Sysadmin Toolbox
- 7 installs
- 82 repo stars
- Updated August 2, 2026
- aaaaqwq/agi-super-skills
sysadmin-toolbox is a Claude Code skill that recommends CLI tools and shell one-liners for sysadmin, DevOps, and security tasks.
About
sysadmin-toolbox is a Claude Code skill that provides tool recommendations and shell one-liners for sysadmin, DevOps, and security work. It maps common operational tasks (network debugging, DNS, SSL/TLS, log analysis, containers) to the right CLI tool and command, drawing from the-book-of-secret-knowledge repository. Reference files auto-refresh weekly from upstream.
- Recommends CLI tools for network, DNS, SSL, logs, and containers
- Provides practical shell one-liners for operational tasks
- References auto-refresh weekly from the-book-of-secret-knowledge repo
Sysadmin Toolbox by the numbers
- 7 all-time installs (skills.sh)
- Ranked #419 of 550 CLI & Terminal skills by installs in the Skillselion catalog
- Data as of Aug 3, 2026 (Skillselion catalog sync)
sysadmin-toolbox capabilities & compatibility
Free; recommends open-source CLI tools and commands.
- Capabilities
- tool discovery · shell oneliners · network debugging · log analysis
- Works with
- docker · kubernetes
- Use cases
- devops · security audit · debugging
- Pricing
- Free
What sysadmin-toolbox says it does
Tool discovery and shell one-liner reference for sysadmin, DevOps, and security tasks.
Source: github.com/trimstray/the-book-of-secret-knowledge
npx skills add https://github.com/aaaaqwq/agi-super-skills --skill sysadmin-toolboxAdd your badge
Show developers this skill is listed on Skillselion. Paste this into your README.
| Installs | 7 |
|---|---|
| repo stars | ★ 82 |
| Last updated | August 2, 2026 |
| Repository | aaaaqwq/agi-super-skills ↗ |
What it does
Use when a developer needs to pick the right CLI tool or shell one-liner for a network, DNS, SSL, log, or container task.
Who is it for?
Choosing the right CLI tool or one-liner for network, DNS, SSL, log, or container troubleshooting.
When should I use this skill?
When the user is troubleshooting networking, DNS, SSL/TLS, logs, or asks what tool to use for an operational task.
What you get
The right CLI tool and shell one-liner recommended for the operational task at hand.
- tool recommendations
- shell one-liners
By the numbers
- 5 reference files: shell-oneliners, cli-tools, web-tools, security-tools, shell-tricks
- References auto-refresh weekly (Sundays 5am ET)
Files
Sysadmin Toolbox
Curated tool recommendations and practical shell one-liners for operational work.
When to Auto-Consult
Load relevant references when user is:
- Debugging network connectivity, ports, traffic
- Troubleshooting DNS or SSL/TLS
- Analyzing processes, memory, disk usage
- Working with logs or system diagnostics
- Writing shell scripts or one-liners
- Asking "what's a good tool for..."
- Doing security audits or pentesting
- Working with containers/Docker/K8s
Reference Files
| File | Use When |
|---|---|
references/shell-oneliners.md | Need practical commands for: terminal, networking, SSL, curl, ssh, tcpdump, git, awk, sed, grep, find |
references/cli-tools.md | Recommending CLI tools: shells, file managers, network utils, databases, security tools |
references/web-tools.md | Web-based tools: SSL checkers, DNS lookup, performance testing, OSINT, scanners |
references/security-tools.md | Pentesting, vulnerability scanning, exploit databases, CTF resources |
references/shell-tricks.md | Shell scripting patterns and tricks |
Quick Tool Index
Network Debugging
mtr- traceroute + ping combinedtcpdump/tshark- packet capturenetstat/ss- connection monitoringnmap- port scanningcurl/httpie- HTTP testing
DNS
dig/host- DNS queriesdnsdiag- DNS diagnosticssubfinder/amass- subdomain enumeration
SSL/TLS
openssl- certificate inspectiontestssl.sh- TLS testingsslyze- SSL scanningcertbot- Let's Encrypt
Process/System
htop/btop- process monitoringstrace/ltrace- syscall/library tracinglsof- open files/connectionsncdu- disk usage
Log Analysis
lnav- log navigatorGoAccess- web log analyzerangle-grinder- log slicing
Containers
dive- Docker image analysisctop- container toplazydocker- Docker TUI
Keeping Current
References auto-refresh weekly (Sundays 5am ET) from the upstream repo:
~/clawd-duke-leto/skills/sysadmin-toolbox/scripts/refresh.shManual refresh anytime:
./scripts/refresh.sh [skill-dir]Example Queries → Actions
"Why is this port not responding?" → Load shell-oneliners.md, search for netstat/ss/lsof commands
"What's a good tool for testing SSL?" → Load cli-tools.md SSL section, recommend testssl.sh or sslyze
"Show me how to find large files" → Load shell-oneliners.md, search for find/ncdu/du commands
"I need to debug DNS resolution" → Load shell-oneliners.md dig section + recommend dnsdiag from cli-tools.md
{
"ownerId": "kn73ft5fmjrf1h9n78fc61tgfs7yp8ez",
"slug": "sysadmin-toolbox",
"version": "1.1.0",
"publishedAt": 1768843243799
}{
"version": 1,
"registry": "https://clawhub.ai",
"slug": "sysadmin-toolbox",
"installedVersion": "1.1.0",
"installedAt": 1770443017465
}
CLI Tools [<sup>[TOC]</sup>](#anger-table-of-contents)
:black_small_square: Shells
<p> <a href="https://www.gnu.org/software/bash/"><b>GNU Bash</b></a> - is an sh-compatible shell that incorporates useful features from the Korn shell and C shell.<br> <a href="https://www.zsh.org/"><b>Zsh</b></a> - is a shell designed for interactive use, although it is also a powerful scripting language.<br> <a href="https://tcl-lang.org/"><b>tclsh</b></a> - is a very powerful cross-platform shell, suitable for a huge range of uses.<br> <a href="https://github.com/Bash-it/bash-it"><b>bash-it</b></a> - is a framework for using, developing and maintaining shell scripts and custom commands.<br> <a href="https://ohmyz.sh/"><b>Oh My ZSH!</b></a> - is the best framework for managing your Zsh configuration.<br> <a href="https://github.com/oh-my-fish/oh-my-fish"><b>Oh My Fish</b></a> - the Fishshell framework.<br> <a href="https://github.com/starship/starship"><b>Starship</b></a> - the cross-shell prompt written in Rust.<br> <a href="https://github.com/romkatv/powerlevel10k"><b>powerlevel10k</b></a> - is a fast reimplementation of Powerlevel9k ZSH theme.<br> </p>
:black_small_square: Shell plugins
<p> <a href="https://github.com/rupa/z"><b>z</b></a> - tracks the folder you use the most and allow you to jump, without having to type the whole path.<br> <a href="https://github.com/junegunn/fzf"><b>fzf</b></a> - is a general-purpose command-line fuzzy finder.<br> <a href="https://github.com/zsh-users/zsh-autosuggestions"><b>zsh-autosuggestions</b></a> - Fish-like autosuggestions for Zsh.<br> <a href="https://github.com/zsh-users/zsh-syntax-highlighting"><b>zsh-syntax-highlighting</b></a> - Fish shell like syntax highlighting for Zsh.<br> <a href="https://github.com/unixorn/awesome-zsh-plugins"><b>Awesome ZSH Plugins</b></a> - A list of frameworks, plugins, themes and tutorials for ZSH.<br> </p>
:black_small_square: Managers
<p> <a href="https://midnight-commander.org/"><b>Midnight Commander</b></a> - is a visual file manager, licensed under GNU General Public License.<br> <a href="https://github.com/ranger/ranger"><b>ranger</b></a> - is a VIM-inspired filemanager for the console.<br> <a href="https://github.com/jarun/nnn"><b>nnn</b></a> - is a tiny, lightning fast, feature-packed file manager.<br> <a href="https://www.gnu.org/software/screen/"><b>screen</b></a> - is a full-screen window manager that multiplexes a physical terminal.<br> <a href="https://github.com/tmux/tmux/wiki"><b>tmux</b></a> - is a terminal multiplexer, lets you switch easily between several programs in one terminal.<br> <a href="https://github.com/peikk0/tmux-cssh"><b>tmux-cssh</b></a> - is a tool to set comfortable and easy to use functionality tmux-sessions.<br> </p>
:black_small_square: Text editors
<p> <a href="http://ex-vi.sourceforge.net/"><b>vi</b></a> - is one of the most common text editors on Unix.<br> <a href="https://www.vim.org/"><b>vim</b></a> - is a highly configurable text editor.<br> <a href="https://www.gnu.org/software/emacs/"><b>emacs</b></a> - is an extensible, customizable, free/libre text editor, and more.<br> <a href="https://github.com/zyedidia/micro"><b>micro</b></a> - is a modern and intuitive terminal-based text editor.<br> <a href="https://neovim.io/"><b>neovim</b></a> - is a free open source, powerful, extensible and usable code editor.<br> <a href="https://www.spacemacs.org/"><b>spacemacs</b></a> - a community-driven Emacs distribution.<br> <a href="https://spacevim.org/"><b>spacevim</b></a> - a community-driven vim distribution.<br> </p>
:black_small_square: Files and directories
<p> <a href="https://github.com/sharkdp/fd"><b>fd</b></a> - is a simple, fast and user-friendly alternative to find.<br> <a href="https://dev.yorhel.nl/ncdu"><b>ncdu</b></a> - is an easy to use, fast disk usage analyzer.<br> </p>
:black_small_square: Network
<p> <a href="https://www.putty.org/"><b>PuTTY</b></a> - is an SSH and telnet client, developed originally by Simon Tatham.<br> <a href="https://mosh.org/"><b>Mosh</b></a> - is a SSH wrapper designed to keep a SSH session alive over a volatile connection.<br> <a href="https://eternalterminal.dev/"><b>Eternal Terminal</b></a> - enables mouse-scrolling and tmux commands inside the SSH session.<br> <a href="https://nmap.org/"><b>nmap</b></a> - is a free and open source (license) utility for network discovery and security auditing.<br> <a href="https://github.com/zmap/zmap"><b>zmap</b></a> - is a fast single packet network scanner designed for Internet-wide network surveys.<br> <a href="https://github.com/RustScan/RustScan"><b>Rust Scan</b></a> - to find all open ports faster than Nmap.<br> <a href="https://github.com/robertdavidgraham/masscan"><b>masscan</b></a> - is the fastest Internet port scanner, spews SYN packets asynchronously.<br> <a href="https://github.com/gvb84/pbscan"><b>pbscan</b></a> - is a faster and more efficient stateless SYN scanner and banner grabber.<br> <a href="http://www.hping.org/"><b>hping</b></a> - is a command-line oriented TCP/IP packet assembler/analyzer.<br> <a href="https://github.com/traviscross/mtr"><b>mtr</b></a> - is a tool that combines the functionality of the 'traceroute' and 'ping' programs in a single tool.<br> <a href="https://github.com/mehrdadrad/mylg"><b>mylg</b></a> - utility which combines the functions of the different network probes in one diagnostic tool.<br> <a href="http://netcat.sourceforge.net/"><b>netcat</b></a> - utility which reads and writes data across network connections, using the TCP/IP protocol.<br> <a href="http://www.dest-unreach.org/socat/"><b>socat</b></a> - utility which transfers data between two objects.<br> <a href="https://www.tcpdump.org/"><b>tcpdump</b></a> - is a powerful command-line packet analyzer.<br> <a href="https://www.wireshark.org/docs/man-pages/tshark.html"><b>tshark</b></a> - is a tool that allows us to dump and analyze network traffic (wireshark cli).<br> <a href="https://termshark.io/"><b>Termshark</b></a> - is a simple terminal user-interface for tshark.<br> <a href="https://github.com/jpr5/ngrep"><b>ngrep</b></a> - is like GNU grep applied to the network layer.<br> <a href="http://netsniff-ng.org/"><b>netsniff-ng</b></a> - is a Swiss army knife for your daily Linux network plumbing if you will.<br> <a href="https://github.com/mechpen/sockdump"><b>sockdump</b></a> - dump unix domain socket traffic.<br> <a href="https://github.com/google/stenographer"><b>stenographer</b></a> - is a packet capture solution which aims to quickly spool all packets to disk.<br> <a href="https://github.com/sachaos/tcpterm"><b>tcpterm</b></a> - visualize packets in TUI.<br> <a href="https://github.com/tgraf/bmon"><b>bmon</b></a> - is a monitoring and debugging tool to capture networking related statistics and prepare them visually.<br> <a href="http://iptraf.seul.org/2.6/manual.html#installation"><b>iptraf-ng</b></a> - is a console-based network monitoring program for Linux that displays information about IP traffic.<br> <a href="https://github.com/vergoh/vnstat"><b>vnstat</b></a> - is a network traffic monitor for Linux and BSD.<br> <a href="https://iperf.fr/"><b>iPerf3</b></a> - is a tool for active measurements of the maximum achievable bandwidth on IP networks.<br> <a href="https://github.com/Microsoft/Ethr"><b>ethr</b></a> - is a Network Performance Measurement Tool for TCP, UDP & HTTP.<br> <a href="https://github.com/jwbensley/Etherate"><b>Etherate</b></a> - is a Linux CLI based Ethernet and MPLS traffic testing tool.<br> <a href="https://github.com/mpolden/echoip"><b>echoip</b></a> - is a IP address lookup service.<br> <a href="https://github.com/troglobit/nemesis"><b>Nemesis</b></a> - packet manipulation CLI tool; craft and inject packets of several protocols.<br> <a href="https://github.com/packetfu/packetfu"><b>packetfu</b></a> - a mid-level packet manipulation library for Ruby.<br> <a href="https://scapy.net/"><b>Scapy</b></a> - packet manipulation library; forge, send, decode, capture packets of a wide number of protocols.<br> <a href="https://github.com/SecureAuthCorp/impacket"><b>impacket</b></a> - is a collection of Python classes for working with network protocols.<br> <a href="https://github.com/arthepsy/ssh-audit"><b>ssh-audit</b></a> - is a tool for SSH server auditing.<br> <a href="https://aria2.github.io/"><b>aria2</b></a> - is a lightweight multi-protocol & multi-source command-line download utility.<br> <a href="https://github.com/x-way/iptables-tracer"><b>iptables-tracer</b></a> - observe the path of packets through the iptables chains.<br> <a href="https://github.com/proabiral/inception"><b>inception</b></a> - a highly configurable tool to check for whatever you like against any number of hosts.<br> <a href="https://mremoteng.org/"><b>mRemoteNG</b></a> - a fork of mRemote, multi-tabbed PuTTy on steroids!<br> </p>
:black_small_square: Network (DNS)
<p> <a href="https://github.com/farrokhi/dnsdiag"><b>dnsdiag</b></a> - is a DNS diagnostics and performance measurement tools.<br> <a href="https://github.com/mschwager/fierce"><b>fierce</b></a> - is a DNS reconnaissance tool for locating non-contiguous IP space.<br> <a href="https://github.com/subfinder/subfinder"><b>subfinder</b></a> - is a subdomain discovery tool that discovers valid subdomains for websites.<br> <a href="https://github.com/aboul3la/Sublist3r"><b>sublist3r</b></a> - is a fast subdomains enumeration tool for penetration testers.<br> <a href="https://github.com/OWASP/Amass"><b>amass</b></a> - is tool that obtains subdomain names by scraping data sources, crawling web archives, and more.<br> <a href="https://github.com/google/namebench"><b>namebench</b></a> - provides personalized DNS server recommendations based on your browsing history.<br> <a href="https://github.com/blechschmidt/massdns"><b>massdns</b></a> - is a high-performance DNS stub resolver for bulk lookups and reconnaissance.<br> <a href="https://github.com/guelfoweb/knock"><b>knock</b></a> - is a tool to enumerate subdomains on a target domain through a wordlist.<br> <a href="https://github.com/DNS-OARC/dnsperf"><b>dnsperf</b></a> - DNS performance testing tools.<br> <a href="https://github.com/jedisct1/dnscrypt-proxy"><b>dnscrypt-proxy 2</b></a> - a flexible DNS proxy, with support for encrypted DNS protocols.<br> <a href="https://github.com/dnsdb/dnsdbq"><b>dnsdbq</b></a> - API client providing access to passive DNS database systems.<br> <a href="https://github.com/looterz/grimd"><b>grimd</b></a> - fast dns proxy, built to black-hole internet advertisements and malware servers.<br> <a href="https://github.com/elceef/dnstwist"><b>dnstwist</b></a> - detect typosquatters, phishing attacks, fraud, and brand impersonation.<br> </p>
:black_small_square: Network (HTTP)
<p> <a href="https://curl.haxx.se/"><b>curl</b></a> - is a command line tool and library for transferring data with URLs.<br> <a href="https://gitlab.com/davidjpeacock/kurly"><b>kurly</b></a> - is an alternative to the widely popular curl program, written in Golang.<br> <a href="https://github.com/jakubroztocil/httpie"><b>HTTPie</b></a> - is an user-friendly HTTP client.<br> <a href="https://github.com/asciimoo/wuzz"><b>wuzz</b></a> - is an interactive cli tool for HTTP inspection.<br> <a href="https://github.com/summerwind/h2spec"><b>h2spec</b></a> - is a conformance testing tool for HTTP/2 implementation.<br> <a href="https://github.com/gildasio/h2t"><b>h2t</b></a> - is a simple tool to help sysadmins to hardening their websites.<br> <a href="https://github.com/trimstray/htrace.sh"><b>htrace.sh</b></a> - is a simple Swiss Army knife for http/https troubleshooting and profiling.<br> <a href="https://github.com/reorx/httpstat"><b>httpstat</b></a> - is a tool that visualizes curl statistics in a way of beauty and clarity.<br> <a href="https://github.com/gchaincl/httplab"><b>httplab</b></a> - is an interactive web server.<br> <a href="https://lynx.browser.org/"><b>Lynx</b></a> - is a text browser for the World Wide Web.<br> <a href="https://github.com/browsh-org/browsh/"><b>Browsh</b></a> - is a fully interactive, real-time, and modern text-based browser.<br> <a href="https://github.com/dhamaniasad/HeadlessBrowsers"><b>HeadlessBrowsers</b></a> - a list of (almost) all headless web browsers in existence.<br> <a href="https://httpd.apache.org/docs/2.4/programs/ab.html"><b>ab</b></a> - is a single-threaded command line tool for measuring the performance of HTTP web servers.<br> <a href="https://www.joedog.org/siege-home/"><b>siege</b></a> - is an http load testing and benchmarking utility.<br> <a href="https://github.com/wg/wrk"><b>wrk</b></a> - is a modern HTTP benchmarking tool capable of generating significant load.<br> <a href="https://github.com/giltene/wrk2"><b>wrk2</b></a> - is a constant throughput, correct latency recording variant of wrk.<br> <a href="https://github.com/tsenart/vegeta"><b>vegeta</b></a> - is a constant throughput, correct latency recording variant of wrk.<br> <a href="https://github.com/codesenberg/bombardier"><b>bombardier</b></a> - is a fast cross-platform HTTP benchmarking tool written in Go.<br> <a href="https://github.com/cmpxchg16/gobench"><b>gobench</b></a> - http/https load testing and benchmarking tool.<br> <a href="https://github.com/rakyll/hey"><b>hey</b></a> - HTTP load generator, ApacheBench (ab) replacement, formerly known as rakyll/boom.<br> <a href="https://github.com/tarekziade/boom"><b>boom</b></a> - is a script you can use to quickly smoke-test your web app deployment.<br> <a href="https://github.com/shekyan/slowhttptest"><b>SlowHTTPTest</b></a> - is a tool that simulates some Application Layer Denial of Service attacks by prolonging HTTP.<br> <a href="https://github.com/OJ/gobuster"><b>gobuster</b></a> - is a free and open source directory/file & DNS busting tool written in Go.<br> <a href="https://github.com/ssllabs/ssllabs-scan"><b>ssllabs-scan</b></a> - command-line reference-implementation client for SSL Labs APIs.<br> <a href="https://github.com/mozilla/http-observatory"><b>http-observatory</b></a> - Mozilla HTTP Observatory cli version.<br> <a href="https://hurl.dev"><b>Hurl</b></a> - is a command line tool to run and test HTTP requests with plain text.<br> </p>
:black_small_square: SSL
<p> <a href="https://www.openssl.org/"><b>openssl</b></a> - is a robust, commercial-grade, and full-featured toolkit for the TLS and SSL protocols.<br> <a href="https://gnutls.org/manual/html_node/gnutls_002dcli-Invocation.html"><b>gnutls-cli</b></a> - client program to set up a TLS connection to some other computer.<br> <a href="https://github.com/nabla-c0d3/sslyze"><b>sslyze </b></a> - fast and powerful SSL/TLS server scanning library.<br> <a href="https://github.com/rbsec/sslscan"><b>sslscan</b></a> - tests SSL/TLS enabled services to discover supported cipher suites.<br> <a href="https://github.com/drwetter/testssl.sh"><b>testssl.sh</b></a> - testing TLS/SSL encryption anywhere on any port.<br> <a href="https://github.com/mozilla/cipherscan"><b>cipherscan</b></a> - a very simple way to find out which SSL ciphersuites are supported by a target.<br> <a href="http://www.tarsnap.com/spiped.html"><b>spiped</b></a> - is a utility for creating symmetrically encrypted and authenticated pipes between socket addresses.<br> <a href="https://github.com/certbot/certbot"><b>Certbot</b></a> - is EFF's tool to obtain certs from Let's Encrypt and (optionally) auto-enable HTTPS on your server.<br> <a href="https://github.com/FiloSottile/mkcert"><b>mkcert</b></a> - simple zero-config tool to make locally trusted development certificates with any names you'd like.<br> <a href="https://github.com/square/certstrap"><b>certstrap</b></a> - tools to bootstrap CAs, certificate requests, and signed certificates.<br> <a href="https://github.com/yassineaboukir/sublert"><b>Sublert</b></a> - is a security and reconnaissance tool to automatically monitor new subdomains.<br> <a href="https://github.com/trimstray/mkchain"><b>mkchain</b></a> - open source tool to help you build a valid SSL certificate chain.<br> <a href="https://github.com/Matty9191/ssl-cert-check"><b>ssl-cert-check</b></a> - SSL Certification Expiration Checker.<br> </p>
:black_small_square: Security
<p> <a href="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/5/html/deployment_guide/ch-selinux"><b>SELinux</b></a> - provides a flexible Mandatory Access Control (MAC) system built into the Linux kernel.<br> <a href="https://wiki.ubuntu.com/AppArmor"><b>AppArmor</b></a> - proactively protects the operating system and applications from external or internal threats.<br> <a href="https://github.com/grapheneX/grapheneX"><b>grapheneX</b></a> - Automated System Hardening Framework.<br> <a href="https://github.com/dev-sec/"><b>DevSec Hardening Framework</b></a> - Security + DevOps: Automatic Server Hardening.<br> </p>
:black_small_square: Auditing Tools
<p> <a href="https://www.ossec.net/"><b>ossec</b></a> - actively monitoring all aspects of system activity with file integrity monitoring.<br> <a href="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security_guide/chap-system_auditing"><b>auditd</b></a> - provides a way to track security-relevant information on your system.<br> <a href="https://www.nongnu.org/tiger/"><b>Tiger</b></a> - is a security tool that can be use both as a security audit and intrusion detection system.<br> <a href="https://cisofy.com/lynis/"><b>Lynis</b></a> - battle-tested security tool for systems running Linux, macOS, or Unix-based operating system.<br> <a href="https://github.com/rebootuser/LinEnum"><b>LinEnum</b></a> - scripted Local Linux Enumeration & Privilege Escalation Checks.<br> <a href="https://github.com/installation/rkhunter"><b>Rkhunter</b></a> - scanner tool for Linux systems that scans backdoors, rootkits and local exploits on your systems.<br> <a href="https://github.com/hasherezade/pe-sieve"><b>PE-sieve</b></a> - is a light-weight tool that helps to detect malware running on the system.<br> <a href="https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite"><b>PEASS</b></a> - privilege escalation tools for Windows and Linux/Unix and MacOS.<br> </p>
:black_small_square: System Diagnostics/Debuggers
<p> <a href="https://github.com/strace/strace"><b>strace</b></a> - diagnostic, debugging and instructional userspace utility for Linux.<br> <a href="http://dtrace.org/blogs/about/"><b>DTrace</b></a> - is a performance analysis and troubleshooting tool.<br> <a href="https://en.wikipedia.org/wiki/Ltrace"><b>ltrace</b></a> - is a library call tracer, used to trace calls made by programs to library functions.<br> <a href="https://github.com/brainsmoke/ptrace-burrito"><b>ptrace-burrito</b></a> - is a friendly wrapper around ptrace.<br> <a href="https://github.com/brendangregg/perf-tools"><b>perf-tools</b></a> - performance analysis tools based on Linux perf_events (aka perf) and ftrace.<br> <a href="https://github.com/iovisor/bpftrace"><b>bpftrace</b></a> - high-level tracing language for Linux eBPF.<br> <a href="https://github.com/draios/sysdig"><b>sysdig</b></a> - system exploration and troubleshooting tool with first class support for containers.<br> <a href="http://www.valgrind.org/"><b>Valgrind</b></a> - is an instrumentation framework for building dynamic analysis tools.<br> <a href="https://github.com/gperftools/gperftools"><b>gperftools</b></a> - high-performance multi-threaded malloc() implementation, plus some performance analysis tools.<br> <a href="https://nicolargo.github.io/glances/"><b>glances</b></a> - cross-platform system monitoring tool written in Python.<br> <a href="https://github.com/hishamhm/htop"><b>htop</b></a> - interactive text-mode process viewer for Unix systems. It aims to be a better 'top'.<br> <a href="https://github.com/aristocratos/bashtop"><b>bashtop</b></a> - Linux resource monitor written in pure Bash.<br> <a href="http://nmon.sourceforge.net/pmwiki.php"><b>nmon</b></a> - a single executable for performance monitoring and data analysis.<br> <a href="https://www.atoptool.nl/"><b>atop</b></a> - ASCII performance monitor. Includes statistics for CPU, memory, disk, swap, network, and processes.<br> <a href="https://en.wikipedia.org/wiki/Lsof"><b>lsof</b></a> - displays in its output information about files that are opened by processes.<br> <a href="http://www.brendangregg.com/flamegraphs.html"><b>FlameGraph</b></a> - stack trace visualizer.<br> <a href="https://github.com/zevv/lsofgraph"><b>lsofgraph</b></a> - convert Unix lsof output to a graph showing FIFO and UNIX interprocess communication.<br> <a href="https://github.com/mozilla/rr"><b>rr</b></a> - is a lightweight tool for recording, replaying and debugging execution of applications.<br> <a href="https://pcp.io/index.html"><b>Performance Co-Pilot</b></a> - a system performance analysis toolkit.<br> <a href="https://github.com/sharkdp/hexyl"><b>hexyl</b></a> - a command-line hex viewer.<br> <a href="https://github.com/p403n1x87/austin"><b>Austin</b></a> - Python frame stack sampler for CPython.<br> </p>
:black_small_square: Log Analyzers
<p> <a href="https://github.com/rcoh/angle-grinder"><b>angle-grinder</b></a> - slice and dice log files on the command line.<br> <a href="https://lnav.org"><b>lnav</b></a> - log file navigator with search and automatic refresh.<br> <a href="https://goaccess.io/"><b>GoAccess</b></a> - real-time web log analyzer and interactive viewer that runs in a terminal.<br> <a href="https://github.com/lebinh/ngxtop"><b>ngxtop</b></a> - real-time metrics for nginx server.<br> </p>
:black_small_square: Databases
<p> <a href="https://github.com/xo/usql"><b>usql</b></a> - universal command-line interface for SQL databases.<br> <a href="https://github.com/dbcli/pgcli"><b>pgcli</b></a> - postgres CLI with autocompletion and syntax highlighting.<br> <a href="https://github.com/dbcli/mycli"><b>mycli</b></a> - terminal client for MySQL with autocompletion and syntax highlighting.<br> <a href="https://github.com/dbcli/litecli"><b>litecli</b></a> - SQLite CLI with autocompletion and syntax highlighting.<br> <a href="https://github.com/dbcli/mssql-cli"><b>mssql-cli</b></a> - SQL Server CLI with autocompletion and syntax highlighting.<br> <a href="https://github.com/osquery/osquery"><b>OSQuery</b></a> - is a SQL powered operating system instrumentation, monitoring, and analytics framework.<br> <a href="https://github.com/ankane/pgsync"><b>pgsync</b></a> - sync data from one Postgres database to another.<br> <a href="https://github.com/laixintao/iredis"><b>iredis</b></a> - a terminal client for redis with autocompletion and syntax highlighting.<br> <a href="https://www.schemacrawler.com/diagramming.html"><b>SchemaCrawler</b></a> - generates an E-R diagram of your database.<br> </p>
:black_small_square: TOR
<p> <a href="https://github.com/GouveaHeitor/nipe"><b>Nipe</b></a> - script to make Tor Network your default gateway.<br> <a href="https://github.com/trimstray/multitor"><b>multitor</b></a> - a tool that lets you create multiple TOR instances with a load-balancing.<br> </p>
:black_small_square: Messengers/IRC Clients
<p> <a href="https://irssi.org"><b>Irssi</b></a> - is a free open source terminal based IRC client.<br> <a href="https://weechat.org/"><b>WeeChat</b></a> - is an extremely extensible and lightweight IRC client.<br> </p>
:black_small_square: Productivity
<p> <a href="https://taskwarrior.org"><b>taskwarrior</b></a> - task management system, todo list <br> </p>
:black_small_square: Other
<p> <a href="https://github.com/skx/sysadmin-util"><b>sysadmin-util</b></a> - tools for Linux/Unix sysadmins.<br> <a href="http://inotify.aiken.cz/"><b>incron</b></a> - is an inode-based filesystem notification technology.<br> <a href="https://github.com/axkibe/lsyncd"><b>lsyncd</b></a> - synchronizes local directories with remote targets (Live Syncing Daemon).<br> <a href="https://github.com/rgburke/grv"><b>GRV</b></a> - is a terminal based interface for viewing Git repositories.<br> <a href="https://jonas.github.io/tig/"><b>Tig</b></a> - text-mode interface for Git.<br> <a href="https://github.com/tldr-pages/tldr"><b>tldr</b></a> - simplified and community-driven man pages.<br> <a href="https://github.com/mholt/archiver"><b>archiver</b></a> - easily create and extract .zip, .tar, .tar.gz, .tar.bz2, .tar.xz, .tar.lz4, .tar.sz, and .rar.<br> <a href="https://github.com/tj/commander.js"><b>commander.js</b></a> - minimal CLI creator in JavaScript.<br> <a href="https://github.com/tomnomnom/gron"><b>gron</b></a> - make JSON greppable!<br> <a href="https://github.com/itchyny/bed"><b>bed</b></a> - binary editor written in Go.<br> </p>
GUI Tools [<sup>[TOC]</sup>](#anger-table-of-contents)
Hacking/Penetration Testing [<sup>[TOC]</sup>](#anger-table-of-contents)
:black_small_square: Pentesters arsenal tools
<p> <a href="http://www.syhunt.com/sandcat/"><b>Sandcat Browser</b></a> - a penetration-oriented browser with plenty of advanced functionality already built in.<br> <a href="https://www.metasploit.com/"><b>Metasploit</b></a> - tool and framework for pentesting system, web and many more.<br> <a href="https://portswigger.net/burp"><b>Burp Suite</b></a> - tool for testing web app security, intercepting proxy to replay, inject, scan and fuzz.<br> <a href="https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project"><b>OWASP Zed Attack Proxy</b></a> - intercepting proxy to replay, inject, scan and fuzz HTTP requests.<br> <a href="http://w3af.org/"><b>w3af</b></a> - is a Web Application Attack and Audit Framework.<br> <a href="https://mitmproxy.org/"><b>mitmproxy</b></a> - an interactive TLS-capable intercepting HTTP proxy for penetration testers.<br> <a href="https://cirt.net/Nikto2"><b>Nikto2</b></a> - web server scanner which performs comprehensive tests against web servers for multiple items.<br> <a href="http://sqlmap.org/"><b>sqlmap</b></a> - tool that automates the process of detecting and exploiting SQL injection flaws.<br> <a href="https://github.com/lanmaster53/recon-ng"><b>Recon-ng</b></a> - is a full-featured Web Reconnaissance framework written in Python.<br> <a href="https://github.com/Tib3rius/AutoRecon"><b>AutoRecon</b></a> - is a network reconnaissance tool which performs automated enumeration of services.<br> <a href="https://www.faradaysec.com/"><b>Faraday</b></a> - an Integrated Multiuser Pentest Environment.<br> <a href="https://github.com/s0md3v/Photon"><b>Photon</b></a> - incredibly fast crawler designed for OSINT.<br> <a href="https://github.com/s0md3v/XSStrike"><b>XSStrike</b></a> - most advanced XSS detection suite.<br> <a href="https://github.com/1N3/Sn1per"><b>Sn1per</b></a> - automated pentest framework for offensive security experts.<br> <a href="https://github.com/future-architect/vuls"><b>vuls</b></a> - is an agent-less vulnerability scanner for Linux, FreeBSD, and other.<br> <a href="https://github.com/google/tsunami-security-scanner"><b>tsunami</b></a> - is a general purpose network security scanner with an extensible plugin system.<br> <a href="https://github.com/michenriksen/aquatone"><b>aquatone</b></a> - a tool for domain flyovers.<br> <a href="https://github.com/GitHackTools/BillCipher"><b>BillCipher</b></a> - information gathering tool for a website or IP address.<br> <a href="https://github.com/Ekultek/WhatWaf"><b>WhatWaf</b></a> - detect and bypass web application firewalls and protection systems.<br> <a href="https://github.com/s0md3v/Corsy"><b>Corsy</b></a> - CORS misconfiguration scanner.<br> <a href="https://github.com/evyatarmeged/Raccoon"><b>Raccoon</b></a> - is a high performance offensive security tool for reconnaissance and vulnerability scanning.<br> <a href="https://github.com/Nekmo/dirhunt"><b>dirhunt</b></a> - find web directories without bruteforce.<br> <a href="https://www.openwall.com/john/"><b>John The Ripper</b></a> - is a fast password cracker, currently available for many flavors of Unix, Windows, and other.<br> <a href="https://hashcat.net/hashcat/"><b>hashcat</b></a> - world's fastest and most advanced password recovery utility.<br> <a href="http://lcamtuf.coredump.cx/p0f3/"><b>p0f</b></a> - is a tool to identify the players behind any incidental TCP/IP communications.<br> <a href="https://github.com/mozilla/ssh_scan"><b>ssh_scan</b></a> - a prototype SSH configuration and policy scanner.<br> <a href="https://github.com/woj-ciech/LeakLooker"><b>LeakLooker</b></a> - find open databases - powered by Binaryedge.io<br> <a href="https://github.com/offensive-security/exploitdb"><b>exploitdb</b></a> - searchable archive from The Exploit Database.<br> <a href="https://github.com/vulnersCom/getsploit"><b>getsploit</b></a> - is a command line utility for searching and downloading exploits.<br> <a href="https://github.com/zardus/ctf-tools"><b>ctf-tools</b></a> - some setup scripts for security research tools.<br> <a href="https://github.com/Gallopsled/pwntools"><b>pwntools</b></a> - CTF framework and exploit development library.<br> <a href="https://github.com/bl4de/security-tools"><b>security-tools</b></a> - collection of small security tools created mostly in Python. CTFs, pentests and so on.<br> <a href="https://github.com/leonteale/pentestpackage"><b>pentestpackage</b></a> - is a package of Pentest scripts.<br> <a href="https://github.com/dloss/python-pentest-tools"><b>python-pentest-tools</b></a> - python tools for penetration testers.<br> <a href="https://github.com/fuzzdb-project/fuzzdb"><b>fuzzdb</b></a> - dictionary of attack patterns and primitives for black-box application fault injection.<br> <a href="https://github.com/google/AFL"><b>AFL</b></a> - is a free software fuzzer maintained by Google.<br> <a href="https://github.com/AFLplusplus/AFLplusplus"><b>AFL++</b></a> - is AFL with community patches.<br> <a href="https://github.com/google/syzkaller"><b>syzkaller</b></a> - is an unsupervised, coverage-guided kernel fuzzer.<br> <a href="https://github.com/pwndbg/pwndbg"><b>pwndbg</b></a> - exploit development and reverse engineering with GDB made easy.<br> <a href="https://github.com/longld/peda"><b>GDB PEDA</b></a> - Python Exploit Development Assistance for GDB.<br> <a href="https://www.hex-rays.com/products/ida/index.shtml"><b>IDA</b></a> - multi-processor disassembler and debugger useful for reverse engineering malware.<br> <a href="https://github.com/radare/radare2"><b>radare2</b></a> - framework for reverse-engineering and analyzing binaries.<br> <a href="https://github.com/threat9/routersploit"><b>routersploit</b></a> - exploitation framework for embedded devices.<br> <a href="https://github.com/NationalSecurityAgency/ghidra"><b>Ghidra</b></a> - is a software reverse engineering (SRE) framework.<br> <a href="https://cutter.re/"><b>Cutter</b></a> - is an SRE platform integrating Ghidra's decompiler.<br> <a href="https://github.com/salesforce/vulnreport"><b>Vulnreport</b></a> - open-source pentesting management and automation platform by Salesforce Product Security.<br> <a href="https://github.com/sc0tfree/mentalist"><b>Mentalist</b></a> - is a graphical tool for custom wordlist generation.<br> <a href="https://github.com/archerysec/archerysec"><b>archerysec</b></a> - vulnerability assessment and management helps to perform scans and manage vulnerabilities.<br> <a href="https://github.com/j3ssie/Osmedeus"><b>Osmedeus</b></a> - fully automated offensive security tool for reconnaissance and vulnerability scanning.<br> <a href="https://github.com/beefproject/beef"><b>beef</b></a> - the browser exploitation framework project.<br> <a href="https://github.com/NullArray/AutoSploit"><b>AutoSploit</b></a> - automated mass exploiter.<br> <a href="https://github.com/TH3xACE/SUDO_KILLER"><b>SUDO_KILLER</b></a> - is a tool to identify and exploit sudo rules' misconfigurations and vulnerabilities.<br> <a href="https://github.com/VirusTotal/yara"><b>yara</b></a> - the pattern matching swiss knife.<br> <a href="https://github.com/gentilkiwi/mimikatz"><b>mimikatz</b></a> - a little tool to play with Windows security.<br> <a href="https://github.com/sherlock-project/sherlock"><b>sherlock</b></a> - hunt down social media accounts by username across social networks.<br> <a href="https://owasp.org/www-project-threat-dragon/"><b>OWASP Threat Dragon</b></a> - is a tool used to create threat model diagrams and to record possible threats.<br> </p>
:black_small_square: Pentests bookmarks collection
<p> <a href="http://www.pentest-standard.org/index.php/Main_Page"><b>PTES</b></a> - the penetration testing execution standard.<br> <a href="https://www.amanhardikar.com/mindmaps/Practice.html"><b>Pentests MindMap</b></a> - amazing mind map with vulnerable apps and systems.<br> <a href="https://www.amanhardikar.com/mindmaps/webapptest.html"><b>WebApps Security Tests MindMap</b></a> - incredible mind map for WebApps security tests.<br> <a href="https://brutelogic.com.br/blog/"><b>Brute XSS</b></a> - master the art of Cross Site Scripting.<br> <a href="https://portswigger.net/web-security/cross-site-scripting/cheat-sheet"><b>XSS cheat sheet</b></a> - contains many vectors that can help you bypass WAFs and filters.<br> <a href="https://jivoi.github.io/2015/07/03/offensive-security-bookmarks/"><b>Offensive Security Bookmarks</b></a> - security bookmarks collection, all things that author need to pass OSCP.<br> <a href="https://github.com/coreb1t/awesome-pentest-cheat-sheets"><b>Awesome Pentest Cheat Sheets</b></a> - collection of the cheat sheets useful for pentesting.<br> <a href="https://github.com/Hack-with-Github/Awesome-Hacking"><b>Awesome Hacking by HackWithGithub</b></a> - awesome lists for hackers, pentesters and security researchers.<br> <a href="https://github.com/carpedm20/awesome-hacking"><b>Awesome Hacking by carpedm20</b></a> - a curated list of awesome hacking tutorials, tools and resources.<br> <a href="https://github.com/vitalysim/Awesome-Hacking-Resources"><b>Awesome Hacking Resources</b></a> - collection of hacking/penetration testing resources to make you better.<br> <a href="https://github.com/enaqx/awesome-pentest"><b>Awesome Pentest</b></a> - collection of awesome penetration testing resources, tools and other shiny things.<br> <a href="https://github.com/m4ll0k/Awesome-Hacking-Tools"><b>Awesome-Hacking-Tools</b></a> - is a curated list of awesome Hacking Tools.<br> <a href="https://github.com/ksanchezcld/Hacking_Cheat_Sheet"><b>Hacking Cheat Sheet</b></a> - author hacking and pentesting notes.<br> <a href="https://github.com/toolswatch/blackhat-arsenal-tools"><b>blackhat-arsenal-tools</b></a> - official Black Hat arsenal security tools repository.<br> <a href="https://www.peerlyst.com/posts/the-complete-list-of-infosec-related-cheat-sheets-claus-cramon"><b>Penetration Testing and WebApp Cheat Sheets</b></a> - the complete list of Infosec related cheat sheets.<br> <a href="https://github.com/The-Art-of-Hacking/h4cker"><b>Cyber Security Resources</b></a> - includes thousands of cybersecurity-related references and resources.<br> <a href="https://github.com/jhaddix/pentest-bookmarks"><b>Pentest Bookmarks</b></a> - there are a LOT of pentesting blogs.<br> <a href="https://github.com/OlivierLaflamme/Cheatsheet-God"><b>Cheatsheet-God</b></a> - Penetration Testing Reference Bank - OSCP/PTP & PTX Cheatsheet.<br> <a href="https://github.com/Cyb3rWard0g/ThreatHunter-Playbook"><b>ThreatHunter-Playbook</b></a> - to aid the development of techniques and hypothesis for hunting campaigns.<br> <a href="https://github.com/hmaverickadams/Beginner-Network-Pentesting"><b>Beginner-Network-Pentesting</b></a> - notes for beginner network pentesting course.<br> <a href="https://github.com/rewardone/OSCPRepo"><b>OSCPRepo</b></a> - is a list of resources that author have been gathering in preparation for the OSCP.<br> <a href="https://github.com/swisskyrepo/PayloadsAllTheThings"><b>PayloadsAllTheThings</b></a> - a list of useful payloads and bypass for Web Application Security and Pentest/CTF.<br> <a href="https://github.com/foospidy/payloads"><b>payloads</b></a> - git all the Payloads! A collection of web attack payloads.<br> <a href="https://github.com/payloadbox/command-injection-payload-list"><b>command-injection-payload-list</b></a> - command injection payload list.<br> <a href="https://github.com/jakejarvis/awesome-shodan-queries"><b>Awesome Shodan Search Queries</b></a> - great search queries to plug into Shodan.<br> <a href="https://github.com/s0md3v/AwesomeXSS"><b>AwesomeXSS</b></a> - is a collection of Awesome XSS resources.<br> <a href="https://github.com/JohnTroony/php-webshells"><b>php-webshells</b></a> - common php webshells.<br> <a href="https://highon.coffee/blog/penetration-testing-tools-cheat-sheet/"><b>Pentesting Tools Cheat Sheet</b></a> - a quick reference high level overview for typical penetration testing.<br> <a href="https://cheatsheetseries.owasp.org/"><b>OWASP Cheat Sheet Series</b></a> - is a collection of high value information on specific application security topics.<br> <a href="https://jeremylong.github.io/DependencyCheck/index.html"><b>OWASP dependency-check</b></a> - is an open source solution the OWASP Top 10 2013 entry.<br> <a href="https://www.owasp.org/index.php/OWASP_Proactive_Controls"><b>OWASP ProActive Controls</b></a> - OWASP Top 10 Proactive Controls 2018.<br> <a href="https://github.com/blaCCkHatHacEEkr/PENTESTING-BIBLE"><b>PENTESTING-BIBLE</b></a> - hacking & penetration testing & red team & cyber security resources.<br> <a href="https://github.com/nixawk/pentest-wiki"><b>pentest-wiki</b></a> - is a free online security knowledge library for pentesters/researchers.<br> <a href="https://media.defcon.org/"><b>DEF CON Media Server</b></a> - great stuff from DEFCON.<br> <a href="https://github.com/rshipp/awesome-malware-analysis"><b>Awesome Malware Analysis</b></a> - a curated list of awesome malware analysis tools and resources.<br> <a href="https://www.netsparker.com/blog/web-security/sql-injection-cheat-sheet/"><b>SQL Injection Cheat Sheet</b></a> - detailed technical stuff about the many different variants of the SQL Injection.<br> <a href="http://kb.entersoft.co.in/"><b>Entersoft Knowledge Base</b></a> - great and detailed reference about vulnerabilities.<br> <a href="http://html5sec.org/"><b>HTML5 Security Cheatsheet</b></a> - a collection of HTML5 related XSS attack vectors.<br> <a href="http://evuln.com/tools/xss-encoder/"><b>XSS String Encoder</b></a> - for generating XSS code to check your input validation filters against XSS.<br> <a href="https://gtfobins.github.io/"><b>GTFOBins</b></a> - list of Unix binaries that can be exploited by an attacker to bypass local security restrictions.<br> <a href="https://guif.re/"><b>Guifre Ruiz Notes</b></a> - collection of security, system, network and pentest cheatsheets.<br> <a href="http://blog.safebuff.com/2016/07/03/SSRF-Tips/index.html"><b>SSRF Tips</b></a> - a collection of SSRF Tips.<br> <a href="http://shell-storm.org/repo/CTF/"><b>shell-storm repo CTF</b></a> - great archive of CTFs.<br> <a href="https://github.com/bl4de/ctf"><b>ctf</b></a> - CTF (Capture The Flag) writeups, code snippets, notes, scripts.<br> <a href="https://github.com/orangetw/My-CTF-Web-Challenges"><b>My-CTF-Web-Challenges</b></a> - collection of CTF Web challenges.<br> <a href="https://github.com/OWASP/owasp-mstg"><b>MSTG</b></a> - The Mobile Security Testing Guide (MSTG) is a comprehensive manual for mobile app security testing.<br> <a href="https://github.com/sdcampbell/Internal-Pentest-Playbook"><b>Internal-Pentest-Playbook</b></a> - notes on the most common things for an Internal Network Penetration Test.<br> <a href="https://github.com/streaak/keyhacks"><b>KeyHacks</b></a> - shows quick ways in which API keys leaked by a bug bounty program can be checked.<br> <a href="https://github.com/securitum/research"><b>securitum/research</b></a> - various Proof of Concepts of security research performed by Securitum.<br> <a href="https://github.com/juliocesarfort/public-pentesting-reports"><b>public-pentesting-reports</b></a> - is a list of public pentest reports released by several consulting security groups.<br> <a href="https://github.com/djadmin/awesome-bug-bounty"><b>awesome-bug-bounty</b></a> - is a comprehensive curated list of available Bug Bounty.<br> <a href="https://github.com/ngalongc/bug-bounty-reference"><b>bug-bounty-reference</b></a> - is a list of bug bounty write-ups.<br> <a href="https://github.com/devanshbatham/Awesome-Bugbounty-Writeups"><b>Awesome-Bugbounty-Writeups</b></a> - is a curated list of bugbounty writeups.<br> <a href="https://pentester.land/list-of-bug-bounty-writeups.html"><b>Bug bounty writeups</b></a> - list of bug bounty writeups (2012-2020).<br> <a href="https://hackso.me/"><b>hackso.me</b></a> - a great journey into security.<br> </p>
:black_small_square: Backdoors/exploits
<p> <a href="https://github.com/bartblaze/PHP-backdoors"><b>PHP-backdoors</b></a> - a collection of PHP backdoors. For educational or testing purposes only.<br> </p>
:black_small_square: Wordlists and Weak passwords
<p> <a href="https://weakpass.com/"><b>Weakpass</b></a> - for any kind of bruteforce find wordlists or unleash the power of them all at once!<br> <a href="https://hashes.org/"><b>Hashes.org</b></a> - is a free online hash resolving service incorporating many unparalleled techniques.<br> <a href="https://github.com/danielmiessler/SecLists"><b>SecLists</b></a> - collection of multiple types of lists used during security assessments, collected in one place.<br> <a href="https://github.com/berzerk0/Probable-Wordlists"><b>Probable-Wordlists</b></a> - sorted by probability originally created for password generation and testing.<br> <a href="https://wiki.skullsecurity.org/index.php?title=Passwords"><b>skullsecurity passwords</b></a> - password dictionaries and leaked passwords repository.<br> <a href="https://bezpieka.org/polski-slownik-premium-polish-wordlist"><b>Polish PREMIUM Dictionary</b></a> - official dictionary created by the team on the forum bezpieka.org.<b>*</b> <sup><a href="https://sourceforge.net/projects/kali-linux/files/Wordlist/">1</sup><br> <a href="https://github.com/insidetrust/statistically-likely-usernames"><b>statistically-likely-usernames</b></a> - wordlists for creating statistically likely username lists.<br> </p>
:black_small_square: Bounty platforms
<p> <a href="https://www.yeswehack.com/"><b>YesWeHack</b></a> - bug bounty platform with infosec jobs.<br> <a href="https://www.openbugbounty.org/"><b>Openbugbounty</b></a> - allows any security researcher reporting a vulnerability on any website.<br> <a href="https://www.hackerone.com/"><b>hackerone</b></a> - global hacker community to surface the most relevant security issues.<br> <a href="https://www.bugcrowd.com/"><b>bugcrowd</b></a> - crowdsourced cybersecurity for the enterprise.<br> <a href="https://crowdshield.com/"><b>Crowdshield</b></a> - crowdsourced security & bug bounty management.<br> <a href="https://www.synack.com/"><b>Synack</b></a> - crowdsourced security & bug bounty programs, crowd security intelligence platform, and more.<br> <a href="https://hacktrophy.com/en/"><b>Hacktrophy</b></a> - bug bounty platform.<br> </p>
:black_small_square: Web Training Apps (local installation)
<p> <a href="https://www.owasp.org/index.php/OWASP_Vulnerable_Web_Applications_Directory_Project"><b>OWASP-VWAD</b></a> - comprehensive and well maintained registry of all known vulnerable web applications.<br> <a href="http://www.dvwa.co.uk/"><b>DVWA</b></a> - PHP/MySQL web application that is damn vulnerable.<br> <a href="https://metasploit.help.rapid7.com/docs/metasploitable-2"><b>metasploitable2</b></a> - vulnerable web application amongst security researchers.<br> <a href="https://github.com/rapid7/metasploitable3"><b>metasploitable3</b></a> - is a VM that is built from the ground up with a large amount of security vulnerabilities.<br> <a href="https://github.com/stamparm/DSVW"><b>DSVW</b></a> - is a deliberately vulnerable web application written in under 100 lines of code.<br> <a href="https://sourceforge.net/projects/mutillidae/"><b>OWASP Mutillidae II</b></a> - free, open source, deliberately vulnerable web-application.<br> <a href="https://www.owasp.org/index.php/OWASP_Juice_Shop_Project"><b>OWASP Juice Shop Project</b></a> - the most bug-free vulnerable application in existence.<br> <a href="https://www.owasp.org/index.php/Projects/OWASP_Node_js_Goat_Project"><b>OWASP Node js Goat Project</b></a> - OWASP Top 10 security risks apply to web apps developed using Node.js.<br> <a href="https://github.com/iteratec/juicy-ctf"><b>juicy-ctf</b></a> - run Capture the Flags and Security Trainings with OWASP Juice Shop.<br> <a href="https://github.com/OWASP/SecurityShepherd"><b>SecurityShepherd</b></a> - web and mobile application security training platform.<br> <a href="https://github.com/opendns/Security_Ninjas_AppSec_Training"><b>Security Ninjas</b></a> - open source application security training program.<br> <a href="https://github.com/rapid7/hackazon"><b>hackazon</b></a> - a modern vulnerable web app.<br> <a href="https://github.com/appsecco/dvna"><b>dvna</b></a> - damn vulnerable NodeJS application.<br> <a href="https://github.com/DefectDojo/django-DefectDojo"><b>django-DefectDojo</b></a> - is an open-source application vulnerability correlation and security orchestration tool.<br> <a href="https://google-gruyere.appspot.com/"><b>Google Gruyere</b></a> - web application exploits and defenses.<br> <a href="https://github.com/amolnaik4/bodhi"><b>Bodhi</b></a> - is a playground focused on learning the exploitation of client-side web vulnerabilities.<br> <a href="https://websploit.h4cker.org/"><b>Websploit</b></a> - single vm lab with the purpose of combining several vulnerable appliations in one environment.<br> <a href="https://github.com/vulhub/vulhub"><b>vulhub</b></a> - pre-built Vulnerable Environments based on docker-compose.<br> <a href="https://rhinosecuritylabs.com/aws/introducing-cloudgoat-2/"><b>CloudGoat 2</b></a> - the new & improved "Vulnerable by Design" AWS deployment tool.<br> <a href="https://github.com/globocom/secDevLabs"><b>secDevLabs</b></a> - is a laboratory for learning secure web development in a practical manner.<br> <a href="https://github.com/incredibleindishell/CORS-vulnerable-Lab"><b>CORS-vulnerable-Lab</b></a> - sample vulnerable code and its exploit code.<br> <a href="https://github.com/moloch--/RootTheBox"><b>RootTheBox</b></a> - a Game of Hackers (CTF Scoreboard & Game Manager).<br> <a href="https://application.security/"><b>KONTRA</b></a> - application security training (OWASP Top Web & Api).<br> </p>
:black_small_square: Labs (ethical hacking platforms/trainings/CTFs)
<p> <a href="https://www.offensive-security.com/"><b>Offensive Security</b></a> - true performance-based penetration testing training for over a decade.<br> <a href="https://www.hackthebox.eu/"><b>Hack The Box</b></a> - online platform allowing you to test your penetration testing skills.<br> <a href="https://www.hacking-lab.com/index.html"><b>Hacking-Lab</b></a> - online ethical hacking, computer network and security challenge platform.<br> <a href="http://pwnable.kr/index.php"><b>pwnable.kr</b></a> - non-commercial wargame site which provides various pwn challenges.<br> <a href="https://pwnable.tw/"><b>Pwnable.tw</b></a> - is a wargame site for hackers to test and expand their binary exploiting skills.<br> <a href="https://picoctf.com/"><b>picoCTF</b></a> - is a free computer security game targeted at middle and high school students.<br> <a href="https://ctflearn.com/"><b>CTFlearn</b></a> - is an online platform built to help ethical hackers learn and practice their cybersecurity knowledge.<br> <a href="https://ctftime.org/"><b>ctftime</b></a> - CTF archive and a place, where you can get some another CTF-related info.<br> <a href="https://silesiasecuritylab.com/"><b>Silesia Security Lab</b></a> - high quality security testing services.<br> <a href="https://practicalpentestlabs.com/"><b>Practical Pentest Labs</b></a> - pentest lab, take your Hacking skills to the next level.<br> <a href="https://www.root-me.org/?lang=en"><b>Root Me</b></a> - the fast, easy, and affordable way to train your hacking skills.<br> <a href="https://rozwal.to/login"><b>rozwal.to</b></a> - a great platform to train your pentesting skills.<br> <a href="https://tryhackme.com/"><b>TryHackMe</b></a> - learning Cyber Security made easy.<br> <a href="https://hackxor.net/"><b>hackxor</b></a> - is a realistic web application hacking game, designed to help players of all abilities develop their skills.<br> <a href="http://hack-yourself-first.com/"><b>Hack Yourself First</b></a> - it's full of nasty app sec holes.<br> <a href="http://overthewire.org/wargames/"><b>OverTheWire</b></a> - can help you to learn and practice security concepts in the form of fun-filled games.<br> <a href="https://labs.wizard-security.net/"><b>Wizard Labs</b></a> - is an online Penetration Testing Lab.<br> <a href="https://pentesterlab.com/"><b>PentesterLab</b></a> - provides vulnerable systems that can be used to test and understand vulnerabilities.<br> <a href="https://ringzer0ctf.com/"><b>RingZer0</b></a> - tons of challenges designed to test and improve your hacking skills.<br> <a href="http://www.try2hack.nl/"><b>try2hack</b></a> - several security-oriented challenges for your entertainment.<br> <a href="https://www.ubeeri.com/preconfig-labs"><b>Ubeeri</b></a> - preconfigured lab environments.<br> <a href="https://lab.pentestit.ru/"><b>Pentestit</b></a> - emulate IT infrastructures of real companies for legal pen testing and improving pentest skills.<br> <a href="https://microcorruption.com/login"><b>Microcorruption</b></a> - reversal challenges done in the web interface.<br> <a href="https://crackmes.one/"><b>Crackmes</b></a> - download crackmes to help improve your reverse engineering skills.<br> <a href="https://domgo.at/cxss/intro"><b>DomGoat</b></a> - DOM XSS security learning and practicing platform.<br> <a href="https://chall.stypr.com"><b>Stereotyped Challenges</b></a> - upgrade your web hacking techniques today!<br> <a href="https://www.vulnhub.com/"><b>Vulnhub</b></a> - allows anyone to gain practical 'hands-on' experience in digital security.<br> <a href="https://w3challs.com/"><b>W3Challs</b></a> - is a penetration testing training platform, which offers various computer challenges.<br> <a href="https://ringzer0ctf.com/challenges"><b>RingZer0 CTF</b></a> - offers you tons of challenges designed to test and improve your hacking skills.<br> <a href="https://hack.me/"><b>Hack.me</b></a> - a platform where you can build, host and share vulnerable web apps for educational purposes.<br> <a href="https://www.hackthis.co.uk/levels/"><b>HackThis!</b></a> - discover how hacks, dumps and defacements are performed and secure your website.<br> <a href="https://www.enigmagroup.org/#"><b>Enigma Group WebApp Training</b></a> - these challenges cover the exploits listed in the OWASP Top 10 Project.<br> <a href="https://challenges.re/"><b>Reverse Engineering Challenges</b></a> - challenges, exercises, problems and tasks - by level, by type, and more.<br> <a href="https://0x00sec.org/"><b>0x00sec</b></a> - the home of the Hacker - Malware, Reverse Engineering, and Computer Science.<br> <a href="https://www.wechall.net/challs"><b>We Chall</b></a> - there are exist a lots of different challenge types.<br> <a href="https://www.hackergateway.com/"><b>Hacker Gateway</b></a> - is the go-to place for hackers who want to test their skills.<br> <a href="https://www.hacker101.com/"><b>Hacker101</b></a> - is a free class for web security.<br> <a href="https://contained.af/"><b>contained.af</b></a> - a stupid game for learning about containers, capabilities, and syscalls.<br> <a href="http://flaws.cloud/"><b>flAWS challenge!</b></a> - a series of levels you'll learn about common mistakes and gotchas when using AWS.<br> <a href="https://cybersecurity.wtf"><b>CyberSec WTF</b></a> - provides web hacking challenges derived from bounty write-ups.<br> <a href="https://ctfchallenge.co.uk/login"><b>CTF Challenge</b></a> - CTF Web App challenges.<br> <a href="https://capturetheflag.withgoogle.com"><b>gCTF</b></a> - most of the challenges used in the Google CTF 2017.<br> <a href="https://www.hackthissite.org/pages/index/index.php"><b>Hack This Site</b></a> - is a free, safe and legal training ground for hackers.<br> <a href="https://attackdefense.com"><b>Attack & Defense</b></a> - is a browser-based cloud labs.<br> <a href="https://cryptohack.org/"><b>Cryptohack</b></a> - a fun platform for learning modern cryptography.<br> <a href="https://cryptopals.com/"><b>Cryptopals</b></a> - the cryptopals crypto challenges.<br> </p>
:black_small_square: CTF platforms
<p> <a href="https://github.com/facebook/fbctf"><b>fbctf</b></a> - platform to host Capture the Flag competitions.<br> <a href="https://github.com/google/ctfscoreboard"><b>ctfscoreboard</b></a> - scoreboard for Capture The Flag competitions.<br> </p>
:black_small_square: Other resources
<p> <a href="https://github.com/bugcrowd/bugcrowd_university"><b>Bugcrowd University</b></a> - open source education content for the researcher community.<br> <a href="https://github.com/rewardone/OSCPRepo"><b>OSCPRepo</b></a> - a list of resources and scripts that I have been gathering in preparation for the OSCP.<br> <a href="https://medium.com/@cxosmo/owasp-top-10-real-world-examples-part-1-a540c4ea2df5"><b>OWASP Top 10: Real-World Examples</b></a> - test your web apps with real-world examples (two-part series).<br> <a href="http://phrack.org/index.html"><b>phrack.org</b></a> - an awesome collection of articles from several respected hackers and other thinkers.<br> <a href="https://github.com/Gr1mmie/Practical-Ethical-Hacking-Resources"><b>Practical-Ethical-Hacking-Resources</b></a> - compilation of resources from TCM's Udemy Course.<br> </p>
Your daily knowledge and news [<sup>[TOC]</sup>](#anger-table-of-contents)
Shell One-liners [<sup>[TOC]</sup>](#anger-table-of-contents)
Table of Contents
- terminal
- busybox
- mount
- fuser
- lsof
- ps
- top
- vmstat
- iostat
- strace
- kill
- find
- diff
- vimdiff
- tail
- cpulimit
- pwdx
- tr
- chmod
- who
- last
- screen
- script
- du
- inotifywait
- openssl
- secure-delete
- dd
- gpg
- system-other
- curl
- httpie
- ssh
- linux-dev
- tcpdump
- tcpick
- ngrep
- hping3
- nmap
- netcat
- socat
- p0f
- gnutls-cli
- netstat
- rsync
- host
- dig
- certbot
- network-other
- git
- awk
- sed
- grep
- perl
Tool: terminal
Reload shell without exit
exec $SHELL -lClose shell keeping all subprocess running
disown -a && exitExit without saving shell history
kill -9 $$
unset HISTFILE && exitPerform a branching conditional
true && echo success
false || echo failedPipe stdout and stderr to separate commands
some_command > >(/bin/cmd_for_stdout) 2> >(/bin/cmd_for_stderr)Redirect stdout and stderr each to separate files and print both to the screen
(some_command 2>&1 1>&3 | tee errorlog ) 3>&1 1>&2 | tee stdoutlogList of commands you use most often
history | \
awk '{CMD[$2]++;count++;}END { for (a in CMD)print CMD[a] " " CMD[a]/count*100 "% " a;}' | \
grep -v "./" | \
column -c3 -s " " -t | \
sort -nr | nl | head -n 20Sterilize bash history
function sterile() {
history | awk '$2 != "history" { $1=""; print $0 }' | egrep -vi "\
curl\b+.*(-E|--cert)\b+.*\b*|\
curl\b+.*--pass\b+.*\b*|\
curl\b+.*(-U|--proxy-user).*:.*\b*|\
curl\b+.*(-u|--user).*:.*\b*
.*(-H|--header).*(token|auth.*)\b+.*|\
wget\b+.*--.*password\b+.*\b*|\
http.?://.+:.+@.*\
" > $HOME/histbuff; history -r $HOME/histbuff;
}
export PROMPT_COMMAND="sterile"Look also: A naive utility to censor credentials in command history.
Quickly backup a file
cp filename{,.orig}Empty a file (truncate to 0 size)
>filenameDelete all files in a folder that don't match a certain file extension
rm !(*.foo|*.bar|*.baz)Pass multi-line string to a file
# cat >filename ... - overwrite the file
# cat >>filename ... - append to a file
cat > filename << __EOF__
data data data
__EOF__Edit a file on a remote host using vim
vim scp://user@host//etc/fstabCreate a directory and change into it at the same time
mkd() { mkdir -p "$@" && cd "$@"; }Convert uppercase files to lowercase files
rename 'y/A-Z/a-z/' *Print a row of characters across the terminal
printf "%`tput cols`s" | tr ' ' '#'Show shell history without line numbers
history | cut -c 8-
fc -l -n 1 | sed 's/^\s*//'Run command(s) after exit session
cat > /etc/profile << __EOF__
_after_logout() {
username=$(whoami)
for _pid in $(ps afx | grep sshd | grep "$username" | awk '{print $1}') ; do
kill -9 $_pid
done
}
trap _after_logout EXIT
__EOF__Generate a sequence of numbers
for ((i=1; i<=10; i+=2)) ; do echo $i ; done
# alternative: seq 1 2 10
for ((i=5; i<=10; ++i)) ; do printf '%02d\n' $i ; done
# alternative: seq -w 5 10
for i in {1..10} ; do echo $i ; doneSimple Bash filewatching
unset MAIL; export MAILCHECK=1; export MAILPATH='$FILE_TO_WATCH?$MESSAGE'---
Tool: busybox
Static HTTP web server
busybox httpd -p $PORT -h $HOME [-c httpd.conf]___
Tool: mount)
Mount a temporary ram partition
mount -t tmpfs tmpfs /mnt -o size=64M-t- filesystem type-o- mount options
Remount a filesystem as read/write
mount -o remount,rw /___
Tool: fuser)
Show which processes use the files/directories
fuser /var/log/daemon.log
fuser -v /home/supervisorKills a process that is locking a file
fuser -ki filename-i- interactive option
Kills a process that is locking a file with specific signal
fuser -k -HUP filename--list-signals- list available signal names
Show what PID is listening on specific port
fuser -v 53/udpShow all processes using the named filesystems or block device
fuser -mv /var/www___
Tool: lsof
Show process that use internet connection at the moment
lsof -P -i -nShow process that use specific port number
lsof -i tcp:443Lists all listening ports together with the PID of the associated process
lsof -Pan -i tcp -i udpList all open ports and their owning executables
lsof -i -P | grep -i "listen"Show all open ports
lsof -Pnl -iShow open ports (LISTEN)
lsof -Pni4 | grep LISTEN | column -tList all files opened by a particular command
lsof -c "process"View user activity per directory
lsof -u username -a +D /etcShow 10 largest open files
lsof / | \
awk '{ if($7 > 1048576) print $7/1048576 "MB" " " $9 " " $1 }' | \
sort -n -u | tail | column -tShow current working directory of a process
lsof -p <PID> | grep cwd___
Tool: ps)
Show a 4-way scrollable process tree with full details
ps awwfux | less -SProcesses per user counter
ps hax -o user | sort | uniq -c | sort -rShow all processes by name with main header
ps -lfC nginx___
Tool: find)
Find files that have been modified on your system in the past 60 minutes
find / -mmin 60 -type fFind all files larger than 20M
find / -type f -size +20MFind duplicate files (based on MD5 hash)
find -type f -exec md5sum '{}' ';' | sort | uniq --all-repeated=separate -w 33Change permission only for files
cd /var/www/site && find . -type f -exec chmod 766 {} \;
cd /var/www/site && find . -type f -exec chmod 664 {} +Change permission only for directories
cd /var/www/site && find . -type d -exec chmod g+x {} \;
cd /var/www/site && find . -type d -exec chmod g+rwx {} +Find files and directories for specific user/group
# User:
find . -user <username> -print
find /etc -type f -user <username> -name "*.conf"
# Group:
find /opt -group <group>
find /etc -type f -group <group> -iname "*.conf"Find files and directories for all without specific user/group
# User:
find . \! -user <username> -print
# Group:
find . \! -group <group>Looking for files/directories that only have certain permission
# User
find . -user <username> -perm -u+rw # -rw-r--r--
find /home -user $(whoami) -perm 777 # -rwxrwxrwx
# Group:
find /home -type d -group <group> -perm 755 # -rwxr-xr-xDelete older files than 60 days
find . -type f -mtime +60 -deleteRecursively remove all empty sub-directories from a directory
find . -depth -type d -empty -exec rmdir {} \;How to find all hard links to a file
find </path/to/dir> -xdev -samefile filenameRecursively find the latest modified files
find . -type f -exec stat --format '%Y :%y %n' "{}" \; | sort -nr | cut -d: -f2- | headRecursively find/replace of a string with sed
find . -not -path '*/\.git*' -type f -print0 | xargs -0 sed -i 's/foo/bar/g'Recursively find/replace of a string in directories and file names
find . -depth -name '*test*' -execdir bash -c 'mv -v "$1" "${1//foo/bar}"' _ {} \;Recursively find suid executables
find / \( -perm -4000 -o -perm -2000 \) -type f -exec ls -la {} \;___
Tool: top)
Use top to monitor only all processes with the specific string
top -p $(pgrep -d , <str>)<str>- process containing string (eg. nginx, worker)
___
Tool: vmstat
Show current system utilization (fields in kilobytes)
vmstat 2 20 -t -w2- number of times with a defined time interval (delay)20- each execution of the command (count)-t- show timestamp-w- wide output-S M- output of the fields in megabytes instead of kilobytes
Show current system utilization will get refreshed every 5 seconds
vmstat 5 -wDisplay report a summary of disk operations
vmstat -DDisplay report of event counters and memory stats
vmstat -sDisplay report about kernel objects stored in slab layer cache
vmstat -mTool: iostat
Show information about the CPU usage, and I/O statistics about all the partitions
iostat 2 10 -t -m2- number of times with a defined time interval (delay)10- each execution of the command (count)-t- show timestamp-m- fields in megabytes (-k- in kilobytes, default)
Show information only about the CPU utilization
iostat 2 10 -t -m -cShow information only about the disk utilization
iostat 2 10 -t -m -dShow information only about the LVM utilization
iostat -N___
Tool: strace
Track with child processes
# 1)
strace -f -p $(pidof glusterfsd)
# 2)
strace -f $(pidof php-fpm | sed 's/\([0-9]*\)/\-p \1/g')Track process with 30 seconds limit
timeout 30 strace $(< /var/run/zabbix/zabbix_agentd.pid)Track processes and redirect output to a file
ps auxw | grep '[a]pache' | awk '{print " -p " $2}' | \
xargs strace -o /tmp/strace-apache-proc.outTrack with print time spent in each syscall and limit length of print strings
ps auxw | grep '[i]init_policy' | awk '{print " -p " $2}' | \
xargs strace -f -e trace=network -T -s 10000Track the open request of a network port
strace -f -e trace=bind nc -l 80Track the open request of a network port (show TCP/UDP)
strace -f -e trace=network nc -lu 80___
Tool: kill)
Kill a process running on port
kill -9 $(lsof -i :<port> | awk '{l=$2} END {print l}')___
Tool: diff
Compare two directory trees
diff <(cd directory1 && find | sort) <(cd directory2 && find | sort)Compare output of two commands
diff <(cat /etc/passwd) <(cut -f2 /etc/passwd)___
Tool: vimdiff
Highlight the exact differences, based on characters and words
vimdiff file1 file2Compare two JSON files
vimdiff <(jq -S . A.json) <(jq -S . B.json)Compare Hex dump
d(){ vimdiff <(f $1) <(f $2);};f(){ hexdump -C $1 | cut -d' ' -f3- | tr -s ' ';}; d ~/bin1 ~/bin2diffchar
Save diffchar @ ~/.vim/plugins
Click F7 to switch between diff modes
Usefull vimdiff commands:
qato exit all windows:vertical resize 70to resize window- set window width
Ctrl+W [N columns]+(Shift+)<\>
___
Tool: tail)
Annotate tail -f with timestamps
tail -f file | while read ; do echo "$(date +%T.%N) $REPLY" ; doneAnalyse an Apache access log for the most common IP addresses
tail -10000 access_log | awk '{print $1}' | sort | uniq -c | sort -n | tailAnalyse web server log and show only 5xx http codes
tail -n 100 -f /path/to/logfile | grep "HTTP/[1-2].[0-1]\" [5]"___
Tool: tar)
System backup with exclude specific directories
cd /
tar -czvpf /mnt/system$(date +%d%m%Y%s).tgz --directory=/ \
--exclude=proc/* --exclude=sys/* --exclude=dev/* --exclude=mnt/* .System backup with exclude specific directories (pigz)
cd /
tar cvpf /backup/snapshot-$(date +%d%m%Y%s).tgz --directory=/ \
--exclude=proc/* --exclude=sys/* --exclude=dev/* \
--exclude=mnt/* --exclude=tmp/* --use-compress-program=pigz .___
Tool: dump)
System backup to file
dump -y -u -f /backup/system$(date +%d%m%Y%s).lzo /Restore system from lzo file
cd /
restore -rf /backup/system$(date +%d%m%Y%s).lzo___
Tool: cpulimit
Limit the cpu usage of a process
cpulimit -p pid -l 50___
Tool: pwdx
Show current working directory of a process
pwdx <pid>___
Tool: taskset
Start a command on only one CPU core
taskset -c 0 <command>___
Tool: tr)
Show directories in the PATH, one per line
tr : '\n' <<<$PATH___
Tool: chmod
Remove executable bit from all files in the current directory
chmod -R -x+X *Restore permission for /bin/chmod
# 1:
cp /bin/ls chmod.01
cp /bin/chmod chmod.01
./chmod.01 700 file
# 2:
/bin/busybox chmod 0700 /bin/chmod
# 3:
setfacl --set u::rwx,g::---,o::--- /bin/chmod___
Tool: who)
Find last reboot time
who -bDetect a user sudo-su'd into the current shell
[[ $(who -m | awk '{ print $1 }') == $(whoami) ]] || echo "You are su-ed to $(whoami)"___
Tool: last
Was the last reboot a panic?
(last -x -f $(ls -1t /var/log/wtmp* | head -2 | tail -1); last -x -f /var/log/wtmp) | \
grep -A1 reboot | head -2 | grep -q shutdown && echo "Expected reboot" || echo "Panic reboot"___
Tool: screen
Start screen in detached mode
screen -d -m <command>Attach to an existing screen session
screen -r -d <pid>___
Tool: script)
Record and replay terminal session
### Record session
# 1)
script -t 2>~/session.time -a ~/session.log
# 2)
script --timing=session.time session.log
### Replay session
scriptreplay --timing=session.time session.log___
Tool: du
Show 20 biggest directories with 'K M G'
du | \
sort -r -n | \
awk '{split("K M G",v); s=1; while($1>1024){$1/=1024; s++} print int($1)" "v[s]"\t"$2}' | \
head -n 20___
Tool: inotifywait
Init tool everytime a file in a directory is modified
while true ; do inotifywait -r -e MODIFY dir/ && ls dir/ ; done;___
Tool: openssl
Testing connection to the remote host
echo | openssl s_client -connect google.com:443 -showcertsTesting connection to the remote host (debug mode)
echo | openssl s_client -connect google.com:443 -showcerts -tlsextdebug -statusTesting connection to the remote host (with SNI support)
echo | openssl s_client -showcerts -servername google.com -connect google.com:443Testing connection to the remote host with specific ssl version
openssl s_client -tls1_2 -connect google.com:443Testing connection to the remote host with specific ssl cipher
openssl s_client -cipher 'AES128-SHA' -connect google.com:443Verify 0-RTT
_host="example.com"
cat > req.in << __EOF__
HEAD / HTTP/1.1
Host: $_host
Connection: close
__EOF__
openssl s_client -connect ${_host}:443 -tls1_3 -sess_out session.pem -ign_eof < req.in
openssl s_client -connect ${_host}:443 -tls1_3 -sess_in session.pem -early_data req.inGenerate private key without passphrase
# _len: 2048, 4096
( _fd="private.key" ; _len="2048" ; \
openssl genrsa -out ${_fd} ${_len} )Generate private key with passphrase
# _ciph: aes128, aes256
# _len: 2048, 4096
( _ciph="aes128" ; _fd="private.key" ; _len="2048" ; \
openssl genrsa -${_ciph} -out ${_fd} ${_len} )Remove passphrase from private key
( _fd="private.key" ; _fd_unp="private_unp.key" ; \
openssl rsa -in ${_fd} -out ${_fd_unp} )Encrypt existing private key with a passphrase
# _ciph: aes128, aes256
( _ciph="aes128" ; _fd="private.key" ; _fd_pass="private_pass.key" ; \
openssl rsa -${_ciph} -in ${_fd} -out ${_fd_pass}Check private key
( _fd="private.key" ; \
openssl rsa -check -in ${_fd} )Get public key from private key
( _fd="private.key" ; _fd_pub="public.key" ; \
openssl rsa -pubout -in ${_fd} -out ${_fd_pub} )Generate private key and CSR
( _fd="private.key" ; _fd_csr="request.csr" ; _len="2048" ; \
openssl req -out ${_fd_csr} -new -newkey rsa:${_len} -nodes -keyout ${_fd} )Generate CSR
( _fd="private.key" ; _fd_csr="request.csr" ; \
openssl req -out ${_fd_csr} -new -key ${_fd} )Generate CSR (metadata from existing certificate)
Where private.key is the existing private key. As you can see you do not generate this CSR from your certificate (public key). Also you do not generate the "same" CSR, just a new one to request a new certificate.( _fd="private.key" ; _fd_csr="request.csr" ; _fd_crt="cert.crt" ; \
openssl x509 -x509toreq -in ${_fd_crt} -out ${_fd_csr} -signkey ${_fd} )Generate CSR with -config param
( _fd="private.key" ; _fd_csr="request.csr" ; \
openssl req -new -sha256 -key ${_fd} -out ${_fd_csr} \
-config <(
cat << __EOF__
[req]
default_bits = 2048
default_md = sha256
prompt = no
distinguished_name = dn
req_extensions = req_ext
[ dn ]
C = "<two-letter ISO abbreviation for your country>"
ST = "<state or province where your organisation is legally located>"
L = "<city where your organisation is legally located>"
O = "<legal name of your organisation>"
OU = "<section of the organisation>"
CN = "<fully qualified domain name>"
[ req_ext ]
subjectAltName = @alt_names
[ alt_names ]
DNS.1 = <fully qualified domain name>
DNS.2 = <next domain>
DNS.3 = <next domain>
__EOF__
))Other values in [ dn ]:
countryName = "DE" # C=
stateOrProvinceName = "Hessen" # ST=
localityName = "Keller" # L=
postalCode = "424242" # L/postalcode=
postalAddress = "Keller" # L/postaladdress=
streetAddress = "Crater 1621" # L/street=
organizationName = "apfelboymschule" # O=
organizationalUnitName = "IT Department" # OU=
commonName = "example.com" # CN=
emailAddress = "webmaster@example.com" # CN/emailAddress=Example of oids (you'll probably also have to make OpenSSL know about the new fields required for EV by adding the following under [new_oids]):
[req]
...
oid_section = new_oids
[ new_oids ]
postalCode = 2.5.4.17
streetAddress = 2.5.4.9Full example:
( _fd="private.key" ; _fd_csr="request.csr" ; \
openssl req -new -sha256 -key ${_fd} -out ${_fd_csr} \
-config <(
cat << __EOF__
[req]
default_bits = 2048
default_md = sha256
prompt = no
distinguished_name = dn
req_extensions = req_ext
oid_section = new_oids
[ new_oids ]
serialNumber = 2.5.4.5
streetAddress = 2.5.4.9
postalCode = 2.5.4.17
businessCategory = 2.5.4.15
[ dn ]
serialNumber=00001111
businessCategory=Private Organization
jurisdictionC=DE
C=DE
ST=Hessen
L=Keller
postalCode=424242
streetAddress=Crater 1621
O=AV Company
OU=IT
CN=example.com
[ req_ext ]
subjectAltName = @alt_names
[ alt_names ]
DNS.1 = example.com
__EOF__
))For more information please look at these great explanations:
- RFC 5280
- How to create multidomain certificates using config files
- Generate a multi domains certificate using config files
- Your OpenSSL CSR command is out of date
- OpenSSL example configuration file
- Object Identifiers (OIDs)
- openssl objects.txt
List available EC curves
openssl ecparam -list_curvesPrint ECDSA private and public keys
( _fd="private.key" ; \
openssl ec -in ${_fd} -noout -text )
# For x25519 only extracting public key
( _fd="private.key" ; _fd_pub="public.key" ; \
openssl pkey -in ${_fd} -pubout -out ${_fd_pub} )Generate ECDSA private key
# _curve: prime256v1, secp521r1, secp384r1
( _fd="private.key" ; _curve="prime256v1" ; \
openssl ecparam -out ${_fd} -name ${_curve} -genkey )
# _curve: X25519
( _fd="private.key" ; _curve="x25519" ; \
openssl genpkey -algorithm ${_curve} -out ${_fd} )Generate private key and CSR (ECC)
# _curve: prime256v1, secp521r1, secp384r1
( _fd="domain.com.key" ; _fd_csr="domain.com.csr" ; _curve="prime256v1" ; \
openssl ecparam -out ${_fd} -name ${_curve} -genkey ; \
openssl req -new -key ${_fd} -out ${_fd_csr} -sha256 )Generate self-signed certificate
# _len: 2048, 4096
( _fd="domain.key" ; _fd_out="domain.crt" ; _len="2048" ; _days="365" ; \
openssl req -newkey rsa:${_len} -nodes \
-keyout ${_fd} -x509 -days ${_days} -out ${_fd_out} )Generate self-signed certificate from existing private key
# _len: 2048, 4096
( _fd="domain.key" ; _fd_out="domain.crt" ; _days="365" ; \
openssl req -key ${_fd} -nodes \
-x509 -days ${_days} -out ${_fd_out} )Generate self-signed certificate from existing private key and csr
# _len: 2048, 4096
( _fd="domain.key" ; _fd_csr="domain.csr" ; _fd_out="domain.crt" ; _days="365" ; \
openssl x509 -signkey ${_fd} -nodes \
-in ${_fd_csr} -req -days ${_days} -out ${_fd_out} )Generate DH public parameters
( _dh_size="2048" ; \
openssl dhparam -out /etc/nginx/ssl/dhparam_${_dh_size}.pem "$_dh_size" )Display DH public parameters
openssl pkeyparam -in dhparam.pem -textExtract private key from pfx
( _fd_pfx="cert.pfx" ; _fd_key="key.pem" ; \
openssl pkcs12 -in ${_fd_pfx} -nocerts -nodes -out ${_fd_key} )Extract private key and certs from pfx
( _fd_pfx="cert.pfx" ; _fd_pem="key_certs.pem" ; \
openssl pkcs12 -in ${_fd_pfx} -nodes -out ${_fd_pem} )Extract certs from p7b
# PKCS#7 file doesn't include private keys.
( _fd_p7b="cert.p7b" ; _fd_pem="cert.pem" ; \
openssl pkcs7 -inform DER -outform PEM -in ${_fd_p7b} -print_certs > ${_fd_pem})
# or:
openssl pkcs7 -print_certs -in -in ${_fd_p7b} -out ${_fd_pem})Convert DER to PEM
( _fd_der="cert.crt" ; _fd_pem="cert.pem" ; \
openssl x509 -in ${_fd_der} -inform der -outform pem -out ${_fd_pem} )Convert PEM to DER
( _fd_der="cert.crt" ; _fd_pem="cert.pem" ; \
openssl x509 -in ${_fd_pem} -outform der -out ${_fd_der} )Verification of the private key
( _fd="private.key" ; \
openssl rsa -noout -text -in ${_fd} )Verification of the public key
# 1)
( _fd="public.key" ; \
openssl pkey -noout -text -pubin -in ${_fd} )
# 2)
( _fd="private.key" ; \
openssl rsa -inform PEM -noout -in ${_fd} &> /dev/null ; \
if [ $? = 0 ] ; then echo -en "OK\n" ; fi )Verification of the certificate
( _fd="certificate.crt" ; # format: pem, cer, crt \
openssl x509 -noout -text -in ${_fd} )Verification of the CSR
( _fd_csr="request.csr" ; \
openssl req -text -noout -in ${_fd_csr} )Check the private key and the certificate are match
(openssl rsa -noout -modulus -in private.key | openssl md5 ; \
openssl x509 -noout -modulus -in certificate.crt | openssl md5) | uniqCheck the private key and the CSR are match
(openssl rsa -noout -modulus -in private.key | openssl md5 ; \
openssl req -noout -modulus -in request.csr | openssl md5) | uniq___
Tool: secure-delete
Secure delete with shred
shred -vfuz -n 10 file
shred --verbose --random-source=/dev/urandom -n 1 /dev/sdaSecure delete with scrub
scrub -p dod /dev/sda
scrub -p dod -r fileSecure delete with badblocks
badblocks -s -w -t random -v /dev/sda
badblocks -c 10240 -s -w -t random -v /dev/sdaSecure delete with secure-delete
srm -vz /tmp/file
sfill -vz /local
sdmem -v
swapoff /dev/sda5 && sswap -vz /dev/sda5___
Tool: dd)
Show dd status every so often
dd <dd_params> status=progress
watch --interval 5 killall -USR1 ddRedirect output to a file with dd
echo "string" | dd of=filename___
Tool: gpg
Export public key
gpg --export --armor "<username>" > username.pkey--export- export all keys from all keyrings or specific key-a|--armor- create ASCII armored output
Encrypt file
gpg -e -r "<username>" dump.sql-e|--encrypt- encrypt data-r|--recipient- encrypt for specific <username>
Decrypt file
gpg -o dump.sql -d dump.sql.gpg-o|--output- use as output file-d|--decrypt- decrypt data (default)
Search recipient
gpg --keyserver hkp://keyserver.ubuntu.com --search-keys "<username>"--keyserver- set specific key server--search-keys- search for keys on a key server
List all of the packets in an encrypted file
gpg --batch --list-packets archive.gpg
gpg2 --batch --list-packets archive.gpg___
Tool: system-other
Reboot system from init
exec /sbin/init 6Init system from single user mode
exec /sbin/initShow current working directory of a process
readlink -f /proc/<PID>/cwdShow actual pathname of the executed command
readlink -f /proc/<PID>/exeTool: curl
curl -Iks https://www.google.com-I- show response headers only-k- insecure connection when using ssl-s- silent mode (not display body)
curl -Iks --location -X GET -A "x-agent" https://www.google.com--location- follow redirects-X- set method-A- set user-agent
curl -Iks --location -X GET -A "x-agent" --proxy http://127.0.0.1:16379 https://www.google.com--proxy [socks5://|http://]- set proxy server
curl -o file.pdf -C - https://example.com/Aiju2goo0Ja2.pdf-o- write output to file-C- resume the transfer
Find your external IP address (external services)
curl ipinfo.io
curl ipinfo.io/ip
curl icanhazip.com
curl ifconfig.me/ip ; echoRepeat URL request
# URL sequence substitution with a dummy query string:
curl -ks https://example.com/?[1-20]
# With shell 'for' loop:
for i in {1..20} ; do curl -ks https://example.com/ ; doneCheck DNS and HTTP trace with headers for specific domains
### Set domains and external dns servers.
_domain_list=(google.com) ; _dns_list=("8.8.8.8" "1.1.1.1")
for _domain in "${_domain_list[@]}" ; do
printf '=%.0s' {1..48}
echo
printf "[\\e[1;32m+\\e[m] resolve: %s\\n" "$_domain"
for _dns in "${_dns_list[@]}" ; do
# Resolve domain.
host "${_domain}" "${_dns}"
echo
done
for _proto in http https ; do
printf "[\\e[1;32m+\\e[m] trace + headers: %s://%s\\n" "$_proto" "$_domain"
# Get trace and http headers.
curl -Iks -A "x-agent" --location "${_proto}://${_domain}"
echo
done
done
unset _domain_list _dns_list___
Tool: httpie
http -p Hh https://www.google.com-p- print request and response headersH- request headersB- request bodyh- response headersb- response body
http -p Hh https://www.google.com --follow --verify no-F, --follow- follow redirects--verify no- skip SSL verification
http -p Hh https://www.google.com --follow --verify no \
--proxy http:http://127.0.0.1:16379--proxy [http:]- set proxy server
Tool: ssh
Escape Sequence
# Supported escape sequences:
~. - terminate connection (and any multiplexed sessions)
~B - send a BREAK to the remote system
~C - open a command line
~R - Request rekey (SSH protocol 2 only)
~^Z - suspend ssh
~# - list forwarded connections
~& - background ssh (when waiting for connections to terminate)
~? - this message
~~ - send the escape character by typing it twiceCompare a remote file with a local file
ssh user@host cat /path/to/remotefile | diff /path/to/localfile -SSH connection through host in the middle
ssh -t reachable_host ssh unreachable_hostRun command over SSH on remote host
cat > cmd.txt << __EOF__
cat /etc/hosts
__EOF__
ssh host -l user $(<cmd.txt)Get public key from private key
ssh-keygen -y -f ~/.ssh/id_rsaGet all fingerprints
ssh-keygen -l -f .ssh/known_hostsSSH authentication with user password
ssh -o PreferredAuthentications=password -o PubkeyAuthentication=no user@remote_hostSSH authentication with publickey
ssh -o PreferredAuthentications=publickey -o PubkeyAuthentication=yes -i id_rsa user@remote_hostSimple recording SSH session
function _ssh_sesslog() {
_sesdir="<path/to/session/logs>"
mkdir -p "${_sesdir}" && \
ssh $@ 2>&1 | tee -a "${_sesdir}/$(date +%Y%m%d).log"
}
# Alias:
alias ssh='_ssh_sesslog'Using Keychain for SSH logins
### Delete all of ssh-agent's keys.
function _scl() {
/usr/bin/keychain --clear
}
### Add key to keychain.
function _scg() {
/usr/bin/keychain /path/to/private-key
source "$HOME/.keychain/$HOSTNAME-sh"
}SSH login without processing any login scripts
ssh -tt user@host bashSSH local port forwarding
Example 1:
# Forwarding our local 2250 port to nmap.org:443 from localhost through localhost
host1> ssh -L 2250:nmap.org:443 localhost
# Connect to the service:
host1> curl -Iks --location -X GET https://localhost:2250Example 2:
# Forwarding our local 9051 port to db.d.x:5432 from localhost through node.d.y
host1> ssh -nNT -L 9051:db.d.x:5432 node.d.y
# Connect to the service:
host1> psql -U db_user -d db_dev -p 9051 -h localhost-n- redirects stdin from/dev/null-N- do not execute a remote command-T- disable pseudo-terminal allocation
SSH remote port forwarding
# Forwarding our local 9051 port to db.d.x:5432 from host2 through node.d.y
host1> ssh -nNT -R 9051:db.d.x:5432 node.d.y
# Connect to the service:
host2> psql -U postgres -d postgres -p 8000 -h localhost___
Tool: linux-dev
Testing remote connection to port
timeout 1 bash -c "</dev/<proto>/<host>/<port>" >/dev/null 2>&1 ; echo $?<proto- set protocol (tcp/udp)<host>- set remote host<port>- set destination port
Read and write to TCP or UDP sockets with common bash tools
exec 5<>/dev/tcp/<host>/<port>; cat <&5 & cat >&5; exec 5>&-___
Tool: tcpdump
Filter incoming (on interface) traffic (specific <ip:port>)
tcpdump -ne -i eth0 -Q in host 192.168.252.1 and port 443-n- don't convert addresses (-nnwill not resolve hostnames or ports)-e- print the link-level headers-i [iface|any]- set interface-Q|-D [in|out|inout]- choose send/receive direction (-D- for old tcpdump versions)host [ip|hostname]- set host, also[host not][and|or]- set logicport [1-65535]- set port number, also[port not]
Filter incoming (on interface) traffic (specific <ip:port>) and write to a file
tcpdump -ne -i eth0 -Q in host 192.168.252.1 and port 443 -c 5 -w tcpdump.pcap-c [num]- capture only num number of packets-w [filename]- write packets to file,-r [filename]- reading from file
Capture all ICMP packets
tcpdump -nei eth0 icmpCheck protocol used (TCP or UDP) for service
tcpdump -nei eth0 tcp port 22 -vv -X | egrep "TCP|UDP"Display ASCII text (to parse the output using grep or other)
tcpdump -i eth0 -A -s0 port 443Grab everything between two keywords
tcpdump -i eth0 port 80 -X | sed -n -e '/username/,/=ldap/ p'Grab user and pass ever plain http
tcpdump -i eth0 port http -l -A | egrep -i \
'pass=|pwd=|log=|login=|user=|username=|pw=|passw=|passwd=|password=|pass:|user:|username:|password:|login:|pass |user ' \
--color=auto --line-buffered -B20Extract HTTP User Agent from HTTP request header
tcpdump -ei eth0 -nn -A -s1500 -l | grep "User-Agent:"Capture only HTTP GET and POST packets
tcpdump -ei eth0 -s 0 -A -vv \
'tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420' or 'tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x504f5354'or simply:
tcpdump -ei eth0 -s 0 -v -n -l | egrep -i "POST /|GET /|Host:"Rotate capture files
tcpdump -ei eth0 -w /tmp/capture-%H.pcap -G 3600 -C 200-G <num>- pcap will be created every<num>seconds-C <size>- close the current pcap and open a new one if is larger than<size>
Top hosts by packets
tcpdump -ei enp0s25 -nnn -t -c 200 | cut -f 1,2,3,4 -d '.' | sort | uniq -c | sort -nr | head -n 20Excludes any RFC 1918 private address
tcpdump -nei eth0 'not (src net (10 or 172.16/12 or 192.168/16) and dst net (10 or 172.16/12 or 192.168/16))'___
Tool: tcpick
Analyse packets in real-time
while true ; do tcpick -a -C -r dump.pcap ; sleep 2 ; clear ; done___
Tool: ngrep
ngrep -d eth0 "www.domain.com" port 443-d [iface|any]- set interface[domain]- set hostnameport [1-65535]- set port number
ngrep -d eth0 "www.domain.com" src host 10.240.20.2 and port 443(host [ip|hostname])- filter by ip or hostname(port [1-65535])- filter by port number
ngrep -d eth0 -qt -O ngrep.pcap "www.domain.com" port 443-q- quiet mode (only payloads)-t- added timestamps-O [filename]- save output to file,-I [filename]- reading from file
ngrep -d eth0 -qt 'HTTP' 'tcp'HTTP- show http headerstcp|udp- set protocol[src|dst] host [ip|hostname]- set direction for specific node
ngrep -l -q -d eth0 -i "User-Agent: curl*"-l- stdout line buffered-i- case-insensitive search
___
Tool: hping3
hping3 -V -p 80 -s 5050 <scan_type> www.google.com-V|--verbose- verbose mode-p|--destport- set destination port-s|--baseport- set source port<scan_type>- set scan type-F|--fin- set FIN flag, port open if no reply-S|--syn- set SYN flag-P|--push- set PUSH flag-A|--ack- set ACK flag (use when ping is blocked, RST response back if the port is open)-U|--urg- set URG flag-Y|--ymas- set Y unused flag (0x80 - nullscan), port open if no reply-M 0 -UPF- set TCP sequence number and scan type (URG+PUSH+FIN), port open if no reply
hping3 -V -c 1 -1 -C 8 www.google.com-c [num]- packet count-1- set ICMP mode-C|--icmptype [icmp-num]- set icmp type (default icmp-echo = 8)
hping3 -V -c 1000000 -d 120 -S -w 64 -p 80 --flood --rand-source <remote_host>--flood- sent packets as fast as possible (don't show replies)--rand-source- random source address mode-d --data- data size-w|--win- winsize (default 64)
___
Tool: nmap
Ping scans the network
nmap -sP 192.168.0.0/24Show only open ports
nmap -F --open 192.168.0.0/24Full TCP port scan using with service version detection
nmap -p 1-65535 -sV -sS -T4 192.168.0.0/24Nmap scan and pass output to Nikto
nmap -p80,443 192.168.0.0/24 -oG - | nikto.pl -h -Recon specific ip:service with Nmap NSE scripts stack
# Set variables:
_hosts="192.168.250.10"
_ports="80,443"
# Set Nmap NSE scripts stack:
_nmap_nse_scripts="+dns-brute,\
+http-auth-finder,\
+http-chrono,\
+http-cookie-flags,\
+http-cors,\
+http-cross-domain-policy,\
+http-csrf,\
+http-dombased-xss,\
+http-enum,\
+http-errors,\
+http-git,\
+http-grep,\
+http-internal-ip-disclosure,\
+http-jsonp-detection,\
+http-malware-host,\
+http-methods,\
+http-passwd,\
+http-phpself-xss,\
+http-php-version,\
+http-robots.txt,\
+http-sitemap-generator,\
+http-shellshock,\
+http-stored-xss,\
+http-title,\
+http-unsafe-output-escaping,\
+http-useragent-tester,\
+http-vhosts,\
+http-waf-detect,\
+http-waf-fingerprint,\
+http-xssed,\
+traceroute-geolocation.nse,\
+ssl-enum-ciphers,\
+whois-domain,\
+whois-ip"
# Set Nmap NSE script params:
_nmap_nse_scripts_args="dns-brute.domain=${_hosts},http-cross-domain-policy.domain-lookup=true,"
_nmap_nse_scripts_args+="http-waf-detect.aggro,http-waf-detect.detectBodyChanges,"
_nmap_nse_scripts_args+="http-waf-fingerprint.intensive=1"
# Perform scan:
nmap --script="$_nmap_nse_scripts" --script-args="$_nmap_nse_scripts_args" -p "$_ports" "$_hosts"___
Tool: netcat
nc -kl 5000-l- listen for an incoming connection-k- listening after client has disconnected>filename.out- save receive data to file (optional)
nc 192.168.0.1 5051 < filename.in< filename.in- send data to remote host
nc -vz 10.240.30.3 5000-v- verbose output-z- scan for listening daemons
nc -vzu 10.240.30.3 1-65535-u- scan only udp ports
Transfer data file (archive)
server> nc -l 5000 | tar xzvfp -
client> tar czvfp - /path/to/dir | nc 10.240.30.3 5000Launch remote shell
# 1)
server> nc -l 5000 -e /bin/bash
client> nc 10.240.30.3 5000
# 2)
server> rm -f /tmp/f; mkfifo /tmp/f
server> cat /tmp/f | /bin/bash -i 2>&1 | nc -l 127.0.0.1 5000 > /tmp/f
client> nc 10.240.30.3 5000Simple file server
while true ; do nc -l 5000 | tar -xvf - ; doneSimple minimal HTTP Server
while true ; do nc -l -p 1500 -c 'echo -e "HTTP/1.1 200 OK\n\n $(date)"' ; doneSimple HTTP Server
Restarts web server after each request - remove while condition for only single connection.cat > index.html << __EOF__
<!doctype html>
<head>
<meta charset="utf-8">
<meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1">
<title></title>
<meta name="description" content="">
<meta name="viewport" content="width=device-width, initial-scale=1">
</head>
<body>
<p>
Hello! It's a site.
</p>
</body>
</html>
__EOF__server> while : ; do \
(echo -ne "HTTP/1.1 200 OK\r\nContent-Length: $(wc -c <index.html)\r\n\r\n" ; cat index.html;) | \
nc -l -p 5000 \
; done-p- port number
Simple HTTP Proxy (single connection)
#!/usr/bin/env bash
if [[ $# != 2 ]] ; then
printf "%s\\n" \
"usage: ./nc-proxy listen-port bk_host:bk_port"
fi
_listen_port="$1"
_bk_host=$(echo "$2" | cut -d ":" -f1)
_bk_port=$(echo "$2" | cut -d ":" -f2)
printf " lport: %s\\nbk_host: %s\\nbk_port: %s\\n\\n" \
"$_listen_port" "$_bk_host" "$_bk_port"
_tmp=$(mktemp -d)
_back="$_tmp/pipe.back"
_sent="$_tmp/pipe.sent"
_recv="$_tmp/pipe.recv"
trap 'rm -rf "$_tmp"' EXIT
mkfifo -m 0600 "$_back" "$_sent" "$_recv"
sed "s/^/=> /" <"$_sent" &
sed "s/^/<= /" <"$_recv" &
nc -l -p "$_listen_port" <"$_back" | \
tee "$_sent" | \
nc "$_bk_host" "$_bk_port" | \
tee "$_recv" >"$_back"server> chmod +x nc-proxy && ./nc-proxy 8080 192.168.252.10:8000
lport: 8080
bk_host: 192.168.252.10
bk_port: 8000
client> http -p h 10.240.30.3:8080
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=31536000
Content-Length: 2748
Content-Type: text/html; charset=utf-8
Date: Sun, 01 Jul 2018 20:12:08 GMT
Last-Modified: Sun, 01 Apr 2018 21:53:37 GMTCreate a single-use TCP or UDP proxy
### TCP -> TCP
nc -l -p 2000 -c "nc [ip|hostname] 3000"
### TCP -> UDP
nc -l -p 2000 -c "nc -u [ip|hostname] 3000"
### UDP -> UDP
nc -l -u -p 2000 -c "nc -u [ip|hostname] 3000"
### UDP -> TCP
nc -l -u -p 2000 -c "nc [ip|hostname] 3000"___
Tool: gnutls-cli
Testing connection to remote host (with SNI support)
gnutls-cli -p 443 google.comTesting connection to remote host (without SNI support)
gnutls-cli --disable-sni -p 443 google.com___
Tool: socat
Testing remote connection to port
socat - TCP4:10.240.30.3:22-- standard input (STDIO)TCP4:<params>- set tcp4 connection with specific params[hostname|ip]- set hostname/ip[1-65535]- set port number
Redirecting TCP-traffic to a UNIX domain socket under Linux
socat TCP-LISTEN:1234,bind=127.0.0.1,reuseaddr,fork,su=nobody,range=127.0.0.0/8 UNIX-CLIENT:/tmp/fooTCP-LISTEN:<params>- set tcp listen with specific params[1-65535]- set port numberbind=[hostname|ip]- set bind hostname/ipreuseaddr- allows other sockets to bind to an addressfork- keeps the parent process attempting to produce more connectionssu=nobody- set userrange=[ip-range]- ip rangeUNIX-CLIENT:<params>- communicates with the specified peer socketfilename- define socket
___
Tool: p0f
Set iface in promiscuous mode and dump traffic to the log file
p0f -i enp0s25 -p -d -o /dump/enp0s25.log-i- listen on the specified interface-p- set interface in promiscuous mode-d- fork into background-o- output file
___
Tool: netstat
Graph # of connections for each hosts
netstat -an | awk '/ESTABLISHED/ { split($5,ip,":"); if (ip[1] !~ /^$/) print ip[1] }' | \
sort | uniq -c | awk '{ printf("%s\t%s\t",$2,$1) ; for (i = 0; i < $1; i++) {printf("*")}; print "" }'Monitor open connections for specific port including listen, count and sort it per IP
watch "netstat -plan | grep :443 | awk {'print \$5'} | cut -d: -f 1 | sort | uniq -c | sort -nk 1"Grab banners from local IPv4 listening ports
netstat -nlt | grep 'tcp ' | grep -Eo "[1-9][0-9]*" | xargs -I {} sh -c "echo "" | nc -v -n -w1 127.0.0.1 {}"___
Tool: rsync
Rsync remote data as root using sudo
rsync --rsync-path 'sudo rsync' username@hostname:/path/to/dir/ /local/___
Tool: host)
Resolves the domain name (using external dns server)
host google.com 9.9.9.9Checks the domain administrator (SOA record)
host -t soa google.com 9.9.9.9___
Tool: dig)
Resolves the domain name (short output)
dig google.com +shortLookup NS record for specific domain
dig @9.9.9.9 google.com NSQuery only answer section
dig google.com +nocomments +noquestion +noauthority +noadditional +nostatsQuery ALL DNS Records
dig google.com ANY +noall +answerDNS Reverse Look-up
dig -x 172.217.16.14 +short___
Tool: certbot
Generate multidomain certificate
certbot certonly -d example.com -d www.example.comGenerate wildcard certificate
certbot certonly --manual --preferred-challenges=dns -d example.com -d *.example.comGenerate certificate with 4096 bit private key
certbot certonly -d example.com -d www.example.com --rsa-key-size 4096___
Tool: network-other
Get all subnets for specific AS (Autonomous system)
AS="AS32934"
whois -h whois.radb.net -- "-i origin ${AS}" | \
grep "^route:" | \
cut -d ":" -f2 | \
sed -e 's/^[ \t]//' | \
sort -n -t . -k 1,1 -k 2,2 -k 3,3 -k 4,4 | \
cut -d ":" -f2 | \
sed -e 's/^[ \t]/allow /' | \
sed 's/$/;/' | \
sed 's/allow */subnet -> /g'Resolves domain name from dns.google.com with curl and jq
_dname="google.com" ; curl -s "https://dns.google.com/resolve?name=${_dname}&type=A" | jq .Tool: git
Log alias for a decent view of your repo
# 1)
git log --oneline --decorate --graph --all
# 2)
git log --graph \
--pretty=format:'%Cred%h%Creset -%C(yellow)%d%Creset %s %Cgreen(%cr) %C(bold blue)<%an>%Creset' \
--abbrev-commit___
Tool: python
Static HTTP web server
# Python 3.x
python3 -m http.server 8000 --bind 127.0.0.1
# Python 2.x
python -m SimpleHTTPServer 8000Static HTTP web server with SSL support
# Python 3.x
from http.server import HTTPServer, BaseHTTPRequestHandler
import ssl
httpd = HTTPServer(('localhost', 4443), BaseHTTPRequestHandler)
httpd.socket = ssl.wrap_socket (httpd.socket,
keyfile="path/to/key.pem",
certfile='path/to/cert.pem', server_side=True)
httpd.serve_forever()
# Python 2.x
import BaseHTTPServer, SimpleHTTPServer
import ssl
httpd = BaseHTTPServer.HTTPServer(('localhost', 4443),
SimpleHTTPServer.SimpleHTTPRequestHandler)
httpd.socket = ssl.wrap_socket (httpd.socket,
keyfile="path/tp/key.pem",
certfile='path/to/cert.pem', server_side=True)
httpd.serve_forever()Encode base64
python -m base64 -e <<< "sample string"Decode base64
python -m base64 -d <<< "dGhpcyBpcyBlbmNvZGVkCg=="Tool: awk
Search for matching lines
# egrep foo
awk '/foo/' filenameSearch non matching lines
# egrep -v foo
awk '!/foo/' filenamePrint matching lines with numbers
# egrep -n foo
awk '/foo/{print FNR,$0}' filenamePrint the last column
awk '{print $NF}' filenameFind all the lines longer than 80 characters
awk 'length($0)>80{print FNR,$0}' filenamePrint only lines of less than 80 characters
awk 'length < 80' filenamePrint double new lines a file
awk '1; { print "" }' filenamePrint line numbers
awk '{ print FNR "\t" $0 }' filename
awk '{ printf("%5d : %s\n", NR, $0) }' filename # in a fancy mannerPrint line numbers for only non-blank lines
awk 'NF { $0=++a " :" $0 }; { print }' filenamePrint the line and the next two (i=5) lines after the line matching regexp
awk '/foo/{i=5+1;}{if(i){i--; print;}}' filenamePrint the lines starting at the line matching 'server {' until the line matching '}'
awk '/server {/,/}/' filenamePrint multiple columns with separators
awk -F' ' '{print "ip:\t" $2 "\n port:\t" $3' filenameRemove empty lines
awk 'NF > 0' filename
# alternative:
awk NF filenameDelete trailing white space (spaces, tabs)
awk '{sub(/[ \t]*$/, "");print}' filenameDelete leading white space
awk '{sub(/^[ \t]+/, ""); print}' filenameRemove duplicate consecutive lines
# uniq
awk 'a !~ $0{print}; {a=$0}' filenameRemove duplicate entries in a file without sorting
awk '!x[$0]++' filenameExclude multiple columns
awk '{$1=$3=""}1' filenameSubstitute foo for bar on lines matching regexp
awk '/regexp/{gsub(/foo/, "bar")};{print}' filenameAdd some characters at the beginning of matching lines
awk '/regexp/{sub(/^/, "++++"); print;next;}{print}' filenameGet the last hour of Apache logs
awk '/'$(date -d "1 hours ago" "+%d\\/%b\\/%Y:%H:%M")'/,/'$(date "+%d\\/%b\\/%Y:%H:%M")'/ { print $0 }' \
/var/log/httpd/access_log___
Tool: sed
Print a specific line from a file
sed -n 10p /path/to/fileRemove a specific line from a file
sed -i 10d /path/to/file
# alternative (BSD): sed -i'' 10d /path/to/fileRemove a range of lines from a file
sed -i <file> -re '<start>,<end>d'Replace newline(s) with a space
sed ':a;N;$!ba;s/\n/ /g' /path/to/file
# cross-platform compatible syntax:
sed -e ':a' -e 'N' -e '$!ba' -e 's/\n/ /g' /path/to/file:acreate a labelaNappend the next line to the pattern space$!if not the last line, ba branch (go to) labelassubstitute,/\n/regex for new line,/ /by a space,/gglobal match (as many times as it can)
Alternatives:
# perl version (sed-like speed):
perl -p -e 's/\n/ /' /path/to/file
# bash version (slow):
while read line ; do printf "%s" "$line " ; done < fileDelete string +N next lines
sed '/start/,+4d' /path/to/file___
Tool: grep
Search for a "pattern" inside all files in the current directory
grep -rn "pattern"
grep -RnisI "pattern" *
fgrep "pattern" * -RShow only for multiple patterns
grep 'INFO*'\''WARN' filename
grep 'INFO\|WARN' filename
grep -e INFO -e WARN filename
grep -E '(INFO|WARN)' filename
egrep "INFO|WARN" filenameExcept multiple patterns
grep -vE '(error|critical|warning)' filenameShow data from file without comments
grep -v ^[[:space:]]*# filenameShow data from file without comments and new lines
egrep -v '#|^$' filenameShow strings with a dash/hyphen
grep -e -- filename
grep -- -- filename
grep "\-\-" filenameRemove blank lines from a file and save output to new file
grep . filename > newfilenameTool: perl
Search and replace (in place)
perl -i -pe's/SEARCH/REPLACE/' filenameEdit of *.conf files changing all foo to bar (and backup original)
perl -p -i.orig -e 's/\bfoo\b/bar/g' *.confPrints the first 20 lines from *.conf files
perl -pe 'exit if $. > 20' *.confSearch lines 10 to 20
perl -ne 'print if 10 .. 20' filenameDelete first 10 lines (and backup original)
perl -i.orig -ne 'print unless 1 .. 10' filenameDelete all but lines between foo and bar (and backup original)
perl -i.orig -ne 'print unless /^foo$/ .. /^bar$/' filenameReduce multiple blank lines to a single line
perl -p -i -00pe0 filenameConvert tabs to spaces (1t = 2sp)
perl -p -i -e 's/\t/ /g' filenameRead input from a file and report number of lines and characters
perl -lne '$i++; $in += length($_); END { print "$i lines, $in characters"; }' filenameShell Tricks [<sup>[TOC]</sup>](#anger-table-of-contents)
Shell Tricks [<sup>[TOC]</sup>](#anger-table-of-contents)
When you get a shell, it is generally not very clean, but after following these steps, you will have a fairly clean and comfortable shell to work with.
1) script /dev/null -c bash 2) Ctrl-Z (to send it to background) 3) stty raw -echo; fg (returns the shell to foreground) 4) reset (to reset terminal) 5) xterm (when asked for terminal type) 6) export TERM=xterm; export SHELL=bash
Shell functions [<sup>[TOC]</sup>](#anger-table-of-contents)
Table of Contents
Domain resolve
# Dependencies:
# - curl
# - jq
function DomainResolve() {
local _host="$1"
local _curl_base="curl --request GET"
local _timeout="15"
_host_ip=$($_curl_base -ks -m "$_timeout" "https://dns.google.com/resolve?name=${_host}&type=A" | \
jq '.Answer[0].data' | tr -d "\"" 2>/dev/null)
if [[ -z "$_host_ip" ]] || [[ "$_host_ip" == "null" ]] ; then
echo -en "Unsuccessful domain name resolution.\\n"
else
echo -en "$_host > $_host_ip\\n"
fi
}Example:
shell> DomainResolve nmap.org
nmap.org > 45.33.49.119
shell> DomainResolve nmap.org
Unsuccessful domain name resolution.Get ASN
# Dependencies:
# - curl
function GetASN() {
local _ip="$1"
local _curl_base="curl --request GET"
local _timeout="15"
_asn=$($_curl_base -ks -m "$_timeout" "http://ip-api.com/line/${_ip}?fields=as")
_state=$(echo $?)
if [[ -z "$_ip" ]] || [[ "$_ip" == "null" ]] || [[ "$_state" -ne 0 ]]; then
echo -en "Unsuccessful ASN gathering.\\n"
else
echo -en "$_ip > $_asn\\n"
fi
}Example:
shell> GetASN 1.1.1.1
1.1.1.1 > AS13335 Cloudflare, Inc.
shell> GetASN 0.0.0.0
Unsuccessful ASN gathering.#!/bin/bash
# Refresh sysadmin-toolbox from The Book of Secret Knowledge repo
# Run periodically to keep references current
set -e
REPO_URL="https://github.com/trimstray/the-book-of-secret-knowledge.git"
TEMP_DIR="/tmp/tbsk-refresh-$$"
SKILL_DIR="${1:-$HOME/clawd-duke-leto/skills/sysadmin-toolbox}"
echo "🔄 Refreshing sysadmin-toolbox from upstream..."
# Clone fresh copy
git clone --depth 1 "$REPO_URL" "$TEMP_DIR" 2>/dev/null
cd "$TEMP_DIR"
# Extract sections
echo "📦 Extracting references..."
awk '/^#### Shell One-liners/,/^#### Shell Tricks/' README.md > "$SKILL_DIR/references/shell-oneliners.md"
awk '/^#### Shell Tricks/,/^#### Shell Functions/' README.md > "$SKILL_DIR/references/shell-tricks.md"
awk '/^#### CLI Tools/,/^#### GUI Tools/' README.md > "$SKILL_DIR/references/cli-tools.md"
awk '/^#### Web Tools/,/^#### Systems\/Services/' README.md > "$SKILL_DIR/references/web-tools.md"
awk '/^#### Hacking\/Penetration Testing/,/^#### Your daily knowledge/' README.md > "$SKILL_DIR/references/security-tools.md"
# Cleanup
rm -rf "$TEMP_DIR"
echo "✅ sysadmin-toolbox refreshed from upstream"
echo " Shell one-liners: $(wc -l < "$SKILL_DIR/references/shell-oneliners.md") lines"
Related skills
Lark SharedWire Feishu/Lark Open Platform auth, tokens, and shared API helpers into agent-built bots and internal tools.493k
Runcomfy CliLet their coding agent call any RunComfy model from the terminal or scripts without managing separate SDKs.298k30
Skills CliDiscover, install, update, and manage reusable agent capabilities from the open Skillselion ecosystem directly inside their coding agent.270k72TzstCreate, extract, list, and script `.tzst` / `.tar.zst` archives from the terminal with the right compression, streaming, and conflict flags.267k72XdropPull files from an Xdrop share URL, decrypt them locally, and land outputs in a chosen directory with optional JSON for automation.266k72
WizardAuthor interactive bash setup wizards that open URLs, capture secrets, write .env upserts, and set GitHub Actions secrets step by step.92.1k193kFAQ
What kinds of tasks does sysadmin-toolbox cover?
Network debugging, DNS, SSL/TLS, process and log analysis, security auditing, and container work, each mapped to recommended CLI tools.
Where do its recommendations come from?
From the-book-of-secret-knowledge repository, with reference files that auto-refresh weekly.