General Command Syntax

Instead of spending time on figuring out what arguments to use in a command each time you use it, you can look at your terminal history for what you previously used.

However, with many different commands and terminals this can become quite difficult and time consuming.

\\\\====== Presenting the Command Syntax List ======////

Below you can find all available commands. Either select one from the ToC list or use Ctrl+F to look for it. Below the ToC there is a list of separate cheat sheets for some more complex commands.

In the commands you will find variables enclosed by <variable>. This simply means it needs to be replaced by your own value (e.g., <ip> becomes 10.10.101.81).

Subjects

• Separate command sheets
• Aircrack-ng
• AmcacheParser
• APOLLO
• AppCompatCacheParser
• Apt
• Arp
• Auditctl
• Aureport
• Ausearch
• Binwalk
• Capa
• cURL
• Dd
• Debugfs
• Df
• Dig
• Dmesg
• Dpkg
• DS_Store Parser
• Dumpe2fs
• Dumpzilla.py
• Enum4Linux
• EvtxECmd
• Exiftool
• Find
• Foremost
• Free
• Gobuster
• Hexdump
• Hostname
• Hostnamectl
• Ifconfig
• Iftop
• Ip
• Iptables
• Journalctl
• LECmd
• Log (macOS)
• Lsblk
• Lscpu
• Lsof
• mac_apt
• MFTECmd
• Mount
• Neo-ReGeorg
• Netcat
• Netstat
• Nmap
• Nslookup
• oledump.py
• Osquery
• Packet Monitor (pktmon)
• PECmd
• Ping
• Plutil / Plistutil
• Ps
• Pspy64
• Pstree
• Route
• RsaCTFtool
• Rsatool
• Scalpel
• Smbclient
• Ss
• Stat
• Strings
• Systemctl
• Tcpdump
• Top
• Traceroute
• Unifiedlog_parser
• Uptime
• Wget
• Whois
• Zgrep

Separate command sheets

Some tools are so vast, they have many commands. Too many to include in this document whilst keeping it nice and organized. That is why I created a separate document specifically for such programs.

🔰 Name
⭐Metasploit Framework
⭐Powershell
****

Aircrack-ng

Aircrack- ng is a complete suite of tools to assess WiFi network security. More info here

Crack wifi passwords from a network capture file (must include EAPOL handshake).

aircrack-ng -w <wordlist> <capture_file>
aircrack-ng -w /usr/share/wordlists/rockyou.txt capture.pcap

AmcacheParser

AmcacheParser (part of Eric Zimmerman's tools) parses the Amcache.hve registry hive, which records metadata about executed and installed applications on Windows systems, including file paths, hashes, and first-execution timestamps.

Parse the Amcache.hve file and export the results to a CSV.

.\AmcacheParser.exe -f "C:\Windows\appcompat\Programs\Amcache.hve" --csv C:\Users\Administrator\Desktop --csvf Amcache_Parsed.csv

Arguments

Argument	Value	Description
-f	<path>	Path to the Amcache.hve file
--csv	<directory>	Output directory for the CSV file
--csvf	<filename>	Output CSV file name

More info here.

APOLLO

APOLLO (Apple Pattern of Life Lazy Output'er) runs a curated library of SQL modules against macOS/iOS forensic databases (e.g. knowledgeC.db, CurrentPowerlog.PLSQL) to extract application usage, Bluetooth connections, and other pattern-of-life artefacts.

Extract artefacts using a specific module against a copy of the target databases.

python3 apollo.py extract -o sql_json -p yolo -v yolo modules tmp_apollo

Arguments

Argument	Value	Description
extract	-	Subcommand: extract artefacts using SQL modules
-o	sql_json	Output format
-p / -v	<platform>/<version>	Target platform and OS version (affects which modules/queries apply)
modules	<path>	Path to the SQL module directory to run
<db-folder>	tmp_apollo	Folder containing the copied source database(s)

More info here.

AppCompatCacheParser

AppCompatCacheParser (part of Eric Zimmerman's tools) parses the ShimCache (AppCompatCache), which records file metadata — path, size, and last modified time — for executables that have been run or simply browsed to. Stored in the SYSTEM registry hive at SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache.

Parse the ShimCache from the local SYSTEM hive and export the results to a CSV.

.\AppCompatCacheParser\AppCompatCacheParser.exe --csv . --csvf appcompatcache_parsed.csv

Arguments

Argument	Value	Description
-f	<file>	Path to a specific SYSTEM hive to process (defaults to the live SYSTEM hive)
--csv	<directory>	Output directory for the CSV file
--csvf	<filename>	Output CSV file name

More info here.

Apt

apt (Advanced Package Tool) handles package management on Debian-based Linux systems, including installing, updating, and removing software and their dependencies.

List all installed packages.

apt list --installed

List installed packages (first 30).

apt list --installed | head -n 30

Update package lists.

sudo apt update

Search for a package.

apt search <package-name>

Subcommands

Subcommand	Description
list --installed	List all installed packages
update	Refresh package index from repositories
install <pkg>	Install a package
remove <pkg>	Remove a package
search <term>	Search for packages matching term
show <pkg>	Show detailed info about a package

Arp

arp displays and modifies the system's ARP (Address Resolution Protocol) table, which maps IP addresses to MAC addresses on a local network.

Display the ARP table.

arp -a

Display the ARP table in numeric format.

arp -n

Delete an ARP entry.

sudo arp -d <ip-address>

Arguments

Argument	Value	Description
-a	-	Display all ARP entries
-n	-	Show numeric addresses instead of resolving hostnames
-d	<ip>	Delete the ARP entry for the specified IP
-s	<ip> <mac>	Add a static ARP entry

Auditctl

auditctl is used to control the Linux audit system. It configures audit rules that define which system calls, file accesses, and user activities are logged by auditd. Rules added with auditctl are temporary; for persistent rules, edit /etc/audit/audit.rules.

Watch a file for read, write, and attribute changes.

sudo auditctl -w /etc/passwd -p wra -k users

Log all program executions via execve syscall (64-bit).

sudo auditctl -a always,exit -F arch=b64 -S execve -k execve_syscalls

List all active audit rules.

sudo auditctl -l

Delete all active audit rules.

sudo auditctl -D

Arguments

Argument	Value	Description
-w	<path>	Watch a file or directory
-p	rwxa	Permissions to watch: r=read, w=write, x=execute, a=attribute
-k	<key>	Tag rule events with a searchable key name
-a	always,exit	Append rule: always log on syscall exit
-F	arch=b64	Filter: apply to 64-bit architecture
-S	<syscall>	Syscall to monitor (e.g. execve, open)
-l	-	List all current rules
-D	-	Delete all rules

Aureport

aureport generates summary reports from the Linux audit log. It is typically used by piping output from ausearch to produce structured, human-readable reports of audit events.

Generate a summary report of file events.

sudo ausearch -k users | aureport -f --summary

Generate a named file report.

sudo ausearch -k users | aureport -f user-logs

Generate a report of all authentication events.

sudo aureport --auth

Generate a report of executable events.

sudo aureport --executable

Arguments

Argument	Value	Description
-f	-	Generate a file access report
--summary	-	Produce a summary report
--auth	-	Report on authentication events
--executable	-	Report on executable events
--login	-	Report on login events
--user	-	Report on user-related events
--failed	-	Show only failed events

Ausearch

ausearch queries the Linux audit log (/var/log/audit/audit.log) for events matching specified criteria such as rule keys, usernames, or syscalls.

Search by audit rule key.

sudo ausearch -k <key>
sudo ausearch -k users
sudo ausearch -k execve_syscalls

Search by username.

sudo ausearch -ua <username>

Search within a time range.

sudo ausearch --start today
sudo ausearch --start "01/01/2024 00:00:00" --end "01/02/2024 00:00:00"

Pipe to aureport for a structured report.

sudo ausearch -k users | aureport -f --summary

Arguments

Argument	Value	Description
-k	<key>	Search by audit rule key tag
-ua	<username>	Search by username
-ui	<uid>	Search by user ID
--start	today / <date>	Start of time range
--end	<date>	End of time range
-f	<file>	Search events related to a specific file
-sc	<syscall>	Search by syscall name

Binwalk

Binwalk analyses and extracts data from binary files by scanning for known file signatures, embedded files, and executable code. Useful for examining memory dumps, firmware, embedded systems, and slack space for hidden or fragmented file fragments.

Scan a file/disk image and list detected file signatures with their offsets.

binwalk Challenge2_slack_space.img

List and extract known files.

binwalk -e Challenge2_slack_space.img

Arguments

Argument	Value	Description
-e	-	Automatically extract known file types

More info here.

Capa

Capa is the FLARE team's free and open-source tool to identify capabilities in executable files.

Analyse a bin file.

capa.exe .\cryptbot.bin

Log more detailed information.

capa -vv .\cryptbot.bin

Log more detailed information and direct the result to a .json file.

capa.bin -j -vv .\cryptbot.bin > cryptbot_vv.json

cURL

curl transfers data from or to a server using various protocols (HTTP, HTTPS, FTP, etc.). Useful for testing network connections, downloading files, and interacting with web APIs.

Basic GET request

curl <ip/hostname>

Basic POST request for a login form.

curl -X POST -d "username=user&password=user&submit=Login" http://10.80.184.173/post.php

Download a file.

curl -O <url>
curl -O https://example.com/file.txt

Save output to a specific filename.

curl -o <filename> <url>

Send a GET request and print the response.

curl <url>

Send a POST request with data.

curl -X POST -d "param=value" <url>

Use through a SOCKS5 proxy.

curl --socks5 127.0.0.1:1080 <url>

Follow redirects.

curl -L <url>

Arguments

Argument	Value	Description
-i	-	To view exactly what the server returns (including headers and potential redirects).
-O	-	Save to a file with the remote filename
-o	<file>	Save to a specified local filename
-X	POST/GET/PUT	Specify the HTTP method
-d	<data>	Send data in a POST request
-H	<header>	Add a custom HTTP header
-A	<user-agent>	Specify a custom user-agent.
-c	<filename>	Writes any cookies received from the server into a file.
-b	<filename>	Send the saved cookies in the next request.
-L	-	Follow redirects
-s	-	Silent mode (no progress bar)
--socks5	<host:port>	Route traffic through a SOCKS5 proxy
-v	-	Verbose output (useful for debugging)

Dd

dd copies and converts raw data block-by-block. In forensics, it's used to read raw filesystem structures (e.g. a superblock) directly off disk, to carve out a byte range identified by file carving, and to image/clone whole disks or partitions bit-for-bit.

Read the EXT4 superblock (block 1) and pipe it to hexdump for inspection.

sudo dd if=/dev/loop0 bs=1024 count=1 skip=1 | hexdump -C

Recover a file at a known block offset (e.g. found via strings -t d).

sudo dd if=/dev/loop0 bs=4096 skip=24578 count=1 of=/tmp/recovered_file

Carve a file out of a disk image using known start/end byte offsets (file carving).

dd if=Challenge1_Manual_Carve_usb.img of=Image.png bs=1 skip=134483968 count=463

Arguments

Argument	Value	Description
if	<file>	Input file/device to read from
of	<file>	Output file to write to
bs	<bytes>	Block size to read/write at a time
skip	<n>	Skip N input blocks before reading (used to seek to an offset)
count	<n>	Copy only N input blocks

Tip: When carving with bs=1, skip and count are exact byte offsets — count = ending offset minus starting offset.

Debugfs

debugfs is an interactive EXT2/3/4 filesystem debugger. It allows inspecting inodes, directory entries, and other on-disk structures directly, without mounting the filesystem — useful for manual inode/metadata analysis and understanding tampering.

Open a debugfs session against a device.

sudo debugfs /dev/loop0

Show stats/metadata for the root directory or a specific inode number.

debugfs: stat .
debugfs: stat <11>

Subcommands

Subcommand	Description
stat <path or inode>	Show inode metadata (mode, timestamps, extents, checksum)
ls <path>	List directory contents including inode numbers
cat <path>	Print the contents of a file
logdump	Dump the ext3/4 journal contents

More info here.

Df

df reports the amount of disk space used and available on filesystems.

Display disk usage in human-readable format.

df -h

Display disk usage for a specific path.

df -h /home

Show inode usage instead of block usage.

df -i

Arguments

Argument	Value	Description
-h	-	Human-readable sizes (KB, MB, GB)
-H	-	Human-readable using powers of 1000 instead of 1024
-i	-	Show inode usage instead of block usage
-T	-	Show filesystem type
<path>	-	Limit output to the filesystem containing the specified path

Dig

dig (Domain Information Groper) queries DNS servers for information about domain names. Useful for diagnosing DNS-related issues and gathering DNS records.

Query DNS records for a domain.

dig <domain>
dig tryhackme.com

Query a specific DNS server.

dig @<dns-server> <domain>
dig @1.1.1.1 tryhackme.com

Query a specific record type.

dig <domain> <type>
dig tryhackme.com MX
dig tryhackme.com TXT

Perform a DNS zone transfer.

dig -t AXFR <domain> @<dns-server>

Arguments

Argument	Value	Description
@<server>	-	Use a specific DNS server
-t	AXFR/A/MX/TXT	Query type (default: A record)
+short	-	Return only the answer, no extra output
+noall +answer	-	Show only the answer section
-x	<ip>	Reverse DNS lookup

Dmesg

dmesg prints and controls the kernel ring buffer — a circular log of messages generated by the kernel. Useful for detecting hardware events, unusual module loads, and signs of kernel-level tampering.

View the kernel ring buffer.

sudo dmesg

View with human-readable timestamps.

sudo dmesg -T

Filter output by keyword.

sudo dmesg -T | grep '<keyword>'
sudo dmesg -T | grep 'custom_kernel'

Follow new messages in real time.

sudo dmesg -w

View the persistent kernel log file.

cat /var/log/kern.log
tail -f /var/log/kern.log

Arguments

Argument	Value	Description
-T	-	Print timestamps in human-readable format
-w	-	Follow/watch for new messages in real time
-l	err,warn	Filter by log level (emerg, alert, crit, err, warn, notice, info, debug)
-f	kern	Filter by facility (kern, user, daemon, etc.)
-H	-	Human-readable output with color and relative timestamps
--clear	-	Clear the ring buffer

Dpkg

dpkg is the low-level package management tool for Debian-based systems. It installs, removes, and provides information about .deb packages directly, without handling dependencies.

List all installed packages.

dpkg -l

List installed packages filtered by name.

dpkg -l | grep <package-name>

Show detailed info about an installed package.

dpkg -s <package-name>

List files installed by a package.

dpkg -L <package-name>

Find which package owns a file.

dpkg -S <file-path>
dpkg -S /usr/bin/python3

Arguments

Argument	Value	Description
-l	-	List all installed packages
-s	<pkg>	Show package status and details
-L	<pkg>	List files installed by the package
-S	<file>	Find which package a file belongs to
-i	<.deb>	Install a .deb package file
-r	<pkg>	Remove a package

DS_Store Parser

.DS_Store files are created by macOS Finder in nearly every folder to store view metadata (icon positions, window size). Forensically, they can retain the names of files/folders that have since been deleted or renamed from that directory.

Parse a .DS_Store file.

python3 DS_Store-parser/parse.py ../.DS_Store

More info here.

Dumpe2fs

dumpe2fs prints the superblock and block group information of an EXT2/3/4 filesystem in human-readable form — block size, block/inode counts, free blocks/inodes, volume creation time, and more.

Print filesystem metadata for a device.

sudo dumpe2fs /dev/loop0

Arguments

Argument	Value	Description
-h	-	Only display the superblock (no block group info)

Dumpzilla.py

DumpZilla is a forensic tool for extracting data from Firefox browser profiles. It can retrieve cookies, passwords, bookmarks, history, downloads, and other browser artifacts.

Extract all available data from a Firefox profile.

sudo python3 dumpzilla.py /home/<user>/.mozilla/firefox/<profile>/ --All

Extract bookmarks only.

sudo python3 dumpzilla.py /home/<user>/.mozilla/firefox/<profile>/ --Bookmarks

Extract cookies and saved passwords.

sudo python3 dumpzilla.py /home/<user>/.mozilla/firefox/<profile>/ --Cookies --Passwords

The Firefox profile path is typically ~/.mozilla/firefox/<profile>/. Profile name can be found in ~/.mozilla/firefox/profiles.ini.

Arguments

Argument	Value	Description
--All	-	Extract all available data
--Bookmarks	-	Extract saved bookmarks
--Cookies	-	Extract browser cookies
--Passwords	-	Extract saved passwords
--History	-	Extract browsing history
--Downloads	-	Extract download history
--Addons	-	List installed extensions/add-ons

More info here.

Enum4Linux

enum4Linux is a Linux alternative to enum.exe for enumerating data from Windows and Samba hosts.

More info here.

EvtxECmd

EvtxECmd (part of Eric Zimmerman's tools) parses Windows Event Log (.evtx) files, with support for filtering to specific Event IDs and mapping known events to human-readable fields via community-maintained maps.

Parse a Security event log, extracting only successful and failed logon events.

.\EvtxECmd\EvtxECmd.exe -f "C:\Windows\System32\winevt\Logs\Security.evtx" --csv . --csvf "output.csv" --inc 4624,4625

Arguments

Argument	Value	Description
-f	<file>	Path to the .evtx file to parse
-d	<directory>	Directory containing .evtx files to parse
--inc	4624,4625	Only include the specified, comma-separated Event IDs
--csv	<directory>	Output directory for the CSV file
--csvf	<filename>	Output CSV file name

More info here.

Exiftool

ExifTool reads, writes, and edits file metadata (EXIF, IPTC, XMP, and more) across many file formats. In forensics, it's used to verify a recovered/carved file's true type and inspect embedded metadata (camera info, GPS, timestamps, authorship).

Extract all metadata from a file.

exiftool Challenge1_Image.png

Arguments

Argument	Value	Description
-a	-	Allow duplicate tag names to be extracted
-G	-	Print group name for each tag
-json	-	Output in JSON format
-gps:all	-	Extract only GPS-related tags

More info here.

Find

find searches a directory tree for files matching given criteria. In forensics, its time-comparison filters (e.g. -newerct) are valuable for detecting timestomping, since they can locate files by a specific timestamp field regardless of what ls/other tools display.

Find files with a change time (ctime) within a specific date range.

sudo find /mnt/ext4_time -newerct "2025-01-01" ! -newerct "2025-01-06" -ls

Arguments

Argument	Value	Description
-newerct	<date>	Match files with a change time newer than the given date
!	-	Negate the following test (e.g. combine two -newerct for a range)
-newermt	<date>	Match files with a modification time newer than the given date
-newerat	<date>	Match files with an access time newer than the given date
-ls	-	List matching files in ls -dils format

Foremost

foremost recovers files from a disk image based on their headers, footers, and internal data structures (file carving), without relying on filesystem metadata. Commonly used to recover deleted files.

Carve specific file types out of a disk image using a custom configuration file.

foremost -t pdf,jpg,png -i Challenge3_deleted_disk.img -o Challenge3_files -c /etc/custom_foremost.conf

Arguments

Argument	Value	Description
-t	pdf,jpg,png	File types to search for and recover
-i	<image>	Input file/disk image to carve
-o	<directory>	Output directory for recovered files
-c	<config>	Path to a custom configuration file
-a	-	Write all headers, perform no error detection (may result in corrupted files)

More info here.

Free

free displays the total amount of physical and swap memory in the system, including what is used, free, and available.

Display memory usage in human-readable format.

free -h

Display memory in megabytes.

free -m

Continuously update every N seconds.

free -h -s <seconds>
free -h -s 2

Arguments

Argument	Value	Description
-h	-	Human-readable sizes (KB, MB, GB)
-m	-	Display in megabytes
-g	-	Display in gigabytes
-s	<sec>	Continuously display, updating every N seconds
-t	-	Show a totals line

Gobuster

Gobuster is a software tool for brute forcing directories on web servers. It comes preinstalled with Kali Linux, a Linux distribution designed for digital forensics and penetration testing.

Enumerate common files in directories

gobuster dir -u http://TARGET_IP:80 -w /usr/share/wordlists/SecLists/Discovery/Web-Content/common.txt -x bak,txt,html -t 20

Arguments

Argument	Value	Description
dir	-	Mode — use directory/file enumeration
-u	http://TARGET_IP:80	Target URL including port
-w	common.txt	Wordlist to use for brute-forcing paths
-x	bak,txt,html	File extensions to append to each wordlist entry
-t	20	Number of concurrent threads

More info here.

Hexdump

hexdump displays the contents of a file (or piped input) in hexadecimal, octal, decimal, or ASCII. Commonly piped from dd to inspect raw bytes at a specific offset on disk (e.g. verifying a filesystem's superblock fields).

Display canonical hex+ASCII output.

sudo dd if=/dev/loop0 bs=1024 count=1 skip=1 | hexdump -C

Arguments

Argument	Value	Description
-C	-	Canonical hex+ASCII display (16 bytes per line)
-n	<bytes>	Only interpret the first N bytes of input
-s	<offset>	Skip the first N bytes of input before displaying

Hostname

hostname displays or sets the hostname of the system. It is useful for identifying the local system's network identity.

Display the current hostname.

hostname

Display the system's IP address.

hostname -I

Display the fully qualified domain name (FQDN).

hostname -f

Arguments

Argument	Value	Description
-I	-	Display all IP addresses of the host
-f	-	Display the fully qualified domain name
-s	-	Display the short hostname (up to the first dot)
-d	-	Display the DNS domain name

Hostnamectl

hostnamectl queries and changes the system hostname and related settings. It provides more detail than hostname, including machine ID, OS, kernel version, and virtualisation type.

Display all hostname and system information.

hostnamectl

Set the system hostname.

sudo hostnamectl set-hostname <new-hostname>

Subcommands

Subcommand	Description
(no subcommand)	Display hostname, machine ID, OS, kernel, architecture
set-hostname <name>	Set the static hostname
set-icon-name <name>	Set the icon name (chassis type)

Ifconfig

ifconfig configures and displays information about network interfaces. Largely replaced by ip in modern Linux systems, but still widely available.

Display all network interfaces.

ifconfig

Display a specific interface.

ifconfig <interface>
ifconfig eth0

Bring an interface up or down.

sudo ifconfig <interface> up
sudo ifconfig <interface> down

Arguments

Argument	Value	Description
<interface>	eth0	Show info for a specific interface
up / down	-	Enable or disable an interface
-a	-	Show all interfaces including inactive ones

Note: ip a is the modern equivalent and preferred in current Linux distributions.

Iftop

iftop provides a real-time display of bandwidth usage on a network interface, showing which connections are using the most bandwidth.

Monitor bandwidth on the default interface.

sudo iftop

Monitor a specific interface.

sudo iftop -i <interface>
sudo iftop -i eth0

Show port numbers.

sudo iftop -P

Run in non-interactive mode and output to a file.

sudo iftop -t -s <seconds> > output.txt

Arguments

Argument	Value	Description
-i	<interface>	Monitor a specific network interface
-P	-	Show port numbers in output
-n	-	Do not resolve hostnames (show IPs only)
-N	-	Do not resolve port names
-t	-	Use text mode (non-interactive)
-s	<seconds>	Run for N seconds then exit (use with -t)

Ip

ip is the modern, versatile replacement for ifconfig and route. It configures network interfaces, routing, tunnels, and more.

Display all network interfaces and IP addresses.

ip a
ip address show

Display a specific interface.

ip a show <interface>
ip a show eth0

Display the routing table.

ip r
ip route show

Display ARP/neighbour table.

ip neigh

Bring an interface up or down.

sudo ip link set <interface> up
sudo ip link set <interface> down

Subcommands

Subcommand	Description
ip a / ip address	Show/configure IP addresses
ip r / ip route	Show/configure routing table
ip link	Show/configure network interfaces
ip neigh	Show/modify ARP/neighbour table
ip tunnel	Configure IP tunnels

Iptables

iptables displays, sets up, and maintains IP packet filter rules. It is used to manage firewall rules and monitor network traffic on Linux systems.

List all active rules.

sudo iptables -L
sudo iptables -L -v -n

Allow incoming traffic on a port.

sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT

Allow outgoing traffic on a port.

sudo iptables -A OUTPUT -p tcp --dport 22 -j ACCEPT

Block traffic from an IP.

sudo iptables -A INPUT -s <ip> -j DROP

Save and restore rules.

sudo iptables-save > /etc/iptables/rules.v4
sudo iptables-restore < /etc/iptables/rules.v4

Arguments

Argument	Value	Description
-L	-	List all rules in the selected chain
-v	-	Verbose output
-n	-	Numeric output (no DNS resolution)
-A	INPUT/OUTPUT/FORWARD	Append a rule to a chain
-D	<chain> <rule>	Delete a rule
-F	-	Flush (delete) all rules
-p	tcp/udp/icmp	Protocol to match
--dport	<port>	Destination port
-s	<ip>	Source IP address
-j	ACCEPT/DROP/REJECT	Target action

Journalctl

journalctl is the command-line utility for querying and displaying messages from the systemd journal. Used in forensics to investigate service logs and detect malicious activity.

Follow (tail) logs for a specific service in real time.

sudo journalctl -f -u <service-name>

View all journal logs for a specific service.

journalctl -u <service-name>

View logs since a relative or absolute timestamp.

journalctl --since "1 hour ago"
journalctl --since "2024-01-01 00:00:00"

View logs between two timestamps.

journalctl --since "08:00" --until "12:00"

Show logs from the current boot only.

journalctl -b

Arguments

Argument	Value	Description
-f	-	Follow — stream new log entries in real time
-u	<service-name>	Filter by systemd unit/service name
--since	"1 hour ago"	Show entries after this timestamp
--until	"2024-01-01"	Show entries before this timestamp
-n	<number>	Show the last N lines
-p	err	Filter by priority (emerg, alert, crit, err, warning, notice, info, debug)
-b	-	Show logs from the current boot

LECmd

LECmd (part of Eric Zimmerman's tools) parses Windows LNK (shortcut) files, which are automatically created when a user opens a file. LNK files reveal recently accessed items, including for files that have since been deleted.

Parse all LNK files in a directory and export the results to a CSV.

.\LECmd.exe -d C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Recent --csvf Parsed-LNK.csv --csv C:\Users\Administrator\Desktop

Parse a single LNK file.

LECmd.exe -f <path to file>

LNK files are typically found under %userprofile%\AppData\Roaming\Microsoft\Windows\Recent and %userprofile%\recent.

Arguments

Argument	Value	Description
-d	<directory>	Directory containing LNK files to parse
-f	<file>	Parse a single LNK file instead of a directory
--csv	<directory>	Output directory for the CSV file
--csvf	<filename>	Output CSV file name

More info here.

Log (macOS)

log is macOS's built-in Unified Log query tool. It reads the live log archive (or an exported .logarchive) and supports powerful predicate-based filtering by subsystem, category, and message content.

Show the last minute of logs.

log show --last 1m

Filter logs with a predicate (subsystem, category, and message content).

log show --predicate 'subsystem=="com.apple.sharing" and category=="AirDrop" and eventMessage contains "Discoverable"'

Arguments

Argument	Value	Description
show	-	Print log entries
--last	1m/1h/1d	Show entries from the last given time window
--predicate	'<expr>'	Filter entries using an NSPredicate-style expression
--info	-	Include info-level messages
--style	syslog/json	Output format

Lsblk

lsblk lists information about block devices (disks and partitions), including their sizes, mount points, and type.

List all block devices.

lsblk

Show filesystem type and UUID.

lsblk -f

Show all columns including permissions.

lsblk -o NAME,SIZE,TYPE,MOUNTPOINT,FSTYPE,UUID

Arguments

Argument	Value	Description
-f	-	Show filesystem type, UUID, and label
-o	<columns>	Specify output columns
-d	-	Do not show slave/holder devices
-n	-	Do not print header
-J	-	Output in JSON format

Lscpu

lscpu displays detailed information about the CPU architecture, including the number of cores, threads, speed, and vendor.

Display CPU architecture information.

lscpu

Output in JSON format.

lscpu -J

Arguments

Argument	Value	Description
-J	-	Output in JSON format
-p	-	Output in parseable (CSV-like) format
-e	-	Extended readable format
--all	-	Include all CPUs including offline ones

Lsof

lsof (LiSt Open Files) lists information about files opened by processes. Since everything in Linux is treated as a file, this includes regular files, directories, network sockets, and devices — making it extremely powerful for spotting suspicious behavior.

List all open files and the processes that opened them.

lsof

List all open files for a specific process by PID.

sudo lsof -p <PID>

List open network connections.

lsof -i

List open connections on a specific port.

lsof -i :<port>
lsof -i :4444

List all open files for a specific user.

lsof -u <username>

Arguments

Argument	Value	Description
-p	<PID>	Filter by process ID
-i	:<port>	Show network connections, optionally filtered by port
-u	<username>	Filter by user
-c	<name>	Filter by process name
+D	<directory>	Show all open files under a directory
-t	-	Return only PIDs (useful for piping)

mac_apt

mac_apt (macOS Artefact Parsing Tool) is a cross-platform command-line parser for macOS/iOS forensic artefacts — it can run against a mounted live system, a DMG image, or an extracted filesystem, and supports plugins for artefacts like FSEVENTS, ASL logs, and more.

Parse an artefact plugin from a DMG disk image.

python3 mac_apt.py -o . -c DMG ~/mac-disk.img FSEVENTS

Parse an artefact plugin from the live, mounted system.

sudo python3 mac_apt.py -o . -c MOUNTED / FSEVENTS

Arguments

Argument	Value	Description
-o	<directory>	Output directory for results
-c	DMG/MOUNTED/...	Input type (disk image, mounted volume, etc.)
<source>	<path>	Path to the image file or mount point
<plugin>	FSEVENTS/ASL/...	Artefact plugin(s) to run

More info here.

MFTECmd

Command-line tool for parsing the NTFS Master File Table ($MFT), $J, and other NTFS metadata files.

Extract the records from the Files and save it in the same folder

MFTECmd.exe -f ..\Evidence\$MFT --csv ..\Evidence --csvf ..\Evidence\MFT_record.csv

Parse the $J file (USN Journal change records).

MFTECmd.exe -f ..\Evidence\$J --csv ..\Evidence --csvf USNJrnl.csv

Parse an $I30 index attribute file (directory index, including slack space entries).

MFTECmd.exe -f ..\Evidence\$I30 --csv ..\Evidence\ --csvf i30.csv

Arguments

Argument	Value	Description
-f	..\Evidence\$MFT	MFT/$J/$I30` file location — MFTECmd auto-detects the file type
--csv	..\Evidence	Output directory
--csvf	..\Evidence\MFT_record.csv	Output file name

More info here.

Mount

mount attaches a filesystem (or disk image, via a loop device) to the directory tree. In forensics, always mount evidence images read-only to avoid altering timestamps or other metadata.

Mount a disk image read-only to inspect its filesystem.

sudo mount -o ro,loop Challenge3_deleted_disk.img /mnt/tmp

Arguments

Argument	Value	Description
-o	ro,loop	Mount read-only via a loop device (safe for forensic images)
-t	<fstype>	Specify the filesystem type explicitly (e.g. ext4, ntfs)

Neo-ReGeorg

Neo-reGeorg is an HTTP tunneling and pivot tool that can create a tunnel over the HTTP(S) protocol. It encapsulates other protocols and sends them back and forth via the HTTP protocol. Create an HTTP tunnel communication channel to pivot into the internal network and communicate with local network devices through HTTP protocol. It is used for proxying HTTP traffic when encountering servers that do not allow internet access during traffic proxying.

Generate a Neo-ReGeorg key

python3 neoreg.py generate -k <password> 

Connect to the tunnel (must be uploaded to the machine).

python3 neoreg.py -k thm -u http://10.10.230.138/uploader/files/tunnel.php

Connect to a machine behind the webserver through the tunnel curl, proxychains, FoxyProxy, Firefox, etc.

curl --socks5 127.0.0.1:1080 <address of machine / file>
curl --socks5 127.0.0.1:1080 http://172.20.0.120:80/flag

More info here.

Netcat

netcat (nc) reads and writes data across network connections using TCP or UDP. It is a versatile tool for debugging, testing network connections, and creating bind or reverse shells.

Set up a listener on a port.

nc -nlvp <port>
nc -nlvp 4444

Connect to a remote host and port.

nc <ip> <port>

Transfer a file (receiver side).

nc -nlvp <port> > received_file.txt

Transfer a file (sender side).

nc <ip> <port> < file_to_send.txt

Create a bind shell (on target).

nc -nlvp <port> -e /bin/bash

Arguments

Argument	Value	Description
-l	-	Listen mode
-n	-	Do not resolve hostnames (numeric only)
-v	-	Verbose output
-p	<port>	Specify local port
-e	<cmd>	Execute command after connection (may not be available in all builds)
-u	-	Use UDP instead of TCP
-w	<seconds>	Timeout for idle connections

Netstat

netstat displays network connections, routing tables, interface statistics, and more. Largely replaced by ss in modern systems but still widely encountered.

Show all active connections.

netstat -a

Show listening ports and services.

netstat -tlun

Show connections with PIDs.

sudo netstat -tlunp

Show the routing table.

netstat -r

Arguments

Argument	Value	Description
-a	-	Show all sockets (listening and non-listening)
-t	-	Show TCP connections
-u	-	Show UDP connections
-l	-	Show only listening sockets
-n	-	Show numeric addresses (no DNS resolution)
-p	-	Show PID and program name
-r	-	Show routing table

Note: ss is the modern equivalent and preferred on current Linux distributions.

Windows usage.

netstat -a

Display all currently active TCP connections and TCP/UDP ports.

netstat -b

Display the executable responsible for the connection (i.e. payload.exe).

netstat -o

Display all TCP connections and include the process ID.

netstat -p

Display connections by protocol. Options include TCP, UDP, ICMP, and the IPv6 iterations.

Windows Arguments

Argument	Description
-a	Display all currently active TCP connections and TCP/UDP ports
-b	Display the executable responsible for each connection
-o	Display all TCP connections and include the process ID
-p	Display connections filtered by protocol (TCP, UDP, ICMP, or their IPv6 equivalents)

Nmap

nmap scans networks to discover hosts and services. Useful for identifying devices on a network, open ports, running services, and OS versions.

Basic scan of a host.

nmap <ip>

Fast scan of the most common ports.

nmap -F <ip>

Scan a specific port range.

nmap -p <port-range> <ip>
nmap -p 1-1000 <ip>

Service and version detection.

nmap -sV <ip>

OS detection.

sudo nmap -O <ip>

Full scan with service/OS detection and scripts.

sudo nmap -A <ip>

Scan without sending ICMP ping (useful when ICMP is blocked).

nmap -Pn <ip>

Arguments

Argument	Value	Description
-sS	-	SYN (stealth) scan
-sV	-	Service/version detection
-O	-	OS detection (requires root)
-A	-	Aggressive scan (OS, version, scripts, traceroute)
-p	<range>	Port range to scan
-F	-	Fast mode — scan fewer ports
-Pn	-	Skip host discovery (treat all hosts as up)
--ttl	<n>	Set IP TTL value
--badsum	-	Send packets with bad checksum (firewall testing)

Nslookup

nslookup queries DNS servers to obtain domain name or IP address mappings. Useful for diagnosing DNS issues.

Look up a domain name.

nslookup <domain>
nslookup tryhackme.com

Reverse lookup — find the hostname for an IP.

nslookup <ip>

Query a specific DNS server.

nslookup <domain> <dns-server>
nslookup tryhackme.com 8.8.8.8

Query a specific record type.

nslookup -type=MX <domain>
nslookup -type=TXT <domain>

Arguments

Argument	Value	Description
-type	A/MX/TXT/NS/PTR	Query a specific DNS record type
<dns-server>	8.8.8.8	Use a specific DNS server

oledump.py

Oledump.py is a Python tool that analyzes OLE2 files, commonly called Structured Storage or Compound File Binary Format. OLE stands for Object Linking and Embedding, a proprietary technology developed by Microsoft.

Analyse a file and investigate the 4th datastream. Then decompress any VBA code.

oledump.py agenttesla.xlsm -s 4 --vbadecompress

Firefox

Configure a manual proxy in the network setting and use the ip and port as listed in the Neo-reGeorge CLI output for the SOCKS host.

Osquery

osquery exposes the operating system as a relational database, allowing you to query system information using SQL. Useful for forensics, introspection, and endpoint monitoring.

Launch the interactive osquery shell.

osqueryi

Query running processes.

SELECT pid, name, path, cmdline, state FROM processes;

Query listening ports.

SELECT pid, port, protocol FROM listening_ports;

Query installed packages.

SELECT name, version FROM deb_packages;

Query user accounts.

SELECT username, uid, gid, shell FROM users;

Processes Running From the tmp Directory

SELECT pid, name, path FROM processes WHERE path LIKE '/tmp/%' OR path LIKE '/var/tmp/%';

Hunting for Fileless Malware / Process

SELECT pid, name, path, cmdline, start_time FROM processes WHERE on_disk = 0;

Orphan Processes

SELECT pid, name, parent, path FROM processes WHERE parent NOT IN (SELECT pid from processes);

Finding Processes Launched from User Directories

SELECT pid, name, path, cmdline, start_time FROM processes WHERE path LIKE '/home/%' OR path LIKE '/Users/%';

Network Connections

SELECT pid, family, remote_address, remote_port, local_address, local_port, state FROM process_open_sockets LIMIT 20;

Examining DNS Queries

SELECT * FROM dns_resolvers;

Listing Down Network Interfaces

Listing Down Network Interfaces

Listing Down Network Interfaces

Listing Down Network Interfaces

Open Files

SELECT pid, fd, path FROM process_open_files;

Files Being Accessed From the tmp Directory

SELECT pid, fd, path FROM process_open_files where path LIKE '/tmp/%';

Hidden Files

SELECT filename, path, directory, size, type FROM file WHERE path LIKE '/.%';

Recently Modified Files

SELECT filename, path, directory, type, size FROM file WHERE path LIKE '/etc/%' AND (mtime > (strftime('%s', 'now') - 86400));

Recently Modified Binaries

SELECT filename, path, directory, mtime FROM file WHERE path LIKE '/opt/%' OR path LIKE '/bin/' AND (mtime > (strftime('%s', 'now') - 86400));

Run osquery in daemon mode (for scheduled queries).

sudo osqueryd

More info here.

Packet Monitor (pktmon)

pktmon is a built-in Windows network diagnostic and packet capture tool. Useful for capturing traffic on hosts where installing third-party tools (e.g. Wireshark) isn't possible or desirable.

Start a capture.

pktmon start

Stop a capture.

pktmon stop

Reset the count of packets that PacketMonitor has captured.

pktmon reset

View the amount of packets PacketMonitor has captured across the interfaces.

pktmon counters

Convert a PacketMonitor capture file to a text file.

pktmon etl2txt

Convert a PacketMonitor capture file to a pcap (for opening in Wireshark).

pktmon etl2pcap

Subcommands

Subcommand	Description
start	Start a PacketMonitor capture
stop	Stop a PacketMonitor capture
reset	Reset the count of packets that PacketMonitor has captured
counters	View the amount of packets PacketMonitor has captured across the interfaces
etl2txt	Convert a PacketMonitor capture file to a text file
etl2pcap	Convert a PacketMonitor capture file to a pcap

More info here.

PECmd

PECmd (part of Eric Zimmerman's tools) parses Windows Prefetch files, which record program execution details such as run count, last run times, and loaded files/DLLs — useful for establishing program execution history on a host.

Parse all prefetch files in a directory and export the results to a CSV.

.\PECmd.exe -d "C:\Windows\Prefetch" --csv "C:\Users\Administrator\Desktop\Forensics Tools" --csvf prefetch-parsed.csv

Arguments

Argument	Value	Description
-d	<directory>	Directory containing prefetch files to parse
-f	<file>	Parse a single prefetch file
--csv	<directory>	Output directory for the CSV file
--csvf	<filename>	Output CSV file name

More info here.

Ping

ping tests connectivity to other network devices by sending ICMP echo request packets. Useful for checking whether a host is reachable and measuring latency.

Ping a host.

ping <ip-or-hostname>
ping 8.8.8.8

Limit to N packets.

ping -c <count> <ip>
ping -c 4 8.8.8.8

Send a ping with a custom payload (hex).

ping <ip> -c 1 -p <hex-payload>
ping 10.10.10.10 -c 1 -p 74686d3a7472796861636b6d650a

Arguments

Argument	Value	Description
-c	<count>	Stop after sending N packets
-i	<seconds>	Interval between packets
-s	<bytes>	Packet size in bytes
-t	<ttl>	Set IP time-to-live
-p	<hex>	Fill packet with a hex pattern (data exfiltration simulation)
-f	-	Flood ping (requires root)

Plutil / Plistutil

macOS stores much of its configuration and forensic metadata in property list (.plist) files (binary or XML). plutil is the native macOS tool for reading/converting them; plistutil is the equivalent for Linux/other platforms.

Parse/convert a plist file (on Linux).

plistutil -p <file>

Arguments

Argument	Value	Description
-p	<file>	Print the plist as human-readable XML
-i	<file>	Input plist file (plutil)
-convert	xml1/json	Convert a binary plist to another format (plutil)

Ps

ps reports a snapshot of currently running processes.

List all running processes with detailed info (user, CPU, memory, command).

ps aux

Full-format listing of all processes.

ps -ef

Show processes for a specific user.

ps -u <username>

Show processes sorted by CPU usage.

ps aux --sort=-%cpu

Arguments

Argument	Value	Description
a	-	Show processes for all users
u	-	User-oriented format (shows user, CPU %, memory %)
x	-	Include processes not attached to a terminal
-e	-	Show all processes (equivalent to a)
-f	-	Full-format listing
-u	<user>	Filter by user
--sort	-%cpu	Sort output (prefix - for descending)

Pspy64

pspy is an unprivileged Linux process snooping tool. It monitors process executions and filesystem events without requiring root privileges — making it ideal for detecting cron jobs, scripts run by other users, and other scheduled executions that would otherwise be invisible.

Run pspy64 to monitor process executions.

./pspy64

Run with a custom scan interval (milliseconds).

./pspy64 -i 500

Also watch filesystem events in addition to processes.

./pspy64 -f

Arguments

Argument	Value	Description
-i	<ms>	Interval in milliseconds between scans (default: 100)
-f	-	Also watch filesystem events
-r	<dirs>	Directories to watch recursively
-d	<dirs>	Directories to watch non-recursively
-p	-	Print all commands, not just new/changed ones

More info here.

Pstree

pstree displays running processes as a tree, showing parent-child relationships. Useful for identifying abnormal process spawning patterns.

Display all processes as a tree.

pstree

Show tree with PIDs, user transitions, and full command arguments.

pstree -aups

Show tree for a specific user.

pstree <username>

Show the parent chain for a specific PID.

pstree -s <PID>

Arguments

Argument	Value	Description
-a	-	Show command-line arguments
-u	-	Show user transitions in parentheses
-p	-	Show PIDs
-s	<PID>	Show parent processes of a specified process
-n	-	Sort by PID rather than by name
-h	-	Highlight the current process and its ancestors

Route

route displays or modifies the IP routing table. It shows how packets are directed through the network.

Display the routing table.

route

Display in numeric format (no DNS resolution).

route -n

Add a route.

sudo route add -net <network> gw <gateway>

Delete a route.

sudo route del -net <network>

Arguments

Argument	Value	Description
-n	-	Show numeric addresses (no hostname resolution)
add	-	Add a new route
del	-	Delete a route
-net	<network>	Specify a network address
gw	<gateway>	Specify a gateway

Note: ip r is the modern equivalent and preferred on current Linux distributions.

RsaCTFtool

RSA attack tool (mainly for ctf) - retrieve private key from weak public key and/or uncipher data

This tool is an utility designed to decrypt data from weak public keys and attempt to recover the corresponding private key. Also this tool offers a comprehensive range of attack options, enabling users to apply various strategies to crack the encryption.

More info and commands can be found here.

Rsatool

Rsatool can be used to calculate RSA and RSA-CRT parameters.

Can be installed from here: 🔗 https://github.com/ius/rsatool

Create the PEM and output it to key.pem by supplying modulus and private exponent.

python rsatool.py -f PEM -o key.pem -n 13826123222358393307 -d 9793706120266356337

Create the DER and output it to key.der by supplying two primes.

python rsatool.py -f DER -o key.der -p 4184799299 -q 3303891593

Scalpel

scalpel is a fast file carving tool that recovers files from a disk image based on file headers and footers defined in a configuration file. It is a fork of the original foremost project, focused on speed and low memory usage.

Carve files out of a disk image using a configuration file to define which types to recover.

scalpel Challenge3_deleted_disk.img -o ScalpelOutput -c /etc/scalpel/scalpel.conf

Arguments

Argument	Value	Description
-o	<directory>	Output directory for recovered files
-c	<config>	Path to the scalpel configuration file defining which file types to carve

More info here.

Smbclient

Smbclient is a client that can 'talk' to an SMB/CIFS server and is part of the Samba suite.

'Exploit' misconfiguration of the anonymous login ability.

smbclient <ip> -U:Anonymous -p:<port>

Ss

ss (socket statistics) is the modern replacement for netstat. It dumps socket statistics and shows active connections and listening ports, with faster and more detailed output.

Show all listening TCP and UDP sockets with process info.

ss -tlun

Show all active connections.

ss -a

Show TCP connections with process names.

sudo ss -tlunp

Show connections to a specific port.

ss -tn dst :<port>

Arguments

Argument	Value	Description
-t	-	Show TCP sockets
-u	-	Show UDP sockets
-l	-	Show only listening sockets
-n	-	Show numeric addresses (no DNS resolution)
-p	-	Show process name and PID
-a	-	Show all sockets
-s	-	Show socket statistics summary

Stat

stat displays detailed status information about a file or filesystem, including all four timestamps (access, modify, change, and — on EXT4 — birth) and the inode number. Essential for spotting timestomping, since it shows more than the default ls -l view.

Display file status including timestamps and inode number.

stat test_file2.txt

macOS: display status in a more verbose, human-readable form (e.g. install-done marker file).

stat -x /private/var/db/.AppleSetupDone

Arguments

Argument	Value	Description
-f	-	Display filesystem status instead of file status
-c	<format>	Use a custom output format (GNU/Linux)
-x	-	Verbose, human-readable output (macOS/BSD)

Strings

strings extracts printable character sequences from a binary file or raw device. In forensics, combined with the -t d offset flag, it can locate a known string/signature on disk so its byte offset can be fed into dd for extraction or recovery.

Search a raw device for a known string, printing decimal byte offsets.

sudo strings -t d /dev/loop0 | grep -i "AAAAAAAA"

Arguments

Argument	Value	Description
-t	d/o/x	Print the byte offset before each string (decimal, octal, or hex)
-n	<min-len>	Minimum string length to report (default: 4)
-e	s/S/b/l	Character encoding (single/double-byte, big/little-endian)

Systemctl

systemctl is the primary tool for managing and inspecting systemd services and units. Used in forensics to enumerate services, identify backdoors, and inspect service configurations.

List all services including inactive and failed ones.

sudo systemctl list-units --all --type=service

List only currently running services.

systemctl list-units --type=service --state=running

View the status and recent logs of a service.

systemctl status <service-name>

Print the full unit file for a service.

systemctl cat <service-name>

Start, stop, or restart a service.

sudo systemctl start <service-name>
sudo systemctl stop <service-name>
sudo systemctl restart <service-name>

Enable or disable a service at boot.

sudo systemctl enable <service-name>
sudo systemctl disable <service-name>

Arguments / subcommands

Subcommand / Argument	Value	Description
list-units	--all --type=service	List all services including inactive/failed
status	<service>	Show status and recent logs for a service
cat	<service>	Print the full unit file for a service
start / stop	<service>	Start or stop a service
enable / disable	<service>	Enable or disable a service at boot
--all	-	Include inactive and failed units in output
--type	service	Filter units by type

More info here.

Tcpdump

tcpdump captures and analyzes network packets in real time. Packets can be saved to a file for later analysis or filtered to focus on specific traffic types.

Capture packets on an interface.

sudo tcpdump -i <interface>
sudo tcpdump -i eth0

Capture and save to a file.

sudo tcpdump -i eth0 -w capture.pcap

Read a capture file.

tcpdump -r capture.pcap

Filter by host.

sudo tcpdump -i eth0 host <ip>

Filter by port.

sudo tcpdump -i eth0 port 80

Capture N packets then stop.

sudo tcpdump -i eth0 -c <count>

Arguments

Argument	Value	Description
-i	<interface>	Network interface to capture on
-w	<file.pcap>	Write packets to a file
-r	<file.pcap>	Read packets from a file
-c	<count>	Capture N packets then stop
-n	-	No DNS resolution
-v	-	Verbose output
host	<ip>	Filter by host IP
port	<number>	Filter by port number
tcp/udp/icmp	-	Filter by protocol

Top

top provides a dynamic real-time view of running processes, showing system resource usage including CPU, memory, and process information.

Launch top interactively.

top

Filter to a specific user.

top -u <username>

Run in batch mode (non-interactive, useful for scripting or logging).

top -b -n 1

Update every N seconds.

top -d <seconds>
top -d 5

Arguments

Argument	Value	Description
-b	-	Batch mode — non-interactive, suitable for output piping
-n	<number>	Exit after this many refresh iterations
-u	<user>	Filter processes by user
-d	<seconds>	Delay interval between updates
-p	<PID>	Monitor only the specified PID(s)

Interactive keys while running: k to kill a process, q to quit, M to sort by memory, P to sort by CPU, u to filter by user.

Traceroute

traceroute traces the path packets take to reach a destination, identifying each hop along the way. Useful for diagnosing where network delays or connectivity issues occur.

Trace the route to a host.

traceroute <ip-or-hostname>
traceroute tryhackme.com

Use ICMP instead of UDP.

sudo traceroute -I <host>

Limit the maximum number of hops.

traceroute -m <max-hops> <host>

Arguments

Argument	Value	Description
-m	<hops>	Maximum number of hops (default: 30)
-n	-	Do not resolve hostnames
-I	-	Use ICMP echo requests (requires root)
-T	-	Use TCP SYN packets
-w	<seconds>	Timeout per probe

Note: On Windows, the equivalent command is tracert.

Unifiedlog_parser

unifiedlog_parser (Mandiant's macOS UnifiedLogs parser) parses macOS Unified Log files (.tracev3, found under /private/var/db/diagnostics/ and /private/var/db/uuidtext/) on non-macOS systems, exporting them to CSV for offline analysis.

Parse a collected logarchive and export to CSV.

./unifiedlog_parser -i system_logs.logarchive -o logs/output1.csv

Arguments

Argument	Value	Description
-i	<logarchive>	Input .logarchive bundle or tracev3 directory
-o	<file.csv>	Output CSV file path

More info here.

Uptime

uptime provides a quick snapshot of the system's current status — how long it has been running, the number of logged-in users, and CPU load averages.

Display system uptime and load.

uptime

Display in a more readable format.

uptime -p

Show the time the system was last booted.

uptime -s

Arguments

Argument	Value	Description
-p	-	Show uptime in a human-readable format (e.g. "up 2 hours, 30 minutes")
-s	-	Show the date and time the system was last started

Wget

wget is a non-interactive network downloader. Primarily used to download files from the web and useful for testing download speeds and connectivity.

Download a file.

wget <url>
wget https://example.com/file.txt

Save to a specific filename.

wget -O <filename> <url>

Download in the background.

wget -b <url>

Continue an interrupted download.

wget -c <url>

Mirror a website.

wget -m <url>

Arguments

Argument	Value	Description
-O	<file>	Save output to a specific filename
-b	-	Run in background
-c	-	Continue/resume an interrupted download
-q	-	Quiet mode (no output)
-r	-	Recursive download
--no-check-certificate	-	Skip SSL certificate verification

Whois

whois queries the WHOIS database for domain registration information. Useful for gathering information about domain owners, registrars, and registration dates.

Query WHOIS information for a domain.

whois <domain>
whois tryhackme.com

Query WHOIS for an IP address.

whois <ip>

Arguments

Argument	Value	Description
-h	<server>	Use a specific WHOIS server
-p	<port>	Connect to a specific port

Zgrep

zgrep searches inside gzip-compressed files without needing to decompress them first — useful for searching rotated log archives (e.g. macOS's system.log.0.gz, system.log.1.gz, ...) alongside the current uncompressed log.

Search all rotated + current log files for a keyword.

zgrep BOOT_TIME system.log*
zgrep SHUTDOWN_TIME system.log.*
zgrep login system.log*

Arguments

Argument	Value	Description
-i	-	Case-insensitive search
-c	-	Only print a count of matching lines
<pattern>	<string>	Pattern to search for (supports regex)
<files>	file*	Glob covering both the current and rotated .gz log files