cat > filename << __EOF__ data data data __EOF__ ``` ```bash vim scp://user@host//etc/fstab ``` ```bash mkd() { mkdir -p "$@" && cd "$@"; } ``` ```bash rename 'y/A-Z/a-z/' * ``` ```bash printf "%`tput cols`s" | tr ' ' '#' ``` ```bash history | cut -c 8- fc -l -n 1 | sed 's/^\s*//' ``` ```bash cat > /etc/profile << __EOF__ _after_logout() { username=$(whoami) for _pid in $(ps afx | grep sshd | grep "$username" | awk '{print $1}') ; do kill -9 $_pid done } trap _after_logout EXIT __EOF__ ``` ``...
Install to Claude Code
Skills Directorynpx -y skills add tools-only/X-Skills --skill 1318-shell-oneliners_2c30b852 --agent claude-codeInstalls into .claude/skills of the current project.
Are you the author of 1318 Shell Oneliners 2c30b852?
Add the live security badge to your README — it updates automatically with every re-scan.
[](https://www.skillsdirectory.com/skills/tools-only-1318-shell-oneliners-2c30b852)More formats (shields.io, HTML) on the badges page.
#### Shell One-liners [<sup>[TOC]</sup>](#anger-table-of-contents)
##### Table of Contents
* [terminal](#tool-terminal)
* [busybox](#tool-busybox)
* [mount](#tool-mount)
* [fuser](#tool-fuser)
* [lsof](#tool-lsof)
* [ps](#tool-ps)
* [top](#tool-top)
* [vmstat](#tool-vmstat)
* [iostat](#tool-iostat)
* [strace](#tool-strace)
* [kill](#tool-kill)
* [find](#tool-find)
* [diff](#tool-diff)
* [vimdiff](#tool-vimdiff)
* [tail](#tool-tail)
* [cpulimit](#tool-cpulimit)
* [pwdx](#tool-pwdx)
* [tr](#tool-tr)
* [chmod](#tool-chmod)
* [who](#tool-who)
* [last](#tool-last)
* [screen](#tool-screen)
* [script](#tool-script)
* [du](#tool-du)
* [inotifywait](#tool-inotifywait)
* [openssl](#tool-openssl)
* [secure-delete](#tool-secure-delete)
* [dd](#tool-dd)
* [gpg](#tool-gpg)
* [system-other](#tool-system-other)
* [curl](#tool-curl)
* [httpie](#tool-httpie)
* [ssh](#tool-ssh)
* [linux-dev](#tool-linux-dev)
* [tcpdump](#tool-tcpdump)
* [tcpick](#tool-tcpick)
* [ngrep](#tool-ngrep)
* [hping3](#tool-hping3)
* [nmap](#tool-nmap)
* [netcat](#tool-netcat)
* [socat](#tool-socat)
* [p0f](#tool-p0f)
* [gnutls-cli](#tool-gnutls-cli)
* [netstat](#tool-netstat)
* [rsync](#tool-rsync)
* [host](#tool-host)
* [dig](#tool-dig)
* [certbot](#tool-certbot)
* [network-other](#tool-network-other)
* [git](#tool-git)
* [awk](#tool-awk)
* [sed](#tool-sed)
* [grep](#tool-grep)
* [perl](#tool-perl)
##### Tool: [terminal](https://en.wikipedia.org/wiki/Linux_console)
###### Reload shell without exit
```bash
exec $SHELL -l
```
###### Close shell keeping all subprocess running
```bash
disown -a && exit
```
###### Exit without saving shell history
```bash
kill -9 $$
unset HISTFILE && exit
```
###### Perform a branching conditional
```bash
true && echo success
false || echo failed
```
###### Pipe stdout and stderr to separate commands
```bash
some_command > >(/bin/cmd_for_stdout) 2> >(/bin/cmd_for_stderr)
```
###### Redirect stdout and stderr each to separate files and print both to the screen
```bash
(some_command 2>&1 1>&3 | tee errorlog ) 3>&1 1>&2 | tee stdoutlog
```
###### List of commands you use most often
```bash
history | \
awk '{CMD[$2]++;count++;}END { for (a in CMD)print CMD[a] " " CMD[a]/count*100 "% " a;}' | \
grep -v "./" | \
column -c3 -s " " -t | \
sort -nr | nl | head -n 20
```
###### Sterilize bash history
```bash
function sterile() {
history | awk '$2 != "history" { $1=""; print $0 }' | egrep -vi "\
curl\b+.*(-E|--cert)\b+.*\b*|\
curl\b+.*--pass\b+.*\b*|\
curl\b+.*(-U|--proxy-user).*:.*\b*|\
curl\b+.*(-u|--user).*:.*\b*
.*(-H|--header).*(token|auth.*)\b+.*|\
wget\b+.*--.*password\b+.*\b*|\
http.?://.+:.+@.*\
" > $HOME/histbuff; history -r $HOME/histbuff;
}
export PROMPT_COMMAND="sterile"
```
> Look also: [A naive utility to censor credentials in command history](https://github.com/lbonanomi/go/blob/master/revisionist.go).
###### Quickly backup a file
```bash
cp filename{,.orig}
```
###### Empty a file (truncate to 0 size)
```bash
>filename
```
###### Delete all files in a folder that don't match a certain file extension
```bash
rm !(*.foo|*.bar|*.baz)
```
###### Pass multi-line string to a file
```bash
# cat >filename ... - overwrite the file
# cat >>filename ... - append to a file
cat > filename << __EOF__
data data data
__EOF__
```
###### Edit a file on a remote host using vim
```bash
vim scp://user@host//etc/fstab
```
###### Create a directory and change into it at the same time
```bash
mkd() { mkdir -p "$@" && cd "$@"; }
```
###### Convert uppercase files to lowercase files
```bash
rename 'y/A-Z/a-z/' *
```
###### Print a row of characters across the terminal
```bash
printf "%`tput cols`s" | tr ' ' '#'
```
###### Show shell history without line numbers
```bash
history | cut -c 8-
fc -l -n 1 | sed 's/^\s*//'
```
###### Run command(s) after exit session
```bash
cat > /etc/profile << __EOF__
_after_logout() {
username=$(whoami)
for _pid in $(ps afx | grep sshd | grep "$username" | awk '{print $1}') ; do
kill -9 $_pid
done
}
trap _after_logout EXIT
__EOF__
```
###### Generate a sequence of numbers
```bash
for ((i=1; i<=10; i+=2)) ; do echo $i ; done
# alternative: seq 1 2 10
for ((i=5; i<=10; ++i)) ; do printf '%02d\n' $i ; done
# alternative: seq -w 5 10
for i in {1..10} ; do echo $i ; done
```
###### Simple Bash filewatching
```bash
unset MAIL; export MAILCHECK=1; export MAILPATH='$FILE_TO_WATCH?$MESSAGE'
```
---
##### Tool: [busybox](https://www.busybox.net/)
###### Static HTTP web server
```bash
busybox httpd -p $PORT -h $HOME [-c httpd.conf]
```
___
##### Tool: [mount](https://en.wikipedia.org/wiki/Mount_(Unix))
###### Mount a temporary ram partition
```bash
mount -t tmpfs tmpfs /mnt -o size=64M
```
* `-t` - filesystem type
* `-o` - mount options
###### Remount a filesystem as read/write
```bash
mount -o remount,rw /
```
___
##### Tool: [fuser](https://en.wikipedia.org/wiki/Fuser_(Unix))
###### Show which processes use the files/directories
```bash
fuser /var/log/daemon.log
fuser -v /home/supervisor
```
###### Kills a process that is locking a file
```bash
fuser -ki filename
```
* `-i` - interactive option
###### Kills a process that is locking a file with specific signal
```bash
fuser -k -HUP filename
```
* `--list-signals` - list available signal names
###### Show what PID is listening on specific port
```bash
fuser -v 53/udp
```
###### Show all processes using the named filesystems or block device
```bash
fuser -mv /var/www
```
___
##### Tool: [lsof](https://en.wikipedia.org/wiki/Lsof)
###### Show process that use internet connection at the moment
```bash
lsof -P -i -n
```
###### Show process that use specific port number
```bash
lsof -i tcp:443
```
###### Lists all listening ports together with the PID of the associated process
```bash
lsof -Pan -i tcp -i udp
```
###### List all open ports and their owning executables
```bash
lsof -i -P | grep -i "listen"
```
###### Show all open ports
```bash
lsof -Pnl -i
```
###### Show open ports (LISTEN)
```bash
lsof -Pni4 | grep LISTEN | column -t
```
###### List all files opened by a particular command
```bash
lsof -c "process"
```
###### View user activity per directory
```bash
lsof -u username -a +D /etc
```
###### Show 10 largest open files
```bash
lsof / | \
awk '{ if($7 > 1048576) print $7/1048576 "MB" " " $9 " " $1 }' | \
sort -n -u | tail | column -t
```
###### Show current working directory of a process
```bash
lsof -p <PID> | grep cwd
```
___
##### Tool: [ps](https://en.wikipedia.org/wiki/Ps_(Unix))
###### Show a 4-way scrollable process tree with full details
```bash
ps awwfux | less -S
```
###### Processes per user counter
```bash
ps hax -o user | sort | uniq -c | sort -r
```
###### Show all processes by name with main header
```bash
ps -lfC nginx
```
___
##### Tool: [find](https://en.wikipedia.org/wiki/Find_(Unix))
###### Find files that have been modified on your system in the past 60 minutes
```bash
find / -mmin 60 -type f
```
###### Find all files larger than 20M
```bash
find / -type f -size +20M
```
###### Find duplicate files (based on MD5 hash)
```bash
find -type f -exec md5sum '{}' ';' | sort | uniq --all-repeated=separate -w 33
```
###### Change permission only for files
```bash
cd /var/www/site && find . -type f -exec chmod 766 {} \;
cd /var/www/site && find . -type f -exec chmod 664 {} +
```
###### Change permission only for directories
```bash
cd /var/www/site && find . -type d -exec chmod g+x {} \;
cd /var/www/site && find . -type d -exec chmod g+rwx {} +
```
###### Find files and directories for specific user/group
```bash
# User:
find . -user <username> -print
find /etc -type f -user <username> -name "*.conf"
# Group:
find /opt -group <group>
find /etc -type f -group <group> -iname "*.conf"
```
###### Find files and directories for all without specific user/group
```bash
# User:
find . \! -user <username> -print
# Group:
find . \! -group <group>
```
###### Looking for files/directories that only have certain permission
```bash
# User
find . -user <username> -perm -u+rw # -rw-r--r--
find /home -user $(whoami) -perm 777 # -rwxrwxrwx
# Group:
find /home -type d -group <group> -perm 755 # -rwxr-xr-x
```
###### Delete older files than 60 days
```bash
find . -type f -mtime +60 -delete
```
###### Recursively remove all empty sub-directories from a directory
```bash
find . -depth -type d -empty -exec rmdir {} \;
```
###### How to find all hard links to a file
```bash
find </path/to/dir> -xdev -samefile filename
```
###### Recursively find the latest modified files
```bash
find . -type f -exec stat --format '%Y :%y %n' "{}" \; | sort -nr | cut -d: -f2- | head
```
###### Recursively find/replace of a string with sed
```bash
find . -not -path '*/\.git*' -type f -print0 | xargs -0 sed -i 's/foo/bar/g'
```
###### Recursively find/replace of a string in directories and file names
```bash
find . -depth -name '*test*' -execdir bash -c 'mv -v "$1" "${1//foo/bar}"' _ {} \;
```
###### Recursively find suid executables
```bash
find / \( -perm -4000 -o -perm -2000 \) -type f -exec ls -la {} \;
```
___
##### Tool: [top](https://en.wikipedia.org/wiki/Top_(software))
###### Use top to monitor only all processes with the specific string
```bash
top -p $(pgrep -d , <str>)
```
* `<str>` - process containing string (eg. nginx, worker)
___
##### Tool: [vmstat](https://en.wikipedia.org/wiki/Vmstat)
###### Show current system utilization (fields in kilobytes)
```bash
vmstat 2 20 -t -w
```
* `2` - number of times with a defined time interval (delay)
* `20` - each execution of the command (count)
* `-t` - show timestamp
* `-w` - wide output
* `-S M` - output of the fields in megabytes instead of kilobytes
###### Show current system utilization will get refreshed every 5 seconds
```bash
vmstat 5 -w
```
###### Display report a summary of disk operations
```bash
vmstat -D
```
###### Display report of event counters and memory stats
```bash
vmstat -s
```
###### Display report about kernel objects stored in slab layer cache
```bash
vmstat -m
```
##### Tool: [iostat](https://en.wikipedia.org/wiki/Iostat)
###### Show information about the CPU usage, and I/O statistics about all the partitions
```bash
iostat 2 10 -t -m
```
* `2` - number of times with a defined time interval (delay)
* `10` - each execution of the command (count)
* `-t` - show timestamp
* `-m` - fields in megabytes (`-k` - in kilobytes, default)
###### Show information only about the CPU utilization
```bash
iostat 2 10 -t -m -c
```
###### Show information only about the disk utilization
```bash
iostat 2 10 -t -m -d
```
###### Show information only about the LVM utilization
```bash
iostat -N
```
___
##### Tool: [strace](https://en.wikipedia.org/wiki/Strace)
###### Track with child processes
```bash
# 1)
strace -f -p $(pidof glusterfsd)
# 2)
strace -f $(pidof php-fpm | sed 's/\([0-9]*\)/\-p \1/g')
```
###### Track process with 30 seconds limit
```bash
timeout 30 strace $(< /var/run/zabbix/zabbix_agentd.pid)
```
###### Track processes and redirect output to a file
```bash
ps auxw | grep '[a]pache' | awk '{print " -p " $2}' | \
xargs strace -o /tmp/strace-apache-proc.out
```
###### Track with print time spent in each syscall and limit length of print strings
```bash
ps auxw | grep '[i]init_policy' | awk '{print " -p " $2}' | \
xargs strace -f -e trace=network -T -s 10000
```
###### Track the open request of a network port
```bash
strace -f -e trace=bind nc -l 80
```
###### Track the open request of a network port (show TCP/UDP)
```bash
strace -f -e trace=network nc -lu 80
```
___
##### Tool: [kill](https://en.wikipedia.org/wiki/Kill_(command))
###### Kill a process running on port
```bash
kill -9 $(lsof -i :<port> | awk '{l=$2} END {print l}')
```
___
##### Tool: [diff](https://en.wikipedia.org/wiki/Diff)
###### Compare two directory trees
```bash
diff <(cd directory1 && find | sort) <(cd directory2 && find | sort)
```
###### Compare output of two commands
```bash
diff <(cat /etc/passwd) <(cut -f2 /etc/passwd)
```
___
##### Tool: [vimdiff](http://vimdoc.sourceforge.net/htmldoc/diff.html)
###### Highlight the exact differences, based on characters and words
```bash
vimdiff file1 file2
```
###### Compare two JSON files
```bash
vimdiff <(jq -S . A.json) <(jq -S . B.json)
```
###### Compare Hex dump
```bash
d(){ vimdiff <(f $1) <(f $2);};f(){ hexdump -C $1 | cut -d' ' -f3- | tr -s ' ';}; d ~/bin1 ~/bin2
```
###### diffchar
Save [diffchar](https://raw.githubusercontent.com/vim-scripts/diffchar.vim/master/plugin/diffchar.vim) @ `~/.vim/plugins`
Click `F7` to switch between diff modes
Usefull `vimdiff` commands:
* `qa` to exit all windows
* `:vertical resize 70` to resize window
* set window width `Ctrl+W [N columns]+(Shift+)<\>`
___
##### Tool: [tail](https://en.wikipedia.org/wiki/Tail_(Unix))
###### Annotate tail -f with timestamps
```bash
tail -f file | while read ; do echo "$(date +%T.%N) $REPLY" ; done
```
###### Analyse an Apache access log for the most common IP addresses
```bash
tail -10000 access_log | awk '{print $1}' | sort | uniq -c | sort -n | tail
```
###### Analyse web server log and show only 5xx http codes
```bash
tail -n 100 -f /path/to/logfile | grep "HTTP/[1-2].[0-1]\" [5]"
```
___
##### Tool: [tar](https://en.wikipedia.org/wiki/Tar_(computing))
###### System backup with exclude specific directories
```bash
cd /
tar -czvpf /mnt/system$(date +%d%m%Y%s).tgz --directory=/ \
--exclude=proc/* --exclude=sys/* --exclude=dev/* --exclude=mnt/* .
```
###### System backup with exclude specific directories (pigz)
```bash
cd /
tar cvpf /backup/snapshot-$(date +%d%m%Y%s).tgz --directory=/ \
--exclude=proc/* --exclude=sys/* --exclude=dev/* \
--exclude=mnt/* --exclude=tmp/* --use-compress-program=pigz .
```
___
##### Tool: [dump](https://en.wikipedia.org/wiki/Dump_(program))
###### System backup to file
```bash
dump -y -u -f /backup/system$(date +%d%m%Y%s).lzo /
```
###### Restore system from lzo file
```bash
cd /
restore -rf /backup/system$(date +%d%m%Y%s).lzo
```
___
##### Tool: [cpulimit](http://cpulimit.sourceforge.net/)
###### Limit the cpu usage of a process
```bash
cpulimit -p pid -l 50
```
___
##### Tool: [pwdx](https://www.cyberciti.biz/faq/unix-linux-pwdx-command-examples-usage-syntax/)
###### Show current working directory of a process
```bash
pwdx <pid>
```
___
##### Tool: [taskset](https://www.cyberciti.biz/faq/taskset-cpu-affinity-command/)
###### Start a command on only one CPU core
```bash
taskset -c 0 <command>
```
___
##### Tool: [tr](https://en.wikipedia.org/wiki/Tr_(Unix))
###### Show directories in the PATH, one per line
```bash
tr : '\n' <<<$PATH
```
___
##### Tool: [chmod](https://en.wikipedia.org/wiki/Chmod)
###### Remove executable bit from all files in the current directory
```bash
chmod -R -x+X *
```
###### Restore permission for /bin/chmod
```bash
# 1:
cp /bin/ls chmod.01
cp /bin/chmod chmod.01
./chmod.01 700 file
# 2:
/bin/busybox chmod 0700 /bin/chmod
# 3:
setfacl --set u::rwx,g::---,o::--- /bin/chmod
```
___
##### Tool: [who](https://en.wikipedia.org/wiki/Who_(Unix))
###### Find last reboot time
```bash
who -b
```
###### Detect a user sudo-su'd into the current shell
```bash
[[ $(who -m | awk '{ print $1 }') == $(whoami) ]] || echo "You are su-ed to $(whoami)"
```
___
##### Tool: [last](https://www.howtoforge.com/linux-last-command/)
###### Was the last reboot a panic?
```bash
(last -x -f $(ls -1t /var/log/wtmp* | head -2 | tail -1); last -x -f /var/log/wtmp) | \
grep -A1 reboot | head -2 | grep -q shutdown && echo "Expected reboot" || echo "Panic reboot"
```
___
##### Tool: [screen](https://en.wikipedia.org/wiki/GNU_Screen)
###### Start screen in detached mode
```bash
screen -d -m <command>
```
###### Attach to an existing screen session
```bash
screen -r -d <pid>
```
___
##### Tool: [script](https://en.wikipedia.org/wiki/Script_(Unix))
###### Record and replay terminal session
```bash
### Record session
# 1)
script -t 2>~/session.time -a ~/session.log
# 2)
script --timing=session.time session.log
### Replay session
scriptreplay --timing=session.time session.log
```
___
##### Tool: [du](https://en.wikipedia.org/wiki/GNU_Screen)
###### Show 20 biggest directories with 'K M G'
```bash
du | \
sort -r -n | \
awk '{split("K M G",v); s=1; while($1>1024){$1/=1024; s++} print int($1)" "v[s]"\t"$2}' | \
head -n 20
```
___
##### Tool: [inotifywait](https://en.wikipedia.org/wiki/GNU_Screen)
###### Init tool everytime a file in a directory is modified
```bash
while true ; do inotifywait -r -e MODIFY dir/ && ls dir/ ; done;
```
___
##### Tool: [openssl](https://www.openssl.org/)
###### Testing connection to the remote host
```bash
echo | openssl s_client -connect google.com:443 -showcerts
```
###### Testing connection to the remote host (debug mode)
```bash
echo | openssl s_client -connect google.com:443 -showcerts -tlsextdebug -status
```
###### Testing connection to the remote host (with SNI support)
```bash
echo | openssl s_client -showcerts -servername google.com -connect google.com:443
```
###### Testing connection to the remote host with specific ssl version
```bash
openssl s_client -tls1_2 -connect google.com:443
```
###### Testing connection to the remote host with specific ssl cipher
```bash
openssl s_client -cipher 'AES128-SHA' -connect google.com:443
```
###### Verify 0-RTT
```bash
_host="example.com"
cat > req.in << __EOF__
HEAD / HTTP/1.1
Host: $_host
Connection: close
__EOF__
openssl s_client -connect ${_host}:443 -tls1_3 -sess_out session.pem -ign_eof < req.in
openssl s_client -connect ${_host}:443 -tls1_3 -sess_in session.pem -early_data req.in
```
###### Generate private key without passphrase
```bash
# _len: 2048, 4096
( _fd="private.key" ; _len="2048" ; \
openssl genrsa -out ${_fd} ${_len} )
```
###### Generate private key with passphrase
```bash
# _ciph: aes128, aes256
# _len: 2048, 4096
( _ciph="aes128" ; _fd="private.key" ; _len="2048" ; \
openssl genrsa -${_ciph} -out ${_fd} ${_len} )
```
###### Remove passphrase from private key
```bash
( _fd="private.key" ; _fd_unp="private_unp.key" ; \
openssl rsa -in ${_fd} -out ${_fd_unp} )
```
###### Encrypt existing private key with a passphrase
```bash
# _ciph: aes128, aes256
( _ciph="aes128" ; _fd="private.key" ; _fd_pass="private_pass.key" ; \
openssl rsa -${_ciph} -in ${_fd} -out ${_fd_pass}
```
###### Check private key
```bash
( _fd="private.key" ; \
openssl rsa -check -in ${_fd} )
```
###### Get public key from private key
```bash
( _fd="private.key" ; _fd_pub="public.key" ; \
openssl rsa -pubout -in ${_fd} -out ${_fd_pub} )
```
###### Generate private key and CSR
```bash
( _fd="private.key" ; _fd_csr="request.csr" ; _len="2048" ; \
openssl req -out ${_fd_csr} -new -newkey rsa:${_len} -nodes -keyout ${_fd} )
```
###### Generate CSR
```bash
( _fd="private.key" ; _fd_csr="request.csr" ; \
openssl req -out ${_fd_csr} -new -key ${_fd} )
```
###### Generate CSR (metadata from existing certificate)
> Where `private.key` is the existing private key. As you can see you do not generate this CSR from your certificate (public key). Also you do not generate the "same" CSR, just a new one to request a new certificate.
```bash
( _fd="private.key" ; _fd_csr="request.csr" ; _fd_crt="cert.crt" ; \
openssl x509 -x509toreq -in ${_fd_crt} -out ${_fd_csr} -signkey ${_fd} )
```
###### Generate CSR with -config param
```bash
( _fd="private.key" ; _fd_csr="request.csr" ; \
openssl req -new -sha256 -key ${_fd} -out ${_fd_csr} \
-config <(
cat << __EOF__
[req]
default_bits = 2048
default_md = sha256
prompt = no
distinguished_name = dn
req_extensions = req_ext
[ dn ]
C = "<two-letter ISO abbreviation for your country>"
ST = "<state or province where your organisation is legally located>"
L = "<city where your organisation is legally located>"
O = "<legal name of your organisation>"
OU = "<section of the organisation>"
CN = "<fully qualified domain name>"
[ req_ext ]
subjectAltName = @alt_names
[ alt_names ]
DNS.1 = <fully qualified domain name>
DNS.2 = <next domain>
DNS.3 = <next domain>
__EOF__
))
```
Other values in `[ dn ]`:
```
countryName = "DE" # C=
stateOrProvinceName = "Hessen" # ST=
localityName = "Keller" # L=
postalCode = "424242" # L/postalcode=
postalAddress = "Keller" # L/postaladdress=
streetAddress = "Crater 1621" # L/street=
organizationName = "apfelboymschule" # O=
organizationalUnitName = "IT Department" # OU=
commonName = "example.com" # CN=
emailAddress = "webmaster@example.com" # CN/emailAddress=
```
Example of `oids` (you'll probably also have to make OpenSSL know about the new fields required for EV by adding the following under `[new_oids]`):
```
[req]
...
oid_section = new_oids
[ new_oids ]
postalCode = 2.5.4.17
streetAddress = 2.5.4.9
```
Full example:
```bash
( _fd="private.key" ; _fd_csr="request.csr" ; \
openssl req -new -sha256 -key ${_fd} -out ${_fd_csr} \
-config <(
cat << __EOF__
[req]
default_bits = 2048
default_md = sha256
prompt = no
distinguished_name = dn
req_extensions = req_ext
oid_section = new_oids
[ new_oids ]
serialNumber = 2.5.4.5
streetAddress = 2.5.4.9
postalCode = 2.5.4.17
businessCategory = 2.5.4.15
[ dn ]
serialNumber=00001111
businessCategory=Private Organization
jurisdictionC=DE
C=DE
ST=Hessen
L=Keller
postalCode=424242
streetAddress=Crater 1621
O=AV Company
OU=IT
CN=example.com
[ req_ext ]
subjectAltName = @alt_names
[ alt_names ]
DNS.1 = example.com
__EOF__
))
```
For more information please look at these great explanations:
- [RFC 5280](https://tools.ietf.org/html/rfc5280)
- [How to create multidomain certificates using config files](https://apfelboymchen.net/gnu/notes/openssl%20multidomain%20with%20config%20files.html)
- [Generate a multi domains certificate using config files](https://gist.github.com/romainnorberg/464758a6620228b977212a3cf20c3e08)
- [Your OpenSSL CSR command is out of date](https://expeditedsecurity.com/blog/openssl-csr-command/)
- [OpenSSL example configuration file](https://www.tbs-certificats.com/openssl-dem-server-cert.cnf)
- [Object Identifiers (OIDs)](https://www.alvestrand.no/objectid/)
- [openssl objects.txt](https://github.com/openssl/openssl/blob/master/crypto/objects/objects.txt)
###### List available EC curves
```bash
openssl ecparam -list_curves
```
###### Print ECDSA private and public keys
```bash
( _fd="private.key" ; \
openssl ec -in ${_fd} -noout -text )
# For x25519 only extracting public key
( _fd="private.key" ; _fd_pub="public.key" ; \
openssl pkey -in ${_fd} -pubout -out ${_fd_pub} )
```
###### Generate ECDSA private key
```bash
# _curve: prime256v1, secp521r1, secp384r1
( _fd="private.key" ; _curve="prime256v1" ; \
openssl ecparam -out ${_fd} -name ${_curve} -genkey )
# _curve: X25519
( _fd="private.key" ; _curve="x25519" ; \
openssl genpkey -algorithm ${_curve} -out ${_fd} )
```
###### Generate private key and CSR (ECC)
```bash
# _curve: prime256v1, secp521r1, secp384r1
( _fd="domain.com.key" ; _fd_csr="domain.com.csr" ; _curve="prime256v1" ; \
openssl ecparam -out ${_fd} -name ${_curve} -genkey ; \
openssl req -new -key ${_fd} -out ${_fd_csr} -sha256 )
```
###### Generate self-signed certificate
```bash
# _len: 2048, 4096
( _fd="domain.key" ; _fd_out="domain.crt" ; _len="2048" ; _days="365" ; \
openssl req -newkey rsa:${_len} -nodes \
-keyout ${_fd} -x509 -days ${_days} -out ${_fd_out} )
```
###### Generate self-signed certificate from existing private key
```bash
# _len: 2048, 4096
( _fd="domain.key" ; _fd_out="domain.crt" ; _days="365" ; \
openssl req -key ${_fd} -nodes \
-x509 -days ${_days} -out ${_fd_out} )
```
###### Generate self-signed certificate from existing private key and csr
```bash
# _len: 2048, 4096
( _fd="domain.key" ; _fd_csr="domain.csr" ; _fd_out="domain.crt" ; _days="365" ; \
openssl x509 -signkey ${_fd} -nodes \
-in ${_fd_csr} -req -days ${_days} -out ${_fd_out} )
```
###### Generate DH public parameters
```bash
( _dh_size="2048" ; \
openssl dhparam -out /etc/nginx/ssl/dhparam_${_dh_size}.pem "$_dh_size" )
```
###### Display DH public parameters
```bash
openssl pkeyparam -in dhparam.pem -text
```
###### Extract private key from pfx
```bash
( _fd_pfx="cert.pfx" ; _fd_key="key.pem" ; \
openssl pkcs12 -in ${_fd_pfx} -nocerts -nodes -out ${_fd_key} )
```
###### Extract private key and certs from pfx
```bash
( _fd_pfx="cert.pfx" ; _fd_pem="key_certs.pem" ; \
openssl pkcs12 -in ${_fd_pfx} -nodes -out ${_fd_pem} )
```
###### Extract certs from p7b
```bash
# PKCS#7 file doesn't include private keys.
( _fd_p7b="cert.p7b" ; _fd_pem="cert.pem" ; \
openssl pkcs7 -inform DER -outform PEM -in ${_fd_p7b} -print_certs > ${_fd_pem})
# or:
openssl pkcs7 -print_certs -in -in ${_fd_p7b} -out ${_fd_pem})
```
###### Convert DER to PEM
```bash
( _fd_der="cert.crt" ; _fd_pem="cert.pem" ; \
openssl x509 -in ${_fd_der} -inform der -outform pem -out ${_fd_pem} )
```
###### Convert PEM to DER
```bash
( _fd_der="cert.crt" ; _fd_pem="cert.pem" ; \
openssl x509 -in ${_fd_pem} -outform der -out ${_fd_der} )
```
###### Verification of the private key
```bash
( _fd="private.key" ; \
openssl rsa -noout -text -in ${_fd} )
```
###### Verification of the public key
```bash
# 1)
( _fd="public.key" ; \
openssl pkey -noout -text -pubin -in ${_fd} )
# 2)
( _fd="private.key" ; \
openssl rsa -inform PEM -noout -in ${_fd} &> /dev/null ; \
if [ $? = 0 ] ; then echo -en "OK\n" ; fi )
```
###### Verification of the certificate
```bash
( _fd="certificate.crt" ; # format: pem, cer, crt \
openssl x509 -noout -text -in ${_fd} )
```
###### Verification of the CSR
```bash
( _fd_csr="request.csr" ; \
openssl req -text -noout -in ${_fd_csr} )
```
###### Check the private key and the certificate are match
```bash
(openssl rsa -noout -modulus -in private.key | openssl md5 ; \
openssl x509 -noout -modulus -in certificate.crt | openssl md5) | uniq
```
###### Check the private key and the CSR are match
```bash
(openssl rsa -noout -modulus -in private.key | openssl md5 ; \
openssl req -noout -modulus -in request.csr | openssl md5) | uniq
```
___
##### Tool: [secure-delete](https://wiki.archlinux.org/index.php/Securely_wipe_disk)
###### Secure delete with shred
```bash
shred -vfuz -n 10 file
shred --verbose --random-source=/dev/urandom -n 1 /dev/sda
```
###### Secure delete with scrub
```bash
scrub -p dod /dev/sda
scrub -p dod -r file
```
###### Secure delete with badblocks
```bash
badblocks -s -w -t random -v /dev/sda
badblocks -c 10240 -s -w -t random -v /dev/sda
```
###### Secure delete with secure-delete
```bash
srm -vz /tmp/file
sfill -vz /local
sdmem -v
swapoff /dev/sda5 && sswap -vz /dev/sda5
```
___
##### Tool: [dd](https://en.wikipedia.org/wiki/Dd_(Unix))
###### Show dd status every so often
```bash
dd <dd_params> status=progress
watch --interval 5 killall -USR1 dd
```
###### Redirect output to a file with dd
```bash
echo "string" | dd of=filename
```
___
##### Tool: [gpg](https://www.gnupg.org/)
###### Export public key
```bash
gpg --export --armor "<username>" > username.pkey
```
* `--export` - export all keys from all keyrings or specific key
* `-a|--armor` - create ASCII armored output
###### Encrypt file
```bash
gpg -e -r "<username>" dump.sql
```
* `-e|--encrypt` - encrypt data
* `-r|--recipient` - encrypt for specific <username>
###### Decrypt file
```bash
gpg -o dump.sql -d dump.sql.gpg
```
* `-o|--output` - use as output file
* `-d|--decrypt` - decrypt data (default)
###### Search recipient
```bash
gpg --keyserver hkp://keyserver.ubuntu.com --search-keys "<username>"
```
* `--keyserver` - set specific key server
* `--search-keys` - search for keys on a key server
###### List all of the packets in an encrypted file
```bash
gpg --batch --list-packets archive.gpg
gpg2 --batch --list-packets archive.gpg
```
___
##### Tool: [system-other](https://github.com/trimstray/the-book-of-secret-knowledge#tool-system-other)
###### Reboot system from init
```bash
exec /sbin/init 6
```
###### Init system from single user mode
```bash
exec /sbin/init
```
###### Show current working directory of a process
```bash
readlink -f /proc/<PID>/cwd
```
###### Show actual pathname of the executed command
```bash
readlink -f /proc/<PID>/exe
```
##### Tool: [curl](https://curl.haxx.se)
```bash
curl -Iks https://www.google.com
```
* `-I` - show response headers only
* `-k` - insecure connection when using ssl
* `-s` - silent mode (not display body)
```bash
curl -Iks --location -X GET -A "x-agent" https://www.google.com
```
* `--location` - follow redirects
* `-X` - set method
* `-A` - set user-agent
```bash
curl -Iks --location -X GET -A "x-agent" --proxy http://127.0.0.1:16379 https://www.google.com
```
* `--proxy [socks5://|http://]` - set proxy server
```bash
curl -o file.pdf -C - https://example.com/Aiju2goo0Ja2.pdf
```
* `-o` - write output to file
* `-C` - resume the transfer
###### Find your external IP address (external services)
```bash
curl ipinfo.io
curl ipinfo.io/ip
curl icanhazip.com
curl ifconfig.me/ip ; echo
```
###### Repeat URL request
```bash
# URL sequence substitution with a dummy query string:
curl -ks https://example.com/?[1-20]
# With shell 'for' loop:
for i in {1..20} ; do curl -ks https://example.com/ ; done
```
###### Check DNS and HTTP trace with headers for specific domains
```bash
### Set domains and external dns servers.
_domain_list=(google.com) ; _dns_list=("8.8.8.8" "1.1.1.1")
for _domain in "${_domain_list[@]}" ; do
printf '=%.0s' {1..48}
echo
printf "[\\e[1;32m+\\e[m] resolve: %s\\n" "$_domain"
for _dns in "${_dns_list[@]}" ; do
# Resolve domain.
host "${_domain}" "${_dns}"
echo
done
for _proto in http https ; do
printf "[\\e[1;32m+\\e[m] trace + headers: %s://%s\\n" "$_proto" "$_domain"
# Get trace and http headers.
curl -Iks -A "x-agent" --location "${_proto}://${_domain}"
echo
done
done
unset _domain_list _dns_list
```
___
##### Tool: [httpie](https://httpie.org/)
```bash
http -p Hh https://www.google.com
```
* `-p` - print request and response headers
* `H` - request headers
* `B` - request body
* `h` - response headers
* `b` - response body
```bash
http -p Hh https://www.google.com --follow --verify no
```
* `-F, --follow` - follow redirects
* `--verify no` - skip SSL verification
```bash
http -p Hh https://www.google.com --follow --verify no \
--proxy http:http://127.0.0.1:16379
```
* `--proxy [http:]` - set proxy server
##### Tool: [ssh](https://www.openssh.com/)
###### Escape Sequence
```
# Supported escape sequences:
~. - terminate connection (and any multiplexed sessions)
~B - send a BREAK to the remote system
~C - open a command line
~R - Request rekey (SSH protocol 2 only)
~^Z - suspend ssh
~# - list forwarded connections
~& - background ssh (when waiting for connections to terminate)
~? - this message
~~ - send the escape character by typing it twice
```
###### Compare a remote file with a local file
```bash
ssh user@host cat /path/to/remotefile | diff /path/to/localfile -
```
###### SSH connection through host in the middle
```bash
ssh -t reachable_host ssh unreachable_host
```
###### Run command over SSH on remote host
```bash
cat > cmd.txt << __EOF__
cat /etc/hosts
__EOF__
ssh host -l user $(<cmd.txt)
```
###### Get public key from private key
```bash
ssh-keygen -y -f ~/.ssh/id_rsa
```
###### Get all fingerprints
```bash
ssh-keygen -l -f .ssh/known_hosts
```
###### SSH authentication with user password
```bash
ssh -o PreferredAuthentications=password -o PubkeyAuthentication=no user@remote_host
```
###### SSH authentication with publickey
```bash
ssh -o PreferredAuthentications=publickey -o PubkeyAuthentication=yes -i id_rsa user@remote_host
```
###### Simple recording SSH session
```bash
function _ssh_sesslog() {
_sesdir="<path/to/session/logs>"
mkdir -p "${_sesdir}" && \
ssh $@ 2>&1 | tee -a "${_sesdir}/$(date +%Y%m%d).log"
}
# Alias:
alias ssh='_ssh_sesslog'
```
###### Using Keychain for SSH logins
```bash
### Delete all of ssh-agent's keys.
function _scl() {
/usr/bin/keychain --clear
}
### Add key to keychain.
function _scg() {
/usr/bin/keychain /path/to/private-key
source "$HOME/.keychain/$HOSTNAME-sh"
}
```
###### SSH login without processing any login scripts
```bash
ssh -tt user@host bash
```
###### SSH local port forwarding
Example 1:
```bash
# Forwarding our local 2250 port to nmap.org:443 from localhost through localhost
host1> ssh -L 2250:nmap.org:443 localhost
# Connect to the service:
host1> curl -Iks --location -X GET https://localhost:2250
```
Example 2:
```bash
# Forwarding our local 9051 port to db.d.x:5432 from localhost through node.d.y
host1> ssh -nNT -L 9051:db.d.x:5432 node.d.y
# Connect to the service:
host1> psql -U db_user -d db_dev -p 9051 -h localhost
```
* `-n` - redirects stdin from `/dev/null`
* `-N` - do not execute a remote command
* `-T` - disable pseudo-terminal allocation
###### SSH remote port forwarding
```bash
# Forwarding our local 9051 port to db.d.x:5432 from host2 through node.d.y
host1> ssh -nNT -R 9051:db.d.x:5432 node.d.y
# Connect to the service:
host2> psql -U postgres -d postgres -p 8000 -h localhost
```
___
##### Tool: [linux-dev](https://www.tldp.org/LDP/abs/html/devref1.html)
###### Testing remote connection to port
```bash
timeout 1 bash -c "</dev/<proto>/<host>/<port>" >/dev/null 2>&1 ; echo $?
```
* `<proto` - set protocol (tcp/udp)
* `<host>` - set remote host
* `<port>` - set destination port
###### Read and write to TCP or UDP sockets with common bash tools
```bash
exec 5<>/dev/tcp/<host>/<port>; cat <&5 & cat >&5; exec 5>&-
```
___
##### Tool: [tcpdump](http://www.tcpdump.org/)
###### Filter incoming (on interface) traffic (specific <ip:port>)
```bash
tcpdump -ne -i eth0 -Q in host 192.168.252.1 and port 443
```
* `-n` - don't convert addresses (`-nn` will not resolve hostnames or ports)
* `-e` - print the link-level headers
* `-i [iface|any]` - set interface
* `-Q|-D [in|out|inout]` - choose send/receive direction (`-D` - for old tcpdump versions)
* `host [ip|hostname]` - set host, also `[host not]`
* `[and|or]` - set logic
* `port [1-65535]` - set port number, also `[port not]`
###### Filter incoming (on interface) traffic (specific <ip:port>) and write to a file
```bash
tcpdump -ne -i eth0 -Q in host 192.168.252.1 and port 443 -c 5 -w tcpdump.pcap
```
* `-c [num]` - capture only num number of packets
* `-w [filename]` - write packets to file, `-r [filename]` - reading from file
###### Capture all ICMP packets
```bash
tcpdump -nei eth0 icmp
```
###### Check protocol used (TCP or UDP) for service
```bash
tcpdump -nei eth0 tcp port 22 -vv -X | egrep "TCP|UDP"
```
###### Display ASCII text (to parse the output using grep or other)
```bash
tcpdump -i eth0 -A -s0 port 443
```
###### Grab everything between two keywords
```bash
tcpdump -i eth0 port 80 -X | sed -n -e '/username/,/=ldap/ p'
```
###### Grab user and pass ever plain http
```bash
tcpdump -i eth0 port http -l -A | egrep -i \
'pass=|pwd=|log=|login=|user=|username=|pw=|passw=|passwd=|password=|pass:|user:|username:|password:|login:|pass |user ' \
--color=auto --line-buffered -B20
```
###### Extract HTTP User Agent from HTTP request header
```bash
tcpdump -ei eth0 -nn -A -s1500 -l | grep "User-Agent:"
```
###### Capture only HTTP GET and POST packets
```bash
tcpdump -ei eth0 -s 0 -A -vv \
'tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420' or 'tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x504f5354'
```
or simply:
```bash
tcpdump -ei eth0 -s 0 -v -n -l | egrep -i "POST /|GET /|Host:"
```
###### Rotate capture files
```bash
tcpdump -ei eth0 -w /tmp/capture-%H.pcap -G 3600 -C 200
```
* `-G <num>` - pcap will be created every `<num>` seconds
* `-C <size>` - close the current pcap and open a new one if is larger than `<size>`
###### Top hosts by packets
```bash
tcpdump -ei enp0s25 -nnn -t -c 200 | cut -f 1,2,3,4 -d '.' | sort | uniq -c | sort -nr | head -n 20
```
###### Excludes any RFC 1918 private address
```bash
tcpdump -nei eth0 'not (src net (10 or 172.16/12 or 192.168/16) and dst net (10 or 172.16/12 or 192.168/16))'
```
___
##### Tool: [tcpick](http://tcpick.sourceforge.net/)
###### Analyse packets in real-time
```bash
while true ; do tcpick -a -C -r dump.pcap ; sleep 2 ; clear ; done
```
___
##### Tool: [ngrep](http://ngrep.sourceforge.net/usage.html)
```bash
ngrep -d eth0 "www.domain.com" port 443
```
* `-d [iface|any]` - set interface
* `[domain]` - set hostname
* `port [1-65535]` - set port number
```bash
ngrep -d eth0 "www.domain.com" src host 10.240.20.2 and port 443
```
* `(host [ip|hostname])` - filter by ip or hostname
* `(port [1-65535])` - filter by port number
```bash
ngrep -d eth0 -qt -O ngrep.pcap "www.domain.com" port 443
```
* `-q` - quiet mode (only payloads)
* `-t` - added timestamps
* `-O [filename]` - save output to file, `-I [filename]` - reading from file
```bash
ngrep -d eth0 -qt 'HTTP' 'tcp'
```
* `HTTP` - show http headers
* `tcp|udp` - set protocol
* `[src|dst] host [ip|hostname]` - set direction for specific node
```bash
ngrep -l -q -d eth0 -i "User-Agent: curl*"
```
* `-l` - stdout line buffered
* `-i` - case-insensitive search
___
##### Tool: [hping3](http://www.hping.org/)
```bash
hping3 -V -p 80 -s 5050 <scan_type> www.google.com
```
* `-V|--verbose` - verbose mode
* `-p|--destport` - set destination port
* `-s|--baseport` - set source port
* `<scan_type>` - set scan type
* `-F|--fin` - set FIN flag, port open if no reply
* `-S|--syn` - set SYN flag
* `-P|--push` - set PUSH flag
* `-A|--ack` - set ACK flag (use when ping is blocked, RST response back if the port is open)
* `-U|--urg` - set URG flag
* `-Y|--ymas` - set Y unused flag (0x80 - nullscan), port open if no reply
* `-M 0 -UPF` - set TCP sequence number and scan type (URG+PUSH+FIN), port open if no reply
```bash
hping3 -V -c 1 -1 -C 8 www.google.com
```
* `-c [num]` - packet count
* `-1` - set ICMP mode
* `-C|--icmptype [icmp-num]` - set icmp type (default icmp-echo = 8)
```bash
hping3 -V -c 1000000 -d 120 -S -w 64 -p 80 --flood --rand-source <remote_host>
```
* `--flood` - sent packets as fast as possible (don't show replies)
* `--rand-source` - random source address mode
* `-d --data` - data size
* `-w|--win` - winsize (default 64)
___
##### Tool: [nmap](https://nmap.org/)
###### Ping scans the network
```bash
nmap -sP 192.168.0.0/24
```
###### Show only open ports
```bash
nmap -F --open 192.168.0.0/24
```
###### Full TCP port scan using with service version detection
```bash
nmap -p 1-65535 -sV -sS -T4 192.168.0.0/24
```
###### Nmap scan and pass output to Nikto
```bash
nmap -p80,443 192.168.0.0/24 -oG - | nikto.pl -h -
```
###### Recon specific ip:service with Nmap NSE scripts stack
```bash
# Set variables:
_hosts="192.168.250.10"
_ports="80,443"
# Set Nmap NSE scripts stack:
_nmap_nse_scripts="+dns-brute,\
+http-auth-finder,\
+http-chrono,\
+http-cookie-flags,\
+http-cors,\
+http-cross-domain-policy,\
+http-csrf,\
+http-dombased-xss,\
+http-enum,\
+http-errors,\
+http-git,\
+http-grep,\
+http-internal-ip-disclosure,\
+http-jsonp-detection,\
+http-malware-host,\
+http-methods,\
+http-passwd,\
+http-phpself-xss,\
+http-php-version,\
+http-robots.txt,\
+http-sitemap-generator,\
+http-shellshock,\
+http-stored-xss,\
+http-title,\
+http-unsafe-output-escaping,\
+http-useragent-tester,\
+http-vhosts,\
+http-waf-detect,\
+http-waf-fingerprint,\
+http-xssed,\
+traceroute-geolocation.nse,\
+ssl-enum-ciphers,\
+whois-domain,\
+whois-ip"
# Set Nmap NSE script params:
_nmap_nse_scripts_args="dns-brute.domain=${_hosts},http-cross-domain-policy.domain-lookup=true,"
_nmap_nse_scripts_args+="http-waf-detect.aggro,http-waf-detect.detectBodyChanges,"
_nmap_nse_scripts_args+="http-waf-fingerprint.intensive=1"
# Perform scan:
nmap --script="$_nmap_nse_scripts" --script-args="$_nmap_nse_scripts_args" -p "$_ports" "$_hosts"
```
___
##### Tool: [netcat](http://netcat.sourceforge.net/)
```bash
nc -kl 5000
```
* `-l` - listen for an incoming connection
* `-k` - listening after client has disconnected
* `>filename.out` - save receive data to file (optional)
```bash
nc 192.168.0.1 5051 < filename.in
```
* `< filename.in` - send data to remote host
```bash
nc -vz 10.240.30.3 5000
```
* `-v` - verbose output
* `-z` - scan for listening daemons
```bash
nc -vzu 10.240.30.3 1-65535
```
* `-u` - scan only udp ports
###### Transfer data file (archive)
```bash
server> nc -l 5000 | tar xzvfp -
client> tar czvfp - /path/to/dir | nc 10.240.30.3 5000
```
###### Launch remote shell
```bash
# 1)
server> nc -l 5000 -e /bin/bash
client> nc 10.240.30.3 5000
# 2)
server> rm -f /tmp/f; mkfifo /tmp/f
server> cat /tmp/f | /bin/bash -i 2>&1 | nc -l 127.0.0.1 5000 > /tmp/f
client> nc 10.240.30.3 5000
```
###### Simple file server
```bash
while true ; do nc -l 5000 | tar -xvf - ; done
```
###### Simple minimal HTTP Server
```bash
while true ; do nc -l -p 1500 -c 'echo -e "HTTP/1.1 200 OK\n\n $(date)"' ; done
```
###### Simple HTTP Server
> Restarts web server after each request - remove `while` condition for only single connection.
```bash
cat > index.html << __EOF__
<!doctype html>
<head>
<meta charset="utf-8">
<meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1">
<title></title>
<meta name="description" content="">
<meta name="viewport" content="width=device-width, initial-scale=1">
</head>
<body>
<p>
Hello! It's a site.
</p>
</body>
</html>
__EOF__
```
```bash
server> while : ; do \
(echo -ne "HTTP/1.1 200 OK\r\nContent-Length: $(wc -c <index.html)\r\n\r\n" ; cat index.html;) | \
nc -l -p 5000 \
; done
```
* `-p` - port number
###### Simple HTTP Proxy (single connection)
```bash
#!/usr/bin/env bash
if [[ $# != 2 ]] ; then
printf "%s\\n" \
"usage: ./nc-proxy listen-port bk_host:bk_port"
fi
_listen_port="$1"
_bk_host=$(echo "$2" | cut -d ":" -f1)
_bk_port=$(echo "$2" | cut -d ":" -f2)
printf " lport: %s\\nbk_host: %s\\nbk_port: %s\\n\\n" \
"$_listen_port" "$_bk_host" "$_bk_port"
_tmp=$(mktemp -d)
_back="$_tmp/pipe.back"
_sent="$_tmp/pipe.sent"
_recv="$_tmp/pipe.recv"
trap 'rm -rf "$_tmp"' EXIT
mkfifo -m 0600 "$_back" "$_sent" "$_recv"
sed "s/^/=> /" <"$_sent" &
sed "s/^/<= /" <"$_recv" &
nc -l -p "$_listen_port" <"$_back" | \
tee "$_sent" | \
nc "$_bk_host" "$_bk_port" | \
tee "$_recv" >"$_back"
```
```bash
server> chmod +x nc-proxy && ./nc-proxy 8080 192.168.252.10:8000
lport: 8080
bk_host: 192.168.252.10
bk_port: 8000
client> http -p h 10.240.30.3:8080
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=31536000
Content-Length: 2748
Content-Type: text/html; charset=utf-8
Date: Sun, 01 Jul 2018 20:12:08 GMT
Last-Modified: Sun, 01 Apr 2018 21:53:37 GMT
```
###### Create a single-use TCP or UDP proxy
```bash
### TCP -> TCP
nc -l -p 2000 -c "nc [ip|hostname] 3000"
### TCP -> UDP
nc -l -p 2000 -c "nc -u [ip|hostname] 3000"
### UDP -> UDP
nc -l -u -p 2000 -c "nc -u [ip|hostname] 3000"
### UDP -> TCP
nc -l -u -p 2000 -c "nc [ip|hostname] 3000"
```
___
##### Tool: [gnutls-cli](https://gnutls.org/manual/html_node/gnutls_002dcli-Invocation.html)
###### Testing connection to remote host (with SNI support)
```bash
gnutls-cli -p 443 google.com
```
###### Testing connection to remote host (without SNI support)
```bash
gnutls-cli --disable-sni -p 443 google.com
```
___
##### Tool: [socat](http://www.dest-unreach.org/socat/doc/socat.html)
###### Testing remote connection to port
```bash
socat - TCP4:10.240.30.3:22
```
* `-` - standard input (STDIO)
* `TCP4:<params>` - set tcp4 connection with specific params
* `[hostname|ip]` - set hostname/ip
* `[1-65535]` - set port number
###### Redirecting TCP-traffic to a UNIX domain socket under Linux
```bash
socat TCP-LISTEN:1234,bind=127.0.0.1,reuseaddr,fork,su=nobody,range=127.0.0.0/8 UNIX-CLIENT:/tmp/foo
```
* `TCP-LISTEN:<params>` - set tcp listen with specific params
* `[1-65535]` - set port number
* `bind=[hostname|ip]` - set bind hostname/ip
* `reuseaddr` - allows other sockets to bind to an address
* `fork` - keeps the parent process attempting to produce more connections
* `su=nobody` - set user
* `range=[ip-range]` - ip range
* `UNIX-CLIENT:<params>` - communicates with the specified peer socket
* `filename` - define socket
___
##### Tool: [p0f](http://lcamtuf.coredump.cx/p0f3/)
###### Set iface in promiscuous mode and dump traffic to the log file
```bash
p0f -i enp0s25 -p -d -o /dump/enp0s25.log
```
* `-i` - listen on the specified interface
* `-p` - set interface in promiscuous mode
* `-d` - fork into background
* `-o` - output file
___
##### Tool: [netstat](https://en.wikipedia.org/wiki/Netstat)
###### Graph # of connections for each hosts
```bash
netstat -an | awk '/ESTABLISHED/ { split($5,ip,":"); if (ip[1] !~ /^$/) print ip[1] }' | \
sort | uniq -c | awk '{ printf("%s\t%s\t",$2,$1) ; for (i = 0; i < $1; i++) {printf("*")}; print "" }'
```
###### Monitor open connections for specific port including listen, count and sort it per IP
```bash
watch "netstat -plan | grep :443 | awk {'print \$5'} | cut -d: -f 1 | sort | uniq -c | sort -nk 1"
```
###### Grab banners from local IPv4 listening ports
```bash
netstat -nlt | grep 'tcp ' | grep -Eo "[1-9][0-9]*" | xargs -I {} sh -c "echo "" | nc -v -n -w1 127.0.0.1 {}"
```
___
##### Tool: [rsync](https://en.wikipedia.org/wiki/Rsync)
###### Rsync remote data as root using sudo
```bash
rsync --rsync-path 'sudo rsync' username@hostname:/path/to/dir/ /local/
```
___
##### Tool: [host](https://en.wikipedia.org/wiki/Host_(Unix))
###### Resolves the domain name (using external dns server)
```bash
host google.com 9.9.9.9
```
###### Checks the domain administrator (SOA record)
```bash
host -t soa google.com 9.9.9.9
```
___
##### Tool: [dig](https://en.wikipedia.org/wiki/Dig_(command))
###### Resolves the domain name (short output)
```bash
dig google.com +short
```
###### Lookup NS record for specific domain
```bash
dig @9.9.9.9 google.com NS
```
###### Query only answer section
```bash
dig google.com +nocomments +noquestion +noauthority +noadditional +nostats
```
###### Query ALL DNS Records
```bash
dig google.com ANY +noall +answer
```
###### DNS Reverse Look-up
```bash
dig -x 172.217.16.14 +short
```
___
##### Tool: [certbot](https://certbot.eff.org/)
###### Generate multidomain certificate
```bash
certbot certonly -d example.com -d www.example.com
```
###### Generate wildcard certificate
```bash
certbot certonly --manual --preferred-challenges=dns -d example.com -d *.example.com
```
###### Generate certificate with 4096 bit private key
```bash
certbot certonly -d example.com -d www.example.com --rsa-key-size 4096
```
___
##### Tool: [network-other](https://github.com/trimstray/the-book-of-secret-knowledge#tool-network-other)
###### Get all subnets for specific AS (Autonomous system)
```bash
AS="AS32934"
whois -h whois.radb.net -- "-i origin ${AS}" | \
grep "^route:" | \
cut -d ":" -f2 | \
sed -e 's/^[ \t]//' | \
sort -n -t . -k 1,1 -k 2,2 -k 3,3 -k 4,4 | \
cut -d ":" -f2 | \
sed -e 's/^[ \t]/allow /' | \
sed 's/$/;/' | \
sed 's/allow */subnet -> /g'
```
###### Resolves domain name from dns.google.com with curl and jq
```bash
_dname="google.com" ; curl -s "https://dns.google.com/resolve?name=${_dname}&type=A" | jq .
```
##### Tool: [git](https://git-scm.com/)
###### Log alias for a decent view of your repo
```bash
# 1)
git log --oneline --decorate --graph --all
# 2)
git log --graph \
--pretty=format:'%Cred%h%Creset -%C(yellow)%d%Creset %s %Cgreen(%cr) %C(bold blue)<%an>%Creset' \
--abbrev-commit
```
___
##### Tool: [python](https://www.python.org/)
###### Static HTTP web server
```bash
# Python 3.x
python3 -m http.server 8000 --bind 127.0.0.1
# Python 2.x
python -m SimpleHTTPServer 8000
```
###### Static HTTP web server with SSL support
```bash
# Python 3.x
from http.server import HTTPServer, BaseHTTPRequestHandler
import ssl
httpd = HTTPServer(('localhost', 4443), BaseHTTPRequestHandler)
httpd.socket = ssl.wrap_socket (httpd.socket,
keyfile="path/to/key.pem",
certfile='path/to/cert.pem', server_side=True)
httpd.serve_forever()
# Python 2.x
import BaseHTTPServer, SimpleHTTPServer
import ssl
httpd = BaseHTTPServer.HTTPServer(('localhost', 4443),
SimpleHTTPServer.SimpleHTTPRequestHandler)
httpd.socket = ssl.wrap_socket (httpd.socket,
keyfile="path/tp/key.pem",
certfile='path/to/cert.pem', server_side=True)
httpd.serve_forever()
```
###### Encode base64
```bash
python -m base64 -e <<< "sample string"
```
###### Decode base64
```bash
python -m base64 -d <<< "dGhpcyBpcyBlbmNvZGVkCg=="
```
##### Tool: [awk](http://www.grymoire.com/Unix/Awk.html)
###### Search for matching lines
```bash
# egrep foo
awk '/foo/' filename
```
###### Search non matching lines
```bash
# egrep -v foo
awk '!/foo/' filename
```
###### Print matching lines with numbers
```bash
# egrep -n foo
awk '/foo/{print FNR,$0}' filename
```
###### Print the last column
```bash
awk '{print $NF}' filename
```
###### Find all the lines longer than 80 characters
```bash
awk 'length($0)>80{print FNR,$0}' filename
```
###### Print only lines of less than 80 characters
```bash
awk 'length < 80' filename
```
###### Print double new lines a file
```bash
awk '1; { print "" }' filename
```
###### Print line numbers
```bash
awk '{ print FNR "\t" $0 }' filename
awk '{ printf("%5d : %s\n", NR, $0) }' filename # in a fancy manner
```
###### Print line numbers for only non-blank lines
```bash
awk 'NF { $0=++a " :" $0 }; { print }' filename
```
###### Print the line and the next two (i=5) lines after the line matching regexp
```bash
awk '/foo/{i=5+1;}{if(i){i--; print;}}' filename
```
###### Print the lines starting at the line matching 'server {' until the line matching '}'
```bash
awk '/server {/,/}/' filename
```
###### Print multiple columns with separators
```bash
awk -F' ' '{print "ip:\t" $2 "\n port:\t" $3' filename
```
###### Remove empty lines
```bash
awk 'NF > 0' filename
# alternative:
awk NF filename
```
###### Delete trailing white space (spaces, tabs)
```bash
awk '{sub(/[ \t]*$/, "");print}' filename
```
###### Delete leading white space
```bash
awk '{sub(/^[ \t]+/, ""); print}' filename
```
###### Remove duplicate consecutive lines
```bash
# uniq
awk 'a !~ $0{print}; {a=$0}' filename
```
###### Remove duplicate entries in a file without sorting
```bash
awk '!x[$0]++' filename
```
###### Exclude multiple columns
```bash
awk '{$1=$3=""}1' filename
```
###### Substitute foo for bar on lines matching regexp
```bash
awk '/regexp/{gsub(/foo/, "bar")};{print}' filename
```
###### Add some characters at the beginning of matching lines
```bash
awk '/regexp/{sub(/^/, "++++"); print;next;}{print}' filename
```
###### Get the last hour of Apache logs
```bash
awk '/'$(date -d "1 hours ago" "+%d\\/%b\\/%Y:%H:%M")'/,/'$(date "+%d\\/%b\\/%Y:%H:%M")'/ { print $0 }' \
/var/log/httpd/access_log
```
___
##### Tool: [sed](http://www.grymoire.com/Unix/Sed.html)
###### Print a specific line from a file
```bash
sed -n 10p /path/to/file
```
###### Remove a specific line from a file
```bash
sed -i 10d /path/to/file
# alternative (BSD): sed -i'' 10d /path/to/file
```
###### Remove a range of lines from a file
```bash
sed -i <file> -re '<start>,<end>d'
```
###### Replace newline(s) with a space
```bash
sed ':a;N;$!ba;s/\n/ /g' /path/to/file
# cross-platform compatible syntax:
sed -e ':a' -e 'N' -e '$!ba' -e 's/\n/ /g' /path/to/file
```
- `:a` create a label `a`
- `N` append the next line to the pattern space
- `$!` if not the last line, ba branch (go to) label `a`
- `s` substitute, `/\n/` regex for new line, `/ /` by a space, `/g` global match (as many times as it can)
Alternatives:
```bash
# perl version (sed-like speed):
perl -p -e 's/\n/ /' /path/to/file
# bash version (slow):
while read line ; do printf "%s" "$line " ; done < file
```
###### Delete string +N next lines
```bash
sed '/start/,+4d' /path/to/file
```
___
##### Tool: [grep](http://www.grymoire.com/Unix/Grep.html)
###### Search for a "pattern" inside all files in the current directory
```bash
grep -rn "pattern"
grep -RnisI "pattern" *
fgrep "pattern" * -R
```
###### Show only for multiple patterns
```bash
grep 'INFO*'\''WARN' filename
grep 'INFO\|WARN' filename
grep -e INFO -e WARN filename
grep -E '(INFO|WARN)' filename
egrep "INFO|WARN" filename
```
###### Except multiple patterns
```bash
grep -vE '(error|critical|warning)' filename
```
###### Show data from file without comments
```bash
grep -v ^[[:space:]]*# filename
```
###### Show data from file without comments and new lines
```bash
egrep -v '#|^$' filename
```
###### Show strings with a dash/hyphen
```bash
grep -e -- filename
grep -- -- filename
grep "\-\-" filename
```
###### Remove blank lines from a file and save output to new file
```bash
grep . filename > newfilename
```
##### Tool: [perl](https://www.perl.org/)
###### Search and replace (in place)
```bash
perl -i -pe's/SEARCH/REPLACE/' filename
```
###### Edit of `*.conf` files changing all foo to bar (and backup original)
```bash
perl -p -i.orig -e 's/\bfoo\b/bar/g' *.conf
```
###### Prints the first 20 lines from `*.conf` files
```bash
perl -pe 'exit if $. > 20' *.conf
```
###### Search lines 10 to 20
```bash
perl -ne 'print if 10 .. 20' filename
```
###### Delete first 10 lines (and backup original)
```bash
perl -i.orig -ne 'print unless 1 .. 10' filename
```
###### Delete all but lines between foo and bar (and backup original)
```bash
perl -i.orig -ne 'print unless /^foo$/ .. /^bar$/' filename
```
###### Reduce multiple blank lines to a single line
```bash
perl -p -i -00pe0 filename
```
###### Convert tabs to spaces (1t = 2sp)
```bash
perl -p -i -e 's/\t/ /g' filename
```
###### Read input from a file and report number of lines and characters
```bash
perl -lne '$i++; $in += length($_); END { print "$i lines, $in characters"; }' filename
```
#### Shell Tricks [<sup>[TOC]</sup>](#anger-table-of-contents)
Scanned 6/1/2026
Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.
No comments yet. Be the first to comment!
