Commands by operat0r (6)

  • To be used with other port scanners and or for help with iptables --dport 1000:2000 style expansion Show Sample Output


    0
    nmap -oA derp --top-ports 10 localhost>/dev/null;grep 'services\=' derp.xml | sed -r 's/.*services\=\"(.*)(\"\/>)/\1/g'
    operat0r · 2020-02-06 12:59:24 89
  • This will allow you to ensure you don't get nagged by updates and also protects you from watering hole attacks! Please be sure to make sure your plugins don't have any security issues! Backups are manifext.jason.bak credit @Jay https://chat.counterpoint.info


    0
    find / -iname "manifest.json" -exec sed 's/\"update_url\": \"http/\"update_url\": \"hxxp/g' -i.bak '{}' \;
    operat0r · 2018-10-09 19:50:31 358
  • When bundle install sucks ...This runs isuckat_ruby.rb and when stderror matches find gem ' it will gem install what ever is missing ... Show Sample Output


    0
    gem install `ruby ./isuckat_ruby.rb 2>&1 | sed -e 's/.*find gem .//g' -e 's/ .*//g' | head -n 1`
    operat0r · 2016-08-03 19:41:27 13
  • This dumps serial numbers of all the drives but HP warranty check does not say they are valid ... Show Sample Output


    1
    hpacucli controller all show config detail | grep -A 7 Fail | egrep '(Failed|Last|Serial Number|physicaldrive)'
    operat0r · 2016-07-20 17:42:40 13
  • This is used during pentest to quickly poll all the processes running on a set of systems you have common credentials for the /FAILFAST:ON speeds up the scans. Show Sample Output


    0
    FOR /F "delims==" %%A IN ('type ips.txt') DO wmic /Node:%%A wmic /user:username /password:yourpassword /FAILFAST:ON process where "name like '%.exe'" call getowner
    operat0r · 2014-06-26 01:53:29 8
  • # CC with SSN dash ( low false positive only match ###-##-#### not any 8digi number ) find . -iname "*.???x" -type f -exec unzip -p '{}' '*' \; | sed -e 's/]\{1,\}>/ /g; s/[^[:print:]]\{1,\}/ /g' | egrep "\b4[0-9]{12}(?:[0-9]{3})?\b|\b5[1-5][0-9]{14}\b|\b6011[0-9]{14}\b|\b3(?:0[0-5]\b|\b[68][0-9])[0-9]{11}\b|\b3[47][0-9]{13}\b|\b[0-9]{3}-[0-9]{2}-[0-9]{4}\b" rmccurdyDOTcom Show Sample Output


    1
    find . -iname "*.???x" -type f -exec unzip -p '{}' '*'
    operat0r · 2012-01-24 04:15:28 11

What's this?

commandlinefu.com is the place to record those command-line gems that you return to again and again. That way others can gain from your CLI wisdom and you from theirs too. All commands can be commented on, discussed and voted up or down.

Share Your Commands


Check These Out

Which processes are listening on a specific port (e.g. port 80)
swap out "80" for your port of interest. Can use port number or named ports e.g. "http"

kill all process that belongs to you
This will probably kill any user sessions and/or ssh connections to other servers you might have active.

convert strings toupper/tolower with tr

return a titlecased version of the string
Needs Bash4. Found at http://stackoverflow.com/questions/2264428/converting-string-to-lower-case-in-bash-shell-scripting alongside a few other tricks.

Find dupe files by checking md5sum

Create incremental snapshots of individual folders using find and tar-gzip
Creates an incremental snapshot of individual folders.

Record microphone input and output to date stamped mp3 file
record audio notes or meetings requires arecord and lame run mp3gain on the resulting file to increase the volume / quality ctrl-c to stop recording

download all the presentations from UTOSC2010
miss a class at UTOSC2010? need a refresher? use this to curl down all the presentations from the UTOSC website. (http://2010.utosc.com) NOTE/WARNING this will dump them in the current directory and there are around 37 and some are big - tested on OSX10.6.1

list file descriptors opened by a process
Useful for examining hostile processes (backdoors,proxies)

Detect illegal access to kernel space, potentially useful for Meltdown detection
Based on capsule8 agent examples, not rigorously tested


Stay in the loop…

Follow the Tweets.

Every new command is wrapped in a tweet and posted to Twitter. Following the stream is a great way of staying abreast of the latest commands. For the more discerning, there are Twitter accounts for commands that get a minimum of 3 and 10 votes - that way only the great commands get tweeted.

» http://twitter.com/commandlinefu
» http://twitter.com/commandlinefu3
» http://twitter.com/commandlinefu10

Subscribe to the feeds.

Use your favourite RSS aggregator to stay in touch with the latest commands. There are feeds mirroring the 3 Twitter streams as well as for virtually every other subset (users, tags, functions,…):

Subscribe to the feed for: