Commands (extended)

netstat -natup

Linux — Displays active network connections and listening sockets; -n shows numeric IPs/ports, -a shows all connections/listeners, -t shows TCP, -u shows UDP, and -p shows the associated process/PID.

ss -tulnp

Linux — Displays listening network sockets; -t TCP, -u UDP, -l listening sockets, -n numeric addresses/ports, and -p associated processes/PIDs.

ps -ealf

Linux — Displays detailed information about all running processes; -e selects every process, -a includes processes from all users, -l uses long-format output, and -f uses full-format output.

grep -v

Linux — Searches for lines that do not match the specified pattern; -v inverts the match.

sed -i

Linux — Edits text files directly; -i modifies the original file in place instead of only printing the modified output.

touch -t

Linux — Creates a file or modifies its timestamps; -t allows a specific timestamp to be supplied in [[CC]YY]MMDDhhmm[.ss] format.

file

Linux — Determines a file's type by examining its contents and identifying characteristics rather than relying only on its filename extension.

strings

Linux — Extracts and displays printable character sequences from binary or other files; commonly used to locate readable text inside executables.

stat

Linux — Displays detailed file or filesystem metadata, including size, permissions, ownership, timestamps, inode information, and other attributes.

md5sum

Linux — Calculates and displays an MD5 hash of a file, useful for verifying file integrity or comparing files.

lsof -p

Linux — Lists files and resources opened by a process; -p restricts the output to the specified process ID.

getpid

Meterpreter — Displays the process ID (PID) of the current Meterpreter session/process.

getuid

Meterpreter — Displays the username/security context under which the Meterpreter session is running.

sysinfo

Meterpreter — Displays information about the compromised system, such as hostname, operating system, architecture, and computer name.

ipconfig

Meterpreter — Displays network interface configuration, including IP addresses, subnet information, and interfaces.

route

Meterpreter — Displays and manages the routing table; commonly used to view routes available to the compromised host.

idletime

Meterpreter — Displays how long the logged-in user has been idle.

localtime

Meterpreter — Displays the local date and time of the compromised system.

ssh -p

Linux — Connects to an SSH server; -p specifies the remote SSH port instead of the default port 22.

top

Linux — Provides a continuously updating view of running processes, CPU usage, memory usage, load, and system activity.

kill

Linux — Sends a signal to a process identified by its PID; commonly used to terminate or otherwise control a process.

nice

Linux — Starts a process with a specified CPU scheduling priority; a higher nice value generally gives the process lower CPU priority.

apt

Linux — Debian/Ubuntu package-management command used to install, remove, update, and manage software packages and repositories.

dpkg

Linux — Low-level Debian package-management tool used to install, remove, inspect, and manage .deb packages.

rpm

Linux — Package-management system/tool used by RPM-based distributions to install, remove, verify, and query RPM packages.

cron

Linux — Time-based job scheduler that automatically runs commands or scripts according to configured schedules.

anacron

Linux — Scheduler designed to run periodic jobs even when the system was powered off when the job was originally scheduled.

atd

Linux — Background daemon that executes commands scheduled with the at or batch commands at a specified future time.

dir /tw

Windows — Lists directory contents sorted/displayed using file write-time information; /t:w specifies the last-write timestamp as the time field.

listdlls

Windows — Displays DLLs loaded by Windows processes and can be used to identify which DLLs are associated with a process.

handle64

Windows — Sysinternals utility that displays open handles held by processes; useful for identifying files, registry keys, mutexes, and other objects currently opened by a process.

certutil -hashfile

Windows — Calculates a cryptographic hash of a file; -hashfile specifies that a file hash should be calculated, followed by the filename and optionally a hash algorithm such as MD5, SHA1, or SHA256.

schtasks

Windows — Creates, deletes, queries, changes, or runs scheduled tasks used for automated execution.

ip route add

Linux — Adds a route to the Linux routing table; add specifies creation of a new route followed by the destination/network and routing parameters.

ssh -L

Linux — Creates SSH local port forwarding; -L binds a local port and forwards its traffic through the SSH connection to a specified target host and port.

wget

Linux — Command-line utility for downloading files from HTTP, HTTPS, and FTP servers.

tftp

Windows/Linux — Trivial File Transfer Protocol client used to transfer files using TFTP, typically over UDP port 69.

ftp

Windows/Linux — File Transfer Protocol client used to connect to FTP servers and upload or download files.

pscp

Windows — PuTTY Secure Copy utility used to securely copy files between systems over SSH/SCP.

base64

Linux — Encodes or decodes data using Base64 representation; commonly used to convert binary data into printable text.

certutil

Windows — Windows certificate and cryptography utility that can also perform tasks such as encoding/decoding files, calculating hashes, and managing certificate information.

ausearch

Linux — Searches Linux audit logs for events matching specified criteria such as users, processes, event types, timestamps, or commands.

auditpol /backup

Windows — Backs up Windows advanced audit policy configuration; /backup specifies that the current audit policy should be exported to a file.

auditpol /restore

Windows — Restores Windows advanced audit policy configuration from a previously saved audit-policy file; /restore specifies the policy file to import.

timestomp

Meterpreter — Displays or modifies file timestamps, allowing access, modification, and creation timestamps to be changed.

nc -nvlp

Linux — Starts Netcat as a listening server; -n disables DNS resolution, -v enables verbose output, -l listens for connections, and -p specifies the local listening port.

net use

Windows — Connects to, disconnects from, or displays information about shared network resources and mapped network drives.

reg enumkey -k

Meterpreter — Enumerates subkeys beneath a specified Windows Registry key; -k specifies the registry key to enumerate.

reg queryval -k -v

Meterpreter — Queries a value stored in a Windows Registry key; -k specifies the registry key and -v specifies the registry value name.

dir -t

Meterpreter — Lists files and directories and sorts them by time; -t specifies time-based sorting.

search -f

Meterpreter — Searches the target filesystem for files matching a specified pattern; -f specifies the filename/pattern to search for.

date

Linux — Displays or sets the system date and time.

uname

Linux — Displays system information such as the operating-system name, kernel, hostname, architecture, and kernel release depending on the options used.

last

Linux — Displays a historical list of successful user login sessions using information recorded in the system's login database.

uptime

Linux — Displays how long the system has been running, the current time, number of logged-in users, and system load averages.

psrinfo -v

Linux/Solaris — Displays processor information; -v provides verbose information about available processors. On traditional Solaris systems, psrinfo is primarily associated with processor enumeration.

hostid

Linux — Displays the system's host ID, a value used to identify the particular system.

modinfo -c

Linux — Displays information about an installed kernel module; -c requests information related to module compression where supported by the installed modinfo/kmod version.

lsmod

Linux — Displays currently loaded kernel modules and their dependencies.

vmstat

Linux — Displays virtual-memory, process, CPU, paging, and system-performance statistics.

ifconfig

Linux — Displays or configures network interfaces, including IP addresses, netmasks, MAC addresses, and interface status; largely superseded by ip on modern Linux systems.

arp

Linux — Displays or modifies the ARP cache, which maps IPv4 addresses to MAC addresses on the local network.

netstat

Linux — Displays network connections, listening ports, routing information, and network statistics; its exact output depends on the options supplied.

ip route show

Linux — Displays the current kernel routing table; show specifies that routes should be displayed rather than modified.

shopt -s

Linux — Configures Bash shell options; -s enables the specified shell option.

ausearch -m

Linux — Searches Linux audit logs by audit message type; -m specifies one or more audit event/message types to search for.

aureport --auth

Linux — Generates a summary report from Linux audit logs; --auth limits the report to authentication-related events.

cp

Linux — Copies files or directories from one location to another.

cd

Linux — Changes the current working directory.

diff

Linux — Compares two files or directories and reports their differences.

scp

Linux — Securely copies files between systems over SSH.

find / -newermt

Linux — Searches the filesystem starting at / for files newer than a specified date/time; -newermt compares file modification times against a human-readable timestamp.

grep -ri

Linux — Recursively searches files for a text pattern; -r searches directories recursively and -i makes the search case-insensitive.

dir -t

Meterpreter — Lists files/directories and sorts them by modification time; -t enables time-based sorting.

download

Meterpreter — Downloads a file or directory from the compromised system to the machine running Meterpreter.

uname -r

Linux — Displays the Linux kernel release/version; -r selects the kernel release field.

date -u

Linux — Displays the date/time in Coordinated Universal Time (UTC); -u uses UTC instead of local time.

date +%s

Linux — Displays the current Unix epoch timestamp in seconds; +%s formats the date as seconds since January 1, 1970 UTC.

locale

Linux — Displays the current locale settings, including language, character encoding, numeric formatting, and regional settings.

lsb_release -a

Linux — Displays Linux distribution identification information; -a displays all available LSB-release information.

unset HISTFILE

Linux — Removes the Bash HISTFILE environment variable from the current shell, preventing Bash from using the specified history-file variable for that session.

echo $HISTFILE

Linux — Displays the value of the Bash HISTFILE environment variable, which normally identifies the file used to store command history.

free

Linux — Displays system RAM and swap memory usage, including total, used, free, shared, cached, and available memory.

runlevel

Linux — Displays the previous and current SysV init runlevels; commonly used to determine the system's current operational runlevel.

who -r

Linux — Displays the current and previous system runlevels; -r displays runlevel information.

dpkg -l

Linux — Lists installed Debian packages and their status; -l requests a package listing.

apt list --installed

Linux — Lists packages installed on a Debian/Ubuntu system; --installed restricts the listing to installed packages.

iptables -nL

Linux — Lists firewall rules; -n prevents DNS/service-name resolution and displays numeric addresses/ports, while -L lists the rules.

iptables -t

Linux — Selects the iptables table on which an operation is performed; -t specifies a table such as filter, nat, mangle, or raw.

lastb

Linux — Displays failed login attempts recorded by the system, typically using /var/log/btmp.

sudo -l

Linux — Lists the commands the current user is permitted to execute through sudo; -l means list the user's sudo privileges.

sestatus

Linux — Displays the current SELinux status and operating mode, including whether SELinux is enabled and whether it is enforcing, permissive, or disabled.

service auditd status

Linux — Displays the current status of the Linux Audit daemon (auditd); status requests the service's current state.

which auditd

Linux — Searches the user's PATH for the auditd executable and displays its location if found.

apparmor_status

Linux — Displays the current AppArmor security status, including whether AppArmor is enabled and which profiles are loaded, enforced, or in complain mode.