Commands (concise)

netstat -natup

Linux - Displays active network connections and listening sockets; -n numeric IP/port, -a all connections, -t TCP, -u UDP, -p PID.

ss -tulnp

Linux - Displays listening sockets; -t TCP, -u UDP, -l listening, -n numeric IP/port, -p PID/process.

ps -ealf

Linux - Displays all processes in detailed format; -e all processes, -a all users, -l long format, -f full format.

grep -v

Linux - Displays lines that do not match a pattern; -v inverts the match.

sed -i

Linux - Edits a file in place; -i modifies the original file directly.

touch -t

Linux - Creates/updates a file timestamp; -t specifies a custom timestamp.

file

Linux - Identifies a file's type based on its contents.

strings

Linux - Extracts readable text strings from binary/non-text files.

stat

Linux - Displays detailed file metadata, including permissions, ownership, size, inode, and timestamps.

md5sum

Linux - Calculates an MD5 hash for a file.

lsof -p

Linux - Lists files/resources opened by a process; -p specifies the PID.

getpid

Meterpreter - Displays the PID of the current Meterpreter process.

getuid

Meterpreter - Displays the user/security context of the current Meterpreter session.

sysinfo

Meterpreter - Displays target system information such as OS, architecture, and hostname.

ipconfig

Meterpreter - Displays network interfaces and IP configuration.

route

Meterpreter - Displays/manages the target's routing table.

idletime

Meterpreter - Displays how long the logged-in user has been idle.

localtime

Meterpreter - Displays the target system's local date and time.

ssh -p

Linux - Connects to an SSH server; -p specifies the remote port.

top

Linux - Displays continuously updated process and system resource usage.

kill

Linux - Sends a signal to a process using its PID.

nice

Linux - Runs a process with a specified CPU scheduling priority.

apt

Linux - Manages Debian/Ubuntu software packages and repositories.

dpkg

Linux - Installs, removes, queries, and manages Debian .deb packages.

rpm

Linux - Installs, removes, verifies, and queries RPM packages.

cron

Linux - Schedules commands/scripts to run at specified times.

anacron

Linux - Runs scheduled periodic jobs even if the system was previously powered off.

atd

Linux - Daemon that executes commands scheduled with at.

dir /tw

Windows - Lists files using their last-write time; /t:w specifies write time.

listdlls

Windows - Lists DLLs loaded by Windows processes.

handle64

Windows - Lists open handles held by Windows processes.

certutil -hashfile

Windows - Calculates a file hash; -hashfile specifies hash calculation.

schtasks

Windows - Creates, queries, modifies, runs, and deletes scheduled tasks.

ip route add

Linux - Adds a route to the routing table; add creates a new route.

ssh -L

Linux - Creates local SSH port forwarding; -L forwards a local port to a remote destination.

wget

Linux - Downloads files from HTTP, HTTPS, or FTP servers.

tftp

Windows/Linux - Transfers files using the Trivial File Transfer Protocol (TFTP).

ftp

Windows/Linux - Transfers files using the File Transfer Protocol (FTP).

pscp

Windows - Securely copies files over SSH using PuTTY's SCP client.

base64

Linux - Encodes or decodes data using Base64.

certutil

Windows - Performs certificate, encoding/decoding, and hashing operations.

ausearch

Linux - Searches Linux audit logs for specified events.

auditpol /backup

Windows - Backs up Windows audit-policy settings; /backup exports the policy.

auditpol /restore

Windows - Restores Windows audit-policy settings; /restore imports a saved policy.

timestomp

Meterpreter - Displays or modifies file timestamps.

nc -nvlp

Linux - Starts a Netcat listener; -n no DNS, -v verbose, -l listen, -p specify port.

net use

Windows - Connects to, disconnects from, or displays network shares/drives.

reg enumkey -k

Meterpreter - Enumerates Windows Registry subkeys; -k specifies the registry key.

reg queryval -k -v

Meterpreter - Queries a Registry value; -k specifies the key, -v specifies the value.

dir -t

Meterpreter - Lists files/directories sorted by time; -t sorts by timestamp.

search -f

Meterpreter - Searches for files matching a pattern; -f specifies the filename/pattern.

date

Linux - Displays or sets the system date and time.

uname

Linux - Displays system/kernel information.

last

Linux - Displays successful user login history.

uptime

Linux - Displays system uptime, logged-in users, and load averages.

psrinfo -v

Linux/Solaris - Displays detailed processor information; -v verbose output.

hostid

Linux - Displays the system's host ID.

modinfo -c

Linux - Displays information about a kernel module; -c displays module compression information where supported.

lsmod

Linux - Lists currently loaded kernel modules.

vmstat

Linux - Displays virtual memory, process, CPU, paging, and system statistics.

ifconfig

Linux - Displays/configures network interfaces and IP information.

arp

Linux - Displays or modifies the ARP cache.

netstat

Linux - Displays network connections, listening ports, routing information, and network statistics.

ip route show

Linux - Displays the current routing table; show displays existing routes.

shopt -s

Linux - Enables Bash shell options; -s sets/enables the specified option.

ausearch -m

Linux - Searches audit logs by message type; -m specifies the audit message type.

aureport --auth

Linux - Generates an authentication audit report; --auth limits output to authentication events.

cp

Linux - Copies files or directories.

cd

Linux - Changes the current working directory.

diff

Linux - Compares files/directories and displays differences.

scp

Linux - Securely copies files between systems over SSH.

find / -newermt

Linux - Searches from / for files newer than a specified date/time; -newermt compares modification time to a timestamp.

grep -ri

Linux - Recursively searches files for a pattern; -r recursive, -i case-insensitive.

dir -t

Meterpreter - Lists files/directories sorted by time; -t sorts by timestamp.

download

Meterpreter - Downloads files/directories from the target to the attacking system.

uname -r

Linux - Displays the kernel release/version; -r selects kernel release.

date -u

Linux - Displays the date/time in UTC; -u uses UTC.

date +%s

Linux - Displays the current Unix epoch timestamp; +%s outputs seconds since January 1, 1970 UTC.

locale

Linux - Displays current language, regional, and character-encoding settings.

lsb_release -a

Linux - Displays Linux distribution information; -a displays all available information.

unset HISTFILE

Linux - Removes the Bash history-file variable for the current shell; unset removes the variable.

echo $HISTFILE

Linux - Displays the Bash history-file location stored in $HISTFILE.

free

Linux - Displays RAM and swap memory usage.

runlevel

Linux - Displays the previous and current SysV runlevels.

who -r

Linux - Displays the current and previous runlevels; -r shows runlevel information.

dpkg -l

Linux - Lists installed Debian packages; -l lists packages.

apt list --installed

Linux - Lists installed packages; --installed limits output to installed packages.

iptables -nL

Linux - Lists firewall rules; -n numeric addresses/ports, -L lists rules.

iptables -t

Linux - Specifies the iptables table to operate on; -t selects a table such as filter or nat.

lastb

Linux - Displays failed login attempts, typically from /var/log/btmp.

sudo -l

Linux - Lists commands the current user can run with sudo; -l lists privileges.

sestatus

Linux - Displays SELinux status and operating mode.

service auditd status

Linux - Displays the status of the auditd service; status requests current service state.

which auditd

Linux - Displays the path to the auditd executable if it is in $PATH.

apparmor_status

Linux - Displays AppArmor status and loaded/enforced profiles.