Commands

What it does

Lists directory contents. Long format (-l) is the security analyst’s default: permissions, owner, size, and timestamps tell you who can read secrets and whether a binary looks newly dropped.

Syntax

ls [options] [path]

Important flags / options

• -lLong format with permissions
• -aInclude hidden files (dotfiles)
• -hHuman-readable sizes
• -tSort by mtime

Safe example (lab)

ls -lah /etc/ssh

Expected output

drwxr-xr-x 2 root root 4.0K Jan 10 .
-rw-r--r-- 1 root root 3.2K Jan 10 sshd_config

How to read it: d = directory; rwxr-xr-x means owner rwx, group/other rx. sshd_config is world-readable — normal for that file, but never for private keys.

What it does

Changes the current working directory for this shell. Scripts and relative paths break when you are in the wrong place — always pair with pwd when documenting a lab.

Syntax

cd [dir]

Important flags / options

• ~Home directory
• ..Parent directory
• -Previous directory
• /Filesystem root

Safe example (lab)

cd /var/log

Expected output

(no output)

How to read it: Silence means success. Confirm with pwd → /var/log before grepping logs.

What it does

Prints the absolute path of the current directory. Relative paths in notes are ambiguous; absolute paths make lab write-ups reproducible.

Syntax

pwd

Important flags / options

• -PPhysical path (resolve symlinks)

Safe example (lab)

pwd

Expected output

/var/log

How to read it: You are in /var/log — greps without a path will look here.

What it does

Searches line-oriented text for a pattern. First tool for log triage: failed logins, error strings, IOCs. Prefer ripgrep (rg) when installed for speed; grep is everywhere.

Syntax

grep [options] PATTERN [file]

Important flags / options

• -iCase-insensitive
• -rRecursive through directories
• -cCount matching lines
• -EExtended regex
• -nShow line numbers

Safe example (lab)

grep -c "Failed password" /var/log/auth.log

Expected output

37

How to read it: 37 failed SSH password attempts — correlate with source IPs (awk/cut) for brute-force evidence in a lab.

What it does

Walks a directory tree and selects files by name, type, size, or mode. Security use: SUID binaries, world-writable dirs, recently modified files under /tmp.

Syntax

find [path] [expression]

Important flags / options

• -nameMatch filename (shell globs)
• -type fRegular files only
• -perm -4000SUID bit set
• -mtime -1Modified in last day

Safe example (lab)

find / -perm -4000 -type f 2>/dev/null

Expected output

/usr/bin/passwd
/usr/bin/sudo

How to read it: These SUID programs escalate to root by design — compare against a known-good list when hunting unknown SUID for privesc.

What it does

Sets Unix permission bits (read/write/execute for user/group/other). Wrong modes leak keys or break services; 777 is almost never the right fix.

Syntax

chmod MODE file

Important flags / options

• u/g/o/aWho: user/group/other/all
• 755rwxr-xr-x (common for dirs/bins)
• 600rw------- (secrets/keys)
• +xAdd execute

Safe example (lab)

chmod 600 ~/.ssh/id_ed25519

Expected output

(no output)

How to read it: Private key readable only by you. OpenSSH refuses keys that are group/world-readable.

What it does

Changes file owner and optionally group. Web roots often need www-data ownership; stealing ownership of system files breaks the OS.

Syntax

chown USER[:GROUP] file

Important flags / options

• -RRecursive
• user:groupSet both

Safe example (lab)

sudo chown www-data:www-data /var/www/app

Expected output

(no output)

How to read it: The app tree is now owned by the web user — pair with sane chmod, not 777.

What it does

Snapshot of running processes. Spot unexpected reverse shells, crypto miners, or leftover lab listeners by name/PID/user.

Syntax

ps [options]

Important flags / options

• auxBSD style: all users, detail
• -efSystem V full format
• --forestProcess tree

Safe example (lab)

ps aux | grep sshd

Expected output

root  812 0.0 0.1 sshd: /usr/sbin/sshd -D

How to read it: PID 812 is the SSH daemon as root — expected. Note the grep line also matching itself.

What it does

Modern replacement for netstat — faster and always maintained. Default skill for “what is listening?” during hardening and IR.

Syntax

ss [options]

Important flags / options

• -tTCP
• -uUDP
• -lListening
• -nNumeric
• -pProcess names

Safe example (lab)

ss -tlnp

Expected output

LISTEN 0 128 127.0.0.1:5432 users:(("postgres",pid=900))

How to read it: Postgres bound to localhost only — not reachable from other hosts. Contrast with 0.0.0.0 bindings.

What it does

Shows the first lines of a file.

Syntax

head [options] file

Important flags / options

• -nNumber of lines

Safe example (lab)

head -n 5 /var/log/syslog

Expected output

…first 5 lines…

How to read it: Quick peek without opening the whole log.

What it does

Shows the end of a file; great for live logs.

Syntax

tail [options] file

Important flags / options

• -fFollow
• -nLines

Safe example (lab)

tail -f /var/log/auth.log

Expected output

…streaming new lines…

How to read it: Watch authentication events live in a lab.

What it does

Sticky bit on directories (e.g. /tmp) restricts delete to owner.

Syntax

chmod +t dir

Safe example (lab)

ls -ld /tmp

Expected output

drwxrwxrwt … /tmp

How to read it: The t means sticky bit is set.

What it does

Manage systemd services.

Syntax

systemctl [cmd] [unit]

Important flags / options

• statusShow state
• start/stopControl
• enableStart on boot

Safe example (lab)

systemctl status ssh

Expected output

active (running)

How to read it: Confirms ssh service state on a lab VM.

What it does

Query the systemd journal.

Syntax

journalctl [options]

Important flags / options

• -uUnit
• -fFollow
• --sinceTime filter

Safe example (lab)

journalctl -u ssh -n 20

Expected output

…recent ssh logs…

How to read it: Central place for service logs on systemd distros.

What it does

Prints the current effective username.

Syntax

whoami

Safe example (lab)

whoami

Expected output

alice

How to read it: Confirms which user you are after sudo/su.

What it does

Shows uid/gid and group memberships.

Syntax

id [user]

Safe example (lab)

id

Expected output

uid=1000(alice) gid=1000(alice) groups=1000(alice),27(sudo)

How to read it: Group memberships matter for privilege reviews.

What it does

Linux audit framework control.

Syntax

auditctl -l

Important flags / options

• -wWatch path

Safe example (lab)

sudo auditctl -l

Expected output

LIST_RULES: …

How to read it: Compliance and tamper detection.

What it does

View POSIX ACLs beyond chmod bits.

Syntax

getfacl file

Safe example (lab)

getfacl /shared/project

Expected output

user:alice:rwx …

How to read it: Find excessive ACL grants.

What it does

Modify ACL entries.

Syntax

setfacl -m u:user:perms file

Important flags / options

• -mModify
• -xRemove

Safe example (lab)

setfacl -m u:bob:r-- confidential.txt

Expected output

(updated ACL)

How to read it: Granular sharing — review for abuse.

What it does

Default permission mask for new files.

Syntax

umask

Safe example (lab)

umask

Expected output

0022

How to read it: Explains why new files are 644/755.

What it does

Concatenates and prints file contents to stdout. Security students use it to read configs, logs, and flags in CTFs — but for large logs prefer less/tail so you do not flood the terminal.

Syntax

cat [file …]

Important flags / options

• -Read from stdin
• > fileShell redirect (overwrite)

Safe example (lab)

cat /etc/os-release

Expected output

NAME="Ubuntu"
VERSION="22.04.3 LTS (Jammy Jellyfish)"

How to read it: Shows distribution identity — useful when choosing package managers or vulnerability lookup for that OS.

What it does

Pager for browsing long text. Search with /, next match n, quit with q. Safer than cat for logs because it does not dump everything at once.

Syntax

less [file]

Important flags / options

• /patternSearch forward
• GJump to end
• qQuit

Safe example (lab)

less /var/log/syslog

Expected output

(interactive view)

How to read it: You scroll and search inside the viewer; nothing is printed until you ask.

What it does

Extracts columns from delimited text. Pair with grep/awk for quick log triage without a full SIEM.

Syntax

cut -d DELIM -f FIELDS

Important flags / options

• -dDelimiter (default tab)
• -fField numbers
• -f1,3Multiple fields

Safe example (lab)

echo "alice:x:1000:1000::/home/alice:/bin/bash" | cut -d: -f1,7

Expected output

alice:/bin/bash

How to read it: Username and login shell from a passwd-style line — classic recon of local accounts.

What it does

Programmable text processor. In IR and CTFs, awk pulls fields, counts, and filters without writing a full script.

Syntax

awk 'pattern { action }' [file]

Important flags / options

• -FField separator
• {print $1}Print first field
• NR==1First record only

Safe example (lab)

ss -tln | awk 'NR>1 {print $4}'

Expected output

0.0.0.0:22
127.0.0.1:5432

How to read it: Local addresses of listening TCP sockets — quick exposure check.

What it does

Stream editor for find/replace and line edits. Useful for scrubbing secrets from demos or normalizing configs — never silently rewrite production without review.

Syntax

sed [options] 'script' [file]

Important flags / options

• -nQuiet
• s/a/b/gGlobal substitute
• -iIn-place edit (dangerous)

Safe example (lab)

echo 'password=secret' | sed 's/=.*/=REDACTED/'

Expected output

password=REDACTED

How to read it: Shows how to sanitize sensitive lines before sharing logs.

What it does

Sort lines then collapse duplicates. With -c you get frequency counts — perfect for top failed logins or top URLs.

Syntax

sort [file] | uniq [-c]

Important flags / options

• -nNumeric sort
• -rReverse
• uniq -cCount duplicates

Safe example (lab)

cut -d' ' -f1 access.log | sort | uniq -c | sort -nr | head

Expected output

1201 203.0.113.10
88 198.51.100.2

How to read it: IP 203.0.113.10 dominates requests — investigate first in a lab incident.

What it does

Word/line/byte counts. Fast way to size logs or count findings before opening them.

Syntax

wc [options] [file]

Important flags / options

• -lLines
• -wWords
• -cBytes

Safe example (lab)

wc -l /var/log/auth.log

Expected output

18402 /var/log/auth.log

How to read it: 18k auth lines — plan filtering before grepping blindly.

What it does

Shows inode metadata: size, permissions, owner, and atime/mtime/ctime. Forensics students use this to spot unexpected timestamps.

Syntax

stat file

Important flags / options

• -c %aOctal mode
• -c %yModification time

Safe example (lab)

stat /etc/passwd

Expected output

Access: (0644/-rw-r--r--)
Modify: 2024-01-10 08:00:00

How to read it: World-readable passwd is normal; compare Modify time if you suspect tampering.

What it does

Guesses file type from magic bytes, not the extension. Critical when a 'photo.jpg' is actually an ELF binary or script.

Syntax

file [path]

Important flags / options

• -bBrief
• -iMIME type

Safe example (lab)

file mystery.bin

Expected output

mystery.bin: ELF 64-bit LSB executable, x86-64

How to read it: Treat as executable malware lab sample — open only in a sandbox.

What it does

Extracts printable ASCII/Unicode from binaries. Quick first look for URLs, paths, and error messages in malware or unknown binaries (lab only).

Syntax

strings [options] file

Important flags / options

• -nMin length
• -aScan whole file

Safe example (lab)

strings -n 8 sample.exe | head

Expected output

http://evil.lab/callback
C:\Users\Public\drop

How to read it: Hardcoded URL and path are leads for IOC hunting — not proof by themselves.

What it does

Hex dump of file bytes. Helps spot magic headers (MZ, ELF, PNG) and null-padded secrets.

Syntax

xxd [file]

Important flags / options

• -lLimit bytes
• -sSeek offset

Safe example (lab)

xxd -l 16 flag.png

Expected output

00000000: 8950 4e47 0d0a 1a0a 0000 000d 4948 4452  .PNG........IHDR

How to read it: 89504E47 is the PNG signature — file type matches extension.

What it does

df shows filesystem free space; du measures directory size. Disk-full hosts break logging and updates — both matter for availability and IR.

Syntax

df -h ; du -sh [path]

Important flags / options

• df -hHuman sizes
• du -sh *Per-item sizes
• du -xOne filesystem

Safe example (lab)

du -sh /var/log/* | sort -h | tail

Expected output

2.1G  /var/log/journal

How to read it: Journal is the space hog — tune retention before the disk fills.

What it does

Inventory block devices and mounted filesystems. Look for unexpected USB, loop devices, or world-writable mounts in hardening labs.

Syntax

lsblk ; mount

Important flags / options

• lsblk -fWith FS types
• findmntTree view of mounts

Safe example (lab)

lsblk -f

Expected output

NAME FSTYPE LABEL MOUNTPOINT
sda1 ext4   root  /
sdb1 vfat   LAB   /media/usb

How to read it: An extra USB volume is mounted — document it in your lab notes.

What it does

Lists open files and the processes that hold them. Classic for 'which process has this port/file?' during IR.

Syntax

lsof [options]

Important flags / options

• -i :PORTWho holds a port
• -p PIDFiles for a process
• -u userBy user

Safe example (lab)

sudo lsof -i :22

Expected output

sshd 812 root 3u IPv4 … TCP *:ssh (LISTEN)

How to read it: PID 812 (sshd) owns the SSH listener — matches ss/netstat findings.

What it does

Traces system calls. Powerful for debugging 'permission denied' or seeing what a binary opens — use only on lab processes you own.

Syntax

strace -p PID | strace cmd

Important flags / options

• -e open,openatFilter syscalls
• -o fileWrite output
• -fFollow children

Safe example (lab)

strace -e openat cat /etc/hosts 2>&1 | head

Expected output

openat(AT_FDCWD, "/etc/hosts", O_RDONLY) = 3

How to read it: Confirms the file open succeeded with fd 3.

What it does

sudo runs one command as another user (usually root) with an audit trail; su switches sessions. Least privilege means sudoers rules, not password-sharing.

Syntax

sudo [command] ; su - [user]

Important flags / options

• -lList allowed commands
• -u userRun as user
• su -Login shell as root

Safe example (lab)

sudo -l

Expected output

User alice may run:
    (ALL) NOPASSWD: /usr/bin/systemctl restart nginx

How to read it: Alice can restart nginx without a password — review whether that is intentional.

What it does

Per-user scheduled jobs. Persistence hunters check user and system crontabs (/etc/cron.*) for unexpected wget/curl reverse shells.

Syntax

crontab -l ; crontab -e

Important flags / options

• -lList
• -eEdit
• -u userAnother user's crontab (root)

Safe example (lab)

crontab -l

Expected output

*/5 * * * * /home/alice/backup.sh

How to read it: A backup runs every 5 minutes — verify the script contents and permissions.

What it does

Shows shell command history for the current user. Great for self-review after a lab; attackers also scrape it for secrets — clear or avoid putting tokens on the CLI.

Syntax

history

Important flags / options

• !nRe-run entry n
• HISTCONTROLIgnore duplicates/spaces

Safe example (lab)

history | tail -5

Expected output

 501  nmap -sV 10.0.0.5
 502  ssh alice@10.0.0.5

How to read it: Recent recon and login commands — useful for your lab write-up.

What it does

Shows or sets environment variables. Secrets in ENV are a common leak (CI logs, crash dumps, docker inspect).

Syntax

env ; export NAME=value

Important flags / options

• env -iClean environment
• printenv NAMEOne variable

Safe example (lab)

printenv | grep -i key

Expected output

AWS_ACCESS_KEY_ID=AKIA…

How to read it: An access key is in the environment — rotate it and move to a secrets manager in real work.

What it does

Create or extract compressed archives. Verify contents before extracting untrusted tarballs (path traversal / zip-slip style issues).

Syntax

tar -czvf archive.tgz dir/

Important flags / options

• -cCreate
• -xExtract
• -zgzip
• -tList
• -vVerbose

Safe example (lab)

tar -tzf lab-backup.tgz | head

Expected output

./etc/passwd
./home/alice/.ssh/id_ed25519

How to read it: Archive contains a private key — handle as sensitive evidence, do not extract into a shared folder.

What it does

Copy files over SSH. Prefer keys over passwords; restrict which hosts you push to. rsync can resume and exclude patterns.

Syntax

scp file user@host:path ; rsync -avz src/ dest/

Important flags / options

• -Pscp preserve + progress
• rsync -nDry run
• --excludeSkip paths

Safe example (lab)

rsync -avz --dry-run ./web/ alice@lab:/var/www/html/

Expected output

sending incremental file list
index.html

How to read it: Dry-run shows what would sync — review before a real deploy to your lab VM.

What it does

Secure remote shell. Harden with key auth, disabled root login, and Fail2ban/allowlists. Always verify host keys on first connect.

Syntax

ssh [user@]host [command]

Important flags / options

• -i keyIdentity file
• -LLocal port forward
• -vVerbose debug

Safe example (lab)

ssh -i ~/.ssh/lab_ed25519 alice@192.168.56.10

Expected output

Welcome to Ubuntu 22.04…

How to read it: Interactive session opened on the lab VM as alice.

What it does

Sends a signal to a process (default SIGTERM). Use after identifying the PID with ps/pgrep — do not kill random system PIDs.

Syntax

kill [-SIGNAL] PID

Important flags / options

• -9SIGKILL (last resort)
• -HUPReload many daemons
• pgrep -a nameFind PIDs

Safe example (lab)

pgrep -a python

Expected output

2048 python3 -m http.server 8000

How to read it: Lab web server is PID 2048 — safe candidate to stop after practice.

What it does

Live process monitor for CPU/memory. Spike investigation starts here before diving into logs.

Syntax

top ; htop

Important flags / options

• PSort CPU (top)
• MSort memory
• kKill from within top

Safe example (lab)

top -bn1 | head -15

Expected output

PID USER %CPU %MEM COMMAND
2048 alice 80.0 2.1 python3

How to read it: Python holding 80% CPU — expected if you left a busy lab script running.

What it does

Uncomplicated Firewall front-end on Ubuntu. Default deny incoming is a solid lab hardening baseline.

Syntax

ufw [enable|allow|deny|status]

Important flags / options

• status verboseRules + defaults
• allow 22/tcpPermit SSH
• deny out 53Example deny

Safe example (lab)

sudo ufw status verbose

Expected output

Status: active
Default: deny (incoming), allow (outgoing)
22/tcp ALLOW IN Anywhere

How to read it: SSH is allowed; everything else inbound is denied — good minimal posture for a lab VM.

What it does

Shows Fail2ban jails that ban abusive IPs (often sshd). Confirm bans after simulated brute force in a lab.

Syntax

fail2ban-client status [jail]

Important flags / options

• status sshdSSH jail
• set sshd unbanip IPUnban

Safe example (lab)

sudo fail2ban-client status sshd

Expected output

Currently banned: 1
Banned IP list: 203.0.113.50

How to read it: One attacker IP is banned — correlate with auth.log failures.

What it does

Encode/decode Base64. Appearances in phishing, JWT payloads, and configs — encoding is not encryption.

Syntax

base64 [file] ; base64 -d

Important flags / options

• -w0No wrap
• -dDecode

Safe example (lab)

echo -n 'admin:labpass' | base64

Expected output

YWRtaW46bGFicGFzcw==

How to read it: Decoded later yields admin:labpass — anyone who sees the Base64 can recover it.

What it does

Query and pretty-print JSON. Essential for API security labs, cloud CLI output, and JWT payloads.

Syntax

jq 'filter' file.json

Important flags / options

• .Pretty print
• .users[].idMap field
• -rRaw strings

Safe example (lab)

echo '{"users":[{"id":1,"role":"admin"}]}' | jq '.users[0].role'

Expected output

"admin"

How to read it: Extracted the role claim — useful when reviewing API responses for overexposure.

What it does

Prints or sets the system hostname. During IR and inventory, hostname + /etc/hosts mismatches cause confusing DNS and cert errors.

Syntax

hostname [options]

Important flags / options

• -fFQDN if configured
• -IAll IP addresses
• ctl hostnamectlsystemd hostname metadata

Safe example (lab)

hostname -f; hostname -I

Expected output

lab-web.internal
192.168.56.10 10.0.3.15

How to read it: FQDN is lab-web.internal with two addresses — pick the correct interface when writing firewall rules.

What it does

Shows which PIDs use a file, mount, or TCP/UDP port. Pair with ss/lsof when you need to free a port or unmount a busy disk.

Syntax

fuser -v port/tcp ; fuser -k file

Important flags / options

• -vVerbose
• -kKill processes (dangerous)
• -n tcpNamespace tcp
• 8080/tcpPort syntax

Safe example (lab)

sudo fuser -v 8000/tcp

Expected output

                     USER  PID ACCESS COMMAND
8000/tcp:            alice 2048 F….  python

How to read it: PID 2048 (python) holds TCP 8000 — stop that lab http.server before binding another service.

What it does

Open files + Internet sockets. When ss lacks process names (permissions), lsof often still maps port → binary.

Syntax

lsof -i :port ; lsof -iTCP -sTCP:LISTEN

Important flags / options

• -i :443Anything on 443
• -iTCP -sTCP:LISTENAll TCP listeners
• -p PIDFiles for one process

Safe example (lab)

sudo lsof -iTCP:22 -sTCP:LISTEN

Expected output

COMMAND PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
sshd    812 root   3u  IPv4  …      0t0  TCP *:ssh (LISTEN)

How to read it: Confirms sshd PID 812 — cross-check with ps and audit authorized_keys if you suspect compromise.

What it does

Readable firewall status with rule numbers for deletes. Good teaching bridge from iptables complexity to intent-based rules.

Syntax

sudo ufw status numbered

Important flags / options

• status verboseDefaults + rules
• delete NRemove by number
• allow/denyAdd rules

Safe example (lab)

sudo ufw status numbered

Expected output

Status: active
     To    Action  From
[ 1] 22/tcp ALLOW IN Anywhere

How to read it: Only SSH is allowed inbound — tighten further with allow from lab subnet if exposed.

What it does

Maximum SSH client verbosity — see which auth methods are offered, whether keys are tried, and where negotiation fails.

Syntax

ssh -vvv user@host

Important flags / options

• -vvvDebug level 3
• -i keyIdentity file
• -o PreferredAuthentications=publickeyForce method

Safe example (lab)

ssh -vvv -i ~/.ssh/lab_ed25519 alice@192.168.56.10

Expected output

debug1: Offering public key: …
debug1: Authentication succeeded (public key).

How to read it: Publickey succeeded — if it fails earlier, check permissions on key files (600) and server authorized_keys.

What it does

Copy files over SSH. Prefer explicit paths and dry mental checks before -r of huge trees.

Syntax

scp [-r] source user@host:path

Important flags / options

• -rRecursive
• -P portSSH port (capital P)
• -i keyIdentity
• -CCompression

Safe example (lab)

scp -i ~/.ssh/lab_ed25519 ./notes.md alice@192.168.56.10:~/notes.md

Expected output

notes.md                                    100% 4096   1.2MB/s   00:00

How to read it: File landed in alice’s home — verify checksums for critical artifacts.

What it does

Efficient sync for lab backups and deploy folders. Dry-run first (-n) so you do not delete remote files by accident.

Syntax

rsync -avz -e ssh src/ user@host:dest/

Important flags / options

• -aArchive mode
• -vVerbose
• -zCompress
• -nDry run
• --deleteMirror deletes (dangerous)

Safe example (lab)

rsync -avzn -e 'ssh -i ~/.ssh/lab_ed25519' ./web/ alice@192.168.56.10:/var/www/html/

Expected output

sending incremental file list
index.html
assets/app.css

How to read it: Dry-run shows two paths would sync — drop -n to perform after review.

What it does

Control systemd services during lab hardening. Always status before/after restart so you can prove the change.

Syntax

sudo systemctl status|restart|reload UNIT

Important flags / options

• statusActive state + recent logs
• restartStop then start
• reloadReload config if supported
• is-enabledBoot persistence

Safe example (lab)

sudo systemctl status nginx --no-pager -l

Expected output

● nginx.service - A high performance web server
   Active: active (running)

How to read it: nginx is active — if curl still fails, check listen address and firewall next.

What it does

Service-centric logs for connectivity failures (nginx 502, sshd refused key, NetworkManager).

Syntax

journalctl -u UNIT -n 50 --no-pager

Important flags / options

• -uUnit
• -fFollow
• --since '10 min ago'Time window
• -p errPriority filter

Safe example (lab)

journalctl -u ssh -n 20 --no-pager

Expected output

sshd[812]: Accepted publickey for alice from 192.168.56.50

How to read it: Successful key login from your workstation IP — baseline for detecting later brute force.

What it does

Legacy view of sockets and routing. Still appears in older docs; on modern Linux prefer ss. Shows what is listening and who is connected.

Syntax

netstat [options]

Important flags / options

• -t/-uTCP / UDP
• -lListening only
• -nNumeric (no DNS)
• -pProcess (needs root for others)

Safe example (lab)

sudo netstat -tlnp

Expected output

tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 812/sshd

How to read it: SSH listens on all IPv4 interfaces (0.0.0.0:22). On a lab VM that may be OK; on a cloud box, restrict with firewall/SG.

What it does

HTTP/HTTPS (and more) client. Security workhorses: fetch headers, replay APIs, check redirects, grab robots.txt — on targets you own.

Syntax

curl [options] URL

Important flags / options

• -IHEAD / headers only
• -vVerbose (TLS, headers)
• -XHTTP method
• -dRequest body
• -LFollow redirects
• -HCustom header

Safe example (lab)

curl -I http://localhost:8000

Expected output

HTTP/1.0 200 OK
Server: SimpleHTTP/0.6 Python/3.12

How to read it: 200 OK and a revealing Server banner — useful inventory, also an info leak to fix in production.

What it does

Download files non-interactively. Fine for lab ISOs and wordlists; dangerous when blindly fetching and executing remote scripts.

Syntax

wget [options] URL

Important flags / options

• -OOutput filename
• -qQuiet
• -cContinue partial
• --spiderCheck existence only

Safe example (lab)

wget -O page.html http://localhost:8000

Expected output

‘page.html’ saved [1024/1024]

How to read it: File landed locally — open it; do not pipe wget to sh.

What it does

ICMP echo request/reply for reachability and rough latency. Firewalls often drop ICMP, so silence ≠ proof the host is down.

Syntax

ping [options] host

Important flags / options

• -c NStop after N probes
• -WTimeout
• -nNumeric (no reverse DNS)

Safe example (lab)

ping -c 3 127.0.0.1

Expected output

64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.04 ms

How to read it: Loopback answers — stack is up. TTL and time help spot distant vs local hops later.

What it does

Lists routers (hops) on the path to a destination. Helps explain where latency or filtering appears; many hops show * when ICMP is rate-limited.

Syntax

traceroute host

Important flags / options

• -nSkip DNS lookups
• -IICMP probes
• -TTCP probes (when ICMP blocked)

Safe example (lab)

traceroute -n 1.1.1.1

Expected output

1 192.168.1.1 1.2 ms
2 10.0.0.1 8.1 ms

How to read it: Hop 1 is your LAN gateway; hop 2 is upstream. * * * later would mean no reply, not always a black hole.

What it does

Interactive/simple DNS query tool (legacy). Fine for a quick A record; use dig for serious DNS work (any type, +trace, DNSSEC flags).

Syntax

nslookup name [server]

Safe example (lab)

nslookup example.com

Expected output

Name: example.com
Address: 93.184.215.14

How to read it: Got an A record from the configured resolver — note which server answered if you set one.

What it does

The flexible DNS Swiss Army knife: any RR type, short or verbose, specific resolvers, and +trace. Core for phishing domain checks and mail (MX/TXT/SPF) labs.

Syntax

dig [@server] name [type]

Important flags / options

• +shortOne-line answers
• MX/TXT/NS/ARecord type
• @1.1.1.1Query that resolver
• +traceWalk from root

Safe example (lab)

dig example.com MX +short

Expected output

0 .

How to read it: Null MX (priority 0, host ".") — domain publishes that it accepts no mail. Useful anti-abuse signal.

What it does

iproute2 toolkit: addresses, links, routes, neighbors. Replaces ifconfig/route on modern Linux.

Syntax

ip [object] [command]

Important flags / options

• a / addrAddresses
• l / linkInterfaces up/down
• r / routeRouting table
• n / neighARP/NDP cache

Safe example (lab)

ip a

Expected output

2: eth0: … inet 192.168.56.10/24

How to read it: eth0 has a Host-Only/lab IP in a /24 — use this when configuring nmap targets in VirtualBox/VMware labs.

What it does

CLI packet capture. Learn BPF filters (host, port, net) and always write -w pcaps for Wireshark later. Capture only on networks you own.

Syntax

tcpdump [options] [bpf filter]

Important flags / options

• -iInterface (lo, eth0, any)
• -nnNo name/port resolve
• -w file.pcapWrite capture
• -c NStop after N packets
• port 80BPF example

Safe example (lab)

sudo tcpdump -i lo -nn port 8000 -c 4

Expected output

IP 127.0.0.1.51234 > 127.0.0.1.8000: Flags [S]

How to read it: SYN to port 8000 on loopback — TCP handshake start for your local lab server.

What it does

Shows ARP cache (IP→MAC).

Syntax

arp -a

Safe example (lab)

arp -a

Expected output

192.168.1.1 at aa:bb:…

How to read it: Useful when hunting spoofing in a lab LAN.

What it does

Shows routing table.

Syntax

ip route

Safe example (lab)

ip route

Expected output

default via 192.168.1.1 dev eth0

How to read it: Default gateway and interfaces.

What it does

Netcat — connect or listen for lab tests.

Syntax

nc [options] host port

Important flags / options

• -lListen
• -vVerbose
• -zScan without data

Safe example (lab)

nc -lv 9000

Expected output

listening on [any] 9000 …

How to read it: Simple lab listener for connectivity tests.

What it does

Shows connections and owning PIDs.

Syntax

netstat -ano

Important flags / options

• -aAll
• -nNumeric
• -oPID

Safe example (lab)

netstat -ano | findstr LISTENING

Expected output

TCP 0.0.0.0:445 … LISTENING 4

How to read it: Map listening ports to PIDs for IR.

What it does

Simple DNS lookup utility.

Syntax

host [-t type] name

Important flags / options

• -t TXTTXT records

Safe example (lab)

host -t MX example.com

Expected output

example.com mail is handled by 10 mail.example.com

How to read it: Quick MX checks for email security.

What it does

Registration metadata for domains (OSINT).

Syntax

whois domain

Safe example (lab)

whois example.com

Expected output

Registrar: … Creation Date: …

How to read it: Useful for phishing domain age/reputation.

What it does

systemd-resolved DNS query on modern Linux.

Syntax

resolvectl query name

Important flags / options

• statusResolver state

Safe example (lab)

resolvectl query internal.corp

Expected output

internal.corp: 10.0.0.5

How to read it: Debug split-horizon DNS in labs.

What it does

Legacy Linux firewall (still common).

Syntax

iptables [-t table] -A CHAIN rule

Important flags / options

• -LList rules
• -A INPUTAppend input rule

Safe example (lab)

sudo iptables -L -n -v

Expected output

Chain INPUT (policy ACCEPT) …

How to read it: Review allow/deny before audits.

What it does

Modern netfilter firewall CLI.

Syntax

nft list ruleset

Important flags / options

• add ruleAdd rule

Safe example (lab)

sudo nft list ruleset

Expected output

table inet filter { … }

How to read it: Preferred on newer distros.

What it does

Show/manipulate routing table.

Syntax

ip route [show|add|del]

Safe example (lab)

ip route show default

Expected output

default via 192.168.1.1 dev eth0

How to read it: Verify default gateway and routes.

What it does

NIC driver/link settings.

Syntax

ethtool iface

Safe example (lab)

ethtool eth0

Expected output

Speed: 1000Mb/s Duplex: Full

How to read it: Link diagnostics.

What it does

CLI Wireshark — capture/analyze pcaps.

Syntax

tshark [options]

Important flags / options

• -rRead pcap
• -YDisplay filter

Safe example (lab)

tshark -r lab.pcap -Y 'http.request.method==POST'

Expected output

POST frames listed

How to read it: Automate packet analysis in scripts.

What it does

Quick static file server for labs. Bind carefully — serving your home directory on 0.0.0.0 exposes files to the LAN.

Syntax

python3 -m http.server [port]

Important flags / options

• 8000Port
• --bind 127.0.0.1Localhost only

Safe example (lab)

python3 -m http.server 8000 --bind 127.0.0.1

Expected output

Serving HTTP on 127.0.0.1 port 8000 …

How to read it: Only your machine can reach it — safer for local demos.

What it does

Craft arbitrary HTTP requests. Core skill for API testing on apps you own: verbs, auth headers, and content types.

Syntax

curl -X METHOD -H 'Header: v' -d 'body' URL

Important flags / options

• -HHeader
• -dBody
• -u user:passBasic auth
• -kInsecure TLS (lab only)

Safe example (lab)

curl -s -X POST http://127.0.0.1:5000/login -H "Content-Type: application/json" -d '{"user":"alice","pass":"lab"}'

Expected output

{"token":"eyJhbGciOiJub25lIn0…"}

How to read it: Login returned a JWT — next step is decode claims (alg, exp, role) in your lab notes.

What it does

Follows delegation from root to authoritative servers. Teaches how DNS hierarchy works and where spoofing/cache issues can appear.

Syntax

dig +trace name

Important flags / options

• +traceFull path
• +dnssecShow DNSSEC bits

Safe example (lab)

dig +trace example.com

Expected output

. …
com. …
example.com. … A 93.184.215.14

How to read it: Each section is a referral until the final A record — compare with a normal dig for caching differences.

What it does

Display filters hide noise so you can study protocols. Learn a few: ip.addr, tcp.port, http.host, dns.qry.name, tls.handshake.type.

Syntax

(in Wireshark) http.request || dns.qry.name

Important flags / options

• ==Equals
• containsSubstring
• && / ||Combine

Safe example (lab)

http.request and http.host == "lab.local"

Expected output

(packet list shows only matching HTTP requests)

How to read it: Focuses the capture on one virtual host during a web lab.

What it does

Windows ICMP reachability test. Same idea as Linux ping: prove L3 path and rough latency. Use before blaming the application when “the site is down.”

Syntax

ping [-n count] [-t] host

Important flags / options

• -n NSend N echoes then stop
• -tPing until Ctrl+C
• -4 / -6Force IPv4 / IPv6

Safe example (lab)

ping -n 4 192.168.56.10

Expected output

Reply from 192.168.56.10: bytes=32 time=1ms TTL=64
…
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss)

How to read it: 0% loss and ~1 ms RTT → lab VM is up on the Host-Only network. Next step if apps fail: check port with Test-NetConnection.

What it does

My Traceroute — live updating combination of ping + traceroute. Best first tool when users say “the network is flaky” on a path you own (lab or corp WAN).

Syntax

mtr [-r] [-c count] host

Important flags / options

• -r / --reportSend report then exit
• -c NCycles
• -nNumeric (no DNS)
• -zAS lookups (when available)

Safe example (lab)

mtr -rwc 20 -n 192.168.56.10

Expected output

HOST: labbox    Loss%  Snt  Last  Avg  Best  Wrst
1.|-- 192.168.56.1   0.0%  20   0.4  0.5  0.3  1.1
2.|-- 192.168.56.10  0.0%  20   0.6  0.7  0.4  1.4

How to read it: Stable low Avg/Wrst and 0% Loss → clean lab path. Rising Loss% on one hop suggests congestion or filtering there.

What it does

IPv6 reachability and path tools. Dual-stack labs break when v4 works but v6 is misconfigured (or vice versa).

Syntax

ping6 -c 3 addr ; traceroute6 addr

Important flags / options

• -c NCount (ping6)
• -nNumeric traceroute6

Safe example (lab)

ping6 -c 3 fe80::1%eth0

Expected output

64 bytes from fe80::1%eth0: icmp_seq=1 ttl=64 time=0.3 ms

How to read it: Link-local reply on eth0 proves L2/L3 IPv6 on that interface — note the %eth0 scope id.

What it does

Legacy interface config (still on many BSD/old Linux images). Prefer `ip` on modern Linux, but you must read ifconfig output in older write-ups and CTF boxes.

Syntax

ifconfig [iface]

Important flags / options

• ifaceShow one interface
• iface up/downBring interface up/down (needs root)

Safe example (lab)

ifconfig eth0

Expected output

eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.56.10  netmask 255.255.255.0  broadcast 192.168.56.255

How to read it: eth0 is UP with 192.168.56.10/24 — same story as `ip a`, older syntax.

What it does

Brief view of link state and addresses — fastest “cable plugged in?” check on Linux labs.

Syntax

ip -br link ; ip -br addr

Important flags / options

• -brBrief columns
• link set eth0 upAdmin-up the NIC
• addr add …/24 dev eth0Add address

Safe example (lab)

ip -br addr

Expected output

lo               UNKNOWN        127.0.0.1/8 ::1/128
eth0             UP             192.168.56.10/24

How to read it: eth0 UP with a /24 address → L2+L3 look healthy; if DOWN, check cable/hypervisor NIC attachment.

What it does

Neighbor table (ARP/NDP). Stale or wrong MAC mappings appear during ARP spoof labs and after VM MAC changes.

Syntax

ip neigh show

Important flags / options

• showList cache
• flush allClear cache (careful)

Safe example (lab)

ip neigh show dev eth0

Expected output

192.168.56.1 lladdr 0a:00:27:00:00:01 REACHABLE

How to read it: Gateway MAC is cached and REACHABLE — good. FAILED/INCOMPLETE means no ARP reply.

What it does

NetworkManager CLI — inspect and control connections on desktop/server images that use NM. Handy when `ip` shows an address but “the GUI wifi” is wrong.

Syntax

nmcli device status ; nmcli connection show

Important flags / options

• device statusDevice overview
• connection up NAMEActivate profile
• dev wifiWi‑Fi scan (authorized networks)

Safe example (lab)

nmcli device status

Expected output

DEVICE  TYPE      STATE      CONNECTION
eth0    ethernet  connected  Wired connection 1
wlan0   wifi      disconnected  --

How to read it: Ethernet connected; Wi‑Fi idle — expected for a wired lab VM.

What it does

Built-in Windows DNS query. Use to verify which resolver the OS is using after VPN connect.

Syntax

nslookup name [server]

Safe example (lab)

nslookup lab-web.internal 192.168.56.2

Expected output

Server:  UnKnown
Address:  192.168.56.2

Name:    lab-web.internal
Address:  192.168.56.10

How to read it: Resolver 192.168.56.2 returned 192.168.56.10 — matches your Host-Only lab DNS.

What it does

Quick dual-stack checks. Many “works on my phone / fails on laptop” bugs are A vs AAAA differences.

Syntax

dig +short name A ; dig +short name AAAA

Important flags / options

• +shortOne-line answers
• @resolverQuery a specific server

Safe example (lab)

dig +short example.com A; dig +short example.com AAAA

Expected output

93.184.215.14
2606:2800:220:1:248:1893:25c8:1946

How to read it: Both A and AAAA exist — a v6-only path failure would still leave v4 working.

What it does

Pull TXT records used in email authentication (SPF, DMARC) and domain verification. Core for phishing-domain and mail-hardening labs.

Syntax

dig TXT name +short

Important flags / options

• TXTText records
• _dmarc.domainDMARC policy name

Safe example (lab)

dig TXT example.com +short; dig TXT _dmarc.example.com +short

Expected output

"v=spf1 -all"
"v=DMARC1; p=reject; …"

How to read it: SPF -all and DMARC reject are strict — good for a domain that should not send mail.

What it does

Verbose curl shows DNS → TCP → TLS → HTTP. Use when browsers show generic errors but you need the failing layer.

Syntax

curl -vI https://host

Important flags / options

• -vVerbose
• -IHeaders only
• -kInsecure TLS (lab only)
• --resolve host:443:IPPin IP / bypass DNS

Safe example (lab)

curl -vI https://127.0.0.1:8443/ --resolve lab.local:8443:127.0.0.1 2>&1 | findstr /i "Connected SSL HTTP"

Expected output

* Connected to 127.0.0.1 port 8443
* SSL connection using TLSv1.3
< HTTP/1.1 200 OK

How to read it: TCP connected, TLS negotiated, HTTP 200 — stack is healthy; look at app logic next.

What it does

Human-friendly HTTP client (httpie). Great for API labs: readable JSON, sessions, and auth headers without opaque curl strings.

Syntax

http [METHOD] URL field=value

Important flags / options

• GET/POSTMethods
• Authorization:Bearer …Header form
• -vVerbose
• --sessionPersist cookies

Safe example (lab)

http POST http://127.0.0.1:5000/login username=alice password=lab --print=HhBb

Expected output

POST /login HTTP/1.1
…
HTTP/1.1 200 OK
{
    "token": "eyJ…"
}

How to read it: Login succeeded and returned a token — decode claims next; do not paste real tokens into public tools.

What it does

Check whether a URL responds without downloading the body — useful for monitoring lab endpoints and mirror health.

Syntax

wget --spider -S URL

Important flags / options

• --spiderDo not save
• -SShow server response
• -O-Write body to stdout

Safe example (lab)

wget --spider -S http://127.0.0.1:8000/ 2>&1 | Select-String -Pattern 'HTTP|Length'

Expected output

HTTP/1.0 200 OK
Length: unspecified

How to read it: Endpoint answers 200 — good smoke test before opening a browser.

What it does

Legacy interactive TCP client. Still useful as a “is this port open and speaking cleartext?” probe (SMTP banner, HTTP). Prefer nc/Test-NetConnection when available.

Syntax

telnet host port

Safe example (lab)

telnet 127.0.0.1 80

Expected output

Connected to 127.0.0.1.
Escape character is '^]'.

How to read it: TCP connect succeeded on port 80 — type a raw HTTP request or Ctrl+] quit. Connection refused means nothing listens.

What it does

Swiss-army TCP/UDP client/server for labs: port checks, simple transfers, banner grabs. Same family as the shorter `nc` entry — focus here on troubleshooting patterns.

Syntax

nc [options] host port

Important flags / options

• -zvScan without sending data (verbose)
• -l -p PORTListen
• -uUDP
• -w NTimeout seconds

Safe example (lab)

nc -zv 192.168.56.10 22 80 443

Expected output

Connection to 192.168.56.10 22 port [tcp/ssh] succeeded!
nc: connect to … 80 failed: Connection refused
Connection to … 443 succeeded!

How to read it: SSH and HTTPS open; HTTP closed — aligns with a TLS-only lab web server.

What it does

Modern socket view for “what is listening?” and “who am I connected to?” Faster and more accurate than netstat on current Linux.

Syntax

ss -tulpn ; ss -tn state established

Important flags / options

• -tulpnTCP/UDP listen + processes
• state establishedActive connections
• dst :443Filter destination port

Safe example (lab)

ss -tulpn | findstr /i ":22 :80 :443"

Expected output

LISTEN 0 128 0.0.0.0:22 … users:(("sshd"…))
LISTEN 0 128 127.0.0.1:80 …

How to read it: SSH on all interfaces; HTTP only on localhost — HTTP is not exposed to the LAN (good unless you intended otherwise).

What it does

Classic listening-port snapshot. Deprecated on many distros but still in exam objectives and old runbooks — know how to read it and how to migrate to ss.

Syntax

netstat -tulpn

Important flags / options

• -tulpnTCP/UDP listen + PID/program
• -anAll numeric

Safe example (lab)

sudo netstat -tulpn | head

Expected output

Proto Recv-Q Send-Q Local Address  Foreign Address  State   PID/Program
tcp   0      0      0.0.0.0:22     0.0.0.0:*         LISTEN  812/sshd

How to read it: sshd owns *:22 — same conclusion as ss -tlnp.

What it does

List filter rules with packet counters. First stop when “ping works but port X does not” on legacy Linux firewalls.

Syntax

sudo iptables -L -n -v

Important flags / options

• -LList
• -nNumeric
• -vCounters
• -t natNAT table

Safe example (lab)

sudo iptables -L INPUT -n -v

Expected output

Chain INPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target     prot  …
120  9600 ACCEPT     tcp   --  *  *  0.0.0.0/0  0.0.0.0/0  tcp dpt:22

How to read it: Default DROP with SSH allowed — counters prove SSH traffic matched the accept rule.

What it does

Interactive file transfer over SSH. Useful when you need directory listing and partial uploads without full scp paths memorized.

Syntax

sftp user@host

Important flags / options

• ls/cd/put/getInteractive commands
• -i keyIdentity

Safe example (lab)

sftp -i ~/.ssh/lab_ed25519 alice@192.168.56.10

Expected output

Connected to 192.168.56.10.
sftp> put report.pdf
Uploading report.pdf to /home/alice/report.pdf

How to read it: Interactive session works — same auth as SSH; firewall must allow 22/tcp.

What it does

Confirm packets arrive when app logs are silent. Classic: SYN seen but no SYN-ACK → host firewall or service down.

Syntax

sudo tcpdump -ni iface port PORT -c N

Important flags / options

• -nNo DNS
• -iInterface
• port 443BPF filter
• -w file.pcapSave for Wireshark

Safe example (lab)

sudo tcpdump -ni eth0 port 22 -c 5

Expected output

IP 192.168.56.50.51234 > 192.168.56.10.22: Flags [S]
IP 192.168.56.10.22 > 192.168.56.50.51234: Flags [S.]

How to read it: SYN and SYN-ACK exchanged — TCP handshake for SSH is healthy on the wire.

What it does

Study workflow (not a single binary): (1) link/IP with ip/ifconfig/ipconfig (2) gateway ping (3) DNS dig/nslookup (4) TCP Test-NetConnection/nc (5) app curl/http (6) path mtr/traceroute if lossy. Use only on networks you own.

Syntax

# mental model: L1→L7

Important flags / options

• L1/L2Cable, link state, ARP
• L3IP, route, ping
• L4ports ss/nc
• L7HTTP/TLS/SSH

Safe example (lab)

ip -br addr; ping -c 2 192.168.56.1; dig +short lab-web.internal @192.168.56.2; nc -zv 192.168.56.10 22; curl -I http://192.168.56.10/

Expected output

(each tool prints its own success/failure)

How to read it: Run top-down: if ping to gateway fails, do not debug HTTP yet. Document which layer first failed.

What it does

firewalld CLI (RHEL/CentOS/Fedora). Parallel to ufw/iptables — know which stack your lab distro uses.

Syntax

firewall-cmd --state ; firewall-cmd --list-all

Important flags / options

• --stateRunning?
• --list-allZones/ports
• --add-port=443/tcpOpen port (runtime)
• --permanentPersist across reboot

Safe example (lab)

sudo firewall-cmd --list-all

Expected output

public
  target: default
  services: ssh
  ports:

How to read it: Only ssh service is allowed in public zone — add http/https deliberately for web labs.

What it does

Interactive nslookup record-type switching when dig is missing (common on locked Windows images).

Syntax

nslookup → set type=MX

Important flags / options

• set type=MXMail exchangers
• set type=NSName servers
• server IPChange resolver

Safe example (lab)

nslookup
> set type=MX
> example.com

Expected output

example.com MX preference = 10, mail exchanger = mail.example.com

How to read it: Mail flows to mail.example.com at preference 10 — compare with dig MX +short.

What it does

Break down where latency lives: DNS vs TCP vs TLS vs server think time. Perfect for “site is slow” tickets on systems you own.

Syntax

curl -o NUL -s -w "dns:%{time_namelookup} connect:%{time_connect} tls:%{time_appconnect} ttfb:%{time_starttransfer} total:%{time_total}\n" URL

Important flags / options

• -wWrite-out format
• -o NUL / -o /dev/nullDiscard body
• -sSilent progress

Safe example (lab)

curl -o /dev/null -s -w "dns:%{time_namelookup} connect:%{time_connect} tls:%{time_appconnect} ttfb:%{time_starttransfer} total:%{time_total}\n" https://example.com/

Expected output

dns:0.012 connect:0.045 tls:0.120 ttfb:0.210 total:0.215

How to read it: TLS and TTFB dominate — optimize certificate/chain and origin app, not just DNS.

What it does

Port/service discovery and scriptable checks. Legal/ethical boundary: only scan systems you own or have written authorization for (plus official scanme.nmap.org).

Syntax

nmap [options] target

Important flags / options

• -sVService/version detection
• -sCDefault NSE scripts
• -pPort list or -p-
• -oA nameSave .nmap/.xml/.gnmap
• -PnSkip host discovery

Safe example (lab)

nmap -sV localhost

Expected output

22/tcp open ssh OpenSSH 9.6
8000/tcp open http SimpleHTTPServer

How to read it: Two open services with versions — feed these into CVE research for your lab hardening notes.

What it does

Default script scan (-sC) plus version detection (-sV). Richer than a bare port list — still only on authorized lab targets.

Syntax

nmap -sC -sV -p- target

Important flags / options

• -sCDefault NSE scripts
• -sVVersions
• -p-All TCP ports
• -oASave all formats

Safe example (lab)

nmap -sC -sV -p 22,80 127.0.0.1

Expected output

22/tcp open ssh OpenSSH 9.6
80/tcp open http Apache httpd 2.4.57

How to read it: Versions feed CVE research; scripts may show http-title or ssh algorithms.

What it does

Ping-scan / host discovery without port scanning. Map which lab VMs are up on a subnet you own.

Syntax

nmap -sn net/mask

Important flags / options

• -snNo port scan
• -PS22,80TCP SYN ping set
• -PRARP ping (local LAN)

Safe example (lab)

nmap -sn 192.168.56.0/24

Expected output

Nmap scan report for 192.168.56.1
Host is up.
Nmap scan report for 192.168.56.10
Host is up.

How to read it: Two hosts answered — gateway and your lab VM. Next: targeted -sV on .10 only.

What it does

SYN scan + versions + default scripts on common ports. Standard lab recon pattern — still requires written authorization outside your VMs.

Syntax

nmap -sS -sV -sC -p 22,80,443 target

Important flags / options

• -sSSYN scan (root/cap)
• -sTConnect scan (no raw sockets)
• -sVVersions
• -sCDefault scripts

Safe example (lab)

nmap -sT -sV -p 22,80 127.0.0.1

Expected output

22/tcp open  ssh     OpenSSH 9.6
80/tcp closed http

How to read it: SSH open locally; HTTP closed — matches earlier nc/ss results.

What it does

Capture HTTP(S) between your browser and an authorized lab app. Scope must be your Juice Shop / DVWA / PortSwigger lab only.

Syntax

Burp → Proxy → Intercept on → browse lab app

Important flags / options

• Intercept onHold requests for review
• Target → ScopeRestrict to authorized hosts
• ForwardRelease request after inspection

Safe example (lab)

Set proxy 127.0.0.1:8080 → open local Juice Shop → Intercept a GET /

Expected output

GET / HTTP/1.1
Host: 127.0.0.1:3000
Cookie: …

How to read it: You see method, path, Host, and cookies — confirm Host is in scope before Forward.

What it does

Manually mutate a single request to probe authZ/IDOR on lab apps. Document each change for the report.

Syntax

Right-click request → Send to Repeater → edit → Send

Important flags / options

• SendFire the edited request
• HistoryCompare prior responses

Safe example (lab)

Send lab /api/orders/1001 to Repeater → change id to 1002 as user A

Expected output

HTTP/1.1 200 OK
{"orderId":1002,"owner":"userB"}

How to read it: Foreign object returned → IDOR candidate for the lab write-up (authorized app only).

What it does

Transform Base64/URL/HTML entities while analyzing lab traffic — never paste production secrets into random online decoders.

Syntax

Burp → Decoder → paste → Encode/Decode

Important flags / options

• Smart decodeAuto-detect common encodings
• HashLocal hash for lab password demos

Safe example (lab)

Decode lab cookie value that looks like Base64

Expected output

user=alice&role=user

How to read it: Readable claims — compare to JWT lessons; do not treat encoding as encryption.

What it does

Lists directory contents (cmd).

Syntax

dir [path] [options]

Important flags / options

• /aInclude hidden
• /sRecursive

Safe example (lab)

dir /a C:\Users

Expected output

…file listing…

How to read it: Windows analogue to ls for quick enumeration.

What it does

Shows IP configuration.

Syntax

ipconfig [/all]

Important flags / options

• /allFull details
• /flushdnsClear DNS cache

Safe example (lab)

ipconfig /all

Expected output

IPv4 Address . . : 192.168.1.50

How to read it: Adapter addresses, gateways, DNS servers.

What it does

Shows current user group memberships.

Syntax

whoami /groups

Important flags / options

• /privPrivileges
• /allFull

Safe example (lab)

whoami /groups

Expected output

…BUILTIN\Administrators…

How to read it: Check effective privileges after token changes.

What it does

View/modify NTFS ACLs.

Syntax

icacls path

Important flags / options

• /grantAdd ACE
• /removeRemove

Safe example (lab)

icacls C:\lab\share

Expected output

…NT AUTHORITY\SYSTEM:(F)…

How to read it: Permission review for shares and service paths.

What it does

Query Windows services (cmd).

Syntax

sc query [service]

Safe example (lab)

sc query wuauserv

Expected output

STATE : 4 RUNNING

How to read it: Service state during hardening/IR.

What it does

Read registry values from cmd.

Syntax

reg query HKLM\…

Safe example (lab)

reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Expected output

…autoruns…

How to read it: Persistence checks (pair with Autoruns in labs).

What it does

PowerShell grep. Search logs and configs for IOCs without leaving the Windows admin toolkit.

Syntax

Select-String -Path files -Pattern regex

Important flags / options

• -PathFiles/glob
• -PatternRegex
• -ContextLines around match

Safe example (lab)

Select-String -Path C:\lab\logs\*.log -Pattern 'Failed password|4625'

Expected output

auth.log:12:Failed password for …

How to read it: Matched failure patterns across lab logs — start timeline building from these hits.

What it does

Classic cmd enumeration still seen in malware and older runbooks. Know both cmd and PowerShell forms.

Syntax

net user ; net localgroup Administrators

Important flags / options

• net user nameUser detail
• net localgroupList groups

Safe example (lab)

net localgroup Administrators

Expected output

Members
---------------
alice
backup_admin

How to read it: Same story as Get-LocalGroupMember — unexpected admin is a finding.

What it does

Lists scheduled tasks — common persistence. Compare to baseline after malware labs.

Syntax

schtasks /query /fo LIST /v

Important flags / options

• /queryList
• /CreateCreate (admin)
• /fo LISTReadable format

Safe example (lab)

schtasks /query /fo LIST /v | findstr /i "TaskName Author Run"

Expected output

TaskName: \Lab\Updater
Author: LAB\alice
Run: powershell -enc …

How to read it: Encoded PowerShell in a task is suspicious — decode in a sandbox.

What it does

Built-in hashing without installing tools. Compare to vendor checksums before running installers.

Syntax

certutil -hashfile file SHA256

Important flags / options

• SHA256Algorithm
• MD5Legacy (avoid for security)

Safe example (lab)

certutil -hashfile .\installer.msi SHA256

Expected output

SHA256 hash of installer.msi:
AB12CD…

How to read it: Match this to the vendor’s published hash before install.

What it does

PowerShell connectivity test (ICMP + optional TCP). Replaces many ad-hoc telnet checks.

Syntax

Test-NetConnection host -Port port

Important flags / options

• -PortTCP port
• -TraceRoutePath
• -InformationLevel DetailedMore fields

Safe example (lab)

Test-NetConnection 127.0.0.1 -Port 445

Expected output

TcpTestSucceeded : True

How to read it: SMB port open locally — expected on many Windows labs; lock down on exposed hosts.

What it does

Windows traceroute — lists hops to a destination. Use when latency is high or a path suddenly changes after VPN/firewall changes.

Syntax

tracert [-d] host

Important flags / options

• -dDo not resolve hostnames
• -h NMax hops
• -4 / -6Address family

Safe example (lab)

tracert -d 1.1.1.1

Expected output

1  1 ms  1 ms  1 ms  192.168.1.1
2  8 ms  7 ms  8 ms  10.0.0.1
3  …  1.1.1.1

How to read it: Hop 1 is your router; later hops are ISP/core. Request timed out on a hop often means ICMP rate-limit, not a hard failure.

What it does

Combines traceroute with per-hop statistics (Windows). Slower than tracert but better for spotting lossy hops on a path you are authorized to test.

Syntax

pathping [-n] host

Important flags / options

• -nNo DNS
• -q NQueries per hop

Safe example (lab)

pathping -n 192.168.56.1

Expected output

Computing statistics for 25 seconds…
Hop  RTT  Lost/Sent = Pct  Address
0           0/100 = 0%     your-pc
1    1ms    0/100 = 0%     192.168.56.1

How to read it: Percent loss near hop 1 points at the LAN/gateway; loss only at the last hop often means the target rate-limits ICMP.

What it does

Shows computer name; PowerShell can show address list. Useful when RDP targets the wrong name after a clone.

Syntax

hostname ; [System.Net.Dns]::GetHostByName(($env:computerName))

Safe example (lab)

hostname

Expected output

LAB-WIN11

How to read it: NetBIOS/computer name is LAB-WIN11 — compare with DNS A record in your lab zone.

What it does

PowerShell connectivity Swiss army knife: ping + TCP + optional traceroute. Prefer this over telnet on modern Windows.

Syntax

Test-NetConnection host -Port port -InformationLevel Detailed

Important flags / options

• -PortTCP port
• -TraceRouteShow path
• -InformationLevel DetailedFull object

Safe example (lab)

Test-NetConnection 192.168.56.10 -Port 22 -InformationLevel Detailed

Expected output

ComputerName        : 192.168.56.10
RemotePort          : 22
TcpTestSucceeded    : True
PingSucceeded       : True

How to read it: Both ICMP and TCP/22 work — SSH should be reachable; if ssh.exe still fails, check keys/algorithms next.

What it does

Windows ARP cache dump. Compare MAC vendors when hunting duplicate IPs or lab gateway changes.

Syntax

arp -a

Important flags / options

• -aDisplay
• -dDelete entry

Safe example (lab)

arp -a | findstr 192.168.56

Expected output

192.168.56.1    0a-00-27-00-00-01    dynamic
192.168.56.10   08-00-27-aa-bb-cc    dynamic

How to read it: Gateway and lab VM MACs look like VirtualBox OUIs — expected in a Host-Only lab.

What it does

Windows routing table. When VPN splits traffic wrong, this shows which gateway owns 0.0.0.0 and specific prefixes.

Syntax

route print

Important flags / options

• -4 / -6Address family
• add/deleteModify (admin)

Safe example (lab)

route print -4 | findstr /i "0.0.0.0 192.168.56"

Expected output

0.0.0.0  0.0.0.0  192.168.1.1  …
192.168.56.0  255.255.255.0  On-link  192.168.56.50 …

How to read it: Default via home router; lab /24 is on-link on the Host-Only adapter — good split.

What it does

PowerShell DNS lookups with typed records — cleaner scripting than parsing nslookup text.

Syntax

Resolve-DnsName name -Type A

Important flags / options

• -TypeA/AAAA/MX/TXT/CNAME
• -ServerResolver IP
• -DnsOnlySkip LLMNR/NetBIOS

Safe example (lab)

Resolve-DnsName lab-web.internal -Type A -Server 192.168.56.2

Expected output

Name       Type TTL Section IPAddress
lab-web…   A    30  Answer  192.168.56.10

How to read it: Lab DNS returns the expected A record from your private resolver.

What it does

PowerShell directory listing.

Syntax

Get-ChildItem [-Force] [path]

Important flags / options

• -ForceShow hidden
• -RecurseWalk tree

Safe example (lab)

Get-ChildItem -Force $env:USERPROFILE

Expected output

…items…

How to read it: Prefer PowerShell on modern Windows SOC/IR work.

What it does

Lists running processes in PowerShell.

Syntax

Get-Process [name]

Important flags / options

• | SortSort by CPU/WS

Safe example (lab)

Get-Process | Sort-Object CPU -Descending

Expected output

…top CPU…

How to read it: Quick process triage before deep EDR.

What it does

Query Windows Event Log.

Syntax

Get-WinEvent -FilterHashtable @{…}

Important flags / options

• LogNamee.g. Security
• IdEvent ID

Safe example (lab)

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 20

Expected output

…failed logons…

How to read it: Modern replacement for many wevtutil workflows.

What it does

PowerShell view of TCP connections.

Syntax

Get-NetTCPConnection

Important flags / options

• -State ListenListeners

Safe example (lab)

Get-NetTCPConnection -State Listen

Expected output

LocalAddress LocalPort State …

How to read it: Find unexpected listening ports.

What it does

Integrity hashing for files.

Syntax

Get-FileHash -Algorithm SHA256 file

Important flags / options

• SHA256Common algo

Safe example (lab)

Get-FileHash .\sample.exe -Algorithm SHA256

Expected output

Algorithm Hash Path

How to read it: Compare to known-good hashes.

What it does

Check Authenticode signature status.

Syntax

Get-AuthenticodeSignature file.exe

Safe example (lab)

Get-AuthenticodeSignature .\update.exe

Expected output

Status: Valid

How to read it: Detect unsigned or tampered binaries.

What it does

Enumerate local accounts and group membership. Look for unexpected admins after a lab compromise exercise.

Syntax

Get-LocalUser ; Get-LocalGroupMember Administrators

Important flags / options

• Get-LocalUserUsers
• Get-LocalGroupMemberMembers of a group

Safe example (lab)

Get-LocalGroupMember Administrators

Expected output

ObjectClass Name
---------- ----
User        LAB\alice
User        LAB\backup_admin

How to read it: backup_admin in Administrators deserves explanation in your hardening checklist.

What it does

Defender status: real-time protection, signatures age, last scan. Baseline for endpoint hardening labs.

Syntax

Get-MpComputerStatus

Important flags / options

• AMServiceEnabledService on?
• AntivirusSignatureLastUpdatedDefs freshness

Safe example (lab)

Get-MpComputerStatus | Select AMServiceEnabled, RealTimeProtectionEnabled, AntivirusSignatureLastUpdated

Expected output

AMServiceEnabled : True
RealTimeProtectionEnabled : True
AntivirusSignatureLastUpdated : 2024-06-01 …

How to read it: Protection is on and signatures are recent — good lab baseline.

What it does

View/clear the Windows DNS client cache when a record changed but the PC still hits the old IP.

Syntax

Get-DnsClientCache ; Clear-DnsClientCache

Important flags / options

• Clear-DnsClientCacheFlush
• ipconfig /flushdnsClassic equivalent

Safe example (lab)

Get-DnsClientCache | Where-Object Entry -like '*lab*' | Format-Table -AutoSize

Expected output

Entry            RecordType Section TimeToLive Data
lab-web.internal A          Answer  42         192.168.56.10

How to read it: Cached A record still valid — if the server IP moved, flush and resolve again.

What it does

PowerShell routing view — filterable objects instead of raw route print text.

Syntax

Get-NetRoute -AddressFamily IPv4 | Format-Table -AutoSize

Important flags / options

• -DestinationPrefixFilter
• -InterfaceAliasPer NIC

Safe example (lab)

Get-NetRoute -DestinationPrefix '0.0.0.0/0'

Expected output

ifIndex DestinationPrefix NextHop     RouteMetric
12      0.0.0.0/0          192.168.1.1 25

How to read it: Default route metric 25 via 192.168.1.1 — if two defaults exist, lower metric wins.

What it does

Inspect enabled Windows Firewall rules when a lab port is blocked locally but ss/netstat shows LISTENING.

Syntax

Get-NetFirewallRule -Enabled True | …

Important flags / options

• -DisplayNameFilter by name
• -Direction InboundInbound only
• Get-NetFirewallPortFilterPort details

Safe example (lab)

Get-NetFirewallRule -Enabled True -Direction Inbound | Get-NetFirewallPortFilter | Where-Object LocalPort -eq 3389

Expected output

Protocol LocalPort
TCP      3389

How to read it: An inbound rule references 3389 — confirm Action Allow and RemoteAddress scope next.

What it does

Review history — also useful when hunting leaked secrets.

Syntax

git log --oneline

Important flags / options

• -pPatch
• -SPickaxe search

Safe example (lab)

git log -S 'AKIA' --oneline

Expected output

…commits mentioning pattern…

How to read it: Secret scanning starts with history awareness.

What it does

Manage AWS IAM (authorized accounts only).

Syntax

aws iam <command>

Important flags / options

• list-usersUsers
• get-account-authorization-detailsPolicy dump

Safe example (lab)

aws iam list-users --max-items 5

Expected output

Users: [ … ]

How to read it: Inventory identities in sandbox.

What it does

Show current AWS credential identity.

Syntax

aws sts get-caller-identity

Safe example (lab)

aws sts get-caller-identity

Expected output

Account: 123456789012 Arn: …

How to read it: Confirm which principal you are using.

What it does

List S3 buckets/objects (read-only recon).

Syntax

aws s3 ls s3://bucket

Important flags / options

• lsList
• api get-bucket-aclACL review

Safe example (lab)

aws s3 ls

Expected output

2024-01-01 12:00:00 my-bucket

How to read it: Find exposed buckets in your account.

What it does

Show active Azure subscription.

Syntax

az account show

Safe example (lab)

az account show

Expected output

name: LabSubscription …

How to read it: Confirm subscription context.

What it does

List Azure RBAC assignments.

Syntax

az role assignment list

Safe example (lab)

az role assignment list --assignee user@corp.com

Expected output

Role assignments …

How to read it: Audit excessive RBAC.

What it does

View GCP IAM bindings.

Syntax

gcloud projects get-iam-policy PROJECT

Safe example (lab)

gcloud projects get-iam-policy my-lab-proj

Expected output

bindings: …

How to read it: Find allUsers/allAuthenticatedUsers.

What it does

List Kubernetes resources.

Syntax

kubectl get pods -A

Important flags / options

• -AAll namespaces
• -o wideExtra columns

Safe example (lab)

kubectl get pods -A

Expected output

NAMESPACE NAME READY STATUS …

How to read it: Inventory workloads.

What it does

Detailed pod events and spec.

Syntax

kubectl describe pod name

Safe example (lab)

kubectl describe pod web-7f8c…

Expected output

Events: … Limits: …

How to read it: Debug crashloops and misconfig.

What it does

Check RBAC permissions for current user.

Syntax

kubectl auth can-i --list

Safe example (lab)

kubectl auth can-i create secrets --namespace prod

Expected output

yes/no

How to read it: Verify least privilege.

What it does

Inventory EC2 in an account you control. Look for public IPs, missing tags, and overly open security groups.

Syntax

aws ec2 describe-instances [--filters …]

Important flags / options

• --queryJMSE projection
• --filtersNarrow results

Safe example (lab)

aws ec2 describe-instances --query 'Reservations[].Instances[].{Id:InstanceId,IP:PublicIpAddress,SG:SecurityGroups}' --output table

Expected output

Id               IP             SG
i-0abc…          203.0.113.10   launch-wizard-1

How to read it: Public IP with default wizard SG is a classic lab misconfig to fix.

What it does

Fetch container stdout/stderr. First stop for CrashLoopBackOff and app errors in K8s labs.

Syntax

kubectl logs pod [-c container] [--previous]

Important flags / options

• -fFollow
• --previousLast crashed instance
• -n nsNamespace

Safe example (lab)

kubectl logs deploy/web -n lab --tail=50

Expected output

ERROR: connection refused to db:5432

How to read it: App cannot reach the database Service — check NetworkPolicy and Service selectors next.

What it does

Inventory DNS records in a hosted zone you control — pair with dig from the public Internet to verify propagation.

Syntax

aws route53 list-resource-record-sets --hosted-zone-id ZONE

Important flags / options

• --hosted-zone-idZone id
• --queryJMSE filter

Safe example (lab)

aws route53 list-resource-record-sets --hosted-zone-id Z3LABEXAMPLE --query "ResourceRecordSets[?Type=='A']" --output table

Expected output

Name              Type TTL  ResourceRecords
lab.example.com.  A    60   203.0.113.10

How to read it: Authoritative A record is 203.0.113.10 — dig @8.8.8.8 should match after TTL.

What it does

Tunnel a cluster Service to localhost for debugging when Ingress is not ready. Lab/cluster you admin only.

Syntax

kubectl port-forward svc/name local:remote -n ns

Important flags / options

• svc/nameService
• 8080:80Local:remote ports
• -nNamespace

Safe example (lab)

kubectl port-forward svc/web 8080:80 -n lab

Expected output

Forwarding from 127.0.0.1:8080 -> 80

How to read it: Browse http://127.0.0.1:8080 while the forward runs — stop with Ctrl+C when done.

What it does

JSON metadata about a container.

Syntax

docker inspect container

Safe example (lab)

docker inspect lab_web_1

Expected output

Config, Mounts, NetworkSettings …

How to read it: Find privileged mode / mounted sockets.

What it does

Image vulnerability quick view (Docker Scout).

Syntax

docker scout cves image:tag

Safe example (lab)

docker scout cves myapp:lab

Expected output

CVE list …

How to read it: Pre-deploy image scan.

What it does

Scans container images for OS/app CVEs. Run in CI before pushing lab images to a registry.

Syntax

trivy image image:tag

Important flags / options

• --severity HIGH,CRITICALFilter
• --exit-code 1Fail build

Safe example (lab)

trivy image myapp:lab --severity HIGH,CRITICAL

Expected output

Total: 3 (HIGH: 2, CRITICAL: 1)

How to read it: Rebuild from a patched base image before 'shipping' the lab demo.

What it does

Reach an endpoint from inside the container network namespace when host curl works but the app container cannot — classic Docker DNS/bridge issues.

Syntax

docker run --rm curlimages/curl:latest URL

Important flags / options

• --rmDelete after run
• --networkJoin a compose network

Safe example (lab)

docker run --rm --network lab_default curlimages/curl:latest -sI http://web:80/

Expected output

HTTP/1.1 200 OK

How to read it: Service name `web` resolves on the compose network — if this fails, check compose service names and network attachment.

What it does

Splunk SPL pattern for failed SSH in a lab index — adapt field names to your SIEM course lab.

Syntax

index=lab sourcetype=linux_secure "Failed password" | stats count by src

Important flags / options

• index=Which data set
• stats count byAggregate offenders
• earliest=-24hTime window

Safe example (lab)

index=lab "Failed password" earliest=-1h | top src

Expected output

src          count
10.0.0.5     37

How to read it: 37 failures from one lab IP — correlate with auth.log grep lesson.

What it does

Microsoft Sentinel / Azure Monitor KQL pattern for failed sign-ins in a demo workspace.

Syntax

SigninLogs | where ResultType != 0 | summarize count() by IPAddress, UserPrincipalName

Important flags / options

• whereFilter rows
• summarizeAggregate
• ago(1d)Relative time

Safe example (lab)

SigninLogs | where TimeGenerated > ago(1h) | where ResultType != 0 | take 20

Expected output

TimeGenerated … ResultType 50126 … IPAddress 203.0.113.10

How to read it: Non-zero ResultType = failed auth class — map codes in the SOC course.

What it does

Sigma is a detection rule language — write rules in class, convert with sigmac for Elastic/Splunk labs.

Syntax

title: Lab Failed SSH
logsource: { product: linux, service: auth }
detection: { selection: { message|contains: 'Failed password' } }

Important flags / options

• logsourceWhere the event lives
• detectionMatch logic
• levelInformational → critical

Safe example (lab)

Draft a Sigma rule for your lab auth failures → convert for the SIEM you use in class

Expected output

(rule YAML validated by linter)

How to read it: A portable detection idea — test in lab before any production deploy.

What it does

TLS, X.509, hashing, and key utilities. Inspect remote certs with s_client; hash files with dgst; never paste production private keys into random sites.

Syntax

openssl <subcommand> [options]

Important flags / options

• s_clientSpeak TLS to a server
• x509Cert encode/decode
• dgstMessage digest
• rand -hexRandom bytes

Safe example (lab)

echo -n hello | openssl dgst -sha256

Expected output

SHA2-256(stdin)= 2cf24dba5fb0a30e...

How to read it: Hash of the four characters h-e-l-l-o. Missing echo -n adds a newline and a different digest.

What it does

GPU password recovery for auditing. Use only hashes you are authorized to test (your lab dumps, your org’s audit). Mode -m must match the hash format.

Syntax

hashcat -m MODE -a ATTACK hashes wordlist

Important flags / options

• -m 0MD5
• -m 1000NTLM
• -a 0Dictionary
• -a 3Mask attack
• --showPrint cracked

Safe example (lab)

hashcat -m 0 -a 0 lab.txt rockyou.txt

Expected output

5f4dcc3b5aa765d61d8327deb882cf99:password

How to read it: Lab MD5 cracked to "password" — teach longer unique passwords + hashing with salt/slow KDFs.

What it does

John the Ripper — CPU-friendly password auditor. Good when GPU hashcat is unavailable; still lab/authorized hashes only.

Syntax

john [options] hashfile

Important flags / options

• --wordlist=FILEDictionary
• --showShow cracked
• --format=Force hash type
• --rulesWordlist mangling

Safe example (lab)

john --show lab.txt

Expected output

user1:letmein

How to read it: Cracked pair ready for the lab report — then reset the account and document the weakness.

What it does

Debug a TLS handshake and view certificates.

Syntax

openssl s_client -connect host:443

Important flags / options

• -servernameSNI

Safe example (lab)

openssl s_client -connect example.com:443 -servername example.com

Expected output

Certificate chain …

How to read it: Inspect cert subject/issuer and protocol.

What it does

Compute SHA-256 of a file for integrity checks.

Syntax

sha256sum file

Safe example (lab)

sha256sum image.iso

Expected output

ab12…  image.iso

How to read it: Compare to published hashes.

What it does

Verify signatures (lab/keyring dependent).

Syntax

gpg --verify file.sig file

Important flags / options

• --verifyCheck signature

Safe example (lab)

gpg --verify SHA256SUMS.sig SHA256SUMS

Expected output

Good signature from …

How to read it: Confirms authenticity when keys are trusted.

What it does

Scan files with YARA rules in a malware lab.

Syntax

yara rules.yar file

Safe example (lab)

yara rules.yar sample.bin

Expected output

RuleName sample.bin

How to read it: Rule matched the sample.

What it does

Decode JWT header/payload (jwt-cli or similar).

Syntax

jwt decode TOKEN

Safe example (lab)

jwt decode eyJhbGci…

Expected output

Header/Payload JSON

How to read it: Inspect alg/claims during API reviews.

What it does

Web server scanner for common misconfigurations and outdated software. Noisy — lab and authorized assessments only.

Syntax

nikto -h URL

Important flags / options

• -hHost/URL
• -TuningSelect checks
• -outputSave report

Safe example (lab)

nikto -h http://127.0.0.1:8080

Expected output

+ Server: Apache/2.4.49
+ The anti-clickjacking X-Frame-Options header is not present.

How to read it: Missing security headers and an old Server banner are findings to verify manually.

What it does

Fast web fuzzer for directories, parameters, and vhosts. Rate-limit and scope carefully even in labs.

Syntax

ffuf -u URL/FUZZ -w wordlist

Important flags / options

• -uURL with FUZZ
• -wWordlist
• -mcMatch status codes
• -eExtensions

Safe example (lab)

ffuf -u http://127.0.0.1:3000/FUZZ -w common.txt -mc 200,301,302

Expected output

admin                   [Status: 301]
backup.zip              [Status: 200]

How to read it: Hidden admin path and a downloadable backup — high-value lab findings to report ethically.

What it does

Online password guessing against lab services. Illegal/unethical without authorization — use only intentionally vulnerable VMs.

Syntax

hydra -l user -P wordlist proto://host

Important flags / options

• -lSingle login
• -LLogin list
• -PPassword list
• -tTasks/threads

Safe example (lab)

hydra -l admin -P rockyou-top100.txt ssh://192.168.56.20

Expected output

[22][ssh] host: 192.168.56.20   login: admin   password: admin123

How to read it: Weak lab credential found — document and remediate (disable password auth / enforce MFA).

What it does

Automates SQL injection detection/exploitation against apps you own (e.g. DVWA). Always confirm findings manually for reports.

Syntax

sqlmap -u 'URL' --batch

Important flags / options

• --batchNo prompts
• --dbsList databases
• --risk/--levelTest depth

Safe example (lab)

sqlmap -u "http://127.0.0.1/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit" --cookie="security=low; PHPSESSID=…" --batch --dbs

Expected output

available databases [2]:
[*] dvwa
[*] information_schema

How to read it: Confirmed injectable parameter and listed DBs — next teach parameterized queries as the fix.

What it does

See certificate chain, protocol, and verify return code without a browser. Essential when curl fails with CERT errors.

Syntax

openssl s_client -connect host:443 -servername name</dev/null

Important flags / options

• -servernameSNI
• -showcertsFull chain
• -tls1_2Force version

Safe example (lab)

echo | openssl s_client -connect 127.0.0.1:8443 -servername lab.local 2>/dev/null | openssl x509 -noout -subject -dates

Expected output

subject=CN = lab.local
notBefore=…
notAfter=…

How to read it: Cert CN matches lab.local — if browser still fails, check trust store / intermediate chain.