#the basics
htop
Add user |add passwd in one line
useradd [user] <---add user
echo -e "Password\nPassword" | passwd [user] <----change password - single line
usermod -a -G [group] [user] <----add to a group
iptraf
nmap
mtr
whois
digg
host
text file operation
wc - count lins in a text file
split - split text file into smaller files
uname -a
lsb_release -a
Check Distribution of Ubuntu
cat /etc/*release
cat /etc/issue
Another way to find distro version
Midnight Commander - clone of Norton Commander
apt-get install mc
to use type: mc
cal - prints calendar
ps |ws -l
pipe to ws -l counts the number of lines and in this case number of processes
# ln -sf /origin/location/ -t /shortcut/location
create shortcut
-sf - s for symbolic and f for force deletion if exsiting
- t destination of shortcut
# check running services
chkconfig --list | grep '3:on'
#check open ports
netstat -tulpn<
nmap -sT -O localhost
#check root permissions
awk -F: '($3 == "0") {print}' /etc/passwd
# secure file transfer - scp
Download a file from remote to local
$ scp your_username@remotehost.edu:foobar.txt /some/local/directory
Upload File to remote from local
$ scp foobar.txt your_username@remotehost.edu:/some/remote/directory
Copy Directory from local to remote
$ scp -r foo your_username@remotehost.edu:/some/remote/directory/bar
Copy from remote to remote
$ scp your_username@rh1.edu:/some/remote/directory/foobar.txt \
your_username@rh2.edu:/some/remote/directory/
Copy two files to remote from local
cp foo.txt bar.txt your_username@remotehost.edu:~
copy file from local to remote using an alternate port
V$ scp -P 2264 foobar.txt your_username@remotehost.edu:/some/remote/directory
copy multiple files from reomte to local, current durectory
scp your_username@remotehost.edu:/some/remote/directory/\{a,b,c\}
# console info
who
w - detailed
last - last logged on users (times,source host)
history
history of typed commands
history - c
whowatch
who is on and what they are doing
# hardware and system stats
vmstat
sar
sar -n DEV | more ------ network stats
sar -n DEV -f /var/log/sa/sa24 | more ------ network stats from the 24th (example)
sar 4 5 ------ real-time stats
# memory mapping of a process
#sensors - temperature monitor
install lm-sensors
run "# sensors-detect" to detect available sensors
run "# sensors" to check the temp.
combine with watch command for realtime stats "# watch -n 2 sensors"
# lspci
# acpi
battery and temp info
-p (battery power left time)
-V (caps. all possible info)
# network info
#network dump
tcpdump
tcpdump -i eth1 'udp port 53'
tcpdump -vvv -i eth0 dst port 80 -s 10000
tcpdump 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'
tcpdump -i eth1 'dst 202.54.1.5 and (port 21 or 20')
tcpdump -ni eth0 'dst 192.168.1.5 and tcp and port http'
tcpdump -n -i eth1 -s 0 -w output.txt src or dst port 80
More tcpdump here
#network
lsof
list open files, network conns and more
#processes
nmon
comprehensive process / network /... montor
#bandwidth
nethogs
who is using the bandwidth right now
iftop
bmon
iptraf
# ssh tunneling
ssh -l username -D 8080 -f -C -q -N -p 22 remotehost.com
ssh -f -2 -D 8080 user@remotehost.com -N
Creates ssh tunnel to remotehost.com
Point apps SOCKS proxy to 127.0.0.1 port 8080
to stop ps aux |grep ssh , then kill the process
Reverse SSH tunnel
ssh -fN -R 7000:localhost:22 username@yourMachine-ipaddress
So this ssh connection request originating from remote server to your machine
will make sure that any ssh connection request for port 7000 on your machine
is forwarded to port 22 of remote server.
Now do an ssh connection request from your machine to your own machine at port 7000:
ssh username@localhost -p 7000
Port Forward - the easy way
ssh -L 8888:www.somewebsite.com:80 user@yoursshhost -N
Open your browser and go to http:/ /localhost:8888 to see if your tunnel is working.
- or - ssh -L 8888:ircserver.net:6667 user@yoursshhost -N
connect IRC client to locahost/8888
msf> setg Proxies SOCKS4:127.0.0.1:8080
Use Metasploit via SSH tunnel
Proxy Chains
proxychains is an app for linux
like: your_host <--> proxy 1 (TOR) <--> proxy 2 (HTTP or SOCKS4/5) <--> target_host
proxychains nmap -sT -PO -p 80 -iR (find some webservers through proxy)
proxychains ssh username@anotherhost.com
proxychains lynx www.website.com
examples of proxychaines use
Configuration:
proxychains looks for config file in following order:
---) ./proxychains.conf
---) $(HOME)/.proxychains/proxychains.conf
---) /etc/proxychains.conf **
# proxychains application targethost.com
# proxyresolv targethost.com
WPA:
You can set your details in /etc/network/intefaces:
auto lo
iface lo inet loopback
auto wlan0
iface wlan0 inet dhcp
wireless-essid mylilrouter
wireless-key 0123456abcd
#auto eth0
iface eth0 inet dhcp
# wireless setup
ifconfig eth0 192.168.1.5 netmask 255.255.255.0 up
sudo iwlist wlan0 scan
optionally sudo iwlist wlan0 scan > list.txt
sudo iwconfig wlan0 essid mylilrouter
WEP:
sudo iwconfig wlan0 key 0123456abcd
sudo dhclient wlan0
WPA:
You can set your details in /etc/network/intefaces:
auto lo
iface lo inet loopback
auto wlan0
iface wlan0 inet dhcp
wireless-essid mylilrouter
wireless-key 0123456abcd
#auto eth0
--------------------------------------
iface eth0 inet dhcp
iw(list/config) can only handle WEP.
You need wpa-supplicant for this.
sudo apt-get install wpasupplicant
In /etc/wpa_supplicant.conf you put your ssid and password.
gksu gedit /etc/wpa_supplicant.conf
Example:
network={
ssid="ssid_name"
psk="password"
}
Assuming your interface is wlan0 you can connect to it with...
wpa_supplicant -B -iwlan0 -c/etc/wpa_supplicant.conf -Dwext && dhclient wlan0
# smtp commands
HELO sendinghostname
This command initiates the SMTP conversation. The host connecting to the remote SMTP server
identifies itself by it's fully qualified DNS host name.
EHLO sendinghostname
An alternative command for starting the conversation. This states that the sending server
wants to use the extended SMTP (ESMTP) protocol.
MAIL From:
This is the start of an email message. The source email address is what will appear in the
"From:" field of the message.
RCPT To:
This identifies the receipient of the email message. This command can be repeated multiple times
for a given message in order to deliver a single message to multiple receipients.
DATA
This command signifies that a stream of data, ie the email message body, will follow.
The stream of data is terminated by a "." on a line by itself.v
RSET
Abort the current e-mail transaction (reset), but stay connected for more to come.
NOOP
No op,. as in .no operation.. Do nothing, but return an .OK. response.
QUIT
This terminates an SMTP connection. Multiple email messages can be transfered during a single TCP/IP connection.
This allows for more efficient transfer of email. To start another email message in the same session,
simply issue another "MAIL" command.
VRFY username
This command will request that the receiving SMTP server verify that a given email username is valid.
The SMTP server will reply with the login name of the user. This feature can be turned off in sendmail because
allowing it can be a security hole. VRFY commands can be used to probe for login names on a system.
EXPN aliasname
EXPN is similar to VRFY, except that when used with a distribution list, it will list all users on that list.
This can be a bigger problem than the "VRFY" command since sites often have an alias such as "all".
Subject:
Cc:
Reply-To:
Custom Headers:
# Client sends headers
From: Foo
To: Bar
Date: Mon, 1 May 2006 10:23:00 +0000 (UTC)
Reply-To:
# Custom header
X-submission: Submitted by 192.0.20.1
Subject: This is my message
Email header lines are not SMTP commands per se. They are sent in the DATA stream for a message.
Header lines appear on a line by themselves, and are seperated from the body of a message by a blank line.
# find command
find -mmin -10
find files changed in the last 10 minutes
find -size +5M -ls
find files larger then 5 Meg. display with extra proprties, not just a listing
Find / replace strings in multiple files
find /path/to/files -type f -exec sed -i 's/old.string/new.string/g' {}/;
-or-
sed -i 's/hello.com/localhost.net/g' /root/test/*
watch command. can be used in combination with many others such as FIND (watch file proprties chagne in real time or DF (watch drive Size in real time)
watch -n 1 find -mmin -1
files that changed in the last minute, refresh every second (the -n option)
# GREP - global regular expression print
grep ""
Search for word in a file
grep -n ""
grep -vn ""
grep -c ""
Print count of an occurance
grep -l "boo" *
prints only the filenames of files in the query that have lines that match the search string
grep -i "BOO"
grep -x "boo"
looks for eXact matches only.
grep -f search
specify a file containing the search string
grep "e$"
search the file for lines ending with the letter "e"
egrep "boot|boots"
egrep supports that grep does not is the pipe (|) funcitons as an "or."
find | grep "hello"
print out the files that find returns that contain the text "hello"
tail -n8 | grep "boo"
performs a grep on the last 8 lines of
Can be used for live grepping with -f
find . -exec grep "boo" {} \;
search for the string "boo" in every directory below the current directory
grep "\([a-z]\)\1"
uses backreferences to find lines that contain two of the same lowercase letter in succession.
Disk operations - USB
delete partitions and format a USB drive
fdisk /dev/sda
delete / create partitions
mkfs -t vfat /dev/sda1
format (in this case as Fat32)
# mount USB drive
fdisk -l
find the name of the device
mkdir /mnt/sdb1
create mountpoint directory
mount -t vfat /dev/sdb1 /mnt/sdb
mount device to the mountpoint directory
echo "/dev/sdb1 /mnt/sdb1 vfat defaults 0 0" >> /etc/fstab
mount -a
automate the process (above two lines)
Disk operations - Network
# mkdir /mnt/sharename
# sudo chmod u+s /sbin/mount.cifs /sbin/umount.cifs
# mount.cifs //server.domain/sharename /path/to/mountpoint -o user=myusername,domain=
- //server.domain.com/sharename is the mount location. R
- /path/to/mountpoint is the location you want to map/mount the network drive at.
- username=myusername - myusername should be replaced with your Stevens username.
- workgroup=campus - this specifies the domain to check your username and password against, leave it like this
# umount.cifs /path/to/mountpoint
encryption with truecrypt
# truecrypt -t -c
Encrypt a volume
follow the steps in wizard
mount encrypted volume
truecrypt /dev/device-or-file /mnt/mountpoint
mount the encrypted volume
# BACK TO THE TOP