// arsenal

Operator knowledge base.

Commands, techniques, and playbooks battle-tested and searchable. Curated entries for recon, exploitation, forensics, reverse engineering, DFIR, and CTF.

60entries·14categories·0copies

Platform:Difficulty:Use case:

// 60 entries

(01)// Recon

INTERMEDIATElinuxmacos

Nmap — Full TCP port scan with version detection

Scans all 65535 TCP ports with service version detection and default scripts. -oA saves output in all three formats.

nmaptcpversion-detectionscripts

(02)// Recon

INTERMEDIATElinuxmacos

Nmap — UDP top 20 ports

Scans the 20 most common UDP ports. UDP is slow — be patient.

nmapudp

(03)// Recon

ADVANCEDlinux

Nmap — Stealth SYN scan with OS detection

SYN scan (half-open, less noisy) with OS fingerprinting. Requires root.

nmapsyn-scanos-detectionstealth

(04)// Recon

BEGINNERlinux

Gobuster — Directory bruteforce

Brute-forces directories and files. -x adds extension fuzzing.

gobusterwebdirectory-bruteforcefuzzing

(05)// Recon

INTERMEDIATElinuxmacos

Ffuf — Virtual host fuzzing

Discovers virtual hosts by fuzzing the Host header. Filter by word count to remove false positives.

ffufvhostsubdomainfuzzing

(06)// Recon

BEGINNERlinux

Whatweb — Web technology fingerprinting

Identifies CMS, frameworks, server software, headers. -a 3 is aggressive mode.

whatwebfingerprintingwebcms

(07)// Enumeration

BEGINNERlinux

SMB — Enumerate shares with null session

Lists SMB shares without authentication (null session).

smbsmbclientsharesnull-session

(08)// Enumeration

INTERMEDIATElinux

SMB — Enumerate with enum4linux-ng

Full SMB/LDAP enumeration: users, groups, shares, password policy, OS info.

enum4linuxsmbusersgroupsldap

(09)// Enumeration

BEGINNERlinux

SNMP — Walk community string

Walks the full SNMP MIB tree using the default community string "public".

snmpsnmpwalkcommunity-string

(10)// Enumeration

INTERMEDIATElinux

Ldapsearch — Anonymous LDAP query

Queries LDAP anonymously for all objects. Replace dc values with target domain.

ldapldapsearchactive-directoryanonymous

(11)// Enumeration

BEGINNERlinuxmacos

Netcat — Banner grabbing

Simple banner grab. Connect to a port and read whatever the service sends.

netcatncbannergrabbing

(12)// PrivEsc

BEGINNERlinux

LinPEAS — Linux privilege escalation script

Automated Linux privilege escalation enumeration. Checks SUID, cron, writable paths, sudo, capabilities.

linpeaslinuxprivescautomated

(13)// PrivEsc

BEGINNERlinuxmacos

Sudo — Check allowed commands

Lists commands the current user can run with sudo. Check GTFOBins for each result.

sudolinuxprivescgtfobins

(14)// PrivEsc

BEGINNERlinux

SUID — Find SUID binaries

Finds all SUID binaries on the system. Cross-reference each with GTFOBins.

suidlinuxprivescfindgtfobins

(15)// PrivEsc

INTERMEDIATElinux

Cron — Find writable cron paths

Checks system cron jobs and finds writable shell scripts that may be executed by root cron.

cronlinuxprivescwritable

(16)// PrivEsc

BEGINNERwindows

WinPEAS — Windows privilege escalation

Automated Windows privilege escalation enumeration. Checks services, registry, credentials, tokens.

winpeaswindowsprivescautomated

(17)// PrivEsc

INTERMEDIATEwindows

Windows — Check token privileges

Lists current user token privileges. SeImpersonatePrivilege = likely path to SYSTEM.

windowstokenprivilegesimpersonatesystem

(18)// Web

BEGINNERlinuxmacos

SQLMap — Basic SQL injection scan

Automatically detects and exploits SQL injection. --dbs enumerates databases. --batch skips prompts.

sqlmapsqlidatabaseinjection

(19)// Web

BEGINNERlinuxmacos

JWT — Decode token (no verification)

Decodes JWT header and payload without signature verification.

jwtdecodebase64token

(20)// Web

BEGINNERlinuxmacos

LFI — Basic path traversal test

Tests for Local File Inclusion via path traversal to read /etc/passwd.

lfipath-traversalcurllinux

(21)// Web

INTERMEDIATEany

Burp — Match and Replace for security header bypass

Adds or overrides X-Forwarded-For header to simulate localhost access for IP-restricted endpoints.

burpheadersbypassx-forwarded-forlocalhost

(22)// Reverse Eng.

BEGINNERlinuxmacos

File — Identify binary type

Identifies the true file type regardless of extension. ELF, PE, scripts, archives.

filebinaryidentificationstatic

(23)// Reverse Eng.

BEGINNERlinuxmacos

Strings — Extract printable strings from binary

Extracts all printable strings of 8+ chars. Often reveals hardcoded credentials, URLs, C2 addresses.

stringsstatic-analysisbinarycredentials

(24)// Reverse Eng.

INTERMEDIATElinux

Checksec — Check binary protections

Reports enabled security mitigations: ASLR, NX, PIE, stack canaries, RELRO.

checksecbinaryaslrnxpiecanarymitigations

(25)// Reverse Eng.

ADVANCEDlinuxmacoswindows

Ghidra — Batch headless analysis

Runs Ghidra analysis without the GUI. Useful for scripting bulk analysis.

ghidraheadlessstatic-analysisdisassembly

(26)// Reverse Eng.

INTERMEDIATElinuxmacos

Radare2 — Open binary and analyze

Opens binary in radare2 with full analysis (-A runs aaa). Start here for interactive disassembly.

radare2r2disassemblystatic-analysis

(27)// Reverse Eng.

INTERMEDIATElinux

GDB + pwndbg — Debug with pwndbg plugin

Opens binary in GDB with pwndbg plugin for enhanced output. Essential for dynamic analysis.

gdbpwndbgdebuggingdynamic-analysisstack

(28)// Reverse Eng.

INTERMEDIATElinux

ltrace — Trace library calls

Intercepts and logs all library function calls (malloc, strcmp, printf, etc.) as the program runs.

ltracelibrary-callsdynamic-analysistracing

(29)// Reverse Eng.

INTERMEDIATElinux

strace — Trace system calls

Intercepts system calls. Filter with -e to focus on specific calls like file opens and network.

stracesyscallsdynamic-analysistracing

(30)// Malware Analysis

BEGINNERwindows

PEStudio — Static PE analysis

Static analysis of PE (Windows) executables. Shows suspicious imports, strings, entropy, digital signature.

pestudiopewindowsstatic-analysisimportsentropy

(31)// Malware Analysis

BEGINNERlinuxwindows

Detect-It-Easy — Packer identification

Identifies packers, compilers, cryptors used on PE files. Tells you if unpacking is needed.

diedetect-it-easypackerpeidentification

(32)// Forensics

BEGINNERlinuxmacoswindows

ExifTool — Extract metadata from any file

Extracts full metadata from images, PDFs, Office files, audio, video. Second form strips it all.

exiftoolmetadataexifforensicssteganography

(33)// Malware Analysis

INTERMEDIATEwindows

FLARE-VM — Malware analysis sandbox setup (Windows)

Installs FLARE-VM — the complete Windows malware analysis environment with 100+ tools.

flare-vmwindowssandboxsetupmandiant

(34)// Malware Analysis

INTERMEDIATElinuxwindows

Capa — Identify malware capabilities

Identifies capabilities of a PE binary using rules mapped to MITRE ATT&CK and MBC.

capacapabilitiesmitrestatic-analysismandiant

(35)// Forensics

INTERMEDIATElinuxmacos

Volatility 3 — Identify memory profile

Identifies OS version and build from a Windows memory dump.

volatilitymemory-forensicswindowsprofile

(36)// Forensics

INTERMEDIATElinuxmacos

Volatility 3 — List processes

Lists all running processes at time of memory capture. pstree shows parent-child relationships.

volatilitymemory-forensicsprocessespslistpstree

(37)// Forensics

INTERMEDIATElinuxmacos

Volatility 3 — Network connections from memory

Extracts network connections present in memory at time of capture.

volatilitymemory-forensicsnetworkconnectionsnetstat

(38)// Forensics

BEGINNERlinux

Binwalk — Extract embedded files from firmware/binary

Identifies and extracts embedded files (ZIP, gzip, ELF, PNG, etc.) from any binary or firmware.

binwalkfirmwareextractionembeddedctf

(39)// Forensics

INTERMEDIATElinux

Foremost — Carve files from disk image

File carving tool that recovers files from disk images based on headers and footers.

foremostfile-carvingdisk-forensicsrecovery

(40)// Steganography

BEGINNERlinux

Steghide — Extract hidden data from image

Extracts data hidden in JPEG/BMP/WAV files using steghide embedding.

steghideimagejpeghidden-datastegoctf

(41)// Steganography

BEGINNERlinux

Zsteg — LSB stego analysis on PNG/BMP

Detects LSB (Least Significant Bit) steganography in PNG and BMP files.

zsteglsbpngstegoctf

(42)// Steganography

BEGINNERlinuxmacoswindows

Stegsolve — Visual image analysis (CTF)

GUI tool to analyze image bit planes, color channels, and LSB visually.

stegsolveimagebitplanevisualctf

(43)// Steganography

BEGINNERlinuxmacoswindows

Sonic Visualiser — Audio spectrogram analysis

Visualizes audio files as spectrograms. Hidden images or text often visible in frequency domain.

sonic-visualiseraudiospectrogramstegoctf

(44)// Cryptography

BEGINNERlinuxwindows

Hashcat — Crack hash with rockyou

Cracks hashes using dictionary attack. -m specifies hash type (0=MD5, 1000=NTLM, 1800=sha512crypt).

hashcatcrackinghashrockyoudictionary

(45)// Cryptography

BEGINNERlinux

John the Ripper — Crack shadow file

Combines passwd and shadow files then cracks with wordlist.

johnshadowpasswdcrackinglinux

(46)// Cryptography

BEGINNERany

CyberChef — Identify encoding chain

Use CyberChef Magic operation to auto-detect and decode unknown encoding chains.

cyberchefencodingbase64rot13magicctf

(47)// Active Directory

INTERMEDIATEwindowslinux

BloodHound — Collect AD data with SharpHound

Collects Active Directory relationship data for BloodHound graph analysis.

bloodhoundsharphoundactive-directoryadgraph

(48)// Active Directory

ADVANCEDlinux

Kerberoasting — Request service tickets

Requests Kerberos service tickets for accounts with SPNs. Cracks offline to get plaintext passwords.

kerberoastingkerberosspnimpacketactive-directory

(49)// DFIR

INTERMEDIATEwindows

Windows — Collect system triage (KAPE)

Collects key forensic artifacts from a live Windows system using KAPE triage collection.

kapewindowstriagecollectiondfirartifacts

(50)// DFIR

INTERMEDIATEwindows

Windows Event Logs — Find logon events

PowerShell: retrieves Windows Security logon events (Event ID 4624). Shows who logged in and when.

windowsevent-logspowershelllogonsecurity4624

(51)// DFIR

BEGINNERlinuxmacoswindows

Wireshark — Filter HTTP POST requests

Filters captured traffic to show only HTTP POST requests, useful for credential harvesting in DFIR/CTF.

wiresharkhttppcapnetwork-forensicscredentialsfilter

(52)// DFIR

INTERMEDIATElinuxmacos

Tshark — Extract HTTP objects from PCAP

Extracts all HTTP transferred files (images, scripts, executables) from a PCAP capture.

tsharkpcaphttpexportnetwork-forensicsctf

(53)// Scripting

BEGINNERlinuxmacos

Python — Reverse shell one-liner

Python3 reverse shell one-liner. Start a netcat listener before executing on target.

pythonreverse-shellone-linernetcat

(54)// Scripting

INTERMEDIATElinux

Bash — Upgrade to fully interactive TTY

Upgrades a raw netcat shell to a fully interactive TTY with tab completion, Ctrl+C, and clear.

ttyshellupgradeptybashinteractive

(55)// Scripting

INTERMEDIATEwindows

PowerShell — Download and execute in memory

Downloads and executes a PowerShell script entirely in memory without writing to disk.

powershelliexfilelessmemorydownload

(56)// OSINT

INTERMEDIATEany

Shodan — Search for vulnerable services

Shodan searches for internet-exposed services. Useful for recon on target organizations.

shodanosintreconexposed-servicesdorks

(57)// OSINT

BEGINNERlinuxmacos

TheHarvester — Email and subdomain harvesting

Gathers emails, subdomains, IPs, and employee names from public sources.

theharvesteremailssubdomainsosintrecon

(58)// CTF

BEGINNERlinuxmacos

CTF — First steps checklist on any challenge file

Standard first-five-commands methodology for any unknown file in CTF forensics/misc challenges.

ctfmethodologyforensicsfile-analysischecklist

(59)// CTF

BEGINNERany

CTF — Common encoding recognition patterns

Quick reference for visually identifying common encoding schemes in CTF challenges.

ctfencodingbase64hexrot13morserecognition

(60)// CTF

BEGINNERlinux

GTFOBins — Quick lookup for privesc via SUID binary

GTFOBins documents how to abuse Unix binaries for privilege escalation, reverse shells, and file reads.

gtfobinssuidprivesclpelinuxctf