> For the complete documentation index, see [llms.txt](https://docs.ctrl-z.rocks/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ctrl-z.rocks/cheat-sheets/helpful-command-qr.md).

# Helpful Command QR

### Nmap scanning

```bash
ports=$(nmap -p- --min-rate=1000 -T4 <target-ip> | grep ^[0-9] | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)
```

<details>

<summary>Description of command</summary>

* **`ports=$(...)`**: This part of the command assigns the result of the command within the parentheses to the variable **`ports`**.
* **`nmap -p- --min-rate=1000 -T4 10.129.228.206`**: This **`nmap`** command scans all ports (specified by **`p-`**) on the IP address **`10.129.228.206`**. The **`-min-rate=1000`** flag sets the minimum rate of packets sent per second, and the **`T4`** flag sets the timing template to "aggressive" for faster scanning.
* **`grep ^[0-9]`**: This filters the **`nmap`** output, keeping only the lines starting with a number (i.e., the lines containing open ports).
* **`cut -d '/' -f 1`**: This command processes the filtered lines by cutting each line at the delimiter **`/`** and keeping only the first field, which is the port number.
* **`tr '\\n' ','`**: This translates newline characters **`\`** into commas **`,`**, joining all the port numbers in a single line separated by commas.
* **`sed s/,$//`**: This removes the trailing comma at the end of the line.

</details>

```bash
nmap -p$ports -sC -sV <target-ip>
```

### Shells

```python
python3 -c 'import pty;pty.spawn("/bin/bash")'
```

### Active Directory Enum

Emumerate users

```bash
ldapsearch -h x.x.x.x -x -b "DC=DOMAIN,DC=DOMAIN" -s sub "(&(objectclass=user))"  | grep sAMAccountName: | cut -f2 -d" "
```

```bash
enum4linux -U x.x.x.x  | grep "user:" | cut -f2 -d"[" | cut -f1 -d"]"
```

```bash
kerbrute userenum -d domain.tld --dc x.x.x.x /path/to/username.list > enum_users
```

### Finding Files

```bash
find /path/to/directory -type f -exec grep -il "keyword" {} +
```

```bash
find /path/to/directory \( -name "*.key" -o -name "*.pem" -o -name "*.bak" -o -name "*.conf" \) -exec ls -lah {} + 2>/dev/null
```