Useful One-Liners

OneLiners.sh

# Find a Linux executable named python3 in the /usr/ directory (finds the python3 executable)
find /usr -name "python3*" -exec file {} \; | grep ELF

# Loop over a set of numbers (pings 192.168.1.1 through 192.168.1.255)
for i in {1..255}; do sudo /usr/bin/ping -c1 192.168.1.$i; done

# Loop over lines in a file; write to a file (resolves hostnames to IP addresses)
while read f; do dig A $f +short; done < hosts.txt > ips.txt

# Loop over files ending in txt in your current directory (counts lines in files)
for f in *txt; do wc -l $f; done

# Collect target subdomains from certificate transparency searches, remove the wildcards, sort uniquely
curl -s 'https://crt.sh/?q=counterhack.com&output=json' | jq -r '.[].name_value' | grep -v '*' | sort -u > domains.txt

# Loop over lines in a file; write to a file
while read f; do echo "https://$f" ; echo "http://$f" ; done < domains.txt > webhosts.txt

# OK, so this one is Windows, but it gives you Sysinternals tools in a mount drive
net use * https://live.sysinternals.com/tools

# take screenshots of those webhosts (if they exist) and serve them locally on TCP/7171
docker run --rm -v $(pwd):/data leonjza/gowitness gowitness scan file -f webhosts.txt --write-db
docker run --rm -v $(pwd):/data -p127.0.0.1:7171:7171 leonjza/gowitness gowitness report server --host 0.0.0.0
# the `--host 0.0.0.0` option is to listen on all interfaces of the docker container - not the host itself