FIELD REFERENCE

Command vault

Search by intent, tool, system, or phase. Context first, command second.

/ Focus search

⌕⌘ K

RESULTS12 matching commands

NMAPLinux · Service Enumeration

nmap -p445 --script smb-protocols,smb2-security-mode <target>

Inspect SMB dialects and signing

SMBCLIENTLinux · Service Enumeration

smbclient -L //<target> -N

Attempt anonymous share listing in a lab

NETEXECLinux · Service Enumeration

nxc smb <target> -u '<user>' -p '<password>' --shares

Validate known credentials and enumerate shares

NETEXECLinux · Active Directory

nxc smb <dc> -u '<user>' -p '<password>' --users --groups

Collect basic domain account context

LDAPSEARCHLinux · Active Directory

ldapsearch -x -H ldap://<dc> -D '<user>@<domain>' -W -b 'DC=example,DC=local' '(objectClass=user)' sAMAccountName

Query directory objects with explicit scope

SHARPHOUNDWindows · Active Directory

.\SharpHound.exe -c All

Collect graph data from an authorized Windows lab

IMPACKETLinux · AD Authentication

GetUserSPNs.py '<domain>/<user>:<password>' -dc-ip <dc> -request

Request service tickets in an authorized lab

POWERVIEWWindows · AD Authentication

Get-DomainUser -SPN | Select samaccountname,serviceprincipalname

Enumerate accounts with SPNs

KLISTWindows · AD Authentication

klist

Inspect the current Kerberos ticket cache

SHELLLinux · Linux Privilege Escalation

id; sudo -l

Record identity, groups, and sudo policy

SHELLLinux · Linux Privilege Escalation

find / -perm -4000 -type f 2>/dev/null

Inventory SUID candidates for later validation

SHELLLinux · Linux Privilege Escalation

ss -tulpn; getcap -r / 2>/dev/null

Inspect local services and file capabilities