Fast lookups for the things nobody memorises: which port a service listens on, what an SOA field means, which HTTP status a proxy is really reporting, and the flags for the tools you reach for under pressure. Filter the whole page below.
sed -i
disagree, macOS ships bash 3.2, and there are three common netcat variants. When it
matters, read the man page on the box in front of you.
Lookup tables for the things you stop remembering the moment you need them: port numbers, DNS record syntax, status codes, header values, address ranges, flag bits and file signatures. Every value here is the real one — copy it straight into a zone file, a config or a terminal. Use the filter box above to jump to a single row.
A port number is a convention, not a promise — anything can listen anywhere. Confirm with a banner before you believe the label. Rows marked never expose are services that historically ship with no authentication, weak authentication, or full remote control, and belong on a private interface or behind a VPN.
CAP_NET_BIND_SERVICE./proc/sys/net/ipv4/ip_local_port_range).SSH-2.0-OpenSSH_9.6) gives you the version for free.STARTTLS; plaintext otherwise.rpcinfo -p; a UDP reflection source and the front door to NFS.ntpd mode-7 monlist made it a huge amplification vector; disabled in current builds.public still works far too often. v3 adds real auth and privacy.rsh. Syslog over TLS is 6514 (RFC 5425).STARTTLS and mandatory authentication. This is what a mail client should use.STARTTLS downgrade window.no_root_squash exports plus host-based trust; keep it off untrusted networks./ into a container.pg_hba.conf: trust on a non-loopback line means no password at all.CONFIG SET dir turn a database into arbitrary file write. Protected mode only saves you when no bind/password is configured.exec into any pod on the node.Real zone-file syntax: name TTL class type rdata. A trailing dot makes a name absolute; without it, the name is relative to $ORIGIN — forgetting the dot is the single most common zone-file bug (mail.example.com silently becomes mail.example.com.example.com.).
@), then serial, refresh, retry, expire, and the negative-cache TTL (RFC 2308).ip6.arpa. Mail servers care; set it to match the HELO name.issue, issuewild, iodef. Restricts which CAs may issue for the name (RFC 8659); CAs must check it at issuance time.3 1 1 means "this exact end-entity key, SPKI, SHA-256". Only trustworthy when the zone is DNSSEC-signed.VerifyHostKeyDNS yes, and only trust it under DNSSEC.ech= config for Encrypted Client Hello.The first digit is the class: 1xx informational, 2xx success, 3xx redirection, 4xx client error, 5xx server error. What matters when debugging is which side is complaining.
Expect: 100-continue; send the body.{"error":…} is a design smell, not a success.Location header.Content-Range and Accept-Ranges: bytes.ETag/If-Modified-Since. No body; use the cache.WWW-Authenticate header naming the scheme.Allow header listing what is permitted — useful during a methods probe.Accept. 415 Unsupported Media Type — cannot parse the request's Content-Type.If-Match to avoid lost updates.Retry-After in seconds or as an HTTP date.Header → a value that is safe to start from → what it actually buys you. Set them at the edge and in the app; a proxy-only policy disappears the moment someone bypasses the proxy.
preload is a promise to the browser vendors — hard to undo, and it covers every subdomain including internal ones.strict-dynamic beats host allow-lists, which are routinely bypassable through a permitted CDN.Content-Type instead of guessing at the bytes, so a user-supplied file served as text/plain or image/png is never treated as script or HTML.frame-ancestors, which is what modern browsers honour — set both.no-referrer if your URLs contain tokens.() disables the feature for everyone, including your own page. (self) allows only your own origin.window.opener link to cross-origin pages, closing a family of cross-site leak and tab-nabbing tricks.same-origin this makes the page cross-origin isolated (required for SharedArrayBuffer). It will break third-party embeds that do not opt in.no-cache means "revalidate", not "do not store".__Host- prefix is enforced by the browser: it requires Secure and Path=/ and forbids Domain, so a subdomain cannot overwrite the cookie.Origin blindly. * is illegal together with Access-Control-Allow-Credentials: true, and null is reachable from a sandboxed iframe — never allow it.report-to csp-endpoint in the policy.Content-Security-Policy-Report-Only first and read the reports before enforcing.What to enable in 2026: TLS 1.2 and TLS 1.3 only, AEAD ciphers only, ECDHE key exchange for forward secrecy. Everything above that line is history you still meet in the wild.
-tls1_2 or -tls1_3 to force a version; the handshake output names the negotiated protocol and cipher.Special-purpose address blocks. Knowing them on sight tells you instantly whether a log line is internal, a lab, a document, or something that should never have been routed. IANA keeps the authoritative registries; RFC 6890 is the umbrella document.
0.0.0.0 as a source means "no address yet" (DHCP); as a bind address it means every interface on the host.169.254.169.254 is the cloud instance metadata endpoint — the classic SSRF target for stealing instance credentials.255.255.255.255 is the limited broadcast address and is never forwarded by a router.::ffff:198.51.100.10. Dual-stack sockets log client IPv4 addresses in this form, which is another trap for naive allow-lists.ping6 fe80::1%eth0.Prefix → dotted mask · wildcard mask (the inverse, used in ACLs) · total addresses · usable hosts. "Usable" subtracts the network and broadcast addresses; /31 and /32 are the documented exceptions.
The control bits share one byte of the TCP header — offset 13, the byte tcpdump calls tcp[13]. Reading them is how you tell "the host refused you" from "a firewall ate the packet".
ss -lntp shows every listener with its process.close(). A growing CLOSE_WAIT count is an application bug — file descriptors are leaking.tcp_tw_recycle, is the fix.tcp.flags.syn == 1 && tcp.flags.ack == 0.ICMP is not optional plumbing you can safely drop wholesale — parts of it are load-bearing for the internet to work at all.
net.ipv4.conf.all.accept_redirects=0).Exact published syntax for each record, with the tags that matter. All of these are DNS TXT records except the MTA-STS policy, which is fetched over HTTPS.
all a mx ip4 ip6 include exists (ptr is deprecated). Qualifiers: + pass, - fail, ~ softfail, ? neutral.v version, k key type (rsa or ed25519, RFC 8463), p the base64 public key, t=y testing mode, h permitted hash algorithms. An empty p= revokes the key.d signing domain, s selector (the two locate the DNS key), h the signed headers, bh body hash, b the signature. Use 2048-bit RSA; RFC 8301 rules out keys under 1024 bits and SHA-1.p policy (none, quarantine, reject), sp subdomain policy, rua aggregate report address, ruf forensic reports, adkim/aspf alignment (r relaxed, s strict). Defined in RFC 7489.From: header domain. This is the piece SPF and DKIM alone are missing. Start at p=none with rua, read the reports for a few weeks, then tighten to quarantine and reject.id is an opaque version string — change it whenever you change the policy file, or senders will keep the cached one.Content-Type: text/plain, on a certificate valid for that hostname:mode is enforce, testing or none; max_age is in seconds (604800 = 7 days). RFC 8461.l an SVG Tiny PS logo over HTTPS, a the Verified Mark Certificate. Requires DMARC already at quarantine or reject. BIMI is still being standardised and support differs between mailbox providers, so confirm each provider's current requirements before paying for a mark certificate.PEM is base64-encoded DER wrapped in -----BEGIN X----- armour (RFC 7468). The label tells you what is inside; the file extension frequently lies.
Proc-Type: 4,ENCRYPTED and DEK-Info headers, which use weak legacy key derivation; convert to PKCS#8.p= value decodes to.openssl pkey will not always read it; use ssh-keygen.file cert.crt, or just try both -inform pem and -inform der.keytool. Modern JDKs prefer PKCS#12.-nodes writes the private key unencrypted — delete the output when you are done.The first few bytes of a file identify its real type regardless of what the extension or the upload's Content-Type claims — which is exactly why upload filters that trust the extension fail. Offsets are from the start of the file unless stated.
\x89PNG\r\n\x1a\n. The CR/LF and EOF bytes exist to detect mangling by text-mode transfers.E0 (JFIF), E1 (Exif) or DB. Ends with FF D9 — data after that trailer is appended, not part of the image.GIF87a, 47 49 46 38 39 61 = GIF89a.BM.%PDF- followed by the version, e.g. 1.7. The file should end with %%EOF.PK\x03\x04. An empty archive starts 50 4B 05 06. This also covers .docx, .xlsx, .pptx, .jar, .apk, .odt and .epub — they are all ZIP containers.BZh, then a digit for the block size.\xfd7zXZ\0.7z plus a fixed signature.ustar at offset 257, not at the start. A plain tar has no signature in its first bytes at all.\x7fELF. Byte 4: 01 = 32-bit, 02 = 64-bit. Byte 5: 01 = little-endian, 02 = big-endian. Linux and BSD executables, shared objects and core dumps.MZ at offset 0. The 4-byte little-endian value at offset 0x3C points to the PE header, which begins 50 45 00 00 (PE\0\0). Windows .exe, .dll, .sys.\0asm, followed by the version 01 00 00 00.SQLite format 3 plus a NUL. Sixteen bytes, unmistakable in a hex dump.RIFF), 4 size bytes, then the form type at offset 8: WAVE, AVI or WEBP.ftyp at offset 4, preceded by a 4-byte box length. The brand that follows (isom, mp42, M4A , heic) names the exact flavour.#! followed by an interpreter path. A "JPEG" upload starting with this is a script, not an image.Content-Type from the user's filename.The command lines that actually get typed during recon, triage and incident response — each with real, verified flags. Where a command needs root or is destructive, the description says so. Commands with a spare screen equivalent on this site link straight to it.
nmap 10.0.0.1Default scan: top 1000 TCP ports of one host. As root this is a SYN scan (-sS); unprivileged it falls back to a full connect scan (-sT).nmap -sn 10.0.0.0/24Host discovery only ("ping sweep") — which hosts are up, no port scan.nmap -Pn hostSkip host discovery, treat the target as up. Use when the host drops ping but you know it exists.nmap -sS hostSYN "half-open" scan. Fast and quiet; needs root (raw sockets).nmap -sT hostFull TCP connect scan. No root needed; completes the 3-way handshake so it is louder in logs.nmap -sU hostUDP scan. Slow (relies on ICMP port-unreachable); needs root.nmap -p 22,80,443 hostNamed ports. -p- = all 65535, -p 1-1024 = a range, -F = fast (top 100), --top-ports 100 = the 100 most common.nmap -sV hostService/version detection — probe open ports to name the software and version.nmap -O hostOS fingerprint from TCP/IP stack behaviour. Needs root.nmap -A hostAggressive: version + OS detection, default scripts and traceroute in one shot.nmap -sC hostRun the default NSE script set (equivalent to --script=default). Also --script=vuln, --script http-title, --script-help <name>.nmap -T4 hostTiming template 0–5 (paranoid → insane). -T4 is the usual choice; add --min-rate 1000 to floor the packet rate.nmap --open -n host--open shows only open ports; -n skips DNS (faster); -6 scans IPv6; --reason explains each port state.nmap -oA scan hostWrite all three output formats with one base name: -oN normal, -oX XML, -oG greppable.-f / -D / -g / --spoof-macEvasion flags exist — packet fragmentation, decoy source addresses, source-port and MAC spoofing — to test whether an IDS/firewall detects a scan. Only relevant on systems you are authorised to test.nmap -sV -sC -T4 hostThe everyday combo: what is open, what is running, and the default checks.dig example.comA record by default, with the full ANSWER/AUTHORITY sections and query stats.dig example.com MXQuery a specific type: A AAAA MX TXT NS SOA CNAME CAA SRV.dig +short example.comJust the answer values, one per line — ideal for scripts. Combine: dig +short MX example.com.dig @1.1.1.1 example.comQuery a specific resolver instead of your system default.dig +trace example.comResolve iteratively from the root down, showing each delegation — the tool for diagnosing broken delegation.dig +dnssec example.comSet the DO bit and request signatures (RRSIG). An ad flag in the header means the resolver validated DNSSEC.dig -x 8.8.8.8Reverse lookup (PTR) for an IP. Add +short for just the name.dig +noall +answer NS example.comTrim the output to only the ANSWER section — clean, greppable.dig ANY example.comAsk for every type — but most servers now refuse or minimise ANY (RFC 8482), so results are usually incomplete.host -t MX example.comhost equivalent. host example.com gives A/AAAA/MX in one line; host 8.8.8.8 does reverse; host -a is verbose (ANY-style).nslookup -type=MX example.com 1.1.1.1nslookup form: -type= sets the record, a trailing server picks the resolver. Bare nslookup opens interactive mode (set type=NS, server 1.1.1.1).curl https://example.comGET the URL, body to stdout.curl -I urlHEAD request — response headers only. -i includes headers with the body; -v shows the full request, TLS handshake and headers.curl -sS urlSilent, but still print errors — the standard pairing for scripts. -L follows redirects.curl -X POST urlSet the HTTP method explicitly. With -d, POST is already implied.curl -d 'a=1&b=2' urlSend a form body (implies POST, Content-Type: application/x-www-form-urlencoded). --data-urlencode 'q=a b' encodes safely.curl -d @body.json -H 'Content-Type: application/json' urlSend a JSON file as the request body with the right content type.curl -H 'Authorization: Bearer TOKEN' urlAdd an arbitrary header. -u user:pass does HTTP Basic auth.curl -c jar.txt -b jar.txt url-c saves cookies to a jar, -b jar.txt replays them; -b 'k=v' sends one inline.curl --connect-timeout 5 --max-time 15 urlCap the connect and total time so a hung host cannot block a script.curl --resolve example.com:443:203.0.113.5 urlForce a hostname to a specific IP — test one backend behind a CDN or before DNS is cut over, keeping the correct SNI/Host.curl --cert client.pem --key client.key urlPresent a client certificate (mTLS). --cacert ca.pem pins a trusted CA; -k skips TLS verification — diagnostics only, never in production.curl -x http://proxy:8080 urlRoute through a proxy. -x socks5://host:1080 for SOCKS.curl -O urlDownload to a file. -O keeps the remote name, -o name chooses one, -C - resumes a partial download.curl -w '%{http_code} %{time_total}\n' -o /dev/null -s urlWrite-out format string. Fields include %{time_namelookup} (DNS), %{time_connect} (TCP), %{time_appconnect} (TLS), %{time_starttransfer} (TTFB), %{size_download}, %{num_redirects}, %{remote_ip}, %{url_effective}.openssl s_client -connect example.com:443 -servername example.comOpen a TLS session and print the negotiated cert. -servername sends SNI so you get the right virtual host's certificate.openssl s_client -connect host:443 -showcertsDump the full chain the server sent, in PEM — useful for finding a missing intermediate.openssl s_client -connect host:443 -tls1_2Force a protocol version (-tls1_2 / -tls1_3) to check what a server will accept.openssl s_client -connect mail:587 -starttls smtpNegotiate STARTTLS before the handshake — also imap, pop3, ftp, ldap.echo | openssl s_client -connect host:443 2>/dev/null | openssl x509 -noout -datesOne-liner for a cert's validity window. echo | closes stdin so the session ends.openssl x509 -in cert.pem -text -nooutFull human-readable certificate. -noout -subject -issuer -dates -serial -fingerprint -sha256 for one-line facts; -ext subjectAltName lists the SANs.openssl genrsa -out key.pem 2048Generate an RSA private key. Modern equivalent: openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out key.pem.openssl ecparam -name prime256v1 -genkey -noout -out ec.pemGenerate an EC private key on P-256 (a.k.a. prime256v1 / secp256r1). Public key: openssl pkey -in key.pem -pubout.openssl req -new -newkey rsa:2048 -nodes -keyout key.pem -out csr.pemNew key + CSR in one step (-nodes = no passphrase). Inspect a CSR: openssl req -in csr.pem -noout -text -verify.openssl req -x509 -newkey rsa:2048 -nodes -keyout key.pem -out cert.pem -days 365Self-signed certificate for a lab/test host.openssl x509 -in cert.pem -outform der -out cert.derPEM → DER. Reverse with -inform der. Bundle key + cert into PKCS#12: openssl pkcs12 -export -in cert.pem -inkey key.pem -out bundle.p12; unpack with openssl pkcs12 -in bundle.p12 -nodes -out out.pem.openssl dgst -sha256 fileHash a file. -hmac 'key' for an HMAC; -sign key.pem -out sig file and -verify pub.pem -signature sig file for signatures.openssl enc -aes-256-cbc -salt -pbkdf2 -in plain -out encSymmetric encryption; -d to decrypt. Always include -pbkdf2 so the passphrase is stretched properly. Note this is unauthenticated: enc cannot emit or verify an AEAD tag, so tampering with the ciphertext is undetectable and CBC decryption is a padding-oracle risk. For anything that matters, use an AEAD mode via a real library, or sign the file separately.openssl rand -hex 3232 random bytes as hex (or -base64 32) — keys, tokens, salts.openssl verify -CAfile ca.pem cert.pemVerify a cert against a trusted CA. Add -untrusted chain.pem to supply the intermediates.ssh-keygen -t ed25519 -C 'you@host'Generate a modern Ed25519 key (small, fast, strong). Use -t rsa -b 4096 only where Ed25519 is unsupported.ssh-keygen -l -f id_ed25519.pubShow a key's fingerprint. -y -f key derives the public key from a private one; -p -f key changes its passphrase.ssh -i ~/.ssh/id_ed25519 -p 2222 user@hostConnect with a specific key and port. ssh-copy-id user@host installs your public key on the server.eval "$(ssh-agent -s)" && ssh-add ~/.ssh/id_ed25519Start the agent and load a key so the passphrase is entered once. ssh-add -l lists loaded keys; ssh -A forwards the agent (use sparingly — a compromised host can use your keys).ssh -L 8080:localhost:80 user@hostLocal forward: your localhost:8080 reaches port 80 as seen from the server.ssh -R 9000:localhost:3000 user@hostRemote forward: the server's port 9000 reaches your local port 3000.ssh -D 1080 user@hostDynamic forward — a local SOCKS5 proxy tunnelling through the host. Add -N -f to background a tunnel with no shell.ssh -J bastion user@internalJump through a bastion (ProxyJump) to reach a host you cannot connect to directly.~/.ssh/configPer-host defaults: Host web then indented HostName, User, Port, IdentityFile, ProxyJump. Then just ssh web.ssh-keygen -R hostRemove a stale host key from ~/.ssh/known_hosts after a legitimate rebuild. ssh-keygen -F host finds it; verify a new fingerprint out-of-band before trusting it.scp -P 2222 file user@host:/path/Copy a file up (note capital -P for the port); -r for directories; reverse the arguments to pull a file down.rsync -avz -e 'ssh -p 2222' dir/ user@host:/path/Efficient sync over SSH — only changed data. -P shows progress and resumes; --dry-run previews; --delete mirrors deletions (verify with a dry run first).tcpdump -DList capturable interfaces. Almost every tcpdump command needs root.tcpdump -i eth0Capture on one interface; -i any captures on all.tcpdump host 10.0.0.1BPF filter by host. Also src host / dst host for one direction.tcpdump port 443Filter by port (src port / dst port too); net 10.0.0.0/24 filters a subnet.tcpdump tcp / udp / icmp / arpFilter by protocol; combine expressions with and / or / not, e.g. 'tcp port 80 and host 10.0.0.1'.tcpdump 'tcp[tcpflags] & tcp-syn != 0'Flag-based filter — match packets with the SYN bit set. Equivalent numeric form: 'tcp[13] & 2 != 0'.tcpdump -nn-n stops host name resolution, -nn also stops port-name resolution — faster and unambiguous.tcpdump -c 100 -s 0-c stops after N packets; -s 0 captures the full packet (snaplen), important when writing a pcap for later analysis.tcpdump -w cap.pcapWrite raw packets to a pcap. Read one back (no root needed) with tcpdump -r cap.pcap, or open it in Wireshark.tcpdump -A / -X-A prints payloads as ASCII, -X as hex + ASCII; -e shows the link-layer header; -tttt gives human-readable timestamps.tcpdump -i any -nn -s0 -w cap.pcap 'port 443'Recipe: capture all HTTPS traffic to a file for offline analysis.tcpdump -i eth0 -nn 'tcp[tcpflags] & (tcp-syn|tcp-ack) == tcp-syn'Recipe: bare SYNs only — connection attempts, useful for spotting a scan or a SYN flood.nc -lvnp 4444Listen on a port, verbose, numeric (-p is the port on traditional/ncat; OpenBSD nc takes the port as the last argument). Add > file to receive a file.nc host 4444Connect to a host/port — a bidirectional pipe over stdin/stdout. Pair with a listener redirecting < file to send a file.nc -zv host 20-25Port check: -z = zero-I/O (just test), -v = report state. Single named target only.printf 'HEAD / HTTP/1.0\r\n\r\n' | nc host 80Banner / response grab — speak just enough protocol to read what the service announces.nc -u host 53-u switches to UDP; -w 3 sets a timeout so a dead peer does not hang the pipe.which ncKnow your variant: OpenBSD nc (default on most Linux/macOS) removed the -e exec flag for safety; the traditional (GNU) nc and Nmap's ncat keep it. ncat --ssl host 443 adds TLS.socat - TCP:host:443Connect stdio to a TCP service. socat OPENSSL:host:443,verify=0 - does the same over TLS.socat TCP-LISTEN:8080,reuseaddr,fork TCP:backend:80A quick TCP port-forwarder/relay — fork handles multiple clients.iptables -L -n -v --line-numbersList rules with packet counters and rule numbers. iptables -S prints them in save/restore syntax.iptables -A INPUT -p tcp --dport 22 -j ACCEPTAppend an allow rule for SSH. -A adds to the end; -I INPUT 1 inserts at the top (position matters — see below).iptables -D INPUT 3Delete rule number 3 (from --line-numbers), or repeat the exact rule with -D instead of -A.iptables -P INPUT DROPDefault-deny. Order is everything: first matching rule wins, so allow loopback and established traffic before the policy drops the rest — otherwise you lock yourself out.iptables -A INPUT -i lo -j ACCEPTAllow loopback, then iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT keeps existing connections alive under a default-deny policy.iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADESource-NAT for a gateway. Port-forward (DNAT): iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 10.0.0.5:8080.iptables-save > /etc/iptables/rules.v4iptables rules are not persistent by default. Save them (restore with iptables-restore < file), or use the iptables-persistent / netfilter-persistent package.nft list rulesetnftables equivalent of listing everything. It is the modern replacement for iptables.nft add rule inet filter input tcp dport 22 acceptAllow SSH in nft. A default-deny chain: nft add chain inet filter input '{ type filter hook input priority 0 ; policy drop ; }', then add ct state established,related accept. Load a file with nft -f /etc/nftables.conf.ufw allow 22/tcpThe friendly front-end. ufw allow from 10.0.0.0/24 to any port 22 scopes by source; ufw status numbered then ufw delete N removes a rule.ufw default deny incomingSet a deny-by-default posture, then ufw default allow outgoing and ufw enable. ufw status verbose confirms.w / whoWho is logged in right now, and what they are running.lastRecent successful logins (from wtmp). lastb shows failed attempts (btmp, root only); lastlog shows the last login per account.ss -tulpnListening sockets: -t TCP, -u UDP, -l listening, -p owning process (needs root for others), -n numeric. ss -tanp shows established connections. (Legacy: netstat -tulpn.)ps auxfProcess list as a tree; pstree -ap shows the parentage with arguments — spot a shell spawned by a web server.lsof -i :443What is bound to a port. lsof -p PID lists a process's open files; lsof +L1 reveals deleted-but-still-open files, a common malware hiding trick.crontab -lCurrent user's cron jobs; crontab -l -u user for another. Also check /etc/crontab, /etc/cron.d/, /etc/cron.* and /var/spool/cron/.systemctl list-timers --allsystemd's cron equivalent. systemctl list-units --type=service lists services; systemctl cat <unit> shows a unit's definition.find / -mtime -1 -type f 2>/dev/nullFiles modified in the last day. Scope it (find /etc -mtime -1) to cut noise; -newermt '2026-07-25' filters by an exact date.find / -perm -4000 -type f 2>/dev/nullSUID binaries (run as their owner) — a privilege-escalation surface. -perm -2000 finds SGID files.rpm -VaVerify installed files against the package manifest (RHEL); a 5 in the output means the checksum changed. Debian: dpkg -V or debsums -c.journalctl -u ssh --since '1 hour ago'Read a service's logs. -k kernel, -f follow live, -b current boot. Auth events also land in /var/log/auth.log (Debian) or /var/log/secure (RHEL).grep -rin 'pattern' /path-r recursive, -i case-insensitive, -n line numbers. Add -c count, -v invert, -w whole word, -l filenames only, -A/-B/-C N context lines.grep -E 'foo|bar' / grep -P '\d+'-E = extended regex (POSIX ERE), -P = Perl-compatible (PCRE, needed for \d, lookarounds). -o prints only the matched text.grep -Eo '([0-9]{1,3}\.){3}[0-9]{1,3}' access.log | sort | uniq -c | sort -rn | headWorked example: pull every IP out of a log and rank the noisiest talkers.sed -n '10,20p' filePrint a line range. sed 's/foo/bar/g' file substitutes to stdout; -i edits in place, -i.bak keeps a backup.sed '/DEBUG/d' app.logWorked example: strip out matching lines (here, drop DEBUG noise before reading a log).awk -F: '{print $1}' /etc/passwd-F sets the field separator; $1…$NF are fields, $0 the whole line. awk shines at column extraction and arithmetic over columns.awk '$9==404 {print $7}' access.log | sort | uniq -c | sort -rnWorked example: in a combined access log, field 9 is the status and field 7 the path — this ranks the top 404 URLs. awk '{sum+=$10} END{print sum}' totals bytes served.jq '.' file.jsonPretty-print and validate JSON. -r emits raw strings (no quotes), -c compact output.curl -s api/users | jq -r '.[] | select(.active) | [.id,.email] | @tsv'Worked example: filter a JSON API to active users and emit clean tab-separated columns. Also jq 'keys', jq 'length', jq '.data[].name'.git log -p -S 'AKIA' --allPickaxe: every commit across all branches that added or removed the string — the fastest way to find where a secret entered history. -G'regex' is the regex variant.git log --all --oneline -- path/to/fileFull history of one file, including on branches you are not on.git grep 'pattern' $(git rev-list --all)Grep the working tree of every commit ever made (thorough but heavy on large repos).git log --oneline --graph --allVisualise branch/merge topology. git blame -L 10,20 file shows who last touched specific lines and in which commit.git show <commit>:pathPrint a file exactly as it was at a commit. git show <commit> alone shows that commit's full diff.git log --diff-filter=D --oneline -- pathFind the commit that deleted a file, then recover its last content with git show <commit>^:path (the ^ means the parent, i.e. before the deletion).git filter-repo, BFG) does not un-leak a credential. Anyone who cloned or forked still has it, mirrors and CI caches keep it, and hosting providers can serve an old commit by its SHA. If a secret was ever pushed, treat it as compromised and rotate/revoke it — history cleanup is only tidying up afterwards.ipconfig /allFull network config (adapters, DNS, DHCP, MAC). ipconfig /flushdns clears the resolver cache; ipconfig /displaydns dumps it.nslookup -type=MX example.com 1.1.1.1DNS lookup (same syntax as elsewhere). PowerShell-native: Resolve-DnsName example.com -Type MX.netstat -anoConnections and listeners with the owning PID. netstat -anob (admin) also names the executable; cross-reference the PID in Task Manager.Get-NetTCPConnection -State Listen | Sort LocalPortPowerShell-native listener list; the OwningProcess column is the PID. Use -State Established for active connections.Test-NetConnection host -Port 443The PowerShell "can I reach this TCP port" test — the closest thing to a TCP ping. Add -TraceRoute for path insight.Get-FileHash file -Algorithm SHA256Hash a file (SHA-256 is the default). Command-prompt equivalent: certutil -hashfile file SHA256.certutil -dump cert.cerInspect a certificate. certutil -decode in.b64 out.bin / -encode converts to and from Base64 (a handy built-in when other tools are absent).whoami /privList the current token's privileges — a first stop when checking for privilege-escalation footholds (e.g. SeImpersonatePrivilege). whoami /groups and whoami /all show more.Get-WinEvent -FilterHashtable @{LogName='Security';Id=4625}Query the event log efficiently. Security event 4625 is a failed logon, 4624 a successful one. Get-WinEvent -LogName Security -MaxEvents 50 grabs the most recent entries.^ $ \b \BAnchors: ^ start, $ end (of string, or of each line with the m flag), \b word boundary, \B non-boundary. Anchors match a position, not a character.. \d \w \s [abc] [^abc] [a-z]Classes: . any char (except newline unless s flag), \d digit, \w = [A-Za-z0-9_], \s whitespace (uppercase negates: \D \W \S). [ ] is a custom set, [^ ] negates it.* + ? {n} {n,} {n,m}Quantifiers: * 0+, + 1+, ? 0 or 1, {n,m} a range. Greedy by default (grab as much as possible); append ? for lazy: .*? takes the fewest characters.(ab) (?:ab) (?<y>ab) \1 a|bGroups: ( ) captures, (?: ) groups without capturing, (?<name> ) names a group. \1 is a backreference to the first group's matched text; | is alternation.(?=..) (?!..) (?<=..) (?<!..)Lookaround (zero-width): (?= ) lookahead, (?! ) negative lookahead, (?<= ) lookbehind, (?<! ) negative lookbehind. Not every engine supports lookbehind (POSIX ERE has none).flags: i g m s x ui case-insensitive, g global (all matches), m multiline anchors, s dotall (. matches newline), x extended/verbose, u Unicode.\b(?:\d{1,3}\.){3}\d{1,3}\bIPv4 (loose — also matches 999.999.999.999). For strict octets use each group as (25[0-5]|2[0-4]\d|1?\d?\d).[^@\s]+@[^@\s]+\.[^@\s]+Pragmatic email extractor. No regex fully validates an email address (RFC 5322 is far more permissive than any usable pattern) — use this to find candidates, then confirm by sending mail.https?://[^\s/$.?#]\S*Pragmatic http/https URL matcher for pulling links out of text.\b[a-fA-F0-9]{64}\bHex hash by length: 32 = MD5, 40 = SHA-1, 64 = SHA-256. Swap the {n} to target one.\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}:\d{2}ISO-8601 timestamp; add (?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})? to also catch fractional seconds and the timezone offset.Want to run these against something real? The toolkit covers DNS, TLS, HTTP headers and email authentication live, and the learning modules explain what the values mean.