Skip to content
📋 Quick Reference

Cybersecurity Commands Cheat Sheet

100+ essential commands for Nmap, dig, openssl, curl, hashcat, tshark, and more — all on one page.

🔍 Reconnaissance & DNS🗺️ Nmap Port Scanning🌐 Web Security🔒 SSL/TLS🔌 Network & Firewall# Hash & Crypto🔓 Password Cracking📡 Packet Analysis (tshark)

🔍 Reconnaissance & DNS

CommandDescription
dig A example.com +shortIPv4 address
dig AAAA example.com +shortIPv6 address
dig MX example.comMail servers
dig TXT example.comTXT records (SPF, DKIM)
dig NS example.com +shortName servers
dig CAA example.comAllowed certificate authorities
dig +trace example.comTrace full resolution path
dig -x 8.8.8.8 +shortReverse DNS lookup
dig AXFR example.com @ns1.example.comZone transfer test (should fail)
nslookup -type=MX example.comMX lookup (nslookup)
host -t TXT example.comTXT records (host)
whois example.comDomain registration info
whois 8.8.8.8IP owner/ASN info
curl -s "https://crt.sh/?q=%25.example.com&output=json" | jq '.[].name_value'Certificate transparency (subdomains)
curl -s "https://api.hackertarget.com/hostsearch?q=example.com"Subdomain enumeration (HackerTarget)

🗺️ Nmap Port Scanning

CommandDescription
nmap -sn 192.168.1.0/24Ping sweep — find live hosts
nmap 192.168.1.1Scan top 1000 ports
nmap -p- 192.168.1.1Scan ALL 65535 ports
nmap -p 22,80,443 192.168.1.1Scan specific ports
nmap -sV 192.168.1.1Service version detection
nmap -O 192.168.1.1OS detection
nmap -A 192.168.1.1Aggressive (OS+version+scripts+traceroute)
nmap -sU -p 53,123,161 192.168.1.1UDP port scan
nmap -sS 192.168.1.1Stealth SYN scan (root required)
nmap -Pn 192.168.1.1Skip ping (assume host is up)
nmap -T4 192.168.1.1Fast timing (aggressive)
nmap --script vuln 192.168.1.1Vulnerability scripts
nmap --script smb-vuln-ms17-010 -p 445EternalBlue check
nmap -oA scan-results 192.168.1.1Save in all formats
nmap -iL targets.txtScan from file

🌐 Web Security

CommandDescription
curl -sI https://example.comCheck HTTP response headers
curl -sI https://example.com | grep -iE "strict-transport|content-security|x-frame"Security headers check
curl -s https://example.com/.git/HEADCheck for exposed .git
curl -s https://example.com/robots.txtView robots.txt
curl -sI -H "Origin: https://evil.com" https://example.com/apiCORS misconfiguration test
curl -s -X OPTIONS -I https://example.comCheck allowed HTTP methods
curl -s https://example.com | grep -i "iframe\|eval("Check for injected scripts
curl -s https://example.com | grep -oP 'src="http://[^"]*"'Find mixed content
nikto -h https://example.comWeb vulnerability scanner
gobuster dir -u http://target.com -w /usr/share/wordlists/dirb/common.txtDirectory brute force

🔒 SSL/TLS

CommandDescription
openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -text -nooutView full certificate
openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -issuer -dates -nooutIssuer and expiry
echo | openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -checkend 0Check if cert is expired
openssl s_client -connect example.com:443 -tls1_2 2>&1 | grep "Cipher"TLS 1.2 cipher used
openssl s_client -connect example.com:443 -tls1 2>&1 | grep "CONNECTED"Test if TLS 1.0 is accepted (bad)
openssl req -new -newkey rsa:2048 -nodes -keyout server.key -out server.csrGenerate CSR
openssl x509 -in cert.pem -text -nooutView certificate file

🔌 Network & Firewall

CommandDescription
netstat -tulnListening TCP/UDP ports
ss -tulnListening ports (faster, modern)
ss -tulnpListening ports + process names (root)
netstat -anp | grep ESTABLISHEDActive connections
lsof -i -P | grep LISTENListening ports with processes (macOS)
iptables -L -n -vView firewall rules
traceroute example.comTrace network path
mtr example.comContinuous traceroute
arp -aView ARP table (connected devices)
ip route showShow routing table
tcpdump -i eth0 -n port 80Capture HTTP traffic
tcpdump -i eth0 -w capture.pcapSave to pcap file

# Hash & Crypto

CommandDescription
echo -n "password" | md5sumMD5 hash
echo -n "password" | sha1sumSHA-1 hash
echo -n "password" | sha256sumSHA-256 hash
echo -n "password" | sha512sumSHA-512 hash
md5sum file.txtHash a file (integrity check)
sha256sum file.txt > file.sha256 && sha256sum -c file.sha256Verify file integrity
strings suspicious.bin | grep -iE "http|cmd|bash|exec"Strings in binary
file suspicious.binIdentify file type
base64 -e <<< "hello world"Base64 encode
echo "aGVsbG8gd29ybGQ=" | base64 -dBase64 decode

🔓 Password Cracking

CommandDescription
hashcat -m 0 -a 0 hash.txt rockyou.txtMD5 dictionary attack
hashcat -m 1400 -a 0 hash.txt rockyou.txtSHA-256 dictionary attack
hashcat -m 1800 -a 0 hash.txt rockyou.txtbcrypt dictionary attack
hashcat -m 22000 hash.hc22000 rockyou.txtWPA2 cracking
hashcat -m 0 -a 3 hash.txt ?a?a?a?a?a?aBrute force 6-char all
hashcat --show hash.txtShow cracked passwords
hashcat -bBenchmark GPU speed
john --wordlist=rockyou.txt hash.txtJohn dictionary attack
john --show hash.txtShow cracked (John)
hydra -L users.txt -P pass.txt ssh://192.168.1.1SSH brute force (authorised only)

📡 Packet Analysis (tshark)

CommandDescription
tshark -i eth0 -c 100Capture 100 packets
tshark -i eth0 -f "port 53"Capture DNS only
tshark -i eth0 -w capture.pcapSave to pcap file
tshark -r capture.pcap -Y "dns"Read pcap, filter DNS
tshark -r capture.pcap -Y "http.request" -T fields -e http.request.uriExtract HTTP request URIs
tshark -r capture.pcap -Y "dns" -T fields -e dns.qry.nameExtract DNS queries

📚 Go Deeper

Nmap Tutorial – 50+ Commands →Wireshark – 30 Exercises →SQL Injection from A to Z →Password Cracking Guide →