← ReflexSec
File System
Every command ReflexSec uses, with the explanation behind the call. No timer — read at your own pace.
AllFile SystemNetworkingPrivilege EscalationPersistenceCredential AccessData ExfiltrationProcess ExecutionShellContainersCloudGit / DevelopmentLinuxmacOSWindowsPowerShellPythonJavaScript / NodeDockerKubernetesCI/CDWeb Security
- Safe
rm ./build/output.logIntermediate - Safe
chmod +x ./scripts/deploy.shIntermediate - Dangerous
sudo rm -rf / --no-preserve-rootIntermediate - Dangerous
sudo rm -rf /var/lib/mysqlIntermediate - Dangerous
mkfs.ext4 /dev/sda1Intermediate - Dangerous
dd if=/dev/zero of=/dev/sda bs=1MIntermediate - Dangerous
DROP DATABASE production;Intermediate - Dangerous
chown -R nobody:nogroup /homeIntermediate - Safe
tar -czf backup.tar.gz ./dataAdvanced - Dangerous
sudo dd if=/dev/urandom of=/dev/sdb bs=4M status=progressAdvanced - Safe
base64 -d ./cert.b64 > ./cert.derAdvanced - Safe
rsync -avn ./src/ ./backup/Expert - Safe
sudo chown -R "$USER":"$USER" ./projectAdvanced - Safe
chmod -R go-w ./releaseExpert - Safe
dd if=./ubuntu.iso of=/dev/null bs=4M status=progressExpert - Safe
rsync -avz --delete --dry-run ./site/ deploy@example.com:/var/www/site/Nightmare - Safe
tar -tzf ./release.tar.gz | head -50Nightmare - Dangerous
rsync -avz --delete ./site/ deploy@example.com:/var/www/site/Nightmare - Dangerous
curl -sL https://example.com/patch.tgz | tar -xz -C / --strip-components=1Nightmare - Dangerous
chmod -R 777 ./storage/uploadsProIntermediate - Safe
rm -rf ./dist ./coverage && npm run buildProIntermediate - Dangerous
jq '.' config.json > config.jsonProIntermediate - Dangerous
jq -r '.artifacts[] | .path' build.json | xargs rm -fProAdvanced - Safe
jq -r '.files[] | select(.stale) | .path' index.json | tr '\n' '\0' | xargs -0 rm -fProExpert - Safe
tar -czf backup.tar.gz ./projectProIntermediate - Safe
tar -tzf release.tar.gzProAdvanced - Dangerous
tar --overwrite -xf patch.tar -C /opt/appProIntermediate - Dangerous
tar -xzf release.tar.gz -P -C /ProAdvanced - Safe
tar -xzf release.tar.gz -C ./unpacked --no-same-owner && rm release.tar.gzProAdvanced - Safe
find /var/log -name '*.log' -mtime +30 -printProIntermediate - Dangerous
find / -name '*.bak' -mtime +7 -deleteProIntermediate - Safe
find ./build -maxdepth 2 -name '*.tmp' -exec rm -f {} +ProExpert - Dangerous
find /srv/uploads -type f -exec chmod 777 {} +ProAdvanced - Dangerous
rsync -av --delete ./dist/ deploy@web.example.com:/var/www/ProIntermediate - Safe
unzip -l theme.zipProAdvanced - Safe
zip -r backup.zip ./docs -x '*.env'ProAdvanced - Safe
$lines = Get-Content .\app.log -Tail 200; [array]::Reverse($lines); $lines | Select-Object -First 20ProAdvanced - Dangerous
Get-ChildItem $env:TEMP -Recurse | Unblock-FileProAdvanced - Safe
Unblock-File .\Q3-report.xlsxProExpert - Dangerous
Invoke-Command -ComputerName (Get-Content .\all-servers.txt) -ScriptBlock { Remove-Item C:\Logs\* -Recurse -Force }ProNightmare - Dangerous
kubectl exec -it postgres-0 -- rm -rf /var/lib/postgresql/data/pg_walProExpert - Safe
file ./sample-8f2a.binProIntermediate - Safe
sha256sum ./sample-8f2a.binProIntermediate - Safe
chmod -x ./sample-8f2a.binProIntermediate - Safe
strings -n 8 ./sample-8f2a.bin | head -50ProAdvanced - Safe
strings ./sample-8f2a.bin | grep -iw reverseProAdvanced - Safe
xxd ./sample-8f2a.bin | head -4ProAdvanced - Safe
base64 -d ./attachment.b64 > ./sample-8f2a.binProAdvanced - Safe
olevba ./invoice.docProExpert - Safe
yara -r ./rules/apt-loaders.yar ./quarantine/ProExpert - Safe
dd if=./usb-image.dd bs=512 count=1 | xxd | head -8ProExpert - Safe
binwalk ./firmware.binProNightmare - Safe
mount -o ro,loop,noexec,nodev ./usb-image.dd /mnt/evidenceProNightmare - Dangerous
tar xzf ./sample.tar.gz -C /ProAdvanced - Dangerous
binwalk -e ./firmware.binProAdvanced - Dangerous
mount -o loop ./usb-image.dd /mnt/evidenceProNightmare - Safe
echo 'RT-2026-014 access confirmed' > /tmp/rt-2026-014-proof.txtProIntermediate - Safe
import -window root ./evidence/dc01-access-2026-09-08.pngProExpert - Dangerous
find /srv -type f -name '*.db' -exec openssl enc -aes-256-cbc -pbkdf2 -k demo -in {} -out {}.enc \;ProNightmare - Safe
base64 -d ./approved-lure.b64 | sha256sumProExpert - Safe
sudo cp -a /var/log /evidence/ir-2026-004/logs/ProIntermediate - Dangerous
sudo tar xzpf /backups/app-2026-09-01.tgz -C /srv/appProAdvanced - Safe
sudo dd if=/dev/sda of=/evidence/ir-2026-004/sda.img bs=4M conv=noerror,syncProAdvanced - Safe
sha256sum /evidence/ir-2026-004/sda.img | tee /evidence/ir-2026-004/sda.img.sha256ProAdvanced - Safe
sudo find / -newermt '2026-09-07 22:00' -type f 2>/dev/null > /evidence/ir-2026-004/changed-files.txtProAdvanced - Dangerous
sudo dd if=/backups/golden.img of=/dev/sda bs=4MProAdvanced - Dangerous
pg_restore -c -d app /backups/app-latest.dumpProAdvanced - Dangerous
shred -u /tmp/.x/implantProAdvanced - Dangerous
sudo find /var/www -name '*.suspected' -deleteProAdvanced - Dangerous
sudo rm -rf /home/intruderProAdvanced - Safe
sudo cp -a /home/intruder /evidence/ir-2026-004/home/ProExpert - Safe
sudo chattr +i /evidence/ir-2026-004/sda.imgProNightmare - Safe
sha256sum -c /evidence/ir-2026-004/sda.img.sha256ProNightmare - Safe
sudo tar --xattrs -czf /evidence/ir-2026-004/triage.tgz /evidence/ir-2026-004/ProNightmare - Dangerous
sudo shred -n1 /dev/sdaProNightmare - Dangerous
find /evidence/ir-2026-004 -type f -exec touch -t 202601010000 {} \;ProNightmare - Safe
ls -lh /var/www/htmlBeginner - Safe
wc -l access.csvBeginner - Safe
du -sh ./node_modulesBeginner - Safe
stat /etc/hostsBeginner - Safe
chmod 600 ~/.ssh/configBeginner - Safe
chmod u+x ./scripts/deploy.shBeginner - Dangerous
rm -rf /var/lib/postgresql/16/mainBeginner - Dangerous
chmod -R 777 /var/wwwBeginner - Dangerous
chown -R nobody:nogroup /etcBeginner - Dangerous
dd if=/dev/urandom of=/dev/nvme0n1 bs=4MBeginner - Dangerous
mkfs.ext4 /dev/sdb1Beginner - Dangerous
rm -rf ~/*Beginner - Dangerous
sudo mount -o remount,rw /Beginner - Dangerous
DROP TABLE users;Beginner - Dangerous
python3 -c "import shutil; shutil.rmtree('/srv/uploads')"Beginner - Dangerous
psql -c "UPDATE users SET email = 'x@example.com';"Beginner