← ReflexSec
Linux
Every command ReflexSec uses, with the explanation behind the call. No timer — read at your own pace.
AllFile SystemNetworkingPrivilege EscalationPersistenceCredential AccessData ExfiltrationProcess ExecutionShellContainersCloudGit / DevelopmentLinuxmacOSWindowsPowerShellPythonJavaScript / NodeDockerKubernetesCI/CDWeb Security
- Safe
ls -la /var/logIntermediate - Safe
sudo systemctl restart nginxIntermediate - Safe
sudo dmesg | tail -20Intermediate - Safe
df -hIntermediate - Safe
sudo apt updateIntermediate - Safe
sudo journalctl -u ssh --since "1 hour ago"Advanced - Safe
sudo systemctl status fail2banAdvanced - Safe
sudo -u postgres psql -c "SELECT count(*) FROM users;"Nightmare - Safe
curl -fsSL https://example.com/keys.gpg | sudo gpg --dearmor -o /usr/share/keyrings/example.gpgNightmare - Dangerous
sudo setenforce 0ProAdvanced - Safe
sudo journalctl -u api.service --since "1 hour ago" | tail -n 100ProAdvanced - Safe
sed -n '1,50p' /var/log/app/error.logProAdvanced - Safe
awk -F: '$3 >= 1000 {print $1}' /etc/passwdProAdvanced - Safe
apt-get install --no-install-recommends nginxProIntermediate - Safe
chown -R app:app /srv/app/dataProIntermediate - Safe
chown --from=root app /srv/app/run/app.sockProNightmare - Safe
Get-Content /etc/passwd | Select-String -Pattern '/bin/bash'ProAdvanced - Safe
kubectl exec api-0 -- cat /etc/passwdProIntermediate - Dangerous
systemctl stop clamav-daemonProIntermediate - Dangerous
sudo rebootProIntermediate - Dangerous
sudo shutdown -h nowProAdvanced - Dangerous
sudo systemctl stop auditdProAdvanced - Safe
sudo journalctl --since '2026-09-07 22:00' --until now > /evidence/ir-2026-004/journal.txtProExpert - Safe
cat /etc/hostnameBeginner - Safe
tail -n 100 /var/log/nginx/access.logBeginner - Safe
free -hBeginner - Safe
uptimeBeginner - Safe
uname -srmBeginner - Safe
date -u +%Y-%m-%dT%H:%M:%SZBeginner - Safe
whoamiBeginner - Safe
systemctl status sshdBeginner - Safe
journalctl -u nginx -n 50Beginner - Safe
df -iBeginner - Safe
sudo apt-get updateBeginner - Safe
sudo dmesg -T | tail -n 40Beginner - Dangerous
sudo userdel -r deployBeginner - Dangerous
rm /etc/nginx/nginx.confBeginner - Dangerous
mv /etc/nginx/nginx.conf /tmp/Beginner