Input from .zsh_history#2
Conversation
I've sort -u and awk '!seen[$1]++' my .zsh_history to deconflict against the current "_command" in adding (29) more commands, but most notably most of the nxc services and rounding out impacket with a few more services and increasing john-data's common options.
|
Hey there! First off thank you for this PR, that's a big batch of genuinely useful commands. The hydra/medusa brute set, john, kerbrute (I personally don't use it anymore cause I have my own enum scripts, I advise you to check them out) ..etc are all great to have. Really appreciate it. A few things I'd like to sort out before merging:
The convention here is one file per tool, named after the tool. The cheatsheet renders the different uses as tabs inside a single command card, using the variants: list. So instead of splitting nxc into nxc-ftp.md, nxc-ldap.md, nxc-mssql.md ...etc , all of those should fold into the existing nxc.md as variants. That way the tabs above the card work correctly and you don't end up with the same nxc commands showing up twice. Same idea applies anywhere a tool got split out.
Every command that can authenticate with a hash needs the have: metadata, that's what powers the "filter by the credential material I actually have" feature. A few of these lost it:
Please add have: [hash] (or [hash, ticket, cert] where relevant) back to anything with a hash/ticket/cert auth path, matching how the existing impacket/smbclient/xfreerdp files do it.
The repo uses label: hash for pass-the-hash variants everywhere (impacket-psexec, smbclient, xfreerdp, etc.). A few of the new ones use label: pth. Let's keep it as hash so it stays consistent across the whole sheet (hash is better than pth for UI).
The rewrite dropped the Kerberos ticket (-k) and cert (-c/-k -S) variants. The new scripts upload variant is a nice add, but please keep the ticket and cert ones too since this sheet leans heavily on AD.
Finally, could you run back through CONTRIBUTING.md and check the boxes in the PR checklist? The "Variants" section there covers the one-file-per-tool rule (it actually uses nxc-by-protocol and evil-winrm-by-auth-method as the examples, so it lines up exactly with points 1 and 4), and the checklist's build/test steps (bundle exec jekyll build and node --test test/) will probably catch anything that doesn't render. Thanks again for putting this together, it's a great contribution and I'd love to get it merged once these are tidied up. |
|
Are you finished or do you need help? |
|
Life's got the better of me. Thank you for working those over and the feedback. I'll start working on O-Z and any new A-N's that I have got since then. |
## Review fixes
- Folded `nxc-{ftp,ldap,mssql,rdp,ssh,winrm}.md` into `nxc.md` as protocol variants so the tabs work and commands do not appear twice
- Restored `have:` on `evil-winrm.md` (`[hash, ticket, cert]`) and added it to every command with a credential auth path
- Kept the `hash` label convention; no `pth` labels remain
- Restored the evil-winrm `ticket` and `cert` variants, kept the new `scripts` variant
- Quoted registry paths in `impacket-reg.md` so the shell stops eating the backslashes
- nxc mssql now enables `xp_cmdshell` via `sp_configure` before the `-x` line
## CONTRIBUTING.md
- Documented `have:` in the field reference, the allowed values, and the `_data/` list; it was missing from all three, which is how it got dropped in the first place
- Changed the variants example from `label: pth` to `label: hash` and gave it a `have:` value, so the doc matches the convention it asks for
- Added the seven new service values to the allowed list
## Schema
- Added `FTP`, `NFS`, `SMTP`, `IMAP`, `POP3`, `Oracle`, `PostgreSQL` to `_data/service.yml`; several were already in use but never declared
- Removed the stray top-level `command:` from `autorecon.md`, which also set `variants:`
- Folded `impacket-smbclient.md` and `certipy-auth.md` into `smbclient.md` and `certipy.md`, same split-out issue as nxc
## Expansion
- 30 new tools, one file each, covering pivoting, AD attack paths, database and SNMP enumeration, and cracking support
- Added an `unshadow` variant to `john-extractors.md`
- Scoped `proxychains.md` to the SOCKS config and the no-raw-sockets nmap constraint, rather than repeating other tools' commands behind a prefix
- 106 command files to 128
## Verification
- `bundle exec jekyll build` succeeds
- `node --test test/*.test.mjs` passes 9/9
- Every `have:` value checked in both directions: present where a command can use that material, absent where it cannot
- Lab-specific hosts and credentials from source history replaced with `$UPPERCASE` tokens or generics
|
I'm now in the weeds working your feedback and I completely agree with #1. Thank you on #4 and I wasn't understanding the functionality. Great feedback on #5. Thank you for the troubleshooting in the final paragraph. I think we share #2 & #3 between us as they boil down to inconsistency in the CONTRIBUTE.md:
I've included those two recommendations in my PR; however, I don't know all the nuances, so I recommend reviewing/updating it with any other fields that are missing, but integrated in _commands to aid for future contributers. |
l3clelVl
left a comment
l3clelVl
left a comment
There was a problem hiding this comment.
- Expanded a curated pentest command reference by 49 tool entries (79 -> 128, +62%) and 192 executable commands, covering AD attack paths, pivoting, database and SNMP enumeration, and credential recovery; all entries sanitized of lab-specific hosts and credentials and parameterized into typed input tokens.
- Consolidated 8 fragmented tool files into 4 multi-variant entries, eliminating duplicate commands and restoring the site's protocol- and auth-method tab navigation.
- Restored and enforced the "have:" credential-material metadata that drives the site's
filter by creds heldfeature, and fixed 3 schema-documentation gaps in CONTRIBUTING.md that were the root cause of dropping the field. - Caught 4 pre-existing issues in original repo by validating the 128 for taxonomy conformance, duplicate detection, and bidirectional credential-metadata accuracy.
- Debugged and fixed shell-quoting defects causing silent backslash stripping in Windows registry paths, and corrected an incomplete MSSQL xp_cmdshell exploitation chain.
2 participants
I've sort -u and awk '!seen[$1]++' my .zsh_history to deconflict against the current "_command" in adding (29) more commands, but most notably most of the nxc services and rounding out impacket with a few more services and increasing john-data's common options.
What this does
Type
New command(s)
autorecon
certipy-auth
cEWL
chisel
curl
dig
dnsenum
enum4linux
evil-winrm* (I see there is a conflict, so I'll do a draft)
ffuf
fierce
finalrecon
ftp
gobuster
hydra
impacket-reg
impacket-smbclient
john-data [expand on current john/bcrypt e.g., bitlocker2john, office2john, etc.]
kerbrute
medusa
nbtscan
nfs-cat
nikto
nxc [expand on current smb e.g., nxc ldap, nxc winrm, etc.]
Fix to an existing command
Site feature / bug fix
Docs
Checklist
_commands/following the schema in CONTRIBUTING.md$UPPERCASEtokens; fixed paths are written out in fullservice/phase/os/categoryvalue was added to_data/bundle exec jekyll buildsucceedsnode --test test/passes (requires Node 18+)