offensive-one-liners

_{Jean Miélot at his desk. Public domain.}

A notebook of 110 offensive security one-liners for authorized testing, CTFs, bug bounty, and lab research. Organized into one markdown notebook with 12 sections. Each entry is a full command or tight pipeline, not a stub.

See offensive-one-liners.md for the full notebook.

The problem this solves

Most one-liner lists are a pile of stock nmap and rockyou commands that stop at the table stakes. This notebook is the opposite: real attack chains, modern tooling, and operators that do useful work past the obvious path. One file, copy-paste ready, organized so you can find the right command under time pressure.

What is here

Quick start

git clone [email protected]:WattoCyber/offensive-one-liners.git
cd offensive-one-liners
# open the notebook, jump to a section
less offensive-one-liners.md
# or grep for a tool you already have
grep -n "kerbrute" offensive-one-liners.md

No install. Everything is copy-paste into your target box. Placeholders (TGT, LHOST, LPORT, DOMAIN, USER, PASS) are documented in the notebook; [win] lines run in PowerShell/cmd, the rest assume Kali with common tooling.

Sample entries (from the notebook)

# 1. Host discovery via ARP (works when ICMP is filtered)
nmap -sn --script dns-brute TGT/24 | grep -E "report|dns-brute"

# 2. Kerbrute password spray against valid users, low-and-slow
kerbrute password -d DOMAIN.local users.txt passwords.txt -t 8 --dc TGT

# 3. SNMP community brute that dumps the running-config wart (Cisco)
for c in public private cisco com munity; do snmpwalk -v2c -c $c TGT 1.3.6.1.4.1.9.9.96.1.1 2>/dev/null && echo "SNMP OK: $c"; done

Scope

These one-liners are for systems you own, explicitly authorized systems, CTF/benchmark targets, and lab environments. Nothing here grants authorization. Review target scope before running.