Inspect Response Headers
Review security headers, caching, content type, and server disclosure on an API response.
curl -sS -D - -o /dev/null https://api.example.test/v1/health
Use quick references during a lab or practice session, then save the concepts you repeatedly need into a course path.
Quick Reference · D1 Content
8 categories · 54 commands, loaded from versioned D1 documentation.
API · v1.0.0
A practical reference for reviewing API authentication, authorization, transport, and input validation in authorized environments.
Review security headers, caching, content type, and server disclosure on an API response.
curl -sS -D - -o /dev/null https://api.example.test/v1/health
Check whether protected resources expose different status codes or sensitive fields without authorization.
curl -sS https://api.example.test/v1/account curl -sS -H "Authorization: Bearer $TOKEN" https://api.example.test/v1/account
Reproduce a known-good request against a staging target to validate server-side authorization checks.
curl --request POST https://api.example.test/v1/orders \ --header 'Content-Type: application/json' \ --header "Authorization: Bearer $TOKEN" \ --data @fixtures/order.json
Verify that an untrusted origin is not granted credentialed access to API responses.
curl -sS -D - -o /dev/null \ -H 'Origin: https://untrusted.example' \ https://api.example.test/v1/profile
Confirm that sensitive endpoints publish and enforce an appropriate rate limit in a test environment.
for i in $(seq 1 10); do curl -sS -D - -o /dev/null https://api.example.test/v1/login; done
Blue Team · v1.0.0
Fast defensive checks for logs, firewall policy, and host changes.
Summarize source addresses for failed SSH authentication attempts.
grep "Failed password" /var/log/auth.log | awk '{print $11}' | sort | uniq -c | sort -rnAdd and verify a UFW deny rule for a known malicious address.
ufw deny from 10.0.0.5 to any ufw reload ufw status verbose
Locate files changed in the last day for post-incident review.
find / -mtime -1 -type f -not -path "*/proc/*" 2>/dev/null
Cloud · v1.0.0
Read-only checks for identity inventory, excessive permissions, key age, and audit coverage in cloud environments.
Create an inventory of IAM users before reviewing ownership and access paths.
aws iam list-users --query 'Users[].{UserName:UserName,Created:CreateDate,LastUsed:PasswordLastUsed}' --output tableIdentify keys that should be rotated or replaced with short-lived workload identities.
aws iam list-access-keys --user-name USERNAME --query 'AccessKeyMetadata[].{Id:AccessKeyId,Created:CreateDate,Status:Status}' --output tableInspect directly attached managed policies for an individual user during an access review.
aws iam list-attached-user-policies --user-name USERNAME --output table aws iam list-user-policies --user-name USERNAME --output table
Verify that a trail exists and is actively logging management events.
aws cloudtrail describe-trails --include-shadow-trails --output table aws cloudtrail get-trail-status --name TRAIL_NAME
Check account-level public access block controls before investigating a bucket exposure.
aws s3control get-public-access-block --account-id ACCOUNT_ID
Kubernetes · v1.0.0
Read-only cluster checks for workload identity, exposed services, privileged containers, and admission controls.
Inventory running workloads and container images across namespaces.
kubectl get pods -A -o custom-columns='NAMESPACE:.metadata.namespace,NAME:.metadata.name,IMAGE:.spec.containers[*].image'
Locate containers that run with privileged mode enabled or host namespace access.
kubectl get pods -A -o json | jq -r '.items[] | . as $p | .spec.containers[] | select(.securityContext.privileged == true or .securityContext.allowPrivilegeEscalation == true) | [$p.metadata.namespace,$p.metadata.name,.name] | @tsv'
Find broad cluster-admin bindings that may grant excessive control.
kubectl get clusterrolebindings -o custom-columns='NAME:.metadata.name,ROLE:.roleRef.name,SUBJECTS:.subjects[*].name'
Identify LoadBalancer and NodePort services that create external exposure.
kubectl get svc -A -o wide | awk 'NR==1 || $5 ~ /LoadBalancer|NodePort/'
Confirm that namespaces have intentional ingress and egress controls.
kubectl get networkpolicy -A -o yaml
IR · v1.0.0
Fast, evidence-preserving commands for initial host triage and incident containment.
Record the host, user, kernel, and clock context before collecting evidence.
date -u; hostnamectl; whoami; uname -a
Capture listening services and established connections for triage.
ss -tulpn > /tmp/triage-sockets.txt ss -tp state established >> /tmp/triage-sockets.txt
Preserve a timestamped process listing for later comparison and investigation.
ps auxww --sort=-%cpu > /tmp/triage-processes.txt ps -eo pid,ppid,user,lstart,args >> /tmp/triage-processes.txt
Record cryptographic hashes before moving or quarantining a file.
sha256sum /path/to/suspicious-file | tee /tmp/artifact.sha256 stat /path/to/suspicious-file
Review recent successful and failed logins without altering the original logs.
last -ai | head -50 lastb -ai 2>/dev/null | head -50
Collect triage outputs into a timestamped archive for controlled transfer.
tar --create --file /tmp/triage-$(date -u +%Y%m%dT%H%M%SZ).tar /tmp/triage-*.txt /tmp/artifact.sha256 2>/dev/null
Nmap · v1.0.0
A practical Nmap reference for authorized asset discovery, port enumeration, service identification, validation, and evidence capture.
Record the scanner version before a repeatable assessment or report.
nmap --version
Nmap version 7.x
Identify responsive hosts without performing a port scan. Use only against approved ranges.
nmap -sn -PE -PS80,443 -PA443 192.0.2.0/24
Nmap scan report for 192.0.2.10 Host is upMITRE T1046
Scan targets that are known to be online or that block discovery probes.
nmap -Pn -p 80,443 TARGET
Quickly check the most common TCP ports for initial exposure triage.
nmap --top-ports 100 -T3 TARGET
PORT STATE SERVICE 22/tcp open sshMITRE T1046
Scan a focused port list when validating a known service boundary.
nmap -p 22,80,443,3389 TARGET
Enumerate the full TCP port range during an approved internal assessment.
nmap -p- -T3 --reason TARGET
Use the default half-open TCP SYN technique when operating with suitable privileges.
sudo nmap -sS -p 1-1000 TARGET
Perform a full TCP connect scan when raw packet privileges are unavailable.
nmap -sT -p 1-1000 TARGET
Check common UDP services with an intentionally limited scope because UDP scans are slower.
sudo nmap -sU --top-ports 50 -T2 TARGET
PORT STATE SERVICE 53/udp open|filtered domainMITRE T1046
Validate common UDP services such as DNS, NTP, SNMP, and TFTP.
sudo nmap -sU -p 53,123,161,500,514,1900,4500 TARGET
Identify service products and versions on confirmed open ports.
nmap -sV --version-light -p 22,80,443 TARGET
22/tcp open ssh OpenSSH 9.xMITRE T1046
Combine OS detection, version detection, default scripts, and traceroute for an authorized lab or assessment.
sudo nmap -A -T3 -p 22,80,443 TARGET
Estimate the target operating system using TCP/IP fingerprinting when sufficient evidence is available.
sudo nmap -O --osscan-limit TARGET
Run Nmap's default script set for common service metadata and safe checks.
nmap -sC -sV -p 22,80,443 TARGET
Collect titles, headers, methods, and common web metadata from an authorized web target.
nmap --script http-title,http-headers,http-methods -p 80,443 TARGET
Inspect certificates and supported TLS ciphers for a service under review.
nmap --script ssl-cert,ssl-enum-ciphers -p 443 TARGET
Review SMB protocol support and signing configuration without attempting authentication bypass.
nmap --script smb-protocols,smb2-security-mode -p 445 TARGET
Scan an approved IPv6 target explicitly with the IPv6 flag.
nmap -6 -sV -p 22,80,443 IPV6_TARGET
Run a repeatable scoped scan against targets stored one per line in a file.
nmap -iL approved-targets.txt --top-ports 100 -sV -oA inventory_scan
Write normal, XML, and grepable output for reporting and later parsing.
nmap -sV -p 22,80,443 TARGET -oA evidence/TARGET_web
evidence/TARGET_web.nmap evidence/TARGET_web.xml evidence/TARGET_web.gnmap
Extract open ports from a saved XML result for a repeatable reporting workflow.
xmllint --xpath '//port[state/@state="open"]/@portid' evidence/TARGET_web.xml
Compare two authorized scan outputs to identify newly opened or closed services.
ndiff evidence/baseline.xml evidence/current.xml
- 443/tcp open + 8080/tcp open
Include packet-reason information and host state to avoid treating filtered ports as confirmed exposure.
nmap --reason --open -p- TARGET
Prefer explicit timing and a bounded port list; coordinate scan rate with the asset owner and monitoring team.
nmap -T2 --max-rate 100 --scan-delay 20ms -p 22,80,443 TARGET
Recon · v1.0.0
Host discovery, service enumeration, and initial attack-surface mapping.
Enumerate all TCP ports and identify service versions.
nmap -sV -sC -p- --min-rate 5000 -oA full_scan TARGET
Collect subdomains from passive and active sources.
subfinder -d target.example -all -o subs.txt
Identify exposed frameworks, servers, and technology signatures.
whatweb -a 3 https://target.example
Web Attacks · v1.0.0
Practical SQL injection, XSS, and request tampering references.
Test a login parameter for a tautology-based authentication bypass.
admin' OR '1'='1' -- -
Identify the number of columns accepted by a vulnerable query.
' ORDER BY 1-- - ' ORDER BY 2-- - ' ORDER BY 3-- -
Confirm whether input is reflected into an HTML response.
<img src=x onerror=alert(document.domain)>