Security CLI Manual & Cheat Sheet

Performs a TCP SYN stealth scan without completing full 3-way handshakes, skipping ICMP ping probe (-Pn).

nmap -sS -Pn -T4 target.com

Probes all 65,535 TCP ports to determine service versions, daemon banners, and operating system fingerprints.

nmap -sV -O -p- -T4 target.com

Scans the top 100 most frequently used internet ports and displays only actively open services.

nmap --top-ports 100 -sV --open target.com

Runs standard Nmap Scripting Engine (NSE) vulnerability detection scripts against open service banners.

nmap -sV --script vuln -p 80,443,22 target.com

Audits supported TLS protocol versions (TLS 1.0, 1.1, 1.2, 1.3) and grades cipher suite strength.

nmap --script ssl-enum-ciphers -p 443 target.com

Audits exposed UDP ports commonly targeted for DDoS amplification attacks (DNS, NTP, SNMP).

nmap -sU -p 53,123,161 -T4 target.com

Performs ICMP echo and ARP requests across an entire subnet to find active IP addresses without port scanning.

nmap -sn 192.168.1.0/24

Quickly tests TCP socket reachability and connection timeouts across multiple ports using Netcat.

nc -zv -w 3 target.com 22 80 443

Initiates a full TLS handshake with Server Name Indication (SNI) to view the server certificate chain.

openssl s_client -connect target.com:443 -servername target.com

Extracts and prints the exact NotBefore and NotAfter validity dates of a live website in 1 command.

echo | openssl s_client -servername target.com -connect target.com:443 2>/dev/null | openssl x509 -noout -dates

Extracts human-readable Subject, Issuer, Validity window, SANs, and Public Key modulus from a PEM file.

openssl x509 -in cert.pem -text -noout

Generates a cryptographically strong 4096-bit RSA private key using PKCS#8 format.

openssl genpkey -algorithm RSA -out server.key -pkeyopt rsa_keygen_bits:4096

Generates a high-performance modern Elliptic Curve (ECDSA P-256) private key and Certificate Signing Request.

openssl req -new -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 -nodes -keyout ecc.key -out ecc.csr -subj '/CN=example.com/O=MyOrg/C=US'

Verifies the cryptographic signature chain of a certificate against trusted Root CA certificates.

openssl verify -CAfile ca-bundle.crt cert.pem

Queries all available DNS resource records (A, AAAA, MX, TXT, NS, SOA) cleanly formatted.

dig target.com ANY +noall +answer

Traces the full hierarchical resolution path from IANA Root DNS servers down to the authoritative TLD server.

dig target.com +trace

Resolves the registered reverse DNS hostname for an IPv4 or IPv6 address.

dig -x 1.1.1.1 +short

Captures and inspects live TCP packet headers for incoming and outgoing web traffic.

tcpdump -i eth0 -nn -s0 -v 'tcp port 80 or tcp port 443'

Captures exactly 500 packets targeting a specific host and writes them into a `.pcap` file for Wireshark inspection.

tcpdump -i any -c 500 -nn 'host 10.0.0.1 and port 443' -w capture.pcap

Measures millisecond breakdown of DNS resolution, TCP connection, TLS handshake, and Time-To-First-Byte (TTFB).

curl -w "DNS: %{time_namelookup}s | Connect: %{time_connect}s | TLS: %{time_appconnect}s | TTFB: %{time_starttransfer}s | Total: %{time_total}s\n" -o /dev/null -s https://target.com

Sends an HTTP HEAD request and follows redirects to inspect CSP, HSTS, and X-Frame-Options headers.

curl -I -L https://target.com

Audits whether the backend server reflects untrusted Origins in `Access-Control-Allow-Origin`.

curl -I -H 'Origin: https://unauthorized-domain.com' https://api.target.com/user/profile

Scans for outdated server software, dangerous default files, and insecure HTTP methods (PUT, TRACE).

nikto -h https://target.com -ssl -Tuning 123b

Defines modern NIST digital identity guidelines focusing on passphrase length and breach checking over arbitrary composition rules.

# NIST SP 800-63B Compliance Checklist:
1. Minimum length >= 8 characters (14+ recommended for admins)
2. Allow up to 64+ characters (never truncate passwords)
3. Check against known breach databases (HaveIBeenPwned / common dicts)
4. No periodic forced password resets without evidence of compromise
5. Implement Multi-Factor Authentication (MFA / FIDO2 WebAuthn)

Implements Argon2id, the state-of-the-art Password Hashing Competition winner designed to resist GPU/ASIC attacks via memory-hardness.

python3 -c "import base64, os; print('Argon2id Params: time_cost=3, memory_cost=64MB, parallelism=4')"

Demonstrates defensive password hashing generation with adaptive work factor (Cost 12) using bcrypt / Argon2id.

python3 -c "import bcrypt; print('Bcrypt Salt & Cost 12:', bcrypt.gensalt(12).decode())"

Generates standard RFC 6238 160-bit Base32 secret keys for Authenticator apps (Google Authenticator, Bitwarden, YubiKey).

python3 -c "import secrets, base64; print('TOTP Base32 Secret:', base64.b32encode(secrets.token_bytes(20)).decode())"

Defends authentication routes against automated brute-force attacks by capping requests to 5 per minute per IP.

# Nginx Rate Limiting Directive:
limit_req_zone $binary_remote_addr zone=login_limit:10m rate=5r/m;
limit_req zone=login_limit burst=5 nodelay;

Inspects currently banned IP addresses and failed authentication attempts recorded by Fail2ban.

fail2ban-client status sshd

Modern replacement for netstat: lists all active listening TCP and UDP sockets with owning process names and PIDs.

ss -tulpn

Lists all open TCP listening network files, associated user accounts, and executable paths.

lsof -iTCP -sTCP:LISTEN -P -n

Establishes a hardened baseline firewall rule: drops all incoming traffic except explicit SSH, HTTP, and HTTPS ports.

ufw default deny incoming && ufw default allow outgoing && ufw allow 22/tcp && ufw allow 80/tcp && ufw allow 443/tcp && ufw enable

Configures Linux Pluggable Authentication Modules (PAM) to enforce NIST-compliant 14+ character password complexity.

cat << 'EOF' >> /etc/security/pwquality.conf
minlen = 14
dcredit = -1
ucredit = -1
ocredit = -1
lcredit = -1
maxrepeat = 2
EOF