Cheat sheets / Command outputs (know what they look like)
Command outputs (know what they look like)
Sample output of the commands the class starred — nslookup, arp, nbtstat, netstat, route, ping, ipconfig, nmap, grep — with the line to look at in an investigation.
From class ★: "Look into how the output of these commands looks like. Know the output. Create examples." The exam shows you a screenshot-style output and asks what it means or which tool produced it. Learn the shape of each one.
Which command for which question?
| You need to know… | Run | Look at |
|---|---|---|
| This host's IP / gateway / DNS / MAC | ipconfig /all · ip a | Rogue DNS server, wrong gateway, vendor OUI in the MAC |
| Is a host up, what OS is it? | ping | TTL 128 Windows / 64 Linux / 255 network gear; timeouts may just be filtered ICMP |
| Is someone on-path (ARP poisoning)? | arp -a | Two IPs with the same MAC, or the gateway MAC changed |
| Backdoor listener or C2 connection? | netstat -ano · ss -tulpn | Unexpected LISTENING port (4444), ESTABLISHED to unknown external IP, owning PID |
| Is DNS lying (pharming/poisoning)? | nslookup · dig | Which server answered; returned IP vs. a known-good lookup |
| Is traffic being redirected? | route print · ip route · tracert | Default route gateway, strange added routes, unexpected first hop |
| What Windows machine is at this IP? | nbtstat -A <ip> | NetBIOS name and MAC |
| What ports/services does a target expose? | nmap -sS -Pn | open/closed/filtered per port; -sV versions; authorization required |
| Find the needle in a huge log | grep · head · tail · cat | Pattern/regex filter; first/last lines; join files |
| How bad is this syslog line? | severity 0–7 | 0 emergency (worst) … 7 debug (noise) |
red = attack indicators blue = host identity/reachability yellow = enumeration green = log handling
ipconfig /all (Windows) — "what is this host's network identity?"
C:\> ipconfig /all Windows IP Configuration Host Name . . . . . . . . . . . . : WS-FIN-07 Ethernet adapter Ethernet0: Physical Address. . . . . . . . . : 00-0C-29-4A-1B-9E DHCP Enabled. . . . . . . . . . . : Yes IPv4 Address. . . . . . . . . . . : 192.168.50.23(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.255.0 Default Gateway . . . . . . . . . : 192.168.50.1 DHCP Server . . . . . . . . . . . : 192.168.50.1 DNS Servers . . . . . . . . . . . : 192.168.50.10 8.8.8.8
Look at: DNS Servers (an unknown DNS server = pharming/rogue DHCP), Default Gateway, Physical Address (MAC — first 3 bytes are the vendor OUI). Linux equivalent: ip a / ifconfig.
ping — "is it reachable, and what is it?"
C:\> ping 192.168.50.10 Pinging 192.168.50.10 with 32 bytes of data: Reply from 192.168.50.10: bytes=32 time=1ms TTL=128 Reply from 192.168.50.10: bytes=32 time<1ms TTL=128 Request timed out. Reply from 192.168.50.10: bytes=32 time=2ms TTL=128 Ping statistics for 192.168.50.10: Packets: Sent = 4, Received = 3, Lost = 1 (25% loss)
Look at: TTL (≈128 → Windows, ≈64 → Linux/Unix, ≈255 → network gear), loss %, Request timed out (host down, or ICMP filtered — ping being blocked doesn't prove the host is off; use nmap -Pn).
arp -a — "who does this host think the gateway is?"
C:\> arp -a Interface: 192.168.50.23 --- 0x6 Internet Address Physical Address Type 192.168.50.1 00-1a-2b-3c-4d-5e dynamic 192.168.50.10 00-0c-29-77-88-99 dynamic 192.168.50.66 00-0c-29-77-88-99 dynamic 192.168.50.255 ff-ff-ff-ff-ff-ff static
Look at: two IPs with the same MAC, or the gateway's MAC changing → ARP poisoning / on-path attack. ff-ff-ff-ff-ff-ff is just the broadcast entry. Defense: Dynamic ARP Inspection, static ARP for the gateway.
netstat — "what is listening / talking?"
C:\> netstat -ano Proto Local Address Foreign Address State PID TCP 0.0.0.0:135 0.0.0.0:0 LISTENING 912 TCP 0.0.0.0:445 0.0.0.0:0 LISTENING 4 TCP 0.0.0.0:4444 0.0.0.0:0 LISTENING 5120 TCP 192.168.50.23:49712 203.0.113.9:443 ESTABLISHED 5120 TCP 192.168.50.23:49720 192.168.50.10:445 ESTABLISHED 4 UDP 0.0.0.0:161 *:* 1480
Look at: unexpected LISTENING port (4444 is the classic Metasploit/netcat backdoor), an ESTABLISHED connection to an unknown external IP (C2), and the PID so you can find the process (tasklist /fi "pid eq 5120"). Linux: ss -tulpn / netstat -tulpn. -a all, -n numeric, -o owning PID.
nslookup / dig — "is DNS lying to me?"
C:\> nslookup www.bank.com Server: dns.corp.local Address: 192.168.50.10 Non-authoritative answer: Name: www.bank.com Addresses: 198.51.100.7
Look at: Server/Address = which resolver answered (should be yours), the returned IP (compare with a known-good lookup — a mismatch = DNS poisoning / pharming). nslookup -type=MX domain lists mail servers; -type=TXT shows SPF/DMARC. Linux: dig www.bank.com (answer section, ;; SERVER: line).
route print / ip route — "where is traffic being sent?"
C:\> route print IPv4 Route Table Network Destination Netmask Gateway Interface Metric 0.0.0.0 0.0.0.0 192.168.50.1 192.168.50.23 25 192.168.50.0 255.255.255.0 On-link 192.168.50.23 281 10.20.0.0 255.255.0.0 192.168.50.66 192.168.50.23 26
Look at: the 0.0.0.0 default route's gateway (should be your real gateway) and any added route to a strange gateway (traffic redirection / on-path). Linux: ip route / netstat -r.
nbtstat — "which Windows machine is this?"
C:\> nbtstat -A 192.168.50.66 NetBIOS Remote Machine Name Table Name Type Status --------------------------------------------- KALI-BOX <00> UNIQUE Registered WORKGROUP <00> GROUP Registered KALI-BOX <20> UNIQUE Registered MAC Address = 00-0C-29-77-88-99
Look at: the machine name and MAC for an IP — identifies the rogue device you found in the ARP table. <20> = file/print service running.
tracert / traceroute — "which path?"
C:\> tracert 8.8.8.8 1 1 ms 1 ms 1 ms 192.168.50.1 2 9 ms 8 ms 9 ms 10.0.0.1 3 18 ms 17 ms 18 ms 203.0.113.1 4 22 ms 21 ms 22 ms 8.8.8.8
Look at: an unexpected first hop (traffic going through an attacker's box) or a path that suddenly changed.
nmap — "what is open on the target?"
$ nmap -sS -Pn 192.168.50.66 Nmap scan report for 192.168.50.66 PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 445/tcp open microsoft-ds 3389/tcp closed ms-wbt-server
-sS = half-open / SYN scan (never completes the handshake; stealthier), -Pn = skip ping, -sV = service versions, -O = OS guess, -sX = Xmas (FIN/URG/PSH). Class: scanning systems you're not authorized to test can be illegal — rules of engagement first.
head / tail / cat / grep — "find the needle in the log"
$ head -n 3 auth.log # first 3 lines $ tail -n 20 auth.log # last 20 lines (tail -f follows live) $ cat part1.log part2.log > all.log # concatenate / join files $ grep -i "failed password" auth.log | wc -l Sep 18 03:12:07 srv sshd[2210]: Failed password for root from 203.0.113.9 port 51022 ssh2 Sep 18 03:12:09 srv sshd[2210]: Failed password for root from 203.0.113.9 port 51023 ssh2
grep filters lines by pattern or regular expression (-i ignore case, -v invert, -r recursive, -E extended regex). Pipe chains (grep ... | sort | uniq -c | sort -rn) count the top attacking IPs.
Syslog severity — "how bad is this line?"
| Level | Name | Level | Name |
|---|---|---|---|
| 0 | Emergency — system unusable | 4 | Warning |
| 1 | Alert — act now | 5 | Notice |
| 2 | Critical | 6 | Informational |
| 3 | Error | 7 | Debug ★ — least severe, most verbose |
Windows: Event Viewer → Security log (4624 success logon, 4625 failed logon, 4720 user created, 4732 added to admin group, 1102 audit log cleared).