M4cCrypt0
back to overview

Cheatsheet: shell commands

2026-06-30 foundation

Quick reference per shell: cmd.exe, PowerShell, and Linux/Unix (bash/zsh). Grouped by task so you can see the Windows and Unix equivalent side by side. See also the tool cheatsheet for Nmap/Burp/Hashcat etc.

cmd.exe 
dir /a              # directory contents, incl. hidden files
cd ..\folder        # change directory
copy a.txt b.txt    # copy
del file.txt        # delete
type file.txt       # show contents
PowerShell 
Get-ChildItem -Force      # alias: gci / ls / dir
Set-Location ..\folder    # alias: cd
Copy-Item a.txt b.txt     # alias: cp / copy
Remove-Item file.txt      # alias: rm / del
Get-Content file.txt      # alias: cat / gc / type
Linux / Unix 
ls -la              # list, incl. hidden + details
cd ../folder        # change directory
cp a.txt b.txt      # copy
rm file.txt         # delete (-r for directories, -f forces)
cat file.txt        # show contents

Searching & filtering text

cmd.exe 
findstr /si "password" *.txt      # case-insensitive, recursive into subfolders
dir /s /b *.config                # find files by name
PowerShell 
Select-String -Path *.txt -Pattern "password"
Get-ChildItem -Recurse -Filter *.config
$_ | Where-Object { $_.Name -match "regex" }
Linux / Unix 
grep -ri "password" .             # recursive, case-insensitive
find . -name "*.config"           # files by name
find . -mtime -1 -type f          # changed in the last 24h

Processes & services

cmd.exe 
tasklist                   # running processes
taskkill /PID 1234 /F      # force-kill a process
sc query servicename       # service status
PowerShell 
Get-Process                           # alias: ps
Stop-Process -Id 1234 -Force          # alias: kill
Get-Service servicename
Get-Process | Sort CPU -Descending | Select -First 10
Linux / Unix 
ps aux                     # all processes
top / htop                 # live overview
kill -9 1234               # force-kill a process
systemctl status servicename

Network

cmd.exe 
ipconfig /all              # interfaces + IPs
netstat -ano               # open connections + PID
nslookup example.com       # DNS lookup
tracert example.com        # trace the route
PowerShell 
Get-NetIPAddress
Get-NetTCPConnection | Where State -eq Listen
Resolve-DnsName example.com
Test-NetConnection example.com -Port 443
Linux / Unix 
ip a                       # interfaces + IPs (replaces ifconfig)
ss -tulpn                  # listening ports + process
dig example.com            # or: nslookup example.com
traceroute example.com

Permissions & users

cmd.exe 
whoami /priv               # current user + privileges
net user                   # local users
icacls file.txt            # view ACLs
PowerShell 
whoami /all
Get-LocalUser
Get-Acl file.txt | Format-List
Linux / Unix 
whoami / id                # user + groups
chmod 750 script.sh        # rwx for owner/group/other
chown user:group file      # change owner
sudo -l                    # which sudo rights the current user has
[ TIP ]

PowerShell cmdlets are Verb-Noun and (almost) always ship built-in aliases toward the Unix equivalents (ls, cat, ps, kill) — handy as a mnemonic, but they sometimes behave a little differently from the real Unix tool (e.g. ls in PowerShell has no -la flags).

[WARN]

On a hardened Windows host, PowerShell can be restricted via Constrained Language Mode or AppLocker — checking $ExecutionContext.SessionState.LanguageMode shows whether you have full PowerShell or not.