Command Line Kung Fu Commands Cheat Sheet by karaliking

C:\> netsh firewall show portop­ening

show all ports allowed

C:\> netsh firewall show config

show all config options

C:\> netsh firewall show allowedprogram

show all programs allowed

# for type in nat mangle filter raw; do iptables -t $type -nL; done

list all iptables rules in all chains

C:\> for /r c:\ %i in (*) do @echo %~zi, %i

output to csv and sort in spreadsheet 

# du | sort -nr | head -100

show top 100 largest directories in descending order

# find / -type f -exec wc -c {} \; | sort -nr | head -100

show top 100 largest files in descending order

C:\> FOR /L %i in (1,1,255) do @ping -n 1 -w 100 10.10.1­0.%i | find "­Rep­ly"

# for i in `seq 1 255`; do ping -c 1 -w 1 10.10.1­0.$i | tr \\n ' ' | awk '/1 received/ {print $2}'; done

C:\> netstat -s

all protocols

# netstat -s

all protocols

C:\> netstat -s -p tcp

all tcp

# netstat -s | awk '/:/ { p = $1 }; (p ~ /^[Tt]cp/) { print }'

all tcp (works for OS X too)

C:\> findstr /s /d:<dir>s /m <string> *.<filetype>

dir=absolute|relative, filetype=file extension

# find <dir> -type f -exec grep -l <string> {} +

more flexible, allows for multiple -exec predicates

# grep -irl <string> <dir>

slow for larger searches, easy to remember

C:\> findstr /s /m <st­rin­g> <di­r>*­<fi­let­ype>

altern­ative format

# find <di­r> -type f -print0 | xargs -0 grep -l <st­rin­g>

altern­ative safer command (except on Solaris =P)

Additional Research Links

xargs vs exec uses

 & 

xargs vs exec efficiency

PS C:\> sls spammer@example.com -list -path qf* | rm -path {$_.Path -replace "\\qf","\[qd]f"}

Note, this is PowerShell

C:\> cmd.exe /v:on /c "for /f %i in ('findstr /m spammer@example.com qf*') do @set stuff=%i & del qf!stuff:2! & del df!stuff:2!"

# grep -l spammer@example.com qf* | cut -c3- | xargs -I {} rm qf{} df{}

C:\> doskey /history

up to 50 commands stored by default

# CTRL+r

find & run cmd containing string (ENTER | CTRL+g)

# !<string>:p

only display cmd, then !! to run

# !!

run previous cmd 

# <cmd> !$

run a cmd with last argument of prev cmd (ALT+. also works)

# <cmd> !*

run a cmd with all arguments of prev cmd

# ^foo^bar

run prev cmd replacing 1st instance of foo with bar

# ^<string>

run prev cmd removing 1st instance of string

C:\> F7

bring up prompt with history

# CTRL+p

CTRL+n

previous or next command in history (up & down)

# !<string>

run last cmd that starts with string

# !-<#>

run # previous cmd

# <cmd> !-<#>$

run a cmd with last argument of # prev cmd

# <cmd> !-<#>*

run a cmd with all arguments of # prev cmd

# !:gs/foo/bar/

run prev cmd replacing all instances of foo with bar

C:\> cscript c:\windows\system32\eventquery.vbs /L security /FI "id eq 642"

using “audit account management” event log (XP & 03)

C:\> wevtutil qe security /f:text "/q:*[System[(EventID=4720)]]" | more

using “audit account management” event log (Vista+)

# grep <user> /var/log/secure* | tail

limited history  (may be in /var/log/auth.log)

C:\> for /F %i in (names.txt) do @echo %i & nslookup -norecurse %i [DNSserver] | find "answer" & echo.

names.txt contains names to check, DNSserver is optional chosen DNS server

# for i in `cat names.txt`; do host -r $i [nameserver]; done

names.txt contains names to check, DNSserver is optional chosen DNS server

# rndc dumpdb -cache

if you are the server

# lsof -a -c named -d cwd

find the current working directory of the named process

C:\> type nul > my_file

# cat /dev/null > my_file

C:\> copy nul my_file

shorter command

# cp /dev/null my_file

shorter command