How to: UDP -> TCP
nc -l -u -p 2000 -c "nc [ip|hostname] 3000"
```

___

##### Tool: [gnutls-cli](https://gnutls.org/manual/html_node/gnutls_002dcli-Invocation.html)

###### Testing connection to remote host (with SNI support)

```bash
gnutls-cli -p 443 google.com
```

###### Testing connection to remote host (without SNI support)

```bash
gnutls-cli --disable-sni -p 443 google.com
```

___

##### Tool: [socat](http://www.dest-unreach.org/socat/doc/socat.html)

###### Testing remote connection to port

```bash
socat - TCP4:10.240.30.3:22
```

  * `-` - standard input (STDIO)
  * `TCP4:
` - set tcp4 connection with specific params
    * `[hostname|ip]` - set hostname/ip
    * `[1-65535]` - set port number

###### Redirecting TCP-traffic to a UNIX domain socket under Linux

```bash
socat TCP-LISTEN:1234,bind=127.0.0.1,reuseaddr,fork,su=nobody,range=127.0.0.0/8 UNIX-CLIENT:/tmp/foo
```

  * `TCP-LISTEN:
` - set tcp listen with specific params
    * `[1-65535]` - set port number
    * `bind=[hostname|ip]` - set bind hostname/ip
    * `reuseaddr` - allows other sockets to bind to an address
    * `fork` - keeps the parent process attempting to produce more connections
    * `su=nobody` - set user
    * `range=[ip-range]` - ip range
  * `UNIX-CLIENT:
` - communicates with the specified peer socket
    * `filename` - define socket

___

##### Tool: [p0f](http://lcamtuf.coredump.cx/p0f3/)

###### Set iface in promiscuous mode and dump traffic to the log file

```bash
p0f -i enp0s25 -p -d -o /dump/enp0s25.log
```

  * `-i` - listen on the specified interface
  * `-p` - set interface in promiscuous mode
  * `-d` - fork into background
  * `-o` - output file

___

##### Tool: [netstat](https://en.wikipedia.org/wiki/Netstat)

###### Graph # of connections for each hosts

```bash
netstat -an | awk '/ESTABLISHED/ { split($5,ip,":"); if (ip[1] !~ /^$/) print ip[1] }' | \
sort | uniq -c | awk '{ printf("%s\t%s\t",$2,$1) ; for (i = 0; i < $1; i++) {printf("*")}; print "" }'
```

###### Monitor open connections for specific port including listen, count and sort it per IP

```bash
watch "netstat -plan | grep :443 | awk {'print \$5'} | cut -d: -f 1 | sort | uniq -c | sort -nk 1"
```

###### Grab banners from local IPv4 listening ports

```bash
netstat -nlt | grep 'tcp ' | grep -Eo "[1-9][0-9]*" | xargs -I {} sh -c "echo "" | nc -v -n -w1 127.0.0.1 {}"
```

___

##### Tool: [rsync](https://en.wikipedia.org/wiki/Rsync)

###### Rsync remote data as root using sudo

```bash
rsync --rsync-path 'sudo rsync' username@hostname:/path/to/dir/ /local/
```

___

##### Tool: [host](https://en.wikipedia.org/wiki/Host_(Unix))

###### Resolves the domain name (using external dns server)

```bash
host google.com 9.9.9.9
```

###### Checks the domain administrator (SOA record)

```bash
host -t soa google.com 9.9.9.9
```

___

##### Tool: [dig](https://en.wikipedia.org/wiki/Dig_(command))

###### Resolves the domain name (short output)

```bash
dig google.com +short
```

###### Lookup NS record for specific domain

```bash
dig @9.9.9.9 google.com NS
```

###### Query only answer section

```bash
dig google.com +nocomments +noquestion +noauthority +noadditional +nostats
```

###### Query ALL DNS Records

```bash
dig google.com ANY +noall +answer
```

###### DNS Reverse Look-up

```bash
dig -x 172.217.16.14 +short
```

___

##### Tool: [certbot](https://certbot.eff.org/)

###### Generate multidomain certificate

```bash
certbot certonly -d example.com -d www.example.com
```

###### Generate wildcard certificate

```bash
certbot certonly --manual --preferred-challenges=dns -d example.com -d *.example.com
```

###### Generate certificate with 4096 bit private key

```bash
certbot certonly -d example.com -d www.example.com --rsa-key-size 4096
```

___

##### Tool: [network-other](https://github.com/trimstray/the-book-of-secret-knowledge#tool-network-other)

###### Get all subnets for specific AS (Autonomous system)

```bash
AS="AS32934"
whois -h whois.radb.net -- "-i origin ${AS}" | \
grep "^route:" | \
cut -d ":" -f2 | \
sed -e 's/^[ \t]//' | \
sort -n -t . -k 1,1 -k 2,2 -k 3,3 -k 4,4 | \
cut -d ":" -f2 | \
sed -e 's/^[ \t]/allow /' | \
sed 's/$/;/' | \
sed 's/allow  */subnet -> /g'
```

###### Resolves domain name from dns.google.com with curl and jq

```bash
_dname="google.com" ; curl -s "https://dns.google.com/resolve?name=${_dname}&type=A" | jq .
```

##### Tool: [git](https://git-scm.com/)

###### Log alias for a decent view of your repo

```bash