Recent Posts

Windows commands for Cyber Security Experts

Usually most security expert use Linux for detecting system vulnerability. But sometimes or some others use windows operating system for penetrating target system. So it's essential to know about windows commands which will help security expert to penetrate the system and this type of commands will provide different advantages.

Firstly type cmd into search box then press enter for open command prompt or press Win+R,you will see a input box.Type cmd or cmd.exe then hit enter or press ok button.

Commands List:
A
> at: Used for scheduled commands and programs to run on a computer on a fixed date and time.
> attrib: This command is used for changing file attributes. 

B
> bitsadmin: This command is used to control Background Intelligent Transfer Service(BITS).

> bootcfg: This command is used for editing boot configuration in Windows OS.


C
> cls: This command is used to clear command prompt/CMD screeen.

> chcp: This command is used to show information about the number of active console code page.

> cacls: This command is used to change file permission.
(0 means No permissions,1 means Execute,2 means Write,3 means Write and Execute,4 means Read,5 means Read and Execute,6 means Read and Write,7 means Read,Write and Execute).

> coreinfo: This command is used to show information about logical and physical processor mapping/relation.

> cipher: This command is used for encryption or decryption files and folders which are contains confidential information.

> cscmd: This command is used for configuring offline files in client computers.


> certutil: This command is used to manage services and Certificate Authority(CA) files.

D
> delprof: This command is used to delete user profiles from system.

> doskey: This command is used for creating macros,edit command line and recall previous commands.


> devcon: This command is used to access command line device manager utility.

E
> echo: This command is used to show a message in the display and off/on of the turn command echoing feature.

F
>ftype:This command is used to modify and display file type extension.

G
> getmac: This command is used to show MAC address of current netwrok adapter.


I
> ipconfig: Show current TCT/IP network configuration, DHCP(Dynamic Host Configuration Protocol) and show information about Domain Name System Setting(DNS).

> ipxroute: This command is used to display/modify routing table information used by IPX(Internet-work Packet Exchange)protocol.


> ipseccmd: This command is used to configure IP(Internet Protocol) security policy.

L
> logman: This command is used for managing performance monitor logs.

M
> mkdir: This command is used to create directories and sub-directories.

> msiexec: This command is used to install/modify/configure operations on windows installer. 

> md: This command is used to create directories and sub-directories.

> msinfo32: This command is used to display system information.


> mstsc: This command is used to crate a remote desktop connection.


N
> netstat: Shows all active TCP(Transmission Control Protocol) connection,IP Routing Table,Ports and IPv4 statistics.


> net: Performs operational performance on user,user accounts policies,group etc.

>  netsh: This commands allows to display and modify network configuration which is currently running on computer.

> nbstat: This command is used to show information about NetBIOS over TCP/IP connection.

> nvspbind: This command is used for modifying the network bindings.


> nltest: This command is used to show list of all domain controllers,force remote shutdown and it establishes NetLogon service between clients and domain controller,etc.

P
> psexec: This command is used run a command into a remote computer.

> psping: This command is used for measuring network performance. 

> pause: This command is used to stop a batch file processing.

> path: This command is used set path environment variable for all executable files.

> pskill: This command is used kill a currently running process by using process name and PID(process id).

> portqry:  This command is used to show current status of TCP/UDP ports.

> psshutdown: This command is used logoff,restart and shutdown a remote computer or a local computer.

> perfmon: This command is used to start monitor performance in CMD(Command Prompt).

> psloglist: This command is used show which users are active on system.

> procdump: This command is used for monitoring CPU spikes and generate a crash report about monitoring CPU spikes.  

> pssuspend: This command is used to suspend a process on a remote/local computer.

Q
> qappsrv: Show all Remote Desktop Session Host Server(RD Session Host) on network.

> quser: Show information about user session on Remote Desktop Session Host Server(RD Session Host).

> qprocess: Show information about process or process id(PID) which is currently running on Remote Desktop Session Host Server(RD Session Host).

> query: Show information about session,process and Remote Desktop Session Host Server(RD Session Host).

> qwinsta: Show information about user session on Remote Desktop Session Host Server(RD Session Host).

R
> reg: Perform action on registry values and registry subkey information.

> regedt32: Editing registry key.

> rundll32: Load and run 32-bit Dynamic Link Libraries(DLLs).

> regini: Used for modification registry key from command prompt.

> runas: This command is helps run program as an another user.

> rasdial: This command is used to show Remote Access Service Status(RASS).


> reset session: This command is used to reset a remote desktop session.

> regedit: Used for edit registry key.

S
> sc: Use for communication with service controller.

> systeminfo: Shows information about operating system and configuration about computer.

> systeminfo: This command is used for shows detailed/all information about system/computer.

> secedit: This command is used for configuring system security.

> sysmon: This command is used to system monitor and log system activity on windows event log.


> shellrunas: This command is used to run a command as another user.

T
> telnet: Used for communication with computers which are connected with or running with Telnet server service.

> tasklist: Show information about currently running process or process id(PID) on your computer or remote computer.

> taskkill: This command is user for killing a task or process is running on system currently by using PID(Process ID).

> tftp(Trivial File Transfer Protocol): Used for transfer files between remote computer which is running with tftp.

> tracert: Is actually a command-line utility,its used to tract the path that sends an Internet Protocol(IP) source to destination. 

> tsdiscon: This command is used to terminate a remote desktop connection.

V
> vol: This command is used to show disk volume and disk serial number which holds it.


> ver: This command is used to show installed version of OS.


W
> wusa: Windows Update Agent API (Windows) use for install update packages.

> whoami: Show information about currently logged on user,User permission and privileges on system.

> wmic: This is actually a command line and a scripting interface.It's used for simplifies the use of windows management instrumentation(WMI).

> winrm: This command is used to manage windows remote management(WinRM).

**Just copy commands like netstat. When you copy any commands then skip '>' and ':' symbol. 

If you found any mistakes, then comment below and comment other important command and share.

Post a Comment

0 Comments