Command Center · Reference 07
Competition Command Index
One fast index for Windows 11, Windows Server, Linux, Cisco, networking, and forensics.
Use this when you know what you need to inspect but cannot remember the exact command. Open the full platform reference for cautions and deeper context.
Fast rule
Important
The index gives commands, not automatic answers
Interpret output with scenario requirements, host role, account context, service dependencies, timestamps, and corroborating evidence.
Task lookup
Find the right command family quickly
Need users?
Get-LocalUser / getent passwd
Need admin or sudo membership?
Get-LocalGroupMember -Group "Administrators" / getent group sudo
Need services?
Get-Service / systemctl --type=service --state=running
Need process details?
Get-CimInstance Win32_Process / ps -eo pid,ppid,user,lstart,cmd
Need listeners?
Get-NetTCPConnection -State Listen / ss -tulpn
Need connections?
Get-NetTCPConnection / ss -tpn
Need routes?
route print / ip route / show ip route
Need logs?
Get-WinEvent / journalctl / /var/log/auth.log
Need scheduled activity?
Get-ScheduledTask / crontab -l / systemctl list-timers --all
Need file identity?
Get-FileHash / sha256sum
Need file metadata?
Get-Item / stat
Need firewall state?
Get-NetFirewallProfile / ufw status verbose / show access-lists
Need VLAN state?
show vlan brief / show interfaces trunk
Need interface state?
show ip interface brief / ip addr / Get-NetIPConfiguration
Command index
Windows 11
Use the full quick-reference page when you need interpretation or cautions.
| Task | Command | What it gives you |
|---|---|---|
| Users | Get-LocalUser | List local users. |
| Administrators | Get-LocalGroupMember -Group "Administrators" | Show local administrators. |
| Services | Get-Service | List services and state. |
| Service detail | Get-CimInstance Win32_Service | Select Name,State,StartMode,StartName,PathName | Show service account, path, mode, and state. |
| Processes | Get-CimInstance Win32_Process | Select ProcessId,ParentProcessId,Name,ExecutablePath,CommandLine | Show PID, parent, path, and command line. |
| Scheduled tasks | Get-ScheduledTask | List scheduled tasks. |
| Firewall | Get-NetFirewallProfile | Show firewall profile state. |
| IP config | ipconfig /all | Show addresses, gateways, DNS, and DHCP. |
| Listeners | Get-NetTCPConnection -State Listen | Show listening TCP sockets. |
| Connections | Get-NetTCPConnection | Show TCP states and owning PIDs. |
| Routes | route print | Show routing tables. |
| Security log | Get-WinEvent -LogName Security -MaxEvents 50 | Show recent Security events. |
| File hash | Get-FileHash "C:\Path\To\File" -Algorithm SHA256 | Calculate SHA-256. |
| File metadata | Get-Item "C:\Path\To\File" | Format-List Name,Length,CreationTime,LastWriteTime,Attributes | Show file metadata. |
| Startup | Get-CimInstance Win32_StartupCommand | Show startup commands. |
| Defender | Get-MpComputerStatus | Show Defender status. |
| Updates | Get-HotFix | Sort-Object InstalledOn -Descending | Show visible hotfix history. |
Command index
Windows Server
Use the full quick-reference page when you need interpretation or cautions.
| Task | Command | What it gives you |
|---|---|---|
| Roles | Get-WindowsFeature | List server roles and features. |
| Installed roles | Get-WindowsFeature | Where-Object Installed | Show installed roles/features. |
| Domain role | Get-ComputerInfo | Select CsDomain,CsDomainRole,CsName | Show domain and server-role context. |
| AD users | Get-ADUser -Filter * | List AD users when the AD module is available. |
| AD groups | Get-ADGroup -Filter * | List AD groups. |
| Domain Admins | Get-ADGroupMember -Identity "Domain Admins" | Show Domain Admins membership. |
| Shares | Get-SmbShare | List SMB shares. |
| SMB sessions | Get-SmbSession | Show current SMB sessions. |
| Open SMB files | Get-SmbOpenFile | Show files opened through SMB. |
| IP config | Get-NetIPConfiguration | Show IP, gateway, DNS, and interface data. |
| DNS servers | Get-DnsClientServerAddress | Show DNS assignments. |
| Listeners | Get-NetTCPConnection -State Listen | Show TCP listeners. |
| Directory log | Get-WinEvent -LogName 'Directory Service' -MaxEvents 100 | Show Directory Service events where available. |
Command index
Linux
Use the full quick-reference page when you need interpretation or cautions.
| Task | Command | What it gives you |
|---|---|---|
| Users | getent passwd | List visible users. |
| Groups | getent group | List visible groups. |
| User detail | id <username> | Show UID, GID, and groups. |
| Sessions | who | Show current logins. |
| Login history | last | Show recent login history. |
| Sudo group | getent group sudo | Show sudo-group membership. |
| Sudo rights | sudo -l -U <username> | Show sudo permissions for a user. |
| Permissions | ls -l <path> | Show owner, group, and mode bits. |
| Metadata | stat <path> | Show timestamps, ownership, mode, and inode. |
| Packages | dpkg -l | List installed Debian packages. |
| Running services | systemctl --type=service --state=running | List running services. |
| Service status | systemctl status <service> | Show service state and recent logs. |
| Processes | ps -eo pid,ppid,user,lstart,cmd --sort=pid | Show detailed process state. |
| Process tree | pstree -ap | Show process parent-child relationships. |
| Interfaces | ip addr | Show interfaces and addresses. |
| Routes | ip route | Show routes. |
| Listeners | ss -tulpn | Show listening TCP/UDP sockets. |
| Connections | ss -tpn | Show active TCP connections. |
| Firewall | sudo ufw status verbose | Show UFW state and rules. |
| Journal | journalctl -u <service> --since "2 hours ago" | Show recent service logs. |
| Auth log | sudo tail -n 100 /var/log/auth.log | Show recent authentication events. |
| Cron | crontab -l | Show current user's cron jobs. |
| Timers | systemctl list-timers --all | Show systemd timers. |
| SSH | systemctl status ssh | Show SSH service state. |
| Hash | sha256sum <file> | Calculate SHA-256. |
| File type | file <file> | Identify file type by content. |
Command index
Cisco & Networking
Use the full quick-reference page when you need interpretation or cautions.
| Task | Command | What it gives you |
|---|---|---|
| Baseline | show version | Show IOS, uptime, hardware, and image details. |
| Running config | show running-config | Show active configuration. |
| Startup config | show startup-config | Show saved configuration. |
| Interfaces | show ip interface brief | Show interface IP and status. |
| Interface detail | show interfaces | Show detailed interface counters/state. |
| Routes | show ip route | Show IPv4 routing table. |
| ARP | show arp | Show IPv4-to-MAC mappings. |
| IPv6 | show ipv6 interface brief | Show IPv6 interface addresses/state. |
| MAC table | show mac address-table | Show learned MAC addresses. |
| VLANs | show vlan brief | Show VLANs and access-port membership. |
| Trunks | show interfaces trunk | Show trunk state and allowed VLANs. |
| Switchport | show interfaces switchport | Show access/trunk details. |
| Spanning tree | show spanning-tree | Show root, roles, and STP state. |
| ACLs | show access-lists | Show ACL entries and counters. |
| ACL application | show ip interface | Show ACLs applied to interfaces. |
| Port security | show port-security | Show port-security summary. |
| DHCP bindings | show ip dhcp binding | Show DHCP leases. |
| SSH | show ip ssh | Show SSH status. |
| CDP | show cdp neighbors detail | Show Cisco neighbor details. |
| LLDP | show lldp neighbors detail | Show LLDP neighbor details. |
| Logging | show logging | Show logging config and buffered messages. |
| NTP | show ntp status | Show time synchronization state. |
| Ping | ping <destination> | Test reachability. |
| Traceroute | traceroute <destination> | Show path toward a destination. |
Command index
Forensics
Use the full quick-reference page when you need interpretation or cautions.
| Task | Command | What it gives you |
|---|---|---|
| Windows hash | Get-FileHash "C:\Path\To\File" -Algorithm SHA256 | Hash a Windows file. |
| Linux hash | sha256sum <file> | Hash a Linux file. |
| Windows metadata | Get-Item "C:\Path\To\File" | Format-List Name,Length,CreationTime,LastWriteTime,Attributes | Show Windows file metadata. |
| Linux metadata | stat <file> | Show Linux file metadata. |
| Windows processes | Get-CimInstance Win32_Process | Select ProcessId,ParentProcessId,Name,ExecutablePath,CommandLine | Show detailed process evidence. |
| Linux processes | ps -eo pid,ppid,user,lstart,cmd --sort=pid | Show detailed process evidence. |
| Windows listeners | Get-NetTCPConnection -State Listen | Show Windows listeners. |
| Linux listeners | ss -tulpn | Show Linux listeners. |
| Windows tasks | Get-ScheduledTask | List scheduled tasks. |
| Linux cron | crontab -l | Show current user's cron jobs. |
| Linux timers | systemctl list-timers --all | Show systemd timers. |
| Security events | Get-WinEvent -LogName Security -MaxEvents 100 | Show recent Security events. |
| Linux auth | sudo tail -n 100 /var/log/auth.log | Show recent auth events. |
| Alternate streams | Get-Item "C:\Path\To\File" -Stream * | List NTFS alternate data streams. |
| Hidden Linux files | ls -la <path> | Show hidden entries and metadata. |
Competition rules
Keep the index fast without becoming careless
Use read-only commands first.
Record current state before changing configuration.
Check scenario requirements before disabling services or remote access.
Map ports to owning processes or services.
Treat privilege as capability, not proof of action.
Treat a task or timer as configured state, not proof of execution.
Treat a hash as file identity, not a safety verdict.
Corroborate important conclusions with another source.
After remediation, re-run the command that proves the intended result.