02 ‐ Cheats

Aliasr uses an enhanced Markdown format with special syntax for parameters and references:

# ffuf
#target/remote #os/linux #cat/web

## Fuzz endpoints
```
ffuf -u '<proto|http>://<fqdn>/FUZZ' -w <wordlist|/usr/share/seclists/Discovery/Web-Content/raft-small-words.txt> -c -ac
```

- wordlist
/usr/share/seclists/Discovery/Web-Content/raft-small-files.txt
/usr/share/seclists/Discovery/Web-Content/raft-small-words.txt

In this example, the parameter menu will include all values defined under the wordlist reference at the bottom of the cheat. The input, however, will still be prefilled with /usr/share/seclists/Discovery/Web-Content/raft-small-words.txt, as prefill is determined by the following order of priority:

1. The current corresponding global value.
2. The placeholder defined in the associated cheatsheet, if one is defined.
3. The first value in references, if any are defined.

Cheats are loaded from the paths in [cheats].paths (plus the bundled defaults, unless disabled). See config.toml for the relevant options.

Placeholders (work in progress)

The purpose of this list is to unify cheats and provide a standard for future PRs. The current cheat list is also a work in progress.

Defaults (seeded into every globals file):

krb5ccname
lhost
lport
lwport      # "local web port", where you host a simple HTTP server to stage files
ip
hostname
domain
fqdn
dc_ip
dc_fqdn
domain_sid
aliasr_prefix

Non-defaults:

netbios
tld
target_obj    # Target object in Active Directory
trustee       # Security principal being granted rights in Active Directory

userlist
passwordlist

Tags

Tags written directly under the # <file title> heading apply to every command in that file (a cheat's cheat tags). Tags written under an individual ## <command> heading apply only to that command (its build tags). Both are used for filtering and search; aliasr audit -cl lists every cheat with its build tags.

Mandatory + exclusive - target:

target/remote
target/local

Mandatory + exclusive - operating system (os/* references where the command is executed from):

os/linux
os/windows

Categories (mandatory, optional, or mutually inclusive):

cat/web
cat/ad
cat/powerview
cat/cloud
cat/aws
cat/gcp
cat/azure
cat/containers
cat/mobile

cat/recon
cat/pivoting
cat/movement  # Lateral movement
cat/privesc
cat/persist

cat/pwn
cat/cracking
cat/bruteforce
cat/utils

Protocols and ports:

proto/*
port/*

Variations

Parameters like <auth> can offer a menu of predefined snippets (such as different authentication methods) before the build menu opens. See the Variations page.