first commit

Windows/Information Gathering/History.md

@@ -0,0 +1,6 @@
+Get-History
+
+
+```powershell
+(Get-PSReadlineOption).HistorySavePath
+```

Windows/Information Gathering/Installed Program.md

@@ -0,0 +1,14 @@
+Installed Applications
+
+
+
+Current running program 
+
+
+```powershell
+Get-ItemProperty "HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*" | select displayname
+```
+
+```powershell
+Get-Process
+```

Windows/Information Gathering/Locate files.md

@@ -0,0 +1,15 @@
+
+
+
+
+```powershell
+Get-ChildItem -Path C:\ -Include certutil* -File -Recurse -ErrorAction SilentlyContinue
+```
+
+```powershell
+Get-ChildItem -Path C:\Users\ -Include *.txt,*.ini -File -Recurse -ErrorAction SilentlyContinue
+```
+
+```powershell
+Get-ChildItem -Path C:\Users\mac\ -Include *.txt,*.pdf,*.xls,*.xlsx,*.doc,*.docx -File -Recurse -ErrorAction SilentlyContinue
+```

Windows/Information Gathering/Network.md

@@ -0,0 +1,16 @@
+Print all routes
+
+
+
+All active connection 
+
+
+
+
+```dosbatch
+route print
+```
+
+```dosbatch
+netstat -ano
+```

Windows/Information Gathering/Username and Hostname.md

@@ -0,0 +1,40 @@
+
+List groups for the current user
+
+
+Get all users (powershell)
+
+
+
+Get all Groups
+
+
+Get members of a group
+
+
+
+
+
+```dosbatch
+whoami /groups
+```
+
+```powershell
+Get-LocalUser
+```
+
+```powershell
+Get-LocalGroup
+```
+
+```powershell
+Get-LocalGroupMember GROUPNAME
+```
+
+```dosbatch
+systeminfo
+```
+
+```dosbatch
+runas /user:backupadmin cmd
+```