Last year, a friend called me in a panic. His company's 14 servers had been compromised. He's a business owner, not a sysadmin — he didn't know where to start.
I spent the next 30 minutes walking him through commands over the phone. The same commands I'd looked up from 6 different tabs, re-Googling the syntax because I could never remember the exact flags.
That's what built this toolkit.
What it is
A free, browser-based collection of 500+ copy-paste commands organized into 14 toolkits:
- Linux Incident Response — post-breach forensics, log analysis, persistence hunting
- Windows Incident Response — event logs, autoruns, WMI backdoor detection
- Windows Malware Check — rootkits, scheduled tasks, injected services
- Webshell & Vulnerability Detection — file scanning, backdoor hunting
- Security Hardening — SSH, firewall, file permissions
- Docker & Containers — container forensics, Kubernetes
- Nginx Performance — cache, compression, rate limiting
- WordPress CLI — bulk operations, migrations
- Git Deployment — deploy workflows, rollbacks
- SEO Diagnostics — technical SEO commands
- Plus: Website Health Check, "I Think I Got Hacked" guide, New Website Launch Roadmap The one thing that makes it different
Most command cheatsheets are static text. You copy a command, then spend 2 minutes hunting for every placeholder.
This toolkit has editable placeholders. Click a domain name, IP address, or file path inside a command card — it updates everywhere in that card instantly.
It sounds small. It saves real time when you're mid-incident.
Each command has a strategy note
Not just the command — but:
- When to use it
- What normal output looks like
- What suspicious output looks like
- What to do next
Because find / -mtime -1 -type f returns results, but "recently modified files" doesn't tell you which ones are supposed to be there.
Bilingual
6 of the most common toolkits are available in both English and Chinese. Incident response doesn't care what language you think in.
No install. No login. Works offline.
Each toolkit is a single HTML file. Save it to your desktop. Use it on an air-gapped machine during a breach. No dependencies.
Try it: (https://ordinarymantrying.com/tools/toolkit/)
Source: https://github.com/daligao/website-admin-security-toolkit
The "I Think I Got Hacked" guide is probably the most useful starting point if you're new to incident response — it walks through the first 30 minutes of a breach investigation in plain English.
Top comments (0)