neulab/tldr huggingface dataset:
--retries=RETRIES Retries when the connection timeouts (default 3)
--randomize=RPARAM Randomly change value for given parameter(s)
--safe-url=SAFEURL URL address to visit frequently during testing
--safe-post=SAFE.. POST data to send to a safe URL
--safe-req=SAFER.. Load safe HTTP request from a file
--safe-freq=SAFE.. Test requests between two visits to a given safe URL
--skip-urlencode Skip URL encoding of payload data
--csrf-token=CSR.. Parameter used to hold anti-CSRF token
--csrf-url=CSRFURL URL address to visit to extract anti-CSRF token
--force-ssl Force usage of SSL/HTTPS
--hpp  Use HTTP parameter pollution method
--eval=EVALCODE Evaluate provided Python code before the request (e.g.  "import hashlib;id2=hashlib.md5(id).hexdigest()")
Optimization:
These options can be used to optimize the performance of sqlmap
-o     Turn on all optimization switches
--predict-output Predict common queries output
--keep-alive Use persistent HTTP(s) connections
--null-connection Retrieve page length without actual HTTP response body
--threads=THREADS Max number of concurrent HTTP(s) requests (default 1)
Injection:
These options can be used to specify which parameters to test for, provide custom injection payloads and optional tampering scripts
-p TESTPARAMETER Testable parameter(s)
--skip=SKIP Skip testing for given parameter(s)
--skip-static Skip testing parameters that not appear dynamic
--dbms=DBMS Force back-end DBMS to this value
--dbms-cred=DBMS.. DBMS authentication credentials (user:password)
--os=OS Force back-end DBMS operating system to this value
--invalid-bignum Use big numbers for invalidating values
--invalid-logical Use logical operations for invalidating values
--invalid-string Use random strings for invalidating values
--no-cast Turn off payload casting mechanism
--no-escape Turn off string escaping mechanism
--prefix=PREFIX Injection payload prefix string
--suffix=SUFFIX Injection payload suffix string
--tamper=TAMPER Use given script(s) for tampering injection data
Detection:
These options can be used to customize the detection phase
--level=LEVEL Level of tests to perform (1-5, default 1)
--risk=RISK Risk of tests to perform (1-3, default 1)
--string=STRING String to match when query is evaluated to True
--not-string=NOT.. String to match when query is evaluated to False
--regexp=REGEXP Regexp to match when query is evaluated to True
--code=CODE HTTP code to match when query is evaluated to True
--text-only Compare pages based only on the textual content
--titles Compare pages based only on their titles
Techniques:
These options can be used to tweak testing of specific SQL injection techniques
--technique=TECH SQL injection techniques to use (default "BEUSTQ")
--time-sec=TIMESEC Seconds to delay the DBMS response (default 5)
--union-cols=UCOLS Range of columns to test for UNION query SQL injection
--union-char=UCHAR Character to use for bruteforcing number of columns
--union-from=UFROM Table to use in FROM part of UNION query SQL injection
--dns-domain=DNS.. Domain name used for DNS exfiltration attack
--second-order=S.. Resulting page URL searched for second-order response
Fingerprint:
-f, --fingerprint Perform an extensive DBMS version fingerprint
Enumeration:
These options can be used to enumerate the back-end database management system information, structure and data contained in the tables. Moreover you can run your own SQL statements
-a, --all Retrieve everything
-b, --banner Retrieve DBMS banner
--current-user Retrieve DBMS current user
--current-db Retrieve DBMS current database
--hostname Retrieve DBMS server hostname
--is-dba Detect if the DBMS current user is DBA
--users Enumerate DBMS users
--passwords Enumerate DBMS users password hashes
--privileges Enumerate DBMS users privileges
--roles Enumerate DBMS users roles
--dbs  Enumerate DBMS databases
--tables Enumerate DBMS database tables
--columns Enumerate DBMS database table columns
--schema Enumerate DBMS schema
--count Retrieve number of entries for table(s)
--dump Dump DBMS database table entries
--dump-all Dump all DBMS databases tables entries
--search Search column(s), table(s) and/or database name(s)
--comments Retrieve DBMS comments
-D DB  DBMS database to enumerate
-T TBL DBMS database table(s) to enumerate
-C COL DBMS database table column(s) to enumerate
-X EXCLUDECOL DBMS database table column(s) to not enumerate
-U USER DBMS user to enumerate
--exclude-sysdbs Exclude DBMS system databases when enumerating tables
--where=DUMPWHERE Use WHERE condition while table dumping
--start=LIMITSTART First query output entry to retrieve
--stop=LIMITSTOP Last query output entry to retrieve
--first=FIRSTCHAR First query output word character to retrieve
--last=LASTCHAR Last query output word character to retrieve
--sql-query=QUERY SQL statement to be executed
--sql-shell Prompt for an interactive SQL shell
--sql-file=SQLFILE Execute SQL statements from given file(s)
Brute force:
These options can be used to run brute force checks
--common-tables Check existence of common tables
--common-columns Check existence of common columns
User-defined function injection:
These options can be used to create custom user-defined functions
--udf-inject Inject custom user-defined functions
--shared-lib=SHLIB Local path of the shared library
File system access:
These options can be used to access the back-end database management system underlying file system
--file-read=RFILE Read a file from the back-end DBMS file system
--file-write=WFILE Write a local file on the back-end DBMS file system
--file-dest=DFILE Back-end DBMS absolute filepath to write to
Operating system access:
These options can be used to access the back-end database management system underlying operating system
--os-cmd=OSCMD Execute an operating system command
--os-shell Prompt for an interactive operating system shell
--os-pwn Prompt for an OOB shell, Meterpreter or VNC
--os-smbrelay One click prompt for an OOB shell, Meterpreter or VNC
--os-bof Stored procedure buffer overflow exploitation
--priv-esc Database process user privilege escalation
--msf-path=MSFPATH Local path where Metasploit Framework is installed
--tmp-path=TMPPATH Remote absolute path of temporary files directory
Windows registry access:
These options can be used to access the back-end database management system Windows registry
--reg-read Read a Windows registry key value
--reg-add Write a Windows registry key value data
--reg-del Delete a Windows registry key value
--reg-key=REGKEY Windows registry key
--reg-value=REGVAL Windows registry key value
--reg-data=REGDATA Windows registry key value data
--reg-type=REGTYPE Windows registry key value type
These options can be used to set some general working parameters
-s SESSIONFILE Load session from a stored (.sqlite) file
-t TRAFFICFILE Log all HTTP traffic into a textual file
--batch Never ask for user input, use the default behaviour
--charset=CHARSET Force character encoding used for data retrieval
--crawl=CRAWLDEPTH Crawl the website starting from the target URL
--crawl-exclude=.. Regexp to exclude pages from crawling (e.g. "logout")
--csv-del=CSVDEL Delimiting character used in CSV output (default ",")
--dump-format=DU.. Format of dumped data (CSV (default), HTML or SQLITE)
--eta  Display for each output the estimated time of arrival
--flush-session Flush session files for current target
--forms Parse and test forms on target URL
--fresh-queries Ignore query results stored in session file
--hex  Use DBMS hex function(s) for data retrieval
--output-dir=OUT.. Custom output directory path
--parse-errors Parse and display DBMS error messages from responses
--pivot-column=P.. Pivot column name
--save=SAVECONFIG Save options to a configuration INI file
--scope=SCOPE Regexp to filter targets from provided proxy log
--test-filter=TE.. Select tests by payloads and/or titles (e.g. ROW)
--test-skip=TEST.. Skip tests by payloads and/or titles (e.g. BENCHMARK)
--update Update sqlmap
-z MNEMONICS Use short mnemonics (e.g. "flu,bat,ban,tec=EU")
--alert=ALERT Run host OS command(s) when SQL injection is found
--answers=ANSWERS Set question answers (e.g. "quit=N,follow=N")
--beep Beep on question and/or when SQL injection is found
--cleanup Clean up the DBMS from sqlmap specific UDF and tables
--dependencies Check for missing (non-core) sqlmap dependencies
--disable-coloring Disable console output coloring
--gpage=GOOGLEPAGE Use Google dork results from specified page number
--identify-waf Make a thorough testing for a WAF/IPS/IDS protection
--skip-waf Skip heuristic detection of WAF/IPS/IDS protection
--mobile Imitate smartphone through HTTP User-Agent header
--offline Work in offline mode (only use session data)
--page-rank Display page rank (PR) for Google dork results
--purge-output Safely remove all content from output directory
--smart Conduct thorough tests only if positive heuristic(s)
--sqlmap-shell Prompt for an interactive sqlmap shell
--wizard Simple wizard interface for beginner users
TRUE(1)                           User Commands                          TRUE(1)
true - do nothing, successfully
true [ignored command line arguments] true OPTION
Exit with a status code indicating success.
NOTE: your shell may have its own version of true, which usually supersedes the version described here.  Please refer to your shell's documentation for details about the options it supports.
Full documentation <https://www.gnu.org/software/coreutils/true> or available locally via: info '(coreutils) true invocation'
swift(1)                         OpenStack Swift                        swift(1)
swift - OpenStack Swift client tool
swift [options] <command> [args]
The swift tool is a command line utility for communicating with an OpenStack Object Storage (Swift) environment. It allows one to perform several types of operations.
stat [command-options] [container] [object] Displays information for the account, container, or object depending on the args given (if any).  In verbose mode, the Storage URL and the authentication token are displayed as well. Option --lh reports sizes in human readable format similar to ls -lh.
list [command-options] [container] Lists the containers for the account or the objects for a container. The -p <prefix> or --prefix <prefix> is an option that will only list items beginning with that prefix. The -d <delim> or --delimiter <delim> is option (for container listings only) that will roll up items with the given delimiter (see OpenStack Swift general documentation for what this means).
The -l or --long and --lh options provide more detail, similar to ls -l and ls -lh, the latter providing sizes in human readable format (eg 3K, 12M, etc). These latter 2 switches use more overhead to get those details, which is directly proportional to the number of container or objects being listed. With the -t or --total option they only report totals.
upload [command-options] container file_or_directory [file_or_directory] [...] Uploads to the given container the files and directories specified by the remaining args. The -c or --changed is an option that will only upload files that have changed since the last upload. The --object-name <object-name> is an option that will upload file and name object to <object-name> or upload dir and use <object-name> as object prefix. If the file name is "-", reads the content from standard input. In this case, --object-name is required and no other files may be given. The -S <size> or --segment-size <size> and --leave-segments and others are options as well (see swift upload --help for more).
post [command-options] [container] [object] Updates meta information for the account, container, or object depending on the args given. If the container is not found, it will be created automatically; but this is not true for accounts and objects. Containers also allow the -r (or --read-acl) and -w (or --write-acl) options. The -m or --meta option is allowed on all and used to define the user meta data items to set in the form Name:Value. This option can be repeated.  For more details and options see swift post --help.  Example: post -m Color:Blue -m Size:Large
copy [command-options] container object Copies an object to a new destination or adds user metadata to the object (current user metadata will be preserved, in contrast with the post command) depending on the args given. The --destination option sets the destination in the form /container/object. If not set, the object will be copied onto itself which is useful for adding metadata. The -M or --fresh-metadata option copies the object without the existing user metadata. The -m or --meta option is always allowed and is used to define the user metadata items to set in the form Name:Value (this option can be repeated).  For more details and options see swift copy --help.
download [command-options] [container] [object] [object] [...] Downloads everything in the account (with --all), or everything in a container, or a list of objects depending on the args given. For a single object download, you may use the -o [--output] <filename> option to redirect the output to a specific file or if "-" then just redirect to stdout or with --no-download actually not to write anything to disk.  The --ignore-checksum is an option that turns off checksum validation.  You can specify optional headers with the repeatable cURL-like option -H [--header]. For more details and options see swift download --help.  The --ignore-mtime option ignores the x-object-meta-mtime metadata entry on the object (if present) and instead creates the downloaded files with fresh atime and mtime values.
delete [command-options] [container] [object] [object] [...] Deletes everything in the account (with --all), or everything in a container, or all objects in a container that start with a given string (given by --prefix), or a list of objects depending on the args given. Segments of manifest objects will be deleted as well, unless you specify the --leave-segments option.  For more details and options see swift delete --help.
capabilities [command-options] [proxy-url] Displays cluster capabilities. If the proxy-url option is not provided the storage-url retrieved after authentication is used as proxy-url.
By default, the output includes the list of the activated Swift middlewares as well as relevant options for each one. Additionally the command displays relevant options for the Swift core.
The --json option will print a json representation of the cluster capabilities. This is typically more suitable for consumption by other programs, such as jq.
Example: capabilities https://swift.example.com capabilities --json
tempurl [command-option] method time path key Generates a temporary URL allowing unauthenticated access to the Swift object at the given path, using the given HTTP method, for the given time, using the given TempURL key.
The time can be specified either as an integer denoting the amount of seconds the temporary URL is valid, or as an ISO 8601 timestamp in one of following formats:  Complete date: YYYY-MM-DD (eg 1997-07-16), complete date plus hours, minutes and seconds: YYYY-MM-DDThh:mm:ss (eg 1997-07-16T19:20:30) or complete date plus hours, minutes and seconds with UTC designator: YYYY-MM-DDThh:mm:ssZ (eg 1997-07-16T19:20:30Z). Be aware that if you do not use the latter format, the timestamp is generated using your locale timezone. If the first format is used, the time part used will equal to 00:00:00.
With the --prefix-based option a prefix-based URL is generated.
The option --iso8601 provides ISO 8601 UTC timestamps instead of Unix timestamps inside the generated URL.
If optional --absolute argument is provided and the time argument is specified in seconds, the seconds are interpreted as a Unix timestamp at which the URL should expire.
Example: tempurl GET $(date -d "Jan 1 2016" +%s) /v1/AUTH_foo/bar_container/quux.md my_secret_tempurl_key --absolute
auth Display auth related authentication variables in shell friendly format.  For examples see swift auth --help.
--version              Show program's version number and exit -h, --help             Show this (or any subcommand if after command) help message and exit -s, --snet             Use SERVICENET internal network -v, --verbose          Print more info -q, --quiet            Suppress status output -A AUTH, --auth=AUTH   URL for obtaining an auth token -U USER, --user=USER   User name for obtaining an auth token -V 1|2, --auth-version=VERSION  Authentication protocol version -K KEY, --key=KEY      Key for obtaining an auth token --os-storage-url=URL   Use this instead of URL returned from auth --os-help              Show all OpenStack authentication options For more options see swift --help and swift --os-help.
swift -A https://127.0.0.1:443/auth/v1.0 -U swiftops:swiftops -K swiftops stat
Account: AUTH_43b42dae-dc0b-4a4b-ac55-97de614d6e6e Containers: 1 Objects: 1 Bytes: 1124 Accept-Ranges: bytes X-Trans-Id: txb21186a9eef64ed295a1e95896a0fc72
More in depth documentation about OpenStack Swift as a whole can be found at https://docs.openstack.org/swift/latest/
SENDMAIL(8)                BSD System Manager's Manual               SENDMAIL(8)
sendmail — a mail enqueuer for smtpd(8)
sendmail [-tv] [-F name] [-f from] to ...
The sendmail utility is a local enqueuer for the smtpd(8) daemon, compatible with mailwrapper(8).  The message is read on standard input (stdin) until sendmail encounters an end-of-file.  The sendmail enqueuer is not intended to be used directly to send mail, but rather via a frontend known as a mail user agent.
Unless the optional -t flag is specified, one or more recipients must be specified on the command line.
-F name Set the sender's full name.
-f from Set the sender's address.
-t      Read the message's To:, Cc:, and Bcc: fields for recipients.  The Bcc: field will be deleted before sending.
-v      Enable verbose output.
To maintain compatibility with Sendmail, Inc.'s implementation of sendmail, various other flags are accepted, but have no effect.
The sendmail utility exits 0 on success, and >0 if an error occurs.
smtpctl(8), smtpd(8)
OpenSMTPD is primarily developed by Gilles Chehade, Eric Faurot, and Charles Longeau, with contributions from various OpenBSD hackers.  It is distributed under the ISC license.
This manpage was written by Ryan Kavanagh ⟨rak@debian.org⟩ for the Debian project and is distributed under the ISC license.
ANSIBLE-VAULT(1)         System administration commands         ANSIBLE-VAULT(1)
ansible-vault - encryption/decryption utility for Ansible data files
usage: ansible-vault [-h] [--version] [-v] {create,decrypt,edit,view,encrypt,encrypt_string,rekey} ...
can encrypt any structured data file used by Ansible.  This can include group_vars/ or host_vars/ inventory variables, variables loaded by include_vars or vars_files, or variable files passed on the ansible-playbook command line with -e @file.yml or -e @file.json.  Role variables and defaults are also included!
Because Ansible tasks, handlers, and other objects are data, these can also be encrypted with vault.  If you'd like to not expose what variables you are using, you can keep an individual task file entirely encrypted.
create create and open a file in an editor that will be encrypted with the provided vault secret when closed
--ask-vault-password,   --ask-vault-pass ask for vault password
--encrypt-vault-id 'ENCRYPT_VAULT_ID' the vault id used to encrypt (required if more than one vault-id is provided)
--vault-password-file,   --vault-pass-file vault password file
decrypt decrypt the supplied file using the provided vault secret
--output 'OUTPUT_FILE' output file name for encrypt or decrypt; use - for stdout
edit   open and decrypt an existing vaulted file in an editor, that will be encrypted again when closed
view   open, decrypt and view an existing vaulted file using a pager using the supplied vault secret
encrypt encrypt the supplied file using the provided vault secret
encrypt_string encrypt the supplied string using the provided vault secret
--show-input Do not hide input when prompted for the string to encrypt
--stdin-name 'ENCRYPT_STRING_STDIN_NAME' Specify the variable name for stdin
-n,   --name Specify the variable name
-p,   --prompt Prompt for the string to encrypt
rekey  re-encrypt a vaulted file with a new secret, the previous secret is required
--new-vault-id 'NEW_VAULT_ID' the new vault identity to use for rekey
--new-vault-password-file 'NEW_VAULT_PASSWORD_FILE' new vault password file for rekey
ansible (1), ansible-config (1), ansible-console (1), ansible-doc (1), ansible-galaxy (1), ansible-inventory (1), ansible-playbook (1), ansible-pull (1),
AB(8)                                  ab                                  AB(8)
ab - Apache HTTP server benchmarking tool
ab [ -A auth-username:password ] [ -b windowsize ] [ -c concurrency ] [ -C cookie-name=value ] [ -d ] [ -e csv-file ] [ -f protocol ] [ -g gnuplot-file ] [ -h ] [ -H custom-header ] [ -i ] [ -k ] [ -n requests ] [ -p POST-file ] [ -P proxy-auth-username:password ] [ -q ] [ -r ] [ -s ] [ -S ] [ -t timelimit ] [ -T content-type ] [ -u PUT-file ] [ -v verbosity] [ -V ] [ -w ] [ -x <table>-attributes ] [ -X proxy[:port] ] [ -y <tr>-attributes ] [ -z <td>-attributes ] [ -Z ciphersuite ] [http[s]://]hostname[:port]/path
ab is a tool for benchmarking your Apache Hypertext Transfer Protocol (HTTP) server. It is designed to give you an impression of how your current Apache installation performs. This especially shows you how many requests per second your Apache installation is capable of serving.
-A auth-username:password Supply BASIC Authentication credentials to the server. The username and password are separated by a single : and sent on the wire base64 encoded. The string is sent regardless of whether the server needs it (i.e., has sent an 401 authentication needed).
-b windowsize Size of TCP send/receive buffer, in bytes.
-c concurrency Number of multiple requests to perform at a time. Default is one request at a time.
-C cookie-name=value Add a Cookie: line to the request. The argument is typically in the form of a name=value pair. This field is repeatable.
-d     Do not display the "percentage served within XX [ms] table". (legacy support).
-e csv-file Write a Comma separated value (CSV) file which contains for each percentage (from 1% to 100%) the time (in milliseconds) it took to serve that percentage of the requests. This is usually more useful than the 'gnuplot' file; as the results are already 'binned'.
-f protocol Specify SSL/TLS protocol (SSL2, SSL3, TLS1, or ALL).
-g gnuplot-file Write all measured values out as a 'gnuplot' or TSV (Tab separate values) file. This file can easily be imported into packages like Gnuplot, IDL, Mathematica, Igor or even Excel. The labels are on the first line of the file.
-h     Display usage information.
-H custom-header Append extra headers to the request. The argument is typically in the form of a valid header line, containing a colon-separated field-value pair (i.e., "Accept-Encoding: zip/zop;8bit").
-i     Do HEAD requests instead of GET.
-k     Enable the HTTP KeepAlive feature, i.e., perform multiple requests within one HTTP session. Default is no KeepAlive.
-n requests Number of requests to perform for the benchmarking session. The default is to just perform a single request which usually leads to non-representative benchmarking results.
-p POST-file File containing data to POST. Remember to also set -T.
-P proxy-auth-username:password Supply BASIC Authentication credentials to a proxy en-route. The username and password are separated by a single : and sent on the wire base64 encoded. The string is sent regardless of whether the proxy needs it (i.e., has sent an 407 proxy authentication needed).
-q     When processing more than 150 requests, ab outputs a progress count on stderr every 10% or 100 requests or so. The -q flag will suppress these messages.
-r     Don't exit on socket receive errors.
-s     When compiled in (ab -h will show you) use the SSL protected https rather than the http protocol. This feature is experimental and very rudimentary. You probably do not want to use it.
-S     Do not display the median and standard deviation values, nor display the warning/error messages when the average and median are more than one or two times the standard deviation apart. And default to the min/avg/max values. (legacy support).
-t timelimit Maximum number of seconds to spend for benchmarking. This implies a -n 50000 internally. Use this to benchmark the server within a fixed total amount of time. Per default there is no timelimit.
-T content-type Content-type header to use for POST/PUT data, eg. application/x- www-form-urlencoded. Default: text/plain.
-u PUT-file File containing data to PUT. Remember to also set -T.
-v verbosity Set verbosity level - 4 and above prints information on headers, 3 and above prints response codes (404, 200, etc.), 2 and above prints warnings and info.
-V     Display version number and exit.
-w     Print out results in HTML tables. Default table is two columns wide, with a white background.
-x <table>-attributes String to use as attributes for <table>. Attributes are inserted <table here >.
-X proxy[:port] Use a proxy server for the requests.
-y <tr>-attributes String to use as attributes for <tr>.
-z <td>-attributes String to use as attributes for <td>.
-Z ciphersuite Specify SSL/TLS cipher suite (See openssl ciphers).
The following list describes the values returned by ab:
Server Software The value, if any, returned in the server HTTP header of the first successful response. This includes all characters in the header from beginning to the point a character with decimal value of 32 (most notably: a space or CR/LF) is detected.
Server Hostname The DNS or IP address given on the command line
Server Port The port to which ab is connecting. If no port is given on the command line, this will default to 80 for http and 443 for https.
SSL/TLS Protocol The protocol parameters negotiated between the client and server. This will only be printed if SSL is used.
Document Path The request URI parsed from the command line string.
Document Length This is size in bytes of the first succesfully returning document. If the document length changes during testing, the response is considered an error.
Concurrency Level The number of concurrent clients used during the test
Time taken for tests This is the time taken from the moment the first socket connection is created to the moment the last response is recieved
Complete requests The number of successful responses recieved
Failed requests The number of requests that were considered a failure. If the number is greater than zero, another line will be printed showing the numer of requests that failed due to connecting, reading, incorrect content length, or exceptions.
Write errors The number of errors that failed during write (broken pipe).
Non-2xx responses The number of responses that were not in the 200 series of response codes. If all responses were 200, this field is not printed.
Keep-Alive requests The number of connections that resulted in Keep-Alive requests
Total body sent If configured to send data as part of the test, this is the total number of bytes sent during the tests. This field is omitted if the test did not include a body to send.
Total transferred The total number of bytes received from the server. This number is essentially the number of bytes sent over the wire.
HTML transferred The total number of document bytes received from the server. This number excludes bytes received in HTTP headers
Requests per second This is the number of requests per second. This value is the result of dividing the number of requests by the total time taken
Time per request The average time spent per request. The first value is calculated with the formula concurrency * timetaken * 1000 / done while the second value is calculated with the formula timetaken * 1000 / done
Transfer rate The rate of transfer as calculated by the formula totalread / 1024 / timetaken
There are various statically declared buffers of fixed length. Combined with the lazy parsing of the command line arguments, the response headers from the server and other external inputs, this might bite you.
It does not implement HTTP/1.x fully; only accepts some 'expected' forms of responses. The rather heavy use of strstr(3) shows up top in profile, which might indicate a performance problem; i.e., you would measure the ab performance rather than the server's.
KEEPASSXC-CLI(1)             General Commands Manual            KEEPASSXC-CLI(1)
keepassxc-cli - command line interface for the KeePassXC password manager
keepassxc-cli command [options]
keepassxc-cli is the command line interface for the KeePassXC password manager. It provides the ability to query and modify the entries of a KeePass database, directly from the command line.
add [options] <database> <entry> Adds a new entry to a database. A password can be generated (-g option), or a prompt can be displayed to input the password (-p option). The same password generation options as documented for the generate command can be used when the -g option is set.
analyze [options] <database> Analyzes passwords in a database for weaknesses.
clip [options] <database> <entry> [timeout] Copies an attribute or the current TOTP (if the -t option is specified) of a database entry to the clipboard. If no attribute name is specified using the -a option, the password is copied. If multiple entries with the same name exist in different groups, only the attribute for the first one is copied. For copying the attribute of an entry in a specific group, the group path to the entry should be specified as well, instead of just the name. Optionally, a timeout in seconds can be specified to automatically clear the clipboard.
close In interactive mode, closes the currently opened database (see open).
db-create [options] <database> Creates a new database with a password and/or a key file. The key file will be created if the file that is referred to does not exist. If both the key file and password are empty, no database will be created.
db-info [options] <database> Show a database’s information.
diceware [options] Generates a random diceware passphrase.
edit [options] <database> <entry> Edits a database entry. A password can be generated (-g option), or a prompt can be displayed to input the password (-p option). The same password generation options as documented for the generate command can be used when the -g option is set.
estimate [options] [password] Estimates the entropy of a password. The password to estimate can be provided as a positional argument, or using the standard input.
exit Exits interactive mode. Synonymous with quit.
export [options] <database> Exports the content of a database to standard output in the specified format (defaults to XML).
generate [options] Generates a random password.
help [command] Displays a list of available commands, or detailed information about the specified command.
import [options] <xml> <database> Imports the contents of an XML database to the target database.
locate [options] <database> <term> Locates all the entries that match a specific search term in a database.
ls [options] <database> [group] Lists the contents of a group in a database. If no group is specified, it will default to the root group.
merge [options] <database1> <database2> Merges two databases together. The first database file is going to be replaced by the result of the merge, for that reason it is advisable to keep a backup of the two database files before attempting a merge. In the case that both databases make use of the same credentials, the --same-credentials or -s option can be used.
mkdir [options] <database> <group> Adds a new group to a database.
mv [options] <database> <entry> <group> Moves an entry to a new group.
open [options] <database> Opens the given database in a shell-style interactive mode. This is useful for performing multiple operations on a single database (e.g. ls followed by show).
quit Exits interactive mode. Synonymous with exit.
rm [options] <database> <entry> Removes an entry from a database. If the database has a recycle bin, the entry will be moved there. If the entry is already in the recycle bin, it will be removed permanently.
rmdir [options] <database> <group> Removes a group from a database. If the database has a recycle bin, the group will be moved there. If the group is already in the recycle bin, it will be removed permanently.
show [options] <database> <entry> Shows the title, username, password, URL and notes of a database entry. Can also show the current TOTP. Regarding the occurrence of multiple entries with the same name in different groups, everything stated in the clip command section also applies here.
General options --debug-info Displays debugging information.
-k, --key-file <path> Specifies a path to a key file for unlocking the database. In a merge operation this option, is used to specify the key file path for the first database.
--no-password Deactivates the password key for the database.
-y, --yubikey <slot> Specifies a yubikey slot for unlocking the database. In a merge operation this option is used to specify the YubiKey slot for the first database.
-q, --quiet <path> Silences password prompt and other secondary outputs.
-h, --help Displays help information.
Merge options -d, --dry-run <path> Prints the changes detected by the merge operation without making any changes to the database.
--key-file-from <path> Sets the path of the key file for the second database.
--no-password-from Deactivates password key for the database to merge from.
--yubikey-from <slot> YubiKey slot for the second database.
-s, --same-credentials Uses the same credentials for unlocking both databases.
Add and edit options The same password generation options as documented for the generate command can be used with those 2 commands when the -g option is set.
-u, --username <username> Specifies the username of the entry.
--url <url> Specifies the URL of the entry.
-p, --password-prompt Uses a password prompt for the entry’s password.
-g, --generate Generates a new password for the entry.
Edit options -t, --title <title> Specifies the title of the entry.
Estimate options -a, --advanced Performs advanced analysis on the password.
Analyze options -H, --hibp <filename> Checks if any passwords have been publicly leaked, by comparing against the given list of password SHA-1 hashes, which must be in "Have I Been Pwned" format. Such files are available from https://haveibeenpwned.com/Passwords; note that they are large, and so this operation typically takes some time (minutes up to an hour or so).
Clip options -a, --attribute Copies the specified attribute to the clipboard. If no attribute is specified, the password attribute is the default. For example, "-a username" would copy the username to the clipboard. [Default: password]
-t, --totp Copies the current TOTP instead of the specified attribute to the clipboard. Will report an error if no TOTP is configured for the entry.
Create options -k, --set-key-file <path> Set the key file for the database.
-p, --set-password Set a password for the database.
-t, --decryption-time <time> Target decryption time in MS for the database.
Show options -a, --attributes <attribute>... Shows the named attributes. This option can be specified more than once, with each attribute shown one-per-line in the given order. If no attributes are specified and -t is not specified, a summary of the default attributes is given. Protected attributes will be displayed in clear text if specified explicitly by this option.
-s, --show-protected Shows the protected attributes in clear text.
-t, --totp Also shows the current TOTP, reporting an error if no TOTP is configured for the entry.
Diceware options -W, --words <count> Sets the desired number of words for the generated passphrase. [Default: 7]
-w, --word-list <path> Sets the Path of the wordlist for the diceware generator. The wordlist must have > 1000 words, otherwise the program will fail. If the wordlist has < 4000 words a warning will be printed to STDERR.
Export options -f, --format Format to use when exporting. Available choices are xml or csv. Defaults to xml.
List options -R, --recursive Recursively lists the elements of the group.
-f, --flatten Flattens the output to single lines. When this option is enabled, subgroups and subentries will be displayed with a relative group path instead of indentation.
Generate options -L, --length <length> Sets the desired length for the generated password. [Default: 16]
-l, --lower Uses lowercase characters for the generated password. [Default: Enabled]
-U, --upper Uses uppercase characters for the generated password. [Default: Enabled]
-n, --numeric Uses numbers characters for the generated password. [Default: Enabled]
-s, --special Uses special characters for the generated password. [Default: Disabled]
-e, --extended Uses extended ASCII characters for the generated password. [Default: Disabled]
-x, --exclude <chars> Comma-separated list of characters to exclude from the generated password. None is excluded by default.
--exclude-similar Exclude similar looking characters. [Default: Disabled]
--every-group Include characters from every selected group. [Default: Disabled]
Project homepage https://keepassxc.org
QuickStart Guide https://keepassxc.org/docs/KeePassXC_GettingStarted.html
User Guide https://keepassxc.org/docs/KeePassXC_UserGuide.html
Git repository https://github.com/keepassxreboot/keepassxc.git
This manual page was originally written by Manolis Agkopian m.agkopian@gmail.com.
Bugs and feature requests can be reported on GitHub at https://github.com/keepassxreboot/keepassxc/issues.
Copyright (C) 2016-2020 KeePassXC Team team@keepassxc.org
KeePassXC code is licensed under GPL-2 or GPL-3.
DUPLICITY(1)                      User Manuals                      DUPLICITY(1)
duplicity - Encrypted incremental backup to local or remote storage.
For detailed descriptions for each command see chapter ACTIONS.
duplicity [full|incremental] [options] source_directory target_url
duplicity verify [options] [--compare-data] [--file-to-restore <relpath>] [--time time] source_url target_directory
duplicity collection-status [options] [--file-changed <relpath>] target_url
duplicity list-current-files [options] [--time time] target_url
duplicity [restore] [options] [--file-to-restore <relpath>] [--time time] source_url target_directory
duplicity remove-older-than <time> [options] [--force] target_url
duplicity remove-all-but-n-full <count> [options] [--force] target_url
duplicity remove-all-inc-of-but-n-full <count> [options] [--force] target_url
duplicity cleanup [options] [--force] target_url
duplicity replicate [options] [--time time] source_url target_url
Duplicity incrementally backs up files and folders into tar-format volumes encrypted with GnuPG and places them to a remote (or local) storage backend.  See chapter URL FORMAT for a list of all supported backends and how to address them.  Because duplicity uses librsync, incremental backups are space efficient and only record the parts of files that have changed since the last backup.  Currently duplicity supports deleted files, full Unix permissions, uid/gid, directories, symbolic links, fifos, etc., but not hard links.
If you are backing up the root directory /, remember to --exclude /proc, or else duplicity will probably crash on the weird stuff in there.
Here is an example of a backup, using sftp to back up /home/me to some_dir on the other.host machine:
duplicity /home/me sftp://uid@other.host/some_dir
If the above is run repeatedly, the first will be a full backup, and subsequent ones will be incremental. To force a full backup, use the full action:
duplicity full /home/me sftp://uid@other.host/some_dir
or enforcing a full every other time via --full-if-older-than <time> , e.g. a full every month:
duplicity --full-if-older-than 1M /home/me sftp://uid@other.host/some_dir
Now suppose we accidentally delete /home/me and want to restore it the way it was at the time of last backup:
duplicity sftp://uid@other.host/some_dir /home/me
Duplicity enters restore mode because the URL comes before the local directory.  If we wanted to restore just the file "Mail/article" in /home/me as it was three days ago into /home/me/restored_file:
duplicity -t 3D --file-to-restore Mail/article sftp://uid@other.host/some_dir /home/me/restored_file
The following command compares the latest backup with the current files:
duplicity verify sftp://uid@other.host/some_dir /home/me
Finally, duplicity recognizes several include/exclude options.  For instance, the following will backup the root directory, but exclude /mnt, /tmp, and /proc:
duplicity --exclude /mnt --exclude /tmp --exclude /proc / file:///usr/local/backup
Note that in this case the destination is the local directory /usr/local/backup.  The following will backup only the /home and /etc directories under root:
duplicity --include /home --include /etc --exclude '**' / file:///usr/local/backup
Duplicity can also access a repository via ftp.  If a user name is given, the environment variable FTP_PASSWORD is read to determine the password:
FTP_PASSWORD=mypassword duplicity /local/dir ftp://user@other.host/some_dir
Duplicity knows action commands, which can be finetuned with options. The actions for backup (full,incr) and restoration (restore) can as well be left out as duplicity detects in what mode it should switch to by the order of target URL and local folder. If the target URL comes before the local folder a restore is in order, is the local folder before target URL then this folder is about to be backed up to the target URL. If a backup is in order and old signatures can be found duplicity automatically performs an incremental backup.
Note: The following explanations explain some but not all options that can be used in connection with that action command.  Consult the OPTIONS section for more detailed informations.
full <folder> <url> Perform a full backup. A new backup chain is started even if signatures are available for an incremental backup.
incr <folder> <url> If this is requested an incremental backup will be performed. Duplicity will abort if no old signatures can be found.
verify [--compare-data] [--time <time>] [--file-to-restore <rel_path>] <url> <local_path> Verify tests the integrity of the backup archives at the remote location by downloading each file and checking both that it can restore the archive and that the restored file matches the signature of that file stored in the backup, i.e. compares the archived file with its hash value from archival time. Verify does not actually restore and will not overwrite any local files. Duplicity will exit with a non-zero error level if any files do not match the signature stored in the archive for that file. On verbosity level 4 or higher, it will log a message for each file that differs from the stored signature. Files must be downloaded to the local machine in order to compare them.  Verify does not compare the backed-up version of the file to the current local copy of the files unless the --compare-data option is used (see below). The --file-to-restore option restricts verify to that file or folder.  The --time option allows to select a backup to verify. The --compare-data option enables data comparison (see below).
collection-status [--file-changed <relpath>]<url> Summarize the status of the backup repository by printing the chains and sets found, and the number of volumes in each.
list-current-files [--time <time>] <url> Lists the files contained in the most current backup or backup at time.  The information will be extracted from the signature files, not the archive data itself. Thus the whole archive does not have to be downloaded, but on the other hand if the archive has been deleted or corrupted, this command will not detect it.
restore [--file-to-restore <relpath>] [--time <time>] <url> <target_folder> You can restore the full monty or selected folders/files from a specific time.  Use the relative path as it is printed by list- current-files.  Usually not needed as duplicity enters restore mode when it detects that the URL comes before the local folder.
remove-older-than <time> [--force] <url> Delete all backup sets older than the given time.  Old backup sets will not be deleted if backup sets newer than time depend on them. See the TIME FORMATS section for more information.  Note, this action cannot be combined with backup or other actions, such as cleanup.  Note also that --force will be needed to delete the files instead of just listing them.
remove-all-but-n-full <count> [--force] <url> Delete all backups sets that are older than the count:th last full backup (in other words, keep the last count full backups and associated incremental sets).  count must be larger than zero. A value of 1 means that only the single most recent backup chain will be kept.  Note that --force will be needed to delete the files instead of just listing them.
remove-all-inc-of-but-n-full <count> [--force] <url> Delete incremental sets of all backups sets that are older than the count:th last full backup (in other words, keep only old full backups and not their increments).  count must be larger than zero. A value of 1 means that only the single most recent backup chain will be kept intact.  Note that --force will be needed to delete the files instead of just listing them.
cleanup [--force] <url> Delete the extraneous duplicity files on the given backend.  Non- duplicity files, or files in complete data sets will not be deleted.  This should only be necessary after a duplicity session fails or is aborted prematurely.  Note that --force will be needed to delete the files instead of just listing them.
replicate [--time time] <source_url> <target_url> Replicate backup sets from source to target backend. Files will be (re)-encrypted and (re)-compressed depending on normal backend options. Signatures and volumes will not get recomputed, thus options like --volsize or --max-blocksize have no effect.  When --time time is given, only backup sets older than time will be replicated.
--allow-source-mismatch Do not abort on attempts to use the same archive dir or remote backend to back up different directories. duplicity will tell you if you need this switch.
--archive-dir path The archive directory.  NOTE: This option changed in 0.6.0.  The archive directory is now necessary in order to manage persistence for current and future enhancements.  As such, this option is now used only to change the location of the archive directory.  The archive directory should not be deleted, or duplicity will have to recreate it from the remote repository (which may require decrypting the backup contents).
When backing up or restoring, this option specifies that the local archive directory is to be created in path.  If the archive directory is not specified, the default will be to create the archive directory in ~/.cache/duplicity/.
The archive directory can be shared between backups to multiple targets, because a subdirectory of the archive dir is used for individual backups (see --name ).
The combination of archive directory and backup name must be unique in order to separate the data of different backups.
The interaction between the --archive-dir and the --name options allows for four possible combinations for the location of the archive dir:
1.     neither specified (default) ~/.cache/duplicity/hash-of-url
2.     --archive-dir=/arch, no --name /arch/hash-of-url
3.     no --archive-dir, --name=foo ~/.cache/duplicity/foo
4.     --archive-dir=/arch, --name=foo /arch/foo
--asynchronous-upload (EXPERIMENTAL) Perform file uploads asynchronously in the background, with respect to volume creation. This means that duplicity can upload a volume while, at the same time, preparing the next volume for upload. The intended end-result is a faster backup, because the local CPU and your bandwidth can be more consistently utilized. Use of this option implies additional need for disk space in the temporary storage location; rather than needing to store only one volume at a time, enough storage space is required to store two volumes.
--backend-retry-delay number Specifies the number of seconds that duplicity waits after an error has occured before attempting to repeat the operation.
--cf-backend backend Allows the explicit selection of a cloudfiles backend. Defaults to pyrax.  Alternatively you might choose cloudfiles.
--b2-hide-files Causes Duplicity to hide files in B2 instead of deleting them. Useful in combination with B2's lifecycle rules.