# Cazalla Commands

Complete documentation for all Cazalla agent commands, organized by category.

## File System Commands

- [`ls`](ls.md) - List directory contents
- [`cd`](cd.md) - Change directory
- [`pwd`](pwd.md) - Print working directory
- [`cat`](cat.md) - Read file contents (with credential detection)
- [`cp`](cp.md) - Copy files
- [`mkdir`](mkdir.md) - Create directory
- [`rm`](rm.md) - Delete file/directory
- [`download`](download.md) - Download file from target
- [`upload`](upload.md) - Upload file to target

## Process Management Commands

- [`ps`](ps.md) - List processes
- [`kill`](kill.md) - Terminate process

## Token Operations

- [`list_tokens`](list_tokens.md) - Enumerate tokens
- [`steal_token`](steal_token.md) - Steal process token
- [`make_token`](make_token.md) - Create token from credentials
- [`rev2self`](rev2self.md) - Revert to original token
- [`whoami`](whoami.md) - Display current context

## Network Tunneling

- [`socks`](socks.md) - Start/stop SOCKS5 proxy
- [`rpfwd`](rpfwd.md) - Start/stop reverse port forwarding

## System Operations

- [`shell`](shell.md) - Execute shell commands
- [`browser_info`](browser_info.md) - Identify installed browsers
- [`browser_dump`](browser_dump.md) - Dump browser credentials
- [`screenshot`](screenshot.md) - Capture desktop screenshot
- [`keylog_start`](keylog_start.md) - Start keylogger
- [`keylog_stop`](keylog_stop.md) - Stop keylogger

## Code Execution

- [`inline_execute`](inline_execute.md) - Execute Beacon Object Files (BOFs)
- [`inline_execute_assembly`](inline_execute_assembly.md) - Execute .NET assemblies in-process
- [`execute_assembly`](execute_assembly.md) - Execute .NET assemblies in remote processes

## Control Commands

- [`sleep`](sleep.md) - Adjust beacon interval
- [`exit`](exit.md) - Terminate agent

---

[Back to Cazalla Documentation](../../../README.md)