Common commands for logging and timestamping terminal history during pentests.
Keeping a timestamped, logged record of everything you type is worth the small amount of setup, both for your own notes and as evidence for a client report.
Timestamp your ZSH history
fc -li # List history with timestampsfc -li 100 # List the last 100 commands with timestampsAdd the following to the end of .zshrc to show the timestamp in your right-hand prompt:
RPROMPT="[%D{%f/%m/%y} | %D{%H:%M:%S}]"Log full terminal sessions to disk
sudo mkdir /var/log/shellsudo chmod 777 /var/log/shelltest "$(ps -ocommand= -p $PPID | awk '{print $1}')" == 'script' || (script -f /var/log/shell/$(date +"%d-%b-%y_%H-%M-%S")_shell.log)Session logs will contain terminal colour codes. Strip them out before sharing a log:
sed 's/\x1b\[[0-9;]*m//g' session.log



