I have never seen a command to retrieve all iptables tables or all iptables rules over all tables. What you usually find in documentation is the following:

    iptables contains five tables:
    raw is used only for configuring packets so that they are exempt from connection tracking.
    filter is the default table, and is where all the actions typically associated with a firewall take place.
    nat is used for network address translation (e.g. port forwarding).
    mangle is used for specialized packet alterations.
    security is used for Mandatory Access Control networking rules (e.g. SELinux -- see this article for more details).

My opinion: this is simple but pretty smart at the same time, therefore the perfect hacker tool. I can't even imagine a single sysadmin who searched for additional iptables tables before this leak.

To the dismissive people here: as a hacker you don't want complex attacking tools, they can be found much easier, because all the tools look for complex attacks (e.g. modified system files).

Hiding this well in plain sight in a place where no one and no tool ever looks is genius.