cyber-mastery - 754 curated cybersecurity skills and 14 synthesis

项目说明

<di="center">

🔐 Cyber Mastery Library

The Complete Offensive & Defensi Knowledge Base

754 skills. 14 synthesis docs. ~400KB of structured cybersecurity knowledge.
Built from the ground up — not scraped, not hallucinated.


</div>

---

What Is This?

A curated cybersecurity knowledge base — 754 indi skill documents co every major security domain, synthesized into 14 comprehensi guides. Each skill contains practical tool commands, attack methodologies, and detection techniques. The synthesis docs tie e together into cohesi guides.

Not a tool. Not a framework. A knowledge base you actually want to read.

---

📊 At a Glance

---

📚 Synthesis Documents

The crown jewels — 14 documents that synthesize hundreds of skills into actionable reference guides.

⚔️ Offensi

| # | Document | Size | What It Covers |
|---|----------|------|----------------|
| 1 | Recon & OSINT | 45KB | Passi recon, DNS enumeration, subdomain discovery, Shodan, SpiderFoot, BloodHound, certificate transparency, IOC collection |
| 2 | Network Pentest | 21KB | Nmap scanning, MITM attacks, ARP spoofing, SSL stripping, VLAN hopping, WiFi cracking, Zeek analysis, C2 beaconing detection |
| 3 | Web App Pentest | 25KB | SQL injection, XSS, XXE, SSRF, JWT attacks, WAF bypass, API/GraphQL testing, business logic flaws, CSP bypass |
| 4 | Exploitation & Post-Ex | 30KB | Metasploit, pri escalation (Linux + Windows), credential har, lateral mo, social engineering, phishing campaigns |
| 5 | AD & Windows | 26KB | Kerberos attacks, NTLM relay, ADCS (ESC1-8), DCSync, BloodHound, PowerShell attacks, Azure AD, event log analysis |
| 6 | Malware Analysis | 23KB | Static/dynamic analysis, Ghidra, YARA rules, C2 infrastructure, ransomware, deobfuscation, IOC extraction |
| 7 | Mobile & IoT | 17KB | Android/iOS testing, Frida, certificate pinning bypass, SCADA/ICS protocols, firmware extraction, OT security |

🛡️ Defensi

| # | Document | Size | What It Covers |
|---|----------|------|----------------|
| 8 | DFIR | 27KB | Incident response lifecycle, disk/memory forensics, timeline reconstruction, Windows/Linux artifacts, cloud forensics, e chain |
| 9 | Detection Engineering | 31KB | Splunk SPL rules, Sigma rules, detection-as-code, EDR, osquery, purple team operations, Atomic Red Team, SOC dashboards |
| 10 | Threat Intel & Hunting | 34KB | MITRE ATT&CK, MISP, STIX/TAXII, threat hunting methodology, ad profiling, dark web monitoring, CTI reports |

🏗️ Architecture & Go

| # | Document | Size | What It Covers |
|---|----------|------|----------------|
| 11 | Cloud & Containers | 36KB | AWS/GCP/Azure attack paths, Docker/K8s security, container escape, honeypots, deception technology |
| 12 | Crypto, API & Infra | 33KB | TLS/SSL, JWT, WAF, IDS/IPS, DDoS mitigation, zero trust networking, API security testing |
| 13 | Supply Chain & De | 31KB | SBOM, SAST/DAST/SCA, secrets scanning, Vault, Cosign, in-toto, CI/CD hardening |
| 14 | Identity & Zero Trust | 28KB | SSO/SAML, MFA/FIDO2, PAM, microsegmentation, ZTNA, identity go, JIT access |

---

🧰 Skills Library

754 indi skill documents organized by domain. Each skill contains:

<details>
<summary><strong>🔍 Reconnaissance & OSINT (26 skills)</strong></summary>

acquiring-disk-image-with-dd-and-dcfldd · analyzing-certificate-transparency-for-phishing · analyzing-typosquatting-domains-with-dnstwist · collecting-indicators-of-compromise · collecting-open-source-intelligence · conducting-external-reconnaissance-with-osint · performing-brand-monitoring-for-impersonation · performing-dns-enumeration-and-zone-transfer · performing-ip-reputation-analysis-with-shodan · performing-open-source-intelligence-gathering · performing-osint-with-spiderfoot · performing-subdomain-enumeration-with-subfinder · security-org-reconnaissance · analyzing-indicators-of-compromise · performing-actianalysis · conducting-domain-persistence-with-dcsync · ...

</details>

<details>
<summary><strong>🌐 Network Security (60 skills)</strong></summary>

conducting-network-penetration-test · scanning-network-with-nmap-ad · performing-network-forensics-with-wireshark · performing-network-traffic-analysis-with-tshark · performing-network-traffic-analysis-with-zeek · performing-arp-spoofing-attack-simulation · conducting-man-in-the-middle-attack-simulation · performing-ssl-stripping-attack · performing- · conducting-wireless-network-penetration-test · performing-wifi-password-cracking-with-aircrack · performing-bluetooth-security-assessment · detecting-beaconing-patterns-with-zeek · detecting-network-anomalies-with-zeek · implementing-network-traffic-baselining · performing-network-packet-capture-analysis · detecting-network-scanning-with-ids-signatures · ...

</details>

<details>
<summary><strong>💉 Web Application Security (32 skills)</strong></summary>

performing-web-application-penetration-test · testing-for-xss- · testing-for-xss-psuite · exploiting-sql-injection- · exploiting-sql-injection-with-sqlmap · testing-for-open-redirect- · testing-for-broken-access-control · testing-cors-misconfiguration · exploiting-ser · performing-ssrf-on · testing-for-xxe-injection- · exploiting-insecure-deserialization · testing-for-json-web-token- · performing-jwt-none-algorithm-attack · performing-web-application-firewall-bypass · performing-content-security-policy-bypass · performing-directory-tra · testing-for-business-logic- · performing-api-security-testing-with-postman · performing-graphql-security-assessment · exploiting-websocket- · ...

</details>

<details>
<summary><strong>💥 Exploitation & Post-Exploitation (67 skills)</strong></summary>

exploiting-asploit-framework · performing-priux · performing-priment · detecting-credential-dumping-techniques · performing-kerberoasting-attack · exploiting-kerberoasting-with-impacket · conducting-pass-the-ticket-attack · detecting-pass-the-hash-attacks · performing-lateral-mo · performing-lateral-mo · extracting-credentials-from-memory-dump · performing-credential-access-with-lazagne · deploying-acti · deploying-decoy-files-for-ransomware-detection · performing-ransomware-response · conducting-social-engineering-penetration-test · conducting-spearphishing-simulation-campaign · performing-red-team-phishing-with-gophish · ...

</details>

<details>
<summary><strong>🏢 Acti & Windows (38 skills)</strong></summary>

performing-acti-test · performing-actity-assessment · conducting-internal-reconnaissance-with-bloodhound-ce · exploiting-actiound · exploiting-acti-ser · detecting-golden-ticket-attacks-in-kerberos-logs · detecting-kerberoasting-attacks · detecting-dcsync-attack-in-acti · conducting-domain-persistence-with-dcsync · detecting-pass-the-hash-attacks · detecting-pass-the-ticket-attacks · analyzing-windows-e · analyzing-powershell-script-block-logging · detecting-suspicious-powershell-execution · hunting-for-persistence-mechanisms-in-windows · detecting-mimikatz-execution-patterns · analyzing-acti · ...

</details>

<details>
<summary><strong>🧬 Malware Analysis (66 skills)</strong></summary>

analyzing-android-malware-with-apktool · analyzing-bootkit-and-rootkit-samples · analyzing-cobalt-strike-beacon-configuration · analyzing-cobaltstrike-malleable-c2-profiles · analyzing-command-and-control-communication · analyzing-golang-malware-with-ghidra · analyzing-linux-elf-malware · analyzing-macro-malware-in-office-documents · analyzing-malicious-pdf-with-peepdf · analyzing-malware-beha · analyzing-packed-malware-with-upx-unpacker · analyzing-ransomware-encryption-mechanisms · deobfuscating-ja · deobfuscating-powershell-obfuscated-malware · ree-with-ghidra · re-malware-with-dnspy · performing-malware-triage-with-yara-rules · performing-yara-rule-de · ...

</details>

<details>
<summary><strong>📱 Mobile & IoT Security (26 skills)</strong></summary>

analyzing-android-malware-with-apktool · analyzing-ios-app-security-with-objection · performing-android-app-static-analysis-with-mobsf · performing-dynamic-analysis-of-android-app · performing-ios-app-security-assessment · performing-mobile-app-certificate-pinning-bypass · red-malware-with-jadx · rep-with-frida · performing-iot-security-assessment · performing-plc-firmware-security-analysis · performing-s7comm-protocol-security-analysis · detecting-modbus-protocol-anomalies · implementing-ics-firewall-with-tofino · performing-firmware-extraction-with-binwalk · ...

</details>

<details>
<summary><strong>🔬 Digital Forensics & Incident Response (43 skills)</strong></summary>

acquiring-disk-image-with-dd-and-dcfldd · analyzing-disk-image-with-autopsy · performing-memory-forensics-with- · performing-timeline-reconstruction-with-plaso · analyzing-windows-e · analyzing-windows-amcache-artifacts · analyzing-windows-registry-for-artifacts · analyzing-windows-shellbag-artifacts · analyzing-lnk-file-and-jump-list-artifacts · analyzing-prefetch-files-for-execution-history · extracting-windows-e · performing-linux-log-forensics-in · performing-file-car · analyzing-email-headers-for-phishing-in · ...

</details>

<details>
<summary><strong>🚨 Detection & Monitoring (127 skills)</strong></summary>

building-detection-rule-with-splunk-spl · building-detection-rules-with-sigma · implementing-siem-use-cases-for-detection · performing-false-positi · implementing-endpoint-detection-with-wazuh · deploying-osquery-for-endpoint-monitoring · configuring-snort-ids-for-intrusion-detection · configuring-suricata-for-network-monitoring · implementing-runtime-security-with-tetragon · implementing-ebpf-security-monitoring · performing-purple-team-exercise · performing-purple-team-atomic-testing · performing-threat-emulation-with-atomic-red-team · building-incident-response-dashboard · implementing-alert-fatigue-reduction · hunting-for-beaconing-with-frequency-analysis · hunting-for-cobalt-strike-beacons · hunting-for-data-exfiltration-indicators · ...

</details>

<details>
<summary><strong>🕵️ Threat Intelligence & Hunting (60 skills)</strong></summary>

analyzing-threat-actor-ttps-with-mitre-attack · analyzing-apt-group-with-mitre-na · analyzing-cyber-kill-chain · building-threat-intelligence-platform · building-threat-feed-aggregation-with-misp · collecting-threat-intelligence-with-misp · implementing-stix-taxii-feed-integration · building-threat-actor-profile-from-osint · profiling-threat-actor-groups · tracking-threat-actor-infrastructure · monitoring-darkweb-sources · building-threat-hunt-hypothesis-framework · performing-threat-hunting-with-yara-rules · generating-threat-intelligence-reports · ...

</details>

<details>
<summary><strong>☁️ Cloud & Container Security (96 skills)</strong></summary>

performing-cloud-penetration-testing-with-pacu · performing-aws-account-enumeration-with-scout-suite · performing-aws-priment · detecting-aws-iam-pri · auditing-gcp-iam-permissions · detecting-misconfigured-azure-storage · detecting-azure-ser · performing-container-escape-detection · performing-docker-bench-security-assessment · performing-kubernetes-penetration-testing · performing-kubernetes-cis-benchmark-with-kube-bench · scanning-container-images-with-grype · hardening-docker-containers-for-production · implementing-honeypot-for-ransomware-detection · ...

</details>

<details>
<summary><strong>🔐 Crypto, API & Infrastructure (53 skills)</strong></summary>

configuring-tls-1-3-for-secure-communications · performing-ssl-tls-security-assessment · configuring-certificate-authority-with-openssl · exploiting-jwt-algorithm-confusion-attack · implementing-jwt-signing-and- · conducting-api-security-testing · implementing-api-rate-limiting-and-throttling · performing-api-fuzzing-with-restler · configuring-pfsense-firewall-rules · configuring-snort-ids-for-intrusion-detection · implementing-ddos-mitigation-with-cloudflare · implementing-cloud-waf-rules · implementing-zero-trust-network-access · ...

</details>

<details>
<summary><strong>🔗 Supply Chain & De (61 skills)</strong></summary>

analyzing-sbom-for-supply-chain- · building-detlab-ci · integrating-sast-into-github-actions-pipeline · integrating-dast-with-owasp-zap-in-pipeline · implementing-secret-scanning-with-gitleaks · implementing-image-proh-cosign · implementing-supply-chain-security-with-in-toto · implementing-hashicorp- · implementing-prit-with-cyberark · implementing-just-in-time-access-pro · ...

</details>

<details>
<summary><strong>🆔 Identity & Zero Trust (34 skills)</strong></summary>

implementing-zero-trust-in-cloud · implementing-zero-trust-network-access · implementing-zero-trust-with-beyondcorp · implementing-cisa-zero-trust-maturity-model · implementing-multi-factor-authentication-with-duo · implementing-passwordless-authentication-with-fido2 · implementing-saml-sso-with-okta · implementing-identity-go · deploying-tailscale-for-zero-trust-vpn · deploying-cloudflare-access-for-zero-trust · implementing-microsegmentation-with-guardicore · ...

</details>

---

🗺️ Reading Paths

For Pentesters:

For Blue Team:

For Architects:

For Full Co:

---

🔧 What Makes This Different

| Feature | This Library | Other Resources |
|---------|-------------|-----------------|
| Practical | Actual tool commands, not theory | "You should use Nmap" |
| Synthesized | 754 skills → 14 coherent guides | Scattered blog posts |
| Offensive + Defensive | Both perspectives in every doc | One or the other |
| ATT&CK Mapped | Techniques linked to IDs | Ad hoc references |
| Cross-Referenced | Docs link to each other | Isolated articles |
| Free | MIT licensed | Paywalled courses |

---

📁 Repository Structure

---

🚀 Quick Start

---

🤝 Contributing

This is a living knowledge base. Contributions welcome:

---

📜 License

MIT — Use it, fork it, build on it. Attribution appreciated but not required.

---

<di="center">

Built by Leo & Cyrus — a human and his autonomous AI agent.

*The knowledge is free. What you build with it is yours.*

</div>

项目信息

开发语言：Python

Star 数：2

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕754 curated cybersecurity skills and 14 synthesis reference docs — offensive, defensive, architectural展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。