👻 To-do 👻

To stuff to read: ired.team.

Stuff that I found, but never read/used yet. See also the Blogs section.

Pentesting certification

  • OSCP
  • GPEN
  • GXPN

Reading articles

Practice

Networking

Windows

Linux

  • ...

OSINT

Cloud

  • Attacking and Defending AWS
Big THM CTF List 
https://tryhackme.com/room/easyctf (notes below?)
https://tryhackme.com/room/puttingitalltogether (no tags?)
https://tryhackme.com/room/surfer
https://tryhackme.com/room/lazyadmin
https://tryhackme.com/room/ninjaskills
https://tryhackme.com/room/gamezone
https://tryhackme.com/room/skynet
https://tryhackme.com/room/alfred
https://tryhackme.com/room/brooklynninenine
https://tryhackme.com/room/tomghost
https://tryhackme.com/room/lianyu
https://tryhackme.com/room/cyborgt8
https://tryhackme.com/room/breakoutthecage1
https://tryhackme.com/room/blog
https://tryhackme.com/room/jason
https://tryhackme.com/room/source
https://tryhackme.com/room/committed
https://tryhackme.com/room/corridor
https://tryhackme.com/room/easypeasyctf
https://tryhackme.com/room/toolsrus
https://tryhackme.com/room/kiba (capabilities)
https://tryhackme.com/room/gamingserver
https://tryhackme.com/room/bruteit
https://tryhackme.com/room/ctf
https://tryhackme.com/room/dejavu
https://tryhackme.com/room/tonythetiger (java)
https://tryhackme.com/room/gamezone
https://tryhackme.com/room/ohsint
https://tryhackme.com/room/skynet
https://tryhackme.com/room/25daysofchristmas
https://tryhackme.com/room/adventofcyber2
https://tryhackme.com/room/adventofcyber3
--- Medium
https://tryhackme.com/room/ultratech1 (web - guided?)
https://tryhackme.com/room/hackpark (windows, guided)
https://tryhackme.com/room/anonymous (nmap, smb?, ...)
https://tryhackme.com/room/overpass2hacked
https://tryhackme.com/room/overpass3hosting (web/...) 
--- Hard
https://tryhackme.com/room/mrrobot
https://tryhackme.com/room/dailybugle
https://tryhackme.com/room/retro (blaster...)

Long list of tools

Legend

  • 🔎 = Investigation
  • 🏝️ = Discovery
  • 💥 = Exploitation
  • 🔑 = Privilege escalation
  • ✈️ = Post-exploitation
  • 🛡️ = Defense
  • 🃏️ = Special

Tools

  • legion (🏝️💥✈️) (automated penetration framework)
  • beyondsecurity (🔎🏝💥) (vulnerability scanner)
  • KitHack (🔎🏝💥✈️) (penetration testing framework)
  • hoaxshell (🔎🏝💥) (subdomain, IP scan, CMS identification)
  • Villain (🔎✈️) (post-exploitation framework)
  • OWASP Amass (🏝) (subdomain, DNS, and port scanning)
  • HackTools (🔎🏝💥) (bunch of tools)
  • TheFatRat (💥✈️) (backdoors and payloads)
  • Phantom-Evasion (💥✈️) (generate and obfuscate Windows payload)
  • msfpc (💥✈️) (generating Metasploit payloads)
  • arsenal (✈️) (data exfiltration)
  • hackertarget (🏝) (port scanning, traceroute, and reverse IP)
  • Raccoon (🏝) (subdomain, OSINT)
  • Photon (🏝) (web enumeration, subdomains)
  • Hping3 (💥) (firewall bypass, port/os scanning, -S -p SA/RA --flood)
  • QualysGuard (🔎🔑✈️) (cloud-based vulnerability scanner)
  • Acunetix (🔎💥) (web vulnerability scanner)
  • Nexpose (🔎🔑✈️) (network vulnerability scanner)
  • Retina (🔎🔑✈️) (vulnerability scanner)
  • Nipper (🔎) (network devices scanner)
  • Nettacker (🏝💥) (port scanning, vulnerability scanning)
  • Empire (✈️) (post-exploitation framework)
  • DSSS (🏝💥) (SQL vulnerability scanner)
  • Beef (💥✈️🛡️) (7.8k ⭐, client-side vulnerability scanner)
  • host (🔎🏝) (DNS lookup)
  • dnswalk (🔎🏝) (DNS investigation)
  • dnsmap (🔎🏝) (vhost brute force)
  • Netsparker (🏝💥✈️) (web vulnerability scanner)
  • Skipfish (🏝) (11.4k ⭐, web vulnerability scanner)
  • W3af (🏝💥🔑) (web vulnerability scanner)
  • Arachni (🏝💥) (web vulnerability scanner)
  • AppScan (🏝💥) (web vulnerability scanner)
  • IronWASP (🏝💥) (web vulnerability scanner)
  • Grabber (🏝💥) (web vulnerability scanner)
  • proxify (✈️) (HTTP proxy)
  • interactsh (✈️) (rogue server)
  • naabu (🏝) (network scanner)
  • nuclei (🏝💥) (web application scanner)
  • dnsx (🏝) (dns enumeration)
  • bettercap (💥) (sniffing, MITM)
  • evilgrade (💥✈️) (exploiting update systems, MITM)
  • CodeSec (🏝💥) (web vulnerability scanner)
  • venom (🔎🏝💥🔑✈️) (payloads? -h/-c/-u/-p/-s, scan/crawl/portscan)
  • Burp Collaborator client (🃏) (server for SSRF/XXE/...)
  • recon-ng (🔎) (reconnaissance framework)
  • Archive.is (🔎) (web archive)
  • CommonCrawl (🔎) (web crawler)
  • Netcraft (🔎) (web investigation)
  • PassiveTotal (🔎) (IP/domains/email analysis)
  • intelius/zabasearch (🔎) (people search engines)
  • peoplefinder (🔎) (people search engines)
  • Pipl (🔎) (people search engines)
  • awesome-osint (🔎) (12.1k ⭐, list of tools)
  • OSINT-Tools (🔎) (list of tools)
  • Social Mapper (🔎🏝) (socmint)
  • StalkScan (🔎) (facebook recon)
  • SpiderFoot (🔎🏝✈️) (9.4k ⭐, Automated OSINT)
  • BeautifulSoup (🔎) (Web scrapping)
  • Scrapy (🔎) (Web scrapping)
  • FMiner (🔎🏝) (Web scrapping)
  • Octoparse (🔎🏝) (Web scrapping)
  • ParseHub (🔎🏝) (Web scrapping)
  • Tor Browser (🔎✈️) (web browser)
  • DarkSearch (🏝) (darknet search engine)
  • Ahmia (🏝) (tor search engine)
  • OnionScan (🔎) (scan the Tor network)
  • Censys (🔎🏝) (Device/Network search engine)
  • Zoomeye (🔎🏝) (Chinese device/network search engine)
  • BinaryEdge (🔎🏝) (Device search engine)
  • Fofa (🔎🏝) (Device/Network search engine)
  • Shikata ga nai (💥) (payloads)
  • unicorn (💥) (payload, shellcode injection)
  • cobalt strike (💥✈️) (penetration testing tool)
  • searchlight (🔎) (OSINT)
  • WebScarab (🔎🏝) (intercept HTTP requests)
  • Vega (🔎🏝) (web application scanner)
  • Aircrack-ng (💥🔑) (analyze traffic, crack WEP/WPA/... passwords)
  • Kismet (🏝) (wireless network detection and analysis)
  • MBSA (🏝) (scan Windows-based computers for vulnerabilities)
  • Cain and Abel (💥🔑✈️) (password recovery, sniffing, MITM, spoofing)
  • Ettercap (💥🔑✈️) (sniffing, MITM, spoofing)
  • Greenbone (🏝) (vulnerability management)
  • AppDetectivePro (🏝🛡️) (Database vulnerability scanners)
  • Dbprotect (🏝🛡️) (Database vulnerability scanners)
  • sputnik (🔎) (OSINT scanner)
  • netdiscover (🏝) (network discovery, -r IP|IP/CIDR)
  • Mxtoolbox (🔎) (email configuration)
  • hp webinspect (🏝💥) (web application scanner)
  • Linsniff (✨) (packet capture and analysis)
  • Websniff (✨) (packet capture and analysis)
  • Snoop (✨) (packet capture and analysis)
  • sslyzer (🏝) (SSL scanner and analyzer)
  • webslayer (🏝) (web application scanner)
  • Tamper Chrome|tamper.dev (🏝💥) (intercept HTTP request)
  • httpx (🏝💥) (web server enumeration)
  • Core Impact (💥🔑✈️) (paid exploitation framework)
  • chaos (🔎) (DNS recon)
  • Veil Framework (💥) (payloads)
  • Phantom-Evasion (✈️) (antivirus evasion tool)
  • FavFreak (🏝) (favicon recon)
  • waybackurls (🔎) (wayback tool)
  • EyeWitness
  • ptunnel
  • sshuttle
  • red-team-scripts
  • NetworkMiner
  • NetWitness
  • MailSniper
  • EXOCET
  • HackBrowserData
  • AutoRecon
  • Kismet
  • ssf
  • pupy
  • nishang
  • Mythic (c2 framework)
  • darkarmour (antivirus evasion tool)

Specific tools

Android

Joker

Active directory 🧸

CMS

  • None

Defense

  • ghidra (🛡️) (reverse engineering)

CTFs not done

https://tryhackme.com/room/easyctf 🐍🐍⭐

  • python2 simple.py
  • oh gosh, volatily + pip install --upgrade setuptools https://stackoverflow.com/questions/31719816/pip-fails-to-install-anything-error-invalid-command-egg-info
  • print "[+] Specify an url target"

https://tryhackme.com/room/lazyadmin 🐍🐍⭐

  • nmap
  • Gobuster
  • FTP do not seem to work with path (to upload with put, but it works if you start FTP in the directory where the file is)

https://tryhackme.com/room/allinonemj 🐍🐍⭐

  • Test: wpscan --url http://10.10.162.222/wordpress/ --detection-mode aggressive
  • php://filter/convert.base64-encode/resource=../../../../../wp-config.php (file inclusion, https://www.idontplaydarts.com/2011/02/using-php-filter-for-local-file-inclusion/)

👻 To-do 👻

Stuff that I found, but never read/used yet.

https://github.com/vitalysim/Awesome-Hacking-Resources
https://redteam.guide/ (book)
https://www.hackers-arise.com (book)
Hack Like a LEGEND (book)
https://ippsec.rocks/?#

OSINT