Cybersecurity
My notes notes about Cybersecurity.
Websites to learn, practice, find news, look for news, along with CVE lookup, credentials leak lookup, or stuff like that.
Virtual Machines
readNotes/links to find a VM (Windows, Kali, CTF...) and install it.
H@king process
readH@king box
readStuff that couldn't be put somewhere else.
1. Investigation 🔎
Investigation
readStep 1: Dig information from afar.
Investigate Files
readFind metadata from a PDF, an image... Learn about steganography, tricks...
2. Discovery 🗺️
Discovery
readStep 2: approach your targets to learn more about them.
The Network Mapper. Find open ports, running services, and common vulnerabilities.
Automated though noisy tool to find open ports, running services, many vulnerabilities...
Services 🧟️
Discovery & Exploitation
Services
readNotes about discovery/misconfigurations of services (SSH, FTP, SMTP...).
Brute force services
readUse hydra to brute force SSH, FTP...
Printers
readHow to exploit printers.
3. Exploitation 💥
Exploitation
readStep 3: exploit a vulnerability to get something from your target.
Exploitation: Shells
readLearn about reverse, bind, and web shells. Learn about tools/techniques to stabilize them.
The Metasploit framework, a well-known penetration testing tool.
Utility to generate a bind/reverse shells, along with notes about meterpreter reverse shells and multi handler.
Exploitation: Web - part 1 🕸️
Exploit webservers
readNotes on webservers.
Methodology
readSteps and tools to exploit webservers.
HTTP Headers
readLearn how HTTP headers could be exploited.
Fuzzing / Fuzz
readSomething that can be used for many things (forced browsing, brute force...).
Forced browsing
readFind routes, hidden folders/files, configuration-related files...
Subdomains
readExpand your attack scope by discovering new domains.
Frameworks
readFind and exploit frameworks such as WordPress.
Cookies
readCookies/Sessions vulnerabilities
XML External Entity
readXML External Entity (XEE)
Exploitation: Web - part 2 🕸️
Forms
readKnowledge related to forms.
Brute force Forms
readExamples with ffuf, wfuzz, hydra...
File/Path exploits
readFile inclusion and Path Traversal
XSS (JavaScript)
readXSS vulnerabilities
SSRF
readServer-Side Request Forgery
Command injection
readA flaw may lead to Remote Command Execution (RCE).
File upload
readA flaw may lead to Remote Code Execution (RCE).
Suite of tools for web pentesting.
Exploitation: Network 🌐
Exploit network
readNotes about networking tools.
Exploitation: Databases 🖥️
Exploit databases
readNotes about databases.
SQL injections
readLearn about SQLi (SQL injections).
Tool to automate SQLi exploitation.
4. Privilege escalation 🔓
Privilege escalation
readMethodology used from a regular user to get an administrative account.
Linux Priv. Esc.
readKey escalation vectors on Linux.
Windows Priv. Esc.
readKey escalation vectors on Windows.
5. Post-exploitation 🧹
Post-exploitation
readOnce you got root/system/administrator, what do hackers do?
🛡️️ Defense ⚔️️
Tools for IP/malware lookup...
Digital Forensics
readNotes about forensics, i.e. investigating cyber crimes.