ReconDock By Kdairatchi
Go To ReconDock
MyRepo
MyRepo
  • Pastebin Services
  • Awesome Ai Talk
  • Bug Bounty Testing, Techniques, and Tools
  • Cybersources
  • Targets
  • Bug checklist
  • Bug Bounty Platforms
  • Awesome Bug Bounty Tips Awesome
    • CVE Exploits and PoC Collection
  • ============ Awesome Bugs
    • Awesome One-liner Bug Bounty
  • Awesome CS Courses
  • Awesome Cyber Co
  • Awesome Dev
  • Awesome Free Certs
  • Awesome Git
  • Awesome Github
  • Awesome Go
  • Awesome Interviews
  • Awesome Keys
  • Awesome Mac OpenSource
  • Awesome Mac
  • Awesome Python
    • Awesome Tool
  • Awesome-Selfhosted
    • Awesome Hacker Search Engines
  • Awesome Shell
  • Awesome Shodan Search Queries
  • Awesome Static Website Services Awesome
  • Awesome Vulnerable Applications
  • Awesome WAF
  • Awesome First PR Opportunities
  • Awesome-Bugbounty-Writeups
  • Awesome-web3-Security awesome
  • Bug-Bounty
  • CTF Tools
  • Awesome Blockchain Bug Bounty
  • Awesome Bug Bounty
  • awesome-design-systems
  • Awesome Google VRP Writeups
  • Web Scraping
  • awesome
  • bug-bounty-reference
  • the-book-of-secret-knowledge
  • APACHE
  • AWS
  • AZURE
  • CISCO
  • CLOUDFLARE
  • Cross Origin Resource Sharing (CORS)
  • CRLF Injection || HTTP Response Splitting
  • CSV Injection
  • Content Injection
  • CRLF Injection || HTTP Response Splitting
  • JENKINS
  • JIRA
  • LFI
  • OR
  • PostgreSQL Environment Variable Manipulation Vulnerability
  • RCE
  • Recon
  • SSRF
  • Proof OF Concept (POC): SharePoint Vulnerability Detection
  • Template Injection
  • WORDPRESS
  • XSLT Injection
  • XSS
  • XXE
  • Books
  • Firebase Subdomain Enumeration & PoC Testing
  • SQLI
  • Special Tools
  • Account Takeover
  • Authentication
  • Broken Link Hijacking
  • Business Logic Errors
  • Default Credentials
  • Email Spoofing
  • ExposedAPIkeys
  • ForgotPasswordFunctionality
  • JWT Vulnerabilities
  • OWASPTestingChecklist1
  • Tabnabbing
  • Web Cache Poisoning
  • Wordpress Endpoints to look
  • lfi_vulnerble_targets
  • (LFI)passwrd
  • LostSec
  • POCS
    • CVES
      • CVE-2021-36873
      • BreadcrumbsSQL_Injection_cve_2024
      • CVE-2024-0195
      • CVE-2024-29269 Exploit
  • 403-ByPass
  • Chat-bot_xss_payloads
  • burp
    • Match & Replace
    • Zap
  • cloudflare-waf-bypass
  • infosec
    • Customize the bash shell environments
    • automation
    • Website Ideas
  • 2FA bypass
  • Account Takeover
  • OWASP Web Application Security Testing Checklist
  • Projects
  • OWASP Top Ten
  • links
  • Bug Bounty Builder ¯\(ツ)/¯
  • Awesome
    • AllAboutBugBounty: All about bug bounty (bypasses, payloads, and etc)
  • Cheatsheets
  • Checklists
    • Here’s a clear, step by step breakdown of commands, tools, and objectives for each section in your Web Security Testing Guide (WSTG). Each test includes easy to follow commands, explanations, and examples where applicable.
  • Dorks
  • Scripts
  • Loads
  • OWASP
    • Checklist
  • ai
    • Ai Best for Information and Coding
  • Medium Recent Writeups
  • 🌟 Useful Extensions for Bug Bounty Hunting 🌟
  • Customize the bash shell environments
  • Fabric
    • Test Application Platform Configuration
  • Docker
  • Git auto
  • Bug Bounty Beginner's Roadmap
  • Methodology 2025
    • Advanced Recon Methodology
Powered by GitBook
On this page
  • What is it?
  • For whom?
  • Contributing
  • Support
  • Todo
  • Table of Contents
  • The Book of Secret Knowledge (Chapters)

the-book-of-secret-knowledge

Previousbug-bounty-referenceNextAPACHE

Last updated 4 months ago

Master

"Knowledge is powerful, be careful how you use it!"

A collection of inspiring lists, manuals, cheatsheets, blogs, hacks, one-liners, cli/web tools and more.


This list is a collection of various materials that I use every day in my work. It contains a lot of useful information gathered in one piece.

This collection is suitable for everyone. It is aimed towards System and Network administrators, DevOps, Pentesters and Security Researchers.

If you find something which doesn't make sense, or something doesn't seem right, please make a pull request and please add valid and well-reasoned explanations about your changes or comments.

A few simple rules for this project:

  • inviting and clear

  • not tiring

  • useful

These below rules may be better:

  • easy to contribute to (Markdown + HTML ...)

  • easy to find (simple TOC, maybe it's worth extending them?)

Url marked * is temporary unavailable. Please don't delete it without confirming that it has permanently expired.

If this project is useful and important for you or if you really like the-book-of-secret-knowledge, you can bring positive energy by giving some good words or supporting this project. Thank you!

Only main chapters:

Build your own DNS Servers

Build your own Certificate Authority

Build your own System/Virtual Machine

DNS Servers list (privacy)

IP

URL

84.200.69.80

94.247.43.254

64.6.64.6

89.233.43.71

1.1.1.1

94.130.110.185

TOP Browser extensions

Extension name

Description

IPvFoo

Display the server IP address and HTTPS information across all page elements.

FoxyProxy

Simplifies configuring browsers to access proxy-servers.

HTTPS Everywhere

Automatically use HTTPS security on many sites.

uMatrix

Point & click to forbid/allow any class of requests made by your browser.

uBlock Origin

An efficient blocker: easy on memory and CPU footprint.

Session Buddy

Manage browser tabs and bookmarks with ease.

SuperSorter

Sort bookmarks recursively, delete duplicates, merge folders and more.

Clear Cache

Clear your cache and browsing data.

d3coder

Encoding/Decoding plugin for various types of encoding.

Web Developer

Adds a toolbar button with various web developer tools.

ThreatPinch Lookup

Add threat intelligence hover tool tips.

TOP Burp extensions

Extension name

Description

Autorize

Automatically detects authorization enforcement.

Reflection

An efficient blocker: easy on memory and CPU footprint.

Logger++

Logs requests and responses for all Burp tools in a sortable table.

Bypass WAF

Adds headers useful for bypassing some WAF devices.

JSON Beautifier

Beautifies JSON content in the HTTP message viewer.

JSON Web Tokens

Enables Burp to decode and manipulate JSON web tokens.

CSP Auditor

Displays CSP headers for responses, and passively reports CSP weaknesses.

CSP-Bypass

Passively scans for CSP headers that contain known bypasses..

Hackvertor

Converts data using a tag-based configuration to apply various encoding.

Active Scan++

Extends Burp's active and passive scanning capabilities.

HTML5 Auditor

Scans for usage of risky HTML5 features.

Software Vulnerability Scanner

Software vulnerability scanner based on Vulners.com audit API.

Table of Contents

System

Reload shell without exit

exec $SHELL -l

Close shell keeping all subprocess running

disown -a && exit

Exit without saving shell history

kill -9 $$
unset HISTFILE && exit

Perform a branching conditional

true && echo success
false || echo failed

Pipe stdout and stderr to separate commands

some_command > >(/bin/cmd_for_stdout) 2> >(/bin/cmd_for_stderr)

Redirect stdout and stderr each to separate files and print both to the screen

(some_command 2>&1 1>&3 | tee errorlog ) 3>&1 1>&2 | tee stdoutlog

List of commands you use most often

history | \
awk '{CMD[$2]++;count++;}END { for (a in CMD)print CMD[a] " " CMD[a]/count*100 "% " a;}' | \
grep -v "./" | \
column -c3 -s " " -t | \
sort -nr | nl |  head -n 20

Quickly backup a file

cp filename{,.orig}

Empty a file (truncate to 0 size)

>filename

Delete all files in a folder that don't match a certain file extension

rm !(*.foo|*.bar|*.baz)

Pass multi-line string to a file

# cat  >filename ... - overwrite file
# cat >>filename ... - append to file
cat > filename << __EOF__
data data data
__EOF__

Edit a file on a remote host using vim

vim scp://user@host//etc/fstab

Create a directory and change into it at the same time

mkd() { mkdir -p "$@" && cd "$@"; }

Convert uppercase files to lowercase files

rename 'y/A-Z/a-z/' *

Print a row of characters across the terminal

printf "%`tput cols`s" | tr ' ' '#'

Show shell history without line numbers

history | cut -c 8-
fc -l -n 1 | sed 's/^\s*//'

Run command(s) after exit session

cat > /etc/profile << __EOF__
_after_logout() {

  username=$(whoami)

  for _pid in $(ps afx | grep sshd | grep "$username" | awk '{print $1}') ; do

    kill -9 $_pid

  done

}
trap _after_logout EXIT
__EOF__

Generate a sequence of numbers

for ((i=1; i<=10; i+=2)) ; do echo $i ; done
# alternative: seq 1 2 10

for ((i=5; i<=10; ++i)) ; do printf '%02d\n' $i ; done
# alternative: seq -w 5 10

Mount a temporary ram partition

mount -t tmpfs tmpfs /mnt -o size=64M
  • -t - filesystem type

  • -o - mount options

Remount a filesystem as read/write

mount -o remount,rw /

Kills a process that is locking a file

fuser -k filename

Show what PID is listening on specific port

fuser -v 53/udp

Show a 4-way scrollable process tree with full details

ps awwfux | less -S

Processes per user counter

ps hax -o user | sort | uniq -c | sort -r

Find files that have been modified on your system in the past 60 minutes

find / -mmin 60 -type f

Find all files larger than 20M

find / -type f -size +20M

Find duplicate files (based on MD5 hash)

find -type f -exec md5sum '{}' ';' | sort | uniq --all-repeated=separate -w 33

Change permission only for files

cd /var/www/site && find . -type f -exec chmod 766 {} \;
cd /var/www/site && find . -type f -exec chmod 664 {} +

Change permission only for directories

cd /var/www/site && find . -type d -exec chmod g+x {} \;
cd /var/www/site && find . -type d -exec chmod g+rwx {} +

Find files and directories for specific user

find . -user <username> -print

Find files and directories for all without specific user

find . \!-user <username> -print

Delete older files than 60 days

find . -type f -mtime +60 -delete

Recursively remove all empty sub-directories from a directory

find . -depth  -type d  -empty -exec rmdir {} \;

How to find all hard links to a file

find </path/to/dir> -xdev -samefile filename

Recursively find the latest modified files

find . -type f -exec stat --format '%Y :%y %n' "{}" \; | sort -nr | cut -d: -f2- | head

Recursively find/replace of a string with sed

find . -not -path '*/\.git*' -type f -print0 | xargs -0 sed -i 's/foo/bar/g'

Recursively find suid executables

find / \( -perm -4000 -o -perm -2000 \) -type f -exec ls -la {} \;

Use top to monitor only all processes with the specific string

top -p $(pgrep -d , <str>)
  • <str> - process containing str (eg. nginx, worker)


Track child process

strace -f -p $(pidof glusterfsd)

Track process after 30 seconds

timeout 30 strace $(< /var/run/zabbix/zabbix_agentd.pid)

Track child process and redirect output to a file

ps auxw | grep 'sbin/[a]pache' | awk '{print " -p " $2}' | xargs strace -o /tmp/strace-apache-proc.out

Track the open request of a network port

strace -f -e trace=bind nc -l 80

Track the open request of a network port (show TCP/UDP)

strace -f -e trace=network nc -lu 80

Kill a process running on port

kill -9 $(lsof -i :<port> | awk '{l=$2} END {print l}')

Compare two directory trees

diff <(cd directory1 && find | sort) <(cd directory2 && find | sort)

Annotate tail -f with timestamps

tail -f file | while read ; do echo "$(date +%T.%N) $REPLY" ; done

Analyse an Apache access log for the most common IP addresses

tail -10000 access_log | awk '{print $1}' | sort | uniq -c | sort -n | tail

Analyse web server log and show only 5xx http codes

tail -n 100 -f /path/to/logfile | grep "HTTP/[1-2].[0-1]\" [5]"

System backup with exclude specific directories

cd /
tar -czvpf /mnt/system$(date +%d%m%Y%s).tgz --directory=/ \
--exclude=proc/* --exclude=sys/* --exclude=dev/* --exclude=mnt/* .

System backup with exclude specific directories (pigz)

cd /
tar cvpf /backup/snapshot-$(date +%d%m%Y%s).tgz --directory=/ \
--exclude=proc/* --exclude=sys/* --exclude=dev/* \
--exclude=mnt/* --exclude=tmp/* --use-compress-program=pigz .

System backup to file

dump -y -u -f /backup/system$(date +%d%m%Y%s).lzo /

Restore system from lzo file

cd /
restore -rf /backup/system$(date +%d%m%Y%s).lzo

Limit the cpu usage of a process

cpulimit -p pid -l 50

Show current working directory of a process

pwdx <pid>

Start a command on only one CPU core

taskset -c 0 <command>

Show directories in the PATH, one per line

tr : '\n' <<<$PATH

Remove executable bit from all files in the current directory

chmod -R -x+X *

Restore permission for /bin/chmod

# 1:
cp /bin/ls chmod.01
cp /bin/chmod chmod.01
./chmod.01 700 file

# 2:
/bin/busybox chmod 0700 /bin/chmod

# 3:
setfacl --set u::rwx,g::---,o::--- /bin/chmod

Find last reboot time

who -b

Detect a user sudo-su'd into the current shell

[[ $(who -m | awk '{ print $1 }') == $(whoami) ]] || echo "You are su-ed to $(whoami)"

Was the last reboot a panic?

(last -x -f $(ls -1t /var/log/wtmp* | head -2 | tail -1); last -x -f /var/log/wtmp) | grep -A1 reboot | head -2 | grep -q shutdown && echo "Expected reboot" || echo "Panic reboot"

Start screen in detached mode

screen -d -m [<command>]

Record and replay terminal session

### Record session
# 1)
script -t 2>~/session.time -a ~/session.log

# 2)
script --timing=session.time session.log

### Replay session
scriptreplay --timing=session.time session.log

Show 20 biggest directories with 'K M G'

du | \
sort -r -n | \
awk '{split("K M G",v); s=1; while($1>1024){$1/=1024; s++} print int($1)" "v[s]"\t"$2}' | \
head -n 20

Init tool everytime a file in a directory is modified

while true ; do inotifywait -r -e MODIFY dir/ && ls dir/ ; done;

Testing connection to remote host

echo | openssl s_client -connect google.com:443 -showcerts

Testing connection to remote host (with SNI support)

echo | openssl s_client -showcerts -servername google.com -connect google.com:443

Testing connection to remote host with specific ssl version

openssl s_client -tls1_2 -connect google.com:443

Testing connection to remote host with specific ssl cipher

openssl s_client -cipher 'AES128-SHA' -connect google.com:443

Generate private key

# _len: 2048, 4096
( _fd="private.key" ; _len="4096" ; \
openssl genrsa -out ${_fd} ${_len} )

Generate private key with passphrase

# _ciph: des3, aes128, aes256
# _len: 2048, 4096
( _ciph="aes128" ; _fd="private.key" ; _len="4096" ; \
openssl genrsa -${_ciph} -out ${_fd} ${_len} )

Remove passphrase from private key

( _fd="private.key" ; _fd_unp="private_unp.key" ; \
openssl rsa -in ${_fd} -out ${_fd_unp} )

Encrypt existing private key with a passphrase

# _ciph: des3, aes128, aes256
( _ciph="aes128" ; _fd="private.key" ; _fd_pass="private_pass.key" ; \
openssl rsa -${_ciph} -in ${_fd} -out ${_fd_pass}

Check private key

( _fd="private.key" ; \
openssl rsa -check -in ${_fd} )

Get public key from private key

( _fd="private.key" ; _fd_pub="public.key" ; \
openssl rsa -pubout -in ${_fd} -out ${_fd_pub} )

Generate private key + csr

( _fd="private.key" ; _fd_csr="request.csr" ; _len="4096" ; \
openssl req -out ${_fd_csr} -new -newkey rsa:${_len} -nodes -keyout ${_fd} )

Generate csr

( _fd="private.key" ; _fd_csr="request.csr" ; \
openssl req -out ${_fd_csr} -new -key ${_fd} )

Generate csr (metadata from exist certificate)

( _fd="private.key" ; _fd_csr="request.csr" ; _fd_crt="cert.crt" ; \
openssl x509 -x509toreq -in ${_fd_crt} -out ${_fd_csr} -signkey ${_fd} )

Generate csr with -config param

( _fd="private.key" ; _fd_csr="request.csr" ; \
openssl req -new -sha256 -key ${_fd} -out ${_fd_csr} \
-config <(
cat <<-EOF
[req]
default_bits = 2048
prompt = no
default_md = sha256
req_extensions = req_ext
distinguished_name = dn

[ dn ]
C=<two-letter ISO abbreviation for your country>
ST=<state or province where your organization is legally located>
L=<city where your organization is legally located>
O=<legal name of your organization>
OU=<section of the organization>
CN=<fully qualified domain name>

[ req_ext ]
subjectAltName = @alt_names

[ alt_names ]
DNS.1 = <fully qualified domain name>
DNS.2 = <next domain>
DNS.3 = <next domain>
EOF
))

List available EC curves

openssl ecparam -list_curves

Generate ECDSA private key

# _curve: prime256v1, secp521r1, secp384r1
( _fd="private.key" ; _curve="prime256v1" ; \
openssl ecparam -out ${_fd} -name ${_curve} -genkey )

# _curve: X25519
( _fd="private.key" ; _curve="x25519" ; \
openssl genpkey -algorithm ${_curve} -out ${_fd} )

Print ECDSA private and public keys

( _fd="private.key" ; \
openssl ec -in ${_fd} -noout -text )

# For x25519 only extracting public key
( _fd="private.key" ; _fd_pub="public.key" ; \
openssl pkey -in ${_fd} -pubout -out ${_fd_pub} )

Generate private key with csr (ECC)

# _curve: prime256v1, secp521r1, secp384r1
( _fd="domain.com.key" ; _fd_csr="domain.com.csr" ; _curve="prime256v1" ; openssl ecparam -out ${_fd} -name ${_curve} -genkey ; openssl req -new -key ${_fd} -out ${_fd_csr} -sha256 )

Convert DER to PEM

( _fd_der="cert.crt" ; _fd_pem="cert.pem" ; \
openssl x509 -in ${_fd_der} -inform der -outform pem -out ${_fd_pem} )

Convert PEM to DER

( _fd_der="cert.crt" ; _fd_pem="cert.pem" ; \
openssl x509 -in ${_fd_pem} -outform der -out ${_fd_der} )

Checking whether the private key and the certificate match

(openssl rsa -noout -modulus -in private.key | openssl md5 ; openssl x509 -noout -modulus -in certificate.crt | openssl md5) | uniq

Secure delete with shred

shred -vfuz -n 10 file
shred --verbose --random-source=/dev/urandom -n 1 /dev/sda

Secure delete with scrub

scrub -p dod /dev/sda
scrub -p dod -r file

Secure delete with badblocks

badblocks -s -w -t random -v /dev/sda
badblocks -c 10240 -s -w -t random -v /dev/sda

Secure delete with secure-delete

srm -vz /tmp/file
sfill -vz /local
sdmem -v
swapoff /dev/sda5 && sswap -vz /dev/sda5

Show dd status every so often

dd <dd_params> status=progress
watch --interval 5 killall -USR1 dd

Redirect output to a file with dd

echo "string" | dd of=filename

Export public key

gpg --export --armor "<username>" > username.pkey
  • --export - export all keys from all keyrings or specific key

  • -a|--armor - create ASCII armored output

Encrypt file

gpg -e -r "<username>" dump.sql
  • -e|--encrypt - encrypt data

  • -r|--recipient - encrypt for specific

Decrypt file

gpg -o dump.sql -d dump.sql.gpg
  • -o|--output - use as output file

  • -d|--decrypt - decrypt data (default)

Search recipient

gpg --keyserver hkp://keyserver.ubuntu.com --search-keys "<username>"
  • --keyserver - set specific key server

  • --search-keys - search for keys on a key server


Reboot system from init

exec /sbin/init 6

Init system from single user mode

exec /sbin/init

HTTP/HTTPS

curl -Iks https://www.google.com
  • -I - show response headers only

  • -k - insecure connection when using ssl

  • -s - silent mode (not display body)

curl -Iks --location -X GET -A "x-agent" https://www.google.com
  • --location - follow redirects

  • -X - set method

  • -A - set user-agent

curl -Iks --location -X GET -A "x-agent" --proxy http://127.0.0.1:16379 https://www.google.com
  • --proxy [socks5://|http://] - set proxy server

Check DNS and HTTP trace with headers for specific domains

### Set domains and external dns servers.
_domain_list=(google.com) ; _dns_list=("8.8.8.8" "1.1.1.1")

for _domain in "${_domain_list[@]}" ; do

  printf '=%.0s' {1..48}

  echo

  printf "[\\e[1;32m+\\e[m] resolve: %s\\n" "$_domain"

  for _dns in "${_dns_list[@]}" ; do

    # Resolve domain.
    host "${_domain}" "${_dns}"

    echo

  done

  for _proto in http https ; do

    printf "[\\e[1;32m+\\e[m] trace + headers: %s://%s\\n" "$_proto" "$_domain"

    # Get trace and http headers.
    curl -Iks -A "x-agent" --location "${_proto}://${_domain}"

    echo

  done

done

unset _domain_list _dns_list

http -p Hh https://www.google.com
  • -p - print request and response headers

    • H - request headers

    • B - request body

    • h - response headers

    • b - response body

http -p Hh --follow --max-redirects 5 --verify no https://www.google.com
  • -F, --follow - follow redirects

  • --max-redirects N - maximum for --follow

  • --verify no - skip SSL verification

http -p Hh --follow --max-redirects 5 --verify no --proxy http:http://127.0.0.1:16379 https://www.google.com
  • --proxy [http:] - set proxy server

Network

Escape Sequence

# Supported escape sequences:
~.  - terminate connection (and any multiplexed sessions)
~B  - send a BREAK to the remote system
~C  - open a command line
~R  - Request rekey (SSH protocol 2 only)
~^Z - suspend ssh
~#  - list forwarded connections
~&  - background ssh (when waiting for connections to terminate)
~?  - this message
~~  - send the escape character by typing it twice

Compare a remote file with a local file

ssh user@host cat /path/to/remotefile | diff /path/to/localfile -

SSH connection through host in the middle

ssh -t reachable_host ssh unreachable_host

Run command over ssh on remote host

cat > cmd.txt << __EOF__
cat /etc/hosts
__EOF__

ssh host -l user $(<cmd.txt)

Get public key from private key

ssh-keygen -y -f ~/.ssh/id_rsa

Get all fingerprints

ssh-keygen -l -f .ssh/known_hosts

Ssh authentication with user password

ssh -o PreferredAuthentications=password -o PubkeyAuthentication=no user@remote_host

Ssh authentication with publickey

ssh -o PreferredAuthentications=publickey -o PubkeyAuthentication=yes -i id_rsa user@remote_host

Simple recording SSH session

function _ssh_sesslog() {

  _sesdir="<path/to/session/logs>"

  mkdir -p "${_sesdir}" && \
  ssh $@ 2>&1 | tee -a "${_sesdir}/$(date +%Y%m%d).log"

}

# Alias:
alias ssh='_ssh_sesslog'

Using Keychain for SSH logins

### Delete all of ssh-agent's keys.
function _scl() {

  /usr/bin/keychain --clear

}

### Add key to keychain.
function _scg() {

  /usr/bin/keychain /path/to/private-key
  source "$HOME/.keychain/$HOSTNAME-sh"

}

SSH login without processing any login scripts

ssh -tt user@host bash

SSH local port forwarding

Example 1:

# Forwarding our local 2250 port to nmap.org:443 from localhost through localhost
host1> ssh -L 2250:nmap.org:443 localhost

# Connect to the service:
host1> curl -Iks --location -X GET https://localhost:2250

Example 2:

# Forwarding our local 9051 port to db.d.x:5432 from localhost through node.d.y
host1> ssh -nNT -L 9051:db.d.x:5432 node.d.y

# Connect to the service:
host1> psql -U db_user -d db_dev -p 9051 -h localhost
  • -n - redirects stdin from /dev/null

  • -N - do not execute a remote command

  • -T - disable pseudo-terminal allocation

SSH remote port forwarding

# Forwarding our local 9051 port to db.d.x:5432 from host2 through node.d.y
host1> ssh -nNT -R 9051:db.d.x:5432 node.d.y

# Connect to the service:
host2> psql -U postgres -d postgres -p 8000 -h localhost

Testing remote connection to port

timeout 1 bash -c "</dev/<proto>/<host>/<port>" >/dev/null 2>&1 ; echo $?
  • <proto - set protocol (tcp/udp)

  • <host> - set remote host

  • <port> - set destination port

Read and write to TCP or UDP sockets with common bash tools

exec 5<>/dev/tcp/<host>/<port>; cat <&5 & cat >&5; exec 5>&-

tcpdump -ne -i eth0 -Q in host 192.168.252.1 and port 443
  • -n - don't convert addresses (-nn will not resolve hostnames or ports)

  • -e - print the link-level headers

  • -i [iface|any] - set interface

  • -Q|-D [in|out|inout] - choose send/receive direction (-D - for old tcpdump versions)

  • host [ip|hostname] - set host, also [host not]

  • [and|or] - set logic

  • port [1-65535] - set port number, also [port not]

tcpdump -ne -i eth0 -Q in host 192.168.252.1 and port 443 -c 5 -w tcpdump.pcap
  • -c [num] - capture only num number of packets

  • -w [filename] - write packets to file, -r [filename] - reading from file

Capture all ICMP packets

tcpdump -nei eth0 icmp

Check protocol used (TCP or UDP) for service

tcpdump -nei eth0 tcp port 22 -vv -X | egrep "TCP|UDP"

Display ASCII text (to parse the output using grep or other)

tcpdump -i eth0 -A -s0 port 443

Grab everything between two keywords

tcpdump -i eth0 port 80 -X | sed -n -e '/username/,/=ldap/ p'

Grab user and pass ever plain http

tcpdump -i eth0  port http -l -A | egrep -i 'pass=|pwd=|log=|login=|user=|username=|pw=|passw=|passwd=|password=|pass:|user:|username:|password:|login:|pass |user ' --color=auto --line-buffered -B20

Extract HTTP User Agent from HTTP request header

tcpdump -ei eth0 -nn -A -s1500 -l | grep "User-Agent:"

Capture only HTTP GET and POST packets

tcpdump -ei eth0 -s 0 -A -vv 'tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420' or 'tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x504f5354'

or simply:

tcpdump -ei eth0 -s 0 -v -n -l | egrep -i "POST /|GET /|Host:"

Rotate capture files

tcpdump -ei eth0 -w /tmp/capture-%H.pcap -G 3600 -C 200
  • -G <num> - pcap will be created every <num> seconds

  • -C <size> - close the current pcap and open a new one if is larger than <size>

Top hosts by packets

tcpdump -ei enp0s25 -nnn -t -c 200 | cut -f 1,2,3,4 -d '.' | sort | uniq -c | sort -nr | head -n 20

Analyse packets in real-time

while true ; do tcpick -a -C -r dump.pcap ; sleep 2 ; clear ; done

ngrep -d eth0 "www.google.com" port 443
  • -d [iface|any] - set interface

  • [domain] - set hostname

  • port [1-65535] - set port number

ngrep -d eth0 "www.google.com" (host 10.240.20.2) and (port 443)
  • (host [ip|hostname]) - filter by ip or hostname

  • (port [1-65535]) - filter by port number

ngrep -d eth0 -qt -O ngrep.pcap "www.google.com" port 443
  • -q - quiet mode (only payloads)

  • -t - added timestamps

  • -O [filename] - save output to file, -I [filename] - reading from file

ngrep -d eth0 -qt 'HTTP' 'tcp'
  • HTTP - show http headers

  • tcp|udp - set protocol

  • [src|dst] host [ip|hostname] - set direction for specific node

ngrep -l -q -d eth0 -i "User-Agent: curl*"
  • -l - stdout line buffered

  • -i - case-insensitive search


hping3 -V -p 80 -s 5050 <scan_type> www.google.com
  • -V|--verbose - verbose mode

  • -p|--destport - set destination port

  • -s|--baseport - set source port

  • <scan_type> - set scan type

    • -F|--fin - set FIN flag, port open if no reply

    • -S|--syn - set SYN flag

    • -P|--push - set PUSH flag

    • -A|--ack - set ACK flag (use when ping is blocked, RST response back if the port is open)

    • -U|--urg - set URG flag

    • -Y|--ymas - set Y unused flag (0x80 - nullscan), port open if no reply

    • -M 0 -UPF - set TCP sequence number and scan type (URG+PUSH+FIN), port open if no reply

hping3 -V -c 1 -1 -C 8 www.google.com
  • -c [num] - packet count

  • -1 - set ICMP mode

  • -C|--icmptype [icmp-num] - set icmp type (default icmp-echo = 8)

hping3 -V -c 1000000 -d 120 -S -w 64 -p 80 --flood --rand-source <remote_host>
  • --flood - sent packets as fast as possible (don't show replies)

  • --rand-source - random source address mode

  • -d --data - data size

  • -w|--win - winsize (default 64)


Ping scans the network

nmap -sP 192.168.0.0/24

Show only open ports

nmap -F --open 192.168.0.0/24

Full TCP port scan using with service version detection

nmap -p 1-65535 -sV -sS -T4 192.168.0.0/24

Nmap scan and pass output to Nikto

nmap -p80,443 192.168.0.0/24 -oG - | nikto.pl -h -

Recon specific ip:service with Nmap NSE scripts stack

# Set variables:
_hosts="192.168.250.10"
_ports="80,443"

# Set Nmap NSE scripts stack:
_nmap_nse_scripts="+dns-brute,\
                   +http-auth-finder,\
                   +http-chrono,\
                   +http-cookie-flags,\
                   +http-cors,\
                   +http-cross-domain-policy,\
                   +http-csrf,\
                   +http-dombased-xss,\
                   +http-enum,\
                   +http-errors,\
                   +http-git,\
                   +http-grep,\
                   +http-internal-ip-disclosure,\
                   +http-jsonp-detection,\
                   +http-malware-host,\
                   +http-methods,\
                   +http-passwd,\
                   +http-phpself-xss,\
                   +http-php-version,\
                   +http-robots.txt,\
                   +http-sitemap-generator,\
                   +http-shellshock,\
                   +http-stored-xss,\
                   +http-title,\
                   +http-unsafe-output-escaping,\
                   +http-useragent-tester,\
                   +http-vhosts,\
                   +http-waf-detect,\
                   +http-waf-fingerprint,\
                   +http-xssed,\
                   +traceroute-geolocation.nse,\
                   +ssl-enum-ciphers,\
                   +whois-domain,\
                   +whois-ip"

# Set Nmap NSE script params:
_nmap_nse_scripts_args="dns-brute.domain=${_hosts},http-cross-domain-policy.domain-lookup=true,http-waf-detect.aggro,http-waf-detect.detectBodyChanges,http-waf-fingerprint.intensive=1"

# Perform scan:
nmap --script="$_nmap_nse_scripts" --script-args="$_nmap_nse_scripts_args" -p "$_ports" "$_hosts"

nc -kl 5000
  • -l - listen for an incoming connection

  • -k - listening after client has disconnected

  • >filename.out - save receive data to file (optional)

nc 192.168.0.1 5051 < filename.in
  • < filename.in - send data to remote host

nc -vz 10.240.30.3 5000
  • -v - verbose output

  • -z - scan for listening daemons

nc -vzu 10.240.30.3 1-65535
  • -u - scan only udp ports

Transfer data file (archive)

server> nc -l 5000 | tar xzvfp -
client> tar czvfp - /path/to/dir | nc 10.240.30.3 5000

Launch remote shell

server> nc -l 5000 -e /bin/bash
client> nc 10.240.30.3 5000

Simple file server

while true ; do nc -l 5000 | tar -xvf - ; done

Simple minimal HTTP Server

while true ; do nc -l -p 1500 -c 'echo -e "HTTP/1.1 200 OK\n\n $(date)"' ; done

Simple HTTP Server

Restarts web server after each request - remove while condition for only single connection.

cat > index.html << __EOF__
<!doctype html>
    <head>
        <meta charset="utf-8">
        <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1">
        <title></title>
        <meta name="description" content="">
        <meta name="viewport" content="width=device-width, initial-scale=1">
    </head>
    <body>

    <p>

      Hello! It's a site.

    </p>

    </body>
</html>
__EOF__
server> while : ; do \
(echo -ne "HTTP/1.1 200 OK\r\nContent-Length: $(wc -c <index.html)\r\n\r\n" ; cat index.html;) | \
nc -l -p 5000 \
; done
  • -p - port number

Simple HTTP Proxy (single connection)

#!/usr/bin/env bash

if [[ $# != 2 ]] ; then
  printf "%s\\n" \
         "usage: ./nc-proxy listen-port bk_host:bk_port"
fi

_listen_port="$1"
_bk_host=$(echo "$2" | cut -d ":" -f1)
_bk_port=$(echo "$2" | cut -d ":" -f2)

printf "  lport: %s\\nbk_host: %s\\nbk_port: %s\\n\\n" \
       "$_listen_port" "$_bk_host" "$_bk_port"

_tmp=$(mktemp -d)
_back="$_tmp/pipe.back"
_sent="$_tmp/pipe.sent"
_recv="$_tmp/pipe.recv"

trap 'rm -rf "$_tmp"' EXIT

mkfifo -m 0600 "$_back" "$_sent" "$_recv"

sed "s/^/=> /" <"$_sent" &
sed "s/^/<=  /" <"$_recv" &

nc -l -p "$_listen_port" <"$_back" | \
tee "$_sent" | \
nc "$_bk_host" "$_bk_port" | \
tee "$_recv" >"$_back"
server> chmod +x nc-proxy && ./nc-proxy 8080 192.168.252.10:8000
  lport: 8080
bk_host: 192.168.252.10
bk_port: 8000

client> http -p h 10.240.30.3:8080
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=31536000
Content-Length: 2748
Content-Type: text/html; charset=utf-8
Date: Sun, 01 Jul 2018 20:12:08 GMT
Last-Modified: Sun, 01 Apr 2018 21:53:37 GMT

Create a single-use TCP or UDP proxy

### TCP -> TCP
nc -l -p 2000 -c "nc [ip|hostname] 3000"

### TCP -> UDP
nc -l -p 2000 -c "nc -u [ip|hostname] 3000"

### UDP -> UDP
nc -l -u -p 2000 -c "nc -u [ip|hostname] 3000"

### UDP -> TCP
nc -l -u -p 2000 -c "nc [ip|hostname] 3000"

Testing connection to remote host (with SNI support)

gnutls-cli -p 443 google.com

Testing connection to remote host (without SNI support)

gnutls-cli --disable-sni -p 443 google.com

Testing remote connection to port

socat - TCP4:10.240.30.3:22
  • - - standard input (STDIO)

  • TCP4:<params> - set tcp4 connection with specific params

    • [hostname|ip] - set hostname/ip

    • [1-65535] - set port number

Redirecting TCP-traffic to a UNIX domain socket under Linux

socat TCP-LISTEN:1234,bind=127.0.0.1,reuseaddr,fork,su=nobody,range=127.0.0.0/8 UNIX-CLIENT:/tmp/foo
  • TCP-LISTEN:<params> - set tcp listen with specific params

    • [1-65535] - set port number

    • bind=[hostname|ip] - set bind hostname/ip

    • reuseaddr - allows other sockets to bind to an address

    • fork - keeps the parent process attempting to produce more connections

    • su=nobody - set user

    • range=[ip-range] - ip range

  • UNIX-CLIENT:<params> - communicates with the specified peer socket

    • filename - define socket


Set iface in promiscuous mode and dump traffic to the log file

p0f -i enp0s25 -p -d -o /dump/enp0s25.log
  • -i - listen on the specified interface

  • -p - set interface in promiscuous mode

  • -d - fork into background

  • -o - output file


Show process that use internet connection at the moment

lsof -P -i -n

Show process that use specific port number

lsof -i tcp:443

Lists all listening ports together with the PID of the associated process

lsof -Pan -i tcp -i udp

List all open ports and their owning executables

lsof -i -P | grep -i "listen"

Show all open ports

lsof -Pnl -i

Show open ports (LISTEN)

lsof -Pni4 | grep LISTEN | column -t

List all files opened by a particular command

lsof -c "process"

View user activity per directory

lsof -u username -a +D /etc

Show 10 largest open files

lsof / | \
awk '{ if($7 > 1048576) print $7/1048576 "MB" " " $9 " " $1 }' | \
sort -n -u | tail | column -t

Graph # of connections for each hosts

netstat -an | awk '/ESTABLISHED/ { split($5,ip,":"); if (ip[1] !~ /^$/) print ip[1] }' | \
sort | uniq -c | awk '{ printf("%s\t%s\t",$2,$1) ; for (i = 0; i < $1; i++) {printf("*")}; print "" }'

Monitor open connections for specific port including listen, count and sort it per IP

watch "netstat -plan | grep :443 | awk {'print \$5'} | cut -d: -f 1 | sort | uniq -c | sort -nk 1"

Rsync remote data as root using sudo

rsync --rsync-path 'sudo rsync' username@hostname:/path/to/dir/ /local/

Resolves the domain name (using external dns server)

host google.com 9.9.9.9

Checks the domain administrator (SOA record)

host -t soa google.com 9.9.9.9

Resolves the domain name (short output)

dig google.com +short

Lookup NS record for specific domain

dig @9.9.9.9 google.com NS

Query only answer section

dig google.com +nocomments +noquestion +noauthority +noadditional +nostats

Query ALL DNS Records

dig google.com ANY +noall +answer

DNS Reverse Look-up

dig -x 172.217.16.14 +short

Generate multidomain certificate

certbot certonly -d example.com -d www.example.com

Generate wildcard certificate

certbot certonly --manual --preferred-challenges=dns -d example.com -d *.example.com

Generate certificate with 4096 bit private key

certbot certonly -d example.com -d www.example.com --rsa-key-size 4096

Get all subnets for specific AS (Autonomous system)

AS="AS32934"
whois -h whois.radb.net -- "-i origin ${AS}" | \
grep "^route:" | \
cut -d ":" -f2 | \
sed -e 's/^[ \t]//' | \
sort -n -t . -k 1,1 -k 2,2 -k 3,3 -k 4,4 | \
cut -d ":" -f2 | \
sed -e 's/^[ \t]/allow /' | \
sed 's/$/;/' | \
sed 's/allow  */subnet -> /g'

Resolves domain name from dns.google.com with curl and jq

_dname="google.com" ; curl -s "https://dns.google.com/resolve?name=${_dname}&type=A" | jq .

Programming

Log alias for a decent view of your repo

# 1)
git log --oneline --decorate --graph --all

# 2)
git log --graph --pretty=format:'%Cred%h%Creset -%C(yellow)%d%Creset %s %Cgreen(%cr) %C(bold blue)<%an>%Creset' --abbrev-commit

Static HTTP web server

# Python 3.x
python3 -m http.server 8000 --bind 127.0.0.1

# Python 2.x
python -m SimpleHTTPServer 8000

Static HTTP web server with SSL support

# Python 3.x
from http.server import HTTPServer, BaseHTTPRequestHandler
import ssl


httpd = HTTPServer(('localhost', 4443), BaseHTTPRequestHandler)

httpd.socket = ssl.wrap_socket (httpd.socket,
        keyfile="path/to/key.pem",
        certfile='path/to/cert.pem', server_side=True)

httpd.serve_forever()

# Python 2.x
import BaseHTTPServer, SimpleHTTPServer
import ssl


httpd = BaseHTTPServer.HTTPServer(('localhost', 4443),
        SimpleHTTPServer.SimpleHTTPRequestHandler)

httpd.socket = ssl.wrap_socket (httpd.socket,
        keyfile="path/tp/key.pem",
        certfile='path/to/cert.pem', server_side=True)

httpd.serve_forever()

Encode base64

python -m base64 -e <<< "sample string"

Decode base64

python -m base64 -d <<< "dGhpcyBpcyBlbmNvZGVkCg=="

Remove duplicate entries in a file without sorting

awk '!x[$0]++' filename

Exclude multiple columns using AWK

awk '{$1=$3=""}1' filename

Get the last hour of Apache logs

awk '/'$(date -d "1 hours ago" "+%d\\/%b\\/%Y:%H:%M")'/,/'$(date "+%d\\/%b\\/%Y:%H:%M")'/ { print $0 }' /var/log/httpd/access_log

To print a specific line from a file

sed -n 10p /path/to/file

Remove a specific line from a file

sed -i 10d /path/to/file
# alternative (BSD): sed -i'' 10d /path/to/file

Remove a range of lines from a file

sed -i <file> -re '<start>,<end>d'

Search for a "pattern" inside all files in the current directory

grep -rn "pattern"
grep -RnisI "pattern" *
fgrep "pattern" * -R

Remove blank lines from a file and save output to new file

grep . filename > newfilename

Show only for multiple patterns

grep 'INFO*'\''WARN' filename
grep 'INFO\|WARN' filename
grep -e INFO -e WARN filename
grep -E '(INFO|WARN)' filename
egrep "INFO|WARN" filename

Except multiple patterns

grep -vE '(error|critical|warning)' filename

Show data from file without comments

grep -v ^[[:space:]]*# filename

Show data from file without comments and new lines

egrep -v '#|^$' filename

Table of Contents

Domain resolve

# Dependencies:
#   - curl
#   - jq

function DomainResolve() {

  local _host="$1"

  local _curl_base="curl --request GET"
  local _timeout="15"

  _host_ip=$($_curl_base -ks -m "$_timeout" "https://dns.google.com/resolve?name=${_host}&type=A" | \
  jq '.Answer[0].data' | tr -d "\"" 2>/dev/null)

  if [[ -z "$_host_ip" ]] || [[ "$_host_ip" == "null" ]] ; then

    echo -en "Unsuccessful domain name resolution.\\n"

  else

    echo -en "$_host > $_host_ip\\n"

  fi

}

Example:

shell> DomainResolve nmap.org
nmap.org > 45.33.49.119

shell> DomainResolve nmap.orgs
Unsuccessful domain name resolution.

Get ASN

# Dependencies:
#   - curl
#   - python

function GetASN() {

  local _ip="$1"

  local _curl_base="curl --request GET"
  local _timeout="15"

  _asn=$($_curl_base -ks -m "$_timeout" "http://ip-api.com/json/${_ip}" | python -c 'import sys, json; print json.load(sys.stdin)["as"]' 2>/dev/null)

  _state=$(echo $?)

  if [[ -z "$_ip" ]] || [[ "$_ip" == "null" ]] || [[ "$_state" -ne 0 ]]; then

    echo -en "Unsuccessful ASN gathering.\\n"

  else

    echo -en "$_ip > $_asn\\n"

  fi

}

Example:

shell> GetASN 1.1.1.1
1.1.1.1 > AS13335 Cloudflare, Inc.

shell> GetASN 0.0.0.0
Unsuccessful ASN gathering.

Created by and

What is it?

For whom?

Contributing

Before adding a pull request, please see the . All suggestions/PR are welcome!

Support

Todo

Table of Contents

The Book of Secret Knowledge (Chapters)

CLI Tools

Shells

:small_orange_diamond: - the best framework for managing your Zsh configuration. :small_orange_diamond: - framework for using, developing and maintaining shell scripts and custom commands for your daily work. :small_orange_diamond: - the Fishshell framework.

Managers

:small_orange_diamond: - visual file manager, licensed under GNU General Public License. :small_orange_diamond: - full-screen window manager that multiplexes a physical terminal. :small_orange_diamond: - terminal multiplexer, lets you switch easily between several programs in one terminal. :small_orange_diamond: - sets a comfortable and easy to use functionality, clustering and synchronizing virtual tmux-sessions.

Text editors

:small_orange_diamond: - is one of the most common text editors on Unix. :small_orange_diamond: - is a highly configurable text editor. :small_orange_diamond: - an extensible, customizable, free/libre text editor - and more.

Network

:small_orange_diamond: - free and open source (license) utility for network discovery and security auditing. :small_orange_diamond: - the fastest Internet port scanner, spews SYN packets asynchronously. :small_orange_diamond: - faster and more efficient stateless SYN scanner and banner grabber. :small_orange_diamond: - command-line oriented TCP/IP packet assembler/analyzer. :small_orange_diamond: - functionality of the 'traceroute' and 'ping' programs in a single network diagnostic tool. :small_orange_diamond: - networking utility which reads and writes data across network connections, using the TCP/IP protocol. :small_orange_diamond: - powerful command-line packet analyzer. :small_orange_diamond: - dump and analyze network traffic (wireshark cli). :small_orange_diamond: - is like GNU grep applied to the network layer. :small_orange_diamond: - is a packet capture solution which aims to quickly spool all packets to disk. :small_orange_diamond: - monitoring and debugging tool to capture networking related statistics and prepare them visually. :small_orange_diamond: - is a console-based network monitoring program for Linux that displays information about IP traffic. :small_orange_diamond: - is a tool for active measurements of the maximum achievable bandwidth on IP networks. :small_orange_diamond: - is a Network Performance Measurement Tool for TCP, UDP & HTTP. :small_orange_diamond: - is a Linux CLI based Ethernet and MPLS traffic testing tool. :small_orange_diamond: - packet manipulation CLI tool; craft and inject packets of several protocols. :small_orange_diamond: - a mid-level packet manipulation library for Ruby. :small_orange_diamond: - packet manipulation library; forge, send, decode, capture packets of a wide number of protocols. :small_orange_diamond: - is a lightweight multi-protocol & multi-source command-line download utility.

Network (DNS)

:small_orange_diamond: - a DNS reconnaissance tool for locating non-contiguous IP space. :small_orange_diamond: - fast subdomains enumeration tool for penetration testers. :small_orange_diamond: - tool obtains subdomain names by scraping data sources, crawling web archives and more. :small_orange_diamond: - provides personalized DNS server recommendations based on your browsing history. :small_orange_diamond: - a flexible DNS proxy, with support for encrypted DNS protocols.

Network (HTTP)

:small_orange_diamond: - command line tool and library for transferring data with URLs. :small_orange_diamond: - is an alternative to the widely popular curl program, written in Golang. :small_orange_diamond: - a user-friendly HTTP client. :small_orange_diamond: - interactive cli tool for HTTP inspection. :small_orange_diamond: - simple Swiss Army knife for http/https troubleshooting and profiling. :small_orange_diamond: - visualizes curl statistics in a way of beauty and clarity. :small_orange_diamond: - is a text browser for the World Wide Web. :small_orange_diamond: - is an http load testing and benchmarking utility. :small_orange_diamond: - is a modern HTTP benchmarking tool capable of generating significant load. :small_orange_diamond: - fast cross-platform HTTP benchmarking tool written in Go. :small_orange_diamond: - http/https load testing and benchmarking tool. :small_orange_diamond: - free and open source directory/file & DNS busting tool written in Go.

SSL

:small_orange_diamond: - is a robust, commercial-grade, and full-featured toolkit for the TLS and SSL protocols. :small_orange_diamond: - client program to set up a TLS connection to some other computer. :small_orange_diamond: - fast and powerful SSL/TLS server scanning library. :small_orange_diamond: - tests SSL/TLS enabled services to discover supported cipher suites. :small_orange_diamond: - testing TLS/SSL encryption anywhere on any port. :small_orange_diamond: - is a utility for creating symmetrically encrypted and authenticated pipes between socket addresses. :small_orange_diamond: - is EFF's tool to obtain certs from Let's Encrypt and (optionally) auto-enable HTTPS on your server. :small_orange_diamond: - simple zero-config tool to make locally trusted development certificates with any names you'd like. :small_orange_diamond: - is a security and reconnaissance tool to automatically monitor new subdomains.

Security

:small_orange_diamond: - provides a flexible Mandatory Access Control (MAC) system built into the Linux kernel. :small_orange_diamond: - proactively protects the operating system and applications from external or internal threats.

Auditing Tools

:small_orange_diamond: - actively monitoring all aspects of system activity with file integrity monitoring. :small_orange_diamond: - provides a way to track security-relevant information on your system. :small_orange_diamond: - is a security tool that can be use both as a security audit and intrusion detection system. :small_orange_diamond: - battle-tested security tool for systems running Linux, macOS, or Unix-based operating system. :small_orange_diamond: - scripted Local Linux Enumeration & Privilege Escalation Checks. :small_orange_diamond: - scanner tool for Linux systems that scans backdoors, rootkits and local exploits on your systems. :small_orange_diamond: - is a light-weight tool that helps to detect malware running on the system.

System Diagnostics/Debuggers

:small_orange_diamond: - diagnostic, debugging and instructional userspace utility for Linux. :small_orange_diamond: - is a performance analysis and troubleshooting tool. :small_orange_diamond: - is a library call tracer, used to trace calls made by programs to library functions. :small_orange_diamond: - performance analysis tools based on Linux perf_events (aka perf) and ftrace. :small_orange_diamond: - system exploration and troubleshooting tool with first class support for containers. :small_orange_diamond: - is an instrumentation framework for building dynamic analysis tools. :small_orange_diamond: - cross-platform system monitoring tool written in Python. :small_orange_diamond: - interactive text-mode process viewer for Unix systems. It aims to be a better 'top'. :small_orange_diamond: - ASCII performance monitor. Includes statistics for CPU, memory, disk, swap, network, and processes. :small_orange_diamond: - displays in its output information about files that are opened by processes. :small_orange_diamond: - stack trace visualizer. :small_orange_diamond: - small utility to convert Unix lsof output to a graph showing FIFO and UNIX interprocess communication. :small_orange_diamond: - is a lightweight tool for recording, replaying and debugging execution of applications. :small_orange_diamond: - a system performance analysis toolkit. :small_orange_diamond: - a command-line hex viewer.

Log Analyzers

:small_orange_diamond: - slice and dice log files on the command line. :small_orange_diamond: - log file navigator with search and automatic refresh. :small_orange_diamond: - real-time web log analyzer and interactive viewer that runs in a terminal. :small_orange_diamond: - real-time metrics for nginx server.

Databases

:small_orange_diamond: - universal command-line interface for SQL databases. :small_orange_diamond: - postgres CLI with autocompletion and syntax highlighting. :small_orange_diamond: - terminal client for MySQL with autocompletion and syntax highlighting.

TOR

:small_orange_diamond: - script to make Tor Network your default gateway. :small_orange_diamond: - a tool that lets you create multiple TOR instances with a load-balancing.

Other

:small_orange_diamond: - is an inode-based filesystem notification technology. :small_orange_diamond: - is a terminal based interface for viewing Git repositories. :small_orange_diamond: - text-mode interface for Git. :small_orange_diamond: - simplified and community-driven man pages. :small_orange_diamond: - minimal CLI creator in JavaScript.

GUI Tools

Terminal emulators

:small_orange_diamond: - is a dropdown terminal made for the GNOME desktop environment. :small_orange_diamond: - is based on GNOME Terminal, useful features for sysadmins and other users. :small_orange_diamond: - is a GPU based terminal emulator that supports smooth scrolling and images.

Network

:small_orange_diamond: - is the world’s foremost and widely-used network protocol analyzer. :small_orange_diamond: - is a comprehensive network monitor tool. :small_orange_diamond: - is a graphical network monitoring solution.

Browsers

:small_orange_diamond: - protect your privacy and defend yourself against network surveillance and traffic analysis.

Password Managers

:small_orange_diamond: - store your passwords safely and auto-type them into your everyday websites and apps. :small_orange_diamond: - password manager and secure wallet.

Messengers/IRC Clients

:small_orange_diamond: - is an IRC client based on XChat. :small_orange_diamond: - is an easy to use and free chat client used by millions.

Messengers (end-to-end encryption)

:small_orange_diamond: - is an encrypted communications app. :small_orange_diamond: - secure messaging, file sharing, voice calls and video conferences. All protected with end-to-end encryption. :small_orange_diamond: - decentralized anonymous instant messenger on top of Tor Hidden Services.

Text editors

:small_orange_diamond: - is a lightweight, cross-platform code editor known for its speed, ease of use. :small_orange_diamond: - an open-source and free source code editor developed by Microsoft. :small_orange_diamond: - a hackable text editor for the 21st Century.

Web Tools

Browsers

:small_orange_diamond: - test your browser's SSL implementation. :small_orange_diamond: - provides up-to-date browser support tables for support of front-end web technologies. :small_orange_diamond: - is your browser safe against tracking? :small_orange_diamond: - see what data is exposed from your browser. :small_orange_diamond: - it's all about Web Browser fingerprinting. :small_orange_diamond: - was originally made to help a web server developer learn what real world TLS clients were capable of. :small_orange_diamond: - client test (incl TLSv1.3 information).

SSL/Security

:small_orange_diamond: - free online service performs a deep analysis of the configuration of any SSL web server. :small_orange_diamond: - free online service performs a deep analysis of the configuration of any SSL web server. :small_orange_diamond: - test SSL/TLS (PCI DSS, HIPAA and NIST). :small_orange_diamond: - ssl analyzer and ssl certificate checker. :small_orange_diamond: - scan your website for non-secure content. :small_orange_diamond: - test your TLS server configuration (e.g. ciphers). :small_orange_diamond: - service to scan and analyse websites. :small_orange_diamond: - monitoring security policies like CSP and HPKP. :small_orange_diamond: - allows developers and security experts to check if a Content Security Policy. :small_orange_diamond: - public list about CSP in some big players (might make them care a bit more). :small_orange_diamond: - list of the world's top 100 websites by Alexa rank not automatically redirecting insecure requests. :small_orange_diamond: - strong ciphers for Apache, Nginx, Lighttpd and more. :small_orange_diamond: - memorable site for testing clients against bad SSL configs. :small_orange_diamond: - registered for various tests regarding the TLS/SSL protocol. :small_orange_diamond: - repository of information about CAs, and their root and intermediate certificates. :small_orange_diamond: - real-time certificate transparency log update stream. :small_orange_diamond: - discovers certificates by continually monitoring all of the publicly known CT. :small_orange_diamond: - deploy the security standards. :small_orange_diamond: - test TLS cipher suite compatibility.

HTTP Headers & Web Linters

:small_orange_diamond: - analyse the HTTP response headers (with rating system to the results). :small_orange_diamond: - set of tools to analyze your website. :small_orange_diamond: - is a linting tool that will help you with your site's accessibility, speed, security and more.

DNS

:small_orange_diamond: - one source for free DNS related tools and information. :small_orange_diamond: - online investigation tool. :small_orange_diamond: - monitor, validate and verify your DNS configurations. :small_orange_diamond: - find subdomains for security assessment penetration test. :small_orange_diamond: - dns recon & research, find & lookup dns records. :small_orange_diamond: - search for DNS records by domain, IP, CIDR, ISP. :small_orange_diamond: - this site is responsible for the safekeeping of historical reverse DNS records. :small_orange_diamond: - wildcard DNS for everyone. :small_orange_diamond: - DNS and mail server health checker. :small_orange_diamond: - comprehensive DNS tester. :small_orange_diamond: - one of the best DNS propagation checker (and not only). :small_orange_diamond: - DNS propagation checking tool.

Mail

:small_orange_diamond: - all of your MX record, DNS, blacklist and SMTP diagnostics in one integrated tool. :small_orange_diamond: - checks to see if your domain is on a Real Time Spam Blacklist. :small_orange_diamond: - complete IP check for sending Mailservers. :small_orange_diamond: - checks mail authentication and scores messages with Spam Assassin.

Encoders/Decoders and Regex testing

:small_orange_diamond: - tool from above to either encode or decode a string of text. :small_orange_diamond: - the online translator for search queries on log data. :small_orange_diamond: - online regex tester and debugger: PHP, PCRE, Python, Golang and JavaScript. :small_orange_diamond: - online tool to learn, build, & test Regular Expressions (RegEx / RegExp). :small_orange_diamond: - online regex testing tool. :small_orange_diamond: - online regex testing tool + other tools. :small_orange_diamond: - The Cyber Swiss Army Knife - a web app for encryption, encoding, compression and data analysis.

Net-tools

:small_orange_diamond: - detailed report about the site, helping you to make informed choices about their integrity. :small_orange_diamond: - not-for-profit membership association, a Regional Internet Registry and the secretariat for the RIPE. :small_orange_diamond: - uses various sources to gather public information about IP numbers, domain names, host names, routes etc. :small_orange_diamond: - APIs for Security Companies, Researchers and Teams. :small_orange_diamond: - curl test, analyze HTTP Response Headers. :small_orange_diamond: - online Ping, Traceroute, DNS lookup, WHOIS and others. :small_orange_diamond: - network tools for webmasters, IT technicians & geeks. :small_orange_diamond: - provides online communication tools for people and groups working on liberatory social change. :small_orange_diamond: - analyze suspicious files and URLs to detect types of malware.

Privacy

:small_orange_diamond: - provides knowledge and tools to protect your privacy against global mass surveillance. :small_orange_diamond: - DNS privacy recursive servers list (with a 'no logging' policy).

Code parsers/playgrounds

:small_orange_diamond: - finds bugs in your shell scripts. :small_orange_diamond: - get interactive help texts for shell commands. :small_orange_diamond: - live pastebin for HTML, CSS & JavaScript and more. :small_orange_diamond: - a social development environment for front-end designers and developers. :small_orange_diamond: - online code editor for web application development. Supports React, Vue, Angular, CxJS, Dojo, etc. :small_orange_diamond: - test your PHP code with this code tester. :small_orange_diamond: - an instant IDE to learn, build, collaborate, and host all in one place.

Performance

:small_orange_diamond: - analyze your site’s speed and make it faster. :small_orange_diamond: - test here the performance of any of your sites from across the globe. :small_orange_diamond: - analyze your site’s speed around the world. :small_orange_diamond: - run website latency tests across multiple geographic regions. :small_orange_diamond: - analyze your site’s speed and make it faster. :small_orange_diamond: - helps developers like you learn and apply the web's modern capabilities to your own sites and apps.

Mass scanners (search engines)

:small_orange_diamond: - platform that helps information security practitioners discover, monitor, and analyze devices. :small_orange_diamond: - the world's first search engine for Internet-connected devices. :small_orange_diamond: - do you use Shodan for everyday work? This tool looks for randomly generated data from Shodan. :small_orange_diamond: - mass scanner such as Shodan and Censys. :small_orange_diamond: - search engine for cyberspace that lets the user find specific network components. :small_orange_diamond: - is a cyberspace search engine. :small_orange_diamond: - is a search engine for open-source and cyber threat intelligence data collected. :small_orange_diamond: - it scan the entire internet space and create real-time threat intelligence streams and reports. :small_orange_diamond: - lets you find email addresses in seconds and connect with the people that matter for your business. :small_orange_diamond: - is a submission-based catalog of wireless networks. All the networks. Found by Everyone. :small_orange_diamond: - find any alphanumeric snippet, signature or keyword in the web pages HTML, JS and CSS code. :small_orange_diamond: - this repository contains hundreds of online search utilities. :small_orange_diamond: - search by full email address or username. :small_orange_diamond: - database with public search for Open Amazon S3 Buckets and their contents. :small_orange_diamond: - the breached database directory. :small_orange_diamond: - was my email affected by data breach? :small_orange_diamond: - find out what websites are built with. :small_orange_diamond: - if a target has an open FTP site with accessible content it will be listed here. :small_orange_diamond: - contains great stuff like: security, hacking, reverse engineering, cryptography, programming etc. :small_orange_diamond: - focused on gathering information from free tools or resources. :small_orange_diamond: - is the place to find the person behind the email address, social username or phone number. :small_orange_diamond: - is operated by a random swiss guy fighting malware for non-profit.

Passwords

:small_orange_diamond: - list of 1.4 billion accounts circulates around the Internet. :small_orange_diamond: - check if you have an account that has been compromised in a data breach.

CVE/Exploits databases

:small_orange_diamond: - list of publicly known cybersecurity vulnerabilities. :small_orange_diamond: - CVE security vulnerability advanced database. :small_orange_diamond: - CVE compliant archive of public exploits and corresponding vulnerable software. :small_orange_diamond: - exploits market provides you the possibility to buy zero-day exploits and also to sell 0day exploits. :small_orange_diamond: - the exploit and tools database. :small_orange_diamond: - free vulnerability database.

Mobile apps scanners

:small_orange_diamond: - test security and privacy of mobile apps (iOS & Android). :small_orange_diamond: - free Mobile App Vulnerability Scanner for Android & iOS. :small_orange_diamond: - analyzes mobile application to identify vulnerabilities and potential weaknesses.

Private Search Engines

:small_orange_diamond: - the world's most private search engine. :small_orange_diamond: - a privacy-respecting, hackable metasearch engine.

Secure WebMail Providers

:small_orange_diamond: - is a secure and easy to use online email service, designed to provide maximum security and privacy. :small_orange_diamond: - is a Tor Hidden Service that allows anyone to send and receive emails anonymously. :small_orange_diamond: - is the world's most secure email service and amazingly easy to use. :small_orange_diamond: - is the world's largest secure email service, developed by CERN and MIT scientists. :small_orange_diamond: - private & encrypted email made easy.

Crypto

:small_orange_diamond: - it's open source and powered by public-key cryptography.

PGP Keyservers

:small_orange_diamond: - includes a highly-efficient reconciliation algorithm for keeping the keyservers synchronized.

Other

:small_orange_diamond: - generate fake faces in one click - endless possibilities.

Systems/Services

Operating Systems

:small_orange_diamond: - the most "Unix-like" Linux distribution. :small_orange_diamond: - multi-platform 4.4BSD-based UNIX-like operating system. :small_orange_diamond: - HardenedBSD aims to implement innovative exploit mitigation and security solutions. :small_orange_diamond: - Linux distribution used for Penetration Testing, Ethical Hacking and network security assessments. :small_orange_diamond: - penetration test and security assessment oriented Ubuntu-based Linux distribution. :small_orange_diamond: - is an Arch Linux-based penetration testing distribution for penetration testers and security researchers. :small_orange_diamond: - Linux distro for intrusion detection, enterprise security monitoring, and log management. :small_orange_diamond: - is a live system that aims to preserve your privacy and anonymity.

HTTP(s) Services

:small_orange_diamond: - HTTP accelerator designed for content-heavy dynamic web sites. :small_orange_diamond: - open source web and reverse proxy server that is similar to Apache, but very light weight. :small_orange_diamond: - the reliable, high performance TCP/HTTP load balancer.

Security/hardening

:small_orange_diamond: - seattle-based encrypted-transit internet service provider. :small_orange_diamond: - validating, recursive, and caching DNS resolver (with TLS). :small_orange_diamond: - caching full resolver implementation, including both a resolver library and a daemon. :small_orange_diamond: - the Pi-hole® is a DNS sinkhole that protects your devices from unwanted content. :small_orange_diamond: - malicious traffic detection system. :small_orange_diamond: - monitors AWS, GCP, OpenStack, and GitHub orgs for assets and their changes over time.

Networks

Tools

:small_orange_diamond: - web visual tool to analyze large amounts of captured network traffic (PCAP analyzer).

Labs

:small_orange_diamond: - learn automation by doing it. Right now, right here, in your browser.

Manuals/Howtos/Tutorials

Shells/Command line

:small_orange_diamond: - a collection of pure bash alternatives to external processes. :small_orange_diamond: - hold documentation of any kind about GNU Bash. :small_orange_diamond: - describes the commands and utilities offered to application programs by POSIX-conformant systems. :small_orange_diamond: - master the command line, in one page. :small_orange_diamond: - a shell style guide for Google-originated open-source projects.

Python

:small_orange_diamond: - a curated list of awesome Python frameworks, libraries, software and resources. :small_orange_diamond: - comprehensive Python cheatsheet.

Sed & Awk & Other

:small_orange_diamond: - advanced sed and awk usage (Parsing for Pentesters 3).

*nix & Network

:small_orange_diamond: - linux and unix tutorials for new and seasoned sysadmin. :small_orange_diamond: - the ideal Linux blog for Sysadmins & Geeks. :small_orange_diamond: - free Networking, System Administration and Security tutorials. :small_orange_diamond: - collection of Unix/Linux/BSD commands and tasks which are useful for IT work or for advanced users. :small_orange_diamond: - tutorials on system administration in Fedora® and CentOS®, including OpenLDAP and FreeIPA. :small_orange_diamond: - a detailed document explaining and documenting HTTP/2. :small_orange_diamond: - a document describing the HTTP/3 and QUIC protocols.

Large-scale systems

:small_orange_diamond: - learn how to design large-scale systems. :small_orange_diamond: - best practices in building High Scalability, High Availability, High Stability and more.

System hardening

:small_orange_diamond: - are secure configuration settings for over 100 technologies, available as a free PDF download. :small_orange_diamond: - are the configuration standards for DOD IA and IA-enabled devices/systems. :small_orange_diamond: - this walks you through the steps required to security harden CentOS. :small_orange_diamond: - great guide for hardening CentOS; familiar with OpenSCAP.

Security & Privacy

:small_orange_diamond: - LRaj Chandel's Security & Hacking Blog. :small_orange_diamond: - make your AWS cloud environment more secure. :small_orange_diamond: - an inventory of tools and resources about CyberSecurity. :small_orange_diamond: - every byte of a TLS connection explained and reproduced. :small_orange_diamond: - SSL and TLS Deployment Best Practices by SSL Labs. :small_orange_diamond: - everything you should know about certificates and PKI but are too afraid to ask. :small_orange_diamond: - a reference for subdomain enumeration techniques. :small_orange_diamond: - the comprehensive guide to quitting Google.

Web Apps

:small_orange_diamond: - worldwide not-for-profit charitable organization focused on improving the security of software. :small_orange_diamond: - OWASP Application Security Verification Standard Project. :small_orange_diamond: - simple web app that helps developers understand the ASVS requirements. :small_orange_diamond: - is a list of application security requirements or tests. :small_orange_diamond: - includes a "best practice" penetration testing framework. :small_orange_diamond: - help operational teams with creating secure web applications. :small_orange_diamond: - enable cross-origin resource sharing. :small_orange_diamond: - is an initiative to provide all application security related resources at one place. :small_orange_diamond: - reverse proxy related attacks; it is a result of analysis of various reverse proxies, cache proxies, etc. :small_orange_diamond: - great series about malicious payloads. :small_orange_diamond: - show you how to compromise websites by using esoteric web features. :small_orange_diamond: - as a source of sensitive information about web application. :small_orange_diamond: - this paper will take a close look at cookie security.

Other

:small_orange_diamond: - the steps below could be followed to find vulnerabilities and exploits. :small_orange_diamond: - collection of some hints and useful links for the beginners. :small_orange_diamond: - all cheat sheets. :small_orange_diamond: - massive cheat sheets documentation. :small_orange_diamond: - this is a modest collection of cheatsheets. :small_orange_diamond: - it's time for web servers to handle ten thousand clients simultaneously, don't you think? :small_orange_diamond: - when companies say they have "Bank Grade Security" they imply that it is a good thing.* :small_orange_diamond: - this is the story of a long journey regarding the implementation of SSL. :small_orange_diamond: - some drawings about programming and unix world, zines about systems & debugging tools. :small_orange_diamond: - this great repository is focused on hash collisions exploitation. :small_orange_diamond: - after 3072 hours of manipulating BGP, Job Snijders has succeeded in drawing a Nyancat. :small_orange_diamond: - great tutorial explain how HTTPS works in the real world. :small_orange_diamond: - how we spent two weeks hunting an NFS bug in the Linux kernel. :small_orange_diamond: - if you want to be a hacker, keep reading. :small_orange_diamond: - an infographics which should help to estimate costs of certain operations in CPU clocks.

Inspiring Lists

SysOps/DevOps

:small_orange_diamond: - amazingly awesome open source sysadmin resources. :small_orange_diamond: - awesome command-line frameworks, toolkits, guides and gizmos. :small_orange_diamond: - from finding text to search and replace, from sorting to beautifying text and more. :small_orange_diamond: - collection of tools developed by other researchers to process network traces. :small_orange_diamond: - learn where some of the network sysctl variables fit into the Linux/Kernel network flow. :small_orange_diamond: - list of awesome PostgreSQL software, libraries, tools and resources. :small_orange_diamond: - list of Free Software network services and web applications which can be hosted locally. :small_orange_diamond: - bootstrap Kubernetes the hard way on Google Cloud Platform. No scripts. :small_orange_diamond: - huge collection of applications sorted by category, as a reference for those looking for packages.

Developers

:small_orange_diamond: - the perfect Front-End Checklist for modern websites and meticulous developers. :small_orange_diamond: - what are magic methods? They're everything in object-oriented Python. :small_orange_diamond: - a collection of surprising Python snippets and lesser-known features.

Security/Pentesting

:small_orange_diamond: - a curated list of Web Security materials and resources. :small_orange_diamond: - a curated list of hacking environments where you can train your cyber skills. :small_orange_diamond: - a collection of open source and commercial tools that aid in red team operations. :small_orange_diamond: - a curated list of amazingly awesome Burp Extensions. :small_orange_diamond: - list of a Free Security and Hacking eBooks. :small_orange_diamond: - list of awesome reverse engineering resources. :small_orange_diamond: - a curated list of awesome web-app firewall (WAF) stuff. :small_orange_diamond: - list of movies every hacker & cyberpunk must watch. :small_orange_diamond: - IT whitepapers; hacking, web app security, db, reverse engineering and more; EN/PL.

Blogs

Geeky Persons

:small_orange_diamond: - Brendan Gregg is an industry expert in computing performance and cloud computing. :small_orange_diamond: - Gynvael is a IT security engineer at Google. :small_orange_diamond: - "white hat" hacker, computer security expert. :small_orange_diamond: - developer, Sysadmin, Blogger, Podcaster and Public Speaker. :small_orange_diamond: - Software Developer and Systems Administrator for Stack Exchange. :small_orange_diamond: - IT security Expert. :small_orange_diamond: - Security Researcher, international speaker and founder of securityheaders.com and report-uri.com. :small_orange_diamond: - Linux Evangelist. Malwares. Kernel Dev. Security Enthusiast. :small_orange_diamond: - Detection Engineer at ESET. :small_orange_diamond: - Microsoft Regional Director and Microsoft Most Valuable Professional for Developer Security. :small_orange_diamond: - Linux/Unix Sysadmin specializing in building high availability cloud environments.

Geeky Blogs

:small_orange_diamond: - the Linux security blog about Auditing, Hardening and Compliance by Michael Boelen. :small_orange_diamond: - trainings, howtos, checklists, security tools and more. :small_orange_diamond: - collection of useful incantations for wizards, be you computer wizards, magicians, or whatever. :small_orange_diamond: - about web app security vulns and top tips from our team of web security.

A piece of history

:small_orange_diamond: - how to configure modems, scan images, record CD-ROMs, and other useful techniques.

Hacking/Penetration Testing

Pentesters arsenal tools

:small_orange_diamond: - a penetration-oriented browser with plenty of advanced functionality already built in. :small_orange_diamond: - tool and framework for pentesting system, web and many more, contains a lot a ready to use exploit. :small_orange_diamond: - tool for testing Web application security, intercepting proxy to replay, inject, scan and fuzz HTTP requests. :small_orange_diamond: - intercepting proxy to replay, inject, scan and fuzz HTTP requests. :small_orange_diamond: - is a Web Application Attack and Audit Framework. :small_orange_diamond: - an interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers. :small_orange_diamond: - web server scanner which performs comprehensive tests against web servers for multiple items. :small_orange_diamond: - tool that automates the process of detecting and exploiting SQL injection flaws. :small_orange_diamond: - an Integrated Multiuser Pentest Environment. :small_orange_diamond: - incredibly fast crawler designed for OSINT. :small_orange_diamond: - most advanced XSS detection suite. :small_orange_diamond: - is a fast password cracker, currently available for many flavors of Unix, Windows, and other. :small_orange_diamond: - world's fastest and most advanced password recovery utility. :small_orange_diamond: - is a tool to identify the players behind any incidental TCP/IP communications. :small_orange_diamond: - is a full-featured Web Reconnaissance framework written in Python. :small_orange_diamond: - searchable archive from The Exploit Database. :small_orange_diamond: - some setup scripts for security research tools. :small_orange_diamond: - collection of small security tools created mostly in Python. CTFs, pentests and so on. :small_orange_diamond: - dictionary of attack patterns and primitives for black-box application fault injection and resource discovery. :small_orange_diamond: - is an unsupervised, coverage-guided kernel fuzzer. :small_orange_diamond: - Python Exploit Development Assistance for GDB. :small_orange_diamond: - multi-processor disassembler and debugger useful for reverse engineering malware. :small_orange_diamond: - framework for reverse-engineering and analyzing binaries. :small_orange_diamond: - open-source pentesting management and automation platform by Salesforce Product Security. :small_orange_diamond: - is a graphical tool for custom wordlist generation.

Pentests bookmarks collection

:small_orange_diamond: - the penetration testing execution standard. :small_orange_diamond: - amazing mind map with vulnerable apps and systems. :small_orange_diamond: - incredible mind map for WebApps security tests. :small_orange_diamond: - master the art of Cross Site Scripting. :small_orange_diamond: - security bookmarks collection, all that things I need to pass OSCP. :small_orange_diamond: - collection of the cheat sheets useful for pentesting. :small_orange_diamond: - awesome lists for hackers, pentesters and security researchers. :small_orange_diamond: - a curated list of awesome hacking tutorials, tools and resources. :small_orange_diamond: - collection of hacking/penetration testing resources to make you better. :small_orange_diamond: - collection of awesome penetration testing resources, tools and other shiny things. :small_orange_diamond: - author hacking and pentesting notes. :small_orange_diamond: - includes thousands of cybersecurity-related references and resources. :small_orange_diamond: - there are a LOT of pentesting blogs. :small_orange_diamond: - a list of useful payloads and bypass for Web Application Security and Pentest/CTF. :small_orange_diamond: - git all the Payloads! A collection of web attack payloads. :small_orange_diamond: - a quick reference high level overview for typical penetration testing engagements. :small_orange_diamond: - great stuff from DEFCON. :small_orange_diamond: - a curated list of awesome malware analysis tools and resources. :small_orange_diamond: - detailed technical information about the many different variants of the SQL Injection. :small_orange_diamond: - great and detailed reference about vulnerabilities. :small_orange_diamond: - a collection of HTML5 related XSS attack vectors. :small_orange_diamond: - for generating XSS code to check your input validation filters against XSS. :small_orange_diamond: - list of Unix binaries that can be exploited by an attacker to bypass local security restrictions. :small_orange_diamond: - collection of security, system, network and pentest cheatsheets. :small_orange_diamond: - a collection of SSRF Tips. :small_orange_diamond: - great archive of CTFs. :small_orange_diamond: - CTF (Capture The Flag) writeups, code snippets, notes, scripts. :small_orange_diamond: - The Mobile Security Testing Guide (MSTG) is a comprehensive manual for mobile app security testing.

Wordlists and Weak passwords

:small_orange_diamond: - for any kind of bruteforce find wordlists or unleash the power of them all at once! :small_orange_diamond: - is a free online hash resolving service incorporating many unparalleled techniques. :small_orange_diamond: - collection of multiple types of lists used during security assessments, collected in one place. :small_orange_diamond: - sorted by probability originally created for password generation and testing. :small_orange_diamond: - password dictionaries and leaked passwords repository. :small_orange_diamond: - official dictionary created by the team on the forum bezpieka.org.*

- European bug bounty platform based on the legislation and rules in force in European countries. :small_orange_diamond: - allows any security researcher reporting a vulnerability on any website. :small_orange_diamond: - global hacker community to surface the most relevant security issues. :small_orange_diamond: - crowdsourced cybersecurity for the enterprise. :small_orange_diamond: - crowdsourced security & bug bounty management. :small_orange_diamond: - crowdsourced security & bug bounty programs, crowd security intelligence platform and more. :small_orange_diamond: - bug bounty platform. :small_orange_diamond: - bug bounty platform with infosec jobs.

Web Training Apps (local installation)

:small_orange_diamond: - comprehensive and well maintained registry of all known vulnerable web applications. :small_orange_diamond: - vulnerable web application amongst security researchers. :small_orange_diamond: - PHP/MySQL web application that is damn vulnerable. :small_orange_diamond: - free, open source, deliberately vulnerable web-application. :small_orange_diamond: - the most bug-free vulnerable application in existence. :small_orange_diamond: - insecure web application maintained by OWASP designed to teach web app security. :small_orange_diamond: - open source application security training program. :small_orange_diamond: - a modern vulnerable web app. :small_orange_diamond: - damn vulnerable NodeJS application. :small_orange_diamond: - web application exploits and defenses. :small_orange_diamond: - is a playground focused on learning the exploitation of client-side web vulnerabilities. :small_orange_diamond: - single vm lab with the purpose of combining several vulnerable appliations in one environment.

Labs (ethical hacking platforms/trainings/CTFs)

:small_orange_diamond: - true performance-based penetration testing training for over a decade. :small_orange_diamond: - online platform allowing you to test your penetration testing skills. :small_orange_diamond: - online ethical hacking, computer network and security challenge platform. :small_orange_diamond: - non-commercial wargame site which provides various pwn challenges regarding system exploitation. :small_orange_diamond: - is a wargame site for hackers to test and expand their binary exploiting skills. :small_orange_diamond: - is a free computer security game targeted at middle and high school students. :small_orange_diamond: - is an online platform built to help ethical hackers learn and practice their cybersecurity knowledge and skills. :small_orange_diamond: - high quality security testing services. :small_orange_diamond: - pentest lab, take your Hacking skills to the next level. :small_orange_diamond: - the fast, easy, and affordable way to train your hacking skills. :small_orange_diamond: - a great platform to train your pentesting skills. :small_orange_diamond: - learning Cyber Security made easy. :small_orange_diamond: - is a realistic web application hacking game, designed to help players of all abilities develop their skills. :small_orange_diamond: - it's full of nasty app sec holes. :small_orange_diamond: - can help you to learn and practice security concepts in the form of fun-filled games. :small_orange_diamond: - is an online Penetration Testing Lab. :small_orange_diamond: - provides vulnerable systems that can be used to test and understand vulnerabilities. :small_orange_diamond: - tons of challenges designed to test and improve your hacking skills. :small_orange_diamond: - preconfigured lab environments. :small_orange_diamond: - emulate IT infrastructures of real companies for legal pen testing and improving penetration testing skills. :small_orange_diamond: - reversal challenges done in the web interface. :small_orange_diamond: - download crackmes to help improve your reverse engineering skills.

Other resources

:small_orange_diamond: - open source education content for the researcher community. :small_orange_diamond: - a list of resources and scripts that I have been gathering in preparation for the OSCP. :small_orange_diamond: - test your web apps with real-world examples (two-part series).

Your daily knowledge and news

RSS Readers

:small_orange_diamond: - organize, read and share what matters to you. :small_orange_diamond: - similar to feedly with a support for filtering what you fetch from rss.

IRC Channels

:small_orange_diamond: - hackerspace IRC channels.

Security

:small_orange_diamond: - leading news source dedicated to promoting awareness for security experts and hackers. :small_orange_diamond: - provides the latest hacking news, exploits and vulnerabilities for ethical hackers. :small_orange_diamond: - security news as a weekly digest (email notifications). :small_orange_diamond: - the latest news and insights from Google on security and safety on the Internet. :small_orange_diamond: - expert network security guidance and news. :small_orange_diamond: - connecting the Information Security Community. :small_orange_diamond: - latest hacking tools, hacker news, cybersecurity best practices, ethical hacking & pen-testing. :small_orange_diamond: - public disclosure watcher who keeps you up to date about the recently disclosed bugs. :small_orange_diamond: - a subreddit dedicated to hacking and hackers. :small_orange_diamond: - information security services, news, files, tools, exploits, advisories and whitepapers. :small_orange_diamond: - about security, penetration tests, vulnerabilities and many others (PL/EN). :small_orange_diamond: - basic aspects and mechanisms of Linux operating system security (PL).

Other Cheat Sheets

:small_orange_diamond: - a validating, recursive, and caching DNS server. :small_orange_diamond: - how to get faster and more secure DNS resolution with Knot Resolver on Fedora. :small_orange_diamond: - tutorial to setup your own DNS-over-HTTPS (DoH) server. :small_orange_diamond: - how (and why) i run my own DNS Servers.

:small_orange_diamond: - build your own certificate authority (CA) using the OpenSSL command-line tools.

:small_orange_diamond: - how to create an OS from scratch. :small_orange_diamond: - how to write your own virtual machine (VM).

One-liners

Tool:

Tool:

Tool:

Tool:

Tool:

Tool:

Tool:

Tool:

Tool:

Tool:

Tool:

Tool:

Tool:

Tool:

Tool:

Tool:

Tool:

Tool:

Tool:

Tool:

Tool:

Tool:

Tool:

Tool:

Tool:

Tool:

Tool:

Tool:

Tool:

Tool:

Tool:

Tool:

Tool:

Filter incoming (on interface) traffic (specific )

Filter incoming (on interface) traffic (specific ) and write to a file

Tool:

Tool:

Tool:

Tool:

Tool:

Tool:

Tool:

Tool:

Tool:

Tool:

Tool:

Tool:

Tool:

Tool:

Tool:

Tool:

Tool:

Tool:

Tool:

Tool:

Shell functions

📔
🚻
ℹ️
💝
☑️
💢
🔱
▪️
▪️
▪️
▪️
▪️
▪️
▪️
▪️
▪️
▪️
▪️
▪️
▪️
▪️
▪️
▪️
▪️
▪️
▪️
▪️
▪️
▪️
▪️
▪️
▪️
▪️
▪️
▪️
▪️
▪️
▪️
▪️
▪️
▪️
▪️
▪️
▪️
▪️
▪️
▪️
▪️
▪️
▪️
▪️
▪️
▪️
▪️
▪️
▪️
▪️
▪️
▪️
▪️
▪️
▪️
▪️
▪️
▪️
▪️
▪️
▪️
▪️
▪️
▪️
▪️
▪️
▪️
▪️
▪️
trimstray
contributors
contributing guidelines
Oh My ZSH!
bash-it
Oh My Fish
Midnight Commander
screen
tmux
tmux-cssh
vi
vim
emacs
nmap
masscan
pbscan
hping
mtr
netcat
tcpdump
tshark
ngrep
stenographer
bmon
iptraf-ng
iPerf3
ethr
Etherate
Nemesis
packetfu
Scapy
aria2
fierce
sublist3r
amass
namebench
dnscrypt-proxy 2
Curl
kurly
HTTPie
wuzz
htrace.sh
httpstat
Lynx
siege
wrk
bombardier
gobench
gobuster
openssl
gnutls-cli
sslyze
sslscan
testssl.sh
spiped
Certbot
mkcert
Sublert
SELinux
AppArmor
ossec
auditd
Tiger
Lynis
LinEnum
Rkhunter
PE-sieve
strace
DTrace
ltrace
perf-tools
sysdig
Valgrind
glances
htop
atop
lsof
FlameGraph
lsofgraph
rr
Performance Co-Pilot
hexyl
angle-grinder
lnav
GoAccess
ngxtop
usql
pgcli
mycli
Nipe
multitor
incron
GRV
Tig
tldr
commander.js
Guake
Terminator
Kitty
Wireshark
Ettercap
EtherApe
TOR Browser
KeePassXC
Enpass
HexChat
Pidgin
Signal
Wire
TorChat
Sublime Text
Visual Studio Code
Atom
SSL/TLS Capabilities of Your Browser
Can I use
Panopticlick 3.0
Privacy Analyzer
Web Browser Security
How's My SSL?
sslClientInfo
SSL Server Test
SSL Server Test (DEV)
ImmuniWeb® SSLScan
COMODO SSL Analyzer
SSL Check
CryptCheck
urlscan.io
Report URI
CSP Evaluator
Useless CSP
Why No HTTPS?
cipherli.st
badssl.com
tlsfun.de
Common CA Database
CERTSTREAM
crt.sh
Hardenize
Cipher suite compatibility
Security Headers
Observatory by Mozilla
webhint
ViewDNS
DNSlytics
DNS Spy
Find subdomains online
DNSdumpster
DNS Table online
PTRarchive.com
xip.ip
intoDNS
Leaf DNS
dnslookup (ceipam)
What's My DNS
MX Toolbox
blacklistalert
MultiRBL
DKIM SPF & Spam Assassin Validator
URL Encode/Decode
Uncoder
Regex101
RegExr
RegEx Testing
RegEx Pal
CyberChef
Netcraft
RIPE NCC
Robtex
Security Trails
Online Curl
Ping.eu
Network-Tools
Riseup
VirusTotal
privacytools.io
DNS Privacy Test Servers
ShellCheck
explainshell
jsbin
CodePen
CodeSandbox
PHP Sandbox
Repl.it
GTmetrix
Sucuri loadtimetester
Pingdom Tools
PingMe.io
PageSpeed Insights
web.dev
Censys
Shodan
Shodan 2000
GreyNoise
ZoomEye
FOFA
onyphe
binaryedge
hunter
wigle
PublicWWW
IntelTechniques
GhostProject?
Buckets by Grayhatwarfar
Vigilante.pw
databreaches
builtwith
Mamont's open FTP Index
index-of
OSINT Framework
pipl
abuse.ch
Gotcha?
have i been pwned?
CVE Mitre
CVE Details
Exploit DB
0day.today
sploitus
cxsecurity
ImmuniWeb® Mobile App Scanner
Quixxi
Ostorlab
Startpage
searX
CounterMail
Mail2Tor
Tutanota
Protonmail
Startmail
Keybase
SKS OpenPGP Key server
thispersondoesnotexist
Slackware
OpenBSD
HardenedBSD
Kali Linux
Backbox Linux
BlackArch
Security Onion
Tails
Varnish Cache
Nginx
HAProxy
Emerald Onion
Unbound
Knot Resolver
pi-hole
maltrail
security_monkey
CapAnalysis
NRE Labs
pure-bash-bible
The Bash Hackers Wiki
Shell & Utilities
the-art-of-command-line
Shell Style Guide
Awesome Python
python-cheatsheet
F’Awk Yeah!
nixCraft
TecMint
Omnisecu
Unix Toolbox
Linux Guide and Hints
http2-explained
http3-explained
The System Design Primer
Awesome Scalability
CIS Benchmarks
STIGs
Security Harden CentOS 7
CentOS 7 Server Hardening Guide
Hacking Articles
AWS security tools
Rawsec's CyberSecurity Inventory
The Illustrated TLS Connection
SSL Research
Certificates and PKI
The Art of Subdomain Enumeration
Quitting Google
OWASP
OWASP ASVS 3.0.1
OWASP ASVS 3.0.1 Web App
OWASP ASVS 4.0
OWASP Testing Guide v4
Mozilla Web Security
Enable CORS
Application Security Wiki
Weird Proxies
Webshells
Practical Web Cache Poisoning
Hidden directories and files
Security Cookies
CTF Series : Vulnerable Machines
How to start RE/malware analysis?
LZone Cheat Sheets
Dan’s Cheat Sheets’s
Rico's cheatsheets
The C10K problem
Bank Grade Security
HTTPS on Stack Overflow
Julia's Drawings
Hash collisions
BGP Meets Cat
HTTPS in the real world
Gitlab and NFS bug
How To Become A Hacker
Operation Costs in CPU
Awesome Sysadmin
Awesome Shell
Command-line-text-processing
Awesome Pcaptools
Linux Network Performance
Awesome Postgres
Awesome-Selfhosted
kubernetes-the-hard-way
List of applications
Front-End-Checklist
Python's Magic Methods
wtfpython
Awesome Web Security
awesome-cyber-skills
Red-Teaming-Toolkit
awesome-burp-extensions
Free Security eBooks
reverse-engineering
Awesome-WAF
Movies for Hackers
technical-whitepapers
Brendan Gregg's Blog
Gynvael "GynDream" Coldwind
Michał "lcamtuf" Zalewski
Mattias Geniar
Nick Craver
Robert Penz
Scott Helme
Binni Shah
Kacper Szurek
Troy Hunt
raymii.org
Linux Audit
Linux Security Expert
The Grymoire
PortSwigger Web Security Blog
How to Do Things at ARL
Sandcat Browser
Metasploit
Burp Suite
OWASP Zed Attack Proxy
w3af
mitmproxy
Nikto2
sqlmap
Faraday
Photon
XSStrike
John The Ripper
hashcat
p0f
Recon-ng
exploitdb
ctf-tools
security-tools
fuzzdb
syzkaller
GDB PEDA
IDA
radare2
Vulnreport
Mentalist
PTES
Pentests MindMap
WebApps Security Tests MindMap
Brute XSS
Offensive Security Bookmarks
Awesome Pentest Cheat Sheets
Awesome Hacking by HackWithGithub
Awesome Hacking by carpedm20
Awesome Hacking Resources
Awesome Pentest
Hacking Cheat Sheet
Cyber Security Resources
Pentest Bookmarks
PayloadsAllTheThings
payloads
Pentesting Tools Cheat Sheet
DEF CON Media Server
Awesome Malware Analysis
SQL Injection Cheat Sheet
Entersoft Knowledge Base
HTML5 Security Cheatsheet
XSS String Encoder
GTFOBins
Guifre Ruiz Notes
SSRF Tips
shell-storm repo CTF
ctf
MSTG
Weakpass
Hashes.org
SecLists
Probable-Wordlists
skullsecurity passwords
Polish PREMIUM Dictionary
1
Bounty platforms
:small_orange_diamond:
Bounty Factory
Openbugbounty
hackerone
bugcrowd
Crowdshield
Synack
Hacktrophy
YesWeHack
OWASP-VWAD
Metasploitable 2
DVWA
OWASP Mutillidae II
OWASP Juice Shop Project
OWASP WebGoat Project
Security Ninjas
hackazon
dvna
Google Gruyere
Bodhi
Websploit
Offensive Security
Hack The Box
Hacking-Lab
pwnable.kr
Pwnable.tw
picoCTF
CTFlearn
Silesia Security Lab
Practical Pentest Labs
Root Me
rozwal.to
TryHackMe
hackxor
Hack Yourself First
OverTheWire
Wizard Labs
PentesterLab
RingZer0
Ubeeri
Pentestit
Microcorruption
Crackmes
Bugcrowd University
OSCPRepo
OWASP Top 10: Real-World Examples
Feedly
Inoreader
#hackerspaces
The Hacker News
Latest Hacking News
Security Newsletter
Google Online Security Blog
Qualys Blog
DARKReading
Darknet
publiclyDisclosed
Reddit - Hacking
Packet Storm
Sekurak
nf.sec
Unbound DNS Tutorial
Knot Resolver on Fedora
DNS-over-HTTPS
DNS Servers
OpenSSL Certificate Authority
os-tutorial
Write your Own Virtual Machine
terminal
mount
fuser
ps
find
top
strace
kill
diff
tail
tar
dump
cpulimit
pwdx
taskset
tr
chmod
who
last
screen
script
du
inotifywait
openssl
secure-delete
dd
gpg
system-other
curl
httpie
ssh
linux-dev
tcpdump
ip:port
ip:port
tcpick
ngrep
hping3
nmap
netcat
gnutls-cli
socat
p0f
lsof
netstat
rsync
host
dig
certbot
network-other
git
python
awk
sed
grep
CLI Tools
GUI Tools
Web Tools
Systems/Services
Networks
Manuals/Howtos/Tutorials
Inspiring Lists
Blogs
Hacking/Penetration Testing
Your daily knowledge and news
Other Cheat Sheets
One-liners
Shell functions
[TOC]
[TOC]
[TOC]
[TOC]
[TOC]
[TOC]
[TOC]
[TOC]
[TOC]
[TOC]
[TOC]
[TOC]
System
terminal
mount
fuser
ps
top
strace
kill
find
diff
tail
cpulimit
pwdx
tr
chmod
who
last
screen
script
du
inotifywait
openssl
secure-delete
dd
gpg
system-other
HTTP/HTTPS
curl
httpie
Network
ssh
linux-dev
tcpdump
tcpick
ngrep
hping3
nmap
netcat
socat
p0f
gnutls-cli
lsof
netstat
rsync
host
dig
certbot
network-other
Programming
git
awk
sed
grep
[TOC]
Domain resolve
Get ASN
dns.watch
opennic.org
verisign.com
censurfridns.dk
cloudflare.com
dnsprivacy.at