xeusnguyen.xyz

Search

SearchSearch

Recent Notes

See 135 more →

The collections of hacking, security and anything about malicious

Jan 12, 2025, 17 min read

Info

This page for purpose share the idea, community, skillset, technical about Cyber Security and Information Security. How we can improve the skillset via LAB and CTF contest

center

Awesome Articles / Blogs / Collections InfoSec

Articles

Info

The collection of myself about tool and technique is useful for learning and practicing Cyber and Info Security

Blogs

Info

Blog page where provide you more information about techniques, tools and madness things inside information security field

General

Info

General things will cover a lot of stuff when you want to start with cyber and information security

Awesome InfoSec Repository

Info

The madness and badass repository will provide huge information about Cyber and Information Security

Landscape

Repository

  • awesome-api-security: A collection of awesome API Security tools and resources. The focus goes to open-source tools and resources that benefit all the community.
  • awesome-ctf : A curated list of CTF frameworks, libraries, resources and softwares
  • awesome-cybersecurity-handbooks : A huge chunk of my personal notes since I started playing CTFs and working as a Red Teamer.
  • awesome-hacker-search-engines : A curated list of awesome search engines useful during Penetration testing, Vulnerability assessments, Red/Blue Team operations, Bug Bounty and more
  • awesome-hacking : A collection of various awesome lists for hackers, pentesters and security researchers
  • awesome-infosec : A curated list of awesome infosec courses and training resources.
  • awesome-pentest : A collection of awesome penetration testing resources, tools and other shiny things
  • awesome-privilege-escalation : A curated list of awesome privilege escalation
  • CheatSheetSeries : The OWASP Cheat Sheet Series was created to provide a concise collection of high value information on specific application security topics.
  • h4cker : About ethical hacking, bug bounties, digital forensics and incident response (DFIR), artificial intelligence security, vulnerability research, exploit development, reverse engineering, and more.
  • HackTricks - Cloud : Wikipedia of Hacking Cloud
  • HackTricks - Penatration Testing : Wikipedia of Hacking
  • MobileApp-Pentest-Cheatsheet : Arsenal for mobile application attack
  • OWASP Collection: Free for Open Source Application Security Tools
  • OWASP Project : Collection about OWASP Opensource
  • pentest-book: This book contains a bunch of info, scripts and knowledge used during pentests.
  • public-pentesting-reports: A list of public penetration test reports published by several consulting firms and academic security groups.
  • sec_profile: Chinese Collection about Security with profile vulnerability and awesome hacking technique
  • the-book-of-secret-knowledge : A collection of inspiring lists, manuals, cheat-sheets, blogs, hacks, one-liners, cli/web tools and more.
  • The Hacker Recipes: providing technical guides on various hacking topics

Topics

Bug Bounty

Info

A bug bounty program is a deal offered by many websites, organizations, and software developers by which individuals can receive recognition and compensation for reporting bugs, especially those pertaining to security exploits and vulnerabilities

You can become participant of Bounty program via

CTF (Capture the flag)

center

Info

“CTFs are gamified competitive cybersecurity events that are based on different challenges or aspects of information security. They are excellent for both beginners and experienced hackers looking to develop, test, and prove their skills because they gamify hacking concepts. We’re big believers in the power of gamification here at Hack The Box! Gamification makes learning about something like a video game. Because gamification is fun and makes you think creatively, it’s one of the most effective ways to learn and develop skills.”

Best Writeups ever

Events

  • CTFTime : Place where you can find the next CTF events time.

Introduce

Training page

Youtube Channel

  • Almond Force: He write about Web and Forensic CTF challenge, Supper cool guy
  • CryptoCat: InfoSec education channel: CTF walkthroughs, binary exploitation, pen-testing, bug bounty, malware analysis, programming/scripting etc.
  • Martin Carlisle: Super cool and bring you more knowledge about CTF, especially for newbie via PicoCTF
  • SloppyJoePirates CTF Writeups: Trust me, he is really rare CTF player with most of passion and helpful contents

Tools and Techniques

Cloud

Info

Cloud computing security or, more simply, cloud security, refers to a broad set of policies, technologies, applications, and controls utilized to protect virtualized IP, data, applications, services, and the associated infrastructure of cloud computing. It is a sub-domain of computer security, network security, and, more broadly, information security. Source: Wikipedia

  • Hacking the Cloud: An encyclopedia of the attacks/tactics/techniques that offensive security professionals can use on their next cloud exploitation adventure.
  • T Wiki : Chinese page who talk about Security Cloud with multiple provider like Azure, AWS, GCP, …

Exploitation

Info

In this phase, ethical hacker need to attack to target and try to grasp some thing about weakness of system or applications

Collections about Attack and Defend

Cryptography

Forensics

Privilege Escalation (RCE)

Reverse Engineer (RE)

Webhook

  • Beeceptor : API Mocking
  • Mockoon: Locally mock API
  • Webhook.site : Generates free, unique URLs and e-mail addresses and lets you see everything that’s sent there instantly. (Usage: Steal cookies, bypass authorized, …)

External

Info

The collection of myself about something are need for prepare for security and explore about how the applications prevent with attack to network, code and moreover

Burp extension

  • agartha : A Burp extension helps identifying injection flaws (LFI, RCE, SQLi), authentication/authorization issues, and HTTP 403 access violations, while also converting HTTP requests to JavaScript for enhanced XSS exploitation.

Code Search Engine

Code Validate

  • codeql: the libraries and queries that power security researchers around the world, as well as code scanning in GitHub Advanced Security

IAST (Interactive Application Security Testing)

  • DongTai: (IAST) tool that enables real-time detection of common vulnerabilities in Java applications and third-party components through passive instrumentation.

Mobile

SOC Operation system

  • VultureOS :  An operating system based on HardenedBSD. It has been design to deliverer cybersecurity services for the Advens SOC.

Vulnerability management

  • django-DefectDojo : DevSecOps, ASPM, Vulnerability Management. All on one platform.
  • faraday: Open Source Vulnerability Management Platform
  • ThreatMapper: Open Source Cloud Native Application Protection Platform (CNAPP). Documentation
  • vuls: Agent-less vulnerability scanner for Linux, FreeBSD, Container, WordPress, Programming language libraries, Network devices

Vulnerability Scanner

  • Nettacker : Automated Penetration Testing Framework - Open-Source Vulnerability Scanner - Vulnerability Management
  • nuclei : Fast and customizable vulnerability scanner based on simple YAML based DSL. Doc and Cloud Platform
  • zaproxy : The ZAP core project

Vulnerables Search Engine

Web Application Firewall (WAF)

  • lua-resty-waf : High-performance WAF built on the OpenResty stack
  • ModSecurity :  An open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx.
  • naxsi : An open-source, high performance, low rules maintenance WAF for NGINX
  • Nginx-Lua-Anti-DDoS : A Anti-DDoS script to protect Nginx web servers using Lua with a HTML Javascript

Networking

Info

Security techniques take the concept around networking and techniques related

External Networking Techniques

  • awesome-tunneling : List of ngrok/Cloudflare Tunnel alternatives and other tunneling software and services. Focus on self-hosting.
  • frp: A fast reverse proxy to help you expose a local server behind a NAT or firewall to the internet.
  • GO Simple Tunnel: A simple security tunnel written in golang
  • localtunnel: Localtunnel allows you to easily share a web service on your local development machine without messing with DNS and firewall settings.
  • NetExec : The Network Execution Tool. Website
  • wstunnel : Tunnel all your traffic over Websocket or HTTP2 - Bypass firewalls/DPI - Static binary available
  • Xray-core: Xray, Penetrates Everything. Also the best v2ray-core, with XTLS support. Fully compatible configuration.
  • ZTM : A privacy-first open-source decentralized network software based on HTTP/2 tunnels.

General knowledge

VPN

Give applause for Nyr for contributing a wonderful setup, with those script, you just need 1 minutes for creating your own VPN and safely connected remotely with your network

Reconnaissance (All categories)

Info

In this phase, the tester gathers as much information about the target system as they can, including information about the network topology, operating systems and applications, user accounts, and other relevant information. The goal is to gather as much data as possible so that the tester can plan an effective attack strategy.

Container

  • crane: A tool for interacting with remote images and registries
  • dive : A tool for exploring each layer in a docker image
  • trivy: Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

OSINT

Web

Thread Intelligent

  • openappsec: A machine learning security engine that preemptively and automatically prevents threats against Web Application & APIs.
  • teleport: The easiest, and most secure way to access and protect all of your infrastructure.

Training page (LAB)

Info

The collections of mine about what you need to learn, how to solve problem and figure out what you decide on hacking, doing security and have fun

Forensics

Info

Network + Forensics + Digital Forensics

Introduce

Reverse Engineer

  • Crackme : Place to improving the RE skill
  • Nightmare: Intro to binary exploitation / reverse engineering course based around ctf challenges

Security Lab

Info

Misc + Lab Machine

Walkthrough

Info

HacktheBox/CTF solution, hacking technical and OSCP

Youtube Channel

Info

Hacking/InfoSec Youtube Channel

  • 13Cubed: Digital Forensics. Hacking. Home Labs.
  • Computerphile: All about computers and computer stuff
  • Cristi Vlad
  • David Bombal : Networking Guy with hand on in physical network items, hacking conservation and guide you on hacking journey with cool contribute
  • DAY0: Previous DAY[0] podcasts as well as other reverse engineering / exploit development-related media
  • DC CyberSec: Freelance in Cybersecurity Guy
  • Grant Collins: Funny guy who guide you about Cybersecurity career, education, and the occasional deeboodah shenanigans.
  • HackerSploit : HackerSploit is the leading provider of free Infosec and cybersecurity training
  • Hak5
  • InsiderPhD: She is guiding about bug bounty for starter, cool contents and technics
  • IppSec: Best ever on HTB Solution, Guide you pwn a box and learn about scenarios to reaching them
  • John Hammond : Super dope and cool guy who teach you helpful things, cool stuff about hacking, cyber security
  • LiveOverflow: Binary exploiting guy with guide you about that, more about IT security
  • Loi Liang Yang: Super cool technic with hacking can explore
  • LTN Labs: Empowering others through building engaging educational experiences and communities
  • Motasem Hamdan: HTB and THM resolution, creative guy who will guide you about security
  • NahamSec: Bug bounty guy with impressed technics, conversation hacking and moreover
  • NetworkChuck: Very Helpful, super dope and friendly guy with detailing explanation, who can be able to guide you about network, cloud, linux and more about homelab (Recommendation)
  • Null Byte : Aspiring ethical hackers, computer scientists, and the infosec community
  • SecurityFWD: SecurityFWD shows the latest security tools, amazing projects, and keeps you on the edge of what’s possible in security today.
  • Seytonic : Break down and dissect cyber security related tech news
  • STÖK: Bug Bounty sharing, explain and suggest a cool mindset prep for bug bounty
  • The Cyber Mentor: TCM Security, Very clear contents for starters
  • Zanidd: Hacker, Dev & Educator
  • zSecurity: Provide for guideline to becoming Ethical Hacker

Graph View

Backlinks