xeusnguyen.xyz

Search

SearchSearch

Recent Notes

See 120 more โ†’

The collections of hacking, security and anything about malicious

Nov 17, 2024, 17 min read

Info

This page for purpose share the idea, community, skillset, technical about Cyber Security and Information Security. How we can improve the skillset via LAB and CTF contest

General

Info

General things will cover a lot of stuff when you want to start with cyber and information security

InfoSec Blog page

Info

Blog page where provide you more information about techniques, tools and madness things inside information security field

Awesome Infomation Security repository

Info

The madness and badass repository will provide huge information about Cyber and Information Security

  • awesome-pentest : A collection of awesome penetration testing resources, tools and other shiny things
  • awesome-infosec : A curated list of awesome infosec courses and training resources.
  • the-book-of-secret-knowledge : A collection of inspiring lists, manuals, cheat-sheets, blogs, hacks, one-liners, cli/web tools and more.
  • awesome-api-security: A collection of awesome API Security tools and resources. The focus goes to open-source tools and resources that benefit all the community.
  • Awesome-Hacking : A collection of various awesome lists for hackers, pentesters and security researchers
  • awesome-hacker-search-engines : A curated list of awesome search engines useful during Penetration testing, Vulnerability assessments, Red/Blue Team operations, Bug Bounty and more
  • h4cker : About ethical hacking, bug bounties, digital forensics and incident response (DFIR), artificial intelligence security, vulnerability research, exploit development, reverse engineering, and more.
  • GO Simple Tunnel: A simple security tunnel written in golang
  • awesome-ctf : A curated list of CTF frameworks, libraries, resources and softwares
  • Awesome-Cybersecurity-Handbooks : A huge chunk of my personal notes since I started playing CTFs and working as a Red Teamer.
  • awesome-privilege-escalation : A curated list of awesome privilege escalation
  • NetExec : The Network Execution Tool. Website
  • CheatSheetSeries : The OWASP Cheat Sheet Series was created to provide a concise collection of high value information on specific application security topics.
  • HackTricks - HackTricks : Wikipedia of Hacking
  • Cloud - HackTricks : Wikipedia of Hacking Cloud
  • pentest-book: This book contains a bunch of info, scripts and knowledge used during pentests.
  • public-pentesting-reports: A list of public penetration test reports published by several consulting firms and academic security groups.
  • The Hacker Recipes: providing technical guides on various hacking topics
  • MobileApp-Pentest-Cheatsheet : Arsenal for mobile application attack
  • OWASP Project : Collection about OWASP Opensource
  • OWASP Collection: Free for Open Source Application Security Tools
  • sec_profile: Chinese Collection about Security with profile vulnerability and awesome hacking technique

Awesome Articles

Info

The collection of myself about tool and technique is useful for learning and practicing Cyber and Info Security

Tools and Techniques

Reconnaissance (All categories)

Info

In this phase, the tester gathers as much information about the target system as they can, including information about the network topology, operating systems and applications, user accounts, and other relevant information. The goal is to gather as much data as possible so that the tester can plan an effective attack strategy.

Container

  • dive : A tool for exploring each layer in a docker image
  • crane: A tool for interacting with remote images and registries
  • trivy: Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

OSINT

Web

Exploitation

Info

In this phase, ethical hacker need to attack to target and try to grasp some thing about weakness of system or applications

Collections about Attack and Defend

Privilege Escalation (RCE)

Cryptography

Forensics

Webhook

  • Webhook.site : Generates free, unique URLs and e-mail addresses and lets you see everything thatโ€™s sent there instantly. (Usage: Steal cookies, bypass authorized, โ€ฆ)
  • Mockoon: Locally mock API
  • Beeceptor : API Mocking

Reverse Engineer (RE)

External

Info

The collection of myself about something are need for prepare for security and explore about how the applications prevent with attack to network, code and moreover

Web Application Firewall

  • ModSecurity : ย An open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx.
  • naxsi : An open-source, high performance, low rules maintenance WAF for NGINX
  • lua-resty-waf : High-performance WAF built on the OpenResty stack
  • Nginx-Lua-Anti-DDoS : A Anti-DDoS script to protect Nginx web servers using Lua with a HTML Javascript

Code Search Engine

Vulnerables Search Engine

Vulnerability management

  • faraday: Open Source Vulnerability Management Platform
  • vuls: Agent-less vulnerability scanner for Linux, FreeBSD, Container, WordPress, Programming language libraries, Network devices
  • ThreatMapper: Open Source Cloud Native Application Protection Platform (CNAPP). Documentation
  • django-DefectDojo : DevSecOps, ASPM, Vulnerability Management. All on one platform.

Vulnerability Scanner

  • Nettacker : Automated Penetration Testing Framework - Open-Source Vulnerability Scanner - Vulnerability Management
  • nuclei : Fast and customizable vulnerability scanner based on simple YAML based DSL. Doc and Cloud Platform
  • zaproxy : The ZAP core project

SOC Operation system

  • VultureOS : ย An operating system based onย HardenedBSD. It has been design to deliverer cybersecurity services for the Advens SOC.

Mobile

Burp extension

  • agartha : A Burp extension helps identifying injection flaws (LFI, RCE, SQLi), authentication/authorization issues, and HTTP 403 access violations, while also converting HTTP requests to JavaScript for enhanced XSS exploitation.

Code Validate

  • codeql: the libraries and queries that power security researchers around the world, as well as code scanning in GitHub Advanced Security

IAST (Interactive Application Security Testing)

  • DongTai: (IAST) tool that enables real-time detection of common vulnerabilities in Java applications and third-party components through passive instrumentation.

Networking

Info

Security techniques take the concept around networking and techniques related

General knowledge

VPN

Give applause for Nyr for contributing a wonderful setup, with those script, you just need 1 minutes for creating your own VPN and safely connected remotely with your network

External Networking Techniques

  • awesome-tunneling : List of ngrok/Cloudflare Tunnel alternatives and other tunneling software and services. Focus on self-hosting.
  • wstunnel : Tunnel all your traffic over Websocket or HTTP2 - Bypass firewalls/DPI - Static binary available
  • ZTM : A privacy-first open-source decentralized network software based on HTTP/2 tunnels.
  • Xray-core: Xray, Penetrates Everything. Also the best v2ray-core, with XTLS support. Fully compatible configuration.
  • frp: A fast reverse proxy to help you expose a local server behind a NAT or firewall to the internet.
  • localtunnel: Localtunnel allows you to easily share a web service on your local development machine without messing with DNS and firewall settings.

Cloud

Info

Cloud computing security or, more simply, cloud security, refers to a broad set of policies, technologies, applications, and controls utilized to protect virtualized IP, data, applications, services, and the associated infrastructure of cloud computing. It is a sub-domain of computer security, network security, and, more broadly, information security. Source: Wikipedia

  • T Wiki : Chinese page who talk about Security Cloud with multiple provider like Azure, AWS, GCP, โ€ฆ
  • Hacking the Cloud: An encyclopedia of the attacks/tactics/techniques that offensive security professionals can use on their next cloud exploitation adventure.

Training page (LAB)

Info

The collections of mine about what you need to learn, how to solve problem and figure out what you decide on hacking, doing security and have fun

Introduce

Reverse Engineer

  • Crackme : Place to improving the RE skill
  • Nightmare: Intro to binary exploitation / reverse engineering course based around ctf challenges

Security Lab

Info

Misc + Lab Machine

Forensics

Info

Network + Forensics + Digital Forensics

Walkthrough

Info

HacktheBox/CTF solution, hacking technical and OSCP

CTF (Capture the flag)

center

Info

โ€œCTFs are gamified competitive cybersecurity events that are based on different challenges or aspects of information security. They are excellent for both beginners and experienced hackers looking to develop, test, and prove their skills because they gamify hacking concepts. Weโ€™re big believers in the power of gamification here at Hack The Box! Gamification makes learning about something like a video game. Because gamification is fun and makes you think creatively, itโ€™s one of the most effective ways to learn and develop skills.โ€

Introduce

Youtube Channel

  • Martin Carlisle: Super cool and bring you more knowledge about CTF, especially for newbie via PicoCTF
  • SloppyJoePirates CTF Writeups: Trust me, he is really rare CTF player with most of passion and helpful contents
  • Almond Force: He write about Web and Forensic CTF challenge, Supper cool guy
  • CryptoCat: InfoSec education channel: CTF walkthroughs, binary exploitation, pen-testing, bug bounty, malware analysis, programming/scripting etc.

Training page

Events

  • CTFTime : Place where you can find the next CTF events time.

Best Writeups ever

Bug Bounty

Info

Aย bug bounty programย is a deal offered by many websites, organizations, and software developers by which individuals can receive recognition and compensationย for reportingย bugs, especially those pertaining toย securityย exploitsย andย vulnerabilities

You can become participant of Bounty program via

Youtube Channel

Info

Hacking/InfoSec Youtube Channel

  • 13Cubed: Digital Forensics. Hacking. Home Labs.
  • Motasem Hamdan: HTB and THM resolution, creative guy who will guide you about security
  • John Hammond : Super dope and cool guy who teach you helpful things, cool stuff about hacking, cyber security
  • David Bombal : Networking Guy with hand on in physical network items, hacking conservation and guide you on hacking journey with cool contribute
  • LiveOverflow: Binary exploiting guy with guide you about that, more about IT security
  • NetworkChuck: Very Helpful, super dope and friendly guy with detailing explanation (Recommendation), guide you about network, cloud, linux and more about homelab
  • IppSec: Best ever on HTB Solution, Guide you pwn a box and learn about scenarios to reaching them
  • Loi Liang Yang: Super cool technic with hacking can explore
  • Computerphile: All about computers and computer stuff
  • The Cyber Mentor: TCM Security, Very clear contents for starters
  • Null Byte : Aspiring ethical hackers, computer scientists, and the infosec community
  • DC CyberSec: Freelance in Cybersecurity Guy
  • Grant Collins: Funny guy who guide you about Cybersecurity career, education, and the occasional deeboodah shenanigans.
  • Seytonic : Break down and dissect cyber security related tech news
  • STร–K: Bug Bounty sharing, explain and suggest a cool mindset prep for bug bounty
  • InsiderPhD: She is guiding about bug bounty for starter, cool contents and technics
  • SecurityFWD: SecurityFWD shows the latest security tools, amazing projects, and keeps you on the edge of whatโ€™s possible in security today.
  • zSecurity: Provide for guideline to becoming Ethical Hacker
  • Hak5
  • Zanidd: Hacker, Dev & Educator
  • HackerSploit : HackerSploit is the leading provider of free Infosec and cybersecurity training
  • NahamSec: Bug bounty guy with impressed technics, conversation hacking and moreover
  • DAY0: Previous DAY[0] podcasts as well as other reverse engineering / exploit development-related media
  • Cristi Vlad
  • LTN Labs

Graph View

Backlinks