PenTesting Resources / Links¶
A collection of awesome penetration testing resources¶
- https://github.com/sindresorhus/awesome
- https://github.com/enaqx/awesome-pentest
- https://github.com/coreb1t/awesome-pentest-cheat-sheets
- https://github.com/carpedm20/awesome-hacking
- https://github.com/apsdehal/awesome-ctf
- https://github.com/AnarchoTechNYC/meta/wiki/InfoSec
- https://github.com/onlurking/awesome-infosec
- https://github.com/rmusser01/Infosec_Reference
- https://github.com/vitalysim/Awesome-Hacking-Resources
- https://github.com/dostoevskylabs/dostoevsky-pentest-notes/blob/master/SUMMARY.md
- https://github.com/nixawk/pentest-wiki
Lists of tools¶
- https://linuxsecurity.expert/security-tools/top-100/
- https://linuxsecurity.expert/tools/lynis/
- http://inquisb.github.io/keimpx/
- Hacking Tools Repository: http://gexos.github.io/Hacking-Tools-Repository/
- https://www.concise-courses.com/hacking-tools/top-ten/
- https://www.us-cert.gov/bsi/articles/tools/penetration-testing-tools/penetration-testing-tools
Payloads and Fuzzing¶
- https://github.com/swisskyrepo/PayloadsAllTheThings
- https://github.com/tennc/fuzzdb/tree/master/dict/BURP-PayLoad
- https://github.com/fuzzdb-project/fuzzdb
DNS Enumerations¶
Enumeration¶
- General
- https://booksite.elsevier.com/samplechapters/9781597496278/Chapter_3.pdf
- scripts
- https://highon.coffee/blog/linux-local-enumeration-script/
- Checklists
- https://highon.coffee/blog/penetration-testing-tools-cheat-sheet/
- https://www.rebootuser.com/?p=1623 - Local Linux Enumeration & Privilege Escalation Cheatsheet
- Additional info
- http://resources.infosecinstitute.com/what-is-enumeration/#gref
- https://booksite.elsevier.com/samplechapters/9781597496278/Chapter_3.pdf
- https://www.cyberciti.biz/faq/how-do-i-find-out-what-ports-are-listeningopen-on-my-linuxfreebsd-server/
- Windows
- https://www.sans.org/reading-room/whitepapers/testing/scanning-windows-deeper-nmap-scanning-engine-33138
- http://www.hackingarticles.in/netbios-and-smb-penetration-testing-on-windows/
- http://www.hackingdna.com/2016/09/smb-enumeration.html
User enumeration¶
SharePointURLBrute¶
Priv Esc¶
- Linux
- https://blog.g0tmi1k.com/2011/08/basic-linux-privilege-escalation/
- http://www.hackingarticles.in/4-ways-get-linux-privilege-escalation/
- https://hackmag.com/security/reach-the-root/
- http://www.admin-magazine.com/Articles/Understanding-Privilege-Escalation
- http://security-geek.in/2016/09/01/linux-privilege-escalation-cheat-sheet/
- Windows
- https://medium.com/@rahmatnurfauzi/windows-privilege-escalation-scripts-techniques-30fa37bd194
- https://xapax.gitbooks.io/security/content/privilege_escalation_windows.html
- http://www.greyhathacker.net/?p=738
- https://github.com/AlessandroZ/BeRoot
- https://github.com/foxglovesec/RottenPotato
- http://www.fuzzysecurity.com/tutorials/16.html
Password Cracking¶
Reverse Shell cheatsheets¶
- http://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
- https://highon.coffee/blog/reverse-shell-cheat-sheet/
Reverse Engineering¶
Ciphers¶
Python References¶
- Requests
- http://docs.python-requests.org/en/master/
- Beautiful Soup
- https://www.crummy.com/software/BeautifulSoup/bs4/doc/
Node.js deserialization bug¶
- https://opsecx.com/index.php/2017/02/08/exploiting-node-js-deserialization-bug-for-remote-code-execution/
- https://github.com/ajinabraham/Node.Js-Security-Course/blob/master/nodejsshell.py
jq¶
- https://github.com/stedolan/jq/wiki/
- https://starkandwayne.com/blog/bash-for-loop-over-json-array-using-jq/
- https://stedolan.github.io/jq/manual/
cheatsheet¶
https://cheat.sh/ https://github.com/chubin/cheat.sh
PHP Type Juggling - magic hashes¶
Extracting screenshot from FrameBuffer¶
- https://www.cnx-software.com/2010/07/18/how-to-do-a-framebuffer-screenshot/
- https://w00tsec.blogspot.com/2015/02/extracting-raw-pictures-from-memory.html
Additional Websites¶
- https://thehacktoday.com/top-10-websites-for-hackers/
- Steganography
- https://www.wired.com/story/steganography-hacker-lexicon/
- SSH
- https://help.ubuntu.com/community/SSH/OpenSSH/Keys
- https://www.trustedsec.com/2014/11/meterssh-meterpreter-ssh/
- Posters / Desktop Backgrounds
- https://pen-testing.sans.org/blog/2013/06/20/announcing-the-ultimate-sans-pen-test-poster
- https://pen-testing.sans.org/blog/2017/02/07/command-line-kung-fu-penetration-testing-desktop-wallpapers/comment-page-1/
Additional Reading¶
- https://wiki.debian.org/SystemGroups
- https://en.wikipedia.org/wiki/Computer_terminal#Text_terminals
- https://en.wikipedia.org/wiki/Named_pipe
- https://jamielinux.com/docs/openssl-certificate-authority/sign-server-and-client-certificates.html
- https://www.thesslstore.com/blog/root-certificates-intermediate/
- https://support.dnsimple.com/articles/what-is-ssl-certificate-chain/