You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

преди 2 години
преди 4 години
преди 4 години
преди 4 години
преди 2 години
преди 5 години
преди 5 години
преди 5 години
преди 5 години
преди 5 години
преди 4 години
преди 4 години
преди 4 години
преди 5 години
преди 5 години
преди 5 години
преди 5 години
преди 5 години
преди 5 години
преди 2 години
преди 5 години
преди 5 години
преди 5 години
преди 5 години
преди 5 години
преди 5 години
преди 5 години
преди 6 години
преди 3 години
преди 4 години
преди 4 години
преди 5 години
преди 6 години
преди 5 години
преди 5 години
преди 3 години
преди 5 години
преди 5 години
преди 5 години
преди 3 години
преди 3 години
преди 3 години
преди 5 години
преди 3 години
преди 4 години
преди 4 години
преди 2 години
преди 4 години
преди 5 години
преди 2 години
преди 5 години
преди 4 години
преди 5 години
преди 5 години
преди 5 години
преди 5 години
преди 5 години
преди 3 години
преди 4 години
преди 5 години
преди 5 години
преди 5 години
преди 5 години
преди 5 години
преди 5 години
преди 5 години
преди 4 години
преди 4 години
преди 2 години
преди 5 години
преди 5 години
преди 5 години
преди 4 години
преди 5 години
преди 4 години
преди 5 години
преди 5 години
преди 5 години
преди 5 години
преди 5 години
преди 5 години
преди 5 години
преди 5 години
преди 5 години
преди 5 години
преди 5 години
преди 5 години
преди 5 години
преди 5 години
преди 5 години
преди 5 години
преди 2 години
преди 5 години
преди 5 години
преди 5 години
преди 5 години
преди 5 години
преди 5 години
преди 5 години
преди 5 години
преди 2 години
преди 5 години
преди 5 години
преди 5 години
преди 5 години
преди 2 години
преди 5 години
преди 2 години
преди 5 години
преди 5 години
преди 5 години
преди 5 години
преди 5 години
преди 5 години
преди 5 години
преди 5 години
преди 5 години
преди 5 години
преди 5 години
преди 5 години
преди 5 години
преди 3 години
преди 2 години
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410141114121413141414151416141714181419142014211422142314241425142614271428142914301431143214331434143514361437143814391440144114421443144414451446144714481449145014511452145314541455145614571458145914601461146214631464146514661467146814691470147114721473147414751476147714781479148014811482148314841485148614871488148914901491149214931494149514961497149814991500150115021503150415051506150715081509151015111512151315141515151615171518151915201521152215231524152515261527152815291530153115321533153415351536153715381539154015411542154315441545154615471548154915501551155215531554155515561557155815591560156115621563156415651566156715681569157015711572157315741575157615771578157915801581158215831584158515861587158815891590159115921593159415951596159715981599160016011602160316041605160616071608160916101611161216131614161516161617161816191620162116221623162416251626162716281629163016311632163316341635163616371638163916401641164216431644164516461647164816491650165116521653165416551656165716581659166016611662166316641665166616671668166916701671167216731674167516761677167816791680168116821683168416851686168716881689169016911692169316941695169616971698169917001701170217031704170517061707170817091710171117121713171417151716171717181719172017211722172317241725172617271728172917301731173217331734173517361737173817391740174117421743174417451746174717481749175017511752175317541755175617571758175917601761176217631764176517661767176817691770177117721773177417751776177717781779178017811782178317841785178617871788178917901791179217931794179517961797179817991800180118021803180418051806180718081809181018111812181318141815181618171818181918201821182218231824182518261827182818291830183118321833183418351836183718381839184018411842184318441845184618471848184918501851185218531854185518561857185818591860186118621863186418651866186718681869187018711872187318741875187618771878187918801881188218831884188518861887188818891890189118921893189418951896189718981899190019011902190319041905190619071908190919101911191219131914191519161917191819191920192119221923192419251926192719281929193019311932193319341935193619371938193919401941194219431944194519461947194819491950195119521953195419551956195719581959196019611962196319641965196619671968196919701971197219731974197519761977197819791980198119821983198419851986198719881989199019911992199319941995199619971998199920002001200220032004200520062007200820092010201120122013201420152016201720182019202020212022202320242025202620272028202920302031203220332034203520362037203820392040204120422043204420452046204720482049205020512052205320542055205620572058205920602061206220632064206520662067206820692070207120722073207420752076207720782079208020812082208320842085208620872088208920902091209220932094209520962097209820992100210121022103210421052106210721082109211021112112211321142115211621172118211921202121212221232124212521262127212821292130213121322133213421352136213721382139214021412142214321442145214621472148214921502151215221532154215521562157215821592160216121622163216421652166216721682169217021712172217321742175217621772178217921802181218221832184218521862187218821892190219121922193219421952196219721982199220022012202220322042205220622072208220922102211221222132214221522162217221822192220222122222223222422252226222722282229223022312232223322342235223622372238223922402241224222432244224522462247224822492250225122522253225422552256225722582259226022612262226322642265226622672268226922702271227222732274227522762277227822792280228122822283228422852286228722882289229022912292229322942295229622972298229923002301230223032304230523062307230823092310231123122313231423152316231723182319232023212322232323242325232623272328232923302331233223332334233523362337233823392340234123422343234423452346234723482349235023512352235323542355235623572358235923602361236223632364236523662367236823692370237123722373237423752376237723782379238023812382238323842385238623872388238923902391239223932394239523962397239823992400240124022403240424052406240724082409241024112412241324142415241624172418241924202421242224232424242524262427242824292430243124322433243424352436243724382439244024412442244324442445244624472448244924502451245224532454245524562457245824592460246124622463246424652466246724682469247024712472247324742475247624772478247924802481248224832484248524862487248824892490249124922493249424952496249724982499250025012502250325042505250625072508250925102511251225132514251525162517251825192520252125222523252425252526252725282529253025312532253325342535253625372538253925402541254225432544254525462547254825492550255125522553255425552556255725582559256025612562256325642565256625672568256925702571257225732574257525762577257825792580258125822583258425852586258725882589259025912592259325942595259625972598259926002601260226032604260526062607260826092610261126122613261426152616261726182619262026212622262326242625262626272628262926302631263226332634263526362637263826392640264126422643264426452646264726482649265026512652265326542655265626572658265926602661266226632664266526662667266826692670267126722673267426752676267726782679268026812682268326842685268626872688268926902691269226932694269526962697269826992700270127022703270427052706270727082709271027112712271327142715271627172718271927202721272227232724272527262727272827292730273127322733273427352736273727382739274027412742274327442745274627472748274927502751275227532754275527562757275827592760276127622763276427652766276727682769277027712772277327742775277627772778277927802781278227832784278527862787278827892790279127922793279427952796279727982799280028012802280328042805280628072808280928102811281228132814281528162817281828192820282128222823282428252826282728282829283028312832283328342835283628372838283928402841284228432844284528462847284828492850285128522853285428552856285728582859286028612862286328642865286628672868286928702871287228732874287528762877287828792880288128822883288428852886288728882889289028912892289328942895289628972898289929002901290229032904290529062907290829092910291129122913291429152916291729182919292029212922292329242925292629272928292929302931293229332934293529362937293829392940294129422943294429452946294729482949295029512952295329542955295629572958295929602961296229632964296529662967296829692970297129722973297429752976297729782979298029812982298329842985298629872988298929902991299229932994299529962997299829993000300130023003300430053006300730083009301030113012301330143015301630173018301930203021302230233024302530263027302830293030303130323033303430353036303730383039304030413042304330443045304630473048304930503051305230533054305530563057305830593060306130623063306430653066306730683069307030713072307330743075307630773078307930803081308230833084308530863087308830893090309130923093309430953096309730983099310031013102310331043105310631073108310931103111311231133114311531163117311831193120312131223123312431253126312731283129313031313132313331343135313631373138313931403141314231433144314531463147314831493150315131523153315431553156315731583159316031613162316331643165316631673168316931703171317231733174317531763177317831793180318131823183318431853186318731883189319031913192319331943195319631973198319932003201320232033204320532063207320832093210321132123213321432153216321732183219322032213222322332243225322632273228322932303231323232333234323532363237323832393240324132423243324432453246324732483249325032513252325332543255325632573258325932603261326232633264326532663267326832693270327132723273327432753276327732783279328032813282328332843285328632873288328932903291329232933294329532963297329832993300330133023303330433053306330733083309331033113312331333143315331633173318331933203321332233233324332533263327332833293330333133323333333433353336333733383339334033413342334333443345334633473348334933503351335233533354335533563357335833593360336133623363336433653366336733683369337033713372337333743375337633773378337933803381338233833384338533863387338833893390339133923393339433953396339733983399340034013402340334043405340634073408340934103411341234133414341534163417341834193420342134223423342434253426342734283429343034313432343334343435343634373438343934403441344234433444344534463447344834493450345134523453345434553456345734583459346034613462346334643465346634673468346934703471347234733474347534763477347834793480348134823483348434853486348734883489349034913492349334943495349634973498349935003501350235033504350535063507350835093510351135123513351435153516351735183519352035213522352335243525352635273528352935303531353235333534353535363537353835393540354135423543354435453546354735483549355035513552355335543555355635573558355935603561356235633564356535663567356835693570357135723573357435753576357735783579358035813582358335843585358635873588358935903591359235933594359535963597359835993600360136023603360436053606360736083609361036113612361336143615361636173618361936203621362236233624362536263627362836293630363136323633363436353636363736383639364036413642364336443645364636473648364936503651365236533654365536563657365836593660366136623663366436653666366736683669367036713672367336743675367636773678367936803681368236833684368536863687368836893690369136923693369436953696369736983699370037013702370337043705370637073708370937103711371237133714371537163717371837193720372137223723372437253726372737283729373037313732373337343735373637373738373937403741374237433744374537463747374837493750375137523753375437553756375737583759376037613762376337643765376637673768376937703771377237733774377537763777377837793780378137823783378437853786378737883789379037913792379337943795379637973798379938003801380238033804380538063807380838093810381138123813381438153816381738183819382038213822382338243825382638273828382938303831383238333834383538363837383838393840384138423843384438453846384738483849385038513852385338543855385638573858385938603861386238633864386538663867386838693870387138723873387438753876387738783879388038813882388338843885388638873888388938903891389238933894389538963897389838993900390139023903390439053906390739083909391039113912391339143915391639173918391939203921392239233924392539263927392839293930393139323933393439353936393739383939394039413942394339443945394639473948394939503951395239533954395539563957395839593960396139623963396439653966396739683969397039713972397339743975397639773978397939803981398239833984398539863987398839893990399139923993399439953996399739983999400040014002400340044005400640074008400940104011401240134014401540164017401840194020402140224023402440254026402740284029403040314032403340344035403640374038403940404041404240434044404540464047404840494050405140524053405440554056405740584059406040614062406340644065406640674068406940704071407240734074407540764077407840794080408140824083408440854086408740884089409040914092409340944095409640974098409941004101410241034104410541064107410841094110411141124113411441154116411741184119412041214122412341244125412641274128412941304131413241334134413541364137413841394140414141424143414441454146414741484149415041514152415341544155415641574158415941604161416241634164416541664167416841694170417141724173417441754176417741784179418041814182418341844185418641874188418941904191419241934194419541964197419841994200420142024203420442054206420742084209421042114212421342144215421642174218421942204221422242234224422542264227422842294230423142324233423442354236423742384239424042414242424342444245424642474248424942504251425242534254425542564257425842594260426142624263426442654266426742684269427042714272427342744275427642774278427942804281428242834284428542864287428842894290429142924293429442954296429742984299430043014302430343044305430643074308430943104311431243134314431543164317431843194320432143224323432443254326432743284329433043314332433343344335433643374338433943404341434243434344434543464347434843494350435143524353435443554356435743584359436043614362436343644365436643674368436943704371437243734374437543764377437843794380438143824383438443854386438743884389439043914392439343944395439643974398439944004401440244034404440544064407440844094410441144124413441444154416441744184419442044214422442344244425442644274428442944304431443244334434443544364437443844394440444144424443444444454446444744484449445044514452445344544455
  1. <p align="center">
  2. <a href="https://github.com/trimstray/the-book-of-secret-knowledge">
  3. <img src="./static/img/the-book-of-secret-knowledge-preview-black.png#gh-light-mode-only" alt="Master">
  4. <img src="./static/img/the-book-of-secret-knowledge-preview-white.png#gh-dark-mode-only" alt="Master">
  5. </a>
  6. </p>
  7. <p align="center">"<i>Knowledge is powerful, be careful how you use it!</i>"</p>
  8. <h4 align="center">A collection of inspiring lists, manuals, cheatsheets, blogs, hacks, one-liners, cli/web tools, and more.</h4>
  9. <br>
  10. <p align="center">
  11. <a href="https://github.com/trimstray/the-book-of-secret-knowledge/pulls">
  12. <img src="https://img.shields.io/badge/PRs-welcome-brightgreen.svg?longCache=true" alt="Pull Requests">
  13. </a>
  14. <a href="LICENSE.md">
  15. <img src="https://img.shields.io/badge/License-MIT-lightgrey.svg?longCache=true" alt="MIT License">
  16. </a>
  17. </p>
  18. <p align="center">
  19. <a href="https://twitter.com/trimstray" target="_blank">
  20. <img src="https://img.shields.io/twitter/follow/trimstray.svg?logo=twitter">
  21. </a>
  22. </p>
  23. <div align="center">
  24. <sub>Created by
  25. <a href="https://twitter.com/trimstray">trimstray</a> and
  26. <a href="https://github.com/trimstray/the-book-of-secret-knowledge/graphs/contributors">contributors</a>
  27. </div>
  28. <br>
  29. ****
  30. ## :notebook_with_decorative_cover: &nbsp;What is it?
  31. This repository is a collection of various materials and tools that I use every day in my work. It contains a lot of useful information gathered in one piece. It is an invaluable source of knowledge for me that I often look back on.
  32. ## :restroom: &nbsp;For whom?
  33. For everyone, really. Here everyone can find their favourite tastes. But to be perfectly honest, it is aimed towards System and Network administrators, DevOps, Pentesters, and Security Researchers.
  34. ## :information_source: &nbsp;Contributing
  35. If you find something which doesn't make sense, or something doesn't seem right, please make a pull request and please add valid and well-reasoned explanations about your changes or comments.
  36. A few simple rules for this project:
  37. - inviting and clear
  38. - not tiring
  39. - useful
  40. These below rules may be better:
  41. - easy to contribute to (Markdown + HTML ...)
  42. - easy to find (simple TOC, maybe it's worth extending them?)
  43. Url marked **\*** is temporary unavailable. Please don't delete it without confirming that it has permanently expired.
  44. Before adding a pull request, please see the **[contributing guidelines](.github/CONTRIBUTING.md)**. You should also remember about this:
  45. ```diff
  46. + This repository is not meant to contain everything but only good quality stuff.
  47. ```
  48. All **suggestions/PR** are welcome!
  49. ### Code Contributors
  50. This project exists thanks to all the people who contribute.
  51. <a href="https://github.com/trimstray/the-book-of-secret-knowledge/graphs/contributors"><img src="https://opencollective.com/the-book-of-secret-knowledge/contributors.svg?width=890&button=false"></a>
  52. ### Financial Contributors
  53. <p align="left">
  54. <a href="https://opencollective.com/the-book-of-secret-knowledge" alt="Financial Contributors on Open Collective">
  55. <img src="https://img.shields.io/opencollective/backers/the-book-of-secret-knowledge?style=for-the-badge&color=FF4500&labelColor=A9A9A9"></a>
  56. </a>
  57. <a href="https://opencollective.com/the-book-of-secret-knowledge" alt="Financial Contributors on Open Collective">
  58. <img src="https://img.shields.io/opencollective/sponsors/the-book-of-secret-knowledge?style=for-the-badge&color=FF4500&labelColor=A9A9A9"></a>
  59. </a>
  60. </p>
  61. ## :newspaper: &nbsp;RSS Feed & Updates
  62. GitHub exposes an [RSS/Atom](https://github.com/trimstray/the-book-of-secret-knowledge/commits.atom) feed of the commits, which may also be useful if you want to be kept informed about all changes.
  63. ## :ballot_box_with_check: &nbsp;ToDo
  64. - [ ] Add new stuff...
  65. - [ ] Add useful shell functions
  66. - [ ] Add one-liners for collection tools (eg. CLI Tools)
  67. - [ ] Sort order in lists
  68. New items are also added on a regular basis.
  69. ## :anger: &nbsp;Table of Contents
  70. Only main chapters:
  71. - **[CLI Tools](#cli-tools-toc)**
  72. - **[GUI Tools](#gui-tools-toc)**
  73. - **[Web Tools](#web-tools-toc)**
  74. - **[Systems/Services](#systemsservices-toc)**
  75. - **[Networks](#networks-toc)**
  76. - **[Containers/Orchestration](#containersorchestration-toc)**
  77. - **[Manuals/Howtos/Tutorials](#manualshowtostutorials-toc)**
  78. - **[Inspiring Lists](#inspiring-lists-toc)**
  79. - **[Blogs/Podcasts/Videos](#blogspodcastsvideos-toc)**
  80. - **[Hacking/Penetration Testing](#hackingpenetration-testing-toc)**
  81. - **[Your daily knowledge and news](#your-daily-knowledge-and-news-toc)**
  82. - **[Other Cheat Sheets](#other-cheat-sheets-toc)**
  83. - **[Shell One-liners](#shell-one-liners-toc)**
  84. - **[Shell Tricks](#shell-tricks-toc)**
  85. - **[Shell Functions](#shell-functions-toc)**
  86. ## :trident: &nbsp;The Book of Secret Knowledge (Chapters)
  87. #### CLI Tools &nbsp;[<sup>[TOC]</sup>](#anger-table-of-contents)
  88. ##### :black_small_square: Shells
  89. <p>
  90. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.gnu.org/software/bash/"><b>GNU Bash</b></a> - is an sh-compatible shell that incorporates useful features from the Korn shell and C shell.<br>
  91. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.zsh.org/"><b>Zsh</b></a> - is a shell designed for interactive use, although it is also a powerful scripting language.<br>
  92. &nbsp;&nbsp;:small_orange_diamond: <a href="https://tcl-lang.org/"><b>tclsh</b></a> - is a very powerful cross-platform shell, suitable for a huge range of uses.<br>
  93. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/Bash-it/bash-it"><b>bash-it</b></a> - is a framework for using, developing and maintaining shell scripts and custom commands.<br>
  94. &nbsp;&nbsp;:small_orange_diamond: <a href="https://ohmyz.sh/"><b>Oh My ZSH!</b></a> - is the best framework for managing your Zsh configuration.<br>
  95. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/oh-my-fish/oh-my-fish"><b>Oh My Fish</b></a> - the Fishshell framework.<br>
  96. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/starship/starship"><b>Starship</b></a> - the cross-shell prompt written in Rust.<br>
  97. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/romkatv/powerlevel10k"><b>powerlevel10k</b></a> - is a fast reimplementation of Powerlevel9k ZSH theme.<br>
  98. </p>
  99. ##### :black_small_square: Shell plugins
  100. <p>
  101. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/rupa/z"><b>z</b></a> - tracks the folder you use the most and allow you to jump, without having to type the whole path.<br>
  102. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/junegunn/fzf"><b>fzf</b></a> - is a general-purpose command-line fuzzy finder.<br>
  103. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/zsh-users/zsh-autosuggestions"><b>zsh-autosuggestions</b></a> - Fish-like autosuggestions for Zsh.<br>
  104. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/zsh-users/zsh-syntax-highlighting"><b>zsh-syntax-highlighting</b></a> - Fish shell like syntax highlighting for Zsh.<br>
  105. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/unixorn/awesome-zsh-plugins"><b>Awesome ZSH Plugins</b></a> - A list of frameworks, plugins, themes and tutorials for ZSH.<br>
  106. </p>
  107. ##### :black_small_square: Managers
  108. <p>
  109. &nbsp;&nbsp;:small_orange_diamond: <a href="https://midnight-commander.org/"><b>Midnight Commander</b></a> - is a visual file manager, licensed under GNU General Public License.<br>
  110. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/ranger/ranger"><b>ranger</b></a> - is a VIM-inspired filemanager for the console.<br>
  111. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/jarun/nnn"><b>nnn</b></a> - is a tiny, lightning fast, feature-packed file manager.<br>
  112. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.gnu.org/software/screen/"><b>screen</b></a> - is a full-screen window manager that multiplexes a physical terminal.<br>
  113. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/tmux/tmux/wiki"><b>tmux</b></a> - is a terminal multiplexer, lets you switch easily between several programs in one terminal.<br>
  114. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/peikk0/tmux-cssh"><b>tmux-cssh</b></a> - is a tool to set comfortable and easy to use functionality, clustering and synchronizing tmux-sessions.<br>
  115. </p>
  116. ##### :black_small_square: Text editors
  117. <p>
  118. &nbsp;&nbsp;:small_orange_diamond: <a href="http://ex-vi.sourceforge.net/"><b>vi</b></a> - is one of the most common text editors on Unix.<br>
  119. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.vim.org/"><b>vim</b></a> - is a highly configurable text editor.<br>
  120. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.gnu.org/software/emacs/"><b>emacs</b></a> - is an extensible, customizable, free/libre text editor, and more.<br>
  121. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/zyedidia/micro"><b>micro</b></a> - is a modern and intuitive terminal-based text editor.<br>
  122. &nbsp;&nbsp;:small_orange_diamond: <a href="https://neovim.io/"><b>neovim</b></a> - is a free open source, powerful, extensible and usable code editor.<br>
  123. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.spacemacs.org/"><b>spacemacs</b></a> - a community-driven Emacs distribution.<br>
  124. &nbsp;&nbsp;:small_orange_diamond: <a href="https://spacevim.org/"><b>spacevim</b></a> - a community-driven vim distribution.<br>
  125. </p>
  126. ##### :black_small_square: Files and directories
  127. <p>
  128. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/sharkdp/fd"><b>fd</b></a> - is a simple, fast and user-friendly alternative to find.<br>
  129. &nbsp;&nbsp;:small_orange_diamond: <a href="https://dev.yorhel.nl/ncdu"><b>ncdu</b></a> - is an easy to use, fast disk usage analyzer.<br>
  130. </p>
  131. ##### :black_small_square: Network
  132. <p>
  133. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.putty.org/"><b>PuTTY</b></a> - is an SSH and telnet client, developed originally by Simon Tatham.<br>
  134. &nbsp;&nbsp;:small_orange_diamond: <a href="https://mosh.org/"><b>Mosh</b></a> - is a SSH wrapper designed to keep a SSH session alive over a volatile connection.<br>
  135. &nbsp;&nbsp;:small_orange_diamond: <a href="https://eternalterminal.dev/"><b>Eternal Terminal</b></a> - enables mouse-scrolling and tmux commands inside the SSH session.<br>
  136. &nbsp;&nbsp;:small_orange_diamond: <a href="https://nmap.org/"><b>nmap</b></a> - is a free and open source (license) utility for network discovery and security auditing.<br>
  137. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/zmap/zmap"><b>zmap</b></a> - is a fast single packet network scanner designed for Internet-wide network surveys.<br>
  138. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/RustScan/RustScan"><b>Rust Scan</b></a> - to find all open ports faster than Nmap.<br>
  139. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/robertdavidgraham/masscan"><b>masscan</b></a> - is the fastest Internet port scanner, spews SYN packets asynchronously.<br>
  140. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/gvb84/pbscan"><b>pbscan</b></a> - is a faster and more efficient stateless SYN scanner and banner grabber.<br>
  141. &nbsp;&nbsp;:small_orange_diamond: <a href="http://www.hping.org/"><b>hping</b></a> - is a command-line oriented TCP/IP packet assembler/analyzer.<br>
  142. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/traviscross/mtr"><b>mtr</b></a> - is a tool that combines the functionality of the 'traceroute' and 'ping' programs in a single tool.<br>
  143. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/mehrdadrad/mylg"><b>mylg</b></a> - utility which combines the functions of the different network probes in one diagnostic tool.<br>
  144. &nbsp;&nbsp;:small_orange_diamond: <a href="http://netcat.sourceforge.net/"><b>netcat</b></a> - utility which reads and writes data across network connections, using the TCP/IP protocol.<br>
  145. &nbsp;&nbsp;:small_orange_diamond: <a href="http://www.dest-unreach.org/socat/"><b>socat</b></a> - utility which transfers data between two objects.<br>
  146. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.tcpdump.org/"><b>tcpdump</b></a> - is a powerful command-line packet analyzer.<br>
  147. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.wireshark.org/docs/man-pages/tshark.html"><b>tshark</b></a> - is a tool that allows us to dump and analyze network traffic (wireshark cli).<br>
  148. &nbsp;&nbsp;:small_orange_diamond: <a href="https://termshark.io/"><b>Termshark</b></a> - is a simple terminal user-interface for tshark.<br>
  149. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/jpr5/ngrep"><b>ngrep</b></a> - is like GNU grep applied to the network layer.<br>
  150. &nbsp;&nbsp;:small_orange_diamond: <a href="http://netsniff-ng.org/"><b>netsniff-ng</b></a> - is a Swiss army knife for your daily Linux network plumbing if you will.<br>
  151. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/mechpen/sockdump"><b>sockdump</b></a> - dump unix domain socket traffic.<br>
  152. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/google/stenographer"><b>stenographer</b></a> - is a packet capture solution which aims to quickly spool all packets to disk.<br>
  153. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/sachaos/tcpterm"><b>tcpterm</b></a> - visualize packets in TUI.<br>
  154. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/tgraf/bmon"><b>bmon</b></a> - is a monitoring and debugging tool to capture networking related statistics and prepare them visually.<br>
  155. &nbsp;&nbsp;:small_orange_diamond: <a href="http://iptraf.seul.org/2.6/manual.html#installation"><b>iptraf-ng</b></a> - is a console-based network monitoring program for Linux that displays information about IP traffic.<br>
  156. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/vergoh/vnstat"><b>vnstat</b></a> - is a network traffic monitor for Linux and BSD.<br>
  157. &nbsp;&nbsp;:small_orange_diamond: <a href="https://iperf.fr/"><b>iPerf3</b></a> - is a tool for active measurements of the maximum achievable bandwidth on IP networks.<br>
  158. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/Microsoft/Ethr"><b>ethr</b></a> - is a Network Performance Measurement Tool for TCP, UDP & HTTP.<br>
  159. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/jwbensley/Etherate"><b>Etherate</b></a> - is a Linux CLI based Ethernet and MPLS traffic testing tool.<br>
  160. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/mpolden/echoip"><b>echoip</b></a> - is a IP address lookup service.<br>
  161. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/troglobit/nemesis"><b>Nemesis</b></a> - packet manipulation CLI tool; craft and inject packets of several protocols.<br>
  162. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/packetfu/packetfu"><b>packetfu</b></a> - a mid-level packet manipulation library for Ruby.<br>
  163. &nbsp;&nbsp;:small_orange_diamond: <a href="https://scapy.net/"><b>Scapy</b></a> - packet manipulation library; forge, send, decode, capture packets of a wide number of protocols.<br>
  164. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/SecureAuthCorp/impacket"><b>impacket</b></a> - is a collection of Python classes for working with network protocols.<br>
  165. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/arthepsy/ssh-audit"><b>ssh-audit</b></a> - is a tool for SSH server auditing.<br>
  166. &nbsp;&nbsp;:small_orange_diamond: <a href="https://aria2.github.io/"><b>aria2</b></a> - is a lightweight multi-protocol & multi-source command-line download utility.<br>
  167. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/x-way/iptables-tracer"><b>iptables-tracer</b></a> - observe the path of packets through the iptables chains.<br>
  168. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/proabiral/inception"><b>inception</b></a> - a highly configurable tool to check for whatever you like against any number of hosts.<br>
  169. &nbsp;&nbsp;:small_orange_diamond: <a href="https://mremoteng.org/"><b>mRemoteNG</b></a> - a fork of mRemote, multi-tabbed PuTTy on steroids!<br>
  170. </p>
  171. ##### :black_small_square: Network (DNS)
  172. <p>
  173. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/farrokhi/dnsdiag"><b>dnsdiag</b></a> - is a DNS diagnostics and performance measurement tools.<br>
  174. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/mschwager/fierce"><b>fierce</b></a> - is a DNS reconnaissance tool for locating non-contiguous IP space.<br>
  175. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/subfinder/subfinder"><b>subfinder</b></a> - is a subdomain discovery tool that discovers valid subdomains for websites.<br>
  176. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/aboul3la/Sublist3r"><b>sublist3r</b></a> - is a fast subdomains enumeration tool for penetration testers.<br>
  177. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/OWASP/Amass"><b>amass</b></a> - is tool that obtains subdomain names by scraping data sources, crawling web archives, and more.<br>
  178. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/google/namebench"><b>namebench</b></a> - provides personalized DNS server recommendations based on your browsing history.<br>
  179. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/blechschmidt/massdns"><b>massdns</b></a> - is a high-performance DNS stub resolver for bulk lookups and reconnaissance.<br>
  180. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/guelfoweb/knock"><b>knock</b></a> - is a tool to enumerate subdomains on a target domain through a wordlist.<br>
  181. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/DNS-OARC/dnsperf"><b>dnsperf</b></a> - DNS performance testing tools.<br>
  182. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/jedisct1/dnscrypt-proxy"><b>dnscrypt-proxy 2</b></a> - a flexible DNS proxy, with support for encrypted DNS protocols.<br>
  183. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/dnsdb/dnsdbq"><b>dnsdbq</b></a> - API client providing access to passive DNS database systems.<br>
  184. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/looterz/grimd"><b>grimd</b></a> - fast dns proxy, built to black-hole internet advertisements and malware servers.<br>
  185. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/elceef/dnstwist"><b>dnstwist</b></a> - detect typosquatters, phishing attacks, fraud, and brand impersonation.<br>
  186. </p>
  187. ##### :black_small_square: Network (HTTP)
  188. <p>
  189. &nbsp;&nbsp;:small_orange_diamond: <a href="https://curl.haxx.se/"><b>curl</b></a> - is a command line tool and library for transferring data with URLs.<br>
  190. &nbsp;&nbsp;:small_orange_diamond: <a href="https://gitlab.com/davidjpeacock/kurly"><b>kurly</b></a> - is an alternative to the widely popular curl program, written in Golang.<br>
  191. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/jakubroztocil/httpie"><b>HTTPie</b></a> - is an user-friendly HTTP client.<br>
  192. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/asciimoo/wuzz"><b>wuzz</b></a> - is an interactive cli tool for HTTP inspection.<br>
  193. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/summerwind/h2spec"><b>h2spec</b></a> - is a conformance testing tool for HTTP/2 implementation.<br>
  194. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/gildasio/h2t"><b>h2t</b></a> - is a simple tool to help sysadmins to hardening their websites.<br>
  195. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/trimstray/htrace.sh"><b>htrace.sh</b></a> - is a simple Swiss Army knife for http/https troubleshooting and profiling.<br>
  196. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/reorx/httpstat"><b>httpstat</b></a> - is a tool that visualizes curl statistics in a way of beauty and clarity.<br>
  197. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/gchaincl/httplab"><b>httplab</b></a> - is an interactive web server.<br>
  198. &nbsp;&nbsp;:small_orange_diamond: <a href="https://lynx.browser.org/"><b>Lynx</b></a> - is a text browser for the World Wide Web.<br>
  199. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/browsh-org/browsh/"><b>Browsh</b></a> - is a fully interactive, real-time, and modern text-based browser.<br>
  200. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/dhamaniasad/HeadlessBrowsers"><b>HeadlessBrowsers</b></a> - a list of (almost) all headless web browsers in existence.<br>
  201. &nbsp;&nbsp;:small_orange_diamond: <a href="https://httpd.apache.org/docs/2.4/programs/ab.html"><b>ab</b></a> - is a single-threaded command line tool for measuring the performance of HTTP web servers.<br>
  202. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.joedog.org/siege-home/"><b>siege</b></a> - is an http load testing and benchmarking utility.<br>
  203. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/wg/wrk"><b>wrk</b></a> - is a modern HTTP benchmarking tool capable of generating significant load.<br>
  204. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/giltene/wrk2"><b>wrk2</b></a> - is a constant throughput, correct latency recording variant of wrk.<br>
  205. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/tsenart/vegeta"><b>vegeta</b></a> - is a constant throughput, correct latency recording variant of wrk.<br>
  206. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/codesenberg/bombardier"><b>bombardier</b></a> - is a fast cross-platform HTTP benchmarking tool written in Go.<br>
  207. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/cmpxchg16/gobench"><b>gobench</b></a> - http/https load testing and benchmarking tool.<br>
  208. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/rakyll/hey"><b>hey</b></a> - HTTP load generator, ApacheBench (ab) replacement, formerly known as rakyll/boom.<br>
  209. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/tarekziade/boom"><b>boom</b></a> - is a script you can use to quickly smoke-test your web app deployment.<br>
  210. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/shekyan/slowhttptest"><b>SlowHTTPTest</b></a> - is a tool that simulates some Application Layer Denial of Service attacks by prolonging HTTP.<br>
  211. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/OJ/gobuster"><b>gobuster</b></a> - is a free and open source directory/file & DNS busting tool written in Go.<br>
  212. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/ssllabs/ssllabs-scan"><b>ssllabs-scan</b></a> - command-line reference-implementation client for SSL Labs APIs.<br>
  213. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/mozilla/http-observatory"><b>http-observatory</b></a> - Mozilla HTTP Observatory cli version.<br>
  214. &nbsp;&nbsp;:small_orange_diamond: <a href="https://hurl.dev"><b>Hurl</b></a> - is a command line tool to run and test HTTP requests with plain text.<br>
  215. </p>
  216. ##### :black_small_square: SSL
  217. <p>
  218. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.openssl.org/"><b>openssl</b></a> - is a robust, commercial-grade, and full-featured toolkit for the TLS and SSL protocols.<br>
  219. &nbsp;&nbsp;:small_orange_diamond: <a href="https://gnutls.org/manual/html_node/gnutls_002dcli-Invocation.html"><b>gnutls-cli</b></a> - client program to set up a TLS connection to some other computer.<br>
  220. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/nabla-c0d3/sslyze"><b>sslyze
  221. </b></a> - fast and powerful SSL/TLS server scanning library.<br>
  222. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/rbsec/sslscan"><b>sslscan</b></a> - tests SSL/TLS enabled services to discover supported cipher suites.<br>
  223. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/drwetter/testssl.sh"><b>testssl.sh</b></a> - testing TLS/SSL encryption anywhere on any port.<br>
  224. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/mozilla/cipherscan"><b>cipherscan</b></a> - a very simple way to find out which SSL ciphersuites are supported by a target.<br>
  225. &nbsp;&nbsp;:small_orange_diamond: <a href="http://www.tarsnap.com/spiped.html"><b>spiped</b></a> - is a utility for creating symmetrically encrypted and authenticated pipes between socket addresses.<br>
  226. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/certbot/certbot"><b>Certbot</b></a> - is EFF's tool to obtain certs from Let's Encrypt and (optionally) auto-enable HTTPS on your server.<br>
  227. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/FiloSottile/mkcert"><b>mkcert</b></a> - simple zero-config tool to make locally trusted development certificates with any names you'd like.<br>
  228. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/square/certstrap"><b>certstrap</b></a> - tools to bootstrap CAs, certificate requests, and signed certificates.<br>
  229. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/yassineaboukir/sublert"><b>Sublert</b></a> - is a security and reconnaissance tool to automatically monitor new subdomains.<br>
  230. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/trimstray/mkchain"><b>mkchain</b></a> - open source tool to help you build a valid SSL certificate chain.<br>
  231. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/Matty9191/ssl-cert-check"><b>ssl-cert-check</b></a> - SSL Certification Expiration Checker.<br>
  232. </p>
  233. ##### :black_small_square: Security
  234. <p>
  235. &nbsp;&nbsp;:small_orange_diamond: <a href="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/5/html/deployment_guide/ch-selinux"><b>SELinux</b></a> - provides a flexible Mandatory Access Control (MAC) system built into the Linux kernel.<br>
  236. &nbsp;&nbsp;:small_orange_diamond: <a href="https://wiki.ubuntu.com/AppArmor"><b>AppArmor</b></a> - proactively protects the operating system and applications from external or internal threats.<br>
  237. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/grapheneX/grapheneX"><b>grapheneX</b></a> - Automated System Hardening Framework.<br>
  238. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/dev-sec/"><b>DevSec Hardening Framework</b></a> - Security + DevOps: Automatic Server Hardening.<br>
  239. </p>
  240. ##### :black_small_square: Auditing Tools
  241. <p>
  242. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.ossec.net/"><b>ossec</b></a> - actively monitoring all aspects of system activity with file integrity monitoring.<br>
  243. &nbsp;&nbsp;:small_orange_diamond: <a href="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security_guide/chap-system_auditing"><b>auditd</b></a> - provides a way to track security-relevant information on your system.<br>
  244. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.nongnu.org/tiger/"><b>Tiger</b></a> - is a security tool that can be use both as a security audit and intrusion detection system.<br>
  245. &nbsp;&nbsp;:small_orange_diamond: <a href="https://cisofy.com/lynis/"><b>Lynis</b></a> - battle-tested security tool for systems running Linux, macOS, or Unix-based operating system.<br>
  246. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/rebootuser/LinEnum"><b>LinEnum</b></a> - scripted Local Linux Enumeration & Privilege Escalation Checks.<br>
  247. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/installation/rkhunter"><b>Rkhunter</b></a> - scanner tool for Linux systems that scans backdoors, rootkits and local exploits on your systems.<br>
  248. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/hasherezade/pe-sieve"><b>PE-sieve</b></a> - is a light-weight tool that helps to detect malware running on the system.<br>
  249. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite"><b>PEASS</b></a> - privilege escalation tools for Windows and Linux/Unix and MacOS.<br>
  250. </p>
  251. ##### :black_small_square: System Diagnostics/Debuggers
  252. <p>
  253. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/strace/strace"><b>strace</b></a> - diagnostic, debugging and instructional userspace utility for Linux.<br>
  254. &nbsp;&nbsp;:small_orange_diamond: <a href="http://dtrace.org/blogs/about/"><b>DTrace</b></a> - is a performance analysis and troubleshooting tool.<br>
  255. &nbsp;&nbsp;:small_orange_diamond: <a href="https://en.wikipedia.org/wiki/Ltrace"><b>ltrace</b></a> - is a library call tracer, used to trace calls made by programs to library functions.<br>
  256. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/brainsmoke/ptrace-burrito"><b>ptrace-burrito</b></a> - is a friendly wrapper around ptrace.<br>
  257. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/brendangregg/perf-tools"><b>perf-tools</b></a> - performance analysis tools based on Linux perf_events (aka perf) and ftrace.<br>
  258. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/iovisor/bpftrace"><b>bpftrace</b></a> - high-level tracing language for Linux eBPF.<br>
  259. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/draios/sysdig"><b>sysdig</b></a> - system exploration and troubleshooting tool with first class support for containers.<br>
  260. &nbsp;&nbsp;:small_orange_diamond: <a href="http://www.valgrind.org/"><b>Valgrind</b></a> - is an instrumentation framework for building dynamic analysis tools.<br>
  261. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/gperftools/gperftools"><b>gperftools</b></a> - high-performance multi-threaded malloc() implementation, plus some performance analysis tools.<br>
  262. &nbsp;&nbsp;:small_orange_diamond: <a href="https://nicolargo.github.io/glances/"><b>glances</b></a> - cross-platform system monitoring tool written in Python.<br>
  263. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/hishamhm/htop"><b>htop</b></a> - interactive text-mode process viewer for Unix systems. It aims to be a better 'top'.<br>
  264. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/aristocratos/bashtop"><b>bashtop</b></a> - Linux resource monitor written in pure Bash.<br>
  265. &nbsp;&nbsp;:small_orange_diamond: <a href="http://nmon.sourceforge.net/pmwiki.php"><b>nmon</b></a> - a single executable for performance monitoring and data analysis.<br>
  266. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.atoptool.nl/"><b>atop</b></a> - ASCII performance monitor. Includes statistics for CPU, memory, disk, swap, network, and processes.<br>
  267. &nbsp;&nbsp;:small_orange_diamond: <a href="https://en.wikipedia.org/wiki/Lsof"><b>lsof</b></a> - displays in its output information about files that are opened by processes.<br>
  268. &nbsp;&nbsp;:small_orange_diamond: <a href="http://www.brendangregg.com/flamegraphs.html"><b>FlameGraph</b></a> - stack trace visualizer.<br>
  269. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/zevv/lsofgraph"><b>lsofgraph</b></a> - convert Unix lsof output to a graph showing FIFO and UNIX interprocess communication.<br>
  270. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/mozilla/rr"><b>rr</b></a> - is a lightweight tool for recording, replaying and debugging execution of applications.<br>
  271. &nbsp;&nbsp;:small_orange_diamond: <a href="https://pcp.io/index.html"><b>Performance Co-Pilot</b></a> - a system performance analysis toolkit.<br>
  272. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/sharkdp/hexyl"><b>hexyl</b></a> - a command-line hex viewer.<br>
  273. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/p403n1x87/austin"><b>Austin</b></a> - Python frame stack sampler for CPython.<br>
  274. </p>
  275. ##### :black_small_square: Log Analyzers
  276. <p>
  277. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/rcoh/angle-grinder"><b>angle-grinder</b></a> - slice and dice log files on the command line.<br>
  278. &nbsp;&nbsp;:small_orange_diamond: <a href="https://lnav.org"><b>lnav</b></a> - log file navigator with search and automatic refresh.<br>
  279. &nbsp;&nbsp;:small_orange_diamond: <a href="https://goaccess.io/"><b>GoAccess</b></a> - real-time web log analyzer and interactive viewer that runs in a terminal.<br>
  280. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/lebinh/ngxtop"><b>ngxtop</b></a> - real-time metrics for nginx server.<br>
  281. </p>
  282. ##### :black_small_square: Databases
  283. <p>
  284. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/xo/usql"><b>usql</b></a> - universal command-line interface for SQL databases.<br>
  285. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/dbcli/pgcli"><b>pgcli</b></a> - postgres CLI with autocompletion and syntax highlighting.<br>
  286. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/dbcli/mycli"><b>mycli</b></a> - terminal client for MySQL with autocompletion and syntax highlighting.<br>
  287. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/dbcli/litecli"><b>litecli</b></a> - SQLite CLI with autocompletion and syntax highlighting.<br>
  288. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/dbcli/mssql-cli"><b>mssql-cli</b></a> - SQL Server CLI with autocompletion and syntax highlighting.<br>
  289. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/osquery/osquery"><b>OSQuery</b></a> - is a SQL powered operating system instrumentation, monitoring, and analytics framework.<br>
  290. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/ankane/pgsync"><b>pgsync</b></a> - sync data from one Postgres database to another.<br>
  291. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/laixintao/iredis"><b>iredis</b></a> - a terminal client for redis with autocompletion and syntax highlighting.<br>
  292. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.schemacrawler.com/diagramming.html"><b>SchemaCrawler</b></a> - generates an E-R diagram of your database.<br>
  293. </p>
  294. ##### :black_small_square: TOR
  295. <p>
  296. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/GouveaHeitor/nipe"><b>Nipe</b></a> - script to make Tor Network your default gateway.<br>
  297. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/trimstray/multitor"><b>multitor</b></a> - a tool that lets you create multiple TOR instances with a load-balancing.<br>
  298. </p>
  299. ##### :black_small_square: Messengers/IRC Clients
  300. <p>
  301. &nbsp;&nbsp;:small_orange_diamond: <a href="https://irssi.org"><b>Irssi</b></a> - is a free open source terminal based IRC client.<br>
  302. &nbsp;&nbsp;:small_orange_diamond: <a href="https://weechat.org/"><b>WeeChat</b></a> - is an extremely extensible and lightweight IRC client.<br>
  303. </p>
  304. ##### :black_small_square: Productivity
  305. <p>
  306. &nbsp;&nbsp;:small_orange_diamond: <a href="https://taskwarrior.org"><b>taskwarrior</b></a> - task management system, todo list <br>
  307. </p>
  308. ##### :black_small_square: Other
  309. <p>
  310. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/skx/sysadmin-util"><b>sysadmin-util</b></a> - tools for Linux/Unix sysadmins.<br>
  311. &nbsp;&nbsp;:small_orange_diamond: <a href="http://inotify.aiken.cz/"><b>incron</b></a> - is an inode-based filesystem notification technology.<br>
  312. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/axkibe/lsyncd"><b>lsyncd</b></a> - synchronizes local directories with remote targets (Live Syncing Daemon).<br>
  313. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/rgburke/grv"><b>GRV</b></a> - is a terminal based interface for viewing Git repositories.<br>
  314. &nbsp;&nbsp;:small_orange_diamond: <a href="https://jonas.github.io/tig/"><b>Tig</b></a> - text-mode interface for Git.<br>
  315. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/tldr-pages/tldr"><b>tldr</b></a> - simplified and community-driven man pages.<br>
  316. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/mholt/archiver"><b>archiver</b></a> - easily create and extract .zip, .tar, .tar.gz, .tar.bz2, .tar.xz, .tar.lz4, .tar.sz, and .rar.<br>
  317. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/tj/commander.js"><b>commander.js</b></a> - minimal CLI creator in JavaScript.<br>
  318. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/tomnomnom/gron"><b>gron</b></a> - make JSON greppable!<br>
  319. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/itchyny/bed"><b>bed</b></a> - binary editor written in Go.<br>
  320. </p>
  321. #### GUI Tools &nbsp;[<sup>[TOC]</sup>](#anger-table-of-contents)
  322. ##### :black_small_square: Terminal emulators
  323. <p>
  324. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/Guake/guake"><b>Guake</b></a> - is a dropdown terminal made for the GNOME desktop environment.<br>
  325. &nbsp;&nbsp;:small_orange_diamond: <a href="https://gnometerminator.blogspot.com/p/introduction.html"><b>Terminator</b></a> - is based on GNOME Terminal, useful features for sysadmins and other users.<br>
  326. &nbsp;&nbsp;:small_orange_diamond: <a href="https://sw.kovidgoyal.net/kitty/"><b>Kitty</b></a> - is a GPU based terminal emulator that supports smooth scrolling and images.<br>
  327. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/alacritty/alacritty"><b>Alacritty</b></a> - is a fast, cross-platform, OpenGL terminal emulator.<br>
  328. </p>
  329. ##### :black_small_square: Network
  330. <p>
  331. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.wireshark.org/"><b>Wireshark</b></a> - is the world’s foremost and widely-used network protocol analyzer.<br>
  332. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.ettercap-project.org/"><b>Ettercap</b></a> - is a comprehensive network monitor tool.<br>
  333. &nbsp;&nbsp;:small_orange_diamond: <a href="https://etherape.sourceforge.io/"><b>EtherApe</b></a> - is a graphical network monitoring solution.<br>
  334. &nbsp;&nbsp;:small_orange_diamond: <a href="https://packetsender.com/"><b>Packet Sender</b></a> - is a networking utility for packet generation and built-in UDP/TCP/SSL client and servers.<br>
  335. &nbsp;&nbsp;:small_orange_diamond: <a href="https://ostinato.org/"><b>Ostinato</b></a> - is a packet crafter and traffic generator.<br>
  336. &nbsp;&nbsp;:small_orange_diamond: <a href="https://jmeter.apache.org/"><b>JMeter™</b></a> - open source software to load test functional behavior and measure performance.<br>
  337. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/locustio/locust"><b>locust</b></a> - scalable user load testing tool written in Python.<br>
  338. </p>
  339. ##### :black_small_square: Browsers
  340. <p>
  341. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.torproject.org/"><b>TOR Browser</b></a> - protect your privacy and defend yourself against network surveillance and traffic analysis.<br>
  342. </p>
  343. ##### :black_small_square: Password Managers
  344. <p>
  345. &nbsp;&nbsp;:small_orange_diamond: <a href="https://keepassxc.org/"><b>KeePassXC</b></a> - store your passwords safely and auto-type them into your everyday websites and apps.<br>
  346. &nbsp;&nbsp;:small_orange_diamond: <a href="https://bitwarden.com/"><b>Bitwarden</b></a> - open source password manager with built-in sync.<br>
  347. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/dani-garcia/vaultwarden/"><b>Vaultwarden</b></a> - unofficial Bitwarden compatible server written in Rust.<br>
  348. </p>
  349. ##### :black_small_square: Messengers/IRC Clients
  350. <p>
  351. &nbsp;&nbsp;:small_orange_diamond: <a href="https://hexchat.github.io/index.html"><b>HexChat</b></a> - is an IRC client based on XChat.<br>
  352. &nbsp;&nbsp;:small_orange_diamond: <a href="https://pidgin.im/"><b>Pidgin</b></a> - is an easy to use and free chat client used by millions.<br>
  353. </p>
  354. ##### :black_small_square: Messengers (end-to-end encryption)
  355. <p>
  356. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.signal.org/"><b>Signal</b></a> - is an encrypted communications app.<br>
  357. &nbsp;&nbsp;:small_orange_diamond: <a href="https://wire.com/en/"><b>Wire</b></a> - secure messaging, file sharing, voice calls and video conferences. All protected with end-to-end encryption.<br>
  358. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/prof7bit/TorChat"><b>TorChat</b></a> - decentralized anonymous instant messenger on top of Tor Hidden Services.<br>
  359. &nbsp;&nbsp;:small_orange_diamond: <a href="https://matrix.org/"><b>Matrix</b></a> - an open network for secure, decentralized, real-time communication.<br>
  360. </p>
  361. ##### :black_small_square: Text editors
  362. <p>
  363. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.sublimetext.com/3"><b>Sublime Text</b></a> - is a lightweight, cross-platform code editor known for its speed, ease of use.<br>
  364. &nbsp;&nbsp;:small_orange_diamond: <a href="https://code.visualstudio.com/"><b>Visual Studio Code</b></a> - an open-source and free source code editor developed by Microsoft.<br>
  365. &nbsp;&nbsp;:small_orange_diamond: <a href="https://atom.io/"><b>Atom</b></a> - a hackable text editor for the 21st Century.<br>
  366. </p>
  367. #### Web Tools &nbsp;[<sup>[TOC]</sup>](#anger-table-of-contents)
  368. ##### :black_small_square: Browsers
  369. <p>
  370. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.ssllabs.com/ssltest/viewMyClient.html"><b>SSL/TLS Capabilities of Your Browser</b></a> - test your browser's SSL implementation.<br>
  371. &nbsp;&nbsp;:small_orange_diamond: <a href="https://caniuse.com/"><b>Can I use</b></a> - provides up-to-date browser support tables for support of front-end web technologies.<br>
  372. &nbsp;&nbsp;:small_orange_diamond: <a href="https://panopticlick.eff.org/"><b>Panopticlick 3.0</b></a> - is your browser safe against tracking?<br>
  373. &nbsp;&nbsp;:small_orange_diamond: <a href="https://privacy.net/analyzer/"><b>Privacy Analyzer</b></a> - see what data is exposed from your browser.<br>
  374. &nbsp;&nbsp;:small_orange_diamond: <a href="https://browserleaks.com/"><b>Web Browser Security</b></a> - it's all about Web Browser fingerprinting.<br>
  375. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.howsmyssl.com/"><b>How's My SSL?</b></a> - help a web server developer learn what real world TLS clients were capable of.<br>
  376. &nbsp;&nbsp;:small_orange_diamond: <a href="https://suche.org/sslClientInfo"><b>sslClientInfo</b></a> - client test (incl TLSv1.3 information).<br>
  377. </p>
  378. ##### :black_small_square: SSL/Security
  379. <p>
  380. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.ssllabs.com/ssltest/"><b>SSLLabs Server Test</b></a> - performs a deep analysis of the configuration of any SSL web server.<br>
  381. &nbsp;&nbsp;:small_orange_diamond: <a href="https://dev.ssllabs.com/ssltest/"><b>SSLLabs Server Test (DEV)</b></a> - performs a deep analysis of the configuration of any SSL web server.<br>
  382. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.immuniweb.com/ssl/"><b>ImmuniWeb® SSLScan</b></a> - test SSL/TLS (PCI DSS, HIPAA and NIST).<br>
  383. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.jitbit.com/sslcheck/"><b>SSL Check</b></a> - scan your website for non-secure content.<br>
  384. &nbsp;&nbsp;:small_orange_diamond: <a href="http://www.ssltools.com"><b>SSL Scanner</b></a> - analyze website security.<br>
  385. &nbsp;&nbsp;:small_orange_diamond: <a href="https://cryptcheck.fr/"><b>CryptCheck</b></a> - test your TLS server configuration (e.g. ciphers).<br>
  386. &nbsp;&nbsp;:small_orange_diamond: <a href="https://urlscan.io/"><b>urlscan.io</b></a> - service to scan and analyse websites.<br>
  387. &nbsp;&nbsp;:small_orange_diamond: <a href="https://report-uri.com/home/tools"><b>Report URI</b></a> - monitoring security policies like CSP and HPKP.<br>
  388. &nbsp;&nbsp;:small_orange_diamond: <a href="https://csp-evaluator.withgoogle.com/"><b>CSP Evaluator</b></a> - allows developers and security experts to check if a Content Security Policy.<br>
  389. &nbsp;&nbsp;:small_orange_diamond: <a href="https://uselesscsp.com/"><b>Useless CSP</b></a> - public list about CSP in some big players (might make them care a bit more).<br>
  390. &nbsp;&nbsp;:small_orange_diamond: <a href="https://whynohttps.com/"><b>Why No HTTPS?</b></a> - top 100 websites by Alexa rank not automatically redirecting insecure requests.<br>
  391. &nbsp;&nbsp;:small_orange_diamond: <a href="https://ciphersuite.info/"><b>TLS Cipher Suite Search</b></a>- cipher suite search engine.<br>
  392. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/RaymiiOrg/cipherli.st"><b>cipherli.st</b></a> - strong ciphers for Apache, Nginx, Lighttpd, and more.<b>*</b><br>
  393. &nbsp;&nbsp;:small_orange_diamond: <a href="https://2ton.com.au/dhtool/"><b>dhtool</b></a> - public Diffie-Hellman parameter service/tool.<br>
  394. &nbsp;&nbsp;:small_orange_diamond: <a href="https://badssl.com/"><b>badssl.com</b></a> - memorable site for testing clients against bad SSL configs.<br>
  395. &nbsp;&nbsp;:small_orange_diamond: <a href="https://tlsfun.de/"><b>tlsfun.de</b></a> - registered for various tests regarding the TLS/SSL protocol.<br>
  396. &nbsp;&nbsp;:small_orange_diamond: <a href="https://sslmate.com/caa/"><b>CAA Record Helper</b></a> - generate a CAA policy.<br>
  397. &nbsp;&nbsp;:small_orange_diamond: <a href="https://ccadb.org/resources"><b>Common CA Database</b></a> - repository of information about CAs, and their root and intermediate certificates.<br>
  398. &nbsp;&nbsp;:small_orange_diamond: <a href="https://certstream.calidog.io/"><b>CERTSTREAM</b></a> - real-time certificate transparency log update stream.<br>
  399. &nbsp;&nbsp;:small_orange_diamond: <a href="https://crt.sh/"><b>crt.sh</b></a> - discovers certificates by continually monitoring all of the publicly known CT.<br>
  400. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.hardenize.com/"><b>Hardenize</b></a> - deploy the security standards.<br>
  401. &nbsp;&nbsp;:small_orange_diamond: <a href="https://cryptcheck.fr/suite/"><b>Cipher suite compatibility</b></a> - test TLS cipher suite compatibility.<br>
  402. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.urlvoid.com/"><b>urlvoid</b></a> - this service helps you detect potentially malicious websites.<br>
  403. &nbsp;&nbsp;:small_orange_diamond: <a href="https://securitytxt.org/"><b>security.txt</b></a> - a proposed standard (generator) which allows websites to define security policies.<br>
  404. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/mozilla/ssl-config-generator"><b>ssl-config-generator</b></a> - help you follow the Mozilla Server Side TLS configuration guidelines.<br>
  405. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/mjol/TLScan"><b>TLScan</b></a> - pure python, SSL/TLS protocol and cipher scanner/enumerator.<br>
  406. </p>
  407. ##### :black_small_square: HTTP Headers & Web Linters
  408. <p>
  409. &nbsp;&nbsp;:small_orange_diamond: <a href="https://securityheaders.com/"><b>Security Headers</b></a> - analyse the HTTP response headers (with rating system to the results).<br>
  410. &nbsp;&nbsp;:small_orange_diamond: <a href="https://observatory.mozilla.org/"><b>Observatory by Mozilla</b></a> - set of tools to analyze your website.<br>
  411. &nbsp;&nbsp;:small_orange_diamond: <a href="https://webhint.io/"><b>webhint</b></a> - is a linting tool that will help you with your site's accessibility, speed, security, and more.<br>
  412. </p>
  413. ##### :black_small_square: DNS
  414. <p>
  415. &nbsp;&nbsp;:small_orange_diamond: <a href="http://viewdns.info/"><b>ViewDNS</b></a> - one source for free DNS related tools and information.<br>
  416. &nbsp;&nbsp;:small_orange_diamond: <a href="https://dnslookup.org/"><b>DNSLookup</b></a> - is an advanced DNS lookup tool.<br>
  417. &nbsp;&nbsp;:small_orange_diamond: <a href="https://dnslytics.com/"><b>DNSlytics</b></a> - online DNS investigation tool.<br>
  418. &nbsp;&nbsp;:small_orange_diamond: <a href="https://dnsspy.io/"><b>DNS Spy</b></a> - monitor, validate and verify your DNS configurations.<br>
  419. &nbsp;&nbsp;:small_orange_diamond: <a href="https://zonemaster.iis.se/en/"><b>Zonemaster</b></a> - helps you to control how your DNS works.<br>
  420. &nbsp;&nbsp;:small_orange_diamond: <a href="http://leafdns.com/"><b>Leaf DNS</b></a> - comprehensive DNS tester.<br>
  421. &nbsp;&nbsp;:small_orange_diamond: <a href="https://findsubdomains.com/"><b>Find subdomains online</b></a> - find subdomains for security assessment penetration test.<br>
  422. &nbsp;&nbsp;:small_orange_diamond: <a href="https://dnsdumpster.com/"><b>DNSdumpster</b></a> - dns recon & research, find & lookup dns records.<br>
  423. &nbsp;&nbsp;:small_orange_diamond: <a href="https://dnstable.com/"><b>DNS Table online</b></a> - search for DNS records by domain, IP, CIDR, ISP.<br>
  424. &nbsp;&nbsp;:small_orange_diamond: <a href="https://intodns.com/"><b>intoDNS</b></a> - DNS and mail server health checker.<br>
  425. &nbsp;&nbsp;:small_orange_diamond: <a href="http://www.zonecut.net/dns/"><b>DNS Bajaj</b></a> - check the delegation of your domain.<br>
  426. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.buddyns.com/delegation-lab/"><b>BuddyDNS Delegation LAB</b></a> - check, trace and visualize delegation of your domain.<br>
  427. &nbsp;&nbsp;:small_orange_diamond: <a href="https://dnssec-debugger.verisignlabs.com/"><b>dnssec-debugger</b></a> - DS or DNSKEY records validator.<br>
  428. &nbsp;&nbsp;:small_orange_diamond: <a href="http://ptrarchive.com/"><b>PTRarchive.com</b></a> - this site is responsible for the safekeeping of historical reverse DNS records.<br>
  429. &nbsp;&nbsp;:small_orange_diamond: <a href="http://xip.io/"><b>xip.io</b></a> - wildcard DNS for everyone.<br>
  430. &nbsp;&nbsp;:small_orange_diamond: <a href="https://nip.io/"><b>nip.io</b></a> - dead simple wildcard DNS for any IP Address.<br>
  431. &nbsp;&nbsp;:small_orange_diamond: <a href="https://ceipam.eu/en/dnslookup.php"><b>dnslookup (ceipam)</b></a> - one of the best DNS propagation checker (and not only).<br>
  432. &nbsp;&nbsp;:small_orange_diamond: <a href="https://whatsmydns.com"><b>What's My DNS</b></a> - DNS propagation checking tool.<br>
  433. &nbsp;&nbsp;:small_orange_diamond: <a href="https://blog.erbbysam.com/index.php/2019/02/09/dnsgrep/"><b>DNSGrep</b></a> - quickly searching large DNS datasets.<br>
  434. </p>
  435. ##### :black_small_square: Mail
  436. <p>
  437. &nbsp;&nbsp;:small_orange_diamond: <a href="https://luxsci.com/smtp-tls-checker"><b>smtp-tls-checker</b></a> - check an email domain for SMTP TLS support.<br>
  438. &nbsp;&nbsp;:small_orange_diamond: <a href="https://mxtoolbox.com/SuperTool.aspx"><b>MX Toolbox</b></a> - all of your MX record, DNS, blacklist and SMTP diagnostics in one integrated tool.<br>
  439. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.checktls.com/index.html"><b>Secure Email</b></a> - complete email test tools for email technicians.<br>
  440. &nbsp;&nbsp;:small_orange_diamond: <a href="http://www.blacklistalert.org/"><b>blacklistalert</b></a> - checks to see if your domain is on a Real Time Spam Blacklist.<br>
  441. &nbsp;&nbsp;:small_orange_diamond: <a href="http://multirbl.valli.org/"><b>MultiRBL</b></a> - complete IP check for sending Mailservers.<br>
  442. &nbsp;&nbsp;:small_orange_diamond: <a href="https://dkimvalidator.com/"><b>DKIM SPF & Spam Assassin Validator</b></a> - checks mail authentication and scores messages with Spam Assassin.<br>
  443. </p>
  444. ##### :black_small_square: Encoders/Decoders and Regex testing
  445. <p>
  446. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.url-encode-decode.com/"><b>URL Encode/Decode</b></a> - tool from above to either encode or decode a string of text.<br>
  447. &nbsp;&nbsp;:small_orange_diamond: <a href="https://uncoder.io/"><b>Uncoder</b></a> - the online translator for search queries on log data.<br>
  448. &nbsp;&nbsp;:small_orange_diamond: <a href="https://regex101.com/"><b>Regex101</b></a> - online regex tester and debugger: PHP, PCRE, Python, Golang and JavaScript.<br>
  449. &nbsp;&nbsp;:small_orange_diamond: <a href="https://regexr.com/"><b>RegExr</b></a> - online tool to learn, build, & test Regular Expressions (RegEx / RegExp).<br>
  450. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.regextester.com/"><b>RegEx Testing</b></a> - online regex testing tool.<br>
  451. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.regexpal.com/"><b>RegEx Pal</b></a> - online regex testing tool + other tools.<br>
  452. &nbsp;&nbsp;:small_orange_diamond: <a href="https://gchq.github.io/CyberChef/"><b>The Cyber Swiss Army Knife</b></a> - a web app for encryption, encoding, compression and data analysis.<br>
  453. </p>
  454. ##### :black_small_square: Net-tools
  455. <p>
  456. &nbsp;&nbsp;:small_orange_diamond: <a href="https://toolbar.netcraft.com/site_report"><b>Netcraft</b></a> - detailed report about the site, helping you to make informed choices about their integrity.<b>*</b><br>
  457. &nbsp;&nbsp;:small_orange_diamond: <a href="https://atlas.ripe.net/"><b>RIPE NCC Atlas</b></a> - a global, open, distributed Internet measurement platform.<br>
  458. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.robtex.com/"><b>Robtex</b></a> - uses various sources to gather public information about IP numbers, domain names, host names, etc.<br>
  459. &nbsp;&nbsp;:small_orange_diamond: <a href="https://securitytrails.com/"><b>Security Trails</b></a> - APIs for Security Companies, Researchers and Teams.<br>
  460. &nbsp;&nbsp;:small_orange_diamond: <a href="https://tools.keycdn.com/curl"><b>Online Curl</b></a> - curl test, analyze HTTP Response Headers.<br>
  461. &nbsp;&nbsp;:small_orange_diamond: <a href="https://extendsclass.com/"><b>Online Tools for Developers</b></a> - HTTP API tools, testers, encoders, converters, formatters, and other tools.<br>
  462. &nbsp;&nbsp;:small_orange_diamond: <a href="https://ping.eu/"><b>Ping.eu</b></a> - online Ping, Traceroute, DNS lookup, WHOIS and others.<br>
  463. &nbsp;&nbsp;:small_orange_diamond: <a href="https://network-tools.com/"><b>Network-Tools</b></a> - network tools for webmasters, IT technicians & geeks.<br>
  464. &nbsp;&nbsp;:small_orange_diamond: <a href="https://bgpview.io/"><b>BGPview</b></a> - search for any ASN, IP, Prefix or Resource name.<br>
  465. &nbsp;&nbsp;:small_orange_diamond: <a href="https://isbgpsafeyet.com/"><b>Is BGP safe yet?</b></a> - check BGP (RPKI) security of ISPs and other major Internet players.<br>
  466. &nbsp;&nbsp;:small_orange_diamond: <a href="https://riseup.net/"><b>Riseup</b></a> - provides online communication tools for people and groups working on liberatory social change.<br>
  467. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.virustotal.com/gui/home/upload"><b>VirusTotal</b></a> - analyze suspicious files and URLs to detect types of malware.<br>
  468. </p>
  469. ##### :black_small_square: Privacy
  470. <p>
  471. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.privacyguides.org/"><b>privacyguides.org</b></a> - provides knowledge and tools to protect your privacy against global mass surveillance.<br>
  472. &nbsp;&nbsp;:small_orange_diamond: <a href="https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Test+Servers"><b>DNS Privacy Test Servers</b></a> - DNS privacy recursive servers list (with a 'no logging' policy).<br>
  473. </p>
  474. ##### :black_small_square: Code parsers/playgrounds
  475. <p>
  476. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.shellcheck.net/"><b>ShellCheck</b></a> - finds bugs in your shell scripts.<br>
  477. &nbsp;&nbsp;:small_orange_diamond: <a href="https://explainshell.com/"><b>explainshell</b></a> - get interactive help texts for shell commands.<br>
  478. &nbsp;&nbsp;:small_orange_diamond: <a href="https://jsbin.com/?html,output"><b>jsbin</b></a> - live pastebin for HTML, CSS & JavaScript, and more.<br>
  479. &nbsp;&nbsp;:small_orange_diamond: <a href="https://codesandbox.io/"><b>CodeSandbox</b></a> - online code editor for web application development.<br>
  480. &nbsp;&nbsp;:small_orange_diamond: <a href="http://sandbox.onlinephpfunctions.com/"><b>PHP Sandbox</b></a> - test your PHP code with this code tester.<br>
  481. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.repl.it/"><b>Repl.it</b></a> - an instant IDE to learn, build, collaborate, and host all in one place.<br>
  482. &nbsp;&nbsp;:small_orange_diamond: <a href="http://www.vclfiddle.net/"><b>vclFiddle</b></a> - is an online tool for experimenting with the Varnish Cache VCL.<br>
  483. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/hadolint/hadolint"><b>Haskell Dockerfile Linter</b></a> - a smarter Dockerfile linter that helps you build best practice Docker images.<br>
  484. </p>
  485. ##### :black_small_square: Performance
  486. <p>
  487. &nbsp;&nbsp;:small_orange_diamond: <a href="https://gtmetrix.com/"><b>GTmetrix</b></a> - analyze your site’s speed and make it faster.<br>
  488. &nbsp;&nbsp;:small_orange_diamond: <a href="https://performance.sucuri.net/"><b>Sucuri loadtimetester</b></a> - test here the
  489. performance of any of your sites from across the globe.<br>
  490. &nbsp;&nbsp;:small_orange_diamond: <a href="https://tools.pingdom.com/"><b>Pingdom Tools</b></a> - analyze your site’s speed around the world.<br>
  491. &nbsp;&nbsp;:small_orange_diamond: <a href="https://pingme.io/"><b>PingMe.io</b></a> - run website latency tests across multiple geographic regions.<br>
  492. &nbsp;&nbsp;:small_orange_diamond: <a href="https://developers.google.com/speed/pagespeed/insights/"><b>PageSpeed Insights</b></a> - analyze your site’s speed and make it faster.<br>
  493. &nbsp;&nbsp;:small_orange_diamond: <a href="https://web.dev/"><b>web.dev</b></a> - helps developers like you learn and apply the web's modern capabilities to your own sites and apps.<br>
  494. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/GoogleChrome/lighthouse"><b>Lighthouse</b></a> - automated auditing, performance metrics, and best practices for the web.<br>
  495. </p>
  496. ##### :black_small_square: Mass scanners (search engines)
  497. <p>
  498. &nbsp;&nbsp;:small_orange_diamond: <a href="https://censys.io/"><b>Censys</b></a> - platform that helps information security practitioners discover, monitor, and analyze devices.<br>
  499. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.shodan.io/"><b>Shodan</b></a> - the world's first search engine for Internet-connected devices.<br>
  500. &nbsp;&nbsp;:small_orange_diamond: <a href="https://2000.shodan.io/#/"><b>Shodan 2000</b></a> - this tool looks for randomly generated data from Shodan.<br>
  501. &nbsp;&nbsp;:small_orange_diamond: <a href="https://viz.greynoise.io/table"><b>GreyNoise</b></a> - mass scanner such as Shodan and Censys.<br>
  502. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.zoomeye.org/"><b>ZoomEye</b></a> - search engine for cyberspace that lets the user find specific network components.<br>
  503. &nbsp;&nbsp;:small_orange_diamond: <a href="https://netograph.io/"><b>netograph</b></a> - tools to monitor and understand deep structure of the web.<br>
  504. &nbsp;&nbsp;:small_orange_diamond: <a href="https://fofa.so/"><b>FOFA</b></a> - is a cyberspace search engine.<br>
  505. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.onyphe.io/"><b>onyphe</b></a> - is a search engine for open-source and cyber threat intelligence data collected.<br>
  506. &nbsp;&nbsp;:small_orange_diamond: <a href="https://intelx.io/"><b>IntelligenceX</b></a> - is a search engine and data archive.<br>
  507. &nbsp;&nbsp;:small_orange_diamond: <a href="https://app.binaryedge.io/"><b>binaryedge</b></a> - it scan the entire internet space and create real-time threat intelligence streams and reports.<br>
  508. &nbsp;&nbsp;:small_orange_diamond: <a href="https://spyse.com/"><b>Spyse</b></a> - Internet assets registry: networks, threats, web objects, etc.<br>
  509. &nbsp;&nbsp;:small_orange_diamond: <a href="https://wigle.net/"><b>wigle</b></a> - is a submission-based catalog of wireless networks. All the networks. Found by Everyone.<br>
  510. &nbsp;&nbsp;:small_orange_diamond: <a href="https://publicwww.com/"><b>PublicWWW</b></a> - find any alphanumeric snippet, signature or keyword in the web pages HTML, JS and CSS code.<br>
  511. &nbsp;&nbsp;:small_orange_diamond: <a href="https://inteltechniques.com/index.html"><b>IntelTechniques</b></a> - this repository contains hundreds of online search utilities.<br>
  512. &nbsp;&nbsp;:small_orange_diamond: <a href="https://hunter.io/"><b>hunter</b></a> - lets you find email addresses in seconds and connect with the people that matter for your business.<br>
  513. &nbsp;&nbsp;:small_orange_diamond: <a href="https://ghostproject.fr/"><b>GhostProject?</b></a> - search by full email address or username.<br>
  514. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.databreaches.live/"><b>databreaches</b></a> - was my email affected by data breach?<br>
  515. &nbsp;&nbsp;:small_orange_diamond: <a href="https://weleakinfo.com"><b>We Leak Info</b></a> - world's fastest and largest data breach search engine.<br>
  516. &nbsp;&nbsp;:small_orange_diamond: <a href="https://pulsedive.com/"><b>Pulsedive</b></a> - scans of malicious URLs, IPs, and domains, including port scans and web requests.<br>
  517. &nbsp;&nbsp;:small_orange_diamond: <a href="https://buckets.grayhatwarfare.com/"><b>Buckets by Grayhatwarfar</b></a> - database with public search for Open Amazon S3 Buckets and their contents.<br>
  518. &nbsp;&nbsp;:small_orange_diamond: <a href="https://vigilante.pw/"><b>Vigilante.pw</b></a> - the breached database directory.<br>
  519. &nbsp;&nbsp;:small_orange_diamond: <a href="https://builtwith.com/"><b>builtwith</b></a> - find out what websites are built with.<br>
  520. &nbsp;&nbsp;:small_orange_diamond: <a href="https://nerdydata.com/"><b>NerdyData</b></a> - search the web's source code for technologies, across millions of sites.<br>
  521. &nbsp;&nbsp;:small_orange_diamond: <a href="http://zorexeye.com/"><b>zorexeye</b></a> - search for sites, images, apps, softwares & more.<br>
  522. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.mmnt.net/"><b>Mamont's open FTP Index</b></a> - if a target has an open FTP site with accessible content it will be listed here.<br>
  523. &nbsp;&nbsp;:small_orange_diamond: <a href="https://osintframework.com/"><b>OSINT Framework</b></a> - focused on gathering information from free tools or resources.<br>
  524. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.maltiverse.com/search"><b>maltiverse</b></a> - is a service oriented to cybersecurity analysts for the advanced analysis of indicators of compromise.<br>
  525. &nbsp;&nbsp;:small_orange_diamond: <a href="https://leakedsource.ru/main/"><b>Leaked Source</b></a> - is a collaboration of data found online in the form of a lookup.<br>
  526. &nbsp;&nbsp;:small_orange_diamond: <a href="https://search.weleakinfo.com/"><b>We Leak Info</b></a> - to help everyday individuals secure their online life, avoiding getting hacked.<br>
  527. &nbsp;&nbsp;:small_orange_diamond: <a href="https://pipl.com/"><b>pipl</b></a> - is the place to find the person behind the email address, social username or phone number.<br>
  528. &nbsp;&nbsp;:small_orange_diamond: <a href="https://abuse.ch/"><b>abuse.ch</b></a> - is operated by a random swiss guy fighting malware for non-profit.<br>
  529. &nbsp;&nbsp;:small_orange_diamond: <a href="http://malc0de.com/database/"><b>malc0de</b></a> - malware search engine.<br>
  530. &nbsp;&nbsp;:small_orange_diamond: <a href="https://cybercrime-tracker.net/index.php"><b>Cybercrime Tracker</b></a> - monitors and tracks various malware families that are used to perpetrate cyber crimes.<br>
  531. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/eth0izzle/shhgit/"><b>shhgit</b></a> - find GitHub secrets in real time.<br>
  532. &nbsp;&nbsp;:small_orange_diamond: <a href="https://searchcode.com/"><b>searchcode</b></a> - helping you find real world examples of functions, API's and libraries.<br>
  533. &nbsp;&nbsp;:small_orange_diamond: <a href="http://www.insecam.org/"><b>Insecam</b></a> - the world biggest directory of online surveillance security cameras.<br>
  534. &nbsp;&nbsp;:small_orange_diamond: <a href="http://index-of.es/"><b>index-of</b></a> - contains great stuff like: security, hacking, reverse engineering, cryptography, programming etc.<br>
  535. &nbsp;&nbsp;:small_orange_diamond: <a href="https://opendata.rapid7.com/"><b>Rapid7 Labs Open Data</b></a> - is a great resources of datasets from Project Sonar.<br>
  536. &nbsp;&nbsp;:small_orange_diamond: <a href="https://webtechsurvey.com/common-response-headers"><b>Common Response Headers</b></a> - the largest database of HTTP response headers.<br>
  537. &nbsp;&nbsp;:small_orange_diamond: <a href="https://labs.inquest.net"><b>InQuest Labs</b></a> - InQuest Labs is an open, interactive, and API driven data portal for security researchers.<br>
  538. </p>
  539. ##### :black_small_square: Generators
  540. <p>
  541. &nbsp;&nbsp;:small_orange_diamond: <a href="https://thispersondoesnotexist.com/"><b>thispersondoesnotexist</b></a> - generate fake faces in one click - endless possibilities.<br>
  542. &nbsp;&nbsp;:small_orange_diamond: <a href="https://generated.photos"><b>AI Generated Photos</b></a> - 100.000 AI generated faces.<br>
  543. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.fakenamegenerator.com/"><b>fakenamegenerator</b></a> - your randomly generated identity.<br>
  544. &nbsp;&nbsp;:small_orange_diamond: <a href="https://tools.intigriti.io/redirector/"><b>Intigriti Redirector</b></a> - open redirect/SSRF payload generator.<br>
  545. </p>
  546. ##### :black_small_square: Passwords
  547. <p>
  548. &nbsp;&nbsp;:small_orange_diamond: <a href="https://haveibeenpwned.com/"><b>have i been pwned?</b></a> - check if you have an account that has been compromised in a data breach.<br>
  549. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.dehashed.com/"><b>dehashed</b></a> - is a hacked database search engine.<br>
  550. &nbsp;&nbsp;:small_orange_diamond: <a href="https://leakedsource.ru/"><b>Leaked Source</b></a> - is a collaboration of data found online in the form of a lookup.<br>
  551. </p>
  552. ##### :black_small_square: CVE/Exploits databases
  553. <p>
  554. &nbsp;&nbsp;:small_orange_diamond: <a href="https://cve.mitre.org/"><b>CVE Mitre</b></a> - list of publicly known cybersecurity vulnerabilities.<br>
  555. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.cvedetails.com/"><b>CVE Details</b></a> - CVE security vulnerability advanced database.<br>
  556. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.exploit-db.com/"><b>Exploit DB</b></a> - CVE compliant archive of public exploits and corresponding vulnerable software.<br>
  557. &nbsp;&nbsp;:small_orange_diamond: <a href="https://0day.today/"><b>0day.today</b></a> - exploits market provides you the possibility to buy/sell zero-day exploits.<br>
  558. &nbsp;&nbsp;:small_orange_diamond: <a href="https://sploitus.com/"><b>sploitus</b></a> - the exploit and tools database.<br>
  559. &nbsp;&nbsp;:small_orange_diamond: <a href="https://cxsecurity.com/exploit/"><b>cxsecurity</b></a> - free vulnerability database.<br>
  560. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.vulncode-db.com/"><b>Vulncode-DB</b></a> - is a database for vulnerabilities and their corresponding source code if available.<br>
  561. &nbsp;&nbsp;:small_orange_diamond: <a href="https://cveapi.com/"><b>cveapi</b></a> - free API for CVE data.<br>
  562. </p>
  563. ##### :black_small_square: Mobile apps scanners
  564. <p>
  565. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.immuniweb.com/mobile/"><b>ImmuniWeb® Mobile App Scanner</b></a> - test security and privacy of mobile apps (iOS & Android).<br>
  566. &nbsp;&nbsp;:small_orange_diamond: <a href="https://vulnerabilitytest.quixxi.com/"><b>Quixxi</b></a> - free Mobile App Vulnerability Scanner for Android & iOS.<br>
  567. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.ostorlab.co/scan/mobile/"><b>Ostorlab</b></a> - analyzes mobile application to identify vulnerabilities and potential weaknesses.<br>
  568. </p>
  569. ##### :black_small_square: Private Search Engines
  570. <p>
  571. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.startpage.com/"><b>Startpage</b></a> - the world's most private search engine.<br>
  572. &nbsp;&nbsp;:small_orange_diamond: <a href="https://searx.me/"><b>searX</b></a> - a privacy-respecting, hackable metasearch engine.<br>
  573. &nbsp;&nbsp;:small_orange_diamond: <a href="https://darksearch.io/"><b>darksearch</b></a> - the 1st real Dark Web search engine.<br>
  574. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.qwant.com/"><b>Qwant</b></a> - the search engine that respects your privacy.<br>
  575. &nbsp;&nbsp;:small_orange_diamond: <a href="https://duckduckgo.com/"><b>DuckDuckGo</b></a> - the search engine that doesn't track you.<br>
  576. &nbsp;&nbsp;:small_orange_diamond: <a href="https://swisscows.com/"><b>Swisscows</b></a> - privacy safe web search<br>
  577. &nbsp;&nbsp;:small_orange_diamond: <a href="https://search.disconnect.me/"><b>Disconnect</b></a> - the search engine that anonymizes your searches.<br>
  578. &nbsp;&nbsp;:small_orange_diamond: <a href="https://metager.org/"><b>MetaGer</b></a> - the search engine that uses anonymous proxy and hidden Tor branches.<br>
  579. </p>
  580. ##### :black_small_square: Secure Webmail Providers
  581. <p>
  582. &nbsp;&nbsp;:small_orange_diamond: <a href="https://countermail.com/"><b>CounterMail</b></a> - online email service, designed to provide maximum security and privacy.<br>
  583. &nbsp;&nbsp;:small_orange_diamond: <a href="http://mail2tor.com/"><b>Mail2Tor</b></a> - is a Tor Hidden Service that allows anyone to send and receive emails anonymously.<br>
  584. &nbsp;&nbsp;:small_orange_diamond: <a href="https://tutanota.com/"><b>Tutanota</b></a> - is the world's most secure email service and amazingly easy to use.<br>
  585. &nbsp;&nbsp;:small_orange_diamond: <a href="https://protonmail.com/"><b>Protonmail</b></a> - is the world's largest secure email service, developed by CERN and MIT scientists.<br>
  586. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.startmail.com/en/"><b>Startmail</b></a> - private & encrypted email made easy.<br>
  587. </p>
  588. ##### :black_small_square: Crypto
  589. <p>
  590. &nbsp;&nbsp;:small_orange_diamond: <a href="https://keybase.io/"><b>Keybase</b></a> - it's open source and powered by public-key cryptography.<br>
  591. </p>
  592. ##### :black_small_square: PGP Keyservers
  593. <p>
  594. &nbsp;&nbsp;:small_orange_diamond: <a href="https://keyserver.ubuntu.com/"><b>SKS OpenPGP Key server</b></a> - services for the SKS keyservers used by OpenPGP.<br>
  595. </p>
  596. #### Systems/Services &nbsp;[<sup>[TOC]</sup>](#anger-table-of-contents)
  597. ##### :black_small_square: Operating Systems
  598. <p>
  599. &nbsp;&nbsp;:small_orange_diamond: <a href="http://www.slackware.com/"><b>Slackware</b></a> - the most "Unix-like" Linux distribution.<br>
  600. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.openbsd.org/"><b>OpenBSD</b></a> - multi-platform 4.4BSD-based UNIX-like operating system.<br>
  601. &nbsp;&nbsp;:small_orange_diamond: <a href="https://hardenedbsd.org/"><b>HardenedBSD</b></a> - HardenedBSD aims to implement innovative exploit mitigation and security solutions.<br>
  602. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.kali.org/"><b>Kali Linux</b></a> - Linux distribution used for Penetration Testing, Ethical Hacking and network security assessments.<br>
  603. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.parrotsec.org/"><b>Parrot Security OS</b></a> - cyber security GNU/Linux environment.<br>
  604. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.backbox.org/"><b>Backbox Linux</b></a> - penetration test and security assessment oriented Ubuntu-based Linux distribution.<br>
  605. &nbsp;&nbsp;:small_orange_diamond: <a href="https://blackarch.org/"><b>BlackArch</b></a> - is an Arch Linux-based penetration testing distribution for penetration testers.<br>
  606. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.pentoo.ch/"><b>Pentoo</b></a> - is a security-focused livecd based on Gentoo.<br>
  607. &nbsp;&nbsp;:small_orange_diamond: <a href="https://securityonion.net/"><b>Security Onion</b></a> - Linux distro for intrusion detection, enterprise security monitoring, and log management.<br>
  608. &nbsp;&nbsp;:small_orange_diamond: <a href="https://tails.boum.org/"><b>Tails</b></a> - is a live system that aims to preserve your privacy and anonymity.<br>
  609. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/vedetta-com/vedetta"><b>vedetta</b></a> - OpenBSD router boilerplate.<br>
  610. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.qubes-os.org"><b>Qubes OS</b></a> - is a security-oriented OS that uses Xen-based virtualization.<br>
  611. </p>
  612. ##### :black_small_square: HTTP(s) Services
  613. <p>
  614. &nbsp;&nbsp;:small_orange_diamond: <a href="https://varnish-cache.org/"><b>Varnish Cache</b></a> - HTTP accelerator designed for content-heavy dynamic web sites.<br>
  615. &nbsp;&nbsp;:small_orange_diamond: <a href="https://nginx.org/"><b>Nginx</b></a> - open source web and reverse proxy server that is similar to Apache, but very light weight.<br>
  616. &nbsp;&nbsp;:small_orange_diamond: <a href="https://openresty.org/en/"><b>OpenResty</b></a> - is a dynamic web platform based on NGINX and LuaJIT.<br>
  617. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/alibaba/tengine"><b>Tengine</b></a> - a distribution of Nginx with some advanced features.<br>
  618. &nbsp;&nbsp;:small_orange_diamond: <a href="https://caddyserver.com/"><b>Caddy Server</b></a> - is an open source, HTTP/2-enabled web server with HTTPS by default.<br>
  619. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.haproxy.org/"><b>HAProxy</b></a> - the reliable, high performance TCP/HTTP load balancer.<br>
  620. </p>
  621. ##### :black_small_square: DNS Services
  622. <p>
  623. &nbsp;&nbsp;:small_orange_diamond: <a href="https://nlnetlabs.nl/projects/unbound/about/"><b>Unbound</b></a> - validating, recursive, and caching DNS resolver (with TLS).<br>
  624. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.knot-resolver.cz/"><b>Knot Resolver</b></a> - caching full resolver implementation, including both a resolver library and a daemon.<br>
  625. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.powerdns.com/"><b>PowerDNS</b></a> - is an open source authoritative DNS server, written in C++ and licensed under the GPL.<br>
  626. </p>
  627. ##### :black_small_square: Other Services
  628. <p>
  629. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/z3APA3A/3proxy"><b>3proxy</b></a> - tiny free proxy server.<br>
  630. </p>
  631. ##### :black_small_square: Security/hardening
  632. <p>
  633. &nbsp;&nbsp;:small_orange_diamond: <a href="https://twitter.com/EmeraldOnion"><b>Emerald Onion</b></a> - is a 501(c)(3) nonprofit organization and transit internet service provider (ISP).<br>
  634. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/pi-hole/pi-hole"><b>pi-hole</b></a> - the Pi-hole® is a DNS sinkhole that protects your devices from unwanted content.<br>
  635. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/stamparm/maltrail"><b>maltrail</b></a> - malicious traffic detection system.<br>
  636. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/Netflix/security_monkey"><b>security_monkey</b></a> - monitors AWS, GCP, OpenStack, and GitHub orgs for assets and their changes over time.<br>
  637. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/firecracker-microvm/firecracker"><b>firecracker</b></a> - secure and fast microVMs for serverless computing.<br>
  638. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/StreisandEffect/streisand"><b>streisand</b></a> - sets up a new server running your choice of WireGuard, OpenSSH, OpenVPN, and more.<br>
  639. </p>
  640. #### Networks &nbsp;[<sup>[TOC]</sup>](#anger-table-of-contents)
  641. ##### :black_small_square: Tools
  642. <p>
  643. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.capanalysis.net/ca/"><b>CapAnalysis</b></a> - web visual tool to analyze large amounts of captured network traffic (PCAP analyzer).<br>
  644. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/digitalocean/netbox"><b>netbox</b></a> - IP address management (IPAM) and data center infrastructure management (DCIM) tool.<br>
  645. </p>
  646. ##### :black_small_square: Labs
  647. <p>
  648. &nbsp;&nbsp;:small_orange_diamond: <a href="https://labs.networkreliability.engineering/"><b>NRE Labs</b></a> - learn automation by doing it. Right now, right here, in your browser.<br>
  649. </p>
  650. ##### :black_small_square: Other
  651. <p>
  652. &nbsp;&nbsp;:small_orange_diamond: <a href="https://ee.lbl.gov/"><b>LBNL's Network Research Group</b></a> - home page of the Network Research Group (NRG).<br>
  653. </p>
  654. #### Containers/Orchestration &nbsp;[<sup>[TOC]</sup>](#anger-table-of-contents)
  655. ##### :black_small_square: CLI Tools
  656. <p>
  657. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/google/gvisor"><b>gvisor</b></a> - container runtime sandbox.<br>
  658. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/bcicen/ctop"><b>ctop</b></a> - top-like interface for container metrics.<br>
  659. </p>
  660. ##### :black_small_square: Web Tools
  661. <p>
  662. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/moby/moby"><b>Moby</b></a> - a collaborative project for the container ecosystem to assemble container-based system.<br>
  663. &nbsp;&nbsp;:small_orange_diamond: <a href="https://traefik.io/"><b>Traefik</b></a> - open source reverse proxy/load balancer provides easier integration with Docker and Let's encrypt.<br>
  664. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/Kong/kong"><b>kong</b></a> - The Cloud-Native API Gateway.<br>
  665. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/rancher/rancher"><b>rancher</b></a> - complete container management platform.<br>
  666. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/portainer/portainer"><b>portainer</b></a> - making Docker management easy.<br>
  667. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/jwilder/nginx-proxy"><b>nginx-proxy</b></a> - automated nginx proxy for Docker containers using docker-gen.<br>
  668. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/bunkerity/bunkerized-nginx"><b>bunkerized-nginx</b></a> - nginx docker image "secure by default".<br>
  669. </p>
  670. ##### :black_small_square: Security
  671. <p>
  672. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/docker/docker-bench-security"><b>docker-bench-security</b></a> - checks for dozens of common best-practices around deploying Docker.<br>
  673. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/aquasecurity/trivy"><b>trivy</b></a> - vulnerability scanner for containers, suitable for CI.<br>
  674. &nbsp;&nbsp;:small_orange_diamond: <a href="https://goharbor.io/"><b>Harbor</b></a> - cloud native registry project that stores, signs, and scans content.<br>
  675. &nbsp;&nbsp;:small_orange_diamond: <a href="https://houdini.secsi.io/"><b>Houdini</b></a> - hundreds of offensive and useful docker images for network intrusion.<br>
  676. </p>
  677. ##### :black_small_square: Manuals/Tutorials/Best Practices
  678. <p>
  679. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/wsargent/docker-cheat-sheet"><b>docker-cheat-sheet</b></a> - a quick reference cheat sheet on Docker.<br>
  680. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/veggiemonk/awesome-docker"><b>awesome-docker</b></a> - a curated list of Docker resources and projects.<br>
  681. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/yeasy/docker_practice"><b>docker_practice</b></a> - learn and understand Docker technologies, with real DevOps practice!<br>
  682. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/docker/labs"><b>labs
  683. </b></a> - is a collection of tutorials for learning how to use Docker with various tools.<br>
  684. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/jessfraz/dockerfiles"><b>dockerfiles</b></a> - various Dockerfiles I use on the desktop and on servers.<br>
  685. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/kelseyhightower/kubernetes-the-hard-way"><b>kubernetes-the-hard-way</b></a> - bootstrap Kubernetes the hard way on Google Cloud Platform. No scripts.<br>
  686. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/jamesward/kubernetes-the-easy-way"><b>kubernetes-the-easy-way</b></a> - bootstrap Kubernetes the easy way on Google Cloud Platform. No scripts.<br>
  687. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/dennyzhang/cheatsheet-kubernetes-A4"><b>cheatsheet-kubernetes-A4</b></a> - Kubernetes CheatSheets in A4.<br>
  688. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/kabachook/k8s-security"><b>k8s-security</b></a> - kubernetes security notes and best practices.<br>
  689. &nbsp;&nbsp;:small_orange_diamond: <a href="https://learnk8s.io/production-best-practices/"><b>kubernetes-production-best-practices</b></a> - checklists with best-practices for production-ready Kubernetes.<br>
  690. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/freach/kubernetes-security-best-practice"><b>kubernetes-production-best-practices</b></a> - kubernetes security - best practice guide.<br>
  691. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/hjacobs/kubernetes-failure-stories"><b>kubernetes-failure-stories</b></a> - is a compilation of public failure/horror stories related to Kubernetes.<br>
  692. </p>
  693. #### Manuals/Howtos/Tutorials &nbsp;[<sup>[TOC]</sup>](#anger-table-of-contents)
  694. ##### :black_small_square: Shell/Command line
  695. <p>
  696. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/dylanaraps/pure-bash-bible"><b>pure-bash-bible</b></a> - is a collection of pure bash alternatives to external processes.<br>
  697. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/dylanaraps/pure-sh-bible"><b>pure-sh-bible</b></a> - is a collection of pure POSIX sh alternatives to external processes.<br>
  698. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/Idnan/bash-guide"><b>bash-guide</b></a> - is a guide to learn bash.<br>
  699. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/denysdovhan/bash-handbook"><b>bash-handbook</b></a> - for those who wanna learn Bash.<br>
  700. &nbsp;&nbsp;:small_orange_diamond: <a href="https://wiki.bash-hackers.org/start"><b>The Bash Hackers Wiki</b></a> - hold documentation of any kind about GNU Bash.<br>
  701. &nbsp;&nbsp;:small_orange_diamond: <a href="http://pubs.opengroup.org/onlinepubs/9699919799/utilities/contents.html"><b>Shell & Utilities</b></a> - describes the commands offered to application programs by POSIX-conformant systems.<br>
  702. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/jlevy/the-art-of-command-line"><b>the-art-of-command-line</b></a> - master the command line, in one page.<br>
  703. &nbsp;&nbsp;:small_orange_diamond: <a href="https://google.github.io/styleguide/shellguide.html"><b>Shell Style Guide</b></a> - a shell style guide for Google-originated open-source projects.<br>
  704. </p>
  705. ##### :black_small_square: Text Editors
  706. <p>
  707. &nbsp;&nbsp;:small_orange_diamond: <a href="https://vim.rtorr.com/"><b>Vim Cheat Sheet</b></a> - great multi language vim guide.<br>
  708. </p>
  709. ##### :black_small_square: Python
  710. <p>
  711. &nbsp;&nbsp;:small_orange_diamond: <a href="https://awesome-python.com/"><b>Awesome Python</b></a> - a curated list of awesome Python frameworks, libraries, software and resources.<br>
  712. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/gto76/python-cheatsheet"><b>python-cheatsheet</b></a> - comprehensive Python cheatsheet.<br>
  713. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.pythoncheatsheet.org/"><b>pythoncheatsheet.org</b></a> - basic reference for beginner and advanced developers.<br>
  714. </p>
  715. ##### :black_small_square: Sed & Awk & Other
  716. <p>
  717. &nbsp;&nbsp;:small_orange_diamond: <a href="https://posts.specterops.io/fawk-yeah-advanced-sed-and-awk-usage-parsing-for-pentesters-3-e5727e11a8ad?gi=c8f9506b26b6"><b>F’Awk Yeah!</b></a> - advanced sed and awk usage (Parsing for Pentesters 3).<br>
  718. </p>
  719. ##### :black_small_square: \*nix & Network
  720. <p>
  721. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.cyberciti.biz/"><b>nixCraft</b></a> - linux and unix tutorials for new and seasoned sysadmin.<br>
  722. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.tecmint.com/"><b>TecMint</b></a> - the ideal Linux blog for Sysadmins & Geeks.<br>
  723. &nbsp;&nbsp;:small_orange_diamond: <a href="http://www.omnisecu.com/index.php"><b>Omnisecu</b></a> - free Networking, System Administration and Security tutorials.<br>
  724. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/cirosantilli/linux-cheat"><b>linux-cheat</b></a> - Linux tutorials and cheatsheets. Minimal examples. Mostly user-land CLI utilities.<br>
  725. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/snori74/linuxupskillchallenge"><b>linuxupskillchallenge</b></a> - learn the skills required to sysadmin.<br>
  726. &nbsp;&nbsp;:small_orange_diamond: <a href="http://cb.vu/unixtoolbox.xhtml"><b>Unix Toolbox</b></a> - Unix/Linux/BSD commands and tasks which are useful for IT work or for advanced users.<br>
  727. &nbsp;&nbsp;:small_orange_diamond: <a href="https://linux-kernel-labs.github.io/refs/heads/master/index.html"><b>Linux Kernel Teaching</b></a> - is a collection of lectures and labs Linux kernel topics.<br>
  728. &nbsp;&nbsp;:small_orange_diamond: <a href="https://peteris.rocks/blog/htop/"><b>htop explained</b></a> - explanation of everything you can see in htop/top on Linux.<br>
  729. &nbsp;&nbsp;:small_orange_diamond: <a href="https://linuxguideandhints.com/"><b>Linux Guide and Hints</b></a> - tutorials on system administration in Fedora and CentOS.<br>
  730. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/NanXiao/strace-little-book"><b>strace-little-book</b></a> - a little book which introduces strace.<br>
  731. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/goldshtn/linux-tracing-workshop"><b>linux-tracing-workshop</b></a> - examples and hands-on labs for Linux tracing tools workshops.<br>
  732. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/bagder/http2-explained"><b>http2-explained</b></a> - a detailed document explaining and documenting HTTP/2.<br>
  733. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/bagder/http3-explained"><b>http3-explained</b></a> - a document describing the HTTP/3 and QUIC protocols.<br>
  734. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.manning.com/books/http2-in-action"><b>HTTP/2 in Action</b></a> - an excellent introduction to the new HTTP/2 standard.<br>
  735. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.saminiir.com/lets-code-tcp-ip-stack-1-ethernet-arp/"><b>Let's code a TCP/IP stack</b></a> - great stuff to learn network and system programming at a deeper level.<br>
  736. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/trimstray/nginx-admins-handbook"><b>Nginx Admin's Handbook</b></a> - how to improve NGINX performance, security and other important things.<br>
  737. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/digitalocean/nginxconfig.io"><b>nginxconfig.io</b></a> - NGINX config generator on steroids.<br>
  738. &nbsp;&nbsp;:small_orange_diamond: <a href="https://infosec.mozilla.org/guidelines/openssh"><b>openssh guideline</b></a> - is to help operational teams with the configuration of OpenSSH server and client.<br>
  739. &nbsp;&nbsp;:small_orange_diamond: <a href="https://gravitational.com/blog/ssh-handshake-explained/"><b>SSH Handshake Explained</b></a> - is a relatively brief description of the SSH handshake.<br>
  740. &nbsp;&nbsp;:small_orange_diamond: <a href="https://kb.isc.org/docs/using-this-knowledgebase"><b>ISC's Knowledgebase</b></a> - you'll find some general information about BIND 9, ISC DHCP, and Kea DHCP.<br>
  741. &nbsp;&nbsp;:small_orange_diamond: <a href="https://packetlife.net/"><b>PacketLife.net</b></a> - a place to record notes while studying for Cisco's CCNP certification.<br>
  742. </p>
  743. ##### :black_small_square: Microsoft
  744. <p>
  745. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/infosecn1nja/AD-Attack-Defense"><b>AD-Attack-Defense</b></a> - attack and defend active directory using modern post exploitation activity.<br>
  746. </p>
  747. ##### :black_small_square: Large-scale systems
  748. <p>
  749. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/donnemartin/system-design-primer"><b>The System Design Primer</b></a> - learn how to design large-scale systems.<br>
  750. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/binhnguyennus/awesome-scalability"><b>Awesome Scalability</b></a> - best practices in building High Scalability, High Availability, High Stability, and more.<br>
  751. &nbsp;&nbsp;:small_orange_diamond: <a href="https://engineering.videoblocks.com/web-architecture-101-a3224e126947?gi=a896808d22a"><b>Web Architecture 101</b></a> - the basic architecture concepts.<br>
  752. </p>
  753. ##### :black_small_square: System hardening
  754. <p>
  755. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.cisecurity.org/cis-benchmarks/"><b>CIS Benchmarks</b></a> - secure configuration settings for over 100 technologies, available as a free PDF.<br>
  756. &nbsp;&nbsp;:small_orange_diamond: <a href="https://highon.coffee/blog/security-harden-centos-7/"><b>Security Harden CentOS 7</b></a> - this walks you through the steps required to security harden CentOS.<br>
  757. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.lisenet.com/2017/centos-7-server-hardening-guide/"><b>CentOS 7 Server Hardening Guide</b></a> - great guide for hardening CentOS; familiar with OpenSCAP.<br>
  758. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/decalage2/awesome-security-hardening"><b>awesome-security-hardening</b></a> - is a collection of security hardening guides, tools and other resources.<br>
  759. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/trimstray/the-practical-linux-hardening-guide"><b>The Practical Linux Hardening Guide</b></a> - provides a high-level overview of hardening GNU/Linux systems.<br>
  760. &nbsp;&nbsp;:small_orange_diamond: <a href="https://madaidans-insecurities.github.io/guides/linux-hardening.html"><b>Linux Hardening Guide</b></a> - how to harden Linux as much as possible for security and privacy.<br>
  761. </p>
  762. ##### :black_small_square: Security & Privacy
  763. <p>
  764. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.hackingarticles.in/"><b>Hacking Articles</b></a> - LRaj Chandel's Security & Hacking Blog.<br>
  765. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/toniblyx/my-arsenal-of-aws-security-tools"><b>AWS security tools</b></a> - make your AWS cloud environment more secure.<br>
  766. &nbsp;&nbsp;:small_orange_diamond: <a href="https://inventory.rawsec.ml/index.html"><b>Rawsec's CyberSecurity Inventory</b></a> - an inventory of tools and resources about CyberSecurity.<br>
  767. &nbsp;&nbsp;:small_orange_diamond: <a href="https://tls.ulfheim.net/"><b>The Illustrated TLS Connection</b></a> - every byte of a TLS connection explained and reproduced.<br>
  768. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/ssllabs/research/wiki/SSL-and-TLS-Deployment-Best-Practices"><b>SSL Research</b></a> - SSL and TLS Deployment Best Practices by SSL Labs.<br>
  769. &nbsp;&nbsp;:small_orange_diamond: <a href="http://selinuxgame.org/index.html"><b>SELinux Game</b></a> - learn SELinux by doing. Solve Puzzles, show skillz.<br>
  770. &nbsp;&nbsp;:small_orange_diamond: <a href="https://smallstep.com/blog/everything-pki.html"><b>Certificates and PKI</b></a> - everything you should know about certificates and PKI but are too afraid to ask.<br>
  771. &nbsp;&nbsp;:small_orange_diamond: <a href="https://appsecco.com/books/subdomain-enumeration/"><b>The Art of Subdomain Enumeration</b></a> - a reference for subdomain enumeration techniques.<br>
  772. &nbsp;&nbsp;:small_orange_diamond: <a href="https://lifehacker.com/the-comprehensive-guide-to-quitting-google-1830001964"><b>Quitting Google</b></a> - the comprehensive guide to quitting Google.<br>
  773. </p>
  774. ##### :black_small_square: Web Apps
  775. <p>
  776. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.owasp.org/index.php/Main_Page"><b>OWASP</b></a> - worldwide not-for-profit charitable organization focused on improving the security of software.<br>
  777. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.owasp.org/index.php/Category:OWASP_Application_Security_Verification_Standard_Project"><b>OWASP ASVS 3.0.1</b></a> - OWASP Application Security Verification Standard Project.<br>
  778. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/Santandersecurityresearch/asvs"><b>OWASP ASVS 3.0.1 Web App</b></a> - simple web app that helps developers understand the ASVS requirements.<br>
  779. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/OWASP/ASVS/tree/master/4.0"><b>OWASP ASVS 4.0</b></a> - is a list of application security requirements or tests.<br>
  780. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.owasp.org/index.php/OWASP_Testing_Project"><b>OWASP Testing Guide v4</b></a> - includes a "best practice" penetration testing framework.<br>
  781. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/OWASP/DevGuide"><b>OWASP Dev Guide</b></a> - this is the development version of the OWASP Developer Guide.<br>
  782. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/OWASP/wstg"><b>OWASP WSTG</b></a> - is a comprehensive open source guide to testing the security of web apps.<br>
  783. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.owasp.org/index.php/OWASP_API_Security_Project"><b>OWASP API Security Project</b></a> - focuses specifically on the top ten vulnerabilities in API security.<br>
  784. &nbsp;&nbsp;:small_orange_diamond: <a href="https://infosec.mozilla.org/guidelines/web_security.html"><b>Mozilla Web Security</b></a> - help operational teams with creating secure web applications.<br>
  785. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/Netflix/security-bulletins"><b>security-bulletins</b></a> - security bulletins that relate to Netflix Open Source.<br>
  786. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/shieldfy/API-Security-Checklist"><b>API-Security-Checklist</b></a> - security countermeasures when designing, testing, and releasing your API.<br>
  787. &nbsp;&nbsp;:small_orange_diamond: <a href="https://enable-cors.org/index.html"><b>Enable CORS</b></a> - enable cross-origin resource sharing.<br>
  788. &nbsp;&nbsp;:small_orange_diamond: <a href="https://appsecwiki.com/#/"><b>Application Security Wiki</b></a> - is an initiative to provide all application security related resources at one place.<br>
  789. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/GrrrDog/weird_proxies/wiki"><b>Weird Proxies</b></a> - reverse proxy related attacks; it is a result of analysis of various proxies.<br>
  790. &nbsp;&nbsp;:small_orange_diamond: <a href="https://dfir.it/blog/2015/08/12/webshell-every-time-the-same-purpose/"><b>Webshells</b></a> - great series about malicious payloads.<br>
  791. &nbsp;&nbsp;:small_orange_diamond: <a href="https://portswigger.net/blog/practical-web-cache-poisoning"><b>Practical Web Cache Poisoning</b></a> - show you how to compromise websites by using esoteric web features.<br>
  792. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/bl4de/research/tree/master/hidden_directories_leaks"><b>Hidden directories and files</b></a> - as a source of sensitive information about web application.<br>
  793. &nbsp;&nbsp;:small_orange_diamond: <a href="https://bo0om.ru/en/"><b>Explosive blog</b></a> - great blog about cybersec and pentests.<br>
  794. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.netsparker.com/security-cookies-whitepaper/"><b>Security Cookies</b></a> - this paper will take a close look at cookie security.<br>
  795. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/GitGuardian/APISecurityBestPractices"><b>APISecurityBestPractices</b></a> - help you keep secrets (API keys, db credentials, certificates) out of source code.<br>
  796. </p>
  797. ##### :black_small_square: All-in-one
  798. <p>
  799. &nbsp;&nbsp;:small_orange_diamond: <a href="https://lzone.de/cheat-sheet/"><b>LZone Cheat Sheets</b></a> - all cheat sheets.<br>
  800. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/rstacruz/cheatsheets"><b>Dan’s Cheat Sheets’s</b></a> - massive cheat sheets documentation.<br>
  801. &nbsp;&nbsp;:small_orange_diamond: <a href="https://devhints.io/"><b>Rico's cheatsheets</b></a> - this is a modest collection of cheatsheets.<br>
  802. &nbsp;&nbsp;:small_orange_diamond: <a href="https://devdocs.io/"><b>DevDocs API</b></a> - combines multiple API documentations in a fast, organized, and searchable interface.<br>
  803. &nbsp;&nbsp;:small_orange_diamond: <a href="https://cheat.sh/"><b>cheat.sh</b></a> - the only cheat sheet you need.<br>
  804. &nbsp;&nbsp;:small_orange_diamond: <a href="https://gnulinux.guru/"><b>gnulinux.guru</b></a> - collection of cheat sheets about bash, vim and networking.<br>
  805. &nbsp;&nbsp;:small_orange_diamond: <a href="https://andreasbm.github.io/web-skills/"><b>Web Skills</b></a> - visual overview of useful skills to learn as a web developer.<br>
  806. </p>
  807. ##### :black_small_square: Ebooks
  808. <p>
  809. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/EbookFoundation/free-programming-books"><b>free-programming-books</b></a> - list of free learning resources in many languages.<br>
  810. </p>
  811. ##### :black_small_square: Other
  812. <p>
  813. &nbsp;&nbsp;:small_orange_diamond: <a href="https://bitvijays.github.io/LFC-VulnerableMachines.html"><b>CTF Series : Vulnerable Machines</b></a> - the steps below could be followed to find vulnerabilities and exploits.<br>
  814. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/manoelt/50M_CTF_Writeup"><b>50M_CTF_Writeup</b></a> - $50 million CTF from Hackerone - writeup.<br>
  815. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/j00ru/ctf-tasks"><b>ctf-tasks</b></a> - an archive of low-level CTF challenges developed over the years.<br>
  816. &nbsp;&nbsp;:small_orange_diamond: <a href="https://hshrzd.wordpress.com/how-to-start/"><b>How to start RE/malware analysis?</b></a> - collection of some hints and useful links for the beginners.<br>
  817. &nbsp;&nbsp;:small_orange_diamond: <a href="http://www.kegel.com/c10k.html"><b>The C10K problem</b></a> - it's time for web servers to handle ten thousand clients simultaneously, don't you think?<br>
  818. &nbsp;&nbsp;:small_orange_diamond: <a href="https://blog.benjojo.co.uk/post/why-is-ethernet-mtu-1500"><b>How 1500 bytes became the MTU of the internet</b></a> - great story about the Maximum Transmission Unit.<br>
  819. &nbsp;&nbsp;:small_orange_diamond: <a href="http://poormansprofiler.org/"><b>poor man's profiler</b></a> - like dtrace's don't really provide methods to see what programs are blocking on.<br>
  820. &nbsp;&nbsp;:small_orange_diamond: <a href="https://nickcraver.com/blog/2017/05/22/https-on-stack-overflow/"><b>HTTPS on Stack Overflow</b></a> - this is the story of a long journey regarding the implementation of SSL.<br>
  821. &nbsp;&nbsp;:small_orange_diamond: <a href="https://drawings.jvns.ca/"><b>Julia's Drawings</b></a> - some drawings about programming and unix world, zines about systems & debugging tools.<br>
  822. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/corkami/collisions"><b>Hash collisions</b></a> - this great repository is focused on hash collisions exploitation.<br>
  823. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/in3rsha/sha256-animation"><b>sha256-animation</b></a> - animation of the SHA-256 hash function in your terminal.<br>
  824. &nbsp;&nbsp;:small_orange_diamond: <a href="https://sha256algorithm.com/"><b>sha256algorithm</b></a> - sha256 algorithm explained online step by step visually.<br>
  825. &nbsp;&nbsp;:small_orange_diamond: <a href="https://labs.ripe.net/Members/cteusche/bgp-meets-cat"><b>BGP Meets Cat</b></a> - after 3072 hours of manipulating BGP, Job Snijders has succeeded in drawing a Nyancat.<br>
  826. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/benjojo/bgp-battleships"><b>bgp-battleships</b></a> - playing battleships over BGP.<br>
  827. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/alex/what-happens-when"><b>What happens when...</b></a> - you type google.com into your browser and press enter?<br>
  828. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/vasanthk/how-web-works"><b>how-web-works</b></a> - based on the 'What happens when...' repository.<br>
  829. &nbsp;&nbsp;:small_orange_diamond: <a href="https://robertheaton.com/2018/11/28/https-in-the-real-world/"><b>HTTPS in the real world</b></a> - great tutorial explain how HTTPS works in the real world.<br>
  830. &nbsp;&nbsp;:small_orange_diamond: <a href="https://about.gitlab.com/2018/11/14/how-we-spent-two-weeks-hunting-an-nfs-bug/"><b>Gitlab and NFS bug</b></a> - how we spent two weeks hunting an NFS bug in the Linux kernel.<br>
  831. &nbsp;&nbsp;:small_orange_diamond: <a href="https://about.gitlab.com/2017/02/10/postmortem-of-database-outage-of-january-31/"><b>Gitlab melts down</b></a> - postmortem on the database outage of January 31 2017 with the lessons we learned.<br>
  832. &nbsp;&nbsp;:small_orange_diamond: <a href="http://www.catb.org/esr/faqs/hacker-howto.html"><b>How To Become A Hacker</b></a> - if you want to be a hacker, keep reading.<br>
  833. &nbsp;&nbsp;:small_orange_diamond: <a href="http://ithare.com/infographics-operation-costs-in-cpu-clock-cycles/"><b>Operation Costs in CPU</b></a> - should help to estimate costs of certain operations in CPU clocks.<br>
  834. &nbsp;&nbsp;:small_orange_diamond: <a href="https://cstack.github.io/db_tutorial/"><b>Let's Build a Simple Database</b></a> - writing a sqlite clone from scratch in C.<br>
  835. &nbsp;&nbsp;:small_orange_diamond: <a href="https://djhworld.github.io/post/2019/05/21/i-dont-know-how-cpus-work-so-i-simulated-one-in-code/"><b>simple-computer</b></a> - great resource to understand how computers work under the hood.<br>
  836. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.troyhunt.com/working-with-154-million-records-on/"><b>The story of "Have I been pwned?"</b></a> - working with 154 million records on Azure Table Storage.<br>
  837. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.top500.org/"><b>TOP500 Supercomputers</b></a> - shows the 500 most powerful commercially available computer systems known to us.<br>
  838. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.shellntel.com/blog/2017/2/8/how-to-build-a-8-gpu-password-cracker"><b>How to build a 8 GPU password cracker</b></a> - any "black magic" or hours of frustration like desktop components do.<br>
  839. &nbsp;&nbsp;:small_orange_diamond: <a href="https://home.cern/science/computing"><b>CERN Data Centre</b></a> - 3D visualizations of the CERN computing environments (and more).<br>
  840. &nbsp;&nbsp;:small_orange_diamond: <a href="http://howfuckedismydatabase.com/"><b>How fucked is my database</b></a> - evaluate how fucked your database is with this handy website.<br>
  841. &nbsp;&nbsp;:small_orange_diamond: <a href="https://krisbuytaert.be/blog/linux-troubleshooting-101-2016-edition/index.html"><b>Linux Troubleshooting 101 , 2016 Edition</b></a> - everything is a DNS Problem...<br>
  842. &nbsp;&nbsp;:small_orange_diamond: <a href="https://open.buffer.com/5-whys-process/"><b>Five Whys</b></a> - you know what the problem is, but you cannot solve it?<br>
  843. &nbsp;&nbsp;:small_orange_diamond: <a href="https://gvnshtn.com/maersk-me-notpetya/"><b>Maersk, me & notPetya</b></a> - how did ransomware successfully hijack hundreds of domain controllers?<br>
  844. &nbsp;&nbsp;:small_orange_diamond: <a href="https://howhttps.works/"><b>howhttps.works</b></a> - how HTTPS works ...in a comic!<br>
  845. &nbsp;&nbsp;:small_orange_diamond: <a href="https://howdns.works/"><b>howdns.works</b></a> - a fun and colorful explanation of how DNS works.<br>
  846. &nbsp;&nbsp;:small_orange_diamond: <a href="https://postgresqlco.nf/en/doc/param/"><b>POSTGRESQLCO.NF</b></a> - your postgresql.conf documentation and recommendations.<br>
  847. </p>
  848. #### Inspiring Lists &nbsp;[<sup>[TOC]</sup>](#anger-table-of-contents)
  849. ##### :black_small_square: SysOps/DevOps
  850. <p>
  851. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/kahun/awesome-sysadmin"><b>Awesome Sysadmin</b></a> - amazingly awesome open source sysadmin resources.<br>
  852. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/alebcay/awesome-shell"><b>Awesome Shell</b></a> - awesome command-line frameworks, toolkits, guides and gizmos.<br>
  853. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/learnbyexample/Command-line-text-processing"><b>Command-line-text-processing</b></a> - finding text to search and replace, sorting to beautifying, and more.<br>
  854. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/caesar0301/awesome-pcaptools"><b>Awesome Pcaptools</b></a> - collection of tools developed by other researchers to process network traces.<br>
  855. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/zoidbergwill/awesome-ebpf"><b>awesome-ebpf</b></a> - a curated list of awesome projects related to eBPF.<br>
  856. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/leandromoreira/linux-network-performance-parameters"><b>Linux Network Performance</b></a> - where some of the network sysctl variables fit into the Linux/Kernel network flow.<br>
  857. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/dhamaniasad/awesome-postgres"><b>Awesome Postgres</b></a> - list of awesome PostgreSQL software, libraries, tools and resources.<br>
  858. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/enochtangg/quick-SQL-cheatsheet"><b>quick-SQL-cheatsheet</b></a> - a quick reminder of all SQL queries and examples on how to use them.<br>
  859. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/Kickball/awesome-selfhosted"><b>Awesome-Selfhosted</b></a> - list of Free Software network services and web applications which can be hosted locally.<br>
  860. &nbsp;&nbsp;:small_orange_diamond: <a href="https://wiki.archlinux.org/index.php/List_of_applications"><b>List of applications</b></a> - huge list of apps sorted by category, as a reference for those looking for packages.<br>
  861. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/InterviewMap/CS-Interview-Knowledge-Map"><b>CS-Interview-Knowledge-Map</b></a> - build the best interview map.<br>
  862. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/Tikam02/DevOps-Guide"><b>DevOps-Guide</b></a> - DevOps Guide from basic to advanced with Interview Questions and Notes.<br>
  863. &nbsp;&nbsp;:small_orange_diamond: <a href="https://issue.freebsdfoundation.org/publication/?m=33057&l=1&view=issuelistBrowser"><b>FreeBSD Journal</b></a> - it is a great list of periodical magazines about FreeBSD and other important things.<br>
  864. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/bregman-arie/devops-interview-questions"><b>devops-interview-questions</b></a> - contains interview questions on various DevOps and SRE related topics.<br></p>
  865. ##### :black_small_square: Developers
  866. <p>
  867. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/kamranahmedse/developer-roadmap"><b>Web Developer Roadmap</b></a> - roadmaps, articles and resources to help you choose your path, learn and improve.<br>
  868. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/thedaviddias/Front-End-Checklist"><b>Front-End-Checklist</b></a> - the perfect Front-End Checklist for modern websites and meticulous developers.<br>
  869. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/thedaviddias/Front-End-Performance-Checklist"><b>Front-End-Performance-Checklist</b></a> - Front-End Performance Checklist that runs faster than the others.<br>
  870. &nbsp;&nbsp;:small_orange_diamond: <a href="https://rszalski.github.io/magicmethods/"><b>Python's Magic Methods</b></a> - what are magic methods? They're everything in object-oriented Python.<br>
  871. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/satwikkansal/wtfpython"><b>wtfpython</b></a> - a collection of surprising Python snippets and lesser-known features.<br>
  872. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/twhite96/js-dev-reads"><b>js-dev-reads</b></a> - a list of books and articles for the discerning web developer to read.<br>
  873. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/RomuloOliveira/commit-messages-guide"><b>Commit messages guide</b></a> - a guide to understand the importance of commit messages.<br>
  874. </p>
  875. ##### :black_small_square: Security/Pentesting
  876. <p>
  877. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/qazbnm456/awesome-web-security"><b>Awesome Web Security</b></a> - a curated list of Web Security materials and resources.<br>
  878. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/joe-shenouda/awesome-cyber-skills"><b>awesome-cyber-skills</b></a> - a curated list of hacking environments where you can train your cyber skills.<br>
  879. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/devsecops/awesome-devsecops"><b>awesome-devsecops</b></a> - an authoritative list of awesome devsecops tools.<br>
  880. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/jivoi/awesome-osint"><b>awesome-osint</b></a> - is a curated list of amazingly awesome OSINT.<br>
  881. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/HolyBugx/HolyTips"><b>HolyTips</b></a> - tips and tutorials on Bug Bounty Hunting and Web App Security.<br>
  882. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/hslatman/awesome-threat-intelligence"><b>awesome-threat-intelligence</b></a> - a curated list of Awesome Threat Intelligence resources.<br>
  883. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/infosecn1nja/Red-Teaming-Toolkit"><b>Red-Teaming-Toolkit</b></a> - a collection of open source and commercial tools that aid in red team operations.<br>
  884. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/snoopysecurity/awesome-burp-extensions"><b>awesome-burp-extensions</b></a> - a curated list of amazingly awesome Burp Extensions.<br>
  885. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/Hack-with-Github/Free-Security-eBooks"><b>Free Security eBooks</b></a> - list of a Free Security and Hacking eBooks.<br>
  886. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/yeahhub/Hacking-Security-Ebooks"><b>Hacking-Security-Ebooks</b></a> - top 100 Hacking & Security E-Books.<br>
  887. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/nikitavoloboev/privacy-respecting"><b>privacy-respecting</b></a> - curated list of privacy respecting services and software.<br>
  888. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/wtsxDev/reverse-engineering"><b>reverse-engineering</b></a> - list of awesome reverse engineering resources.<br>
  889. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/michalmalik/linux-re-101"><b>linux-re-101</b></a> - a collection of resources for linux reverse engineering.<br>
  890. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/onethawt/reverseengineering-reading-list"><b>reverseengineering-reading-list</b></a> - a list of Reverse Engineering articles, books, and papers.<br>
  891. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/0xInfection/Awesome-WAF"><b>Awesome-WAF</b></a> - a curated list of awesome web-app firewall (WAF) stuff.<br>
  892. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/jakejarvis/awesome-shodan-queries"><b>awesome-shodan-queries</b></a> - interesting, funny, and depressing search queries to plug into shodan.io.<br>
  893. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/danielmiessler/RobotsDisallowed"><b>RobotsDisallowed</b></a> - a curated list of the most common and most interesting robots.txt disallowed directories.<br>
  894. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/Kayzaks/HackingNeuralNetworks"><b>HackingNeuralNetworks</b></a> - is a small course on exploiting and defending neural networks.<br>
  895. &nbsp;&nbsp;:small_orange_diamond: <a href="https://gist.github.com/joepie91/7e5cad8c0726fd6a5e90360a754fc568"><b>wildcard-certificates</b></a> - why you probably shouldn't use a wildcard certificate.<br>
  896. &nbsp;&nbsp;:small_orange_diamond: <a href="https://gist.github.com/joepie91/5a9909939e6ce7d09e29"><b>Don't use VPN services</b></a> - which is what every third-party "VPN provider" does.<br>
  897. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/InQuest/awesome-yara"><b>awesome-yara</b></a> - a curated list of awesome YARA rules, tools, and people.<br>
  898. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/drduh/macOS-Security-and-Privacy-Guide"><b>macOS-Security-and-Privacy-Guide</b></a> - guide to securing and improving privacy on macOS.<br>
  899. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/usnistgov/macos_security"><b>macos_security</b></a> - macOS Security Compliance Project.<br>
  900. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/PaulSec/awesome-sec-talks"><b>awesome-sec-talks</b></a> - is a collected list of awesome security talks.<br>
  901. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/k4m4/movies-for-hackers"><b>Movies for Hackers</b></a> - list of movies every hacker & cyberpunk must watch.<br>
  902. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/danieldizzy/Cryptography_1"><b>Cryptography_1</b></a> - materials used whilst taking Prof. Dan Boneh Stanford Crypto course.<br>
  903. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/ashutosh1206/Crypton"><b>Crypton</b></a> - library to learn and practice Offensive and Defensive Cryptography.<br>
  904. </p>
  905. ##### :black_small_square: Other
  906. <p>
  907. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.cheatography.com/"><b>Cheatography</b></a> - over 3,000 free cheat sheets, revision aids and quick references.<br>
  908. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/mre/awesome-static-analysis"><b>awesome-static-analysis</b></a> - static analysis tools for all programming languages.<br>
  909. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/ossu/computer-science"><b>computer-science</b></a> - path to a free self-taught education in Computer Science.<br>
  910. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/danluu/post-mortems"><b>post-mortems</b></a> - is a collection of postmortems (config errors, hardware failures, and more).<br>
  911. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/danistefanovic/build-your-own-x"><b>build-your-own-x</b></a> - build your own (insert technology here).<br>
  912. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/rby90/Project-Based-Tutorials-in-C"><b>Project-Based-Tutorials-in-C</b></a> - is a curated list of project-based tutorials in C.<br>
  913. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/kylelobo/The-Documentation-Compendium"><b>The-Documentation-Compendium</b></a> - various README templates & tips on writing high-quality documentation.<br>
  914. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/mahmoud/awesome-python-applications"><b>awesome-python-applications</b></a> - free software that works great, and also happens to be open-source Python.<br>
  915. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/awesomedata/awesome-public-datasets"><b>awesome-public-datasets</b></a> - a topic-centric list of HQ open datasets.<br>
  916. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/Sahith02/machine-learning-algorithms"><b>machine-learning-algorithms</b></a> - a curated list of all machine learning algorithms and concepts.<br>
  917. </p>
  918. #### Blogs/Podcasts/Videos &nbsp;[<sup>[TOC]</sup>](#anger-table-of-contents)
  919. ##### :black_small_square: SysOps/DevOps
  920. <p>
  921. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.youtube.com/watch?v=nAFpkV5-vuI"><b>Varnish for PHP developers</b></a> - very interesting presentation of Varnish by Mattias Geniar.<br>
  922. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.youtube.com/watch?v=CZ3wIuvmHeM"><b>A Netflix Guide to Microservices</b></a> - talks about the chaotic and vibrant world of microservices at Netflix.<br>
  923. </p>
  924. ##### :black_small_square: Developers
  925. <p>
  926. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.youtube.com/watch?v=yOyaJXpAYZQ"><b>Comparing C to machine lang</b></a> - compare a simple C app with the compiled machine code of that program.<br>
  927. </p>
  928. ##### :black_small_square: Geeky Persons
  929. <p>
  930. &nbsp;&nbsp;:small_orange_diamond: <a href="http://www.brendangregg.com/"><b>Brendan Gregg's Blog</b></a> - is an industry expert in computing performance and cloud computing.<br>
  931. &nbsp;&nbsp;:small_orange_diamond: <a href="https://gynvael.coldwind.pl/"><b>Gynvael "GynDream" Coldwind</b></a> - is a IT security engineer at Google.<br>
  932. &nbsp;&nbsp;:small_orange_diamond: <a href="http://lcamtuf.coredump.cx/"><b>Michał "lcamtuf" Zalewski</b></a> - white hat hacker, computer security expert.<br>
  933. &nbsp;&nbsp;:small_orange_diamond: <a href="https://ma.ttias.be/"><b>Mattias Geniar</b></a> - developer, sysadmin, blogger, podcaster and public speaker.<br>
  934. &nbsp;&nbsp;:small_orange_diamond: <a href="https://nickcraver.com/"><b>Nick Craver</b></a> - software developer and systems administrator for Stack Exchange.<br>
  935. &nbsp;&nbsp;:small_orange_diamond: <a href="https://scotthelme.co.uk/"><b>Scott Helme</b></a> - security researcher, speaker and founder of securityheaders.com and report-uri.com.<br>
  936. &nbsp;&nbsp;:small_orange_diamond: <a href="https://krebsonsecurity.com/"><b>Brian Krebs</b></a> - The Washington Post and now an Independent investigative journalist.<br>
  937. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.schneier.com/"><b>Bruce Schneier</b></a> - is an internationally renowned security technologist, called a "security guru".<br>
  938. &nbsp;&nbsp;:small_orange_diamond: <a href="https://chrissymorgan.co.uk/"><b>Chrissy Morgan</b></a> - advocate of practical learning, Chrissy also takes part in bug bounty programs.<br>
  939. &nbsp;&nbsp;:small_orange_diamond: <a href="https://blog.zsec.uk/"><b>Andy Gill</b></a> - is a hacker at heart who works as a senior penetration tester.<br>
  940. &nbsp;&nbsp;:small_orange_diamond: <a href="https://danielmiessler.com/"><b>Daniel Miessler</b></a> - cybersecurity expert and writer.<br>
  941. &nbsp;&nbsp;:small_orange_diamond: <a href="https://samy.pl/"><b>Samy Kamkar</b></a> - is an American privacy and security researcher, computer hacker.<br>
  942. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.j4vv4d.com/"><b>Javvad Malik</b></a> - is a security advocate at AlienVault, a blogger event speaker and industry commentator.<br>
  943. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.grahamcluley.com/"><b>Graham Cluley</b></a> - public speaker and independent computer security analyst.<br>
  944. &nbsp;&nbsp;:small_orange_diamond: <a href="https://security.szurek.pl/"><b>Kacper Szurek</b></a> - detection engineer at ESET.<br>
  945. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.troyhunt.com/"><b>Troy Hunt</b></a> - web security expert known for public education and outreach on security topics.<br>
  946. &nbsp;&nbsp;:small_orange_diamond: <a href="https://raymii.org/s/index.html"><b>raymii.org</b></a> - sysadmin specializing in building high availability cloud environments.<br>
  947. &nbsp;&nbsp;:small_orange_diamond: <a href="https://robert.penz.name/"><b>Robert Penz</b></a> - IT security expert.<br>
  948. </p>
  949. ##### :black_small_square: Geeky Blogs
  950. <p>
  951. &nbsp;&nbsp;:small_orange_diamond: <a href="https://linux-audit.com/"><b>Linux Audit</b></a> - the Linux security blog about auditing, hardening and compliance by Michael Boelen.<br>
  952. &nbsp;&nbsp;:small_orange_diamond: <a href="https://linuxsecurity.expert/"><b>
  953. Linux Security Expert</b></a> - trainings, howtos, checklists, security tools, and more.<br>
  954. &nbsp;&nbsp;:small_orange_diamond: <a href="http://www.grymoire.com/"><b>The Grymoire</b></a> - collection of useful incantations for wizards, be you computer wizards, magicians, or whatever.<br>
  955. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.secjuice.com"><b>Secjuice</b></a> - is the only non-profit, independent and volunteer led publication in the information security space.<br>
  956. &nbsp;&nbsp;:small_orange_diamond: <a href="https://duo.com/decipher"><b>Decipher</b></a> - security news that informs and inspires.<br>
  957. </p>
  958. ##### :black_small_square: Geeky Vendor Blogs
  959. <p>
  960. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.tenable.com/podcast"><b>Tenable Podcast</b></a> - conversations and interviews related to Cyber Exposure, and more.<br>
  961. &nbsp;&nbsp;:small_orange_diamond: <a href="https://nakedsecurity.sophos.com/"><b>Sophos</b></a> - threat news room, giving you news, opinion, advice and research on computer security issues.<br>
  962. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.tripwire.com/state-of-security/"><b>Tripwire State of Security</b></a> - blog featuring the latest news, trends and insights on current security issues.<br>
  963. &nbsp;&nbsp;:small_orange_diamond: <a href="https://blog.malwarebytes.com/"><b>Malwarebytes Labs Blog</b></a> - security blog aims to provide insider news about cybersecurity.<br>
  964. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.trustedsec.com/category/articles/"><b>TrustedSec</b></a> - latest news, and trends about cybersecurity.<br>
  965. &nbsp;&nbsp;:small_orange_diamond: <a href="https://portswigger.net/blog"><b>PortSwigger Web Security Blog</b></a> - about web app security vulns and top tips from our team of web security.<br>
  966. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.alienvault.com/blogs"><b>AT&T Cybersecurity blog</b></a> - news on emerging threats and practical advice to simplify threat detection.<br>
  967. &nbsp;&nbsp;:small_orange_diamond: <a href="https://thycotic.com/company/blog/"><b>Thycotic</b></a> - where CISOs and IT Admins come to learn about industry trends, IT security, and more.<br>
  968. </p>
  969. ##### :black_small_square: Geeky Cybersecurity Podcasts
  970. <p>
  971. &nbsp;&nbsp;:small_orange_diamond: <a href="https://risky.biz/netcasts/risky-business/"><b>Risky Business</b></a> - is a weekly information security podcast featuring news and in-depth interviews.<br>
  972. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.vice.com/en_us/topic/cyber"><b>Cyber, by Motherboard</b></a> - stories, and focus on the ideas about cybersecurity.<br>
  973. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.tenable.com/podcast"><b>Tenable Podcast</b></a> - conversations and interviews related to Cyber Exposure, and more.<br>
  974. &nbsp;&nbsp;:small_orange_diamond: <a href="https://podcasts.apple.com/gb/podcast/cybercrime-investigations/id1428801405"><b>
  975. Cybercrime Investigations</b></a> - podcast by Geoff White about cybercrimes.<br>
  976. &nbsp;&nbsp;:small_orange_diamond: <a href="https://themanyhats.club/tag/episodes/"><b>The many hats club</b></a> - featuring stories from a wide range of Infosec people (Whitehat, Greyhat and Blackhat).<br>
  977. &nbsp;&nbsp;:small_orange_diamond: <a href="https://darknetdiaries.com/"><b>Darknet Diaries</b></a> - true stories from the dark side of the Internet.<br>
  978. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.youtube.com/playlist?list=PL423I_gHbWUXah3dmt_q_XNp0NlGAKjis"><b>OSINTCurious Webcasts</b></a> - is the investigative curiosity that helps people be successful in OSINT.<br>
  979. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.youtube.com/user/SecurityWeeklyTV"><b>Security Weekly</b></a> - the latest information security and hacking news.<br>
  980. </p>
  981. ##### :black_small_square: Geeky Cybersecurity Video Blogs
  982. <p>
  983. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.youtube.com/channel/UCzvJStjySZVvOBsPl-Vgj0g"><b>rev3rse security</b></a> - offensive, binary exploitation, web app security, hardening, red team, blue team.<br>
  984. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w"><b>LiveOverflow</b></a> - a lot more advanced topics than what is typically offered in paid online courses - but for free.<br>
  985. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.youtube.com/infoseccynic"><b>J4vv4D</b></a> - the important information regarding our internet security.<br>
  986. &nbsp;&nbsp;:small_orange_diamond: <a href="https://cybertalks.co.uk/"><b>
  987. CyberTalks</b></a> - talks, interviews, and article about cybersecurity.<br>
  988. </p>
  989. ##### :black_small_square: Best Personal Twitter Accounts
  990. <p>
  991. &nbsp;&nbsp;:small_orange_diamond: <a href="https://twitter.com/blackroomsec"><b>@blackroomsec</b></a> - a white-hat hacker/pentester. Intergalactic Minesweeper Champion 1990.<br>
  992. &nbsp;&nbsp;:small_orange_diamond: <a href="https://twitter.com/MarcoCiappelli"><b>@MarcoCiappelli</b></a> - Co-Founder @ITSPmagazine, at the intersection of IT security and society.<br>
  993. &nbsp;&nbsp;:small_orange_diamond: <a href="https://twitter.com/binitamshah"><b>@binitamshah</b></a> - Linux Evangelist. Malwares. Kernel Dev. Security Enthusiast.<br>
  994. &nbsp;&nbsp;:small_orange_diamond: <a href="https://twitter.com/joe_carson"><b>@joe_carson</b></a> - an InfoSec Professional and Tech Geek.<br>
  995. &nbsp;&nbsp;:small_orange_diamond: <a href="https://twitter.com/mikko"><b>@mikko</b></a> - CRO at F-Secure, Reverse Engineer, TED Speaker, Supervillain.<br>
  996. &nbsp;&nbsp;:small_orange_diamond: <a href="https://twitter.com/esrtweet"><b>@esrtweet</b></a> - often referred to as ESR, is an American software developer, and open-source software advocate.<br>
  997. &nbsp;&nbsp;:small_orange_diamond: <a href="https://twitter.com/gynvael"><b>@gynvael</b></a> - security researcher/programmer, @DragonSectorCTF founder/player, technical streamer.<br>
  998. &nbsp;&nbsp;:small_orange_diamond: <a href="https://twitter.com/x0rz"><b>@x0rz</b></a> - Security Researcher & Cyber Observer.<br>
  999. &nbsp;&nbsp;:small_orange_diamond: <a href="https://twitter.com/hasherezade"><b>@hasherezade</b></a> - programmer, malware analyst. Author of PEbear, PEsieve, libPeConv.<br>
  1000. &nbsp;&nbsp;:small_orange_diamond: <a href="https://twitter.com/TinkerSec"><b>@TinkerSec</b></a> - tinkerer, cypherpunk, hacker.<br>
  1001. &nbsp;&nbsp;:small_orange_diamond: <a href="https://twitter.com/alisaesage"><b>@alisaesage</b></a> - independent hacker and researcher.<br>
  1002. &nbsp;&nbsp;:small_orange_diamond: <a href="https://twitter.com/SwiftOnSecurity"><b>@SwiftOnSecurity</b></a> - systems security, industrial safety, sysadmin, author of decentsecurity.com.<br>
  1003. &nbsp;&nbsp;:small_orange_diamond: <a href="https://twitter.com/dakami"><b>@dakami</b></a> - is one of just seven people with the authority to restore the DNS root keys.<br>
  1004. &nbsp;&nbsp;:small_orange_diamond: <a href="https://twitter.com/samykamkar"><b>@samykamkar</b></a> - is a famous "grey hat" hacker, security researcher, creator of the MySpace "Samy" worm.<br>
  1005. &nbsp;&nbsp;:small_orange_diamond: <a href="https://twitter.com/securityweekly"><b>@securityweekly</b></a> - founder & CTO of Security Weekly podcast network.<br>
  1006. &nbsp;&nbsp;:small_orange_diamond: <a href="https://twitter.com/jack_daniel"><b>@jack_daniel</b></a> - @SecurityBSides co-founder.<br>
  1007. &nbsp;&nbsp;:small_orange_diamond: <a href="https://twitter.com/thegrugq"><b>@thegrugq</b></a> - Security Researcher.<br>
  1008. &nbsp;&nbsp;:small_orange_diamond: <a href="https://twitter.com/matthew_d_green"><b>@matthew_d_green</b></a> - a cryptographer and professor at Johns Hopkins University.<br>
  1009. </p>
  1010. ##### :black_small_square: Best Commercial Twitter Accounts
  1011. <p>
  1012. &nbsp;&nbsp;:small_orange_diamond: <a href="https://twitter.com/haveibeenpwned"><b>@haveibeenpwned</b></a> - check if you have an account that has been compromised in a data breach.<br>
  1013. &nbsp;&nbsp;:small_orange_diamond: <a href="https://twitter.com/bugcrowd"><b>@bugcrowd</b></a> - trusted by more of the Fortune 500 than any other crowdsourced security platform.<br>
  1014. &nbsp;&nbsp;:small_orange_diamond: <a href="https://twitter.com/Malwarebytes"><b>@Malwarebytes</b></a> - most trusted security company. Unmatched threat visibility.<br>
  1015. &nbsp;&nbsp;:small_orange_diamond: <a href="https://twitter.com/sansforensics"><b>@sansforensics</b></a> - the world's leading Digital Forensics and Incident Response provider.<br>
  1016. &nbsp;&nbsp;:small_orange_diamond: <a href="https://twitter.com/attcyber"><b>@attcyber</b></a> - AT&T Cybersecurity’s Edge-to-Edge technologies provide threat intelligence, and more.<br>
  1017. &nbsp;&nbsp;:small_orange_diamond: <a href="https://twitter.com/TheManyHatsClub"><b>@TheManyHatsClub</b></a> - an information security focused podcast and group of individuals from all walks of life.<br>
  1018. &nbsp;&nbsp;:small_orange_diamond: <a href="https://twitter.com/hedgehogsec"><b>@hedgehogsec</b></a> - Hedgehog Cyber. Gibraltar and Manchester's top boutique information security firm.<br>
  1019. &nbsp;&nbsp;:small_orange_diamond: <a href="https://twitter.com/NCSC"><b>@NCSC</b></a> - the National Cyber Security Centre. Helping to make the UK the safest place to live and work online.<br>
  1020. &nbsp;&nbsp;:small_orange_diamond: <a href="https://twitter.com/Synacktiv"><b>@Synacktiv</b></a> - IT security experts.<br>
  1021. </p>
  1022. ##### :black_small_square: A piece of history
  1023. <p>
  1024. &nbsp;&nbsp;:small_orange_diamond: <a href="http://web.archive.org/web/20190221103734/https://ftp.arl.army.mil/~mike/howto/"><b>How to Do Things at ARL</b></a> - how to configure modems, scan images, record CD-ROMs, and other.<b>*</b><br>
  1025. </p>
  1026. ##### :black_small_square: Other
  1027. <p>
  1028. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.youtube.com/watch?v=3QnD2c4Xovk"><b>Diffie-Hellman Key Exchange (short version)</b></a> - how Diffie-Hellman Key Exchange worked.<br>
  1029. </p>
  1030. #### Hacking/Penetration Testing &nbsp;[<sup>[TOC]</sup>](#anger-table-of-contents)
  1031. ##### :black_small_square: Pentesters arsenal tools
  1032. <p>
  1033. &nbsp;&nbsp;:small_orange_diamond: <a href="http://www.syhunt.com/sandcat/"><b>Sandcat Browser</b></a> - a penetration-oriented browser with plenty of advanced functionality already built in.<br>
  1034. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.metasploit.com/"><b>Metasploit</b></a> - tool and framework for pentesting system, web and many more, contains a lot a ready to use exploit.<br>
  1035. &nbsp;&nbsp;:small_orange_diamond: <a href="https://portswigger.net/burp"><b>Burp Suite</b></a> - tool for testing web app security, intercepting proxy to replay, inject, scan and fuzz.<br>
  1036. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project"><b>OWASP Zed Attack Proxy</b></a> - intercepting proxy to replay, inject, scan and fuzz HTTP requests.<br>
  1037. &nbsp;&nbsp;:small_orange_diamond: <a href="http://w3af.org/"><b>w3af</b></a> - is a Web Application Attack and Audit Framework.<br>
  1038. &nbsp;&nbsp;:small_orange_diamond: <a href="https://mitmproxy.org/"><b>mitmproxy</b></a> - an interactive TLS-capable intercepting HTTP proxy for penetration testers.<br>
  1039. &nbsp;&nbsp;:small_orange_diamond: <a href="https://cirt.net/Nikto2"><b>Nikto2</b></a> - web server scanner which performs comprehensive tests against web servers for multiple items.<br>
  1040. &nbsp;&nbsp;:small_orange_diamond: <a href="http://sqlmap.org/"><b>sqlmap</b></a> - tool that automates the process of detecting and exploiting SQL injection flaws.<br>
  1041. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/lanmaster53/recon-ng"><b>Recon-ng</b></a> - is a full-featured Web Reconnaissance framework written in Python.<br>
  1042. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/Tib3rius/AutoRecon"><b>AutoRecon</b></a> - is a network reconnaissance tool which performs automated enumeration of services.<br>
  1043. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.faradaysec.com/"><b>Faraday</b></a> - an Integrated Multiuser Pentest Environment.<br>
  1044. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/s0md3v/Photon"><b>Photon</b></a> - incredibly fast crawler designed for OSINT.<br>
  1045. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/s0md3v/XSStrike"><b>XSStrike</b></a> - most advanced XSS detection suite.<br>
  1046. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/1N3/Sn1per"><b>Sn1per</b></a> - automated pentest framework for offensive security experts.<br>
  1047. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/future-architect/vuls"><b>vuls</b></a> - is an agent-less vulnerability scanner for Linux, FreeBSD, and other.<br>
  1048. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/google/tsunami-security-scanner"><b>tsunami</b></a> - is a general purpose network security scanner with an extensible plugin system.<br>
  1049. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/michenriksen/aquatone"><b>aquatone</b></a> - a tool for domain flyovers.<br>
  1050. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/GitHackTools/BillCipher"><b>BillCipher</b></a> - information gathering tool for a website or IP address.<br>
  1051. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/Ekultek/WhatWaf"><b>WhatWaf</b></a> - detect and bypass web application firewalls and protection systems.<br>
  1052. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/s0md3v/Corsy"><b>Corsy</b></a> - CORS misconfiguration scanner.<br>
  1053. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/evyatarmeged/Raccoon"><b>Raccoon</b></a> - is a high performance offensive security tool for reconnaissance and vulnerability scanning.<br>
  1054. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/Nekmo/dirhunt"><b>dirhunt</b></a> - find web directories without bruteforce.<br>
  1055. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.openwall.com/john/"><b>John The Ripper</b></a> - is a fast password cracker, currently available for many flavors of Unix, Windows, and other.<br>
  1056. &nbsp;&nbsp;:small_orange_diamond: <a href="https://hashcat.net/hashcat/"><b>hashcat</b></a> - world's fastest and most advanced password recovery utility.<br>
  1057. &nbsp;&nbsp;:small_orange_diamond: <a href="http://lcamtuf.coredump.cx/p0f3/"><b>p0f</b></a> - is a tool to identify the players behind any incidental TCP/IP communications.<br>
  1058. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/mozilla/ssh_scan"><b>ssh_scan</b></a> - a prototype SSH configuration and policy scanner.<br>
  1059. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/woj-ciech/LeakLooker"><b>LeakLooker</b></a> - find open databases - powered by Binaryedge.io<br>
  1060. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/offensive-security/exploitdb"><b>exploitdb</b></a> - searchable archive from The Exploit Database.<br>
  1061. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/vulnersCom/getsploit"><b>getsploit</b></a> - is a command line utility for searching and downloading exploits.<br>
  1062. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/zardus/ctf-tools"><b>ctf-tools</b></a> - some setup scripts for security research tools.<br>
  1063. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/Gallopsled/pwntools"><b>pwntools</b></a> - CTF framework and exploit development library.<br>
  1064. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/bl4de/security-tools"><b>security-tools</b></a> - collection of small security tools created mostly in Python. CTFs, pentests and so on.<br>
  1065. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/leonteale/pentestpackage"><b>pentestpackage</b></a> - is a package of Pentest scripts.<br>
  1066. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/dloss/python-pentest-tools"><b>python-pentest-tools</b></a> - python tools for penetration testers.<br>
  1067. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/fuzzdb-project/fuzzdb"><b>fuzzdb</b></a> - dictionary of attack patterns and primitives for black-box application fault injection.<br>
  1068. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/google/AFL"><b>AFL</b></a> - is a free software fuzzer maintained by Google.<br>
  1069. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/AFLplusplus/AFLplusplus"><b>AFL++</b></a> - is AFL with community patches.<br>
  1070. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/google/syzkaller"><b>syzkaller</b></a> - is an unsupervised, coverage-guided kernel fuzzer.<br>
  1071. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/pwndbg/pwndbg"><b>pwndbg</b></a> - exploit development and reverse engineering with GDB made easy.<br>
  1072. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/longld/peda"><b>GDB PEDA</b></a> - Python Exploit Development Assistance for GDB.<br>
  1073. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.hex-rays.com/products/ida/index.shtml"><b>IDA</b></a> - multi-processor disassembler and debugger useful for reverse engineering malware.<br>
  1074. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/radare/radare2"><b>radare2</b></a> - framework for reverse-engineering and analyzing binaries.<br>
  1075. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/threat9/routersploit"><b>routersploit</b></a> - exploitation framework for embedded devices.<br>
  1076. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/NationalSecurityAgency/ghidra"><b>Ghidra</b></a> - is a software reverse engineering (SRE) framework.<br>
  1077. &nbsp;&nbsp;:small_orange_diamond: <a href="https://cutter.re/"><b>Cutter</b></a> - is an SRE platform integrating Ghidra's decompiler.<br>
  1078. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/salesforce/vulnreport"><b>Vulnreport</b></a> - open-source pentesting management and automation platform by Salesforce Product Security.<br>
  1079. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/sc0tfree/mentalist"><b>Mentalist</b></a> - is a graphical tool for custom wordlist generation.<br>
  1080. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/archerysec/archerysec"><b>archerysec</b></a> - vulnerability assessment and management helps to perform scans and manage vulnerabilities.<br>
  1081. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/j3ssie/Osmedeus"><b>Osmedeus</b></a> - fully automated offensive security tool for reconnaissance and vulnerability scanning.<br>
  1082. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/beefproject/beef"><b>beef</b></a> - the browser exploitation framework project.<br>
  1083. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/NullArray/AutoSploit"><b>AutoSploit</b></a> - automated mass exploiter.<br>
  1084. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/TH3xACE/SUDO_KILLER"><b>SUDO_KILLER</b></a> - is a tool to identify and exploit sudo rules' misconfigurations and vulnerabilities.<br>
  1085. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/VirusTotal/yara"><b>yara</b></a> - the pattern matching swiss knife.<br>
  1086. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/gentilkiwi/mimikatz"><b>mimikatz</b></a> - a little tool to play with Windows security.<br>
  1087. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/sherlock-project/sherlock"><b>sherlock</b></a> - hunt down social media accounts by username across social networks.<br>
  1088. &nbsp;&nbsp;:small_orange_diamond: <a href="https://owasp.org/www-project-threat-dragon/"><b>OWASP Threat Dragon</b></a> - is a tool used to create threat model diagrams and to record possible threats.<br>
  1089. </p>
  1090. ##### :black_small_square: Pentests bookmarks collection
  1091. <p>
  1092. &nbsp;&nbsp;:small_orange_diamond: <a href="http://www.pentest-standard.org/index.php/Main_Page"><b>PTES</b></a> - the penetration testing execution standard.<br>
  1093. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.amanhardikar.com/mindmaps/Practice.html"><b>Pentests MindMap</b></a> - amazing mind map with vulnerable apps and systems.<br>
  1094. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.amanhardikar.com/mindmaps/webapptest.html"><b>WebApps Security Tests MindMap</b></a> - incredible mind map for WebApps security tests.<br>
  1095. &nbsp;&nbsp;:small_orange_diamond: <a href="https://brutelogic.com.br/blog/"><b>Brute XSS</b></a> - master the art of Cross Site Scripting.<br>
  1096. &nbsp;&nbsp;:small_orange_diamond: <a href="https://portswigger.net/web-security/cross-site-scripting/cheat-sheet"><b>XSS cheat sheet</b></a> - contains many vectors that can help you bypass WAFs and filters.<br>
  1097. &nbsp;&nbsp;:small_orange_diamond: <a href="https://jivoi.github.io/2015/07/03/offensive-security-bookmarks/"><b>Offensive Security Bookmarks</b></a> - security bookmarks collection, all things that author need to pass OSCP.<br>
  1098. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/coreb1t/awesome-pentest-cheat-sheets"><b>Awesome Pentest Cheat Sheets</b></a> - collection of the cheat sheets useful for pentesting.<br>
  1099. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/Hack-with-Github/Awesome-Hacking"><b>Awesome Hacking by HackWithGithub</b></a> - awesome lists for hackers, pentesters and security researchers.<br>
  1100. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/carpedm20/awesome-hacking"><b>Awesome Hacking by carpedm20</b></a> - a curated list of awesome hacking tutorials, tools and resources.<br>
  1101. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/vitalysim/Awesome-Hacking-Resources"><b>Awesome Hacking Resources</b></a> - collection of hacking/penetration testing resources to make you better.<br>
  1102. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/enaqx/awesome-pentest"><b>Awesome Pentest</b></a> - collection of awesome penetration testing resources, tools and other shiny things.<br>
  1103. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/m4ll0k/Awesome-Hacking-Tools"><b>Awesome-Hacking-Tools</b></a> - is a curated list of awesome Hacking Tools.<br>
  1104. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/ksanchezcld/Hacking_Cheat_Sheet"><b>Hacking Cheat Sheet</b></a> - author hacking and pentesting notes.<br>
  1105. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/toolswatch/blackhat-arsenal-tools"><b>blackhat-arsenal-tools</b></a> - official Black Hat arsenal security tools repository.<br>
  1106. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.peerlyst.com/posts/the-complete-list-of-infosec-related-cheat-sheets-claus-cramon"><b>Penetration Testing and WebApp Cheat Sheets</b></a> - the complete list of Infosec related cheat sheets.<br>
  1107. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/The-Art-of-Hacking/h4cker"><b>Cyber Security Resources</b></a> - includes thousands of cybersecurity-related references and resources.<br>
  1108. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/jhaddix/pentest-bookmarks"><b>Pentest Bookmarks</b></a> - there are a LOT of pentesting blogs.<br>
  1109. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/OlivierLaflamme/Cheatsheet-God"><b>Cheatsheet-God</b></a> - Penetration Testing Reference Bank - OSCP/PTP & PTX Cheatsheet.<br>
  1110. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/Cyb3rWard0g/ThreatHunter-Playbook"><b>ThreatHunter-Playbook</b></a> - to aid the development of techniques and hypothesis for hunting campaigns.<br>
  1111. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/hmaverickadams/Beginner-Network-Pentesting"><b>Beginner-Network-Pentesting</b></a> - notes for beginner network pentesting course.<br>
  1112. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/rewardone/OSCPRepo"><b>OSCPRepo</b></a> - is a list of resources that author have been gathering in preparation for the OSCP.<br>
  1113. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/swisskyrepo/PayloadsAllTheThings"><b>PayloadsAllTheThings</b></a> - a list of useful payloads and bypass for Web Application Security and Pentest/CTF.<br>
  1114. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/foospidy/payloads"><b>payloads</b></a> - git all the Payloads! A collection of web attack payloads.<br>
  1115. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/payloadbox/command-injection-payload-list"><b>command-injection-payload-list</b></a> - command injection payload list.<br>
  1116. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/jakejarvis/awesome-shodan-queries"><b>Awesome Shodan Search Queries</b></a> - great search queries to plug into Shodan.<br>
  1117. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/s0md3v/AwesomeXSS"><b>AwesomeXSS</b></a> - is a collection of Awesome XSS resources.<br>
  1118. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/JohnTroony/php-webshells"><b>php-webshells</b></a> - common php webshells.<br>
  1119. &nbsp;&nbsp;:small_orange_diamond: <a href="https://highon.coffee/blog/penetration-testing-tools-cheat-sheet/"><b>Pentesting Tools Cheat Sheet</b></a> - a quick reference high level overview for typical penetration testing.<br>
  1120. &nbsp;&nbsp;:small_orange_diamond: <a href="https://cheatsheetseries.owasp.org/"><b>OWASP Cheat Sheet Series</b></a> - is a collection of high value information on specific application security topics.<br>
  1121. &nbsp;&nbsp;:small_orange_diamond: <a href="https://jeremylong.github.io/DependencyCheck/index.html"><b>OWASP dependency-check</b></a> - is an open source solution the OWASP Top 10 2013 entry.<br>
  1122. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.owasp.org/index.php/OWASP_Proactive_Controls"><b>OWASP ProActive Controls</b></a> - OWASP Top 10 Proactive Controls 2018.<br>
  1123. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/blaCCkHatHacEEkr/PENTESTING-BIBLE"><b>PENTESTING-BIBLE</b></a> - hacking & penetration testing & red team & cyber security resources.<br>
  1124. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/nixawk/pentest-wiki"><b>pentest-wiki</b></a> - is a free online security knowledge library for pentesters/researchers.<br>
  1125. &nbsp;&nbsp;:small_orange_diamond: <a href="https://media.defcon.org/"><b>DEF CON Media Server</b></a> - great stuff from DEFCON.<br>
  1126. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/rshipp/awesome-malware-analysis"><b>Awesome Malware Analysis</b></a> - a curated list of awesome malware analysis tools and resources.<br>
  1127. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.netsparker.com/blog/web-security/sql-injection-cheat-sheet/"><b>SQL Injection Cheat Sheet</b></a> - detailed technical stuff about the many different variants of the SQL Injection.<br>
  1128. &nbsp;&nbsp;:small_orange_diamond: <a href="http://kb.entersoft.co.in/"><b>Entersoft Knowledge Base</b></a> - great and detailed reference about vulnerabilities.<br>
  1129. &nbsp;&nbsp;:small_orange_diamond: <a href="http://html5sec.org/"><b>HTML5 Security Cheatsheet</b></a> - a collection of HTML5 related XSS attack vectors.<br>
  1130. &nbsp;&nbsp;:small_orange_diamond: <a href="http://evuln.com/tools/xss-encoder/"><b>XSS String Encoder</b></a> - for generating XSS code to check your input validation filters against XSS.<br>
  1131. &nbsp;&nbsp;:small_orange_diamond: <a href="https://gtfobins.github.io/"><b>GTFOBins</b></a> - list of Unix binaries that can be exploited by an attacker to bypass local security restrictions.<br>
  1132. &nbsp;&nbsp;:small_orange_diamond: <a href="https://guif.re/"><b>Guifre Ruiz Notes</b></a> - collection of security, system, network and pentest cheatsheets.<br>
  1133. &nbsp;&nbsp;:small_orange_diamond: <a href="http://blog.safebuff.com/2016/07/03/SSRF-Tips/index.html"><b>SSRF Tips</b></a> - a collection of SSRF Tips.<br>
  1134. &nbsp;&nbsp;:small_orange_diamond: <a href="http://shell-storm.org/repo/CTF/"><b>shell-storm repo CTF</b></a> - great archive of CTFs.<br>
  1135. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/bl4de/ctf"><b>ctf</b></a> - CTF (Capture The Flag) writeups, code snippets, notes, scripts.<br>
  1136. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/orangetw/My-CTF-Web-Challenges"><b>My-CTF-Web-Challenges</b></a> - collection of CTF Web challenges.<br>
  1137. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/OWASP/owasp-mstg"><b>MSTG</b></a> - The Mobile Security Testing Guide (MSTG) is a comprehensive manual for mobile app security testing.<br>
  1138. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/sdcampbell/Internal-Pentest-Playbook"><b>Internal-Pentest-Playbook</b></a> - notes on the most common things for an Internal Network Penetration Test.<br>
  1139. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/streaak/keyhacks"><b>KeyHacks</b></a> - shows quick ways in which API keys leaked by a bug bounty program can be checked.<br>
  1140. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/securitum/research"><b>securitum/research</b></a> - various Proof of Concepts of security research performed by Securitum.<br>
  1141. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/juliocesarfort/public-pentesting-reports"><b>public-pentesting-reports</b></a> - is a list of public pentest reports released by several consulting security groups.<br>
  1142. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/djadmin/awesome-bug-bounty"><b>awesome-bug-bounty</b></a> - is a comprehensive curated list of available Bug Bounty.<br>
  1143. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/ngalongc/bug-bounty-reference"><b>bug-bounty-reference</b></a> - is a list of bug bounty write-ups.<br>
  1144. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/devanshbatham/Awesome-Bugbounty-Writeups"><b>Awesome-Bugbounty-Writeups</b></a> - is a curated list of bugbounty writeups.<br>
  1145. &nbsp;&nbsp;:small_orange_diamond: <a href="https://pentester.land/list-of-bug-bounty-writeups.html"><b>Bug bounty writeups</b></a> - list of bug bounty writeups (2012-2020).<br>
  1146. &nbsp;&nbsp;:small_orange_diamond: <a href="https://hackso.me/"><b>hackso.me</b></a> - a great journey into security.<br>
  1147. </p>
  1148. ##### :black_small_square: Backdoors/exploits
  1149. <p>
  1150. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/bartblaze/PHP-backdoors"><b>PHP-backdoors</b></a> - a collection of PHP backdoors. For educational or testing purposes only.<br>
  1151. </p>
  1152. ##### :black_small_square: Wordlists and Weak passwords
  1153. <p>
  1154. &nbsp;&nbsp;:small_orange_diamond: <a href="https://weakpass.com/"><b>Weakpass</b></a> - for any kind of bruteforce find wordlists or unleash the power of them all at once!<br>
  1155. &nbsp;&nbsp;:small_orange_diamond: <a href="https://hashes.org/"><b>Hashes.org</b></a> - is a free online hash resolving service incorporating many unparalleled techniques.<br>
  1156. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/danielmiessler/SecLists"><b>SecLists</b></a> - collection of multiple types of lists used during security assessments, collected in one place.<br>
  1157. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/berzerk0/Probable-Wordlists"><b>Probable-Wordlists</b></a> - sorted by probability originally created for password generation and testing.<br>
  1158. &nbsp;&nbsp;:small_orange_diamond: <a href="https://wiki.skullsecurity.org/index.php?title=Passwords"><b>skullsecurity passwords</b></a> - password dictionaries and leaked passwords repository.<br>
  1159. &nbsp;&nbsp;:small_orange_diamond: <a href="https://bezpieka.org/polski-slownik-premium-polish-wordlist"><b>Polish PREMIUM Dictionary</b></a> - official dictionary created by the team on the forum bezpieka.org.<b>*</b> <sup><a href="https://sourceforge.net/projects/kali-linux/files/Wordlist/">1</sup><br>
  1160. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/insidetrust/statistically-likely-usernames"><b>statistically-likely-usernames</b></a> - wordlists for creating statistically likely username lists.<br>
  1161. </p>
  1162. ##### :black_small_square: Bounty platforms
  1163. <p>
  1164. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.yeswehack.com/"><b>YesWeHack</b></a> - bug bounty platform with infosec jobs.<br>
  1165. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.openbugbounty.org/"><b>Openbugbounty</b></a> - allows any security researcher reporting a vulnerability on any website.<br>
  1166. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.hackerone.com/"><b>hackerone</b></a> - global hacker community to surface the most relevant security issues.<br>
  1167. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.bugcrowd.com/"><b>bugcrowd</b></a> - crowdsourced cybersecurity for the enterprise.<br>
  1168. &nbsp;&nbsp;:small_orange_diamond: <a href="https://crowdshield.com/"><b>Crowdshield</b></a> - crowdsourced security & bug bounty management.<br>
  1169. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.synack.com/"><b>Synack</b></a> - crowdsourced security & bug bounty programs, crowd security intelligence platform, and more.<br>
  1170. &nbsp;&nbsp;:small_orange_diamond: <a href="https://hacktrophy.com/en/"><b>Hacktrophy</b></a> - bug bounty platform.<br>
  1171. </p>
  1172. ##### :black_small_square: Web Training Apps (local installation)
  1173. <p>
  1174. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.owasp.org/index.php/OWASP_Vulnerable_Web_Applications_Directory_Project"><b>OWASP-VWAD</b></a> - comprehensive and well maintained registry of all known vulnerable web applications.<br>
  1175. &nbsp;&nbsp;:small_orange_diamond: <a href="http://www.dvwa.co.uk/"><b>DVWA</b></a> - PHP/MySQL web application that is damn vulnerable.<br>
  1176. &nbsp;&nbsp;:small_orange_diamond: <a href="https://metasploit.help.rapid7.com/docs/metasploitable-2"><b>metasploitable2</b></a> - vulnerable web application amongst security researchers.<br>
  1177. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/rapid7/metasploitable3"><b>metasploitable3</b></a> - is a VM that is built from the ground up with a large amount of security vulnerabilities.<br>
  1178. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/stamparm/DSVW"><b>DSVW</b></a> - is a deliberately vulnerable web application written in under 100 lines of code.<br>
  1179. &nbsp;&nbsp;:small_orange_diamond: <a href="https://sourceforge.net/projects/mutillidae/"><b>OWASP Mutillidae II</b></a> - free, open source, deliberately vulnerable web-application.<br>
  1180. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.owasp.org/index.php/OWASP_Juice_Shop_Project"><b>OWASP Juice Shop Project</b></a> - the most bug-free vulnerable application in existence.<br>
  1181. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.owasp.org/index.php/Projects/OWASP_Node_js_Goat_Project"><b>OWASP Node js Goat Project</b></a> - OWASP Top 10 security risks apply to web apps developed using Node.js.<br>
  1182. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/iteratec/juicy-ctf"><b>juicy-ctf</b></a> - run Capture the Flags and Security Trainings with OWASP Juice Shop.<br>
  1183. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/OWASP/SecurityShepherd"><b>SecurityShepherd</b></a> - web and mobile application security training platform.<br>
  1184. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/opendns/Security_Ninjas_AppSec_Training"><b>Security Ninjas</b></a> - open source application security training program.<br>
  1185. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/rapid7/hackazon"><b>hackazon</b></a> - a modern vulnerable web app.<br>
  1186. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/appsecco/dvna"><b>dvna</b></a> - damn vulnerable NodeJS application.<br>
  1187. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/DefectDojo/django-DefectDojo"><b>django-DefectDojo</b></a> - is an open-source application vulnerability correlation and security orchestration tool.<br>
  1188. &nbsp;&nbsp;:small_orange_diamond: <a href="https://google-gruyere.appspot.com/"><b>Google Gruyere</b></a> - web application exploits and defenses.<br>
  1189. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/amolnaik4/bodhi"><b>Bodhi</b></a> - is a playground focused on learning the exploitation of client-side web vulnerabilities.<br>
  1190. &nbsp;&nbsp;:small_orange_diamond: <a href="https://websploit.h4cker.org/"><b>Websploit</b></a> - single vm lab with the purpose of combining several vulnerable appliations in one environment.<br>
  1191. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/vulhub/vulhub"><b>vulhub</b></a> - pre-built Vulnerable Environments based on docker-compose.<br>
  1192. &nbsp;&nbsp;:small_orange_diamond: <a href="https://rhinosecuritylabs.com/aws/introducing-cloudgoat-2/"><b>CloudGoat 2</b></a> - the new & improved "Vulnerable by Design"
  1193. AWS deployment tool.<br>
  1194. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/globocom/secDevLabs"><b>secDevLabs</b></a> - is a laboratory for learning secure web development in a practical manner.<br>
  1195. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/incredibleindishell/CORS-vulnerable-Lab"><b>CORS-vulnerable-Lab</b></a> - sample vulnerable code and its exploit code.<br>
  1196. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/moloch--/RootTheBox"><b>RootTheBox</b></a> - a Game of Hackers (CTF Scoreboard & Game Manager).<br>
  1197. &nbsp;&nbsp;:small_orange_diamond: <a href="https://application.security/"><b>KONTRA</b></a> - application security training (OWASP Top Web & Api).<br>
  1198. </p>
  1199. ##### :black_small_square: Labs (ethical hacking platforms/trainings/CTFs)
  1200. <p>
  1201. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.offensive-security.com/"><b>Offensive Security</b></a> - true performance-based penetration testing training for over a decade.<br>
  1202. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.hackthebox.eu/"><b>Hack The Box</b></a> - online platform allowing you to test your penetration testing skills.<br>
  1203. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.hacking-lab.com/index.html"><b>Hacking-Lab</b></a> - online ethical hacking, computer network and security challenge platform.<br>
  1204. &nbsp;&nbsp;:small_orange_diamond: <a href="http://pwnable.kr/index.php"><b>pwnable.kr</b></a> - non-commercial wargame site which provides various pwn challenges.<br>
  1205. &nbsp;&nbsp;:small_orange_diamond: <a href="https://pwnable.tw/"><b>Pwnable.tw</b></a> - is a wargame site for hackers to test and expand their binary exploiting skills.<br>
  1206. &nbsp;&nbsp;:small_orange_diamond: <a href="https://picoctf.com/"><b>picoCTF</b></a> - is a free computer security game targeted at middle and high school students.<br>
  1207. &nbsp;&nbsp;:small_orange_diamond: <a href="https://ctflearn.com/"><b>CTFlearn</b></a> - is an online platform built to help ethical hackers learn and practice their cybersecurity knowledge.<br>
  1208. &nbsp;&nbsp;:small_orange_diamond: <a href="https://ctftime.org/"><b>ctftime</b></a> - CTF archive and a place, where you can get some another CTF-related info.<br>
  1209. &nbsp;&nbsp;:small_orange_diamond: <a href="https://silesiasecuritylab.com/"><b>Silesia Security Lab</b></a> - high quality security testing services.<br>
  1210. &nbsp;&nbsp;:small_orange_diamond: <a href="https://practicalpentestlabs.com/"><b>Practical Pentest Labs</b></a> - pentest lab, take your Hacking skills to the next level.<br>
  1211. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.root-me.org/?lang=en"><b>Root Me</b></a> - the fast, easy, and affordable way to train your hacking skills.<br>
  1212. &nbsp;&nbsp;:small_orange_diamond: <a href="https://rozwal.to/login"><b>rozwal.to</b></a> - a great platform to train your pentesting skills.<br>
  1213. &nbsp;&nbsp;:small_orange_diamond: <a href="https://tryhackme.com/"><b>TryHackMe</b></a> - learning Cyber Security made easy.<br>
  1214. &nbsp;&nbsp;:small_orange_diamond: <a href="https://hackxor.net/"><b>hackxor</b></a> - is a realistic web application hacking game, designed to help players of all abilities develop their skills.<br>
  1215. &nbsp;&nbsp;:small_orange_diamond: <a href="http://hack-yourself-first.com/"><b>Hack Yourself First</b></a> - it's full of nasty app sec holes.<br>
  1216. &nbsp;&nbsp;:small_orange_diamond: <a href="http://overthewire.org/wargames/"><b>OverTheWire</b></a> - can help you to learn and practice security concepts in the form of fun-filled games.<br>
  1217. &nbsp;&nbsp;:small_orange_diamond: <a href="https://labs.wizard-security.net/"><b>Wizard Labs</b></a> - is an online Penetration Testing Lab.<br>
  1218. &nbsp;&nbsp;:small_orange_diamond: <a href="https://pentesterlab.com/"><b>PentesterLab</b></a> - provides vulnerable systems that can be used to test and understand vulnerabilities.<br>
  1219. &nbsp;&nbsp;:small_orange_diamond: <a href="https://ringzer0ctf.com/"><b>RingZer0</b></a> - tons of challenges designed to test and improve your hacking skills.<br>
  1220. &nbsp;&nbsp;:small_orange_diamond: <a href="http://www.try2hack.nl/"><b>try2hack</b></a> - several security-oriented challenges for your entertainment.<br>
  1221. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.ubeeri.com/preconfig-labs"><b>Ubeeri</b></a> - preconfigured lab environments.<br>
  1222. &nbsp;&nbsp;:small_orange_diamond: <a href="https://lab.pentestit.ru/"><b>Pentestit</b></a> - emulate IT infrastructures of real companies for legal pen testing and improving pentest skills.<br>
  1223. &nbsp;&nbsp;:small_orange_diamond: <a href="https://microcorruption.com/login"><b>Microcorruption</b></a> - reversal challenges done in the web interface.<br>
  1224. &nbsp;&nbsp;:small_orange_diamond: <a href="https://crackmes.one/"><b>Crackmes</b></a> - download crackmes to help improve your reverse engineering skills.<br>
  1225. &nbsp;&nbsp;:small_orange_diamond: <a href="https://domgo.at/cxss/intro"><b>DomGoat</b></a> - DOM XSS security learning and practicing platform.<br>
  1226. &nbsp;&nbsp;:small_orange_diamond: <a href="https://chall.stypr.com"><b>Stereotyped Challenges</b></a> - upgrade your web hacking techniques today!<br>
  1227. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.vulnhub.com/"><b>Vulnhub</b></a> - allows anyone to gain practical 'hands-on' experience in digital security.<br>
  1228. &nbsp;&nbsp;:small_orange_diamond: <a href="https://w3challs.com/"><b>W3Challs</b></a> - is a penetration testing training platform, which offers various computer challenges.<br>
  1229. &nbsp;&nbsp;:small_orange_diamond: <a href="https://ringzer0ctf.com/challenges"><b>RingZer0 CTF</b></a> - offers you tons of challenges designed to test and improve your hacking skills.<br>
  1230. &nbsp;&nbsp;:small_orange_diamond: <a href="https://hack.me/"><b>Hack.me</b></a> - a platform where you can build, host and share vulnerable web apps for educational purposes.<br>
  1231. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.hackthis.co.uk/levels/"><b>HackThis!</b></a> - discover how hacks, dumps and defacements are performed and secure your website.<br>
  1232. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.enigmagroup.org/#"><b>Enigma Group WebApp Training</b></a> - these challenges cover the exploits listed in the OWASP Top 10 Project.<br>
  1233. &nbsp;&nbsp;:small_orange_diamond: <a href="https://challenges.re/"><b>Reverse Engineering Challenges</b></a> - challenges, exercises, problems and tasks - by level, by type, and more.<br>
  1234. &nbsp;&nbsp;:small_orange_diamond: <a href="https://0x00sec.org/"><b>0x00sec</b></a> - the home of the Hacker - Malware, Reverse Engineering, and Computer Science.<br>
  1235. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.wechall.net/challs"><b>We Chall</b></a> - there are exist a lots of different challenge types.<br>
  1236. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.hackergateway.com/"><b>Hacker Gateway</b></a> - is the go-to place for hackers who want to test their skills.<br>
  1237. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.hacker101.com/"><b>Hacker101</b></a> - is a free class for web security.<br>
  1238. &nbsp;&nbsp;:small_orange_diamond: <a href="https://contained.af/"><b>contained.af</b></a> - a stupid game for learning about containers, capabilities, and syscalls.<br>
  1239. &nbsp;&nbsp;:small_orange_diamond: <a href="http://flaws.cloud/"><b>flAWS challenge!</b></a> - a series of levels you'll learn about common mistakes and gotchas when using AWS.<br>
  1240. &nbsp;&nbsp;:small_orange_diamond: <a href="https://cybersecurity.wtf"><b>CyberSec WTF</b></a> - provides web hacking challenges derived from bounty write-ups.<br>
  1241. &nbsp;&nbsp;:small_orange_diamond: <a href="https://ctfchallenge.co.uk/login"><b>CTF Challenge</b></a> - CTF Web App challenges.<br>
  1242. &nbsp;&nbsp;:small_orange_diamond: <a href="https://capturetheflag.withgoogle.com"><b>gCTF</b></a> - most of the challenges used in the Google CTF 2017.<br>
  1243. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.hackthissite.org/pages/index/index.php"><b>Hack This Site</b></a> - is a free, safe and legal training ground for hackers.<br>
  1244. &nbsp;&nbsp;:small_orange_diamond: <a href="https://attackdefense.com"><b>Attack & Defense</b></a> - is a browser-based cloud labs.<br>
  1245. &nbsp;&nbsp;:small_orange_diamond: <a href="https://cryptohack.org/"><b>Cryptohack</b></a> - a fun platform for learning modern cryptography.<br>
  1246. &nbsp;&nbsp;:small_orange_diamond: <a href="https://cryptopals.com/"><b>Cryptopals</b></a> - the cryptopals crypto challenges.<br>
  1247. </p>
  1248. ##### :black_small_square: CTF platforms
  1249. <p>
  1250. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/facebook/fbctf"><b>fbctf</b></a> - platform to host Capture the Flag competitions.<br>
  1251. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/google/ctfscoreboard"><b>ctfscoreboard</b></a> - scoreboard for Capture The Flag competitions.<br>
  1252. </p>
  1253. ##### :black_small_square: Other resources
  1254. <p>
  1255. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/bugcrowd/bugcrowd_university"><b>Bugcrowd University</b></a> - open source education content for the researcher community.<br>
  1256. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/rewardone/OSCPRepo"><b>OSCPRepo</b></a> - a list of resources and scripts that I have been gathering in preparation for the OSCP.<br>
  1257. &nbsp;&nbsp;:small_orange_diamond: <a href="https://medium.com/@cxosmo/owasp-top-10-real-world-examples-part-1-a540c4ea2df5"><b>OWASP Top 10: Real-World Examples</b></a> - test your web apps with real-world examples (two-part series).<br>
  1258. &nbsp;&nbsp;:small_orange_diamond: <a href="http://phrack.org/index.html"><b>phrack.org</b></a> - an awesome collection of articles from several respected hackers and other thinkers.<br>
  1259. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/Gr1mmie/Practical-Ethical-Hacking-Resources"><b>Practical-Ethical-Hacking-Resources</b></a> - compilation of resources from TCM's Udemy Course.<br>
  1260. </p>
  1261. #### Your daily knowledge and news &nbsp;[<sup>[TOC]</sup>](#anger-table-of-contents)
  1262. ##### :black_small_square: RSS Readers
  1263. <p>
  1264. &nbsp;&nbsp;:small_orange_diamond: <a href="https://feedly.com/"><b>Feedly</b></a> - organize, read and share what matters to you.<br>
  1265. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.inoreader.com/"><b>Inoreader</b></a> - similar to feedly with a support for filtering what you fetch from rss.<br>
  1266. </p>
  1267. ##### :black_small_square: IRC Channels
  1268. <p>
  1269. &nbsp;&nbsp;:small_orange_diamond: <a href="https://wiki.hackerspaces.org/IRC_Channel"><b>#hackerspaces</b></a> - hackerspace IRC channels.<br>
  1270. </p>
  1271. ##### :black_small_square: Security
  1272. <p>
  1273. &nbsp;&nbsp;:small_orange_diamond: <a href="https://thehackernews.com/"><b>The Hacker News</b></a> - leading news source dedicated to promoting awareness for security experts and hackers.<br>
  1274. &nbsp;&nbsp;:small_orange_diamond: <a href="https://latesthackingnews.com/"><b>Latest Hacking News</b></a> - provides the latest hacking news, exploits and vulnerabilities for ethical hackers.<br>
  1275. &nbsp;&nbsp;:small_orange_diamond: <a href="https://securitynewsletter.co/"><b>Security Newsletter</b></a> - security news as a weekly digest (email notifications).<br>
  1276. &nbsp;&nbsp;:small_orange_diamond: <a href="https://security.googleblog.com/"><b>Google Online Security Blog</b></a> - the latest news and insights from Google on security and safety on the Internet.<br>
  1277. &nbsp;&nbsp;:small_orange_diamond: <a href="https://blog.qualys.com/"><b>Qualys Blog</b></a> - expert network security guidance and news.<br>
  1278. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.darkreading.com/"><b>DARKReading</b></a> - connecting the Information Security Community.<br>
  1279. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.darknet.org.uk/"><b>Darknet</b></a> - latest hacking tools, hacker news, cybersecurity best practices, ethical hacking & pen-testing.<br>
  1280. &nbsp;&nbsp;:small_orange_diamond: <a href="https://twitter.com/disclosedh1"><b>publiclyDisclosed</b></a> - public disclosure watcher who keeps you up to date about the recently disclosed bugs.<br>
  1281. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.reddit.com/r/hacking/"><b>Reddit - Hacking</b></a> - a subreddit dedicated to hacking and hackers.<br>
  1282. &nbsp;&nbsp;:small_orange_diamond: <a href="https://packetstormsecurity.com/"><b>Packet Storm</b></a> - information security services, news, files, tools, exploits, advisories and whitepapers.<br>
  1283. &nbsp;&nbsp;:small_orange_diamond: <a href="https://sekurak.pl/"><b>Sekurak</b></a> - about security, penetration tests, vulnerabilities and many others (PL/EN).<br>
  1284. &nbsp;&nbsp;:small_orange_diamond: <a href="https://nfsec.pl/"><b>nf.sec</b></a> - basic aspects and mechanisms of Linux operating system security (PL).<br>
  1285. </p>
  1286. ##### :black_small_square: Other/All-in-one
  1287. <p>
  1288. &nbsp;&nbsp;:small_orange_diamond: <a href="https://changelog.com/"><b>Changelog</b></a> - is a community of hackers; news & podcasts for developers and hackers.<br>
  1289. </p>
  1290. #### Other Cheat Sheets &nbsp;[<sup>[TOC]</sup>](#anger-table-of-contents)
  1291. ###### Build your own DNS Servers
  1292. <p>
  1293. &nbsp;&nbsp;:small_orange_diamond: <a href="https://calomel.org/unbound_dns.html"><b>Unbound DNS Tutorial</b></a> - a validating, recursive, and caching DNS server.<br>
  1294. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.ctrl.blog/entry/knot-dns-resolver-tutorial.html"><b>Knot Resolver on Fedora</b></a> - how to get faster and more secure DNS resolution with Knot Resolver on Fedora.<br>
  1295. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.aaflalo.me/2018/10/tutorial-setup-dns-over-https-server/"><b>DNS-over-HTTPS</b></a> - tutorial to setup your own DNS-over-HTTPS (DoH) server.<br>
  1296. &nbsp;&nbsp;:small_orange_diamond: <a href="https://hacks.mozilla.org/2018/05/a-cartoon-intro-to-dns-over-https/"><b>dns-over-https</b></a> - a cartoon intro to DNS over HTTPS.<br>
  1297. &nbsp;&nbsp;:small_orange_diamond: <a href="https://www.aaflalo.me/2019/03/dns-over-tls/"><b>DNS-over-TLS</b></a> - following to your DoH server, setup your DNS-over-TLS (DoT) server.<br>
  1298. &nbsp;&nbsp;:small_orange_diamond: <a href="https://zwischenzugs.com/2018/01/26/how-and-why-i-run-my-own-dns-servers/"><b>DNS Servers</b></a> - how (and why) i run my own DNS Servers.<br>
  1299. </p>
  1300. ###### Build your own Certificate Authority
  1301. <p>
  1302. &nbsp;&nbsp;:small_orange_diamond: <a href="https://jamielinux.com/docs/openssl-certificate-authority/"><b>OpenSSL Certificate Authority</b></a> - build your own certificate authority (CA) using the OpenSSL tools.<br>
  1303. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/smallstep/certificates"><b>step-ca Certificate Authority</b></a> - build your own certificate authority (CA) using open source step-ca.<br>
  1304. </p>
  1305. ###### Build your own System/Virtual Machine
  1306. <p>
  1307. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/cfenollosa/os-tutorial"><b>os-tutorial</b></a> - how to create an OS from scratch.<br>
  1308. &nbsp;&nbsp;:small_orange_diamond: <a href="https://justinmeiners.github.io/lc3-vm/"><b>Write your Own Virtual Machine</b></a> - how to write your own virtual machine (VM).<br>
  1309. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/cirosantilli/x86-bare-metal-examples"><b>x86 Bare Metal Examples</b></a> - dozens of minimal operating systems to learn x86 system programming.<br>
  1310. &nbsp;&nbsp;:small_orange_diamond: <a href="https://github.com/djhworld/simple-computer"><b>simple-computer</b></a> - the scott CPU from "But How Do It Know?" by J. Clark Scott.<br>
  1311. &nbsp;&nbsp;:small_orange_diamond: <a href="https://littleosbook.github.io/"><b>littleosbook</b></a> - the little book about OS development.<br>
  1312. </p>
  1313. ###### DNS Servers list (privacy)
  1314. | <b><u>IP</u></b> | <b><u>URL</u></b> |
  1315. | :--- | :--- |
  1316. | **`84.200.69.80`** | [dns.watch](https://dns.watch/) |
  1317. | **`94.247.43.254`** | [opennic.org](https://www.opennic.org/) |
  1318. | **`64.6.64.6`** | [verisign.com](https://www.verisign.com/en_US/security-services/public-dns/index.xhtml) |
  1319. | **`89.233.43.71`** | [censurfridns.dk](https://blog.uncensoreddns.org/) |
  1320. | **`1.1.1.1`** | [cloudflare.com](https://1.1.1.1/) |
  1321. | **`94.130.110.185`** | [dnsprivacy.at](https://dnsprivacy.at/) |
  1322. ###### TOP Browser extensions
  1323. | <b><u>Extension name</u></b> | <b><u>Description</u></b> |
  1324. | :--- | :--- |
  1325. | **`IPvFoo`** | Display the server IP address and HTTPS information across all page elements. |
  1326. | **`FoxyProxy`** | Simplifies configuring browsers to access proxy-servers. |
  1327. | **`HTTPS Everywhere`** | Automatically use HTTPS security on many sites. |
  1328. | **`uMatrix`** | Point & click to forbid/allow any class of requests made by your browser. |
  1329. | **`uBlock Origin`** | An efficient blocker: easy on memory and CPU footprint. |
  1330. | **`Session Buddy`** | Manage browser tabs and bookmarks with ease. |
  1331. | **`SuperSorter`** | Sort bookmarks recursively, delete duplicates, merge folders, and more. |
  1332. | **`Clear Cache`** | Clear your cache and browsing data. |
  1333. | **`d3coder`** | Encoding/Decoding plugin for various types of encoding. |
  1334. | **`Web Developer`** | Adds a toolbar button with various web developer tools. |
  1335. | **`ThreatPinch Lookup`** | Add threat intelligence hover tool tips. |
  1336. ###### TOP Burp extensions
  1337. | <b><u>Extension name</u></b> | <b><u>Description</u></b> |
  1338. | :--- | :--- |
  1339. | **`Active Scan++`** | Extends Burp's active and passive scanning capabilities. |
  1340. | **`Autorize`** | Automatically detects authorization enforcement. |
  1341. | **`AuthMatrix`** | A simple matrix grid to define the desired levels of access privilege. |
  1342. | **`Logger++`** | Logs requests and responses for all Burp tools in a sortable table. |
  1343. | **`Bypass WAF`** | Adds headers useful for bypassing some WAF devices. |
  1344. | **`JSON Beautifier`** | Beautifies JSON content in the HTTP message viewer. |
  1345. | **`JSON Web Tokens`** | Enables Burp to decode and manipulate JSON web tokens. |
  1346. | **`CSP Auditor`** | Displays CSP headers for responses, and passively reports CSP weaknesses. |
  1347. | **`CSP-Bypass`** | Passively scans for CSP headers that contain known bypasses. |
  1348. | **`Hackvertor`** | Converts data using a tag-based configuration to apply various encoding. |
  1349. | **`HTML5 Auditor`** | Scans for usage of risky HTML5 features. |
  1350. | **`Software Vulnerability Scanner`** | Vulnerability scanner based on vulners.com audit API. |
  1351. | **`Turbo Intruder`** | Is a powerful bruteforcing tool. |
  1352. | **`Upload Scanner`** | Upload a number of different file types, laced with different forms of payload. |
  1353. ###### Hack Mozilla Firefox address bar
  1354. In Firefox's address bar, you can limit results by typing special characters before or after your term:
  1355. - `^` - for matches in your browsing history
  1356. - `*` - for matches in your bookmarks.
  1357. - `%` - for matches in your currently open tabs.
  1358. - `#` - for matches in page titles.
  1359. - `@` - for matches in web addresses.
  1360. ###### Chrome hidden commands
  1361. - `chrome://chrome-urls` - list of all commands
  1362. - `chrome://flags` - enable experiments and development features
  1363. - `chrome://interstitials` - errors and warnings
  1364. - `chrome://net-internals` - network internals (events, dns, cache)
  1365. - `chrome://network-errors` - network errors
  1366. - `chrome://net-export` - start logging future network activity to a file
  1367. - `chrome://safe-browsing` - safe browsing options
  1368. - `chrome://user-actions` - record all user actions
  1369. - `chrome://restart` - restart chrome
  1370. - `chrome://dino` - ERR_INTERNET_DISCONNECTED...
  1371. - `cache:<website-address>` - view the cached version of the web page
  1372. ###### Bypass WAFs by Shortening IP Address (by [0xInfection](https://twitter.com/0xInfection))
  1373. IP addresses can be shortened by dropping the zeroes:
  1374. ```
  1375. http://1.0.0.1 → http://1.1
  1376. http://127.0.0.1 → http://127.1
  1377. http://192.168.0.1 → http://192.168.1
  1378. http://0xC0A80001 or http://3232235521 → 192.168.0.1
  1379. http://192.168.257 → 192.168.1.1
  1380. http://192.168.516 → 192.168.2.4
  1381. ```
  1382. > This bypasses WAF filters for SSRF, open-redirect, etc where any IP as input gets blacklisted.
  1383. For more information please see [How to Obscure Any URL](http://www.pc-help.org/obscure.htm) and [Magic IP Address Shortcuts](https://stuff-things.net/2014/09/25/magic-ip-address-shortcuts/).
  1384. ###### Hashing, encryption and encoding (by [Michal Špaček](https://twitter.com/spazef0rze))
  1385. _Hashing_
  1386. plaintext :arrow_right: hash<br>
  1387. hash :no_entry: plaintext
  1388. _Symmetric encryption_
  1389. plaintext :arrow_right: :key: :arrow_right: ciphertext<br>
  1390. plaintext :arrow_left: :key: :arrow_left: ciphertext<br>
  1391. (:key: shared key)
  1392. _Asymmetric encryption_
  1393. plaintext :arrow_right: :key: :arrow_right: ciphertext<br>
  1394. plaintext :arrow_left: :part_alternation_mark: :arrow_left: ciphertext<br>
  1395. (:key: public key, :part_alternation_mark: private key)<br>
  1396. _Encoding_
  1397. text :arrow_right: encoded<br>
  1398. text :arrow_left: encoded
  1399. #### Shell One-liners &nbsp;[<sup>[TOC]</sup>](#anger-table-of-contents)
  1400. ##### Table of Contents
  1401. * [terminal](#tool-terminal)
  1402. * [busybox](#tool-busybox)
  1403. * [mount](#tool-mount)
  1404. * [fuser](#tool-fuser)
  1405. * [lsof](#tool-lsof)
  1406. * [ps](#tool-ps)
  1407. * [top](#tool-top)
  1408. * [vmstat](#tool-vmstat)
  1409. * [iostat](#tool-iostat)
  1410. * [strace](#tool-strace)
  1411. * [kill](#tool-kill)
  1412. * [find](#tool-find)
  1413. * [diff](#tool-diff)
  1414. * [vimdiff](#tool-vimdiff)
  1415. * [tail](#tool-tail)
  1416. * [cpulimit](#tool-cpulimit)
  1417. * [pwdx](#tool-pwdx)
  1418. * [tr](#tool-tr)
  1419. * [chmod](#tool-chmod)
  1420. * [who](#tool-who)
  1421. * [last](#tool-last)
  1422. * [screen](#tool-screen)
  1423. * [script](#tool-script)
  1424. * [du](#tool-du)
  1425. * [inotifywait](#tool-inotifywait)
  1426. * [openssl](#tool-openssl)
  1427. * [secure-delete](#tool-secure-delete)
  1428. * [dd](#tool-dd)
  1429. * [gpg](#tool-gpg)
  1430. * [system-other](#tool-system-other)
  1431. * [curl](#tool-curl)
  1432. * [httpie](#tool-httpie)
  1433. * [ssh](#tool-ssh)
  1434. * [linux-dev](#tool-linux-dev)
  1435. * [tcpdump](#tool-tcpdump)
  1436. * [tcpick](#tool-tcpick)
  1437. * [ngrep](#tool-ngrep)
  1438. * [hping3](#tool-hping3)
  1439. * [nmap](#tool-nmap)
  1440. * [netcat](#tool-netcat)
  1441. * [socat](#tool-socat)
  1442. * [p0f](#tool-p0f)
  1443. * [gnutls-cli](#tool-gnutls-cli)
  1444. * [netstat](#tool-netstat)
  1445. * [rsync](#tool-rsync)
  1446. * [host](#tool-host)
  1447. * [dig](#tool-dig)
  1448. * [certbot](#tool-certbot)
  1449. * [network-other](#tool-network-other)
  1450. * [git](#tool-git)
  1451. * [awk](#tool-awk)
  1452. * [sed](#tool-sed)
  1453. * [grep](#tool-grep)
  1454. * [perl](#tool-perl)
  1455. ##### Tool: [terminal](https://en.wikipedia.org/wiki/Linux_console)
  1456. ###### Reload shell without exit
  1457. ```bash
  1458. exec $SHELL -l
  1459. ```
  1460. ###### Close shell keeping all subprocess running
  1461. ```bash
  1462. disown -a && exit
  1463. ```
  1464. ###### Exit without saving shell history
  1465. ```bash
  1466. kill -9 $$
  1467. unset HISTFILE && exit
  1468. ```
  1469. ###### Perform a branching conditional
  1470. ```bash
  1471. true && echo success
  1472. false || echo failed
  1473. ```
  1474. ###### Pipe stdout and stderr to separate commands
  1475. ```bash
  1476. some_command > >(/bin/cmd_for_stdout) 2> >(/bin/cmd_for_stderr)
  1477. ```
  1478. ###### Redirect stdout and stderr each to separate files and print both to the screen
  1479. ```bash
  1480. (some_command 2>&1 1>&3 | tee errorlog ) 3>&1 1>&2 | tee stdoutlog
  1481. ```
  1482. ###### List of commands you use most often
  1483. ```bash
  1484. history | \
  1485. awk '{CMD[$2]++;count++;}END { for (a in CMD)print CMD[a] " " CMD[a]/count*100 "% " a;}' | \
  1486. grep -v "./" | \
  1487. column -c3 -s " " -t | \
  1488. sort -nr | nl | head -n 20
  1489. ```
  1490. ###### Sterilize bash history
  1491. ```bash
  1492. function sterile() {
  1493. history | awk '$2 != "history" { $1=""; print $0 }' | egrep -vi "\
  1494. curl\b+.*(-E|--cert)\b+.*\b*|\
  1495. curl\b+.*--pass\b+.*\b*|\
  1496. curl\b+.*(-U|--proxy-user).*:.*\b*|\
  1497. curl\b+.*(-u|--user).*:.*\b*
  1498. .*(-H|--header).*(token|auth.*)\b+.*|\
  1499. wget\b+.*--.*password\b+.*\b*|\
  1500. http.?://.+:.+@.*\
  1501. " > $HOME/histbuff; history -r $HOME/histbuff;
  1502. }
  1503. export PROMPT_COMMAND="sterile"
  1504. ```
  1505. > Look also: [A naive utility to censor credentials in command history](https://github.com/lbonanomi/go/blob/master/revisionist.go).
  1506. ###### Quickly backup a file
  1507. ```bash
  1508. cp filename{,.orig}
  1509. ```
  1510. ###### Empty a file (truncate to 0 size)
  1511. ```bash
  1512. >filename
  1513. ```
  1514. ###### Delete all files in a folder that don't match a certain file extension
  1515. ```bash
  1516. rm !(*.foo|*.bar|*.baz)
  1517. ```
  1518. ###### Pass multi-line string to a file
  1519. ```bash
  1520. # cat >filename ... - overwrite the file
  1521. # cat >>filename ... - append to a file
  1522. cat > filename << __EOF__
  1523. data data data
  1524. __EOF__
  1525. ```
  1526. ###### Edit a file on a remote host using vim
  1527. ```bash
  1528. vim scp://user@host//etc/fstab
  1529. ```
  1530. ###### Create a directory and change into it at the same time
  1531. ```bash
  1532. mkd() { mkdir -p "$@" && cd "$@"; }
  1533. ```
  1534. ###### Convert uppercase files to lowercase files
  1535. ```bash
  1536. rename 'y/A-Z/a-z/' *
  1537. ```
  1538. ###### Print a row of characters across the terminal
  1539. ```bash
  1540. printf "%`tput cols`s" | tr ' ' '#'
  1541. ```
  1542. ###### Show shell history without line numbers
  1543. ```bash
  1544. history | cut -c 8-
  1545. fc -l -n 1 | sed 's/^\s*//'
  1546. ```
  1547. ###### Run command(s) after exit session
  1548. ```bash
  1549. cat > /etc/profile << __EOF__
  1550. _after_logout() {
  1551. username=$(whoami)
  1552. for _pid in $(ps afx | grep sshd | grep "$username" | awk '{print $1}') ; do
  1553. kill -9 $_pid
  1554. done
  1555. }
  1556. trap _after_logout EXIT
  1557. __EOF__
  1558. ```
  1559. ###### Generate a sequence of numbers
  1560. ```bash
  1561. for ((i=1; i<=10; i+=2)) ; do echo $i ; done
  1562. # alternative: seq 1 2 10
  1563. for ((i=5; i<=10; ++i)) ; do printf '%02d\n' $i ; done
  1564. # alternative: seq -w 5 10
  1565. for i in {1..10} ; do echo $i ; done
  1566. ```
  1567. ###### Simple Bash filewatching
  1568. ```bash
  1569. unset MAIL; export MAILCHECK=1; export MAILPATH='$FILE_TO_WATCH?$MESSAGE'
  1570. ```
  1571. ---
  1572. ##### Tool: [busybox](https://www.busybox.net/)
  1573. ###### Static HTTP web server
  1574. ```bash
  1575. busybox httpd -p $PORT -h $HOME [-c httpd.conf]
  1576. ```
  1577. ___
  1578. ##### Tool: [mount](https://en.wikipedia.org/wiki/Mount_(Unix))
  1579. ###### Mount a temporary ram partition
  1580. ```bash
  1581. mount -t tmpfs tmpfs /mnt -o size=64M
  1582. ```
  1583. * `-t` - filesystem type
  1584. * `-o` - mount options
  1585. ###### Remount a filesystem as read/write
  1586. ```bash
  1587. mount -o remount,rw /
  1588. ```
  1589. ___
  1590. ##### Tool: [fuser](https://en.wikipedia.org/wiki/Fuser_(Unix))
  1591. ###### Show which processes use the files/directories
  1592. ```bash
  1593. fuser /var/log/daemon.log
  1594. fuser -v /home/supervisor
  1595. ```
  1596. ###### Kills a process that is locking a file
  1597. ```bash
  1598. fuser -ki filename
  1599. ```
  1600. * `-i` - interactive option
  1601. ###### Kills a process that is locking a file with specific signal
  1602. ```bash
  1603. fuser -k -HUP filename
  1604. ```
  1605. * `--list-signals` - list available signal names
  1606. ###### Show what PID is listening on specific port
  1607. ```bash
  1608. fuser -v 53/udp
  1609. ```
  1610. ###### Show all processes using the named filesystems or block device
  1611. ```bash
  1612. fuser -mv /var/www
  1613. ```
  1614. ___
  1615. ##### Tool: [lsof](https://en.wikipedia.org/wiki/Lsof)
  1616. ###### Show process that use internet connection at the moment
  1617. ```bash
  1618. lsof -P -i -n
  1619. ```
  1620. ###### Show process that use specific port number
  1621. ```bash
  1622. lsof -i tcp:443
  1623. ```
  1624. ###### Lists all listening ports together with the PID of the associated process
  1625. ```bash
  1626. lsof -Pan -i tcp -i udp
  1627. ```
  1628. ###### List all open ports and their owning executables
  1629. ```bash
  1630. lsof -i -P | grep -i "listen"
  1631. ```
  1632. ###### Show all open ports
  1633. ```bash
  1634. lsof -Pnl -i
  1635. ```
  1636. ###### Show open ports (LISTEN)
  1637. ```bash
  1638. lsof -Pni4 | grep LISTEN | column -t
  1639. ```
  1640. ###### List all files opened by a particular command
  1641. ```bash
  1642. lsof -c "process"
  1643. ```
  1644. ###### View user activity per directory
  1645. ```bash
  1646. lsof -u username -a +D /etc
  1647. ```
  1648. ###### Show 10 largest open files
  1649. ```bash
  1650. lsof / | \
  1651. awk '{ if($7 > 1048576) print $7/1048576 "MB" " " $9 " " $1 }' | \
  1652. sort -n -u | tail | column -t
  1653. ```
  1654. ###### Show current working directory of a process
  1655. ```bash
  1656. lsof -p <PID> | grep cwd
  1657. ```
  1658. ___
  1659. ##### Tool: [ps](https://en.wikipedia.org/wiki/Ps_(Unix))
  1660. ###### Show a 4-way scrollable process tree with full details
  1661. ```bash
  1662. ps awwfux | less -S
  1663. ```
  1664. ###### Processes per user counter
  1665. ```bash
  1666. ps hax -o user | sort | uniq -c | sort -r
  1667. ```
  1668. ###### Show all processes by name with main header
  1669. ```bash
  1670. ps -lfC nginx
  1671. ```
  1672. ___
  1673. ##### Tool: [find](https://en.wikipedia.org/wiki/Find_(Unix))
  1674. ###### Find files that have been modified on your system in the past 60 minutes
  1675. ```bash
  1676. find / -mmin 60 -type f
  1677. ```
  1678. ###### Find all files larger than 20M
  1679. ```bash
  1680. find / -type f -size +20M
  1681. ```
  1682. ###### Find duplicate files (based on MD5 hash)
  1683. ```bash
  1684. find -type f -exec md5sum '{}' ';' | sort | uniq --all-repeated=separate -w 33
  1685. ```
  1686. ###### Change permission only for files
  1687. ```bash
  1688. cd /var/www/site && find . -type f -exec chmod 766 {} \;
  1689. cd /var/www/site && find . -type f -exec chmod 664 {} +
  1690. ```
  1691. ###### Change permission only for directories
  1692. ```bash
  1693. cd /var/www/site && find . -type d -exec chmod g+x {} \;
  1694. cd /var/www/site && find . -type d -exec chmod g+rwx {} +
  1695. ```
  1696. ###### Find files and directories for specific user/group
  1697. ```bash
  1698. # User:
  1699. find . -user <username> -print
  1700. find /etc -type f -user <username> -name "*.conf"
  1701. # Group:
  1702. find /opt -group <group>
  1703. find /etc -type f -group <group> -iname "*.conf"
  1704. ```
  1705. ###### Find files and directories for all without specific user/group
  1706. ```bash
  1707. # User:
  1708. find . \! -user <username> -print
  1709. # Group:
  1710. find . \! -group <group>
  1711. ```
  1712. ###### Looking for files/directories that only have certain permission
  1713. ```bash
  1714. # User
  1715. find . -user <username> -perm -u+rw # -rw-r--r--
  1716. find /home -user $(whoami) -perm 777 # -rwxrwxrwx
  1717. # Group:
  1718. find /home -type d -group <group> -perm 755 # -rwxr-xr-x
  1719. ```
  1720. ###### Delete older files than 60 days
  1721. ```bash
  1722. find . -type f -mtime +60 -delete
  1723. ```
  1724. ###### Recursively remove all empty sub-directories from a directory
  1725. ```bash
  1726. find . -depth -type d -empty -exec rmdir {} \;
  1727. ```
  1728. ###### How to find all hard links to a file
  1729. ```bash
  1730. find </path/to/dir> -xdev -samefile filename
  1731. ```
  1732. ###### Recursively find the latest modified files
  1733. ```bash
  1734. find . -type f -exec stat --format '%Y :%y %n' "{}" \; | sort -nr | cut -d: -f2- | head
  1735. ```
  1736. ###### Recursively find/replace of a string with sed
  1737. ```bash
  1738. find . -not -path '*/\.git*' -type f -print0 | xargs -0 sed -i 's/foo/bar/g'
  1739. ```
  1740. ###### Recursively find/replace of a string in directories and file names
  1741. ```bash
  1742. find . -depth -name '*test*' -execdir bash -c 'mv -v "$1" "${1//foo/bar}"' _ {} \;
  1743. ```
  1744. ###### Recursively find suid executables
  1745. ```bash
  1746. find / \( -perm -4000 -o -perm -2000 \) -type f -exec ls -la {} \;
  1747. ```
  1748. ___
  1749. ##### Tool: [top](https://en.wikipedia.org/wiki/Top_(software))
  1750. ###### Use top to monitor only all processes with the specific string
  1751. ```bash
  1752. top -p $(pgrep -d , <str>)
  1753. ```
  1754. * `<str>` - process containing string (eg. nginx, worker)
  1755. ___
  1756. ##### Tool: [vmstat](https://en.wikipedia.org/wiki/Vmstat)
  1757. ###### Show current system utilization (fields in kilobytes)
  1758. ```bash
  1759. vmstat 2 20 -t -w
  1760. ```
  1761. * `2` - number of times with a defined time interval (delay)
  1762. * `20` - each execution of the command (count)
  1763. * `-t` - show timestamp
  1764. * `-w` - wide output
  1765. * `-S M` - output of the fields in megabytes instead of kilobytes
  1766. ###### Show current system utilization will get refreshed every 5 seconds
  1767. ```bash
  1768. vmstat 5 -w
  1769. ```
  1770. ###### Display report a summary of disk operations
  1771. ```bash
  1772. vmstat -D
  1773. ```
  1774. ###### Display report of event counters and memory stats
  1775. ```bash
  1776. vmstat -s
  1777. ```
  1778. ###### Display report about kernel objects stored in slab layer cache
  1779. ```bash
  1780. vmstat -m
  1781. ```
  1782. ##### Tool: [iostat](https://en.wikipedia.org/wiki/Iostat)
  1783. ###### Show information about the CPU usage, and I/O statistics about all the partitions
  1784. ```bash
  1785. iostat 2 10 -t -m
  1786. ```
  1787. * `2` - number of times with a defined time interval (delay)
  1788. * `10` - each execution of the command (count)
  1789. * `-t` - show timestamp
  1790. * `-m` - fields in megabytes (`-k` - in kilobytes, default)
  1791. ###### Show information only about the CPU utilization
  1792. ```bash
  1793. iostat 2 10 -t -m -c
  1794. ```
  1795. ###### Show information only about the disk utilization
  1796. ```bash
  1797. iostat 2 10 -t -m -d
  1798. ```
  1799. ###### Show information only about the LVM utilization
  1800. ```bash
  1801. iostat -N
  1802. ```
  1803. ___
  1804. ##### Tool: [strace](https://en.wikipedia.org/wiki/Strace)
  1805. ###### Track with child processes
  1806. ```bash
  1807. # 1)
  1808. strace -f -p $(pidof glusterfsd)
  1809. # 2)
  1810. strace -f $(pidof php-fpm | sed 's/\([0-9]*\)/\-p \1/g')
  1811. ```
  1812. ###### Track process with 30 seconds limit
  1813. ```bash
  1814. timeout 30 strace $(< /var/run/zabbix/zabbix_agentd.pid)
  1815. ```
  1816. ###### Track processes and redirect output to a file
  1817. ```bash
  1818. ps auxw | grep '[a]pache' | awk '{print " -p " $2}' | \
  1819. xargs strace -o /tmp/strace-apache-proc.out
  1820. ```
  1821. ###### Track with print time spent in each syscall and limit length of print strings
  1822. ```bash
  1823. ps auxw | grep '[i]init_policy' | awk '{print " -p " $2}' | \
  1824. xargs strace -f -e trace=network -T -s 10000
  1825. ```
  1826. ###### Track the open request of a network port
  1827. ```bash
  1828. strace -f -e trace=bind nc -l 80
  1829. ```
  1830. ###### Track the open request of a network port (show TCP/UDP)
  1831. ```bash
  1832. strace -f -e trace=network nc -lu 80
  1833. ```
  1834. ___
  1835. ##### Tool: [kill](https://en.wikipedia.org/wiki/Kill_(command))
  1836. ###### Kill a process running on port
  1837. ```bash
  1838. kill -9 $(lsof -i :<port> | awk '{l=$2} END {print l}')
  1839. ```
  1840. ___
  1841. ##### Tool: [diff](https://en.wikipedia.org/wiki/Diff)
  1842. ###### Compare two directory trees
  1843. ```bash
  1844. diff <(cd directory1 && find | sort) <(cd directory2 && find | sort)
  1845. ```
  1846. ###### Compare output of two commands
  1847. ```bash
  1848. diff <(cat /etc/passwd) <(cut -f2 /etc/passwd)
  1849. ```
  1850. ___
  1851. ##### Tool: [vimdiff](http://vimdoc.sourceforge.net/htmldoc/diff.html)
  1852. ###### Highlight the exact differences, based on characters and words
  1853. ```bash
  1854. vimdiff file1 file2
  1855. ```
  1856. ###### Compare two JSON files
  1857. ```bash
  1858. vimdiff <(jq -S . A.json) <(jq -S . B.json)
  1859. ```
  1860. ###### Compare Hex dump
  1861. ```bash
  1862. d(){ vimdiff <(f $1) <(f $2);};f(){ hexdump -C $1 | cut -d' ' -f3- | tr -s ' ';}; d ~/bin1 ~/bin2
  1863. ```
  1864. ###### diffchar
  1865. Save [diffchar](https://raw.githubusercontent.com/vim-scripts/diffchar.vim/master/plugin/diffchar.vim) @ `~/.vim/plugins`
  1866. Click `F7` to switch between diff modes
  1867. Usefull `vimdiff` commands:
  1868. * `qa` to exit all windows
  1869. * `:vertical resize 70` to resize window
  1870. * set window width `Ctrl+W [N columns]+(Shift+)<\>`
  1871. ___
  1872. ##### Tool: [tail](https://en.wikipedia.org/wiki/Tail_(Unix))
  1873. ###### Annotate tail -f with timestamps
  1874. ```bash
  1875. tail -f file | while read ; do echo "$(date +%T.%N) $REPLY" ; done
  1876. ```
  1877. ###### Analyse an Apache access log for the most common IP addresses
  1878. ```bash
  1879. tail -10000 access_log | awk '{print $1}' | sort | uniq -c | sort -n | tail
  1880. ```
  1881. ###### Analyse web server log and show only 5xx http codes
  1882. ```bash
  1883. tail -n 100 -f /path/to/logfile | grep "HTTP/[1-2].[0-1]\" [5]"
  1884. ```
  1885. ___
  1886. ##### Tool: [tar](https://en.wikipedia.org/wiki/Tar_(computing))
  1887. ###### System backup with exclude specific directories
  1888. ```bash
  1889. cd /
  1890. tar -czvpf /mnt/system$(date +%d%m%Y%s).tgz --directory=/ \
  1891. --exclude=proc/* --exclude=sys/* --exclude=dev/* --exclude=mnt/* .
  1892. ```
  1893. ###### System backup with exclude specific directories (pigz)
  1894. ```bash
  1895. cd /
  1896. tar cvpf /backup/snapshot-$(date +%d%m%Y%s).tgz --directory=/ \
  1897. --exclude=proc/* --exclude=sys/* --exclude=dev/* \
  1898. --exclude=mnt/* --exclude=tmp/* --use-compress-program=pigz .
  1899. ```
  1900. ___
  1901. ##### Tool: [dump](https://en.wikipedia.org/wiki/Dump_(program))
  1902. ###### System backup to file
  1903. ```bash
  1904. dump -y -u -f /backup/system$(date +%d%m%Y%s).lzo /
  1905. ```
  1906. ###### Restore system from lzo file
  1907. ```bash
  1908. cd /
  1909. restore -rf /backup/system$(date +%d%m%Y%s).lzo
  1910. ```
  1911. ___
  1912. ##### Tool: [cpulimit](http://cpulimit.sourceforge.net/)
  1913. ###### Limit the cpu usage of a process
  1914. ```bash
  1915. cpulimit -p pid -l 50
  1916. ```
  1917. ___
  1918. ##### Tool: [pwdx](https://www.cyberciti.biz/faq/unix-linux-pwdx-command-examples-usage-syntax/)
  1919. ###### Show current working directory of a process
  1920. ```bash
  1921. pwdx <pid>
  1922. ```
  1923. ___
  1924. ##### Tool: [taskset](https://www.cyberciti.biz/faq/taskset-cpu-affinity-command/)
  1925. ###### Start a command on only one CPU core
  1926. ```bash
  1927. taskset -c 0 <command>
  1928. ```
  1929. ___
  1930. ##### Tool: [tr](https://en.wikipedia.org/wiki/Tr_(Unix))
  1931. ###### Show directories in the PATH, one per line
  1932. ```bash
  1933. tr : '\n' <<<$PATH
  1934. ```
  1935. ___
  1936. ##### Tool: [chmod](https://en.wikipedia.org/wiki/Chmod)
  1937. ###### Remove executable bit from all files in the current directory
  1938. ```bash
  1939. chmod -R -x+X *
  1940. ```
  1941. ###### Restore permission for /bin/chmod
  1942. ```bash
  1943. # 1:
  1944. cp /bin/ls chmod.01
  1945. cp /bin/chmod chmod.01
  1946. ./chmod.01 700 file
  1947. # 2:
  1948. /bin/busybox chmod 0700 /bin/chmod
  1949. # 3:
  1950. setfacl --set u::rwx,g::---,o::--- /bin/chmod
  1951. ```
  1952. ___
  1953. ##### Tool: [who](https://en.wikipedia.org/wiki/Who_(Unix))
  1954. ###### Find last reboot time
  1955. ```bash
  1956. who -b
  1957. ```
  1958. ###### Detect a user sudo-su'd into the current shell
  1959. ```bash
  1960. [[ $(who -m | awk '{ print $1 }') == $(whoami) ]] || echo "You are su-ed to $(whoami)"
  1961. ```
  1962. ___
  1963. ##### Tool: [last](https://www.howtoforge.com/linux-last-command/)
  1964. ###### Was the last reboot a panic?
  1965. ```bash
  1966. (last -x -f $(ls -1t /var/log/wtmp* | head -2 | tail -1); last -x -f /var/log/wtmp) | \
  1967. grep -A1 reboot | head -2 | grep -q shutdown && echo "Expected reboot" || echo "Panic reboot"
  1968. ```
  1969. ___
  1970. ##### Tool: [screen](https://en.wikipedia.org/wiki/GNU_Screen)
  1971. ###### Start screen in detached mode
  1972. ```bash
  1973. screen -d -m <command>
  1974. ```
  1975. ###### Attach to an existing screen session
  1976. ```bash
  1977. screen -r -d <pid>
  1978. ```
  1979. ___
  1980. ##### Tool: [script](https://en.wikipedia.org/wiki/Script_(Unix))
  1981. ###### Record and replay terminal session
  1982. ```bash
  1983. ### Record session
  1984. # 1)
  1985. script -t 2>~/session.time -a ~/session.log
  1986. # 2)
  1987. script --timing=session.time session.log
  1988. ### Replay session
  1989. scriptreplay --timing=session.time session.log
  1990. ```
  1991. ___
  1992. ##### Tool: [du](https://en.wikipedia.org/wiki/GNU_Screen)
  1993. ###### Show 20 biggest directories with 'K M G'
  1994. ```bash
  1995. du | \
  1996. sort -r -n | \
  1997. awk '{split("K M G",v); s=1; while($1>1024){$1/=1024; s++} print int($1)" "v[s]"\t"$2}' | \
  1998. head -n 20
  1999. ```
  2000. ___
  2001. ##### Tool: [inotifywait](https://en.wikipedia.org/wiki/GNU_Screen)
  2002. ###### Init tool everytime a file in a directory is modified
  2003. ```bash
  2004. while true ; do inotifywait -r -e MODIFY dir/ && ls dir/ ; done;
  2005. ```
  2006. ___
  2007. ##### Tool: [openssl](https://www.openssl.org/)
  2008. ###### Testing connection to the remote host
  2009. ```bash
  2010. echo | openssl s_client -connect google.com:443 -showcerts
  2011. ```
  2012. ###### Testing connection to the remote host (debug mode)
  2013. ```bash
  2014. echo | openssl s_client -connect google.com:443 -showcerts -tlsextdebug -status
  2015. ```
  2016. ###### Testing connection to the remote host (with SNI support)
  2017. ```bash
  2018. echo | openssl s_client -showcerts -servername google.com -connect google.com:443
  2019. ```
  2020. ###### Testing connection to the remote host with specific ssl version
  2021. ```bash
  2022. openssl s_client -tls1_2 -connect google.com:443
  2023. ```
  2024. ###### Testing connection to the remote host with specific ssl cipher
  2025. ```bash
  2026. openssl s_client -cipher 'AES128-SHA' -connect google.com:443
  2027. ```
  2028. ###### Verify 0-RTT
  2029. ```bash
  2030. _host="example.com"
  2031. cat > req.in << __EOF__
  2032. HEAD / HTTP/1.1
  2033. Host: $_host
  2034. Connection: close
  2035. __EOF__
  2036. openssl s_client -connect ${_host}:443 -tls1_3 -sess_out session.pem -ign_eof < req.in
  2037. openssl s_client -connect ${_host}:443 -tls1_3 -sess_in session.pem -early_data req.in
  2038. ```
  2039. ###### Generate private key without passphrase
  2040. ```bash
  2041. # _len: 2048, 4096
  2042. ( _fd="private.key" ; _len="2048" ; \
  2043. openssl genrsa -out ${_fd} ${_len} )
  2044. ```
  2045. ###### Generate private key with passphrase
  2046. ```bash
  2047. # _ciph: aes128, aes256
  2048. # _len: 2048, 4096
  2049. ( _ciph="aes128" ; _fd="private.key" ; _len="2048" ; \
  2050. openssl genrsa -${_ciph} -out ${_fd} ${_len} )
  2051. ```
  2052. ###### Remove passphrase from private key
  2053. ```bash
  2054. ( _fd="private.key" ; _fd_unp="private_unp.key" ; \
  2055. openssl rsa -in ${_fd} -out ${_fd_unp} )
  2056. ```
  2057. ###### Encrypt existing private key with a passphrase
  2058. ```bash
  2059. # _ciph: aes128, aes256
  2060. ( _ciph="aes128" ; _fd="private.key" ; _fd_pass="private_pass.key" ; \
  2061. openssl rsa -${_ciph} -in ${_fd} -out ${_fd_pass}
  2062. ```
  2063. ###### Check private key
  2064. ```bash
  2065. ( _fd="private.key" ; \
  2066. openssl rsa -check -in ${_fd} )
  2067. ```
  2068. ###### Get public key from private key
  2069. ```bash
  2070. ( _fd="private.key" ; _fd_pub="public.key" ; \
  2071. openssl rsa -pubout -in ${_fd} -out ${_fd_pub} )
  2072. ```
  2073. ###### Generate private key and CSR
  2074. ```bash
  2075. ( _fd="private.key" ; _fd_csr="request.csr" ; _len="2048" ; \
  2076. openssl req -out ${_fd_csr} -new -newkey rsa:${_len} -nodes -keyout ${_fd} )
  2077. ```
  2078. ###### Generate CSR
  2079. ```bash
  2080. ( _fd="private.key" ; _fd_csr="request.csr" ; \
  2081. openssl req -out ${_fd_csr} -new -key ${_fd} )
  2082. ```
  2083. ###### Generate CSR (metadata from existing certificate)
  2084. > Where `private.key` is the existing private key. As you can see you do not generate this CSR from your certificate (public key). Also you do not generate the "same" CSR, just a new one to request a new certificate.
  2085. ```bash
  2086. ( _fd="private.key" ; _fd_csr="request.csr" ; _fd_crt="cert.crt" ; \
  2087. openssl x509 -x509toreq -in ${_fd_crt} -out ${_fd_csr} -signkey ${_fd} )
  2088. ```
  2089. ###### Generate CSR with -config param
  2090. ```bash
  2091. ( _fd="private.key" ; _fd_csr="request.csr" ; \
  2092. openssl req -new -sha256 -key ${_fd} -out ${_fd_csr} \
  2093. -config <(
  2094. cat << __EOF__
  2095. [req]
  2096. default_bits = 2048
  2097. default_md = sha256
  2098. prompt = no
  2099. distinguished_name = dn
  2100. req_extensions = req_ext
  2101. [ dn ]
  2102. C = "<two-letter ISO abbreviation for your country>"
  2103. ST = "<state or province where your organisation is legally located>"
  2104. L = "<city where your organisation is legally located>"
  2105. O = "<legal name of your organisation>"
  2106. OU = "<section of the organisation>"
  2107. CN = "<fully qualified domain name>"
  2108. [ req_ext ]
  2109. subjectAltName = @alt_names
  2110. [ alt_names ]
  2111. DNS.1 = <fully qualified domain name>
  2112. DNS.2 = <next domain>
  2113. DNS.3 = <next domain>
  2114. __EOF__
  2115. ))
  2116. ```
  2117. Other values in `[ dn ]`:
  2118. ```
  2119. countryName = "DE" # C=
  2120. stateOrProvinceName = "Hessen" # ST=
  2121. localityName = "Keller" # L=
  2122. postalCode = "424242" # L/postalcode=
  2123. postalAddress = "Keller" # L/postaladdress=
  2124. streetAddress = "Crater 1621" # L/street=
  2125. organizationName = "apfelboymschule" # O=
  2126. organizationalUnitName = "IT Department" # OU=
  2127. commonName = "example.com" # CN=
  2128. emailAddress = "webmaster@example.com" # CN/emailAddress=
  2129. ```
  2130. Example of `oids` (you'll probably also have to make OpenSSL know about the new fields required for EV by adding the following under `[new_oids]`):
  2131. ```
  2132. [req]
  2133. ...
  2134. oid_section = new_oids
  2135. [ new_oids ]
  2136. postalCode = 2.5.4.17
  2137. streetAddress = 2.5.4.9
  2138. ```
  2139. Full example:
  2140. ```bash
  2141. ( _fd="private.key" ; _fd_csr="request.csr" ; \
  2142. openssl req -new -sha256 -key ${_fd} -out ${_fd_csr} \
  2143. -config <(
  2144. cat << __EOF__
  2145. [req]
  2146. default_bits = 2048
  2147. default_md = sha256
  2148. prompt = no
  2149. distinguished_name = dn
  2150. req_extensions = req_ext
  2151. oid_section = new_oids
  2152. [ new_oids ]
  2153. serialNumber = 2.5.4.5
  2154. streetAddress = 2.5.4.9
  2155. postalCode = 2.5.4.17
  2156. businessCategory = 2.5.4.15
  2157. [ dn ]
  2158. serialNumber=00001111
  2159. businessCategory=Private Organization
  2160. jurisdictionC=DE
  2161. C=DE
  2162. ST=Hessen
  2163. L=Keller
  2164. postalCode=424242
  2165. streetAddress=Crater 1621
  2166. O=AV Company
  2167. OU=IT
  2168. CN=example.com
  2169. [ req_ext ]
  2170. subjectAltName = @alt_names
  2171. [ alt_names ]
  2172. DNS.1 = example.com
  2173. __EOF__
  2174. ))
  2175. ```
  2176. For more information please look at these great explanations:
  2177. - [RFC 5280](https://tools.ietf.org/html/rfc5280)
  2178. - [How to create multidomain certificates using config files](https://apfelboymchen.net/gnu/notes/openssl%20multidomain%20with%20config%20files.html)
  2179. - [Generate a multi domains certificate using config files](https://gist.github.com/romainnorberg/464758a6620228b977212a3cf20c3e08)
  2180. - [Your OpenSSL CSR command is out of date](https://expeditedsecurity.com/blog/openssl-csr-command/)
  2181. - [OpenSSL example configuration file](https://www.tbs-certificats.com/openssl-dem-server-cert.cnf)
  2182. - [Object Identifiers (OIDs)](https://www.alvestrand.no/objectid/)
  2183. - [openssl objects.txt](https://github.com/openssl/openssl/blob/master/crypto/objects/objects.txt)
  2184. ###### List available EC curves
  2185. ```bash
  2186. openssl ecparam -list_curves
  2187. ```
  2188. ###### Print ECDSA private and public keys
  2189. ```bash
  2190. ( _fd="private.key" ; \
  2191. openssl ec -in ${_fd} -noout -text )
  2192. # For x25519 only extracting public key
  2193. ( _fd="private.key" ; _fd_pub="public.key" ; \
  2194. openssl pkey -in ${_fd} -pubout -out ${_fd_pub} )
  2195. ```
  2196. ###### Generate ECDSA private key
  2197. ```bash
  2198. # _curve: prime256v1, secp521r1, secp384r1
  2199. ( _fd="private.key" ; _curve="prime256v1" ; \
  2200. openssl ecparam -out ${_fd} -name ${_curve} -genkey )
  2201. # _curve: X25519
  2202. ( _fd="private.key" ; _curve="x25519" ; \
  2203. openssl genpkey -algorithm ${_curve} -out ${_fd} )
  2204. ```
  2205. ###### Generate private key and CSR (ECC)
  2206. ```bash
  2207. # _curve: prime256v1, secp521r1, secp384r1
  2208. ( _fd="domain.com.key" ; _fd_csr="domain.com.csr" ; _curve="prime256v1" ; \
  2209. openssl ecparam -out ${_fd} -name ${_curve} -genkey ; \
  2210. openssl req -new -key ${_fd} -out ${_fd_csr} -sha256 )
  2211. ```
  2212. ###### Generate self-signed certificate
  2213. ```bash
  2214. # _len: 2048, 4096
  2215. ( _fd="domain.key" ; _fd_out="domain.crt" ; _len="2048" ; _days="365" ; \
  2216. openssl req -newkey rsa:${_len} -nodes \
  2217. -keyout ${_fd} -x509 -days ${_days} -out ${_fd_out} )
  2218. ```
  2219. ###### Generate self-signed certificate from existing private key
  2220. ```bash
  2221. # _len: 2048, 4096
  2222. ( _fd="domain.key" ; _fd_out="domain.crt" ; _days="365" ; \
  2223. openssl req -key ${_fd} -nodes \
  2224. -x509 -days ${_days} -out ${_fd_out} )
  2225. ```
  2226. ###### Generate self-signed certificate from existing private key and csr
  2227. ```bash
  2228. # _len: 2048, 4096
  2229. ( _fd="domain.key" ; _fd_csr="domain.csr" ; _fd_out="domain.crt" ; _days="365" ; \
  2230. openssl x509 -signkey ${_fd} -nodes \
  2231. -in ${_fd_csr} -req -days ${_days} -out ${_fd_out} )
  2232. ```
  2233. ###### Generate DH public parameters
  2234. ```bash
  2235. ( _dh_size="2048" ; \
  2236. openssl dhparam -out /etc/nginx/ssl/dhparam_${_dh_size}.pem "$_dh_size" )
  2237. ```
  2238. ###### Display DH public parameters
  2239. ```bash
  2240. openssl pkeyparam -in dhparam.pem -text
  2241. ```
  2242. ###### Extract private key from pfx
  2243. ```bash
  2244. ( _fd_pfx="cert.pfx" ; _fd_key="key.pem" ; \
  2245. openssl pkcs12 -in ${_fd_pfx} -nocerts -nodes -out ${_fd_key} )
  2246. ```
  2247. ###### Extract private key and certs from pfx
  2248. ```bash
  2249. ( _fd_pfx="cert.pfx" ; _fd_pem="key_certs.pem" ; \
  2250. openssl pkcs12 -in ${_fd_pfx} -nodes -out ${_fd_pem} )
  2251. ```
  2252. ###### Extract certs from p7b
  2253. ```bash
  2254. # PKCS#7 file doesn't include private keys.
  2255. ( _fd_p7b="cert.p7b" ; _fd_pem="cert.pem" ; \
  2256. openssl pkcs7 -inform DER -outform PEM -in ${_fd_p7b} -print_certs > ${_fd_pem})
  2257. # or:
  2258. openssl pkcs7 -print_certs -in -in ${_fd_p7b} -out ${_fd_pem})
  2259. ```
  2260. ###### Convert DER to PEM
  2261. ```bash
  2262. ( _fd_der="cert.crt" ; _fd_pem="cert.pem" ; \
  2263. openssl x509 -in ${_fd_der} -inform der -outform pem -out ${_fd_pem} )
  2264. ```
  2265. ###### Convert PEM to DER
  2266. ```bash
  2267. ( _fd_der="cert.crt" ; _fd_pem="cert.pem" ; \
  2268. openssl x509 -in ${_fd_pem} -outform der -out ${_fd_der} )
  2269. ```
  2270. ###### Verification of the private key
  2271. ```bash
  2272. ( _fd="private.key" ; \
  2273. openssl rsa -noout -text -in ${_fd} )
  2274. ```
  2275. ###### Verification of the public key
  2276. ```bash
  2277. # 1)
  2278. ( _fd="public.key" ; \
  2279. openssl pkey -noout -text -pubin -in ${_fd} )
  2280. # 2)
  2281. ( _fd="private.key" ; \
  2282. openssl rsa -inform PEM -noout -in ${_fd} &> /dev/null ; \
  2283. if [ $? = 0 ] ; then echo -en "OK\n" ; fi )
  2284. ```
  2285. ###### Verification of the certificate
  2286. ```bash
  2287. ( _fd="certificate.crt" ; # format: pem, cer, crt \
  2288. openssl x509 -noout -text -in ${_fd} )
  2289. ```
  2290. ###### Verification of the CSR
  2291. ```bash
  2292. ( _fd_csr="request.csr" ; \
  2293. openssl req -text -noout -in ${_fd_csr} )
  2294. ```
  2295. ###### Check the private key and the certificate are match
  2296. ```bash
  2297. (openssl rsa -noout -modulus -in private.key | openssl md5 ; \
  2298. openssl x509 -noout -modulus -in certificate.crt | openssl md5) | uniq
  2299. ```
  2300. ###### Check the private key and the CSR are match
  2301. ```bash
  2302. (openssl rsa -noout -modulus -in private.key | openssl md5 ; \
  2303. openssl req -noout -modulus -in request.csr | openssl md5) | uniq
  2304. ```
  2305. ___
  2306. ##### Tool: [secure-delete](https://wiki.archlinux.org/index.php/Securely_wipe_disk)
  2307. ###### Secure delete with shred
  2308. ```bash
  2309. shred -vfuz -n 10 file
  2310. shred --verbose --random-source=/dev/urandom -n 1 /dev/sda
  2311. ```
  2312. ###### Secure delete with scrub
  2313. ```bash
  2314. scrub -p dod /dev/sda
  2315. scrub -p dod -r file
  2316. ```
  2317. ###### Secure delete with badblocks
  2318. ```bash
  2319. badblocks -s -w -t random -v /dev/sda
  2320. badblocks -c 10240 -s -w -t random -v /dev/sda
  2321. ```
  2322. ###### Secure delete with secure-delete
  2323. ```bash
  2324. srm -vz /tmp/file
  2325. sfill -vz /local
  2326. sdmem -v
  2327. swapoff /dev/sda5 && sswap -vz /dev/sda5
  2328. ```
  2329. ___
  2330. ##### Tool: [dd](https://en.wikipedia.org/wiki/Dd_(Unix))
  2331. ###### Show dd status every so often
  2332. ```bash
  2333. dd <dd_params> status=progress
  2334. watch --interval 5 killall -USR1 dd
  2335. ```
  2336. ###### Redirect output to a file with dd
  2337. ```bash
  2338. echo "string" | dd of=filename
  2339. ```
  2340. ___
  2341. ##### Tool: [gpg](https://www.gnupg.org/)
  2342. ###### Export public key
  2343. ```bash
  2344. gpg --export --armor "<username>" > username.pkey
  2345. ```
  2346. * `--export` - export all keys from all keyrings or specific key
  2347. * `-a|--armor` - create ASCII armored output
  2348. ###### Encrypt file
  2349. ```bash
  2350. gpg -e -r "<username>" dump.sql
  2351. ```
  2352. * `-e|--encrypt` - encrypt data
  2353. * `-r|--recipient` - encrypt for specific <username>
  2354. ###### Decrypt file
  2355. ```bash
  2356. gpg -o dump.sql -d dump.sql.gpg
  2357. ```
  2358. * `-o|--output` - use as output file
  2359. * `-d|--decrypt` - decrypt data (default)
  2360. ###### Search recipient
  2361. ```bash
  2362. gpg --keyserver hkp://keyserver.ubuntu.com --search-keys "<username>"
  2363. ```
  2364. * `--keyserver` - set specific key server
  2365. * `--search-keys` - search for keys on a key server
  2366. ###### List all of the packets in an encrypted file
  2367. ```bash
  2368. gpg --batch --list-packets archive.gpg
  2369. gpg2 --batch --list-packets archive.gpg
  2370. ```
  2371. ___
  2372. ##### Tool: [system-other](https://github.com/trimstray/the-book-of-secret-knowledge#tool-system-other)
  2373. ###### Reboot system from init
  2374. ```bash
  2375. exec /sbin/init 6
  2376. ```
  2377. ###### Init system from single user mode
  2378. ```bash
  2379. exec /sbin/init
  2380. ```
  2381. ###### Show current working directory of a process
  2382. ```bash
  2383. readlink -f /proc/<PID>/cwd
  2384. ```
  2385. ###### Show actual pathname of the executed command
  2386. ```bash
  2387. readlink -f /proc/<PID>/exe
  2388. ```
  2389. ##### Tool: [curl](https://curl.haxx.se)
  2390. ```bash
  2391. curl -Iks https://www.google.com
  2392. ```
  2393. * `-I` - show response headers only
  2394. * `-k` - insecure connection when using ssl
  2395. * `-s` - silent mode (not display body)
  2396. ```bash
  2397. curl -Iks --location -X GET -A "x-agent" https://www.google.com
  2398. ```
  2399. * `--location` - follow redirects
  2400. * `-X` - set method
  2401. * `-A` - set user-agent
  2402. ```bash
  2403. curl -Iks --location -X GET -A "x-agent" --proxy http://127.0.0.1:16379 https://www.google.com
  2404. ```
  2405. * `--proxy [socks5://|http://]` - set proxy server
  2406. ```bash
  2407. curl -o file.pdf -C - https://example.com/Aiju2goo0Ja2.pdf
  2408. ```
  2409. * `-o` - write output to file
  2410. * `-C` - resume the transfer
  2411. ###### Find your external IP address (external services)
  2412. ```bash
  2413. curl ipinfo.io
  2414. curl ipinfo.io/ip
  2415. curl icanhazip.com
  2416. curl ifconfig.me/ip ; echo
  2417. ```
  2418. ###### Repeat URL request
  2419. ```bash
  2420. # URL sequence substitution with a dummy query string:
  2421. curl -ks https://example.com/?[1-20]
  2422. # With shell 'for' loop:
  2423. for i in {1..20} ; do curl -ks https://example.com/ ; done
  2424. ```
  2425. ###### Check DNS and HTTP trace with headers for specific domains
  2426. ```bash
  2427. ### Set domains and external dns servers.
  2428. _domain_list=(google.com) ; _dns_list=("8.8.8.8" "1.1.1.1")
  2429. for _domain in "${_domain_list[@]}" ; do
  2430. printf '=%.0s' {1..48}
  2431. echo
  2432. printf "[\\e[1;32m+\\e[m] resolve: %s\\n" "$_domain"
  2433. for _dns in "${_dns_list[@]}" ; do
  2434. # Resolve domain.
  2435. host "${_domain}" "${_dns}"
  2436. echo
  2437. done
  2438. for _proto in http https ; do
  2439. printf "[\\e[1;32m+\\e[m] trace + headers: %s://%s\\n" "$_proto" "$_domain"
  2440. # Get trace and http headers.
  2441. curl -Iks -A "x-agent" --location "${_proto}://${_domain}"
  2442. echo
  2443. done
  2444. done
  2445. unset _domain_list _dns_list
  2446. ```
  2447. ___
  2448. ##### Tool: [httpie](https://httpie.org/)
  2449. ```bash
  2450. http -p Hh https://www.google.com
  2451. ```
  2452. * `-p` - print request and response headers
  2453. * `H` - request headers
  2454. * `B` - request body
  2455. * `h` - response headers
  2456. * `b` - response body
  2457. ```bash
  2458. http -p Hh https://www.google.com --follow --verify no
  2459. ```
  2460. * `-F, --follow` - follow redirects
  2461. * `--verify no` - skip SSL verification
  2462. ```bash
  2463. http -p Hh https://www.google.com --follow --verify no \
  2464. --proxy http:http://127.0.0.1:16379
  2465. ```
  2466. * `--proxy [http:]` - set proxy server
  2467. ##### Tool: [ssh](https://www.openssh.com/)
  2468. ###### Escape Sequence
  2469. ```
  2470. # Supported escape sequences:
  2471. ~. - terminate connection (and any multiplexed sessions)
  2472. ~B - send a BREAK to the remote system
  2473. ~C - open a command line
  2474. ~R - Request rekey (SSH protocol 2 only)
  2475. ~^Z - suspend ssh
  2476. ~# - list forwarded connections
  2477. ~& - background ssh (when waiting for connections to terminate)
  2478. ~? - this message
  2479. ~~ - send the escape character by typing it twice
  2480. ```
  2481. ###### Compare a remote file with a local file
  2482. ```bash
  2483. ssh user@host cat /path/to/remotefile | diff /path/to/localfile -
  2484. ```
  2485. ###### SSH connection through host in the middle
  2486. ```bash
  2487. ssh -t reachable_host ssh unreachable_host
  2488. ```
  2489. ###### Run command over SSH on remote host
  2490. ```bash
  2491. cat > cmd.txt << __EOF__
  2492. cat /etc/hosts
  2493. __EOF__
  2494. ssh host -l user $(<cmd.txt)
  2495. ```
  2496. ###### Get public key from private key
  2497. ```bash
  2498. ssh-keygen -y -f ~/.ssh/id_rsa
  2499. ```
  2500. ###### Get all fingerprints
  2501. ```bash
  2502. ssh-keygen -l -f .ssh/known_hosts
  2503. ```
  2504. ###### SSH authentication with user password
  2505. ```bash
  2506. ssh -o PreferredAuthentications=password -o PubkeyAuthentication=no user@remote_host
  2507. ```
  2508. ###### SSH authentication with publickey
  2509. ```bash
  2510. ssh -o PreferredAuthentications=publickey -o PubkeyAuthentication=yes -i id_rsa user@remote_host
  2511. ```
  2512. ###### Simple recording SSH session
  2513. ```bash
  2514. function _ssh_sesslog() {
  2515. _sesdir="<path/to/session/logs>"
  2516. mkdir -p "${_sesdir}" && \
  2517. ssh $@ 2>&1 | tee -a "${_sesdir}/$(date +%Y%m%d).log"
  2518. }
  2519. # Alias:
  2520. alias ssh='_ssh_sesslog'
  2521. ```
  2522. ###### Using Keychain for SSH logins
  2523. ```bash
  2524. ### Delete all of ssh-agent's keys.
  2525. function _scl() {
  2526. /usr/bin/keychain --clear
  2527. }
  2528. ### Add key to keychain.
  2529. function _scg() {
  2530. /usr/bin/keychain /path/to/private-key
  2531. source "$HOME/.keychain/$HOSTNAME-sh"
  2532. }
  2533. ```
  2534. ###### SSH login without processing any login scripts
  2535. ```bash
  2536. ssh -tt user@host bash
  2537. ```
  2538. ###### SSH local port forwarding
  2539. Example 1:
  2540. ```bash
  2541. # Forwarding our local 2250 port to nmap.org:443 from localhost through localhost
  2542. host1> ssh -L 2250:nmap.org:443 localhost
  2543. # Connect to the service:
  2544. host1> curl -Iks --location -X GET https://localhost:2250
  2545. ```
  2546. Example 2:
  2547. ```bash
  2548. # Forwarding our local 9051 port to db.d.x:5432 from localhost through node.d.y
  2549. host1> ssh -nNT -L 9051:db.d.x:5432 node.d.y
  2550. # Connect to the service:
  2551. host1> psql -U db_user -d db_dev -p 9051 -h localhost
  2552. ```
  2553. * `-n` - redirects stdin from `/dev/null`
  2554. * `-N` - do not execute a remote command
  2555. * `-T` - disable pseudo-terminal allocation
  2556. ###### SSH remote port forwarding
  2557. ```bash
  2558. # Forwarding our local 9051 port to db.d.x:5432 from host2 through node.d.y
  2559. host1> ssh -nNT -R 9051:db.d.x:5432 node.d.y
  2560. # Connect to the service:
  2561. host2> psql -U postgres -d postgres -p 8000 -h localhost
  2562. ```
  2563. ___
  2564. ##### Tool: [linux-dev](https://www.tldp.org/LDP/abs/html/devref1.html)
  2565. ###### Testing remote connection to port
  2566. ```bash
  2567. timeout 1 bash -c "</dev/<proto>/<host>/<port>" >/dev/null 2>&1 ; echo $?
  2568. ```
  2569. * `<proto` - set protocol (tcp/udp)
  2570. * `<host>` - set remote host
  2571. * `<port>` - set destination port
  2572. ###### Read and write to TCP or UDP sockets with common bash tools
  2573. ```bash
  2574. exec 5<>/dev/tcp/<host>/<port>; cat <&5 & cat >&5; exec 5>&-
  2575. ```
  2576. ___
  2577. ##### Tool: [tcpdump](http://www.tcpdump.org/)
  2578. ###### Filter incoming (on interface) traffic (specific <ip:port>)
  2579. ```bash
  2580. tcpdump -ne -i eth0 -Q in host 192.168.252.1 and port 443
  2581. ```
  2582. * `-n` - don't convert addresses (`-nn` will not resolve hostnames or ports)
  2583. * `-e` - print the link-level headers
  2584. * `-i [iface|any]` - set interface
  2585. * `-Q|-D [in|out|inout]` - choose send/receive direction (`-D` - for old tcpdump versions)
  2586. * `host [ip|hostname]` - set host, also `[host not]`
  2587. * `[and|or]` - set logic
  2588. * `port [1-65535]` - set port number, also `[port not]`
  2589. ###### Filter incoming (on interface) traffic (specific <ip:port>) and write to a file
  2590. ```bash
  2591. tcpdump -ne -i eth0 -Q in host 192.168.252.1 and port 443 -c 5 -w tcpdump.pcap
  2592. ```
  2593. * `-c [num]` - capture only num number of packets
  2594. * `-w [filename]` - write packets to file, `-r [filename]` - reading from file
  2595. ###### Capture all ICMP packets
  2596. ```bash
  2597. tcpdump -nei eth0 icmp
  2598. ```
  2599. ###### Check protocol used (TCP or UDP) for service
  2600. ```bash
  2601. tcpdump -nei eth0 tcp port 22 -vv -X | egrep "TCP|UDP"
  2602. ```
  2603. ###### Display ASCII text (to parse the output using grep or other)
  2604. ```bash
  2605. tcpdump -i eth0 -A -s0 port 443
  2606. ```
  2607. ###### Grab everything between two keywords
  2608. ```bash
  2609. tcpdump -i eth0 port 80 -X | sed -n -e '/username/,/=ldap/ p'
  2610. ```
  2611. ###### Grab user and pass ever plain http
  2612. ```bash
  2613. tcpdump -i eth0 port http -l -A | egrep -i \
  2614. 'pass=|pwd=|log=|login=|user=|username=|pw=|passw=|passwd=|password=|pass:|user:|username:|password:|login:|pass |user ' \
  2615. --color=auto --line-buffered -B20
  2616. ```
  2617. ###### Extract HTTP User Agent from HTTP request header
  2618. ```bash
  2619. tcpdump -ei eth0 -nn -A -s1500 -l | grep "User-Agent:"
  2620. ```
  2621. ###### Capture only HTTP GET and POST packets
  2622. ```bash
  2623. tcpdump -ei eth0 -s 0 -A -vv \
  2624. 'tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420' or 'tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x504f5354'
  2625. ```
  2626. or simply:
  2627. ```bash
  2628. tcpdump -ei eth0 -s 0 -v -n -l | egrep -i "POST /|GET /|Host:"
  2629. ```
  2630. ###### Rotate capture files
  2631. ```bash
  2632. tcpdump -ei eth0 -w /tmp/capture-%H.pcap -G 3600 -C 200
  2633. ```
  2634. * `-G <num>` - pcap will be created every `<num>` seconds
  2635. * `-C <size>` - close the current pcap and open a new one if is larger than `<size>`
  2636. ###### Top hosts by packets
  2637. ```bash
  2638. tcpdump -ei enp0s25 -nnn -t -c 200 | cut -f 1,2,3,4 -d '.' | sort | uniq -c | sort -nr | head -n 20
  2639. ```
  2640. ###### Excludes any RFC 1918 private address
  2641. ```bash
  2642. tcpdump -nei eth0 'not (src net (10 or 172.16/12 or 192.168/16) and dst net (10 or 172.16/12 or 192.168/16))'
  2643. ```
  2644. ___
  2645. ##### Tool: [tcpick](http://tcpick.sourceforge.net/)
  2646. ###### Analyse packets in real-time
  2647. ```bash
  2648. while true ; do tcpick -a -C -r dump.pcap ; sleep 2 ; clear ; done
  2649. ```
  2650. ___
  2651. ##### Tool: [ngrep](http://ngrep.sourceforge.net/usage.html)
  2652. ```bash
  2653. ngrep -d eth0 "www.domain.com" port 443
  2654. ```
  2655. * `-d [iface|any]` - set interface
  2656. * `[domain]` - set hostname
  2657. * `port [1-65535]` - set port number
  2658. ```bash
  2659. ngrep -d eth0 "www.domain.com" src host 10.240.20.2 and port 443
  2660. ```
  2661. * `(host [ip|hostname])` - filter by ip or hostname
  2662. * `(port [1-65535])` - filter by port number
  2663. ```bash
  2664. ngrep -d eth0 -qt -O ngrep.pcap "www.domain.com" port 443
  2665. ```
  2666. * `-q` - quiet mode (only payloads)
  2667. * `-t` - added timestamps
  2668. * `-O [filename]` - save output to file, `-I [filename]` - reading from file
  2669. ```bash
  2670. ngrep -d eth0 -qt 'HTTP' 'tcp'
  2671. ```
  2672. * `HTTP` - show http headers
  2673. * `tcp|udp` - set protocol
  2674. * `[src|dst] host [ip|hostname]` - set direction for specific node
  2675. ```bash
  2676. ngrep -l -q -d eth0 -i "User-Agent: curl*"
  2677. ```
  2678. * `-l` - stdout line buffered
  2679. * `-i` - case-insensitive search
  2680. ___
  2681. ##### Tool: [hping3](http://www.hping.org/)
  2682. ```bash
  2683. hping3 -V -p 80 -s 5050 <scan_type> www.google.com
  2684. ```
  2685. * `-V|--verbose` - verbose mode
  2686. * `-p|--destport` - set destination port
  2687. * `-s|--baseport` - set source port
  2688. * `<scan_type>` - set scan type
  2689. * `-F|--fin` - set FIN flag, port open if no reply
  2690. * `-S|--syn` - set SYN flag
  2691. * `-P|--push` - set PUSH flag
  2692. * `-A|--ack` - set ACK flag (use when ping is blocked, RST response back if the port is open)
  2693. * `-U|--urg` - set URG flag
  2694. * `-Y|--ymas` - set Y unused flag (0x80 - nullscan), port open if no reply
  2695. * `-M 0 -UPF` - set TCP sequence number and scan type (URG+PUSH+FIN), port open if no reply
  2696. ```bash
  2697. hping3 -V -c 1 -1 -C 8 www.google.com
  2698. ```
  2699. * `-c [num]` - packet count
  2700. * `-1` - set ICMP mode
  2701. * `-C|--icmptype [icmp-num]` - set icmp type (default icmp-echo = 8)
  2702. ```bash
  2703. hping3 -V -c 1000000 -d 120 -S -w 64 -p 80 --flood --rand-source <remote_host>
  2704. ```
  2705. * `--flood` - sent packets as fast as possible (don't show replies)
  2706. * `--rand-source` - random source address mode
  2707. * `-d --data` - data size
  2708. * `-w|--win` - winsize (default 64)
  2709. ___
  2710. ##### Tool: [nmap](https://nmap.org/)
  2711. ###### Ping scans the network
  2712. ```bash
  2713. nmap -sP 192.168.0.0/24
  2714. ```
  2715. ###### Show only open ports
  2716. ```bash
  2717. nmap -F --open 192.168.0.0/24
  2718. ```
  2719. ###### Full TCP port scan using with service version detection
  2720. ```bash
  2721. nmap -p 1-65535 -sV -sS -T4 192.168.0.0/24
  2722. ```
  2723. ###### Nmap scan and pass output to Nikto
  2724. ```bash
  2725. nmap -p80,443 192.168.0.0/24 -oG - | nikto.pl -h -
  2726. ```
  2727. ###### Recon specific ip:service with Nmap NSE scripts stack
  2728. ```bash
  2729. # Set variables:
  2730. _hosts="192.168.250.10"
  2731. _ports="80,443"
  2732. # Set Nmap NSE scripts stack:
  2733. _nmap_nse_scripts="+dns-brute,\
  2734. +http-auth-finder,\
  2735. +http-chrono,\
  2736. +http-cookie-flags,\
  2737. +http-cors,\
  2738. +http-cross-domain-policy,\
  2739. +http-csrf,\
  2740. +http-dombased-xss,\
  2741. +http-enum,\
  2742. +http-errors,\
  2743. +http-git,\
  2744. +http-grep,\
  2745. +http-internal-ip-disclosure,\
  2746. +http-jsonp-detection,\
  2747. +http-malware-host,\
  2748. +http-methods,\
  2749. +http-passwd,\
  2750. +http-phpself-xss,\
  2751. +http-php-version,\
  2752. +http-robots.txt,\
  2753. +http-sitemap-generator,\
  2754. +http-shellshock,\
  2755. +http-stored-xss,\
  2756. +http-title,\
  2757. +http-unsafe-output-escaping,\
  2758. +http-useragent-tester,\
  2759. +http-vhosts,\
  2760. +http-waf-detect,\
  2761. +http-waf-fingerprint,\
  2762. +http-xssed,\
  2763. +traceroute-geolocation.nse,\
  2764. +ssl-enum-ciphers,\
  2765. +whois-domain,\
  2766. +whois-ip"
  2767. # Set Nmap NSE script params:
  2768. _nmap_nse_scripts_args="dns-brute.domain=${_hosts},http-cross-domain-policy.domain-lookup=true,"
  2769. _nmap_nse_scripts_args+="http-waf-detect.aggro,http-waf-detect.detectBodyChanges,"
  2770. _nmap_nse_scripts_args+="http-waf-fingerprint.intensive=1"
  2771. # Perform scan:
  2772. nmap --script="$_nmap_nse_scripts" --script-args="$_nmap_nse_scripts_args" -p "$_ports" "$_hosts"
  2773. ```
  2774. ___
  2775. ##### Tool: [netcat](http://netcat.sourceforge.net/)
  2776. ```bash
  2777. nc -kl 5000
  2778. ```
  2779. * `-l` - listen for an incoming connection
  2780. * `-k` - listening after client has disconnected
  2781. * `>filename.out` - save receive data to file (optional)
  2782. ```bash
  2783. nc 192.168.0.1 5051 < filename.in
  2784. ```
  2785. * `< filename.in` - send data to remote host
  2786. ```bash
  2787. nc -vz 10.240.30.3 5000
  2788. ```
  2789. * `-v` - verbose output
  2790. * `-z` - scan for listening daemons
  2791. ```bash
  2792. nc -vzu 10.240.30.3 1-65535
  2793. ```
  2794. * `-u` - scan only udp ports
  2795. ###### Transfer data file (archive)
  2796. ```bash
  2797. server> nc -l 5000 | tar xzvfp -
  2798. client> tar czvfp - /path/to/dir | nc 10.240.30.3 5000
  2799. ```
  2800. ###### Launch remote shell
  2801. ```bash
  2802. # 1)
  2803. server> nc -l 5000 -e /bin/bash
  2804. client> nc 10.240.30.3 5000
  2805. # 2)
  2806. server> rm -f /tmp/f; mkfifo /tmp/f
  2807. server> cat /tmp/f | /bin/bash -i 2>&1 | nc -l 127.0.0.1 5000 > /tmp/f
  2808. client> nc 10.240.30.3 5000
  2809. ```
  2810. ###### Simple file server
  2811. ```bash
  2812. while true ; do nc -l 5000 | tar -xvf - ; done
  2813. ```
  2814. ###### Simple minimal HTTP Server
  2815. ```bash
  2816. while true ; do nc -l -p 1500 -c 'echo -e "HTTP/1.1 200 OK\n\n $(date)"' ; done
  2817. ```
  2818. ###### Simple HTTP Server
  2819. > Restarts web server after each request - remove `while` condition for only single connection.
  2820. ```bash
  2821. cat > index.html << __EOF__
  2822. <!doctype html>
  2823. <head>
  2824. <meta charset="utf-8">
  2825. <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1">
  2826. <title></title>
  2827. <meta name="description" content="">
  2828. <meta name="viewport" content="width=device-width, initial-scale=1">
  2829. </head>
  2830. <body>
  2831. <p>
  2832. Hello! It's a site.
  2833. </p>
  2834. </body>
  2835. </html>
  2836. __EOF__
  2837. ```
  2838. ```bash
  2839. server> while : ; do \
  2840. (echo -ne "HTTP/1.1 200 OK\r\nContent-Length: $(wc -c <index.html)\r\n\r\n" ; cat index.html;) | \
  2841. nc -l -p 5000 \
  2842. ; done
  2843. ```
  2844. * `-p` - port number
  2845. ###### Simple HTTP Proxy (single connection)
  2846. ```bash
  2847. #!/usr/bin/env bash
  2848. if [[ $# != 2 ]] ; then
  2849. printf "%s\\n" \
  2850. "usage: ./nc-proxy listen-port bk_host:bk_port"
  2851. fi
  2852. _listen_port="$1"
  2853. _bk_host=$(echo "$2" | cut -d ":" -f1)
  2854. _bk_port=$(echo "$2" | cut -d ":" -f2)
  2855. printf " lport: %s\\nbk_host: %s\\nbk_port: %s\\n\\n" \
  2856. "$_listen_port" "$_bk_host" "$_bk_port"
  2857. _tmp=$(mktemp -d)
  2858. _back="$_tmp/pipe.back"
  2859. _sent="$_tmp/pipe.sent"
  2860. _recv="$_tmp/pipe.recv"
  2861. trap 'rm -rf "$_tmp"' EXIT
  2862. mkfifo -m 0600 "$_back" "$_sent" "$_recv"
  2863. sed "s/^/=> /" <"$_sent" &
  2864. sed "s/^/<= /" <"$_recv" &
  2865. nc -l -p "$_listen_port" <"$_back" | \
  2866. tee "$_sent" | \
  2867. nc "$_bk_host" "$_bk_port" | \
  2868. tee "$_recv" >"$_back"
  2869. ```
  2870. ```bash
  2871. server> chmod +x nc-proxy && ./nc-proxy 8080 192.168.252.10:8000
  2872. lport: 8080
  2873. bk_host: 192.168.252.10
  2874. bk_port: 8000
  2875. client> http -p h 10.240.30.3:8080
  2876. HTTP/1.1 200 OK
  2877. Accept-Ranges: bytes
  2878. Cache-Control: max-age=31536000
  2879. Content-Length: 2748
  2880. Content-Type: text/html; charset=utf-8
  2881. Date: Sun, 01 Jul 2018 20:12:08 GMT
  2882. Last-Modified: Sun, 01 Apr 2018 21:53:37 GMT
  2883. ```
  2884. ###### Create a single-use TCP or UDP proxy
  2885. ```bash
  2886. ### TCP -> TCP
  2887. nc -l -p 2000 -c "nc [ip|hostname] 3000"
  2888. ### TCP -> UDP
  2889. nc -l -p 2000 -c "nc -u [ip|hostname] 3000"
  2890. ### UDP -> UDP
  2891. nc -l -u -p 2000 -c "nc -u [ip|hostname] 3000"
  2892. ### UDP -> TCP
  2893. nc -l -u -p 2000 -c "nc [ip|hostname] 3000"
  2894. ```
  2895. ___
  2896. ##### Tool: [gnutls-cli](https://gnutls.org/manual/html_node/gnutls_002dcli-Invocation.html)
  2897. ###### Testing connection to remote host (with SNI support)
  2898. ```bash
  2899. gnutls-cli -p 443 google.com
  2900. ```
  2901. ###### Testing connection to remote host (without SNI support)
  2902. ```bash
  2903. gnutls-cli --disable-sni -p 443 google.com
  2904. ```
  2905. ___
  2906. ##### Tool: [socat](http://www.dest-unreach.org/socat/doc/socat.html)
  2907. ###### Testing remote connection to port
  2908. ```bash
  2909. socat - TCP4:10.240.30.3:22
  2910. ```
  2911. * `-` - standard input (STDIO)
  2912. * `TCP4:<params>` - set tcp4 connection with specific params
  2913. * `[hostname|ip]` - set hostname/ip
  2914. * `[1-65535]` - set port number
  2915. ###### Redirecting TCP-traffic to a UNIX domain socket under Linux
  2916. ```bash
  2917. socat TCP-LISTEN:1234,bind=127.0.0.1,reuseaddr,fork,su=nobody,range=127.0.0.0/8 UNIX-CLIENT:/tmp/foo
  2918. ```
  2919. * `TCP-LISTEN:<params>` - set tcp listen with specific params
  2920. * `[1-65535]` - set port number
  2921. * `bind=[hostname|ip]` - set bind hostname/ip
  2922. * `reuseaddr` - allows other sockets to bind to an address
  2923. * `fork` - keeps the parent process attempting to produce more connections
  2924. * `su=nobody` - set user
  2925. * `range=[ip-range]` - ip range
  2926. * `UNIX-CLIENT:<params>` - communicates with the specified peer socket
  2927. * `filename` - define socket
  2928. ___
  2929. ##### Tool: [p0f](http://lcamtuf.coredump.cx/p0f3/)
  2930. ###### Set iface in promiscuous mode and dump traffic to the log file
  2931. ```bash
  2932. p0f -i enp0s25 -p -d -o /dump/enp0s25.log
  2933. ```
  2934. * `-i` - listen on the specified interface
  2935. * `-p` - set interface in promiscuous mode
  2936. * `-d` - fork into background
  2937. * `-o` - output file
  2938. ___
  2939. ##### Tool: [netstat](https://en.wikipedia.org/wiki/Netstat)
  2940. ###### Graph # of connections for each hosts
  2941. ```bash
  2942. netstat -an | awk '/ESTABLISHED/ { split($5,ip,":"); if (ip[1] !~ /^$/) print ip[1] }' | \
  2943. sort | uniq -c | awk '{ printf("%s\t%s\t",$2,$1) ; for (i = 0; i < $1; i++) {printf("*")}; print "" }'
  2944. ```
  2945. ###### Monitor open connections for specific port including listen, count and sort it per IP
  2946. ```bash
  2947. watch "netstat -plan | grep :443 | awk {'print \$5'} | cut -d: -f 1 | sort | uniq -c | sort -nk 1"
  2948. ```
  2949. ###### Grab banners from local IPv4 listening ports
  2950. ```bash
  2951. netstat -nlt | grep 'tcp ' | grep -Eo "[1-9][0-9]*" | xargs -I {} sh -c "echo "" | nc -v -n -w1 127.0.0.1 {}"
  2952. ```
  2953. ___
  2954. ##### Tool: [rsync](https://en.wikipedia.org/wiki/Rsync)
  2955. ###### Rsync remote data as root using sudo
  2956. ```bash
  2957. rsync --rsync-path 'sudo rsync' username@hostname:/path/to/dir/ /local/
  2958. ```
  2959. ___
  2960. ##### Tool: [host](https://en.wikipedia.org/wiki/Host_(Unix))
  2961. ###### Resolves the domain name (using external dns server)
  2962. ```bash
  2963. host google.com 9.9.9.9
  2964. ```
  2965. ###### Checks the domain administrator (SOA record)
  2966. ```bash
  2967. host -t soa google.com 9.9.9.9
  2968. ```
  2969. ___
  2970. ##### Tool: [dig](https://en.wikipedia.org/wiki/Dig_(command))
  2971. ###### Resolves the domain name (short output)
  2972. ```bash
  2973. dig google.com +short
  2974. ```
  2975. ###### Lookup NS record for specific domain
  2976. ```bash
  2977. dig @9.9.9.9 google.com NS
  2978. ```
  2979. ###### Query only answer section
  2980. ```bash
  2981. dig google.com +nocomments +noquestion +noauthority +noadditional +nostats
  2982. ```
  2983. ###### Query ALL DNS Records
  2984. ```bash
  2985. dig google.com ANY +noall +answer
  2986. ```
  2987. ###### DNS Reverse Look-up
  2988. ```bash
  2989. dig -x 172.217.16.14 +short
  2990. ```
  2991. ___
  2992. ##### Tool: [certbot](https://certbot.eff.org/)
  2993. ###### Generate multidomain certificate
  2994. ```bash
  2995. certbot certonly -d example.com -d www.example.com
  2996. ```
  2997. ###### Generate wildcard certificate
  2998. ```bash
  2999. certbot certonly --manual --preferred-challenges=dns -d example.com -d *.example.com
  3000. ```
  3001. ###### Generate certificate with 4096 bit private key
  3002. ```bash
  3003. certbot certonly -d example.com -d www.example.com --rsa-key-size 4096
  3004. ```
  3005. ___
  3006. ##### Tool: [network-other](https://github.com/trimstray/the-book-of-secret-knowledge#tool-network-other)
  3007. ###### Get all subnets for specific AS (Autonomous system)
  3008. ```bash
  3009. AS="AS32934"
  3010. whois -h whois.radb.net -- "-i origin ${AS}" | \
  3011. grep "^route:" | \
  3012. cut -d ":" -f2 | \
  3013. sed -e 's/^[ \t]//' | \
  3014. sort -n -t . -k 1,1 -k 2,2 -k 3,3 -k 4,4 | \
  3015. cut -d ":" -f2 | \
  3016. sed -e 's/^[ \t]/allow /' | \
  3017. sed 's/$/;/' | \
  3018. sed 's/allow */subnet -> /g'
  3019. ```
  3020. ###### Resolves domain name from dns.google.com with curl and jq
  3021. ```bash
  3022. _dname="google.com" ; curl -s "https://dns.google.com/resolve?name=${_dname}&type=A" | jq .
  3023. ```
  3024. ##### Tool: [git](https://git-scm.com/)
  3025. ###### Log alias for a decent view of your repo
  3026. ```bash
  3027. # 1)
  3028. git log --oneline --decorate --graph --all
  3029. # 2)
  3030. git log --graph \
  3031. --pretty=format:'%Cred%h%Creset -%C(yellow)%d%Creset %s %Cgreen(%cr) %C(bold blue)<%an>%Creset' \
  3032. --abbrev-commit
  3033. ```
  3034. ___
  3035. ##### Tool: [python](https://www.python.org/)
  3036. ###### Static HTTP web server
  3037. ```bash
  3038. # Python 3.x
  3039. python3 -m http.server 8000 --bind 127.0.0.1
  3040. # Python 2.x
  3041. python -m SimpleHTTPServer 8000
  3042. ```
  3043. ###### Static HTTP web server with SSL support
  3044. ```bash
  3045. # Python 3.x
  3046. from http.server import HTTPServer, BaseHTTPRequestHandler
  3047. import ssl
  3048. httpd = HTTPServer(('localhost', 4443), BaseHTTPRequestHandler)
  3049. httpd.socket = ssl.wrap_socket (httpd.socket,
  3050. keyfile="path/to/key.pem",
  3051. certfile='path/to/cert.pem', server_side=True)
  3052. httpd.serve_forever()
  3053. # Python 2.x
  3054. import BaseHTTPServer, SimpleHTTPServer
  3055. import ssl
  3056. httpd = BaseHTTPServer.HTTPServer(('localhost', 4443),
  3057. SimpleHTTPServer.SimpleHTTPRequestHandler)
  3058. httpd.socket = ssl.wrap_socket (httpd.socket,
  3059. keyfile="path/tp/key.pem",
  3060. certfile='path/to/cert.pem', server_side=True)
  3061. httpd.serve_forever()
  3062. ```
  3063. ###### Encode base64
  3064. ```bash
  3065. python -m base64 -e <<< "sample string"
  3066. ```
  3067. ###### Decode base64
  3068. ```bash
  3069. python -m base64 -d <<< "dGhpcyBpcyBlbmNvZGVkCg=="
  3070. ```
  3071. ##### Tool: [awk](http://www.grymoire.com/Unix/Awk.html)
  3072. ###### Search for matching lines
  3073. ```bash
  3074. # egrep foo
  3075. awk '/foo/' filename
  3076. ```
  3077. ###### Search non matching lines
  3078. ```bash
  3079. # egrep -v foo
  3080. awk '!/foo/' filename
  3081. ```
  3082. ###### Print matching lines with numbers
  3083. ```bash
  3084. # egrep -n foo
  3085. awk '/foo/{print FNR,$0}' filename
  3086. ```
  3087. ###### Print the last column
  3088. ```bash
  3089. awk '{print $NF}' filename
  3090. ```
  3091. ###### Find all the lines longer than 80 characters
  3092. ```bash
  3093. awk 'length($0)>80{print FNR,$0}' filename
  3094. ```
  3095. ###### Print only lines of less than 80 characters
  3096. ```bash
  3097. awk 'length < 80' filename
  3098. ```
  3099. ###### Print double new lines a file
  3100. ```bash
  3101. awk '1; { print "" }' filename
  3102. ```
  3103. ###### Print line numbers
  3104. ```bash
  3105. awk '{ print FNR "\t" $0 }' filename
  3106. awk '{ printf("%5d : %s\n", NR, $0) }' filename # in a fancy manner
  3107. ```
  3108. ###### Print line numbers for only non-blank lines
  3109. ```bash
  3110. awk 'NF { $0=++a " :" $0 }; { print }' filename
  3111. ```
  3112. ###### Print the line and the next two (i=5) lines after the line matching regexp
  3113. ```bash
  3114. awk '/foo/{i=5+1;}{if(i){i--; print;}}' filename
  3115. ```
  3116. ###### Print the lines starting at the line matching 'server {' until the line matching '}'
  3117. ```bash
  3118. awk '/server {/,/}/' filename
  3119. ```
  3120. ###### Print multiple columns with separators
  3121. ```bash
  3122. awk -F' ' '{print "ip:\t" $2 "\n port:\t" $3' filename
  3123. ```
  3124. ###### Remove empty lines
  3125. ```bash
  3126. awk 'NF > 0' filename
  3127. # alternative:
  3128. awk NF filename
  3129. ```
  3130. ###### Delete trailing white space (spaces, tabs)
  3131. ```bash
  3132. awk '{sub(/[ \t]*$/, "");print}' filename
  3133. ```
  3134. ###### Delete leading white space
  3135. ```bash
  3136. awk '{sub(/^[ \t]+/, ""); print}' filename
  3137. ```
  3138. ###### Remove duplicate consecutive lines
  3139. ```bash
  3140. # uniq
  3141. awk 'a !~ $0{print}; {a=$0}' filename
  3142. ```
  3143. ###### Remove duplicate entries in a file without sorting
  3144. ```bash
  3145. awk '!x[$0]++' filename
  3146. ```
  3147. ###### Exclude multiple columns
  3148. ```bash
  3149. awk '{$1=$3=""}1' filename
  3150. ```
  3151. ###### Substitute foo for bar on lines matching regexp
  3152. ```bash
  3153. awk '/regexp/{gsub(/foo/, "bar")};{print}' filename
  3154. ```
  3155. ###### Add some characters at the beginning of matching lines
  3156. ```bash
  3157. awk '/regexp/{sub(/^/, "++++"); print;next;}{print}' filename
  3158. ```
  3159. ###### Get the last hour of Apache logs
  3160. ```bash
  3161. awk '/'$(date -d "1 hours ago" "+%d\\/%b\\/%Y:%H:%M")'/,/'$(date "+%d\\/%b\\/%Y:%H:%M")'/ { print $0 }' \
  3162. /var/log/httpd/access_log
  3163. ```
  3164. ___
  3165. ##### Tool: [sed](http://www.grymoire.com/Unix/Sed.html)
  3166. ###### Print a specific line from a file
  3167. ```bash
  3168. sed -n 10p /path/to/file
  3169. ```
  3170. ###### Remove a specific line from a file
  3171. ```bash
  3172. sed -i 10d /path/to/file
  3173. # alternative (BSD): sed -i'' 10d /path/to/file
  3174. ```
  3175. ###### Remove a range of lines from a file
  3176. ```bash
  3177. sed -i <file> -re '<start>,<end>d'
  3178. ```
  3179. ###### Replace newline(s) with a space
  3180. ```bash
  3181. sed ':a;N;$!ba;s/\n/ /g' /path/to/file
  3182. # cross-platform compatible syntax:
  3183. sed -e ':a' -e 'N' -e '$!ba' -e 's/\n/ /g' /path/to/file
  3184. ```
  3185. - `:a` create a label `a`
  3186. - `N` append the next line to the pattern space
  3187. - `$!` if not the last line, ba branch (go to) label `a`
  3188. - `s` substitute, `/\n/` regex for new line, `/ /` by a space, `/g` global match (as many times as it can)
  3189. Alternatives:
  3190. ```bash
  3191. # perl version (sed-like speed):
  3192. perl -p -e 's/\n/ /' /path/to/file
  3193. # bash version (slow):
  3194. while read line ; do printf "%s" "$line " ; done < file
  3195. ```
  3196. ###### Delete string +N next lines
  3197. ```bash
  3198. sed '/start/,+4d' /path/to/file
  3199. ```
  3200. ___
  3201. ##### Tool: [grep](http://www.grymoire.com/Unix/Grep.html)
  3202. ###### Search for a "pattern" inside all files in the current directory
  3203. ```bash
  3204. grep -rn "pattern"
  3205. grep -RnisI "pattern" *
  3206. fgrep "pattern" * -R
  3207. ```
  3208. ###### Show only for multiple patterns
  3209. ```bash
  3210. grep 'INFO*'\''WARN' filename
  3211. grep 'INFO\|WARN' filename
  3212. grep -e INFO -e WARN filename
  3213. grep -E '(INFO|WARN)' filename
  3214. egrep "INFO|WARN" filename
  3215. ```
  3216. ###### Except multiple patterns
  3217. ```bash
  3218. grep -vE '(error|critical|warning)' filename
  3219. ```
  3220. ###### Show data from file without comments
  3221. ```bash
  3222. grep -v ^[[:space:]]*# filename
  3223. ```
  3224. ###### Show data from file without comments and new lines
  3225. ```bash
  3226. egrep -v '#|^$' filename
  3227. ```
  3228. ###### Show strings with a dash/hyphen
  3229. ```bash
  3230. grep -e -- filename
  3231. grep -- -- filename
  3232. grep "\-\-" filename
  3233. ```
  3234. ###### Remove blank lines from a file and save output to new file
  3235. ```bash
  3236. grep . filename > newfilename
  3237. ```
  3238. ##### Tool: [perl](https://www.perl.org/)
  3239. ###### Search and replace (in place)
  3240. ```bash
  3241. perl -i -pe's/SEARCH/REPLACE/' filename
  3242. ```
  3243. ###### Edit of `*.conf` files changing all foo to bar (and backup original)
  3244. ```bash
  3245. perl -p -i.orig -e 's/\bfoo\b/bar/g' *.conf
  3246. ```
  3247. ###### Prints the first 20 lines from `*.conf` files
  3248. ```bash
  3249. perl -pe 'exit if $. > 20' *.conf
  3250. ```
  3251. ###### Search lines 10 to 20
  3252. ```bash
  3253. perl -ne 'print if 10 .. 20' filename
  3254. ```
  3255. ###### Delete first 10 lines (and backup original)
  3256. ```bash
  3257. perl -i.orig -ne 'print unless 1 .. 10' filename
  3258. ```
  3259. ###### Delete all but lines between foo and bar (and backup original)
  3260. ```bash
  3261. perl -i.orig -ne 'print unless /^foo$/ .. /^bar$/' filename
  3262. ```
  3263. ###### Reduce multiple blank lines to a single line
  3264. ```bash
  3265. perl -p -i -00pe0 filename
  3266. ```
  3267. ###### Convert tabs to spaces (1t = 2sp)
  3268. ```bash
  3269. perl -p -i -e 's/\t/ /g' filename
  3270. ```
  3271. ###### Read input from a file and report number of lines and characters
  3272. ```bash
  3273. perl -lne '$i++; $in += length($_); END { print "$i lines, $in characters"; }' filename
  3274. ```
  3275. #### Shell Tricks &nbsp;[<sup>[TOC]</sup>](#anger-table-of-contents)
  3276. When you get a shell, it is generally not very clean, but after following these steps, you will have a fairly clean and comfortable shell to work with.
  3277. 1) `script /dev/null -c bash`
  3278. 2) Ctrl-Z (to send it to background)
  3279. 3) `stty raw -echo; fg` (returns the shell to foreground)
  3280. 4) `reset` (to reset terminal)
  3281. 5) `xterm` (when asked for terminal type)
  3282. 6) `export TERM=xterm; export SHELL=bash`
  3283. #### Shell functions &nbsp;[<sup>[TOC]</sup>](#anger-table-of-contents)
  3284. ##### Table of Contents
  3285. - [Domain resolve](#domain-resolve)
  3286. - [Get ASN](#get-asn)
  3287. ###### Domain resolve
  3288. ```bash
  3289. # Dependencies:
  3290. # - curl
  3291. # - jq
  3292. function DomainResolve() {
  3293. local _host="$1"
  3294. local _curl_base="curl --request GET"
  3295. local _timeout="15"
  3296. _host_ip=$($_curl_base -ks -m "$_timeout" "https://dns.google.com/resolve?name=${_host}&type=A" | \
  3297. jq '.Answer[0].data' | tr -d "\"" 2>/dev/null)
  3298. if [[ -z "$_host_ip" ]] || [[ "$_host_ip" == "null" ]] ; then
  3299. echo -en "Unsuccessful domain name resolution.\\n"
  3300. else
  3301. echo -en "$_host > $_host_ip\\n"
  3302. fi
  3303. }
  3304. ```
  3305. Example:
  3306. ```bash
  3307. shell> DomainResolve nmap.org
  3308. nmap.org > 45.33.49.119
  3309. shell> DomainResolve nmap.org
  3310. Unsuccessful domain name resolution.
  3311. ```
  3312. ###### Get ASN
  3313. ```bash
  3314. # Dependencies:
  3315. # - curl
  3316. function GetASN() {
  3317. local _ip="$1"
  3318. local _curl_base="curl --request GET"
  3319. local _timeout="15"
  3320. _asn=$($_curl_base -ks -m "$_timeout" "http://ip-api.com/line/${_ip}?fields=as")
  3321. _state=$(echo $?)
  3322. if [[ -z "$_ip" ]] || [[ "$_ip" == "null" ]] || [[ "$_state" -ne 0 ]]; then
  3323. echo -en "Unsuccessful ASN gathering.\\n"
  3324. else
  3325. echo -en "$_ip > $_asn\\n"
  3326. fi
  3327. }
  3328. ```
  3329. Example:
  3330. ```bash
  3331. shell> GetASN 1.1.1.1
  3332. 1.1.1.1 > AS13335 Cloudflare, Inc.
  3333. shell> GetASN 0.0.0.0
  3334. Unsuccessful ASN gathering.
  3335. ```