pentest.md

Advice

• https://jhalon.github.io/becoming-a-pentester + https://www.professormesser.com/security-plus/sy0-501/sy0-501-training-course + https://youtu.be/bNcMzKNwASE

Authentication/Authorization

• https://twitter.com/omespino/status/1388580793740447745
• https://portswigger.net/web-security/authentication + https://pentesterlab.com/badges/essential + https://github.com/Quitten/Autorize
• Abusing feature to steal your tokens
• https://snikt.net/blog/2019/05/16/jwt-signature-vs-mac-attacks
• https://research.securitum.com/jwt-json-web-token-security
• https://thehftguy.com/2020/02/18/jwt-is-awesome-heres-why
• Extracting api keys and secrets by requesting each url at the your list.
• Are You Properly Using JWTs? - Dmitry Sotnikov
• JWT Parkour - Louis Nyffenegger
• The arguments in defense of JWT are the same as PGP
• https://duo.com/blog/the-beer-drinkers-guide-to-saml
• What do you use axios transforms and interceptors for?
• https://twitter.com/s0md3v/status/1265948308989775873 + exploit-db.com/download/48495
• https://maxfieldchen.com/posts/2020-05-17-penetration-testers-guide-oauth-2.html
• https://zonksec.com/blog/jwt-hacking-101
• https://blog.raw.pm/en/state-of-the-art-of-network-pivoting-in-2019
• https://blog.asayer.io/jwt-authentication-best-practices
• https://www.liip.ch/en/blog/no-nginx-basic-auth-with-either-network-or-cookie-set + https://twitter.com/aduzsardi/status/1339919551602016257
• https://developer.okta.com/blog/2020/11/06/oauth-sketch-notes-livestream
• https://smarx.com/posts/2020/08/totp-how-most-2fa-apps-work
• access to company without being part of it with google oauth
• JWT brute force cracker written in C + https://auth0.com/blog/brute-forcing-hs256-is-possible-the-importance-of-using-strong-keys-to-sign-jwts
• https://portswigger.net/research/hidden-oauth-attack-vectors + https://twitter.com/PortSwiggerRes/status/1374745056117149697
• https://www.notion.so/2FA-Bypass-techniques-9ead0724fce54a61899fe9c6a312ce5d
• OAuth 2.0 Threat Model Pentesting Checklist
• https://github.com/HolyBugx/HolyTips/blob/main/Checklist/OAuth.md
• List of sites with two factor auth support which includes SMS, email, phone calls, hardware, and software
• A list of vendors that treat single sign-on as a luxury feature, not a core security requirement
• https://sl4x0.github.io/Aurhentication-Attacks
• I am convinced that if OAuth is being used, it is configured incorrectly
• Escalate SelfXSS to account takeover

Blue team

• https://github.com/stars/swisskyrepo/lists/blueteam
• https://github.com/Nickyie/Cybersecurity-Resources/tree/main/Free%20Labs%20to%20Practice%20your%20REDTEAM
• Red and Blue | IamJakoby

Book

• https://diablohorn.com/books
• https://www.ncsc.gov.uk/blog-post/full-version-of-the-cyber-security-body-of-knowledge-published
• https://learning.oreilly.com/library/view/coding-for-penetration/9780128054734
• Building Secure and Reliable Systems
• The Web Application Hacker's Handbook - Extra Content
• https://github.com/zbetcheckin/Security_list#books-books
• https://legacy.gitbook.com/book/bkimminich/pwning-owasp-juice-shop/details + https://m.youtube.com/playlist?list=PLV9O4rIovHhO1y8_78GZfMbH6oznyx2g2 + All OWASP Juice Shop Solutions by Web Security Tutorials
• OWASP Top 5 - The top 5 most useful OWASP resources
• https://www.amazon.com/Building-Virtual-Machine-Labs-Hands/dp/1546932631
• Bug Bounty Playbook
• https://nullsweep.com/my-favorite-infosec-learning-resources
• https://github.com/carlospolop/hacktricks
• http://dfir.org/?q=node/8
• https://struct.github.io/bytes_bombs_and_spies.html
• https://icdt.osu.edu/cybercanon
• https://github.com/hdbreaker/ExploitingBooks
• https://github.com/zamarrowski/recursos-hacking-etico
• https://github.com/six2dez/pentest-book
• https://github.com/skerkour/black-hat-rust
• https://github.com/binarymist/HolisticInfoSec-For-WebDevelopers-Fascicle1
• https://www.amazon.com/Penetration-Testing-Azure-Ethical-Hackers/dp/1839212934
• Internal Security Assessment: Field Guide. Successful Techniques To Hack Your Way To Admin | Paul Seekamp
• https://leanpub.com/fridahandbook/read_full + https://learnfrida.info + https://twitter.com/entdark_/status/1486962987470667777
• Security Engineering | Ross Anderson
• https://www.skeletonscribe.net/2011/12/phrack-ebook.html
• https://github.com/nowsecure/secure-mobile-development
• The Cuckoo's Egg Decompiled Course + https://vimeo.com/networkdefense

Cinema

• https://carstein.github.io/2019/03/20/worth-listening.html
• https://github.com/Nickyie/Cybersecurity-Resources/tree/main/Cybersecurity%20%26%20Hacking%20Documentaries
• https://www.sans.org/webcasts/archive/2019
• http://www.irongeek.com/i.php?page=videos/web-pen-testing-workshop
• How to perform API testing
• https://github.com/PaulSec/awesome-sec-talks
• The Bug Hunters Methodology
• https://github.com/hellerve/programming-talks#security
• Attacking Secondary Contexts in Web Applications
• VirSecCon-All-in-one-slides-by-1ndianl33t.pdf
• https://nullsweep.com/defcon-2020-live-notes
• Purple team | Ch33r10
• https://portal.cyberwarfare.live/products/purple-teaming-fundamentals

Course

• https://cyber-judo.com/security-engineer-skill-tree-certification-recommendations
• https://tryhackme.com/hacktivities
• https://www.hacksplaining.com/lessons
• https://www.infosecirvin.info/class.html + https://m.youtube.com/c/IrvinLemus_cabrillo/playlists
• https://github.com/rmusser01/Infosec_Reference
• https://github.com/DK9510/web-app-exploitation
• https://www.udemy.com/course/du-computer-security/?couponCode=SEEDLABS2020 + https://www.handsonsecurity.net/video.html
• Hands-on-Hacking
• Web Penetration Testing with Kali Linux - Third Edition
• Improving your Penetration Testing Skills
• Penetration Testing Version 1 by Georgia Weidman
• https://www.udemy.com/course/practical-ethical-hacking/?referralCode=4A7D5EE973AFBCAD11C6&couponCode=THECYBERMENTOR
• https://www.udemy.com/course/python-for-pentesters/?couponCode=HEADFIRSTPYPENTEST
• Jump ESP, jump!
• https://github.com/s0md3v/learn-at-home
• ISSA KY Workshop: Network Packet Analysis - webpwnized
• Security for Hackers and Developers
• Zero to Hero: A Practical Network Penetration Testing Course - The Cyber Mentor
• Web Puzzlers - Securing Dynamic Systems (Mike Samuel)
• OWASP Top 10 2017 Training | Infosec Gamer + https://m.youtube.com/playlist?list=PLvmvp9IEWvXy3IKim5ri667Y8oTjC3e2E + https://drive.google.com/file/d/1vcjRroTDlXbpIoDu6gq_fcnAv2Zx54SQ/view
• https://twitter.com/Zardus/status/1298743731491713024 + https://pwn.college
• https://samsclass.info
• CMSC389R: Introduction to Ethical Hacking
• https://github.com/nahamsec/nahamsec.training + https://www.udemy.com/course/intro-to-bug-bounty-by-nahamsec/?couponCode=NAHOMIES
• Practical Ethical Hacking - The Complete Course
• https://www.udemy.com/course/the-owasp-top-10-demystified
• https://github.com/bugcrowd/bugcrowd_university
• https://learn.opsec.institute/courses/opsec-in-theory-and-practice
• Interactive IPython Notebook to demonstrate OWASP ZAP's API and Scripting Functions
• https://github.com/hmaverickadams/Beginner-Network-Pentesting
• https://cybersecurityandgrowth.substack.com/p/4-great-resources-to-study-for-comptia

Community

• https://github.com/binarymist/awesome-infosecnz
• List of resources on deception-based security with honeypots and honeytokens
• Deception based detection techniques mapped to the MITRE’s ATT&CK framework
• @K0rb1nDa11as | Fuzzing
• @goobstersec | Fuzzing
• https://github.com/404notf0und/Security-Data-Analysis-and-Visualization

Laboratory

• Set up a free server to exploit blind vulnerabilities (Google Cloud).
• https://github.com/onlurking/awesome-infosec#laboratories
• https://medium.com/@jshake/how-to-start-penetration-testing-with-a-windows-vm-964b814afdb8
• https://blog.pentesterlab.com/i-dont-need-no-proxy-1bb540c22008
• https://github.com/joe-shenouda/awesome-cyber-skills
• https://github.com/zbetcheckin/Security_list#learning--exercises-mortar_board
• SKF labs - a plethora of XSS challenges but labs for GraphQL bugs, JWT, SSRF, SSTI, lack of rate limiting, etc
• https://snikt.net/blog/2018/11/23/revising-my-lazy-http/https-interception-setup
• https://medium.com/@adam.toscher/wireless-penetration-tips-c0ed0a6665fe
• Vulnerable Banking Suite
• https://m.youtube.com/playlist?list=PLDrNMcTNhhYoEjHYs0ZBfcSE7Hw46BeTA
• Home Lab Cyber Range series - I.T Security Labs
• https://github.com/Wenzel/awesome-virtualization
• https://start.me/p/OmxRqE/mobile
• https://blog.haschek.at/2020/the-encrypted-homelab.html
• https://sensecurity.io/blog/building-your-studio
• https://application.security/free/owasp-top-10-API
• https://github.com/splitline/How-to-Hack-Websites
• https://github.com/GrosQuildu/agh_web_exploitation_workshops
• https://srcincite.io/training/challenge
• https://notsosecure.com/notsocereal-lab-deserialization-exploit-playground + https://github.com/NotSoSecure/NotSoCereal-Lab
• https://github.com/HuskyHacks/O-Course
• Port Swigger Web Security Academy Lab Walkthrough's | FindingUrPasswd
• https://github.com/Samsar4/Ethical-Hacking-Labs
• A built-to-be-vulnerable API application based on the OWASP top 10 API vulnerabilities

Tool

• https://tools.tldr.run
• https://ismailtasdelen.medium.com/how-can-you-improve-yourself-on-web-application-security-e0d65f441e8f
• Organize your API security assessment by using MindAPI
• https://zgheb.com/i?v=blog&pl=55#27.11.2019_-_Attacking_JWT_consumers_with_Burp_and_JWT4B
• https://hackademy.aetherlab.net/p/burp-suite + https://m.youtube.com/playlist?list=PLq9n8iqQJFDrwFe9AEDBlR1uSHEN7egQA
• https://medium.com/@ceos3c/the-best-christmas-presents-for-hackers-in-2019-1f95c634ffd7
• https://systemoverlord.com/2019/11/27/hacker-holiday-gift-guide-hhgg-2019.html
• https://www.peerlyst.com/posts/my-go-to-list-as-a-security-professional-steve-hollands
• https://enciphers.com/xposed-framework-plugins-for-android-pentesting
• Curl to shell isn’t so bad.
• Universal and highly customizable TCP proxy
• A python script that finds endpoints in JavaScript files.
• https://blog.secureideas.com/2020/02/fiddling-with-windows-proxy-tools-for-win10.html
• https://github.com/six2dez/mobile_pentesting_guide
• https://janmasarik.gitlab.io/automating-bug-bounty + https://is.muni.cz/th/de05t/master_thesis_final.pdf + https://vimeo.com/383296402 + https://twitter.com/s14ve/status/1242469452672876546
• https://diablohorn.com/2017/08/15/brute-forcing-encrypted-web-login-forms
• The Physical Security Tool Guide to Hacks, Cracks, and Recon
• Nmap mindmap + https://www.comparitech.com/net-admin/nmap-nessus-cheat-sheet
• https://github.com/ithilgore/mastering-nmap + https://www.packtpub.com/product/mastering-nmap-video/9781787289581
• Nmap on Android App (Python) | NetPwn
• https://github.com/jivoi/offsec_pdfs/blob/master/Burp_Pro_Tips_and_Tricks.pdf
• https://github.com/trickster0/Prepare_Kali_VM
• The Cyber Swiss Army Knife - a web app for encryption, encoding, compression and data analysis
• https://weibell.github.io/reverse-shell-generator + https://github.com/weibell/reverse-shell-generator
• IDA Pro Reverse Engineering Tutorial for Beginners | Debasish Mandal + https://twitter.com/debasishm89/status/1290896198631452674 + http://www.debasish.in/2020/08/ida-pro-video-tutorial-series-for.html
• http://www.debasish.in/2020/06/frida-video-tutorial-series-for-reverse.html
• Offline search tool for LDAP directory dumps in LDIF format.
• https://parsiya.net/blog/2021-06-22-semgrep-the-surgical-static-analysis-tool
• https://research.nccgroup.com/2023/01/26/using-semgrep-with-jupyter-notebook-files
• A pre-DDoS security assessment tool
• https://www.amazon.com/Network-Exploration-Security-Auditing-Cookbook-ebook-dp-B097S3LQPB/dp/B097S3LQPB
• https://github.com/CaledoniaProject/awesome-opensource-security
• https://github.com/honoki/bugbounty-openvpn-socks
• Client Side Prototype Pollution Scanner
• ZAP Deep Dive Series
• Mobile Verification Toolkit
• https://www.linkedin.com/posts/cody-winkler_this-year-marks-15-years-of-self-study-in-activity-6923050752001101825-O9H_
• https://github.com/psiinon/open-source-web-scanners
• Common Findings Database
• https://github.com/mariusv/Gray-Hacker-and-PenTesting
• https://www.pentagrid.ch/en/blog/open-source-sms-gateway-for-pentest-projects + https://github.com/pentagridsec/smsgate + https://twitter.com/pentagridsec/status/1600046890988425216
• Use Tor for anonymous scanning with nmap
• https://github.com/hideckies/exploit-notes
• https://github.com/jatrost/awesome-detection-rules
• https://community.turgensec.com/shodan-pentesting-guide + https://youtu.be/GyZFM5IaH2Y + https://youtu.be/YoXM4m1VEM0 + https://twitter.com/Jhaddix/status/1622588979999653889
• Learning Shodan through katas

Radio

• Notes from @NahamSec's awesome interview with @inhibitor181.
• https://blog.detectify.com/2020/03/13/undetected-podcast-e-01-recap-the-evolution-of-web-security-and-hacking
• 7 Minute Security podcast - full episode guide

Brute force

• https://infocon.org/rainbow%20tables
• How to brute force an OTP when your target is using Web Sockets with encryption.
• https://nordpass.com/most-common-passwords-list
• A Python library to utilize AWS API Gateway's large IP pool as a proxy to generate pseudo-infinite IPs for web scraping
• Common password lists, filtered by complexity and length policy
• https://github.com/ihebski/DefaultCreds-cheat-sheet
• https://github.com/tperich/serbian-wordlists
• https://github.com/insidetrust/statistically-likely-usernames
• https://jakewnuk.com/posts/optimizing-wordlists-w-masks
• https://github.com/TCM-Security/pnpt-wordlists
• The largest open-source Database for detecting secrets, API keys, passwords, tokens

Cross-Site Scripting (XSS)

• https://github.com/RenwaX23/XSS-Payloads
• https://keerok.github.io/2021/06/07/Pop-Ups-in-a-Good-World
• https://m.youtube.com/playlist?list=PLWIcRrPLCdUdhSwzcLEHCBOW1o2tz9J1G
• https://excess-xss.com + https://xss.pwnfunction.com
• https://book.hacktricks.xyz/pentesting-web/xss-cross-site-scripting
• https://medium.com/@corneacristian/top-25-xss-bug-bounty-reports-b3c90e2288c8
• Bootstrap XSS Collection
• Account takeover on Grammarly through the combination of cookie manipulation and XSS
• Cheat Sheet - 2019 Edition
• https://github.com/hakluke/weaponised-XSS-payloads
• JavaScript functions intended to be used as an XSS payload against a WordPress admin account.
• https://www.codedbrain.com/2019/11/intigriti-10k-followers-xss-challenge/
• XSS filter and WAF
• Detecting Chrome XSS Auditor Using
• Cloudflare XSS WAF bypass
• https://medium.com/@terjanq/clobbering-the-clobbered-vol-2-fb199ad7ec41
• Most advanced XSS scanner.
• Embed videos with XSS in their title and description.
• https://research.securitum.com/xss-in-amp4email-dom-clobbering/
• Hide a JavaScript inside a PNG.
• https://medium.com/monetary/how-did-i-earn-3133-70-from-google-translator-9becf942dbdc
• challenge + solution
• https://pragmaticwebsecurity.com/cheatsheets.html#reactxss
• URL parsers desync
• https://netsec.expert/2020/02/01/xss-in-2020.html
• https://blog.isec.pl/xss-fun-with-animated-svg
• 3 types of mXSS + https://research.securitum.com/mutation-xss-via-mathml-mutation-dompurify-2-0-17-bypass
• Reflected XSS via prototype pollution. + https://twitter.com/SecurityMB/status/1309401642228428800
• https://blog.0daylabs.com/2019/02/24/learning-DomXSS-with-DomGoat
• https://twitter.com/shhnjk/status/1374044076048228359 + https://twitter.com/shhnjk/status/1376359531056230405 + https://shhnjk.github.io/challenge/tt/TrustedTypesBypassChallenge.html + https://shhnjk.github.io/docs/solutions/TrustedTypesBypassChallengeSolutions.html
• Ways to alert(document.domain)
• XSLeaks in redirect flows
• https://owasp.org/www-pdf-archive/The_Ultimate_IDS_Smackdown.pdf
• https://github.com/mandatoryprogrammer/xsshunter-express
• https://nokline.github.io/bugbounty/2022/09/02/Glassdoor-Cache-Poisoning.html
• https://mr-medi.github.io/research/2022/11/04/practical-client-side-path-traversal-attacks.html
• https://hacklido.com/d/43-an-art-of-dom-clobbering-from-zero-to-advance-level
• https://github.com/masatokinugawa/filterbypass/wiki/Browser's-XSS-Filter-Bypass-Cheat-Sheet
• A js encode/decode simple tool for XSS
• https://trufflesecurity.com/blog/xsshunter
• https://secbot-xss-challenges.vercel.app + https://gist.github.com/Sankalpa-Acharya/a7b905ea59ac3f621e164a40cedcc77c

XML external entity injection (XXE)

• 👉

Remote Code Execution (RCE)

• https://medium.com/@corneacristian/top-25-rce-bug-bounty-reports-bc9555cca7bc
• https://rezo.blog/hacking/2019/11/29/rce-via-imagetragick.html
• X-HTTP-Method-Override
• Anyone have RCE for a service that's typically only run behind NATs?
• https://github.com/mongo-express/mongo-express/security/advisories/GHSA-h47j-hc6x-h3qq
• A Tale of Two Formats: Exploiting Insecure XML and ZIP File Parsers to Create a Web Shell.
• If a web application allow you to upload a .zip file, zip:// is an interesting PHP wrapper to turn a LFI into a RCE.
• AST Injection, Prototype Pollution to RCE + https://twitter.com/po6ix/status/1290651601850585091
• https://blog.p6.is/prototype-pollution-to-rce
• https://blog.0daylabs.com/2019/02/15/prototype-pollution-javascript
• https://twitter.com/samwcyo/status/1350025984775479296
• Pivoting in the Clouds + https://0day.click/recipe/discourse-sns-rce
• https://parsiya.net/blog/2021-12-20-rce-in-visual-studio-codes-remote-wsl-for-fun-and-negative-profit
• https://github.com/p0dalirius/Awesome-RCE-techniques
• https://www.wiz.io/blog/brokensesame-accidental-write-permissions-to-private-registry-allowed-potential-r
• https://www.ghostccamm.com/blog/multi_strapi_vulns + https://twitter.com/GhostCcamm/status/1647951950191943681
• https://frycos.github.io/vulns4free/2023/06/18/fortinac.html

Broken Object Level Authorization (BOLA)

• https://inonst.medium.com/a-deep-dive-on-the-most-critical-api-vulnerability-bola-1342224ec3f2
• https://medium.com/@corneacristian/top-25-idor-bug-bounty-reports-ba8cd59ad331
• https://medium.com/@R0X4R/graphql-idor-leads-to-information-disclosure-175eb560170d
• https://medium.com/@chiragsukhala/hacking-web-using-images-chira-attack-vector-63e15a1f7dac + https://github.com/ChiragSukhala/chiraAttackVector
• Finding Your First Bug: Manual IDOR Hunting
• How to Use Firefox Containers for Easy IDOR Hunting (With Demo!)
• https://medium.com/@aseem.shrey/attention-to-details-a-curious-case-of-multiple-idors-5a4417ba8848
• https://www.aon.com/cyber-solutions/aon_cyber_labs/finding-more-idors-tips-and-tricks + https://twitter.com/clintgibler/status/1363911452537552896
• https://github.com/snoopysecurity/Vulnerable-Code-Snippets/tree/master/IDOR
• https://techkranti.com/idor-through-mongodb-object-ids-prediction
• https://www.xmind.net/m/CSKSWZ
• https://twitter.com/MrTuxracer/status/1560639161966555141
• https://medium.com/@nynan/what-i-learnt-from-reading-220-idor-bug-reports-6efbea44db7
• https://medium.com/@protostar0/hacking-bank-broken-access-control-vulnerability-in-banking-application-part-ii-89c8edc1baef
• https://erasec.be/blog/client-side-path-manipulation
• https://weekly-bugbounty-content.beehiiv.com/p/broken-access-control

Cross-Site Request Forgery (CSRF)

• https://github.com/pillarjs/understanding-csrf
• https://medium.com/@renwa/bypass-samesite-cookies-default-to-lax-and-get-csrf-343ba09b9f2b
• https://www.agarri.fr/blog/archives/2020/01/13/intruder_and_csrf-protected_form_without_macros/index.html
• If anyone needs a referrer spoof in a GET request + https://twitter.com/shhnjk/status/1334943974453211136
• https://bugs.xdavidhu.me/google/2021/04/05/i-built-a-tv-that-plays-all-of-your-private-youtube-videos
• https://github.com/Damian89/extended-ssrf-search
• https://canopus-k.site/#talks
• https://github.com/BrunoHalltari/CTF-Writeups/tree/master/https:/challenge-0822.intigriti.io + https://blog.huli.tw/2022/08/29/en/intigriti-0822-xss-author-writeup

Open Redirect

• https://medium.com/@byq/from-open-redirect-to-rce-in-one-week-66a7f73fd082
• https://medium.com/@corneacristian/top-25-open-redirect-bug-bounty-reports-5ffe11788794
• Bypassing the Redirect filters with 7 ways
• https://github.com/lutfumertceylan/top25-parameter#top-25-open-redirect-parameters-for-lutfumertceylan

Server Side Request Forgery (SSRF)

• SSRF in Depth
• Break Points
• https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Request%20Forgery
• https://twitter.com/l4x4/status/1214917742823968768
• https://medium.com/a-bugz-life/exploiting-an-ssrf-trials-and-tribulations-14c5d8dbd69a
• https://blog.pentesterlab.com/i-considered-harmful-6e20936ea65f
• An automated SSRF finder.
• An exhaustive list of all the possible ways you can chain your Blind SSRF vulnerability + https://twitter.com/infosec_au/status/1349817057873850368 + https://blog.assetnote.io/2021/01/13/blind-ssrf-chains + https://evilpacket.net/2017/enumerating-files-using-server-side-request-forgery-and-the-request-module
• Cloud Metadata Dictionary useful for SSRF Testing
• https://blog.harshjaiswal.com/demystifying-the-server-side
• https://twitter.com/Yassineaboukir/status/1510634688473354247 + https://m.yassineaboukir.com/blog/exploiting-a-double-edged-SSRF-for-server-and-client-side-impact
• https://twitter.com/hacker_/status/1509545702480760834
• https://hackerinthehouse.in/top-25-server-side-request-forgery-ssrf-bug-bounty-reports

Server Side Template Injection (SSTI)

• https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Template%20Injection
• https://www.sans.org/webcasts/sec642-killing-snakes-fun-flask-sstis-rces-python-112860
• https://gosecure.github.io/template-injection-workshop
• Server-Side Template Injection and Code Injection Detection and Exploitation Tool
• https://github.com/harsh-bothra/SecurityExplained/blob/main/resources/ruby-erb-ssti.md
• https://pequalsnp-team.github.io/cheatsheet/flask-jinja2-ssti
• RCE via SSTI on Spring Boot Error Page with Akamai WAF Bypass

SQL injection (SQLi)

• https://twitter.com/intigriti/status/1612444215073456136
• Discovering SQL Injections in an age of ORMs
• https://www.arneswinnen.net/2013/09/automated-sql-injection-detection
• Blind SQL Injection without an "in"
• https://websec.wordpress.com/2010/03/19/exploiting-hard-filtered-sql-injections
• https://github.com/client9/libinjection + https://twitter.com/robertjhansen/status/1306099876007227392
• https://twitter.com/tr3w_/status/1320427654949019649
• https://github.com/TROUBLE-1/White-box-pentesting
• https://github.com/kleiton0x00/Advanced-SQL-Injection-Cheatsheet

Fuzzing

• https://h0mbre.github.io/Fuzzing-Like-A-Caveman + https://twitter.com/h0mbre_/status/1246387277460373504
• https://github.com/Dor1s/libfuzzer-workshop
• Masters degree dissertation for ISG, Royal Holloway (2011) on evolutionary fuzzing
• https://tldrsec.com/talks/automated_bug_finding_in_practice.html
• https://snikt.net/blog/2019/05/22/to-fuzz-a-websocket
• FuzzBench - Fuzzer benchmarking as a service.
• https://github.com/google/security-research-pocs/tree/master/autofuzz
• https://tldrsec.com/blog/25-years-of-fuzzing + https://twitter.com/richinseattle/status/1232376104440123392
• Radamsa is a test case generator for robustness testing + https://youtu.be/kMu1J8QdxE8
• https://www.blackhat.com/eu-19/briefings/schedule/#what-the-fuzz-18031 + https://youtu.be/Wy7qY5ms3qY + https://i.blackhat.com/eu-19/Thursday/eu-19-Aschermann-What-The-Fuzz.pdf
• https://github.com/Microsvuln/Awesome-AFL
• https://gist.github.com/mylamour/640622641ee39edf3701544a4303cb2e
• Fuzzing - Mohammed A Imran
• https://github.com/wcventure/FuzzingPaper
• https://github.com/0xricksanchez/paper_collection
• https://blog.doyensec.com/2020/09/09/fuzzilli-jerryscript.html
• https://zon8.re/posts/javascript-engine-fuzzing-and-exploitation-reading-list
• https://security.googleblog.com/2021/02/launching-osv-better-vulnerability.html
• https://www.fuzzingbook.org
• Build your own fuzzer - now in Rust
• API level fuzzing: how to harden your REST endpoints - Madalin Illie
• https://github.com/jthack/ffuf_presentation
• https://github.com/SummerSec/learning-codeql
• Finding security vulnerabilities through fuzzing
• https://github.com/xsscx/Commodity-Injection-Signatures
• https://github.com/u1f383/fuzzing-learning-in-30-days
• https://iosifache.me/posts/open-source-fuzzing
• black-box regex fuzzing to bypass validations and discover normalizations in web applications
• a smart DNS response-guided subdomain fuzzer
• Vaf is a cross-platform very advanced and fast web fuzzer written in nim
• Review for "Building Fast Fuzzers" paper
• Fuzzing: Brute Force Vulnerability Discovery | Michael Sutton, Adam Greene, Pedram Amini
• Corrupted files generator. Random bits flipper
• https://microsoftedge.github.io/edgevr/posts/Escaping-the-sandbox-A-bug-that-speaks-for-itself

Enumeration

• Fast subdomains enumeration tool for penetration testers.
• a list of services and how to claim (sub)domains with dangling DNS records.
• https://www.dionach.com/blog/how-to-use-owasp-amass-an-extensive-tutorial
• The best subdomain diagnostics and discovery tools.
• https://malicious.link/post/2020/lmo-egress-testing
• https://github.com/diego-treitos/linux-smart-enumeration

OSINT

• https://github.com/OffcierCia/non-typical-OSINT-guide
• Free SMS
• Operator Handbook: Red Team + OSINT + Blue Team Reference
• Getting a Grasp on GoogleID’s + the twitter thread
• https://github.com/v2-dev/awesome-social-engineering
• What is the best tool to spoof a phone number?
• https://github.com/cipher387/osint_stuff_tool_collection
• How to track location
• Want to learn more about #OSINT?
• https://github.com/cartographia/geospatial-intelligence-library
• OSINT automation for hackers
• Cyber Threat Intelligence sources from the deep and dark web
• https://github.com/netlas-io/netlas-cookbook

Reconnaissance

• https://www.udemy.com/course/reconcybersec
• Finding the Balance Between Speed & Accuracy During an Internet-wide Port Scanning
• https://www.tunnelsup.com/browser-portscanning + https://mobile.twitter.com/JackRhysider/status/1265317230658465794
• https://medium.com/@ankudobal46/operating-system-detection-using-ttl-value-powershell-ping-2da9bc6cdd1
• https://diablohorn.com/2020/03/04/lessons-learned-on-written-social-engineering-attacks
• https://diablohorn.com/2018/02/04/identify-a-whitelisted-ip-address
• https://diablohorn.com/2017/10/26/port-scanning-without-an-ip-address
• https://diablohorn.com/2017/05/21/quantum-insert-bypassing-ip-restrictions
• https://medium.com/bugbountywriteup/why-you-should-always-scan-udp-part-2-2-42050fb136d8
• https://ipx.ac
• Cloudflare blocking you? Scan ASN
• commandline tool/utility to query whois in bulk?
• Beginner's Guide to DFIR/Threat Hunting with VirusTotal Video Series
• https://blog.assetnote.io/2021/04/05/contextual-content-discovery
• Scan git repos (or files) for secrets using regex and entropy
• https://github.com/ayoubfathi/leaky-paths
• https://github.com/redhuntlabs/Awesome-Asset-Discovery
• https://github.com/0xspade/Automated-Scanner
• https://github.com/danielmiessler/RobotsDisallowed
• https://github.com/gwen001/github-subdomains
• A domain recon tool to help detect DNS based vulnerabilities, such as zone transfers and subdomain takeovers
• tips for tools to fingerprint webservers give a list of hostnames?
• https://dhiyaneshgeek.github.io/red/teaming/2022/04/28/reconnaissance-red-teaming
• https://github.com/paralax/awesome-internet-scanning
• https://hdm.io/decks/Duo_Tech_Talks_-_Modern_Network_Discovery.pdf
• Internal Security Assessment: Field Guide | Paul Seekamp
• Trademark and Copyright Recon
• https://github.com/sundowndev/hacker-roadmap
• https://www.osintme.com/index.php/2022/10/18/the-osint-me-ultimate-guide-to-telegram-osint-and-privacy
• https://labs.detectify.com/2022/10/28/hacking-supercharged-how-to-gunnar-andrews
• https://betterprogramming.pub/using-recon-for-pipeline-forensics-dfir-or-just-finding-files-3a220a71efe6
• Fetch data (open ports, CVEs, CPEs, ...) from shodan internetDB API
• Collection of regexp pattern for security passive scanning
• https://rushter.com/blog/how-masscan-works
• https://github.com/edoardottt/awesome-hacker-search-engines

Red team

• https://blog.zsec.uk/redteam-intro
• https://github.com/sneakerhax/TTPs
• An Azure xxploitation toolkit for Red Team & Pentesters
• What are some of your use cases for Wireshark?
• Rust Weaponization for Red Team Engagements
• https://github.com/CyberSecurityUP/Red-Team-Management
• https://github.com/CyberSecurityUP/Awesome-Red-Team-Operations
• https://github.com/assume-breach/Home-Grown-Red-Team
• https://github.com/stars/swisskyrepo/lists/redteam
• Notes and experiments tested on several infrastructures related to professional engagements
• https://github.com/stars/Techbrunch/lists/red-team
• https://github.com/A-poc/RedTeam-Tools
• https://github.com/X-C3LL/congresos-slides

Search

• Recon Lab: Ethical Google Hacking - Securing The Stack
• Google dork about how to get a job in pentesting
• https://github.com/sushiwushi/bug-bounty-dorks
• https://github.com/CorrieOnly/google-dorks
• https://twitter.com/z3dster/status/1500608769671245832
• https://theoradical.ai/research/2010-search-engine-hacking
• Is there a pluggable open source file indexer for making my backup files easier to search?
• https://securib.ee/beelog/a-better-way-to-use-twitter
• https://twitter.com/taksec/status/1605610328607186944
• https://github.com/igorbrigadir/twitter-advanced-search

Social engineering

• https://youtu.be/tCRT3QFzwm8 + https://twitter.com/ghostie_/status/1253623013209190401
• https://medium.com/bugbountywriteup/recipe-for-a-successful-phishing-campaign-part-1-2-dc23d927ec55

Mindset

• Get out of the limited OWASP TOP-10/SANS TOP-25/Bug Bounty mindset.
• https://github.com/pomerium/awesome-zero-trust
• https://github.com/tprynn/web-methodology
• https://swagitda.com/blog/posts/deciduous-attack-tree-app + https://github.com/rpetrich/deciduous
• https://kerkour.com/blog/freedom-the-core-value-of-hackers
• https://github.com/5bhuv4n35h/pentestmindmap
• https://posts.specterops.io/formalized-curiosity-3c550ece803e

Disclosure

• Top disclosed reports from HackerOne
• Undocumented admin
• https://github.com/pomerium/awesome-security-audits
• Pentest Fails - Hillbilly Storytime
• https://github.com/juliocesarfort/public-pentesting-reports
• https://twitter.com/SimonByte/status/1463143700230545412 + https://cvetrends.com
• Free zero-day vulnerability tracking service
• Vulnerability Discovery and Exploitation
• https://github.com/jacobdjwilson/awesome-annual-security-reports

Bug Bounty

• https://twitter.com/securibee/status/1580583966448398336
• https://www.amazon.com/Corporate-Cybersecurity-Identifying-Bounty-Program/dp/111978252X
• https://pentester.land/list-of-bug-bounty-writeups.html
• https://github.com/yaworsk/bugbounty/blob/master/writeups.md
• https://github.com/nahamsec/Resources-for-Beginner-Bug-Bounty-Hunters
• https://github.com/ngalongc/bug-bounty-reference
• bugreader.com (bug bounty submission reports)
• How do I write good bug bounty reports?
• https://blog.intigriti.com/2020/02/24/twitter-recap-1-bug-bounty-tips-by-the-intigriti-community
• Internal Bug Bounty Starter Kit
• https://gowsundar.gitbook.io/book-of-bugbounty-tips/file-upload
• Hourly-updated data dumps of bug bounty platform scopes (like Hackerone/Bugcrowd/Intigriti/etc) that are eligible for reports
• https://medium.com/hackcura/learning-path-for-bug-bounty-6173557662a7
• "bug bounty" site:http://gitbook.io
• https://github.com/ZephrFish/BugBountyTemplates + https://blog.zsec.uk/tag/reporting
• Z-winK University (ZU) - Bug Bounty Education
• https://github.com/cablej/hack-your-government
• https://gowthams.gitbook.io/bughunter-handbook
• Bug Bounty Tools
• https://mokhansec.medium.com/what-would-i-do-if-i-start-bug-hunting-from-0-again-79c7fa78b789 + https://m.youtube.com/user/Michael10Sommer/playlists
• https://github.com/vavkamil/awesome-bugbounty-tools
• https://github.com/daffainfo/AllAboutBugBounty
• https://www.jhaddix.com/post/the-secrets-of-automation-kings-in-bug-bounty

Capture the flag (CTF)

• https://captf.com/practice-ctf
• https://github.com/w181496/Web-CTF-Cheatsheet
• https://github.com/hanhanhanz/cyber-security-sources/blob/main/CTF.md
• https://github.com/orangetw/My-CTF-Web-Challenges
• finally understand HTTP2 request smuggling + https://sensepost.com/blog/2022/me-vs-request-smugglingpost
• https://github.com/jorgectf/Security-Resources
• https://github.com/devploit/ctf-awesome-resources
• https://github.com/perfectblue/ctf-writeups
• https://github.com/kareniel/awesome-ctf-challenge-design
• https://github.com/DownUnderCTF/Challenges_2022_Public
• https://github.com/justcatthefish/ctf-writeups

Writeup

• Gamma FinFisher Hack – 2014
• Hacking Team Hack – 2015
• https://www.pluralsight.com/courses/writing-penetration-testing-reports
• https://youtu.be/r-6LBjlM14Y
• https://diablohorn.com/2022/04/23/writing-a-zero-findings-pentest-report
• https://blog.intigriti.com/2019/12/30/the-best-write-ups-that-2019-brought-us
• https://github.com/Hackplayers/hackthebox-writeups
• https://github.com/xdavidhu/awesome-google-vrp-writeups
• reverse engineering a custom VM
• Common Security Issues in Financially-Oriented Web Applications | Soroush Dalili

Certification

• https://therealunicornsecurity.github.io/OSCP
• https://github.com/CyberSecurityUP/OSCE-Complete-Guide
• https://github.com/CyberSecurityUP/OSCP-Survival-Guide
• https://github.com/0xGodson/OSWE-PREPARATION
• https://github.com/CyberSecurityUP/eWPTX-Preparation
• https://github.com/CyberSecurityUP/eCXD-Preparation
• OSCP Review, Resources, and Tips
• https://github.com/six2dez/OSCP-Human-Guide
• https://github.com/areyou1or0/OSCE-Exploit-Development
• https://www.netsecfocus.com/oscp/2019/03/29/The_Journey_to_Try_Harder-_TJNulls_Preparation_Guide_for_PWK_OSCP.html
• https://niiconsulting.com/checkmate/2017/06/a-detail-guide-on-oscp-preparation-from-newbie-to-oscp
• OSCP Preparation Guide and Tips
• https://infosecskillsmatrix.com/rolesskills
• https://johnjhacking.com/blog/the-oscp-preperation-guide-2020
• https://rana-khalil.gitbook.io/hack-the-box-oscp-preparation
• https://github.com/noraj/OSCP-Exam-Report-Template-Markdown
• https://github.com/so87/CISSP-Study-Guide
• https://github.com/undergroundwires/CEH-in-bullet-points
• https://www.anshumanbhartiya.com/posts/prodsec-roadmap
• https://github.com/noraj/OSCP-Exam-Report-Template-Markdown
• https://github.com/C0nd4/OSCP-Priv-Esc

Methodology

• https://github.com/RackunSec/Penetration-Testing-Grimoire/tree/master/SOP
• https://github.com/Arudjreis/awesome-security-GRC
• https://shellsharks.com/threat-modeling
• Security Standards
• A reading list for software supply-chain security

Miscellaneous

• https://securityflow.io/roadmap
• https://github.com/sneakerhax/Runbooks
• https://github.com/enaqx/awesome-pentest
• https://github.com/hysnsec/awesome-threat-modelling
• https://www.peerlyst.com/posts/my-go-to-list-as-a-security-professional-steve-hollands
• https://github.com/gradiuscypher/infosec_getting_started
• https://github.com/alphaSeclab/awesome-forensics/blob/master/Readme_en.md + https://www.cct.lsu.edu/~golden/materials.html + https://www.memoryanalysis.net/amf
• https://raw.githubusercontent.com/n00py/ReadingList/master/gunsafe.txt
• https://github.com/zbetcheckin/Security_list
• https://github.com/coreb1t/awesome-pentest-cheat-sheets
• https://github.com/OlivierLaflamme/Cheatsheet-God
• Small scripts that make life better.
• https://noncombatant.org/2016/06/20/get-into-security-engineering + https://noncombatant.org/2016/01/27/code-newbie-podcast
• https://github.com/security-prince/Application-Security-Engineer-Interview-Questions
• Areas within InfoSec
• https://github.com/qazbnm456/awesome-web-security
• https://blog.p6.is/Web-Security-CheatSheet
• https://gist.github.com/mubix/5737a066c8845d25721ec4bf3139fd31
• https://github.com/jacobian/infosec-engineering
• https://github.com/ForgottenSec/Transitioning_Into_InfoSec
• https://github.com/daviddias/awesome-hacking-locations
• Catalog of Supply Chain Compromises
• https://labs.detectify.com/2021/09/30/10-types-web-vulnerabilities-often-missed
• https://github.com/hp271/awesome-dev-first-security
• https://klezvirus.github.io/Advanced-Web-Hacking/Serialisation
• https://github.com/kh4sh3i/RabbitMQ-Pentesting
• https://github.com/wiiwu959/Pentest-Record
• https://github.com/shramos/Awesome-Cybersecurity-Datasets
• https://github.com/imran-parray/Mind-Maps

Historic

• https://www.zdnet.com/article/a-decade-of-hacking-the-most-notable-cyber-security-events-of-the-2010s
• https://www.wired.com/story/meet-the-mad-scientist-who-wrote-the-book-on-how-to-hunt-hackers
• https://tldrsec.com/blog/appsec-cali-2019/#the-unabridged-history-of-application-security
• https://www.todaysoftmag.ro/article/3113/istoria-it-ului-clujean-in-documentele-serviciilor-secrete
• Stuxnet: Anatomy of a Computer Virus
• https://zalberico.com/about/#computers-software-and-companies
• http://addxorrol.blogspot.com/2021/02/book-review-this-is-how-they-tell-me.html + https://twitter.com/halvarflake/status/1364474027931222017
• I first learned hacking from underground BBSs.
• Let me explain why "Bugtraq" is probably the most important achievement in the world of cybersecurity.
• https://www.theverge.com/c/22889425/susy-thunder-headley-hackers-phone-phreakers-claire-evans
• Cult of the Dead Cow: How the Original Hacking Supergroup Might Just Save the World
• Top Ten Web Hacking Techniques List

Web Cache Deception

• https://twitter.com/naglinagli/status/1639343866313601024