🌐eJPT References

Introduction

• The Conscience of a Hacker

• Wireshark

  • Learn Wireshark

• Binary Hex Converters

Networking

• IP Header

• TCP/IP Model Stack - Layers & Protocols

  • TCP/IP Model

• ISO/OSI Model

  • TCP/IP vs OSI Model

  • Windows Network Architecture and the OSI Model

• IPv4 vs IPv6

  • Online IP Subnet Calculator

• IPv6 address

  • IPv6 Explained for Beginners

  • How to find IPv6 Prefix

  • IPv6 Subnet Calculator

• Basic Computer Networking

• IP Routing

  • Router vs Switch

  • Layer 2-3 Switching

  • ARP

• TCP vs UDP

  • guru99 - TCP 3-Way Handshake

  • mlytics - TCP 3-Way Handshake

• Firewall

  • Top free Firewall Software

  • The 5 types of Firewalls

  • Network design: Firewall - IDS - IPS

  • IDS vs IPS vs Firewall

  • Firewall vs WAF

  • LinuxSecurity HOWTOs

  • What is NAT

• DNS

  • What is DNS - by Cloudflare

  • DNS Explained

  • DNS Resolution

  • Root name servers

• Wireshark Tool

  • Wireshark Docs

  • Wireshark User's Guide

  • Display filter reference

Web Applications

• WebApp vs WebSite
• HTTP/1.x

  • HTTP Messages
  • HTTP Headers
  • HTTP Request methods
  • HTTP Response status codes
  • RFC 7231
• HTTP vs HTTPS
• High Performance Browser Networking - Book
• What is HTTPS

  • TLS - Transport Layer Security
• netcat Tool

  • netcat Cheat Sheet
  • Burp Suite - Documentation
  • OpenSSL Cookbook
• HTTP Cookies

  • RFC 6265.
  • Set-Cookie header
  • Web Authentication - Cookies vs Tokens
  • Session ID
  • Session Cookies
  • Cookies and Session Management
  • HTTP Cookies & Sessions - video by HackerSploit
• SOP

  • Same Origin Policy - PortSwigger
• Burp Suite by PortSwigger

  • Burp Suite Tools
• ZAP by OWASP Foundation
• What is a Proxy Server

Assessment Methodologies

Information Gathering

• Passive Information Gathering

  • Wappalyzer
  • whois.domaintools.com
  • netcraft
  • dnslytics.com
  • dnsrecon tool
  • dnsdumpster.com
  • wafw00f tool
  • sublist3r tool
  • google.com
  • Google Dorks Cheat Sheet
  • Google Hacking Database
  • theHarvester tool
  • haveibeenpwned.com
• Active Information Gathering

  • Ethical Standards
  • The Pentester's Code of Conduct
  • DNS Records - by Cloudflare
  • ZoneTransfer.me
  • DNS zone transfer and zone file
  • dig
  • dig Command Examples - by Vivek Gite
  • fierce
  • nmap

    • Nmap Command Examples - by Vivek Gite
    • NMap CheatSheet
• Ethical Hacking Footprinting

  • fping
  • zenmap
  • nmap automator
  • Rustscan
  • Autorecon

Enumeration

• Enumeration

  • SMB Enum

    • nmap Scripts
    • smbmap
    • smbclient
    • Metasploit
    • msfconsole
    • rpcclient
    • enum4linux
    • SMB named pipes
    • smtp-user-enum
  • hydra
  • Passwords word lists
  • FTP Enum

    • FTP Windows Enum
    • ftp command
  • SSH Enum

    • nc/netcat
    • ssh
  • What is HTTP?

    • httpie
    • dirb
    • browsh
    • curl
    • whatweb
  • What is MySQL?

    • MySQL Enum
    • mysql

Vulnerability Assessment & Auditing

• Vulnerability
• NIST - NVD
• CVEs & NVD Process
• Zero-Day
• Vulnerability Assessment
• exploit-db.com

  • searchsploit
• What is Cybersecurity? - IBM

  • PII
  • CIA Triad
  • Defense in Depth
  • Risk Management
• Compliance

  • Cybersec Frameworks
• Auditing

  • SCAP
  • OpenSCAP
  • What is a SCAP Scan
• Nessus

  • Nessus Essentials

Host & Network PenTesting

Windows System Attacks

• Host and Network Based Attacks by Tim DeWeese
• Microsoft Learn - IIS

  • davtest
  • cadaver
  • msfvenom
• Microsoft Learn - SMB

  • PsExec
  • impacket-scripts
  • PsExec.py Linux
  • CVE-2017-0143 - EternalBlue

    • AutoBlue-MS17-010
• Microsoft Learn - RDP

  • How to Exploit the BlueKeep Vulnerability with Metasploit - Pentest-Tools
  • Bluekeep CVE-2019–0708 Metasploit Module on Windows 7
• Microsoft Learn - WinRM
• CrackMapExec
• evil-winrm
• Privilege Escalation - Windows Kernel Exploits

  • windows-kernel-exploits
  • Windows-Exploit-Suggester
  • Windows Privilege Escalation - Resources - S1REN
• Microsoft Learn - UAC

  • UACMe
• Microsoft Learn - Access Tokens

  • Access Tokens - HackTricks
  • Abusing Tokens - HackTricks
  • Understanding Impersonation via Access Tokens
• ADS Alternate Data Streams
• SAM Database

  • LSA
  • LSA protection by default in Windows Canary build - 2023
• Windows authentication attacks - part 1 - RedForge

  • LM, NTLM, Net-NTLMv2, oh my!
  • mimikatz
  • Pass-the-hash
  • Alternative ways to Pass the Hash

Linux System Attacks

• Linux and GNU
• Apache Web Server
• CVE-2014-6271 - ShellShock

  • Shellshock exploit + vulnerable environment
• Linux Privilege Escalation: Linux kernel / distribution exploits

  • linux-kernel-exploitation links
  • linux-exploit-suggester
  • Basic Linux Privilege Escalation
  • Linux Privilege Escalation - Resources - S1REN
• Cron Jobs

  • Crontab Editor
• SUID

  • euid-ruid-suid - HackTricks
• Understanding /etc/shadow file format on Linux

  • Creating yescrypt, MD5, SHA-256, and SHA-512 Password Hashes
  • yescrypt

Network Attacks

• Man in the Middle (MITM) Attacks

  • What is MITM
• tshark
• arpspoof
• WiFi - 802.11 Frame Types and Formats

Metasploit

• Metasploit Framework

  • Metasploit Documentation
  • Architecture
  • Modules
  • Payloads
  • MSFConsole
  • Workspaces
  • Database Usage
  • Port Scanning
  • Nessus - Import
  • WMAP
  • Client-Side Attacks

    • Types of client side attacks
  • Msfvenom

    • Python HTTP Server
    • How to use MSFvenom
  • Writing Resource Scripts
  • Exploits
  • Post Exploitation

    • Meterpreter
    • Privilege Escalation
    • Incognito
    • PSExec Pass-the-hash
    • Enabling RDP
    • Pivoting
    • Keylogging
• Metasploit in Kali Linux
• Metasploit Unleashed – Free Ethical Hacking Course by OffSec
• Armitage GUI

  • Armitage
• PTES

  • Guide to Modern Penetration Testing - Infopulse
• MSF Installer
• How to Use Metasploit in Kali Linux + Metasploitable3
• Metasploitable3 - rapid7 Github
• Shikata Ga Nai Encoder Still Going Strong - Mandiant
• Haraka
• Methods Used by Linux for Hashing Passwords

Exploitation

• Exploitation PTES
• Banner Grabbing
• Nmap Scripting Engine
• exploit-db.com

  • Dorks - Google Hacking Database
• Rapid7 db
• Searchsploit
• Cross Compile to Win from Linux

  • MinGW-w64
  • ExploitDB bin-sploits

Shells

• Shells - HackTricks

  • Bind & Reverse Shells - Hacking with Netcat
  • PayloadsAllTheThings - Reverse Shell Cheatsheet
  • Reverse Shell Generator
• Reverse Shells - 0xffsec

  • Reverse-shell via Windows one-liner
• PowerShell-Empire

Defense Evasion

• Metasploitable2
• Metasploitable3
• What is Defense Evasion - Huntress

  • Defense Evasion - MITRE ATT&CK
  • Antivirus Detection Methods
  • Shellter
  • Invoke-Obfuscation

Post Exploitation

• Post-Exploitation

  • Ignitetechnologies/Privilege-Escalation
  • PayloadsAllTheThings - Windows - Privilege Escalation
  • PayloadsAllTheThings - Linux - Privilege Escalation
  • PEASS-ng

    • winPEAS
    • linPEAS
  • JAWS - Just Another Windows (Enum) Script
  • LinEnum - rebootuser
• Python3 - http.server
• tmux

TTY Shells

• Full TTY Shells - HackTricks
• Fully Interactive TTYs - 0xffsec

  • stty

Privilege Escalation

• PrivescCheck
• Linux Privilege Escalation Guide(Updated For 2023 - by Rashid-Feroze
• Linux Privilege Escalation using SUID Binaries

  • FallOfSudo
  • GTFOBins

Persistence

• Persistence - MITRE ATT&CK
• Enabling Remote Desktop - OffSec
• SSH Penetration Testing
• Scheduled Task/Job - MITRE ATT&CK

Cracking Hashes

• John The Ripper
• Hashcat

Pivoting

• Pivoting

Social Engineering

• What is Social Engineering?
• FBI IC3 Releases 2022 Internet Crime Report
• Trendmicro Security 101: Business Email Compromise (BEC) Schemes
• CEO Fraud Attacks - KnowBe4
• NIST SP 800-115 - Technical Guide to Information Security Testing and Assessment
• Social Engineering Penetration Testing: Attacks, Methods, & Steps - Purplesec.us
• Gophish

  • Creating the Gophish Demo

Web App PenTesting

• OWASP TOP 10

  • SQL Injection - OWASP

    • What is a SQLi? - PortSwigger
    • SQLi CheatSheet - PortSwigger
  • XSS - OWASP

    • How does XSS Work? - PortSwigger
    • XSS Cheatsheet - PortSwigger
• PortSwigger Web Security Academy
• HTTP Protocol

  • RFC 9110 - HTTP Semantics

Vulnerable Web Apps

• bWAPP

  • Setting Up OWASP bWAPP With Docker - HackerSploit
• OWASP Juice Shop
• Damn Vulnerable Web Application (DVWA)
• Mutillidae II

Tools

• Gobuster
• ffuf
• Burp Suite by PortSwigger
• ZAProxy
• Nikto
• SQLMap

  • SQLMap Cheatsheet
• XSSer
• WPScan

---