Crypto

Openssl

- openssl
- openssl_engine

- rsa

Enumeration

Containers

Docs

- aws
- cewl
- dns
- docker_enumeration
- ffuf
- gobuster
- kerberoast
- kubectl
- ldap
- linux_basics
- microk8s
- nfs
- nikto
- nmap
- port_knocking
- rpcclient
- rsync
- rustscan
- shodan
Snmp

- onesixtyone
- snmpcheck

- websites
- wfuzz
- wpscan

Network_scanners

Windows

- bloodhound
- event_log
- manual_enum
- powershell
- rpcclient
- sysinternals
- sysmon
- vss

Exfiltration

Dns

- dns

Linux

- nc
- wget

Windows

- evil-winrm
- loot
- smb_connection

Exploit

CPUs

- meltdown

Binaries

- aslr
Buffer_overflow

Docs

- amd64
- amd64_instructions
- buffer_overflow
- cut_stack_in_half
- pwntools_specifics
- ret_address_reuse

- ropping

Canary_bypass

- canary_bypass

Format_string

- format_string

Integral_promotion

- integral_promotion

- plt_got
- r2
- ret2libc

Dns

- zone_transfer

Hashes

- collision

Imagemagick

- imagetragick

Java

OGNL

- cve_2022_26134

- ghidra_debug
- ghostcat
- log4shell
- spring4shell

Level3_hypervisor

Docker_sec

- docker

- kubernetes
- lxc
- microk8s

Linux

- capabilities
Dirty_pipe

- dirty_pipe

- exiftool
- groups
- ld_preload
- nfs_rootsquash
- overlayfs
Pkexec

- CVE_2021_4034

- polkit
- racing_conditions
- setcap
- shared_object_injection
- shell_shock
Sudo

- CVE_2019_14287
- CVE_2019_18634
- baron_samedit
- tokens

- wildard_exploitation

MacOS

Network

- mac_spoofing

Padding

- padbuster

Python

- code_injection
- jail_escape
- lib_hijack
- pickle
- pwntools
- pyc
- scapy

Samba

- smbmap

Sqli

- mssql
- no_sqli
- sqli
- sqlmap

Ssl_tls

- heartbleed

Web

Bypass_rate_limiting

- bypass_rate_limiting

- command_injection
Content_security_policy

- content_security_policy

- cookie_tampering
- csrf
Forced_browsing

- forced_browsing

- http_header_injection
Idor

- idor

Javascript

- bypass_filters
- prototype_pollution

Jwt

- jwt

- local_file_inclusion
- methodology
Nodejs

- deserialization

Php

- command_injection
- password_reset
- php_base64_filter
- php_image_exif
- php_user_agent_rce
- preload_lib
- unserialize

- re_registration
- remote_file_inclusion
Ssrf

- iframe
- ssrf

Ssti

- ssti

- url_forgery
- wordpress
- xpath
- xss
Xxe

- wp_xxe_
- xml_external_entity

Windows

Dll_hijacking

- dll_hijacking

Docs

- always_installed_elevated
- crackmapexec
- dpapi
- impacket
- llmnr
- lnk_exploit
- pass_the_hash
- password_in_registry
- potatoes
- printnightmare
- responder
- unquoted_path

Macros

- macros

Payloads

- windows_scripting_host

Print_nightmare

CVE-2021-1675

Nightmare-dll

- print_nightmare

Process_injection

- dll_injection
- process_hollowing
- shellcode_injection
- thread_hijacking

Service_escalation

- service_escalation

Zero_logon

- zero_logon

Yaml

- deserialization

Forensics

- ios
- kape
- ntfs
- oletools
- volatility
- windows_registry

Hashes

Bruteforce

- generate_wordlists
- haiti
- hashcat_utils
Password_cracking

- hydra
- john
- smb_challenge
- sucrack
- vnc

Password_guessing

- standard_passwords

Misc

Active_directory

- AD_CS
- active_directory
- ad_enumeration
- ad_misconfiguration
- ad_persistence
- gaining_foothold_AD
- lateral_movement

- bash
- clamav
- gitTools
- hadoop
- metasploit
Printer_hacking

- preta

- responder
- sandbox_evasion
- smtp
- snort
Telecommunications

_sipvicious

.github

ISSUE_TEMPLATE

- bug-report
- custom

Sipvicious

- sip_vicious

Threat_intelligence

- isac
- loki
- osquery
- pithus
- siem
- splunk
- yara

Wifi

- airmon-ng

Osint

- recon_ng
Social_engineering

- gophish
- phishing_domain

- spiderfoot
- theharvester

Persistence

- bashrc
- crontab
- meterpreter
- persistence
- wmi

Post exploitation

Seatbelt

.github

ISSUE_TEMPLATE

- bug_report
- feature_request

- CHANGELOG
Seatbelt

Commands

Windows

EventLogs

Output

Bc_security

Docs

- c2
- crackmapexec
- empire
- ids_ips_evation
- linux
- metasploit
- mimikatz
- mitm
- nfs_root_squash
- powershell
- secretsdump
Windows

- antivirus_evasion
- applocker
- evade_event_tracing
- living_off_the_land
- pass_the_hash
- powershell_logs
- registry
- sebackupprivilege
- user_account_control

- pivoting
Priv_esc

Docs

- linux_priv_esc
- pspy
Windows

- add_user
- windows_priv_esc

Kernel-exploits

Privesc-scripts

Docs

- get_script_onto_target

Suid

Reverse engineering

Android

- misc

Docs

- deobfuscation
- dll_reversing
- firmware
- function_mangling
- scada

Java

- krakatau

Reverse shells

Docs

- evil-winrm
- msfconsole
- msfvenom
- netcat
- powershell
- shell_upgrade
- socat
- webshell

- firewalls
Windows

Stego

Docs

- outguess
- remnux
- stegbrute
- steghide
- stegoveritas
- zsteg

- Windows Registry
  - Regedit Keys
  - Paths
    - Transaction Logs
    - Backups
  - Data Acquisition
  - System Information
    - Control Sets
  - Autostart Programs
  - Recent Files
  - ShellBags
  - Last Open/Saved/Visited Dialog MRUs
  - Explorer Address/Search Bars
  - User Assist
  - Shim Cache
    - AmCache
  - Background Activity Monitor/Desktop Activity Moderator BAM/DAM
  - Devices

# Windows Registry

## Regedit Keys

- HKEY_CURRENT_USER (HKCU), inside HKU
- HKEY_USERS (HKU)
- HKEY_LOCAL_MACHINE (HKLM)
- HKEY_CLASSES_ROOT (HKCR), stored in HKLM and HKU
  - `HKEY_CURREN_USER\Software\Classes` for settings of interactive user
  - `HKEY_LOCAL_MACHINE\Software\Classes` to change default settings
- HKEY_CURRENT_CONFIG

## Paths

- `C:\Windows\System32\Config`

  - Default -> `HKEY_USERS\DEFAULT`
  - SAM -> `HKEY_LOCAL_MACHINE\SAM`
  - SECURITY -> `HKEY_LOCAL_MACHINE\Security`
  - SOFTWARE -> `HKEY_LOCAL_MACHINE\Software`
  - SYSTEM -> `HKEY_LOCAL_MACHINE\System`

- `C:\Users\<username>\`

  - NTUSER.DAT -> `HKEY_CURRENT_USER` , hidden file

- `C:\Users\<username>\AppData\Local\Microsoft\Windows`

  - USRCLASS.DAT -> `HKEY_CURRENT_USER\Sofware\CLASSES`, hidden file

- `C:\Windows\AppCompat\Programs\Amcache.hve`

### Transaction Logs

- Transaction `<name of registry hive>.LOG` of the registry hive
- Saved inside the same directory which is `C:\Windows\System32\Config`, as the hive which was altered.

### Backups

- Saved every ten days
- Look out for recently deleted or modified keys
- `C:\Windows\System32\Config\RegBack`

## Data Acquisition

- Tools
  - Autopsy
  - FTK Imager, does not copy `Amcache.hve`
  - KAPE, preserves directory tree
  - `Registry Viewer`
  - `Zimmerman's Registry Explorer`, uses transaction logs as well
    - `AppCompatCache Parser`
  - `RegRipper`, cli and gui

## System Information

- OS Version -> `SOFTWARE\Microsoft\Windows NT\CurrentVersion`
- Computer Name -> `SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName`
- Time Zone `SYSTEM\CurrentControlSet\Control\TimeZoneInformation`
- Network Interfaces -> `SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces`
- Past connected networks -> `SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\Unmanaged` and `SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\Managed`
- Services -> `SYSTEM\CurrentControlSet\Services`
  - Service will start at boot with `start` key value `0x02`
- Users, SAM -> `SAM\Domains\Account\Users`

### Control Sets

- `ControlSet001` -> last boot
- `ControlSet002` -> last known good

- `HKLM\SYSTEM\CurrentControlSet` -> live

- Can be found under:

  - `SYSTEM\Select\Current` shows the used control set
  - `SYSTEM\Select\LastKnownGood`

## Autostart Programs

- `NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Run`
- `NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\RunOnce`
- `SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce`
- `SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run`
- `SOFTWARE\Microsoft\Windows\CurrentVersion\Run`

## Recent Files

- `NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs`, e.g. xml, pdf, jpg
- Office files -> `NTUSER.DAT\Software\Microsoft\Office\VERSION`, `NTUSER.DAT\Software\Microsoft\Office\15.0\Word`
- Office 365 -> `NTUSER.DAT\Software\Microsoft\Office\VERSION\UserMRU\LiveID_####\FileMRU`

## ShellBags

- `USRCLASS.DAT\Local Settings\Software\Microsoft\Windows\Shell\Bags`
- `USRCLASS.DAT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU`
- `NTUSER.DAT\Software\Microsoft\Windows\Shell\BagMRU`
- `NTUSER.DAT\Software\Microsoft\Windows\Shell\Bags`

## Last Open/Saved/Visited Dialog MRUs

- `NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePIDlMRU`
- `NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRU`

## Explorer Address/Search Bars

- `NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths`
- `NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\WordWheelQuery`

## User Assist

- GUI applications launched by the user
- `NTUSER.DAT\Software\Microsoft\Windows\Currentversion\Explorer\UserAssist\{GUID}\Count`

## Shim Cache

- Application Compatibility, AppCompatCache
- `SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache`
- Use `AppCompatCacheParser.exe --csv <path to save output> -f <path to SYSTEM hive for data parsing> -c <control set to parse>`

### AmCache

- Information about recently run applications on the system
- `C:\Windows\appcompat\Programs\Amcache.hve`
- Last executed app -> `Amcache.hve\Root\File\{Volume GUID}\`
- Saves SHA1 of the last executed app

## Background Activity Monitor/Desktop Activity Moderator BAM/DAM

- Saves full path of executed apps
- `SYSTEM\CurrentControlSet\Services\bam\UserSettings\{SID}`
- `SYSTEM\CurrentControlSet\Services\dam\UserSettings\{SID}`

## Devices

- Identification
  - USB -> `SYSTEM\CurrentControlSet\Enum\USBTOR`, `SYSTEM\CurrentControlSet\Enum\USB`
- Device name -> `SOFTWARE\Microsoft\Windows Portable Devices\Devices`
- First time connected -> `SYSTEM\CurrentControlSet\Enum\USBSTOR\Ven_Prod_Version\USBSerial#\Properties\{83da6326-97a6-4088-9453-a19231573b29}\0064`
- Last time connected -> `SYSTEM\CurrentControlSet\Enum\USBSTOR\Ven_Prod_Version\USBSerial#\Properties\{83da6326-97a6-4088-9453-a19231573b29}\0066`
- Last removal time -> `SYSTEM\CurrentControlSet\Enum\USBSTOR\Ven_Prod_Version\USBSerial#\Properties\{83da6326-97a6-4088-9453-a19231573b29}\0067`