Note
This project is shifted Here on GitBook but this repository still continue.
please check out my GitBook aswell.
My Cyber Security Store
These are my Cyber Security notes that I have gathered from various sources,
you can contribute to this repository too!
Index
Learn To Use WSL
1. Installation
1.1 Enable these two features in Windows Feature app.
• Windows Subsystem for Linux
• Virtual Machine Platform
1.2. Open CMD as adminstrator and type wsl --install.
1.3. Restart your pc
1.4. Go to Microsoft Store & install these two apps
• Windows Subsystem for Linux
• Your favourite Linux Distribution (Ubuntu, kali Linux, debian, oracle, arch etc)
1.5. open the Linux app and install the linux distribuation.
1.6. Restart your pc
1.7. Installation Complete.
2. Extra Wsl commands to get started
2.1 wsl --update : To update the wsl version.
2.2 wsl --version, -v : To get all the info about wsl, wslg, kernel version.
2.3 wsl --list, -l : To get list of all distribution installed.
2.3.1 wsl --all : List all distributions, including distributions that are currently being installed or uninstalled.
2.3.2 wsl --running : List only distributions that are currently running.
2.3.3 wsl --quiet, -q : Only show distribution names.
2.3.4 wsl --verbose, -v : Show detailed information about all distributions.
2.3.5 wsl --online, -o : Displays a list of available distributions for install with 'wsl.exe --install'.
2.4 wsl --set-default, -s <Distro> : to set default distro.
3. Wslg installation
3.1 Open linux distribuaton & update & upgrade your distro.
3.2 Sudo apt install kali-win-kex
3.3 After installing win-kex fill required information
3.4 To start gui type Kex in terminal.
3. Additional info in Wslg
Mode:
[none] : Window Mode (default)
--esm : Enhanced Session Mode - Launch Win-KeX desktop in a dedicated window using Windows native RDP
--sl : SeamLess mode - Seamlessly integrate Win-KeX into the Windows desktop
--win : WINdow mode - Launch Win-KeX desktop in a dedicated window
Command:
[none] : Start Win-KeX server and launch Win-KeX client
--start : Start Win-KeX server
--start-client : Start Win-KeX client
--wtstart : Start Win-KeX server and launch Win-KeX client in Windows Terminal session
--stop : Stop Win-KeX server
--status : Show Win-KeX server status
--kill : Stop Win-KeX server and kill all related processes
--passwd : Set Win-KeX server password
--start-sound : Start Windows sound server
--stop-sound : Stop Windows sound server
--wslg-restore : Restore WSLg unix socket
--wslg-remove : Remove WSLg unix socket
--wslg-status : Display status of WSLg unix socket
--version : Display Win-KeX version
--help : Display this help
(Optional) Parameters:
--ip -i : Use container IP address instead of "localhost"
--multiscreen -m : Optimized for multiscreen
--sound -s : Sound support
--nowgl -n : Disable Windows OpenGL
--norc -r : Disable Win-KeX client reconnecting - once is enough!
--wait -w : Wait longer for desktop to start when in SL mode
--verbose : Verbose output
Examples:
kex -s : Start Win-KeX server in window mode and launch Win-KeX client with sound support
kex --sl -s : Start Win-KeX in seamless mode and launch Win-KeX client with sound support
kex --esm -i -s : Start Win-KeX in Enhanced Session Mode with ARM workaround and launch Win-KeX client with sound support
sudo kex : Start Win-KeX server as root in window mode and launch Win-KeX client
Books
Self-Help Books
Bug-Bounty Material
My Methodology
• Always try to chain vulnerability one to another to increase the severity
• finding vulnerability is half the war and then selling that vulnerability is half war
• Use a proxy and check all the resources that are being called when you visit a site or application
1. XSS (Cross Site Scripting):
• find paramter/enpoints/input fields
• try different payloads according to the waf
• image and javascript: payload are most common
2. CSRF(Cross site request forgery):
• Allow's an attacker to perform an action they don't intend to perform
• delete a/c, change email, change password, if old password not req,
add new role if role system exist, change normal information, last/first name,
change profile picture/delete it post xss to csrf
• CSRF Bypasses: Delete token and send request with blank parameter
Delete token parameter
Change request from POST to GET
Change Body encoding
Replace token with random value
Delete referee or use this line in CSRF file | <meta name="referrer" content="no-referrer">
Use another user token
Changing one character in token, Content length bypass
3. IDOR(Insecure direct object referance):
• Attacker exploit this vulnerability to access unauthorize data by manupilating parameters in request
• Always required two accounts for ID paramters
• check for id which seems in order, in victim account copy to attacker account and id response is 200 idor is successfull
• id types:-
Decimal shorter than 8 digits
decimal 8 or more digits
Name/email
uuid
other - non-bruteforceable
Hexadecimal 8 more digits
other - bruteforceable
hash
4. SSRF(server side request forgery):
• It's a vulnerability that allows an attacker to cause the server-side application to make request to unintended location
5. OpenRedirect:
• Mostly leverage this vulnerability while loging/logout page may redirected to another page.
• Observe the url in burpsuite
• check out github file for eg: https://github.com/Raunaksplanet/My-CS-Store/blob/main/Bug%20Bounty/Open-Redirect-Example.txt
6. Account takeover:
• most vulnerable functionality is password reset
• Ways of ACT
1. Oauth
2. JWT verification
3. No rate limit on OTP verification on password reset
5. OTP Bypass Through Response Manipulation
6. idor
• offten times happen due to IDOR or unsecured endpoint
• check the response and source code values that can be hardcoded
8. FIle upload vulnerability
• Mostly found in support chat file upload
• upload normal and file and intercept the request, file data can be changed to malicious content using burpsuite
• Some times using developer tool to change the file type from img to text can lead to xss due to less checking at backend.
9. HTTP parameter pollution
• https://twitter.com/i/u?iid=F6542&uid=1134885524&nid=22+26&sig=647192e86e28fb6691db2502c5ef6cf3xxx
• Notice the parameter UID. This UID happens to be the user ID of the currently signed-in Twitter account.
After noticing the UID, Tasci did what most hackers would do—he tried changing the UID to that of
another user, but nothing happened. Twitter just returned an error. Tasci tried adding a second UID parameter
so the URL looked like this Success! He managed to unsubscribe another user from their email notifications
| Report Title |
Report Link |
| No Rate Limit Vulnerability Report |
View Report |
Some more important topics for Cyber Security
Roadmap By Me
All the resources, Roadmap, CTF, programming knowledge, YT channels related to Cyber Security
are documented here.
Learn Linux
-
Learn Linux Command Line:
-
Learn Linux File System:
-
Linux Learning/Helping Resources:
Learn Programming Languages
-
C++:
-
Java:
-
Python:
-
HTML, CSS:
Languages required in CyberSec
Web Development:
1. HTML
2. CSS
3. JavaScript (JS)
4. PHP
5. MySQL
6. TypeScript
General Programming:
1. C
2. C++
3. Java
4. Python
5. Rust
6. Go
7. C#
Scripting:
1. Bash
2. PowerShell
3. Ruby
4. Perl
5. Lua
6. Python
7. VBScript
Configuration/Markup:
1. YAML
2. JSON
3. XML
4. Markdown
5. TOML
- JavaTpoint
- W3Schools
- GeeksforGeeks
- Tutorialspoint
- HackerRank
- Programmiz
Intentionally Vulnerable Applications to Practice or CTF Websites
CS Certifications
1. Comptia: A+, Security+, Network+, Linux+, Pentest+, CySa+, casp+, ITF+
2. EC-COUNCIL: CEH
3. Ine-Security: eJPT, eWPTX
Learn BurpSuite
1. maltego, BurpSuite, Metasploit, Air-crack-ng, JohnTheRipper
2. SQLMap, netcat, hashcat, kismet, wifite
3. dirbuster, nikto, sublister, nmap, FFUF
4. Katana, BinWalk, Masscan, Hydra, Hashid
5. Crunch, snort, ltrace, subfinder, Rust Scan
6. HTTTPX, Zap, FeroxBuster, Steghide, Which
7. Wheris, find, locate
评论