Hello, Open World

Search Ctrl K

Hello, Open World

Search Ctrl K

Published

Hello, Open World

0. Clouds

0.1. Learn Cloud

0.1.1. General

0.1.1.1. Clouds

0.1.1.2. Clouds testing Scoping

0.1.1.3. Associate roles and services

0.1.2 Azure

0.1.2.1. Azure General

IAM

How does a user authenticate to the cloud?

OpenID Connect

Security Token Service

AZ CLI

AZURE CLI Tab Completion

Azure Network

Azure Powershell

Azure REST API with Azure CLI

Built-in Permissions

Microsoft Graph

Tenant, Subscription, Resource

0.1.2.2. Azure Services

Active Directory Federation Services (ADFS)

Azure Resource Manager

Azure SQL

Azure Storage Account

Azure Virtual Machine

SDKs

Azure Services

0.1.3 AWS

0.1.3.1. AWS Resources

0.1.3.2. AWS Cloud Services

Resources

0.2. Attack Cloud

0.2.1. General

0.2.1.1. Attack Clouds

0.2.1.2. Search for Credentials - Services

0.2.1.3. Search for Credentials - File

0.2.2. AWS

flaws.cloud

AWS Practice - flaws.cloud

AWS Practice 2 -flaws2.cloud

Tips

AWS Access Key to Web

AWS IAM

AWS Signed API Request

AWS Signing and Authenticating REST requests

0.2.2.1. AWS - Search for Creds

0.2.2.2. AWS Enumeration Process

AWS -Tools

0.2.3. Azure

PwnedLabs

0. Azure - Readme

1. Azure Blob Container to Initial Access

2. Unlock Access with Azure Key Vault

3. Azure with Bloodhound and Microsoft.Graph

4. Loot Exchange, Teams and SharePoint with GraphRunner

5. Unmask Privileged Access in Azure

6. Azure Recon to Foothold and Profit

8. Execute Azure Credential Shuffle to Achieve Objectives

Azure - Search for Creds!

Enumerate with credentials

Enumerate without Credentials - Inside of Virtual Machine

Tool - AADInternal

Tool - Azrecon.sh

Tool - AZSubEnum - Subdomain Enum

Tool - BloodHound AzureHoundCustomQuery

Tools - Password spray

0.2.4 GCP

1. GCP - Search Creds

1. Docker

1.1 Learn Docker

Docker- Kali

2. Web

2.1 Learn Web

0. Web Architecture 101

1. Attack Web application

2. DNS Security - Defen ding Against Attacks

3. Load Balancer Security- Defending Against Attacks

4. Web Application Server Security- Defending Against Attacks

4a. RCE

5. Databases

6. Web Caching Security- Attacks & Mitigation Strategies

7a. Introduction to Job Queue Security

8. Microservices Security- Protecting APIs & Authentication Mechanisms

8a. JWT

8b. OAuth

8c. SAML

9. Introduction to Data Pipeline Security

10. HTTP Headers

11. Web Assembly (WASM)

2.2 Attack Web

Data Wrapper

Bash Data Wrapper

Java Data Wrapper

Javascript Data Wrapper

Perl

PHP Data Wrapper

Debugger and Logger

Debugger - vscode

Debugger - .net - DNN

Debugger - Apache Debugger start

Debugger - Docker and NodeJS

Debugger - ERPNext Frappe

Debugger - Java - VSCODE

Debugger-Docker

Debugger-Maria

Debugger-VSCODE-Python

Logger - MongoDB

Logger - MS SQL Server

Logger - mysql

Logger - Nginx

Logger - Oracle Database

Logger - PostgreSQL

Logger - SQLite

Logger-PHP

Deserialization - .net

Black Box Appraoch

Debug with dnspy - DNN

White Box Approach

XML Deserialization Vulnerabilities

GraphQL

0. GraphQL Attack Flow

0. GraphQL Resources

1. GraphQL

2. GraphQL Endpoints?

3. Introspection - Getting information

4. Bypass

5. Connection Type

6. 'Something' doesn't exist on type 'Query'

JAVA

Java 101

Java Extenions

JAVA Servlets and Key Methods

JAVA Web Testing - White box

Javascript

Session Riding CSRF

CSRF

javascript payload session riding - CSRF

Javascript, Nodejs, Express, Webpack

MYSQL

PHP

postgresSQL

0. PSQL Extensions attack - UDF

1. PSQL Large Object exploit

1.1 PSQL Large Object Shell -linux

1.2 PSQL Large Object Shell- Windows

Large Object Reverse shell Python code

poc.c Local execution arking.

psql payload

PSQL Payload copy from, copy to

PSQL payload- RCE

psql poc.c - reverseshell

Remote execution py

Prototype

Example

Main Prototype pollution

Regex

SOP_CORS

SSRF

SSTI

Server Side Template Injection

SSTI Payload

web_pentesting_checklist

Docker

WAF

WASM

WebSocket

2.3. Web3

Learn Web3

1. Learn Web3 (Using Coinbase) Like Systems Engineers

1a. Web3 architecture using Coinbase Wallet

1b. Local Key Storage

1c. Transaction Signing

3. LLM

3.1 Learn LLM

3.2.1 RAG

0. Retrieval-Augmented Generation

1. Text Extraction

2. Text Chunking

3. Embedding Chunks and Storing in Vector DB

4. Querying and Retrieving Relevant Context

5. RAG interface

6. main

7. Ollama

3.2.2 Learn RAG_CAS

rag_backend

uploader.py - CLI TOOL

docker-compose.yml

Agentic AI

Model Context Protocol

3.4 Attack LLM

3.4.1. Test Logging Template

3.4.2. AI Red Teaming

3.4.3. LLM Questioning Playbook

3.4.4. Top Commenting Patterns

3.5 n8n

CLAUDE_DESKTOP_N8N_MCP_SETUP

Resources

4. Kubernetes

Kubernetes

5. Linux thing

Linux Internal Device scan

6. Windows OS

6.1 Learn Windows

1. Windows Basic

Windows Authentication System

LSASS - Local and Domain

Security Account Manager - Local

Windows Credentials Manager - Local

0. Resources

1. Portable Executable Structure

2. From PE to Memory

3. Flow of System Calls - ntdll.dll, kernel32.dll

4. Win32 API and Windows Native API

4a. NTDLL.DLL - Overview and Functionality

5. Syscalls Flow

5a. Syscalls Deep dive

5b. From Memory - PEB_TEB

6. Execution

7. Platform Invoke .net specific

SC

USB - How does it work?

Windows Authentication Systems ( Pending)

Windows Management Instrumentation (WMI)

Windows Remote Management

Windows User Rights

WMIC

1a. Windows Defense Mechanism

1. EDR Intro

1. Let's understand EDR like a blue team

2. Let's understand EDR like a red team

2. EDR Evasion

0. Binary creation and insertion

00. Resources

1. Download Prevention & Bypass Techniques

1a. AES, RC4, XOR encryption

1b. XOR-Based Self-Decrypting Payload (With Memory Execution)

1c. RC4-Based Self-Decrypting Payload (C++)

1d. AES-Based Self-Decrypting Payload (C++)

1e. Advanced UPX Methods for Modifying Binary Structure

2. Direct syscalls intro

2a. Direct Syscalls cpp

2b. Indirect Syscalls intro

2c. Indirect Syscalls -Tool

3. API Hooking

0. Windows defense mechanism

Bypass EDR!!

Windows Code Integrity Engine

2. Online article deep dive

CVE-2016-6563

CVE-2024-9473

Part 1 - Bypassing Windows Defender Application Control with Loki C2

6.2. Active Directory

6.2.1. Attack Active Directory

1. External Initial Access

2a. Credential Harvesting

2b. Gaining Access Without Credentials

3. Entering a Domain-Joined Machine

4. Enumerating a Domain-Joined Machine

5a. Privilege Escalation

5b. Establishing Persistence

6. Enumerating Forest and Trust Relationships

7. Pivoting to Other Machines on the Network

8. Owning a Domain Admin

10. LDAP

11. Powerview

6.3 Attack Windows

Enumerate Windows

Windows Internal Device Scan

8. Threat Modeling

Medical Devices

999. Stuff

Attack Wireless

Wireless

Automation

Automate OSWE starting routine

Learn Programming

Learn C_C++

0. Cross Compiling - From Linux to Windows binary

Learn Python

Threading

uv

Venv

Learn Rust

Rust Cross-Compilation Guide (Linux to Windows)

Publish Stuff

Digital Garden and github issue

Digital Garden Resources

Publish free

Use Gemini with Obsidian

Syntaxes

Chisel

Tunneling

9999. Projects with Kids

Make Water

Start a Fire

Select a result to preview

Enter to select

to navigate

ESC to close

Venv

python3 -m venv venv
source venv/bin/activate
pip3 install -r requirements.txt

deactivate

Connected Pages

Depth

Pages mentioning this page

Tools - Password spray