Giters

Striving-to-learn / Cybersecurity-Resources

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Getting Started in Cybersecurity and Hacking

Introduction

Getting Started in Cybersecurity

Entering the world of cybersecurity can feel overwhelming with numerous resources available. This guide simplifies the journey for newcomers interested in technology, cybersecurity, ethical hacking, and bug bounty hunting.

Table of Contents

Getting Started

Books and PDFs

Legal PDFs about Programming, Networking, IT, Cybersecurity, and Penetration Testing

Educational Channels

Hacking/Cybersecurity Youtubers:

  • Hak5 Hacking hardware, cybersecurity news, hacking tech, and general hacking tutorials.
  • Webpwnized Hacking tutorials, CTFS, Linux.
  • Sstec Hacking tutorials, CTFS, and projects.
  • Hackhappy Hacking tutorials, CTFS, and Linux.
  • Derek Rook CTFS (Capture the Flags).
  • John Hammond Programming, hacking tutorials, malware analysis, CTFS, Linux, and careers.
  • Nullbyte Hacking tutorials, cybersecurity for ethical hackers and programmers.
  • Hackersploit Penetration testing, web application hacking tutorials, Linux, malware analysis.
  • InsiderPHD How to get started with bug bounty hunting.
  • STOK Bug bounty tutorials, vulnerability analysis, hacking tools, and hacking methodology.
  • Liveoverflow Hacking tutorials, CTFs/writeups, HackTheBox, web programming.
  • IppSec Labs and capture-the-flag tutorials, HackTheBox, etc.
  • Peter Yaworski Web-application hacking tips and interviews.
  • Bugcrowd Bug bounty methodology and interviews.
  • The Cyber Mentor Ethical hacking, web application hacking, hardware tutorials, tech reviewer.
  • Nahamsec Educational hacking and bug bounty videos and career advice.
  • Simply Cyber Helps people with cybersecurity career development, and has a daily cybersecurity news video.
  • Black Hat Technical cybersecurity conferences.
  • DEFCON Technical Cybersecurity Conference.
  • 13Cubed Videos on tools, forensics, and incident response.
  • BlackPerl Malware analysis, forensics, and incident response.
  • Computerphile Programming, programming concepts, tech concepts, networking, programming and hacking, Linux.
  • Security Weekly Interviews with cybersecurity figures.
  • SecurityNow Cybercrime news, hacking, and web application security.
  • Infosec Institute Cybersecurity awareness.
  • InfoSec Live Everything cybersecurity related from tutorials to interviews.
  • The PC Security Channel Windows security, malware news, and tutorials.
  • David Bombal Everything cybersecurity related.

Tech Reviewers/PC Building/Consumer Tech

  • Barnacules Nerdgasm Tech reviewer, hardware tutorials.
  • Linus Tech Tips Hardware tutorials, tech reviewer, PC building.
  • ThioJoe Hardware tutorials, tech reviewer, PC building.
  • Elithecomputerguy Hardware tutorials, network tutorials, hardware reviewer, hacking tutorials, Linux tutorials, website development.
  • Joe CollinsEverything Linux related, including tutorials and guides
  • Network Chuck: All-around networking YouTuber
  • Professor Messer Hardware Networking and Security Certifications Youtubers. Has extensive resources on CompTIA certifications

Podcasts

Hacking and Security Challenges

Capture the Flag (CTF) Challenges

  • TryHackMe Highly recommended for beginners. They have many good free tutorials and detailed walkthroughs for many rooms.
  • HackThisSite Focuses primarily on web exploit challenges.
  • HackTheBox Virtual machines available for download to practice hacking. Offers both beginner-friendly and advanced content.
  • Juice Shop An intentionally vulnerable web application developed by OWASP for hands-on learning of web application security.
  • HackerOne Web hacking challenges and bug bounty program platform.
  • CyberSecLabs An online platform offering cybersecurity challenges and labs for hands-on practice and learning.
  • WebScanTest A website/application that allows users to test and analyze the security of web applications through vulnerability assessments and penetration testing.
  • PortSwigger Web hacking CTFs and challenges and extensive resources on learning web application security
  • CrackMe Contains various Small programs or applications to download designed to test a user's reverse engineering and software cracking skills.

Bug Bounty Programs

  • HackerOne One of the largest bug bounty platforms with diverse programs and well-known clients. Offers rewards for security vulnerabilities in various applications
  • Bugcrowd Crowdsourced platform that connects ethical hackers with companies seeking vulnerability assessments. Offers programs from startups to enterprises
  • Synack Hybrid platform that combines human and AI-powered security testing. Offers continuous monitoring and has a private network of skilled researchers
  • Open Bug Bounty Unique platform with a focus on responsible disclosure. Allows researchers to report vulnerabilities to websites without fear of legal consequences
  • YesWeHack European bug bounty platform with a wide range of programs and collaboration with cybersecurity experts. Offers a Responsible Disclosure program for non-monetary rewards
  • Zerodium Zerodium pays BIG bounties to security researchers to acquire their original and previously unreported zero-day research

Vulnerable Software:

  • VulnHub Virtual machines available for download to practice hacking.
  • Exploit-DB Database of exploits and vulnerability information.
  • OWASP SiteGenerator A project by OWASP that helps generate vulnerable web applications for learning and testing web application security.
  • McAfee Hacme, Hacme Casino, Hacme Shipping, Hacme Travel: Deliberately vulnerable web applications developed by McAfee for practicing security testing and identifying vulnerabilities.
  • OldApps Provides archived versions of software applications for compatibility or nostalgic purposes.
  • OldVersion Provides archived versions of software applications for compatibility or nostalgic purposes.

Hacking Techniques

Google Hacking and Dorking:

Wireless

Password and Hash Cracking Tutorials

Password and Hash Cracking in the Browser:

Wordlists

Pass the Hash

MiTM (Man in the Middle) :

Active Directory

Metasploit:

Programming

  • edX Provides various free programming courses from universities.
  • freeCodeCamp A free website for learning web development and Python. FOcuses extensively on Front end and back-end web development
  • Udemy Offers career training courses, some of which are free.
  • Khan Academy Provides courses on math, English, and computer programming in a fun gamified way for free.
  • MIT OpenCourseWare Free intro to programming course released by MIT.
  • Code.Google Google's Python class tutorials.
  • Swaroopch Python tutorials by Swaroop.
  • TheNewBoston Programming tutorials and resources.
  • Hackerrank Coding challenges and competitions.
  • Sololearn Offers interactive coding lessons for various programming languages.
  • Codecademy Provides interactive coding lessons.
  • Coursera Offers career development courses, both paid and free.
  • DevDocs Comprehensive documentation for various programming languages and technologies.
  • W3Schools Provides web development tutorials and references.
  • GitHub Code sharing and collaboration platform.
  • PythonAnywhere Online Python development and hosting platform.
  • CS50 Well-known free course for introduction to programming.
  • HackerRank Offers coding challenges and competitions.
  • SoloLearn Provides interactive coding lessons for various programming languages.
  • Khan Academy Highly recommended resource with lots of free courses in programming, computer science, math, English, etc.
  • DevDocs Comprehensive documentation for various programming languages and technologies.
  • W3Schools Provides web development tutorials and references.
  • TheNewBoston Programming tutorials (web development - front end and back end, python, ruby).
  • The Net Ninja Front-end and Back-End web development tutorials
  • Derek Banas Tutorials on almost every kind of programming you can imagine.
  • Traversy Media Python, Web Development, and various programming tutorials
  • Programming with Mosh Programming Tutorials for various languages

Linux

Networking

Certifications

Hardware

Networking

Linux

  • CompTIA Linux+ CompTia Certification for Linux Cost is Low/Mid (USD $300-400)

Security - Entry Level

  • CompTIA Security+ Comptia Entry-level security certification Cost is Low/Mid (USD $300-400)
  • Stay Tuned for a Security + study guide
  • CEH Certified Ethical Hacker certification. This is for the multiple-choice exam. The Cost is High (USD $1200)
  • Google Cybersecurity Professional Certificate Entry-level cybersecurity certification from Google
  • CC Entry level certification from ISC2

Security - Management Level

  • CISSP Certified Information Systems Security Professional Cost Mid ($USD 700-800)

Penetration Testing

  • CompTIA PenTest+ Certification focusing on penetration testing methodology The Cost is Low/Mid (USD $300-400)
  • PJPT Hands-on exam from TheCyberMentor (Heath Adams) covering internal penetration testing Cost Low/Mid (USD $200)
  • PNPT Hands-on exam from TheCyberMentor (Heath Adams) covering active directory external penetration testing and privilege escalation Cost Low/Mid (USD $300-400)
  • EJPT Practical exam for penetration testing The Cost is Low/Mid (USD $300-400)
  • EWPT Hands-on web application penetration testing exam The Cost is Low/Mid (USD $300-400)
  • EMAPT Hands-on mobile application penetration testing exam The Cost is Low/Mid (USD $300-400)
  • ECPPT Hands-on network penetration testing exam The Cost is Low/Mid (USD $300-400)
  • CEH Master Practical CEH exam Cost is really high (USD $4,670) including CEH multiple-choice and hands-on exams. Typically need college, a scholarship, or work to pay for it.
  • OSCP Highly recognized penetration testing certification with a focus on manual testing techniques by Offensive Security The cost is High (USD $1000-2500)
  • I will be writing an OSCP study guide soon.
  • OSWA Hands-on web application penetration testing exam by Offensive Security The cost is High (USD $1000-2500)
  • OSWP Hands-on wireless penetration testing exam by Offensive Security The Cost is Mid/High (USD $800-900 with learn fundamentals package)
  • Looking for people to give feedback on SANS certifications

Web Application Security

Exploitation Frameworks and Tools

SQL Injection (SQLi)

A vulnerability that permits attackers to manipulate SQL queries to gain unauthorized access, modify, or retrieve sensitive data from a database.

Upload Tricks

Upload web vulnerabilities refer to security flaws that allow malicious users to upload and execute unauthorized files, potentially leading to server compromise or unauthorized access to the system.

LFI/RFI (Local File Inclusion/Remote File Inclusion)

Allows an attacker to include files from the target system or remote servers, potentially leading to unauthorized access or code execution.

XSS (Cross-site Scripting)

An attack where malicious scripts are injected into web pages, affecting users who visit the page and potentially stealing their data or taking control of their accounts.

Metasploit

Metadata

OSINT (Open-source Intelligence)

Shells

Attack Strings

Scanners

Net Scanners and Scripts

Content Management System (CMS) Hacking

Content Management Systems (CMS) are popular platforms used to manage, create, and modify digital content on websites and web applications. While they provide convenience and flexibility, improper configuration and vulnerabilities can lead to security risks. Ethical hacking (penetration testing) of CMSs is essential to identify weaknesses and implement robust security measures. However, it is crucial to obtain proper authorization before conducting any testing. Here's an overview of popular CMS platforms and resources for ethical hacking:

WordPress:

Drupal:

ColdFusion:

Joomla:

  • Joomla A popular open-source CMS with extensibility features.
  • Joomla Security Security checklist and guidelines from Joomla.

Magento:

Shopify:

  • Shopify A hosted CMS for e-commerce solutions.
  • Shopify Security Security measures and guidelines provided by Shopify.

Wix:

  • Wix Cloud-based website builder with drag-and-drop tools.
  • Wix Security Wix's security measures and policies.

Squarespace:

Typo3:

  • Typo3 An enterprise-level open-source CMS known for scalability.
  • Typo3 Security Typo3 security guide.

Umbraco:

  • Umbraco An open-source CMS based on Microsoft's ASP.NET framework.
  • Umbraco Security Security information and guidelines from Umbraco.

Ghost:

  • Ghost A CMS designed for bloggers and writers.
  • Ghost Security Security concepts and practices for Ghost.

Cybersecurity Tools

section in progress

Cloud Security

Cloud Security Resources:

This section is still in progress

Digital Forensics

This section is still in progress

Operating systems

  • Kali Linux is the most common operating system used for ethical hacking. Best for all levels has the most tutorials and support and the largest community. Note various cybersecurity courses assume you are utilizing Kali including offensive security and pnpt/tcm
  • Parrot Security OS Similar to kali . easy to use but not as much support as Kali
  • BlackArch Linux very customizable version of Linux, with a very steep learning curve but is still very powerful
  • For more info on individual Operating Systems see distrowatch

ISOS

An ISO is a virtual "box" that contains all the necessary files and data to set up a computer system or an operating system. ISO files are typically used to distribute software, including operating systems like Windows or Linux.

Windows ISO images from Microsoft

Linux ISO images

Common Linux Distros

Virtual machine software and virtualization

  • VirtualBox windows mac and Linux
  • Vmware Vmware workstation windows mac and Linux
  • Wine emulator for running windows applications on Linux, macOS, & BSD (not a virtual machine) Instead of simulating internal Windows logic like a virtual machine or emulator, Wine translates Windows API calls into POSIX calls on the fly, eliminating the performance and memory penalties of other methods and allowing you to cleanly integrate Windows applications into your desktop.

Osint

OSINT (Open Source Intelligence) -The practice of collecting information from published or otherwise publicly available sources

People and Organizational

Infrastructure:

References and Cheatsheets

Communities and Conferences:

  • Defcon one of the largest worldwide Hacking conferences in the world
  • Blackhat large worldwide conference all over the globe
  • RSA Conference The RSA Conference is an annual event focused on helping improve cybersecurity awareness and cybersecurity culture in companies, and similarly expanding this knowledge in individuals across the globe.
  • Calendar for Information Security Conferences

Blogs, Wikis, Magazines, and Forums

Blogs

Forums:

Created for forums that will help in both tool usage, syntax, attack techniques, and collection of scripts and tools.

Wikis

Magazines:

Security Research

Special thanks to all the contributors who have helped compile and curate this comprehensive list of resources. Your valuable contributions have made this collection possible and will undoubtedly assist many in their pursuit of knowledge and understanding in the world of cybersecurity and information technology. Together, we strive to improve and share knowledge, making the digital landscape safer for all. In no particular order thank you

About