Reverse Engineering (REV)
Static/dynamic analysis of compiled binaries, custom VMs, obfuscated code, and decompilers.
Playbooks & Blueprints
Cheatsheets & Disassemblers
IDA Pro Cheat Sheet
Keyboard shortcuts, cross-references, type casting, and IDAPython automation scripting.
Ghidra Cheat Sheet
Equivalent workflows, commented structures, Data Type Manager, and Jython scripting.
Reversing CLI Tools
Quick guide on file, strings, ltrace, strace, objdump, and unpacked extraction tools.
GDB (gef) Cheat Sheet
GEF context, telescope, registers inspection, and bypassing basic anti-debug checks.
x64dbg Cheat Sheet
Windows dynamic debugging, setting memory patches, hardware breakpoints, and Scylla unpacking.
Solvers & Scripting
Practice & Progression
Machine Exploitation
Network scanning, privilege escalation, Windows/Linux environments, Active Directory, and lateral pivoting.
Playbooks & Blueprints
Machine Exploitation Playbook
Port scanning, shell stabilization, privilege escalation methods, and file transfers.
Exploitation Databank
Exploit references, payloads, and mapping guides for compromised target pathways.
Machine Attack Blueprint Index
40+ detailed attack blueprints spanning SMB, Kerberoasting, MSSQL, Docker escapes, and NFS.
Enumeration & Recon
Nmap Cheat Sheet
Scanning styles, service detection, and NSE script flags.
Footprinting Cheatsheet
OS detection and network enumeration strategies.
Dig (DNS) Cheat Sheet
DNS record queries, reverse lookups, and zone transfer commands.
SMBClient Cheat Sheet
SMB share connections, file downloads, and listing commands.
FTP Cheat Sheet
FTP authentication, mirroring directories, and recursive downloads.
SMTP Mail Enumeration
SMTP commands (VRFY/EXPN) and user enumeration.
Networking & Tunneling
Port forwarding, proxychains, SSH tunneling, and networking diagnostics.
Exploitation & PrivEsc
Metasploit Cheat Sheet
Module configurations, payloads selection, and multi-handler setup.
EternalBlue (MS17-010)
Testing SMB vulnerabilities and executing exploit script commands.
Linux Attack Path & PrivEsc
SUID binaries, capabilities, cronjobs, kernel exploits, and Sudo abuses.
Windows Privilege Escalation
Token impersonation, registry exploits, service path hijacks, and UAC bypasses.
Windows Attack Paths
Windows specific lateral movement, credential harvesting, and attack vectors.
Active Directory
Web Exploitation
Vulnerability analysis of web apps. SQL Injection, Command Injection, LFI/RFI, SSRF, XSS, and directory fuzzing.
Playbooks & Blueprints
Cheatsheets & Tools
Web Testing & Fuzzing
Burp Suite proxies, Gobuster/ffuf directory busting, and parameter wordlists.
Web Attack Alternatives
Advanced payload options, bypass syntax variations, and niche exploit configurations.
picoCTF Web & REV Patterns
Common CTF-specific web challenge patterns, cookie tempers, and basic solutions.
PWN (Binary Exploitation)
Compromising native binaries. Buffer overflows, format string vulnerabilities, shellcode injection, and ROP chain exploitation.
Playbooks & Blueprints
Cheatsheets & Solvers
GDB (gef) for Exploit Dev
Inspecting stack arrays, using pattern creator/searcher, finding canary offsets, and GOT tables.
Pwn CLI Verification Tools
Quick guide for checksec, ROPgadget, ropper, one_gadget, and pwntools command hooks.
Pwntools Script Templates
Template configurations for remote socket exploits, local process forks, ELF symbol lookups.
Steganography
Extracting hidden payloads from files. Analyzing metadata, color-plane channels, and embedded zip files.
Cryptography
Analyzing and breaking ciphers. XOR, AES, RSA, stream ciphers, hash functions, MACs, TLS, and custom crypto attacks.
Playbooks & Blueprints
Cryptography Blueprint
Solvers for XOR ciphers, RSA factorization, classical ciphers, hash ID, and custom source-code reversal. Decision-tree triage workflow.
Hash Cracking & Password Attacks
Syntax mapping for hashcat rules, John the Ripper wordlist mutations, NTLM, NTLMv2, Kerberoast, and zip cracking.
Crypto Python Solvers
Template scripts for XOR brute-force, RSA with pycryptodome, AES-CBC decrypt, Z3 constraint solving, and hash cracking loops.
Crypto101 — Full Textbook (lvh, CC BY-NC 4.0)
Building Blocks (Crypto101 — Part II)
Ch.5 — XOR & One-Time Pads
XOR as a programmable inverter, bitwise XOR, one-time pad construction, perfect secrecy proof, and attacks when the pad is reused.
Ch.6 — Block Ciphers (AES / DES)
Block cipher permutations, AES S-boxes and rounds, DES and 3DES structure, key sizes, and why ECB mode leaks patterns.
Ch.7 — Stream Ciphers & Modes
CBC mode, predictable-IV attacks, bit-flipping, PKCS#7 padding oracle, RC4, Salsa20, CTR mode, and authenticated operation modes.
Ch.8 — Key Exchange (DH / ECDH)
Abstract Diffie-Hellman, discrete logarithm hardness, ECDH over elliptic curves, and forward secrecy motivation.
Ch.9 — Public-Key Encryption (RSA / ECC)
RSA key generation and math, why textbook RSA is broken, OAEP padding, and elliptic curve cryptography basics.
Ch.10 — Hash Functions
MD5, SHA-1, SHA-2, SHA-3/Keccak, collision attacks, pre-image resistance, password storage, and length extension attacks.
Ch.11 — MACs (HMAC / GCM / OCB)
MAC authentication, encrypt-then-MAC ordering, HMAC construction, Carter-Wegman, GCM, and OCB authenticated encryption modes.
Ch.12 — Signature Algorithms (DSA / ECDSA)
RSA signatures, DSA construction, ECDSA nonce reuse vulnerability (the PS3 exploit), and repudiable authenticators.
Ch.13 — Key Derivation Functions
Password stretching with PBKDF2, bcrypt, scrypt, and HKDF for deriving subkeys from shared secrets or passwords.
Ch.14 — Random Number Generators
True RNGs vs CSPRNGs, Yarrow entropy pool, Blum Blum Shub, the Dual_EC_DRBG NSA backdoor story, and Mersenne Twister weaknesses.
Complete Cryptosystems (Crypto101 — Part III)
Ch.15 — SSL & TLS
TLS handshake, certificate authorities, perfect forward secrecy, BEAST, CRIME, POODLE, Lucky13, HSTS, and certificate pinning.
Ch.16 — OpenPGP & GPG
PGP architecture, web of trust model, key signing, key servers, and practical GPG usage for encrypted communication and file signing.
Ch.17 — Off-The-Record Messaging (OTR)
OTR protocol design, authenticated key exchange, Socialist Millionaire Protocol, deniability, and perfect forward secrecy in messaging.
Math Foundations (Crypto101 — Appendices)
Appendix A — Modular Arithmetic
Clock arithmetic, prime numbers, modular inverse, Fermat's little theorem, modular exponentiation by squaring, and the discrete log problem.
Appendix B — Elliptic Curves
Weierstrass form, point addition and doubling, Abelian groups on curves, ECDLP hardness, and why ECC gives smaller keys than RSA.
Appendix C — Side-Channel Attacks
Timing attacks on modular exponentiation, power measurement analysis (DPA/SPA), and Montgomery ladder countermeasures.
OSINT
Open-source intelligence. Domain reconnaissance, public lookup registries, and passive fingerprinting.
Forensics
Incident response analysis. Network traffic packets, event system logs, and shell trace analysis.
Reporting & Vault Hubs
Cross-cutting indices, documentation templates, interactive panels, and overall indices.
Reporting & Methodologies
Interactive Apps & Panels
Vault Indices
Markdown Vault Hub
Static markdown homepage linking the training guides.
Blueprints Index
Direct links to vulnerability and compromise blueprint pages.
Learning Path Index
Structured routes for learning basic network/host theory.
Tools & Cheatsheets Index
Consolidated index of all command-line and graphic analysis sheets.
References Index
Deep external links, system calls mapping, and resource inventory sheets.
Challenge Use Cases
Exemplar case writeups and walkthrough references.