Useful links
Curated references, tools, wordlists, labs and write-ups worth bookmarking.
text·4 min read··INE Certification
Everything I kept coming back to while studying for the eJPT. The notes themselves started from syselement’s INE eJPT notes, which are worth reading in full.
Quick references
- GTFOBins: Unix binaries that can be abused for shells and privilege escalation.
- LOLBAS: the Windows equivalent, built-in binaries and scripts with abusable behaviour.
- HackTricks: sprawling methodology book, good for “what else can I try”.
- PayloadsAllTheThings: payloads and methodology by topic, including a reverse shell cheatsheet.
- Revshells: reverse shell one-liner generator.
- CyberChef: encode, decode and transform data.
- Pentest Everything: notes and checklists, including the Linux privilege escalation checklist.
- Awesome pentest checklist
- Full TTY shells handbook: upgrading a dumb shell to a proper TTY.
- ipcalc: subnet and CIDR calculator.
- Cronhub crontab editor: check what a cron expression means.
Nmap and recon automation
- Nmap NSE usage: official guide to running scripts.
- Nmap cheat sheet (StationX)
- Nmap command examples (cyberciti)
- dig examples (cyberciti)
- masscan and RustScan: fast port scanners.
- AutoRecon and nmapAutomator: automated enumeration wrappers.
OSINT and passive recon
- DNSdumpster: DNS records and subdomains.
- Netcraft site report: hosting and technology info for a site.
- DomainTools Whois, who.is and DNSlytics: whois and DNS lookups.
- Wappalyzer: website technology fingerprinting.
- Wayback Machine: old versions of a site.
- Have I Been Pwned: breached accounts.
- Google Hacking Database: ready-made dorks.
Exploit and vulnerability databases
- Exploit-DB and searchsploit
- Rapid7 vulnerability and exploit database
- NVD: CVE details, plus the CVSS scoring reference.
- Windows kernel exploits collection and exploitdb-bin-sploits: precompiled public exploit code.
CVEs I worked with
- CVE-2021-44228 (Log4Shell)
- CVE-2019-0708 (BlueKeep)
- CVE-2017-0143 (MS17-010)
- CVE-2014-0160 (Heartbleed)
- CVE-2014-6271 (Shellshock)
- Sudo Baron Samedit (CVE-2021-3156) advisory
- CVE-2021-22555 writeup (Google Security Research)
Privilege escalation tooling
- PEASS-ng (LinPEAS / WinPEAS) and parsePEASS for processing its output.
- JAWS, LinEnum and PrivescCheck
- pspy: watch processes and cron jobs without root.
- WES-NG and Windows-Exploit-Suggester: match patch level to known exploits.
- UACME: UAC bypass methods.
Exploitation and post-exploitation
- AutoBlue-MS17-010: manual EternalBlue exploitation.
- metasploit-autopwn: the
db_autopwnplugin. - Invoke-Obfuscation: PowerShell obfuscation.
- Pivoting in Metasploit (official docs) and an intro with lab setup.
- GoPhish and PhishingPretexts: phishing framework and example pretexts.
Wordlists
Practice targets
- Metasploitable 3 and the Metasploitable 2 docs
- VulnHub and OverTheWire wargames
- TryHackMe rooms I did: Further Nmap, Vulnversity, Ice, Startup, Pickle Rick, Easy Peasy, Anonymous, Blog, Poster, Ignite, RootMe, Source, Brooklyn Nine Nine, Basic Pentesting, Easy CTF, CTF, Joker CTF
Write-ups and eJPT reviews
- eJPT v2 review (nmmorette)
- prinugupta’s eJPT CTF series: write-ups for the INE host and network penetration testing CTFs (exploitation, system attacks, post-exploitation, Metasploit, network attacks).
- Room write-ups: Poster, Startup, Simple CTF, Easy Peasy, Anonymous, Fowsniff, Wreath
- Using ffuf with Burp Suite
Frameworks and standards
Related
- Cybersecurity command cheat sheet: the commands side of this reference
- Passive information gathering & OSINT: how the OSINT sites above fit in a workflow
- searchsploit: offline Exploit-DB search