Security Research 101

 

        Research in the cybersecurity industry is paramount as it drives innovation, enabling the development of cutting-edge solutions to combat evolving threats. It fosters a deeper understanding of emerging attack vectors and vulnerabilities, empowering organizations to proactively safeguard their assets. Furthermore, research serves as the cornerstone for the advancement of best practices and standards, ensuring robust defense mechanisms are in place. It cultivates a culture of continuous learning and adaptation, crucial in an ever-changing threat landscape.

Ultimately, research in cybersecurity is indispensable for staying ahead of adversaries and safeguarding digital assets in an increasingly interconnected world. 

Find below my approach to conducting successful research.

 Security research is the art of skillfully pursuing the discovery of previously unidentified threats to technology systems or products. It also involves devising innovative methods to address and mitigate these risks by implementing out-of-the-box ideas. This pursuit leverages deep expertise, advanced technologies, and a passion for problem-solving to enhance overall security measures and deliver significant benefits to the broader community.

1.            Subject and Hypothesis:

   The genesis of any fruitful security research endeavor lies in selecting a pertinent subject and formulating a clear hypothesis. This initial step is akin to laying the cornerstone of a building – it sets the direction and foundation for the entire project. When choosing a subject, opt for one that not only intrigues you but also harbors the potential for substantial impact.

   Example: "The hypothesis that outdated encryption algorithms leave networks vulnerable to cyber-attacks propelled my research into developing more robust encryption methods."

   2.      Data Study:

   Once the subject and hypothesis are delineated, embark upon a thorough exploration of existing data. Analyze past research, case studies, and relevant literature to gain insights into the intricacies of the chosen domain. This phase serves as the bedrock upon which subsequent research activities will be built. 

   Example: "A comprehensive study of breach reports and vulnerability assessments provided invaluable insights into emerging threats and attack vectors." 

   3.      Simulation / perform Actual Use Cases:

   With a solid understanding of the existing landscape, proceed to simulate scenarios or create real-world use cases to validate your hypothesis. This step involves putting theory into practice, thereby elucidating the practical implications of your research.

    Example: "By simulating various cyber-attack scenarios, I was able to assess the efficacy of proposed defense mechanisms and identify potential vulnerabilities." 

   4.      Identifying Data Gaps and Requirements:

   During research, it's imperative to identify any gaps in data or resources required to fuel further exploration. Assess the cost and time implications of acquiring necessary data and devise strategies to address these challenges effectively.

    Example: "The unavailability of real-time threat intelligence necessitated collaboration with industry partners to access proprietary datasets." 

   5.      Planning for Development:

   Armed with comprehensive insights and a validated hypothesis, it's time to chart a course for development. Formulate a strategic plan delineating the steps required to translate research findings into tangible solutions or innovations.

    Example: "A phased development approach enabled seamless integration of research outcomes into existing cybersecurity frameworks, minimizing disruption and maximizing impact." 

   6.      Delivering Success:

   The culmination of diligent research efforts lies in delivering tangible outcomes that contribute to the advancement of cybersecurity. Whether in the form of new products, services, or pioneering discoveries, success is measured by the transformative impact of your research endeavors.

    Example: "The successful implementation of novel intrusion detection algorithms resulted in a significant reduction in cyber threats across enterprise networks.

     A journey in security research necessitates a strategic approach and unwavering determination. By adhering to the outlined pathway – from hypothesis formulation to delivering success – aspiring researchers can navigate the complexities of the cybersecurity landscape with confidence and efficacy. 

Arthur Conan Doyle said, 

"It is a capital mistake to theorize before one has data. Insensibly, one begins to twist facts to suit theories, instead of theories to suit facts." 

Embrace data-driven research, and let your research pave the way for a safer digital future.

AITM Phishing Attacks detect using Sentinel SIEM Tool and MSTICPY

In today's corporate world, many organizations are embracing the use of multi-cloud and hybrid cloud environments, a strategic move that allows for flexibility and cost efficiency. However, this shift has also led to an increase in cyber-attack risks, be it from industry-constructed threats or targeted attacks from Advanced Persistent Threat (APT) groups.

These attacks have become alarmingly sophisticated, with the ability to bypass security sensors and establish persistent activity within the enterprise environment. In order to detect and combat such activity, it is essential to employ an advanced Microsoft Sentinel SIEM (Security Information and Event Management) tool that is capable of hunting threats across multi-cloud environments.

Multi-cloud threat hunting is the art of uncovering and neutralizing security hazards that traverse multiple cloud infrastructures. One preferable tool that can be employed for this purpose is the Microsoft Sentinel SIEM, this SIEM platform allows organizations to monitor and analyze security events across their entire infrastructure, including on-premises, cloud, and hybrid environments. Allow me to illustrate with an example from the most current and emerging SIEM tool from Microsoft Sentinel.

One of the essential features of Sentinel SIM is its ability to Hunt and respond to Advanced Persistent Threats (APTs), which are highly sophisticated and targeted attacks that are designed to evade traditional security measures. One of the most prevalent APT scenarios is the  Adversary-in-the-Middle (AITM) phishing attacks, a common tactic employed by cybercriminals to gain unauthorized access to sensitive information. In this type of attack, the attacker intercepts communications between two parties and manipulates the data in order to trick one of the parties into providing sensitive information.

Microsoft Sentinel SIEM can detect AITM phishing attacks by analyzing email headers, attachment properties, and other email-related data to identify suspicious patterns and anomalies. Additionally, it can also analyze network traffic and endpoint data to detect signs of an AITM attack, such as the use of Threat Intelligence-based known malicious IP addresses or domains. 

Another significant aspect of multi-cloud threat hunting is log analytics. Sentinel SIM provides a robust log analytics engine that allows organizations to search and analyze large volumes of log data from multiple sources, such as firewall logs, intrusion detection systems, and cloud-based services, even providing data from 3rd party data connectors as well. This enables organizations to identify and respond to security threats in real time, as well as to generate detailed reports and charts that can be used to track trends and identify areas of concern in their security posture.

 An example of an AITM phishing attack would be an attacker sending an email to a user that appears to be from a legitimate source, such as a bank or a government agency. The email may contain a link or an attachment that, when clicked, will install malware on the user's device or prompt them to enter sensitive information, such as their login credentials or credit card information.

 One way to detect AITM phishing attacks using Sentinel SIM is to use log analytics to search for suspicious patterns in email-related data. Here one should utilize the best Threat Intelligence feeds for finding trending cyber-attack activity.

 For example, a query to detect AITM phishing attacks could include the following elements:

•  Searching for email messages that contain attachments with a file extension commonly associated with malware, such as .exe or .js
• Searching for email messages that contain links to known malicious domains or IP addresses.
• Searching for email messages that are sent from a domain that is different from the one displayed in the "From" field.
• Email messages from a campaign are removed after delivery. 
•  Suspicious inbox manipulation rule creations or "Anomalous Token" alert triggering. 

Here's an example of a query that could be used to detect AITM phishing attacks in Sentinel SIM:

//Detect the presence of a suspicious email attachment and a threat intelligence indicator in email entities.

EmailEvents

|join kind= leftouter EmailAttachmentInfo on NetworkMessageId

|where FileName endswith ".exe" or 

FileName  endswith ".js" and 

SenderIPv4 has_any (ThreatIntelligenceIndicator)or

SenderIPv6 has_any (ThreatIntelligenceIndicator) or 

SHA256 has_any (ThreatIntelligenceIndicator)

This query looks for email messages that contain attachments with a .exe or .js file extension, or that contain links to a domain known to be associated with malware from the best Threat Intelligence feed.

//Find suspicious tokens tagged by AAD "Anomalous Token" alert

let suspiciousSessionIds = materialize(

AlertInfo

| where  TimeGenerated  > ago(7d)

| where Title == "Anomalous Token"

| join (AlertEvidence | where Timestamp > ago(7d) | where EntityType == "CloudLogonSession") on AlertId

| project sessionId = todynamic(AdditionalFields).SessionId);

//Find Inbox rules created during a session that used the anomalous token

let hasSuspiciousSessionIds = isnotempty(toscalar(suspiciousSessionIds));

CloudAppEvents

| where hasSuspiciousSessionIds

| where TimeGenerated > ago(21d)

| where ActionType == "New-InboxRule"

| where RawEventData.SessionId in (suspiciousSessionIds) 

This query looks for "Anomalous Token" alerts from the cloud authentication session and finds a new "New-InboxRule" rules creation activity from a cloud-based office application. 

It's important to note that this is a simple query example, and organizations should work with their hunters or security team and adjust the query to match their own specific needs and environment. Also, this query is just one way to detect AITM phishing attacks, there are other techniques and methods that can be employed to detect and thwart Advanced Persistent Threats. A synergistic blend of various methods is essential for the establishment of threat hunters in a comprehensive threat-hunting program.

 

Detecting AITM activity using MSTICPY + Jupyter notebook

 All the security researchers and threat hunters knows the MSTICPY is very useful Python module crafted by the tech-titans at Microsoft, which can be employed for the purpose of hunting for digital threats and undertaking incident response actions within the Microsoft Sentinel. One of the key features of MSTICPY is its ability to perform advanced analytics on log data and detect advanced threats, such as AITM phishing attacks.

Here is an example of how MSTICPY can be used to detect AITM phishing attacks in Azure Sentinel:

 

# Import the necessary modules

from msticpy.nbtools import nbinit

from msticpy.nbtools.foliummap import FoliumMap

from msticpy.sectools import EmailAnalyzer

 # Initialize the Jupyter notebook environment

nbinit.init_notebook(namespace=globals())

 

# Create an instance of the EmailAnalyzer class

ea = EmailAnalyzer()

 

# Query Azure Sentinel for email messages that contain attachments with a .exe or .js file extension

query = '''

EmailAttachmentInfo

| where FileName endswith '.exe' or FileName endswith '.js'

'''

# Execute the query and store the results in a variable

email_results = ea.query_logs(query)

# Analyze the results to identify potential phishing emails

phishing_emails = ea.analyze_emails(email_results)

# Print the results

print(phishing_emails)

 

This code uses the MSTICPY EmailAnalyzer class to query Azure Sentinel for email messages that contain attachments with a .exe or .js file extension. It then analyzes the results to identify potential phishing emails.

 

It's important to note that the EmailAnalyzer class provides various other functionalities like analyzing email headers, body, links, and attachments, and also it can be used to identify phishing domains, IP addresses, sender's reputation etc. This is just a simple example and organizations should work with their security team and adjust the code to match their specific needs and environment.

 Please note that in order to effectively utilize the method outlined in this discourse, one must have Microsoft Sentinel configured and in possession of the necessary logs. Additionally, it is of paramount importance to ensure that the appropriate connection strings have been properly established. Be aware that this is but one technique for detecting Adversary-in-the-Middle Phishing attacks, and there are other methods and approaches that may be employed to detect and thwart Advanced Persistent Threats. Indeed, it is always advisable to adopt a multifaceted approach, utilizing a variety of techniques in one's threat-hunting program for maximum efficacy.

I do hope that this post shall prove useful in identifying basic Adversary-in-the-Middle Phishing activity. Your feedback and experiences in the comments section would be greatly appreciated.

Jigsaw Ransomware

Ransomware name : Jigsaw File Extensions : .paytounlock , .FUN, .KKK, .GWS, or, .BTC Using encryptions : AES-128-CBC Ransom : 100 TO 300 USD In Bitcoins Distribution : Spam Emails and Exploits

The underlying security demonstrates that the is pixie basic – it doesn't start any sessions with remote C&C servers and has a straightforward record structure. Upon disease it adjusts a few registry values and can accumulate some fundamental framework information about the contaminated host.

The infection relies on upon the .NET system to be introduced on the PC to run. Its conduct is run of the mill for such ransomware – it scrambles target client documents and afterward demonstrates a payment note which blackmails the casualties for a criminal installment to reestablish their records.

We have managed to extract the list that shows the affected file types:

.jpg .jpeg .raw .tif .gif .png .bmp.3dm .max.accdb .db .dbf .mdb .pdb .sql.dwg .dxf.c

.cpp .cs .h .php .asp .rb .java .jar .class .py .js.aaf .aep .aepx .plb .prel .prproj

.aet .ppj .psd .indd .indl .indt .indb .inx .idml .pmd .xqx .xqx .ai .eps .ps .svg .swf

.fla .as3 .as.txt .doc .dot .docx .docm .dotx .dotm .docb .rtf .wpd .wps .msg .pdf .xls

.xlt .xlm .xlsx .xlsm .xltx .xltm .xlsb .xla .xlam .xll .xlw .ppt .pot .pps .pptx

.pptm .potx .potm .ppam .ppsx .ppsm .sldx .sldm.wav .mp3 .aif .iff .m3u .m4u .mid

.mpa .wma .ra .avi .mov .mp4 .3gp .mpeg .3g2 .asf .asx .flv .mpg .wmv .vob .m3u8

.mkv.dat .csv .efx .sdf .vcf .xml .ses.rar .zip .7zip

.tif .gif .png .bmp.3dm .max.accdb .db .dbf .mdb .pdb .sql.dwg .dxf.c .cpp .cs .h

.php .asp .rb .java .jar .class .py .js.aaf .aep .aepx .plb .prel .prproj .aet .ppj

.psd .indd .indl .indt .indb .inx .idml .pmd .xqx .xqx .ai .eps .ps .svg .swf .fla

.as3 .as.txt .doc .dot .docx .docm .dotx .dotm .docb .rtf .wpd .wps .msg .pdf .xls

.xlt .xlm .xlsx .xlsm .xltx .xltm .xlsb .xla .xlam .xll .xlw .ppt .pot .pps .pptx

.pptm .potx .potm .ppam .ppsx .ppsm .sldx .sldm.wav .mp3 .aif .iff .m3u .m4u .mid

.mpa .wma .ra .avi .mov .mp4 .3gp .mpeg .3g2 .asf .asx .flv .mpg .wmv .vob .m3u8

.mkv.dat .csv .efx .sdf .vcf .xml .ses.rar .zip .7zip

A ransomware note is then shown to the user which contains the following message:

I want to play a game with you. Let me explain the rules:

Your personal files are being deleted. Your photos, videos, documents, etc…

But, don’t worry! It will only happen if you don’t comply.

However I’ve already encrypted your personal files, so you cannot access them.

Every hour I select some of them to delete permanently,

therefore I won’t be able to access them, either.

Are you familiar with the concept of exponential growth? Let me help you out.

It starts out slowly then increases rapidly.

During the first 24 hour you will only lose a few files,

the second day a few hundred, the third day a few thousand, and so on.

If you turn off your computer to try to close me, when I start next time

you will get 1000 files deleted as a punishment.

Yes you will want me to start next time, since I am the only one that

is capable to decrypt your personal data for you.

Now, let’s start and enjoy our little game together!

Jigsaw Ransomware Distribution

The Jigsaw Ransomware poses as a counterfeit Mozilla Firefox installer and/or updater. The binary files are distributed mainly through counterfeit download sites or spam email messages.

When encrypting a file it will add the filename to a list of encrypted files located at %UserProfile%\AppData\Roaming\System32Work\EncryptedFileList.txt. It will also assign a bitcoin address and save it in the %UserProfile%\AppData\Roaming\System32Work\Address.txt file.

Other disease strategies incorporate program hihackers and noxious promotions (ads) that can prompt to connections or connections that incorporate the infection.

Files associated with the Jigsaw Ransomware

file locations in infected system

%UserProfile%\AppData\Roaming\Frfx\

%UserProfile%\AppData\Roaming\Frfx\firefox.exe

%UserProfile%\AppData\Local\Drpbx\

%UserProfile%\AppData\Local\Drpbx\drpbx.exe

%UserProfile%\AppData\Roaming\System32Work\

%UserProfile%\AppData\Roaming\System32Work\Address.txt

%UserProfile%\AppData\Roaming\System32Work\dr

%UserProfile%\AppData\Roaming\System32Work\EncryptedFileList.txt

Registry entries associated with the Jigsaw Ransomware

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\firefox.exe %UserProfile%\AppData\Roaming\Frfx\firefox.exe

How to Remove It Manually:

1) open run Window

2)  type “msconfig” and then press Enter

3) Choose the tab named “Boot”

4) Tic on “Safe Boot” option and then go to “Network” under it to tick it too

5) Apply -> OK

6) Open My Computer

7) Windows 7

Click on “Organize” button

Select “Folder and search options”

Select the “View” tab

Go under “Hidden files and folders” and mark “Show hidden files and folders” option

8) Hit the following key combination: CTRL+SHIFT+ESC

9) Get over to “Processes”

10) When you find suspicious process right click on it and select “Open File Location”

11) Go back to Task Manager and end the malicious process. Right click on it again and choose “End Process”

12) Next you should go folder where the malicious file is located and delete it

13) open Run

14) In the box, write “regedit”(without the inverted commas) and hit Enter

15) Type the CTRL+F and then write the malicious name in the search type field to locate the malicious executable

16) In case you have discovered registry keys and values related to the name, you should delete them, but be careful not to delete legitimate keys

Further help for Windows Registry repair

17) Use present backups

18) Restore your personal files using File History

– Hit WIN Key

– Type “restore your files” in the search box

– Select “Restore your files with File History”

– Choose a folder or type the name of the file in the search bar

restore-your-personal-files-using-File-History-bestecuritysearch

– Hit the “Restore” button

19)If you have created system restore point then you can use the system restore point option and restore the system

Recovery Tool

https://www.bleepingcomputer.com/download/jigsaw-decrypter/

Top Informatation security Links,Sites, Forums Discover Your Self

Security Forums

    https://evilzone.org
    https://www.hackthissite.org/forums/index.php
    https://www.ethicalhacker.net/forums/index.php
    http://forum.antichat.ru/
    https://forum.xeksec.com/
    https://rdot.org/forum/
    https://forum.zloy.bz/
    https://forum.reverse4you.org/
    https://rstforums.com/forum/
    http://www.truehackers.ru/forum/index.php
    http://garage4hackers.com/forum.php
    https://www.hellboundhackers.org/
    http://www.lockpicking101.com/
    https://www.xploitworld.com/index.php

Tor Onion Links

    https://www.torproject.org/
    http://www.hiddenwiki.info/

Security Methodologies    http://www.vulnerabilityassessment.co.uk/Penetration%20Test.html
    http://www.pentest-standard.org/index.php/Main_Page
    https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project
    http://yehg.net/lab/pr0js/misc/wasarg_owasp-tgv4_with_ref.php
    http://www.social-engineer.org/
    http://projects.webappsec.org/w/page/13246927/FrontPage
    https://www.sans.org/reading-room/whitepapers/auditing/base-security-assessment-methodology-1587
    http://www.isecom.org/research/osstmm.html

Training/Classes/Video

    https://exploit-exercises.com
    https://www.cybrary.it/cyber-security/
    http://www.irongeek.com/i.php?page=videos/aide-winter-2011
    https://lab.pentestit.ru/pentestlabs/3
    https://trailofbits.github.io/ctf/
    http://ctf.forgottensec.com/wiki/?title=Main_Page
    http://smashthestack.org/
    http://ctf.hcesperer.org/
    https://www.google.com/calendar/feeds/noge7b1rg2dg4a8kcm1k68vbjg@group.calendar.google.com/public/basic
    https://www.google.com/calendar/embed?src=pe2ikdbe6b841od6e26ato0asc@group.calendar.google.com&gsessionid=OK
    https://crypto.stanford.edu/cs155/
    https://www.offensive-security.com/metasploit-unleashed/
    http://www.irongeek.com/i.php?page=videos/metasploit-class
    http://www.securitytube.net/
    http://resources.infosecinstitute.com/
    https://www.cs.fsu.edu/~redwood/OffensiveSecurity/lectures.html
    https://www.youtube.com/watch?v=ANlROJNWtCs&list=PLM0IiVYClP2vC3A6Uz_ESV86kBVYei5qx
    https://www.youtube.com/watch?v=Sye3mu-EoTI
    https://www.youtube.com/watch?v=GPjcSxyIIUc
    https://www.youtube.com/watch?v=kPxavpgos2I
    https://www.youtube.com/watch?v=pnqcHU2qFiA
    http://www.securitytube.net/video/7640
    https://www.youtube.com/watch?v=y2zrEAwmdws
    http://www.securitytube.net/video/7735

Pentest Tools

    https://github.com/pwnwiki/pwnwiki.github.io
    https://github.com/sbilly/awesome-security
    https://github.com/paragonie/awesome-appsec
    https://github.com/enaqx/awesome-pentest
    https://github.com/kahun/awesome-sysadmin#security
    http://beefproject.com/
    https://xsser.03c8.net/
    https://code.google.com/p/fuzzdb/
    https://www.owasp.org/index.php/Category:OWASP_Fuzzing_Code_Database#tab=Statements
    http://w3af.org/
    https://code.google.com/p/skipfish/
    https://www.sans.org/reading-room/whitepapers/testing/fuzzing-approach-credentials-discovery-burp-intruder-33214
    https://www.securityninja.co.uk/hacking/burp-suite-tutorial-the-intruder-tool/
    http://www.justanotherhacker.com/projects/graudit.html
    https://packetstormsecurity.com/files/tags/tool
    http://pentestbox.com/   (For Windows users)
    http://seclist.us/
    http://www.toolwar.com/
    https://www.toolswatch.org/

Pentest Lab ISO-VMs

    http://www.amanhardikar.com/mindmaps/PracticeUrls.html
    https://www.kali.org/
    https://www.owasp.org/index.php/OWASP_Web_Testing_Environment_Project
    http://blackarch.org/
    https://code.google.com/p/owaspbwa/
    https://www.mavensecurity.com/web_security_dojo/
    http://hackingdojo.com/dojo-media/
    http://informatica.uv.es/~carlos/docencia/netinvm/
    http://www.bonsai-sec.com/en/research/moth.php
    http://sourceforge.net/projects/metasploitable/files/Metasploitable2/
    http://sourceforge.net/projects/lampsecurity/?source=navbar
    https://www.hacking-lab.com/index.html
    http://sourceforge.net/projects/virtualhacking/files/
    http://www.irongeek.com/i.php?page=mutillidae/mutillidae-deliberately-vulnerable-php-owasp-top-10
    http://www.dvwa.co.uk/
    http://sourceforge.net/projects/thebutterflytmp/
    http://magikh0e.ihtb.org/pubPapers/

Metasploit

    http://resources.metasploit.com/
    http://netsec.ws/?p=262
    http://seclists.org/metasploit/
    https://www.offensive-security.com/metasploit-unleashed/Introduction/
    http://www.offensive-security.com/metasploit-unleashed/Msfvenom
    https://community.rapid7.com/community/metasploit/
    http://www.securitytube.net/video/711?q=METASPLOIT
    https://en.wikibooks.org/wiki/Metasploit
    https://www.sans.org/security-resources/sec560/misc_tools_sheet_v1.pdf
    http://rmccurdy.com/scripts/Metasploit%20meterpreter%20cheat%20sheet%20reference.html
    https://github.com/rapid7/metasploit-framework/wiki/Meterpreter
    https://www.blackhat.com/presentations/bh-dc-10/Egypt/BlackHat-DC-2010-Egypt-UAV-slides.pdf

Net Scanners

    https://nmap.org/
    https://nmap.org/nsedoc/
    http://www.securitytube.net/video/931
    https://nmap.org/nsedoc/
    http://www.openvas.org/
    http://www.tenable.com/products/nessus-vulnerability-scanner
    https://www.rapid7.com/products/nexpose/compare-downloads.jsp
    http://www.inguardians.com/research/docs/Skoudis_pentestsecrets.pdf

Man-in-the-middle attack

    http://www.linuxsecurity.com/docs/PDF/dsniff-n-mirror.pdf
    http://media.techtarget.com/searchUnifiedCommunications/downloads/Seven_Deadliest_UC_Attacks_Ch3.pdf
    https://packetstormsecurity.com/papers/wireless/cracking-air.pdf
    https://www.blackhat.com/presentations/bh-europe-03/bh-europe-03-valleri.pdf
    https://www.defcon.org/images/defcon-17/dc-17-presentations/defcon-17-sam_bowne-hijacking_web_2.0.pdf
    http://www.leetupload.com/database/Misc/Papers/Asta%20la%20Vista/18.Ettercap_Spoof.pdf
    http://bandwidthco.com/nf.html
    http://articles.manugarg.com/arp_spoofing.pdf
    http://academy.delmar.edu/Courses/ITSY2430/eBooks/Ettercap(ManInTheMiddleAttack-tool).pdf
    http://www.ucci.it/docs/ICTSecurity-2004-26.pdf

Phase 1 - Reconnaissance: Information Gathering before the Attack

    https://en.wikipedia.org/wiki/Open-source_intelligence
    http://www.spylogic.net/2009/10/enterprise-open-source-intelligence-gathering-part-1-social-networks/
    http://www.spylogic.net/2009/10/enterprise-open-source-intelligence-gathering-%E2%80%93-part-2-blogs-message-boards-and-metadata/
    http://www.spylogic.net/2009/10/enterprise-open-source-intelligence-gathering-part-3-monitoring/
    http://www.slideshare.net/Laramies/tactical-information-gathering
    http://www.infond.fr/2010/05/toturial-footprinting.html

Phase 1.1 - People and Orginizational

    http://www.spokeo.com/
    http://www.spoke.com/
    https://www.xing.com/
    http://www.zoominfo.com/
    https://pipl.com/
    http://www.zabasearch.com/
    http://www.searchbug.com/
    http://skipease.com/
    http://addictomatic.com/
    http://socialmention.com/
    http://entitycube.research.microsoft.com/
    http://www.yasni.com/
    http://www.glassdoor.com/index.htm
    https://connect.data.com/
    https://searchwww.sec.gov/EDGARFSClient/jsp/EDGAR_MainAccess.jsp
    https://www.tineye.com/
    http://www.peekyou.com/

Phase 1.2 - Infastructure

    http://uptime.netcraft.com/
    http://www.shodanhq.com/
    http://www.domaintools.com/
    http://centralops.net/co/
    http://whois.webhosting.info/
    https://www.ssllabs.com/ssltest/analyze.html
    https://www.exploit-db.com/google-hacking-database/
    http://www.my-ip-neighbors.com/

Phase 1.2 - Tools

    OSINT Tools
    http://www.edge-security.com/theharvester.php
    http://www.edge-security.com/metagoofil.php
    http://www.paterva.com/web6/
    https://www.sans.org/reading-room/whitepapers/privacy/document-metadata-silent-killer-32974
    http://www.sno.phy.queensu.ca/~phil/exiftool/
    http://www.darkoperator.com/blog/2009/4/24/metadata-enumeration-with-foca.html

Phase 2 - Enumeration: Finding Attack Vectors

    http://securitysynapse.blogspot.be/2013_08_01_archive.html
    https://hackertarget.com/attacking-wordpress/
    https://code.google.com/p/pentest-bookmarks/wiki/BookmarksList
    http://www.0daysecurity.com/penetration-testing/enumeration.html
    https://github.com/n3ko1/WrapMap
    https://cirt.net/Nikto2
    http://www.unixmen.com/install-nikto-web-scanner-check-vulnerabilities/
    http://seclist.us/autoenum-nmap-enumeration-and-script-scan-automation-script.html
    http://code.stephenmorley.org/articles/xampp-version-history-apache-mysql-php/
    http://carnal0wnage.attackresearch.com/2007/07/over-in-lso-chat-we-were-talking-about.html
    http://www.iodigitalsec.com/windows-null-session-enumeration/
    https://pen-testing.sans.org/blog/2013/07/24/plundering-windows-account-info-via-authenticated-smb-sessions
    http://carnal0wnage.attackresearch.com/2007/07/enumerating-user-accounts-on-linux-and.html
    https://github.com/isaudits/autoenum
    http://www.webpronews.com/snmp-enumeration-and-hacking-2003-09
    http://carnal0wnage.attackresearch.com/2007/07/over-in-lso-chat-we-were-talking-about.html
    http://www.iodigitalsec.com/windows-null-session-enumeration/
    http://pen-testing.sans.org/blog/2013/07/24/plundering-windows-account-info-via-authenticated-smb-sessions
    http://carnal0wnage.attackresearch.com/2007/07/enumerating-user-accounts-on-linux-and.html
    http://www.madirish.net/59a

Phase 3 - Exploitation: Verifying Security Weaknesses

    http://pwnwiki.io
    http://download.vulnhub.com/pentesterlab/php_include_and_post_exploitation.pdf
    http://ru.scribd.com/doc/245679444/hak5-org-OSXPost-Exploitation-copy-20130228-pdf#scribd
    https://cyberwar.nl/d/hak5.org_LinuxUnixBSDPost-ExploitationCommandList_copy-20130228.pdf
    https://www.yumpu.com/en/document/view/14963680/from-sqli-to-shell

Dump Windows Password Hashes

    http://bernardodamele.blogspot.com/2011/12/dump-windows-password-hashes.html

Windows Passhing The Hash

    https://www.kali.org/penetration-testing/passing-hash-remote-desktop/
    https://www.kali.org/kali-monday/pass-the-hash-toolkit-winexe-updates/

Windows Privilege Escalation

    http://travisaltman.com/windows-privilege-escalation-via-weak-service-permissions/
    https://github.com/0xdeafbeef/PSSecSnapshot
    http://it-ovid.blogspot.com/2012/02/windows-privilege-escalation.html
    http://www.fuzzysecurity.com/tutorials/16.html
    http://www.youtube.com/watch?v=kMG8IsCohHA
    http://www.youtube.com/watch?v=_8xJaaQlpBo
    http://www.greyhathacker.net/?p=738
    http://bernardodamele.blogspot.ru/2011/12/dump-windows-password-hashes.html

Linux Privilege Escalation

    http://incolumitas.com/wp-content/uploads/2012/12/blackhats_view.pdf
    http://blog.g0tmi1k.com/2011/08/basic-linux-privilege-escalation.html
    http://pentestmonkey.net/tools/audit/unix-privesc-check
    http://www.rebootuser.com/?page_id=1721
    http://www.rebootuser.com/?p=1758
    http://www.rebootuser.com/?p=1623
    http://insidetrust.blogspot.nl/2011/04/quick-guide-to-linux-privilege.html

Tunneling & Port Forwarding

    https://www.sans.org/reading-room/whitepapers/testing/tunneling-pivoting-web-application-penetration-testing-36117
    https://highon.coffee/blog/reverse-shell-cheat-sheet/
    https://highon.coffee/blog/ssh-meterpreter-pivoting-techniques/
    http://staff.washington.edu/corey/fw/ssh-port-forwarding.html
    http://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
    http://magikh0e.ihtb.org/pubPapers/ssh_gymnastics_tunneling.html
    http://www.debianadmin.com/howto-use-ssh-local-and-remote-port-forwarding.html
    http://www.danscourses.com/Network-Penetration-Testing/metasploit-pivoting.html
    http://carnal0wnage.attackresearch.com/2007/09/using-metasploit-to-pivot-through_06.html
    http://www.offensive-security.com/metasploit-unleashed/Portfwd
    http://www.offensive-security.com/metasploit-unleashed/Pivoting
    http://www.howtoforge.com/reverse-ssh-tunneling
    http://ftp.acc.umu.se/pub/putty/putty-0.57/htmldoc/Chapter7.htmla

XSS Cheat Codes

    http://www.xenuser.org/xss-cheat-sheet/
    https://gist.github.com/sseffa/11031135
    https://html5sec.org/

WebShells

    http://www.r57shell.net/
    https://github.com/b374k/b374k
    https://github.com/epinna/weevely3

SQLi General Resources

    http://www.w3schools.com/sql/sql_injection.asp
    http://sqlzoo.net/hack/
    https://information.rapid7.com/rs/rapid7/images/R7%20SQL_Injection_Cheat_Sheet.v1.pdf
    http://websec.ca/kb/sql_injection
    http://ferruh.mavituna.com/sql-injection-cheatsheet-oku/
    http://www.unixwiz.net/techtips/sql-injection.html
    http://www.sqlinjectionwiki.com/
    http://sqlmap.org/
    https://packetstorm.sigterm.no/papers/cheatsheets/sqlmap-cheatsheet-1.0-SDB.pdf
    https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet
    http://bobby-tables.com/
    https://spike188.wordpress.com/category/blind-sql-injection/
    http://securityidiots.com/Web-Pentest/SQL-Injection
    https://information.rapid7.com/rs/rapid7/images/R7%20SQL_Injection_Cheat_Sheet.v1.pdf
 

MySQLi Resources

    http://pentestmonkey.net/cheat-sheet/sql-injection/mysql-sql-injection-cheat-sheet
    https://websec.wordpress.com/2010/12/04/sqli-filter-evasion-cheat-sheet-mysql/
    http://resources.infosecinstitute.com/backdoor-sql-injection/
    http://www.michaelboman.org/books/sql-injection-cheat-sheet-mysql

MSSQLi Resources

    http://evilsql.com/main/page2.php
    http://pentestmonkey.net/cheat-sheet/sql-injection/mssql-sql-injection-cheat-sheet
    http://www.michaelboman.org/books/sql-injection-cheat-sheet-mssql

Oracle SQLi Resources

    http://pentestmonkey.net/cheat-sheet/sql-injection/oracle-sql-injection-cheat-sheet
    http://www.michaelboman.org/books/sql-injection-cheat-sheet-oracle

Postgres SQLi Resources

    http://pentestmonkey.net/cheat-sheet/sql-injection/postgres-sql-injection-cheat-sheet
    http://www.michaelboman.org/books/sql-injection-cheat-sheet-postgresql

SQLite Resources

    https://sites.google.com/site/0x7674/home/sqlite3injectioncheatsheet

RFI/LFI Tutorials

    https://evilzone.org/tutorials/remote-file-inclusion%28rfi%29/
    http://www.hackersonlineclub.com/lfi-rfi
    https://0xzoidberg.wordpress.com/category/security/lfi-rfi/

NASM Tutorial

    http://ccm.net/faq/1559-compiling-an-assembly-program-with-nasm

Buffer Overflow Tutorial

    http://www.madirish.net/142
    http://n01g3l.tumblr.com/post/49036035399/linux-crossfire-v1-90-buffer-overflow
    http://resources.infosecinstitute.com/author/nikhil-kumar/
    http://www.frequency.com/video/athcon-hack-in-paris-demo-1/40181156
    http://www.savevid.com/video/athcon-hack-in-paris-demo-2.html
    http://www.frequency.com/video/athcon-hack-in-paris-demo-3/11306148
    https://tehaurum.wordpress.com/2015/06/22/exploit-development-stack-buffer-overflow/
    http://proactivedefender.blogspot.ru/2013/05/understanding-buffer-overflows.html
    https://forum.reverse4you.org/showthread.php?t=1371
    http://grey-corner.blogspot.com/2010/01/beginning-stack-based-buffer-overflow.html
    http://grey-corner.blogspot.com/2010/01/seh-stack-based-windows-buffer-overflow.html
    http://grey-corner.blogspot.com/2010/01/windows-buffer-overflow-tutorial.html
    http://grey-corner.blogspot.com/2010/01/heap-spray-exploit-tutorial-internet.html
    http://grey-corner.blogspot.com/2010/02/windows-buffer-overflow-tutorial.html
    http://thepcn3rd.blogspot.ru/2015/07/freeftpd-108-seh-stack-based-overflow.html

Exploit Development

    https://www.corelan.be/index.php/articles/
    http://www.fuzzysecurity.com/tutorials.html
    https://code.google.com/p/it-sec-catalog/wiki/Exploitation
    http://www.myne-us.com/2010/08/from-0x90-to-0x4c454554-journey-into.html
    https://www.ethicalhacker.net/columns/heffner/smashing-the-modern-stack-for-fun-and-profit
    http://x9090.blogspot.ru/2010/03/tutorial-exploit-writting-tutorial-from.html
    http://ref.x86asm.net/index.html
    https://sploitfun.wordpress.com/2015/06/26/linux-x86-exploit-development-tutorial-series/
    https://forum.reverse4you.org/showthread.php?t=1371

Exploits and Shellcodes

    https://www.exploit-db.com/
    https://packetstormsecurity.com/
    http://www.securityfocus.com/bid
    https://nvd.nist.gov/
    http://osvdb.org/
    http://www.secdocs.org/
    http://www.cvedetails.com/
    https://cve.mitre.org/
    http://www.windowsexploits.com/
    http://farlight.org/index.html?type=shellcode
    http://shell-storm.org/shellcode/

Reverse Engineering

    https://www.cyberguerrilla.org/blog/what-the-blackhats-dont-want-you-to-know-series/
    http://fumalwareanalysis.blogspot.ru/p/malware-analysis-tutorials-reverse.html
    http://www.woodmann.com/TiGa/idaseries.html
    http://visi.kenshoto.com/viki/MainPage
    http://www.radare.org/r/
    http://www.offensivecomputing.net/
    http://www.oldapps.com/
    http://www.oldversion.com/
    https://www.exploit-db.com/webapps/
    http://www.mcafee.com/us/downloads/free-tools/hacmebooks.aspx
    http://www.mcafee.com/us/downloads/free-tools/hacme-casino.aspx
    http://www.mcafee.com/us/downloads/free-tools/hacmeshipping.aspx
    http://www.mcafee.com/us/downloads/free-tools/hacmetravel.aspx

OS Cheat Sheets and Script Syntax

    https://www.owasp.org/index.php/Cheat_Sheets
    http://www.cheat-sheets.org/
    http://ss64.com/nt/
    https://rstforums.com/forum/22324-hacking-tools-windows.rst
    https://en.wikipedia.org/wiki/IPv4_subnetting_reference
    http://www.nixtutor.com/linux/all-the-best-linux-cheat-sheets/
    http://shelldorado.com/shelltips/beginner.html
    http://mywiki.wooledge.org/BashPitfalls
    https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml
    http://www.robvanderwoude.com/ntadmincommands.php
    https://www.sans.org/security-resources/sec560/netcat_cheat_sheet_v1.pdf
    https://countuponsecurity.files.wordpress.com/2015/06/jtr-cheatsheetimg.png
    https://danielmiessler.com/study/tcpdump/
    http://www.infosecwriters.com/Papers/nessusNMAPcheatSheet.pdf

Passwords Wordlists, Hashes, Tools

    http://www.irongeek.com/i.php?page=videos/password-exploitation-class
    https://cirt.net/passwords
    http://h.foofus.net/?page_id=51
    http://h.foofus.net/?page_id=55
    http://foofus.net/?page_id=63
    http://hashcrack.blogspot.ru/
    http://www.onlinehashcrack.com/
    http://www.md5this.com/
    http://contest-2010.korelogic.com/wordlists.html
    https://packetstormsecurity.com/Crackers/wordlists/
    http://hqsoftwarecollection.blogspot.in/p/36gn-wordlist.html
    https://wiki.skullsecurity.org/Passwords
    https://www.sans.org/reading-room/whitepapers/testing/pass-the-hash-attacks-tools-mitigation-33283
    https://www.sans.org/reading-room/whitepapers/testing/crack-pass-hash-33219
    https://nmap.org/ncrack/
    http://www.openwall.com/john/
    http://ophcrack.sourceforge.net/
    https://inquisb.github.io/keimpx/
    http://null-byte.wonderhowto.com/how-to/hack-like-pro-crack-passwords-part-3-using-hashcat-0156543/

Privacy Tools

    https://www.privacytools.io/