Essential Resources for Red Team in Cyber Security

Roadmap

1. https://roadmap.sh/cyber-security
2. Roadmap for Beginners : Cyber_Security_Roadmap_(Beginners)_ethicalhackx.pdf

CTF / Skills practice platforms:

1. Picoctf: https://picoctf.org/
2. Tryhackme: https://tryhackme.com/
3. Hackthebox : https://www.hackthebox.com/
4. Root-me: https://www.root-me.org/
5. pwned labs: https://pwnedlabs.io/
6. Ctftime: https://ctftime.org/
7. portswigger: https://portswigger.net/web-security
8. ctflearn : https://ctflearn.com/
9. hackthissite : https://www.hackthissite.org/
10. google-gruyere : https://google-gruyere.appspot.com/
11. Damn Vulnerable iOS App – https://github.com/prateek147/DVIA
12. Defend the Web : https://defendtheweb.net/
13. OverTheWire: https://overthewire.org/wargames/
14. hacksplaining : https://www.hacksplaining.com/
15. hackinghub: https://app.hackinghub.io/
16. Embedded Security CTF: https://microcorruption.com/
17. xss practice : https://xss-game.appspot.com/level1
18. . CyberWolf-Security: https://leonteale.gitbook.io/cyberwolf-security\
19. HTB Academy: https://academy.hackthebox.com/
20. Hackmyvm: https://hackmyvm.eu/
21. Vulnlab: https://www.vulnlab.com/
22. Thunder CTF : https://labs.thundercipher.tech
23. Bug Bounty Hunter: https://www.bugbountyhunter.com/
24. Pwnable: https://pwnable.kr/#
25. Crackme: https://crackmes.one/
26. Offset play : https://portal.offsec.com/labs/play
27. Offsec Practice : https://portal.offsec.com/labs/practice
28. pentesterlab : https://pentesterlab.com/
29. sourcecodester : https://www.sourcecodester.com/

Source Code Review

1. securecode : https://securecode.wiki/
2. sourcecodester : https://www.sourcecodester.com/

Cloud

1. https://hackingthe.cloud/

Bug Hunting platforms

1. Bugcrowd
2. HackerOne
3. yeswehack
4. Intigriti
5. HackenProof
6. openbounty

Invitation based

1. Synack : https://boards.greenhouse.io/synacksrt/jobs/150860
2. Yogosha : https://app.yogosha.com/signup/researcher
3. Cobalt: https://boards.greenhouse.io/cobaltio/jobs/5688200002

API testing

1. https://www.freecodecamp.org/news/what-is-an-api-and-how-to-test-it/
2. https://cheatography.com/tag/api

General useful links

1. bb radar: https://bbradar.io/
2. Zero-day: https://0day.today/
3. https://vulnrepo.com/
4. https://reconshell.com/bug-bounty-tools/

Writeup or cheat sheet

1. https://infosecwriteups.com/
2. https://pentester.land/writeups/
3. https://rashahacks.com/
4. https://d00mfist1.gitbooks.io/ctf/content
5. https://swisskyrepo.github.io/
6. https://appsecexplained.gitbook.io/appsecexplained
7. https://ed4m4s.blog
8. https://cheatsheetseries.owasp.org/
9. https://www.ired.team/

Tools

1. Burpsuite
2. Caido
3. owasp zap
4. nessus
5. Metasploit
6. openVAS
7. Wireshark
8. w3af
9. Hashcat
10. John the ripper
11. Postman
12. Netsparker
13. Nikto

Recon Tools

1. subfinder : https://github.com/projectdiscovery/subfinder
2. Sublist3r : https://github.com/aboul3la/Sublist3r
3. Assetfinder : https://github.com/tomnomnom/assetfinder
4. Censys: https://search.censys.io/
   • Censys Queries: https://github.com/thehappydinoa/awesome-censys-queries
5. Shodan: https://www.shodan.io/
   • Shodan Search Queries: https://github.com/jakejarvis/awesome-shodan-queries
6. Keyhacks: https://github.com/streaak/keyhacks
7. Pdtm : https://github.com/projectdiscovery/pdtm
8. nuclei : https://github.com/projectdiscovery/nuclei
9. notify : https://github.com/projectdiscovery/notify
10. waybackurls: https://github.com/tomnomnom/waybackurls
11. Httpx: https://github.com/projectdiscovery/httpx
12. Amass : https://github.com/owasp-amass/amass
13. Paramspider : https://github.com/devanshbatham/ParamSpider
14. way more: https://github.com/xnl-h4ck3r/waymore
15. Ffuf : https://github.com/ffuf/ffuf
16. Jsecret : https://github.com/raoufmaklouf/jsecret
17. Jsfscan : https://github.com/KathanP19/JSFScan.sh
18. JS-Scan : https://github.com/zseano/JS-Scan
19. Fofa : https://en.fofa.info/
    • Dorks : https://github.com/FofaInfo/Awesome-FOFA
20. Knock : https://github.com/guelfoweb/knock
21. Wayback archive web version : https://web.archive.org/cdx/search/cdx?url=.domain.com/&output=text&fl=original&collapse=urlkey
22. Pentest-tools: https://pentest-tools.com/
23. Gowitness: https://github.com/sensepost/gowitness
24. ZoomEye: https://github.com/knownsec/ZoomEye-python
25. EyeWitness : https://github.com/RedSiege/EyeWitness
26. Aquatone : https://github.com/michenriksen/aquatone
27. Crlfi: https://github.com/karthi-the-hacker/crlfi
28. XSStrike : https://github.com/s0md3v/XSStrike
29. Subdominator: https://github.com/RevoltSecurities/Subdominator
30. Dnsdumpster: https://dnsdumpster.com/
31. Feroxbuster : https://github.com/epi052/feroxbuster
32. Rustscan : https://github.com/RustScan/RustScan
33. Gau : https://github.com/lc/gau
34. OpenRedireX : https://github.com/devanshbatham/OpenRedireX
35. Nmap : https://nmap.org/download.html
36. Dirsearch : https://github.com/maurosoria/dirsearch
37. Gobuster : https://github.com/OJ/gobuster
38. Reconftw : https://github.com/six2dez/reconftw
39. Altdns : https://github.com/infosec-au/altdns
40. Rustscan : https://github.com/RustScan/RustScan
41. Gospider : https://github.com/jaeles-project/gospider
42. Naabu : https://github.com/projectdiscovery/naabu
43. Assetfinder : https://github.com/tomnomnom/assetfinder
44. Gotator : https://github.com/Josue87/gotator
45. Masscan : https://github.com/robertdavidgraham/masscan
46. Infoga : https://github.com/The404Hacking/Infoga
47. JSFScan : https://github.com/KathanP19/JSFScan.sh
48. Slackcat : https://github.com/dwisiswant0/slackcat
49. GitGraber : https://github.com/hisxo/gitGraber
50. Red Hawk : https://github.com/Tuhinshubhra/RED_HAWK
51. Anew : https://github.com/tomnomnom/anew
52. sql map : https://github.com/sqlmapproject/sqlmap
53. jsql-injection : https://github.com/ron190/jsql-injection
54. bbqsql : https://github.com/CiscoCXSecurity/bbqsql
55. Dsss : https://github.com/stamparm/DSSS
56. whitewindow : https://github.com/WhitewidowScanner/whitewidow
57. 403bypasser : https://github.com/yunemse48/403bypasser
58. WhatWeb : https://github.com/urbanadventurer/WhatWeb
59. dalfox : https://github.com/hahwul/dalfox
60. XSStrike : https://github.com/s0md3v/XSStrike
61. xss_vibes : https://github.com/faiyazahmad07/xss_vibes
62. jsecrets : https://github.com/pixielabs/jsecrets
63. cloud enum : https://github.com/initstring/cloud_enum
64. Hunter: https://hunter.how/
65. Blindf: https://dorkking.blindf.com/
66. Bgp: https://bgp.he.net/
67. Nuclei Templates: https://nuclei-templates.netlify.app/
68. SecretFinder : https://github.com/m4ll0k/SecretFinder

Post exploitation

1. Linux exploit suggested: https://github.com/The-Z-Labs/linux-exploit-suggester
2. linpeas : https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS
3. LinEnum : https://github.com/rebootuser/LinEnum

Note-taking apps

1. Obsidian
2. Notion
3. Cherry Tree
4. One Note
5. gitbook
6. evernote
7. joplin

Test bugs in bug hunting or penetration testing

Spawning a shell

python -c 'import pty; pty.spawn("/bin/sh")' 
python3 -c 'import pty; pty.spawn("/bin/bash")'

script -qc /bin/bash /dev/null

echo os.system('/bin/bash') 
/bin/sh -i 
perl -e 'exec "/bin/sh";' 
perl: exec "/bin/sh"; 
ruby: exec "/bin/sh" 
lua: os.execute('/bin/sh') 
exec "/bin/sh"; 
/bin/bash -i
exec "/bin/sh"                # (From within IRB) 
:!bash                        # (From within vi)
:set shell=/bin/bash:shell    # (From within vi) 
!sh                           # (From within nmap) 

Interactive shell

which python3
python3 -c 'import pty; pty.spawn("/bin/bash")'
ctrl + z
stty raw -echo; fg
export TERM=xterm

Privilege Escalation

Linux

1. https://medium.com/@Varma_Chekuri/linux-privilege-escalation-part-1-c35b6c5b4841
2. https://medium.com/@Varma_Chekuri/privilege-escalation-in-linux-2-c2ececd7f385
3. https://medium.com/@Varma_Chekuri/privilege-escalation-in-linux-3-b1430b1ea221

Windows

1. https://medium.com/@Varma_Chekuri/windows-privilege-escalation-aa2c048d246b
2. https://medium.com/@Varma_Chekuri/windows-privilege-escalation-2-f0dfb1021213

Reverse shell links

1. https://www.revshells.com/
2. https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/shell-reverse-cheatsheet/
3. https://d00mfist1.gitbooks.io/ctf/content/spawning_shells.html

Binaries

1. Gtfobins: https://gtfobins.github.io/ [unix / Linux ]
2. Lolbas: https://lolbas-project.github.io/ [ windows ]
3. drivers: https://www.loldrivers.io/ [ Vulnerable drivers ]

GitHub Repos

1. https://github.com/The-Art-of-Hacking/h4cker
2. https://github.com/Hack-with-Github/Awesome-Hacking
3. https://github.com/enaqx/awesome-pentest
4. https://github.com/B3nac/Android-Reports-and-Resources
5. https://github.com/infoslack/awesome-web-hacking
6. https://github.com/JohnHammond/security-resources

Wordlists

1. https://github.com/random-robbie/bruteforce-lists
2. https://wordlists.assetnote.io/
3. https://github.com/danielmiessler/SecLists
4. https://github.com/kongsec/Wordpress-BruteForce-List

Checklists

1. https://github.com/KathanP19/HowToHunt
2. https://github.com/Az0x7/vulnerability-Checklist
3. https://github.com/swisskyrepo/PayloadsAllTheThings

Extensions

Browser Extensions

1. wappalyzer
2. Cookie Editor
3. Http headers
4. foxyproxy
5. fileon
6. open multiple URLs
7. hackbar
8. shodan
9. netcraft
10. Builtwith
11. Google Maps Api Checker

Burp Suite extensions

1. Collaborator everywhere
2. InQL – GraphQL Scanner
3. param miner
4. NoSQLi Scanner
5. JSON Web Tokens

Keep up to date with the latest news

Appsec

1. https://github.com/Simpsonpt/AppSecEzine
2. https://www.reddit.com/r/websecurityresearch/
3. https://appsec.beehiiv.com/

Yearly Reports

1. https://survey.stackoverflow.co/2023/
2. https://www.verizon.com/business/resources/reports/dbir/2023/master-guide/
3. https://www.hackerone.com/resources/reporting/7th-annual-hacker-powered-security-report-2023

General CyberSecurity News

1. https://tldrsec.com/
2. https://www.reddit.com/r/netsec/
3. https://thehackernews.com/
4. https://executiveoffense.beehiiv.com/
5. https://danielmiessler.com/
6. https://www.hackthebox.com/blog/

Others

1. https://www.criticalthinkingpodcast.io/
2. https://www.theregister.com/
3. https://www.youtube.com/c/GeraldAuger
4. https://hackyx.io/
5. https://dorki.io
6. https://bbradar.io/
7. https://book.hacktricks.xyz/
8. https://cheatsheetseries.owasp.org/IndexTopTen.html
9. https://appsecexplained.gitbook.io/appsecexplained/
10. https://osintframework.com/
11. https://quickref.me/index.html
12. https://www.cvedetails.com/
13. https://cvexploits.io/
14. https://sqlitebrowser.org/

Youtube

1. https://www.youtube.com/@RanaKhalil101
2. https://www.youtube.com/@ippsec
3. https://www.youtube.com/@criticalthinkingpodcast
4. https://www.youtube.com/@BittenTech
5. https://www.youtube.com/@CristiVladZ
6. https://www.youtube.com/@FarahHawa
7. https://www.youtube.com/@HackerSploit
8. https://www.youtube.com/@InsiderPhD
9. https://www.youtube.com/@_JohnHammond
10. https://www.youtube.com/@LiveOverflow
11. https://www.youtube.com/@LoiLiangYang
12. https://www.youtube.com/@TheXSSrat
13. https://www.youtube.com/@TomNomNomDotCom
14. https://youtube.com/@impratikdabhi
15. https://www.youtube.com/@jhaddix
16. https://www.youtube.com/@ByteBloggerBase
17. https://www.youtube.com/@TylerRamsbey
18. https://www.youtube.com/@BugBountyReportsExplained
19. https://www.youtube.com/@NetworkChuck
20. https://www.youtube.com/@networkchuckacademy

Twitter

1. https://twitter.com/jhaddix
2. https://twitter.com/NahamSec
3. https://twitter.com/stokfredrik
4. https://twitter.com/3nc0d3dGuY
5. https://x.com/HunterMapping
6. https://x.com/Bugcrowd
7. https://x.com/Hacker0x01
8. https://x.com/yeswehack
9. https://x.com/intigriti
10. https://twitter.com/adityashende17
11. https://twitter.com/GodfatherOrwa
12. https://x.com/CVEnew
13. https://twitter.com/h4x0r_fr34k
14. https://twitter.com/ReconOne_bk
15. https://twitter.com/theXSSrat
16. https://x.com/7h3h4ckv157
17. https://twitter.com/TCMSecurity
18. https://twitter.com/0xTib3rius
19. https://twitter.com/trick3st
20. https://twitter.com/Ox4d5a
21. https://twitter.com/CyberWarship
22. https://x.com/hunter0x7

Referrals

1. Digitalocean : https://m.do.co/c/1f650a3ace33
2. Hostinger : https://hostinger.in?REFERRALCODE=1NAGASAIKIR24

when I find good resources or if you find good resources mentioned in the comments I’ll update the blog

Happy Hacking !!!

Connect me on
Linkedin: https://www.linkedin.com/in/nagasaikiran010/