Learn to hack
This page aims to compile high quality resources for hackers. All books listed on this page can be found on Library Genesis.
Make sure that you follow good OPSEC when carrying out your operations! See OPSEC
General Resources
Resources that assume little to no background knowledge:
Resources that assume minimal tech background:
- (book) Penetration Testing: A Hands-On Introduction to Hacking
- Bassterlord Networking Manual (translated): https://papers.vx-underground.org/papers/VXUG/Mirrors/BassterlordNetworkingManual.pdf
- https://papers.vx-underground.org/papers/Malware%20Defense/Malware%20Analysis%202021/2021-08-31%20-%20Bassterlord%20(FishEye)%20Networking%20Manual%20(X).pdf
Resources that assume a tech or hacking background:
- (book) The Hacker Playbook 3
- Hack Back! A DIY Guide
- https://github.com/ForbiddenProgrammer/conti-pentester-guide-leak
- translated: Conti playbook
Practice labs:
- https://www.hackthebox.com
- https://academy.hackthebox.com
- https://www.pentesteracademy.com
- https://lab.pentestit.ru
- https://overthewire.org/wargames
Appsec:
General references
General resources you may find useful for learning. see General
OWASP Top 10 is a broad consensus about the most critical security risks to web applications. See TryHackMe's room for practical OWASP Top 10 learning and their Juice Shop.
Red Team Tools for post exploitation (Windows)
Find common vulnerabilities and misconfigurations in a windows environment to escalate your privileges: winPEAS
Red Team Tools for post exploitation (Linux)
Rooting: Rooting linux
Linux & Windows Backdoors
- Gsocket: https://github.com/hackerschoice/gsocket
- PHP: https://github.com/epinna/weevely3
- Reverse Shell Generator: https://www.revshells.com
- Meterpreter: https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md#meterpreter-shell
- Blog: https://dhilipsanjay.gitbook.io/ctfs/tryhackme/tryhackme/linuxbackdoors
- Database: https://www.adminer.org
Recommended reading - Library
See recommended reading books that will aid you in your learning. See recommended reading in the library
Malware
Collection of malware source code and binaries:
- https://github.com/vxunderground/MalwareSourceCode
- https://github.com/ytisf/theZoo/tree/master/malware
Active Directory
Active Directory General Tools & resources you may find useful for learning. see Active Directory
Tools
- https://mpgn.gitbook.io/crackmapexec/
- https://www.secureauth.com/labs/open-source-tools/impacket/
- https://github.com/dirkjanm/mitm6
- https://github.com/lgandx/Responder
- https://github.com/FuzzySecurity/StandIn
- https://www.joeware.net/freetools/tools/adfind/
- https://github.com/CravateRouge/bloodyAD
- https://github.com/blacklanternsecurity/MANSPIDER
- https://github.com/login-securite/DonPAPI
- Powerview/Sharpview
- Bloodhound/Sharphound
Office 365 & Azure
- Extremely in-depth technical info on everything https://o365blog.com/
- https://www.synacktiv.com/en/publications/azure-ad-introduction-for-red-teamers.html
- https://blog.xpnsec.com/azuread-connect-for-redteam/
- AAD Connect Cloud Sync: as local admin impersonate or retrieve managed password of the provagentgMSA account to dcsync.
- https://www.blackhillsinfosec.com/webcast-getting-started-in-pentesting-the-cloud-azure/
- https://github.com/dafthack/CloudPentestCheatsheets/blob/master/cheatsheets/Azure.md
- https://www.inversecos.com/
Tools
- https://github.com/nyxgeek/o365recon
- https://github.com/dirkjanm/ROADtools
- https://github.com/fox-it/adconnectdump
- https://github.com/LMGsec/o365creeper
- https://bloodhound.readthedocs.io/en/latest/data-collection/azurehound.html
- https://github.com/rvrsh3ll/TokenTactics
- https://github.com/nyxgeek/onedrive_user_enum
- https://github.com/dafthack/MSOLSpray
- https://github.com/dafthack/MFASweep
GSuite
https://www.slideshare.net/dafthack/ok-google-how-do-i-red-team-gsuite
C2 Frameworks
Antivirus & EDR Evasion
- https://s3cur3th1ssh1t.github.io/Bypass_AMSI_by_manual_modification/
- https://s3cur3th1ssh1t.github.io/Customizing_C2_Frameworks/
- https://s3cur3th1ssh1t.github.io/Powershell-and-the-.NET-AMSI-Interface/
- https://www.blackhillsinfosec.com/tag/sacred-cash-cow-tipping/
- https://blog.securityevaluators.com/creating-av-resistant-malware-part-1-7604b83ea0c0
- https://www.ired.team/offensive-security/defense-evasion
- https://www.youtube.com/watch?v=UO3PjJIiBIE
- https://github.com/matterpreter/DefenderCheck
- https://github.com/RythmStick/AMSITrigger
- https://amsi.fail
VMware
- Exploiting vCenter to add vSphere user: https://github.com/HynekPetrak/HynekPetrak/blob/master/take_over_vcenter_670.md
- VMware Workspace ONE Access and Identity Manager RCE via SSTI. CVE-2022-22954: Unauthenticated server-side template injection. Mass Exploit
RocketChat
- Account hijacking and RCE as admin: https://edbrsk.dev/content/real-cases/how-I-compromised-300-stores-and-a-spanish-consultancy
Microsoft Exchange
ProxyLogon is dead. It's mitigated by Defender. ProxyShell is not. AMSI catches unmodified public exploits.
- ProxyShell: https://github.com/dmaasland/proxyshell-poc
- Improved proxyshell-poc: https://github.com/horizon3ai/proxyshell
- ProxyShell (webshell via New-MailboxExportRequest): https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/exploit/windows/http/exchange_proxyshell_rce.md
- ProxyShell (webshell via New-ExchangeCertificate): https://gist.github.com/dmaasland/0720891aaf6dec8d3b42a5b92c8d6f94
- Polymorphic webshells: https://github.com/grCod/poly
- ProxyShell (no webshell, dump mailboxes via PowerShell): https://github.com/Jumbo-WJB/Exchange_SSRF
- Export all mailboxes:
foreach ($mbx in (Get-Mailbox)){New-MailboxExportRequest -mailbox $mbx.alias -FilePath "\\127.0.0.1\C$\Folder\$($mbx.Alias).pst"}
- Proxylogon, proxyshell, proxyoracle and proxytoken full chain exploit tool: https://github.com/FDlucifer/Proxy-Attackchain
- Automatic ProxyShell Exploit: https://github.com/Udyz/proxyshell-auto
Initial Access
There are many ways to get a foothold into a targets network, from phishing, buying credential access, buying infected machines in corporate networks, password spraying, performing a targeted penetration test and spray and pray scanning for vulnerabilities and hacking in. Here we list some resources in these regards.
For more information on gaining a foothold, see Initial Access Tactics, techniques and procedures
Scanning and Recon
For scanning and Recon tools. see Scanning and Recon. Make sure to make us of your tools documentation and read the help menu (-hh/-h/--help).
Search Engines
Search engines are a useful tool for gathering information and intelligence from publicly available sources. Some are paid and some are not. Make sure to operate good OPSEC whenever placing a purchase for any service that will be used in your recon on a target.
For more information on recommended search engines, see Search Engines Resources
OSINT
Open-source intelligence (OSINT) refers to the collection and analysis of information from publicly available sources.
For more information on recommended tools and resources, see OSINT Tools and Resources
API Hacking
- Prerequisite reading: (Book) Hacking APIs: Breaking Web Application Programming Interfaces
- https://github.com/arainho/awesome-api-security
- OWASP API Security
- KiteRunner, API content discovery. https://github.com/assetnote/kiterunner
- https://github.com/dsopas/MindAPI
- Decode JSON Web Tokens (Online): https://jwt.io
Intercepting proxies
These let you view, edit, and replay requests, and are extremely useful for finding vulnerabilities in web, mobile and API applications.
- https://portswigger.net/burp
- https://www.zaproxy.org
- https://mitmproxy.org
- https://www.postman.com (API focused)
API hacking practice
API hacking blogs
IoT Hacking
Hacking blogs
It's important that we as hackers stay fully up to date and get the latest cyber security news which will allow us to learn new TTPs, find out when new vulnerabilities and exploits are released and stay up to date with the latest news. White hats typically do a lot of the brunt work for us with developing tools and coming up with new interesting and innovative methods which we can learn from and apply this knowledge to our hacktivist operations. We can also learn how hackers get arrested and their OPSEC fails which will enable us to avoid making the same mistakes they did.
See Hacking blogs.
Operational security
Operational security (OPSEC) is crucial for protecting oneself from surveillance and maintaining anonymity while conducting hacktivist activities.
Recommended Measures
Any illegal hacktivity should be done from an encrypted and separate computer or virtual machine, with all traffic router over Tor.
For more information on recommended operational security measures, see Opsec Measures
Secure Messaging
Best practice for secure messaging includes proxying connections over Tor and using end-to-end encryption for messages.
Recommended Applications
For Jabber/XMPP, make sure to enable OTR or OMEMO encryption. For email use PGP for encryption. For file sharing use onionshare.
For more information on recommended applications, see Secure Messaging Applications