黑客成长必备|安全技能树简版

内容简介：黑客成长必备|安全技能树简版

• 说明
  
  • V1 By @余弦 201706
    
    • 联系我：evilcos@gmail.com
    • 更新动态关注微信公众号：懒人在思考
  • 工欲善其事必先利其器
  • 世界之大总有一款利器适合你
    
    • https://github.com/Hack-with-Github/Awesome-Hacking  
• 这份技能树最适合走向安全工程化之路的人

• 高效习惯
  
  • VIM
    

    • 简明 VIM 练级攻略

      • http://coolshell.cn/articles/5426.html
  • Markdown
  • Git
    
    • https://try.github.io/
  • FreeMind/XMind
  • yEd
  • Evernote
  • Windows
    
    • Putty
      
      • https://www.chiark.greenend.org.uk/ ~sgtatham/putty/latest.html
    • WinSCP
    • SysinternalsSuite
  • Mac
    
    • iTerm2
      
      • http://www.iterm2.com/
    • Homebrew
      
      • https://brew.sh/
  • Linux
    
    • Bash
      
      • https://github.com/jlevy/the-art-of-command-line  
    • https://github.com/Idnan/bash-guide  
• tmux/screen/grep/zgrep/awk/sed/cut/find/du/df/dd/ls/cat/cd/pwd/id/free/ps/netstat/vmstat/top/crontab/tree/tail/head/vi/ifconfig/lsof/dig/mount/strings/uname/echo/history/tar/unzip/gzip/zip/diff/md5sum/file/base64/rm/mv/gcc/kill/chown/chmod/last/whoami/strace/ltrace/iptables/nohup/nc/scp/ssh/telnet

隔离

• VMware
• VirtualBox
• Parallels Desktop
• Docker

翻墙

• https://github.com/shadowsocks  

proxychains

暗网

• https://alphabaymarket.com/

硬件

• iPhone+iPad+Mac
• ThinkPad

云服务

• VPS
  
  • AWS
  • Linode
  • Vultr
  • DigitalOcean
• Dropbox
• OneDrive
• Google Docs
• Email
  
  • Gmail
  • Outlook
  • ProtonMail

安全

• GPG
  
  • https://gnupg.org/download/index.html
• TrueCrypt

情报跟进

• Inoreader
• Twitter

• 正则表达式

  • 调试工具
    
    • Kodos
    • RegexBuddy
    • https://regexper.com/
  • 正则表达式30分钟入门教程
    
    • https://deerchao.net/tutorials/regex/regex.htm
  • Python
    
    • http://wiki.ubuntu.org.cn/Python 正则表达式操作指南

• 数据相关

  • bsddb
  • SQLite
  • MySQL
  • MongoDB
  • Cassandra
  • ELK
    
    • Elasticsearch
    • Logstash
    • Kibana
  • Neo4j
  • Redis
  • Memcached
  • Hadoop
  • JSON
  • XML
  • cPickle
  • protobuf

• 从脚本到大并发

  • JavaScript
    
    • jQuery
    • Bootstrap
      
      • 前端框架，不仅JavaScript
    • Node.js
      
      • https://nodejs.org/
    • npm
      
      • https://www.npmjs.com/
  • Python
    
    • PEP 8编程习惯
      
      • https://www.python.org/dev/peps/pep-0008/
    • urllib2
    • socket
    • requests
    • 框架
      
      • Scrapy
        
        • 爬虫框架
      • Django
        
        • Web开发框架
    • 并发
      
      • thread/threading
      • multiprocessing
      • gevent
    • pip
      
      • https://pypi.python.org/pypi
  • Go
    
    • https://tour.go-zh.org/list

• HTTP
  
  • Burp Suite
    
    • https://portswigger.net/burp/
    • 很多时候，免费版本已经满足需求
  • Fiddler
    
    • http://www.telerik.com/fiddler
  • Firefox
    
    • Firebug
    • NoScript
  • Chrome
    
    • F12
  • WhatWeb
    
    • https://github.com/urbanadventurer/whatweb  
• w3af
  
  • https://github.com/andresriancho/w3af  

sqlmap

• https://github.com/sqlmapproject/sqlmap  

XSS’OR

• http://xssor.io/

• 各种协议

  • 端口扫描

    • Nmap
      
      • https://nmap.org/
      • https://highon.coffee/blog/nmap-cheat-sheet/
    • Zmap
      
      • https://www.zmap.io/
    • masscan
      
      • https://github.com/robertdavidgraham/masscan  
    • https://github.com/offensive-security/masscan-web-ui  

Hydra

• https://www.thc.org/thc-hydra/

Metasploit

• https://www.metasploit.com/
• https://github.com/rapid7/metasploit-framework/wiki/Nightly-Installers  

流量

• Wireshark
  
  • https://www.wireshark.org/
• TShark
  
  • https://www.wireshark.org/docs/man-pages/tshark.html
• Tcpdump
  
  • http://www.tcpdump.org/
• Snort
  
  • https://www.snort.org/
• Bro
  
  • https://www.bro.org/
• Moloch
  
  • http://molo.ch/
• Suricata
  
  • https://suricata-ids.org/

• 漏洞测试
  
  • 漏洞环境
    

    • Metasploitable3

      • https://github.com/rapid7/metasploitable3  
  • WebGoat
    
    • https://github.com/WebGoat/WebGoat  
• DVWA
  
  • https://github.com/ethicalhack3r/DVWA  

XVWA

• https://github.com/s4n7h0/xvwa  

网络空间搜索引擎

• Google
• ZoomEye
  
  • https://www.zoomeye.org/
• Shodan
  
  • https://www.shodan.io/
• Censys
  
  • https://censys.io/

漏洞库

• Exploit-DB
  
  • https://www.exploit-db.com/
  • https://www.exploit-db.com/searchsploit/
• Seebug
  
  • https://www.seebug.org/
• 0day.today
  
  • http://0day.today/

• 渗透测试
  
  • 洛马七步杀
    
    • http://www.lockheedmartin.com/us/what-we-do/aerospace-defense/cyber/cyber-kill-chain.html
  • Penetration Testing Tools Cheat Sheet
    
    • https://highon.coffee/blog/penetration-testing-tools-cheat-sheet/
  • 端口转发
    
    • 最基础的SSH隧道
      
      • https://www.ibm.com/developerworks/cn/linux/l-cn-sshforward/index.html
    • iptables -t nat
      
      • https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/4/html/Security_Guide/s1-firewall-ipt-fwd.html
    • rtcp.py
      
      • https://github.com/knownsec/rtcp  
  • 姿势大全
    
    • https://artkond.com/2017/03/23/pivoting-guide/
• Reverse Shell Cheat Sheet
  
  • http://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
• 部分框架
  
  • Kali Linux
    
    • http://tools.kali.org/tools-listing
  • Pentest Box
    
    • https://pentestbox.org/
  • Maltego
    
    • https://www.paterva.com/web7/
  • The Social-Engineer Toolkit (SET)
    
    • https://github.com/trustedsec/social-engineer-toolkit  
• Cobalt Strike
  
  • https://www.cobaltstrike.com/
• Nmap
• Metasploit
• BeEF
  
  • http://beefproject.com/
• mitmproxy
  
  • https://mitmproxy.org/

• 防御

  • 暴力美学
    
    • 不需要必须放线上的服务都下线
    • 默认关闭所有端口，只开需要的
    • 服务器登录只允许公私钥形式
    • 干掉一切明文传输
    • 使用口碑好的第三方服务及组件
    • 备份备份再备份
    • 假设自己正被“洛马七步杀”
  • 部分工具
    
    • 流量
    • Security Onion
      
      • https://securityonion.net/
    • OSSEC
      
      • https://ossec.github.io/
    • Splunk
      
      • https://www.splunk.com/
    • ELK
    • Lynis
      
      • https://cisofy.com/lynis/
    • iptables/防火墙
    • JWT
      
      • https://jwt.io/
  • 资料
    
    • 程序员与黑客系列
      
      • http://www.infoq.com/cn/presentations/programmers-and-hackers
      • http://www.infoq.com/cn/presentations/programmers-and-hackers-part02
    • 实用性开发人员安全须知
      
      • https://github.com/FallibleInc/security-guide-for-developers   
    • SaaS型初创企业安全101
      
      • https://github.com/forter/security-101-for-saas-startups   

*本文作者：余弦，投稿者：zglaozhu，转载请注明来自FreeBuf.COM

以上就是本文的全部内容，希望对大家的学习有所帮助，也希望大家多多支持 码农网

查看所有标签

本站部分资源来源于网络，本站转载出于传递更多信息之目的，版权归原作者或者来源机构所有，如转载稿涉及版权问题，请联系我们。