security.md

security

blogs/ressources

• https://www.nsa.gov/News-Features/the-next-wave/
• https://www.mdpi.com/2076-3417/10/16/5607
• https://docs.securityonion.net/en/2.3/
• https://github.com/safe-graph/graph-fraud-detection-papers
• https://github.com/dvopsway/datasploit
• https://github.com/cugu/awesome-forensics
• https://www.youtube.com/watch?v=nMnHBnYfIaI

forensics

binary analysis

• https://ghidra-sre.org/

exploits

• metasploit
• armitage
• threat hunting
  • https://kestrel.readthedocs.io/en/latest/
  • https://github.com/microsoft/msticpy

scanning

mobile devices

• https://github.com/mvt-project/mvt

AI models

• https://github.com/Azure/counterfit/ https://www.microsoft.com/security/blog/2021/05/03/ai-security-risk-assessment-using-counterfit/
• https://atlas.mitre.org/
• https://github.com/Trusted-AI/adversarial-robustness-toolbox

APT scanning

• https://github.com/cisagov/CHIRP

big data

• apache metron https://metron.apache.org

log analysis

• https://github.com/marty90/netlytics
• https://github.com/s1l3nt78/sifter
• https://github.com/laramies/theHarvester
• https://github.com/j3ssie/Osmedeus
• https://github.com/jaeles-project/jaeles

cloud

• https://github.com/matanolabs/matano

metron tips

• https://datahovel.com/2018/07/18/how-to-onboard-a-new-data-source-in-apache-metron/

device identification

• user agent / SSDP simple service discovery protocol
• ntopng & DNS queries

security training

• https://www.pagerduty.com/blog/security-training-at-pagerduty/

kerberos

• https://fy.blackhats.net.au/blog/html/2017/05/23/kerberos_why_the_world_moved_on.html
• debugging kerberos set KRB5_TRACE

workflow SOC

• https://github.com/microsoft/msticpy

cloud security

• https://forsetisecurity.org

container

• https://sysdig.com/blog/container-security-best-practices/

tools

• great tooling overview https://open-source-security-software.net

containers

screening containers

• https://github.com/quay/clair

networking

wifi

• https://shop.hak5.org/

pentesting

input

• https://github.com/minimaxir/big-list-of-naughty-strings

hats

white

grey

• https://www.cyborgsecurity.com/python-malware-on-the-rise/

red team

videos

• spark big data security https://www.youtube.com/watch?v=5GvfPGcdhqI and https://www.youtube.com/watch?v=YxTE4mff5dk

privacy

• https://www.whonix.org/
• https://getoutline.org/de/
• suggestions https://news.ycombinator.com/item?id=28008571

cloud

permission escalation

• https://github.com/netskopeoss/iaas_permission_mining

data collection

honey pot

• https://github.com/telekom-security/tpotce

CTFs

• unit calculators hex, decimal, binary https://gchq.github.io/CyberChef/

people & organization

• https://owasp.org/www-project-security-culture/v10/4-Security_Champions/

red teaming

reverse shells

• polymorphic
  • https://github.com/projectdiscovery/interactsh