• 安全技能樹簡版
  • 說明
    • V1 By @余弦 201706
      • 聯系我：[email protected]
      • 更新動態關註微信公眾號：懶人在思考
    • 工欲善其事必先利其器
    • 世界之大總有一款利器適合你
      • https://github.com/Hack-with-Github/Awesome-Hacking
    • 這份技能樹最適合走向安全工程化之路的人
  • 高效習慣
  • 正則表達式
    • 調試工具
      • Kodos
      • RegexBuddy
      • https://regexper.com/
    • 正則表達式30分鐘入門教程
      • https://deerchao.net/tutorials/regex/regex.htm
    • Python
      • http://wiki.ubuntu.org.cn/Python正則表達式操作指南
  • 數據相關
    • bsddb
    • SQLite
    • MySQL
    • MongoDB
    • Cassandra
    • ELK
      • Elasticsearch
      • Logstash
      • Kibana
    • Neo4j
    • Redis
    • Memcached
    • Hadoop
    • JSON
    • XML
    • cPickle
    • protobuf
  • 從腳本到大並發
    • JavaScript
      • jQuery
      • Bootstrap
        • 前端框架，不僅JavaScript
      • Node.js
        • https://nodejs.org/
      • npm
        • https://www.npmjs.com/
    • Python
      • PEP 8編程習慣
        • https://www.python.org/dev/peps/pep-0008/
      • urllib2
      • socket
      • requests
      • 框架
        • Scrapy
          • 爬蟲框架
        • Django
          • Web開發框架
      • 並發
        • thread/threading
        • multiprocessing
        • gevent
      • pip
        • https://pypi.python.org/pypi
    • Go
      • https://tour.go-zh.org/list
  • HTTP
    • Burp Suite
      • https://portswigger.net/burp/
      • 很多時候，免費版本已經滿足需求
    • Fiddler
      • http://www.telerik.com/fiddler
    • Firefox
      • Firebug
      • NoScript
    • Chrome
      • F12
    • WhatWeb
      • https://github.com/urbanadventurer/whatweb
    • w3af
      • https://github.com/andresriancho/w3af
    • sqlmap
      • https://github.com/sqlmapproject/sqlmap
    • XSS‘OR
      • http://xssor.io/
  • 各種協議
    • 端口掃描
      • Nmap
        • https://nmap.org/
        • https://highon.coffee/blog/nmap-cheat-sheet/
      • Zmap
        • https://www.zmap.io/
      • masscan
        • https://github.com/robertdavidgraham/masscan
        • https://github.com/offensive-security/masscan-web-ui
    • Hydra
      • https://www.thc.org/thc-hydra/
    • Metasploit
      • https://www.metasploit.com/
      • https://github.com/rapid7/metasploit-framework/wiki/Nightly-Installers
    • 流量
      • Wireshark
        • https://www.wireshark.org/
      • TShark
        • https://www.wireshark.org/docs/man-pages/tshark.html
      • Tcpdump
        • http://www.tcpdump.org/
      • Snort
        • https://www.snort.org/
      • Bro
        • https://www.bro.org/
      • Moloch
        • http://molo.ch/
      • Suricata
        • https://suricata-ids.org/
  • 漏洞測試
    • 漏洞環境
      • Metasploitable3
        • https://github.com/rapid7/metasploitable3
      • WebGoat
        • https://github.com/WebGoat/WebGoat
      • DVWA
        • https://github.com/ethicalhack3r/DVWA
      • XVWA
        • https://github.com/s4n7h0/xvwa
    • 網絡空間搜索引擎
      • Google
      • ZoomEye
        • https://www.zoomeye.org/
      • Shodan
        • https://www.shodan.io/
      • Censys
        • https://censys.io/
    • 漏洞庫
      • Exploit-DB
        • https://www.exploit-db.com/
        • https://www.exploit-db.com/searchsploit/
      • Seebug
        • https://www.seebug.org/
      • 0day.today
        • http://0day.today/
  • 滲透測試
    • 洛馬七步殺
      • http://www.lockheedmartin.com/us/what-we-do/aerospace-defense/cyber/cyber-kill-chain.html
    • Penetration Testing Tools Cheat Sheet
      • https://highon.coffee/blog/penetration-testing-tools-cheat-sheet/
    • 端口轉發
      • 最基礎的SSH隧道
        • https://www.ibm.com/developerworks/cn/linux/l-cn-sshforward/index.html
      • iptables -t nat
        • https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/4/html/Security_Guide/s1-firewall-ipt-fwd.html
      • rtcp.py
        • https://github.com/knownsec/rtcp
      • 姿勢大全
        • https://artkond.com/2017/03/23/pivoting-guide/
    • Reverse Shell Cheat Sheet
      • http://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
    • 部分框架
      • Kali Linux
        • http://tools.kali.org/tools-listing
      • Pentest Box
        • https://pentestbox.org/
      • Maltego
        • https://www.paterva.com/web7/
      • The Social-Engineer Toolkit (SET)
        • https://github.com/trustedsec/social-engineer-toolkit
      • Cobalt Strike
        • https://www.cobaltstrike.com/
      • Nmap
      • Metasploit
      • BeEF
        • http://beefproject.com/
      • mitmproxy
        • https://mitmproxy.org/
  • 防禦
    • 暴力美學
      • 不需要必須放線上的服務都下線
      • 默認關閉所有端口，只開需要的
      • 服務器登錄只允許公私鑰形式
      • 幹掉一切明文傳輸
      • 使用口碑好的第三方服務及組件
      • 備份備份再備份
      • 假設自己正被“洛馬七步殺”
    • 部分工具
      • 流量
      • Security Onion
        • https://securityonion.net/
      • OSSEC
        • https://ossec.github.io/
      • Splunk
        • https://www.splunk.com/
      • ELK
      • Lynis
        • https://cisofy.com/lynis/
      • iptables/防火墻
      • JWT
        • https://jwt.io/
    • 資料
      • 程序員與黑客系列
        • http://www.infoq.com/cn/presentations/programmers-and-hackers
        • http://www.infoq.com/cn/presentations/programmers-and-hackers-part02
      • 實用性開發人員安全須知
        • https://github.com/FallibleInc/security-guide-for-developers
      • SaaS型初創企業安全101
        • https://github.com/forter/security-101-for-saas-startups

安全技能樹簡版（轉）