Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/HackingCost/CyberSpace-Security-Learning
网络安全学习wiki，包括Web安全、内网安全、云安全、免杀绕过等（持续更新）
https://github.com/HackingCost/CyberSpace-Security-Learning
Last synced: 22 days ago
JSON representation
网络安全学习wiki，包括Web安全、内网安全、云安全、免杀绕过等（持续更新）
- Host: GitHub
- URL: https://github.com/HackingCost/CyberSpace-Security-Learning
- Owner: HackingCost
- Created: 2022-11-14T07:24:23.000Z (about 2 years ago)
- Default Branch: main
- Last Pushed: 2023-02-20T02:20:52.000Z (almost 2 years ago)
- Last Synced: 2024-08-05T17:40:16.856Z (4 months ago)
- Homepage:
- Size: 44.9 KB
- Stars: 66
- Watchers: 1
- Forks: 3
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
- awesome-hacking-lists - HackingCost/CyberSpace-Security-Learning - 网络安全学习wiki，包括Web安全、内网安全、云安全、免杀绕过等（持续更新） (Others)
README
# CyberSpace-Security-Learning
网络安全学习wiki，包括Web安全、内网安全、云安全、免杀绕过、应急响应等
**持续更新中...**
- [转载请在文章开头附本文链接](https://github.com/HackingCost/CyberSpace-Security-Learning)
--------------------------------------------------------------
欢迎加入免费知识星球《网安成长营》一起交流讨论技术：https://t.zsxq.com/08Ac3CEkC
----------------------------------------------------------------
目录：
- [Web安全](#web安全)
- [SQL注入](#sql注入)
- [XXE](#xxe)
- [XXS](#xss)
- [SSRF](#ssrf)
- [CORS](#cors)
- [内网攻防](#内网攻防)
- [Windows域](#windows域)
- [App&小程序](#app小程序)
- [云安全](#云安全)
- [红队tips](#红队tips)
- [应急响应](#应急响应)
- [Bypass](#bypass)
- [杂记](#杂记)
# Web安全
## SQL注入
- [高级SQL注入：混淆和绕过 (gitee.io)](https://ernket.gitee.io/2020/02/06/高级SQL注入：混淆和绕过/)
### MySQL
- [对MYSQL注入相关内容及部分Trick的归类小结 - 先知社区 (aliyun.com)](https://xz.aliyun.com/t/7169)
- [MySQL注入技巧 - Utopia (wooyun.js.org)](https://wooyun.js.org/drops/MySQL注入技巧.html)
### MSSQL
- [MSSQL 注入与提权方法整理 - Geekby's Blog](https://www.geekby.site/2021/01/mssql注入与提权方法整理/)
- [浅谈SQL Server从DBO用户提权到DBA的两种思路 (qq.com)](https://mp.weixin.qq.com/s/y_h3GCWcYz7EW11Bz5OkLg)
### Postgresql
- [Postgresql 渗透总结 - 跳跳糖 (tttang.com)](https://tttang.com/archive/1547/)
### 工具相关
- [渗透常用数据库综合利用工具 (yuque.com)](https://www.yuque.com/xxxasec/odeznb/mahogt#vrKaQ)
- sqlmap使用手册
- [SqlMap 1.2.7.20 Tamper详解及使用指南 - FreeBuf网络安全行业门户](https://www.freebuf.com/sectool/179035.html)
## XXE
- [一篇文章带你深入理解漏洞之 XXE 漏洞 - 先知社区 (aliyun.com)](https://xz.aliyun.com/t/3357)
- [XML外部实体注入（XXE）攻击方式汇总 - 跳跳糖 (tttang.com)](https://tttang.com/archive/1813/)
- [一篇文章读懂Java代码审计之XXE - 先知社区 (aliyun.com)](https://xz.aliyun.com/t/7272)
## XSS
- [BugBounty中Dom Xss的案例分享 – Jinone – 败絮其中](https://jinone.github.io/bugbounty-dom-xss/)
- [一些BAT的XSS实例（一）基础篇 - 先知社区 (aliyun.com)](https://xz.aliyun.com/t/11677)
- [一些BAT的XSS实例（二）进阶篇 - 先知社区 (aliyun.com)](https://xz.aliyun.com/t/11681)
- [一些BAT的XSS实例（三）中级篇 - 先知社区 (aliyun.com)](https://xz.aliyun.com/t/11682)
- [一些BAT的XSS实例（四）高级篇 - 先知社区 (aliyun.com)](https://xz.aliyun.com/t/11705)
- [一些BAT的XSS实例（五）最终篇 - 先知社区 (aliyun.com)](https://xz.aliyun.com/t/11790)
- ...
## SSRF
- [从一文中了解SSRF的各种绕过姿势及攻击思路](https://tttang.com/archive/1648/)
## CORS
- [CORS跨域资源共享漏洞的复现、分析、利用及修复过程](https://mp.weixin.qq.com/s/PSU8T-IO3mAz4MEVvAeUug)
# 内网攻防
## Windows域
- [HackingCost/AD_Pentest: 红队|域渗透重要漏洞汇总(持续更新) (github.com)](https://github.com/HackingCost/AD_Pentest)
- [委派攻击知识点全收录！利用委派的姿势能有多花哨？ | 技术精选 0121 (qq.com)](https://mp.weixin.qq.com/s/GdmnlsKJJXhElA4GuwxTKQ)
- [Windows内网协议学习NTLM篇之NTLM基础介绍-安全客 - 安全资讯平台 (anquanke.com)](https://www.anquanke.com/post/id/193149)
- [[Windows内网协议学习NTLM篇之漏洞概述-安全客 - 安全资讯平台 (anquanke.com)](https://www.anquanke.com/post/id/194514)](https://www.anquanke.com/post/id/193493)
- [域内用户Hash获取方式总结 - 跳跳糖 (tttang.com)](https://tttang.com/archive/1758/)
- [Kerberos域渗透的那些事 - 先知社区 (aliyun.com)](https://xz.aliyun.com/t/10189)
# App小程序
- [Android-HTTPS认证的N种方式和对抗方法总结](https://ch3nye.top/Android-HTTPS%E8%AE%A4%E8%AF%81%E7%9A%84N%E7%A7%8D%E6%96%B9%E5%BC%8F%E5%92%8C%E5%AF%B9%E6%8A%97%E6%96%B9%E6%B3%95%E6%80%BB%E7%BB%93/)
- [Android 抓包姿势总结](https://blog.csdn.net/weixin_42282189/article/details/120052802)
# 云安全
- [云安全知识库 | 云安全知识库 (huoxian.cn)](https://cloudsec.huoxian.cn/)
- [云安全资源 | T Wiki (teamssix.com)](https://wiki.teamssix.com/cloudsecurityresources/)
- [k8s安全 入门学习](https://www.const27.com/2022/03/13/k8s%E5%AE%89%E5%85%A8%20%E5%85%A5%E9%97%A8%E5%AD%A6%E4%B9%A0/)
- [K8S后渗透横向节点与持久化隐蔽方式探索](https://mp.weixin.qq.com/s/qYlAYM2jbdPtdXCi0oFagA)
- [K8S API访问控制之RBAC利用](https://mp.weixin.qq.com/s/kwOWwWv00fFG-ik--Ry0tw)
## 云靶场
- https://github.com/HXSecurity/TerraformGoat
- https://github.com/Metarget/metarget
## 工具
- [https://github.com/RhinoSecurityLabs/pacu](https://github.com/RhinoSecurityLabs/pacu)
- https://github.com/teamssix/cf
- https://github.com/Eilonh/s3crets_scanner
# 红队tips
- [safe6Sec/command: 红队常用命令速查 (github.com)](https://github.com/safe6Sec/command)
- [外网快速打点方法技巧总结](https://github.com/biggerduck/RedTeamNotes/blob/main/%E7%BA%A2%E9%98%9F%E5%9F%BA%E6%93%8D2-%E5%A4%96%E7%BD%91%E5%BF%AB%E9%80%9F%E6%89%93%E7%82%B9%E6%96%B9%E6%B3%95%26%E6%8A%80%E5%B7%A7%E6%80%BB%E7%BB%93.pdf)
# 应急响应
- [应急响应实战笔记](https://github.com/Bypass007/Emergency-Response-Notes)
## 工具
- [Windows Emergency Response （应急响应信息采集）](https://github.com/ra66itmachine/GetInfo)
# Bypass
- [Bypass linux bash限制](https://book.hacktricks.xyz/linux-hardening/bypass-bash-restrictions)
## 工具
- [Bash 混淆框架](https://github.com/Bashfuscator/Bashfuscator)
# 杂记
- [2022大赛结束语-再谈钓鱼.pdf](https://github.com/biggerduck/RedTeamNotes/blob/main/2022%E5%A4%A7%E8%B5%9B%E7%BB%93%E6%9D%9F%E8%AF%AD-%E5%86%8D%E8%B0%88%E9%92%93%E9%B1%BC.pdf)