Legal Disclaimer

This page is created strictly for educational purposes. All concepts, tools, and techniques described here are intended to help learners understand how systems work and how to defend them. Never apply any technique on systems, networks, or accounts you do not own or have explicit written permission to test. Unauthorized access to computer systems is illegal in most countries and can result in criminal prosecution. Practice only in legal environments: your own lab, CTF platforms (HackTheBox, TryHackMe), or with signed authorization.

History

How

• Cybersecurity emerged as a discipline in the 1970s–1980s as networked computing grew.
• The Morris Worm (1988) — first major internet worm — infected ~6,000 machines and triggered the creation of the first CERT (Computer Emergency Response Team).
• The 1990s saw the rise of the web, firewalls, antivirus software, and SSL/TLS encryption.
• The 2000s brought large-scale data breaches, botnets, and formalization of ethical hacking certifications (CEH, OSCP).
• The 2010s–present: nation-state attacks, ransomware epidemics (WannaCry, NotPetya), cloud security, zero-day markets, and AI-driven threats.

Who

• Whitfield Diffie & Martin Hellman — invented public-key cryptography (1976).
• Ron Rivest, Adi Shamir, Leonard Adleman — created RSA encryption (1977).
• Bruce Schneier — cryptographer, security author (Applied Cryptography).
• Kevin Mitnick — famous social engineer turned security consultant.
• Organizations: NSA, CISA, NIST, OWASP, SANS Institute, Offensive Security.

Why

• Protect sensitive data (personal, financial, national security).
• Ensure trust in digital systems (banking, healthcare, government).
• Defend critical infrastructure (power grids, hospitals, water systems).
• Combat evolving threats: malware, ransomware, phishing, APTs, insider threats.

Core Concepts & Terminology

The CIA Triad

graph LR
   CIA["🔐 CIA Triad"]
   C["Confidentiality\nOnly authorized access\nEncryption · ACL · Auth"]
   I["Integrity\nData is accurate & unaltered\nHashing · Signatures · Checksums"]
   A["Availability\nSystems accessible when needed\nRedundancy · DDoS Protection · Backups"]
   CIA --> C
   CIA --> I
   CIA --> A

AAA Framework

Authentication  → verify WHO you are     (password, MFA, biometrics)
Authorization   → verify WHAT you can do  (RBAC, ACLs, permissions)
Accounting      → track WHAT you did       (audit logs, SIEM)

Key Security Terms

Defense Principles

Hacker Classifications

Networking Fundamentals for Security

OSI Model — Security Perspective

graph TD
   L7["Layer 7 — Application\nHTTP · HTTPS · DNS · FTP · SMTP\nAttacks: XSS · SQLi · Phishing · MITM"]
   L6["Layer 6 — Presentation\nSSL/TLS · Encoding · Encryption\nAttacks: SSL Stripping · Weak Ciphers"]
   L5["Layer 5 — Session\nSession Management · Cookies\nAttacks: Session Hijacking · Replay"]
   L4["Layer 4 — Transport\nTCP · UDP · Ports\nAttacks: SYN Flood · Port Scanning"]
   L3["Layer 3 — Network\nIP · ICMP · Routing\nAttacks: IP Spoofing · Route Poisoning"]
   L2["Layer 2 — Data Link\nMAC · ARP · Switches\nAttacks: ARP Spoofing · MAC Flooding"]
   L1["Layer 1 — Physical\nCables · Hardware · Wireless\nAttacks: Wiretapping · Signal Jamming"]
   L7 --> L6 --> L5 --> L4 --> L3 --> L2 --> L1

Key Protocols & Security Implications

IP Addressing & Subnetting

Private ranges (RFC 1918 — not routable on internet):
  10.0.0.0/8        → 10.0.0.0 – 10.255.255.255
  172.16.0.0/12     → 172.16.0.0 – 172.31.255.255
  192.168.0.0/16    → 192.168.0.0 – 192.168.255.255
  127.0.0.0/8       → loopback (localhost)
  169.254.0.0/16    → APIPA (link-local, no DHCP)

CIDR: 192.168.1.0/24 → 256 addresses, 254 usable
/24 = 255.255.255.0 | /16 = 255.255.0.0 | /8 = 255.0.0.0

Network Segmentation Architecture

graph LR
   Internet["🌐 Internet\n(Untrusted)"]
   FW1["🔥 Perimeter Firewall"]
   DMZ["🟡 DMZ\nWeb · Mail · DNS servers"]
   FW2["🔥 Internal Firewall"]
   LAN["🟢 Internal LAN\n(Trusted)"]
   MGMT["🔒 Management Network\n(Admin only)"]
   Internet --> FW1 --> DMZ --> FW2 --> LAN
   FW2 --> MGMT

DNS Record Types

Cryptography

collapsed:: true

Symmetric vs Asymmetric Encryption

graph LR
   subgraph Symmetric["🔑 Symmetric Encryption"]
       SK["Same Key\nEncrypt + Decrypt"]
       AES["AES-256 ✅\nChaCha20 ✅\nDES ❌ BROKEN\n3DES ❌ Deprecated"]
   end
   subgraph Asymmetric["🗝️ Asymmetric Encryption"]
       PK["Public Key → Encrypt\nPrivate Key → Decrypt"]
       RSA["RSA-2048/4096 ✅\nECC / ECDH ✅\nDSA (sign only) ✅"]
   end

Symmetric Encryption

AES (Advanced Encryption Standard)
  → 128/192/256-bit keys, block cipher, current gold standard
  → Modes: ECB (weak ❌) | CBC | CTR | GCM (authenticated ✅)
ChaCha20 → stream cipher, fast on mobile, used in TLS 1.3
DES      → 56-bit, BROKEN ❌ — do not use
3DES     → deprecated, slow ❌

Asymmetric Encryption

RSA   → 2048/4096-bit, based on prime factorization
ECC   → Elliptic Curve, smaller keys, same security as RSA
ECDSA → EC Digital Signature Algorithm
ECDH  → EC Diffie-Hellman key exchange (used in TLS 1.3)
DH    → Diffie-Hellman key agreement (not encryption)

Hashing Algorithms

TLS Handshake Flow

sequenceDiagram
   participant C as 🖥️ Client
   participant S as 🌐 Server
   C->>S: ClientHello (TLS version + cipher suites)
   S->>C: ServerHello (chosen cipher + Certificate)
   C->>C: Verify certificate (CA chain, expiry, domain)
   C->>S: Key Exchange (ECDH public key)
   S->>C: Key Exchange (ECDH public key)
   Note over C,S: Both derive same session keys
   C->>S: Finished (encrypted)
   S->>C: Finished (encrypted)
   Note over C,S: 🔒 Encrypted communication begins

Common Cryptographic Attacks

Threat Landscape & Attack Types

Malware Categories

Social Engineering Attacks

OWASP Top 10 (2021)

graph TD
   A01["A01 — Broken Access Control\nUser accesses unauthorized resources"]
   A02["A02 — Cryptographic Failures\nWeak/missing encryption"]
   A03["A03 — Injection\nSQL · Command · LDAP · XPath"]
   A04["A04 — Insecure Design\nMissing security in design phase"]
   A05["A05 — Security Misconfiguration\nDefault creds · Open storage · Verbose errors"]
   A06["A06 — Vulnerable Components\nOutdated libraries with known CVEs"]
   A07["A07 — Auth Failures\nWeak passwords · No MFA · Session issues"]
   A08["A08 — Integrity Failures\nInsecure deserialization · CI/CD attacks"]
   A09["A09 — Logging Failures\nNo monitoring · No alerting"]
   A10["A10 — SSRF\nServer fetches internal resources for attacker"]

Injection Attacks Deep Dive

Password Attack Types

Security Architecture

Defense in Depth

graph TD
   L8["Layer 8 — Monitoring & Response\nSIEM · SOC · Incident Response · Threat Hunting"]
   L7["Layer 7 — Identity & Access\nMFA · Least Privilege · PAM · SSO"]
   L6["Layer 6 — Data Security\nEncryption at Rest/Transit · DLP · Backups"]
   L5["Layer 5 — Application Security\nWAF · Secure Coding · SAST/DAST · Auth"]
   L4["Layer 4 — Endpoint Security\nEDR · Host Firewall · Disk Encryption · Patching"]
   L3["Layer 3 — Network Segmentation\nVLANs · Micro-segmentation · Zero Trust"]
   L2["Layer 2 — Network Perimeter\nFirewall · IDS/IPS · DMZ · VPN · DDoS Protection"]
   L1["Layer 1 — Physical Security\nLocked Rooms · Badge Access · CCTV · Cable Locks"]
   L8 --> L7 --> L6 --> L5 --> L4 --> L3 --> L2 --> L1

Zero Trust Architecture

Pillars:
  Identity   → verify every user with strong auth (MFA, passwordless)
  Device     → verify device health before granting access
  Network    → micro-segment, encrypt all traffic
  Application → per-app access control, not network-level
  Data       → classify + protect data regardless of location

Key Technologies:
  IAM  → Identity & Access Management
  MFA  → Multi-Factor Authentication
  PAM  → Privileged Access Management
  ZTNA → Zero Trust Network Access (replaces VPN)
  CASB → Cloud Access Security Broker
  EDR  → Endpoint Detection & Response

Security Frameworks

graph LR
   NIST["NIST CSF\nIdentify → Protect\nDetect → Respond → Recover"]
   ISO["ISO/IEC 27001\nISMS Standard\nRisk · Controls · Audits"]
   CIS["CIS Controls v8\n18 Prioritized Controls\nIG1 → IG2 → IG3"]
   MITRE["MITRE ATT&CK\nAdversary TTPs\nRecon → Impact"]
   OWASP["OWASP\nTop 10 · ASVS\nTesting Guide · SAMM"]

MITRE ATT&CK Tactics (Kill Chain)

SOC (Security Operations Center)

Ethical Hacking & Penetration Testing

What is Ethical Hacking?

Penetration Testing Phases

graph LR
   P1["1️⃣ Planning & Scoping\nDefine scope · Get written auth\nRules of Engagement"]
   P2["2️⃣ Reconnaissance\nPassive: OSINT · DNS · WHOIS\nActive: Port scan · Enum"]
   P3["3️⃣ Scanning & Enumeration\nOpen ports · Services · Versions\nUsers · Shares · Subdomains"]
   P4["4️⃣ Vulnerability Analysis\nMap CVEs · Nessus/OpenVAS\nManual analysis"]
   P5["5️⃣ Exploitation\nAuthorized only\nDocument every action"]
   P6["6️⃣ Post-Exploitation\nPrivilege escalation\nLateral movement · Impact"]
   P7["7️⃣ Reporting\nExecutive summary\nTechnical findings · Remediation"]
   P1 --> P2 --> P3 --> P4 --> P5 --> P6 --> P7

Test Types

OSINT (Open Source Intelligence)

Sources:
  Google Dorks       → site:example.com filetype:pdf
                       intitle:"index of" "password"
  WHOIS              → domain registration info
  DNS Records        → A, MX, NS, TXT reveal infrastructure
  Shodan             → search engine for internet-connected devices
  Censys             → certificate + banner data
  crt.sh             → find subdomains via SSL certificate logs
  GitHub             → accidentally committed secrets, API keys
  LinkedIn           → employee names, job titles, tech stack
  Wayback Machine    → archived website versions

OSINT Tools:
  theHarvester  → emails, subdomains, IPs from public sources
  Maltego       → visual relationship mapping
  Recon-ng      → modular web reconnaissance framework
  SpiderFoot    → automated OSINT collection
  Amass         → subdomain enumeration

Security Tools Overview

Network Analysis

tcpdump -i eth0 -w capture.pcap          # capture to file
tcpdump -r capture.pcap port 80          # read + filter
tcpdump -i eth0 'tcp and host 10.0.0.1'  # filter by host

Port & Service Scanning

nmap -sV -O target          # service version + OS detection
nmap -sS -T4 target         # SYN scan, aggressive timing
nmap -p- target             # all 65535 ports
nmap -sC -sV target         # default scripts + version
nmap -A target              # aggressive: OS + version + scripts + traceroute
nmap --script=safe target   # run safe NSE scripts only
nmap -oA output target      # save all output formats

Vulnerability Scanners

Web Application Testing

Password Analysis

# -m hash type: 0=MD5 | 100=SHA1 | 1000=NTLM | 3200=bcrypt
hashcat -m 0 hash.txt wordlist.txt           # dictionary attack
hashcat -m 0 -a 3 hash.txt ?a?a?a?a?a?a      # brute force mask
hashcat -m 1000 hash.txt wordlist.txt -r best64.rule  # with rules
hashcat -m 0 hash.txt --show                 # show cracked

Forensics & Reverse Engineering Tools

Identity & Access Management (IAM)

Authentication Methods

Authorization Models

SSO & Federation Protocols

Active Directory Security

graph TD
   DC["🏛️ Domain Controller\nAuthentication · AD Database\nKerberos KDC"]
   T0["Tier 0 — Domain Controllers\nHighest privilege — most protected"]
   T1["Tier 1 — Servers\nApp servers, databases"]
   T2["Tier 2 — Workstations\nUser endpoints"]
   DC --> T0 --> T1 --> T2

Cloud Security

Shared Responsibility Model

graph LR
   subgraph Provider["☁️ Cloud Provider Responsible"]
       P1["Physical data center security"]
       P2["Hypervisor + host OS"]
       P3["Network infrastructure"]
       P4["Managed service patching"]
   end
   subgraph Customer["👤 Customer Responsible"]
       C1["Data classification + encryption"]
       C2["IAM — identity and access"]
       C3["OS + app patching (IaaS)"]
       C4["Network config (security groups)"]
       C5["Monitoring and logging"]
   end

Common Cloud Misconfigurations

Cloud Security Services

Incident Response

IR Lifecycle (NIST SP 800-61)

graph LR
   P["1️⃣ Preparation\nIR plan · Playbooks\nTools · Training · SIEM"]
   D["2️⃣ Detection & Analysis\nIdentify IOCs · Triage\nScope + Severity · Preserve evidence"]
   C["3️⃣ Containment\nIsolate systems\nNetwork quarantine"]
   E["4️⃣ Eradication\nRemove malware\nPatch · Reset credentials"]
   R["5️⃣ Recovery\nRestore from backups\nMonitor closely"]
   L["6️⃣ Lessons Learned\nRoot cause analysis\nUpdate IR plan + detections"]
   P --> D --> C --> E --> R --> L --> P

Common IOCs (Indicators of Compromise)

Critical Windows Event IDs

Digital Forensics — Order of Volatility

Secure Development (DevSecOps)

Secure SDLC — Shift Left

graph LR
   R["Requirements\nSecurity requirements\nThreat modeling\nCompliance needs"]
   D["Design\nSTRIDE threat model\nSecurity architecture\nData flow diagrams"]
   DEV["Development\nSecure coding standards\nSAST · SCA\nNo hardcoded secrets"]
   T["Testing\nDAST · IAST\nPenetration testing\nDependency scanning"]
   DEP["Deployment\nSecrets management\nContainer image scanning\nIaC security scan"]
   OPS["Operations\nRuntime protection\nSIEM monitoring\nPatch management"]
   R --> D --> DEV --> T --> DEP --> OPS

STRIDE Threat Modeling

Secrets Management

# truffleHog — scan git history for secrets
trufflehog git https://github.com/org/repo
 
# git-secrets — prevent committing secrets
git secrets --install
git secrets --register-aws

Container Security Best Practices

Wireless & Physical Security

Wi-Fi Security Protocols

Physical Security Controls

Certifications & Career Paths

Certification Roadmap

graph TD
   B["🟢 Beginner\nCompTIA Network+\nCompTIA Security+\nISC2 CC (free)\nGoogle Cybersecurity Cert"]
   I["🟡 Intermediate\nCEH · CompTIA CySA+\nCompTIA PenTest+\neJPT (practical)"]
   A["🔴 Advanced\nOSCP (hands-on pentest)\nCISSP (management)\nGPEN / GWAPT\nCRTO (Red Team)"]
   C["☁️ Cloud Security\nAWS Security Specialty\nAZ-500 (Azure)\nCCSP"]
   B --> I --> A
   I --> C

Career Paths

Legal Practice Environments

More Learn

Github & Webs

• OWASP Foundation
• MITRE ATT&CK Framework
• NIST Cybersecurity Framework
• CVE / NVD Database
• CIS Benchmarks
• PortSwigger Web Security Academy (Free)
• HackTheBox
• TryHackMe
• Cybersecurity Roadmap – GitHub
• SANS Reading Room
• Exploit Database

Master Playlists YouTube

• Cybersecurity Full Course – freeCodeCamp
• Ethical Hacking Full Course – NetworkChuck
• CompTIA Security+ – Professor Messer
• OSCP Preparation – TCM Security