Ultimate-Cybersecurity-Guide (UCG)

Essential learning guide in CyberSec.

A1 Concepts:

• How Web Works

• Natting-EncodingHere

• Active-Dir

• GET v POSThere

• HTTP Request, Response, MethodsInfo

• Site v Origin & Cookies101

• All About SessionInfo

• DAST-SAST-IAST-RCAInfo

• CIA-Concepts

---

---

1. Web Application Security Testing: PortSwigger Academy

• Web Application Testing - Labs
• Endpoints AKA Entry Points

Client Side Vuln: ONLY Cross Site Scripting(XSS) | Cross Site Request Forgery | Cross Origin Resource Sharing(CORS) | Clickjacking | DOM Based Vuln | Web Socket

2. All About APIs:

• Application Programming Interface API-101
• API Security Testing

3. Mobile App Sec Testing:

• Android
• iOS

---

---

Topics-Covered:

• Security Framework

• Network Security Concepts

• 3-way-handsharking_Ports_Network-Devices_URL_Web-Browser Go

• SANS Top 20 Controls

• Network Models: OSI v TCP/IP

• IP-Related, Subnetting

• Linux Related Concepts

• Protocols Related

• OWASP WebApp-Vuln ZeroDay

• CEH-Examp-Prep

• Client Side vs Server Side Vulnerability

• Thick Client Vuln

---

---

Cheatsheet:

1. CyberSec Tools - Resources

Imp Links to refer:

1. OSCP — The Official Guide
2. C|EH in Bullets

Security Tools

1. Burp-Suite:

• Definition: Web proxy to intercept, analyze, and modify HTTP/S traffic.
• Best For: Web, API, Mobile (API Traffic Analysis).

2. Metasploit:

• Definition: Exploitation framework to identify, exploit, and validate system vulnerabilities.
• Best For: Web, Network, API, Application, Post-Exploitation.

3. Nessus: Vulnerability scanner

• Definition: To detect misconfigurations and security gaps System-level (OS, services, ports, packages), CVE-based scans for known vulns
• Best For: Network, Web, Infrastructure, Cloud Security.

4. Nmap Network Mapper:

• Definition: Network scanner to check open ports, services, and hosts.
• Best For: Network Recon, Web Enumeration, API Recon, Advance NSE (NMAP Script Engine) Support

5. Qualys Scanning Tool:

• Definition: Cloud-based scanner for identifying vulnerabilities and ensuring compliance.
• Best For: Web, Cloud, Network, Compliance Audits.

6. Wireshark: Traffic Analyser

• Intercept HTTP/S traffic between browser and server for manual and automated testing.
• Use to analyze the traffic.

7. Nikto: Web Server Scanner:

• Detect misconfigurations, outdated software, and exposed files in internal networks, dev/test environments, or legacy systems.
• Best for initial recon and hygiene checks before deeper analysis with tools like Burp or Nessus.

---

---

Youtube Resource:

• TCM Acad

NetworkChuck:

NahamSec

Null Byte

The Cyber Expert (Hindi)

HackerSploit