SANS Training Roadmap
Last Version

@TryHackBoxOfficial | Github | YouTube | Group
#SANS

❤ Share & Support & Reaction Us
#CSRF
📰 @BackupLSO
📚 @LibrarySecOfficial

⭕ Hackgyan Advanced Bug Bounty Hunting Full Course

𝖳𝗁𝖾 𝖧𝖺𝖼𝗄𝗀𝗒𝖺𝗇 𝖡𝗎𝗀 𝖡𝗈𝗎𝗇𝗍𝗒 𝖧𝗎𝗇𝗍𝗂𝗇𝗀 𝖥𝗎𝗅𝗅 𝖢𝗈𝗎𝗋𝗌𝖾 𝗂𝗌 𝖿𝗈𝗋 𝖺𝗇𝗒𝗈𝗇𝖾 𝗐𝗁𝗈 𝗐𝖺𝗇𝗍𝗌 𝗍𝗈 𝗅𝖾𝖺𝗋𝗇 𝖾𝗍𝗁𝗂𝖼𝖺𝗅 𝗁𝖺𝖼𝗄𝗂𝗇𝗀. 𝖸𝗈𝗎 𝗐𝗂𝗅𝗅 𝗅𝖾𝖺𝗋𝗇 𝗁𝗈𝗐 𝗍𝗈 𝖿𝗂𝗇𝖽 𝖺𝗇𝖽 𝖿𝗂𝗑 𝗉𝗋𝗈𝖻𝗅𝖾𝗆𝗌 𝗂𝗇 𝗌𝗈𝖿𝗍𝗐𝖺𝗋𝖾. 𝖳𝗁𝖾 𝖼𝗈𝗎𝗋𝗌𝖾 𝖼𝗈𝗏𝖾𝗋𝗌 𝗂𝗆𝗉𝗈𝗋𝗍𝖺𝗇𝗍 𝗍𝗈𝗉𝗂𝖼𝗌 𝗅𝗂𝗄𝖾 𝗌𝖾𝖺𝗋𝖼𝗁𝗂𝗇𝗀 𝖿𝗈𝗋 𝗐𝖾𝖺𝗄𝗇𝖾𝗌𝗌𝖾𝗌, 𝗍𝖾𝗌𝗍𝗂𝗇𝗀 𝗌𝖾𝖼𝗎𝗋𝗂𝗍𝗒, 𝖺𝗇𝖽 𝗉𝗋𝖺𝖼𝗍𝗂𝖼𝖺𝗅 𝖾𝗑𝖾𝗋𝖼𝗂𝗌𝖾𝗌. 𝖸𝗈𝗎 𝗐𝗂𝗅𝗅 𝖺𝗅𝗌𝗈 𝗅𝖾𝖺𝗋𝗇 𝖺𝖻𝗈𝗎𝗍 𝖻𝗎𝗀 𝖻𝗈𝗎𝗇𝗍𝗒 𝗐𝖾𝖻𝗌𝗂𝗍𝖾𝗌 𝖺𝗇𝖽 𝗍𝗁𝖾 𝗋𝗎𝗅𝖾𝗌 𝗈𝖿 𝗁𝖺𝖼𝗄𝗂𝗇𝗀. 𝖩𝗈𝗂𝗇 𝗎𝗌 𝗍𝗈 𝗂𝗆𝗉𝗋𝗈𝗏𝖾 𝗒𝗈𝗎𝗋 𝗌𝗄𝗂𝗅𝗅𝗌 𝖺𝗇𝖽 𝗁𝖾𝗅𝗉 𝗆𝖺𝗄𝖾 𝗍𝗁𝖾 𝗂𝗇𝗍𝖾𝗋𝗇𝖾𝗍 𝗌𝖺𝖿𝖾𝗋

❤ Share & Support & Reaction Us
🧩 #bugbounty
📰 @BackupLSO
📚 @LibrarySecOfficial

HOW TO CREATE AND HOST YOUR OWN DARKWEB SITE

Requirements:

Onionshare
Tor Browser
❤ Share & Support & Reaction Us
📰 @BackupLSO
📚 @LibrarySecOfficial

Browser Exploitation Framework

❤ Share & Support & Reaction Us
🧩 #Exploitation
📰 @BackupLSO
📚 @LibrarySecOfficial

🔖 Website Pentesting in Practice: Hands-on Course 101

❤ Share & Support & Reaction Us
🧩 #Web #pentest
📰 @BackupLSO
📚 @LibrarySecOfficial

⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️

📖 Cyber ​​Security books and sources
📚 @LibrarySecOfficial

💠 Blueteam sources:
⭕️ @BlueTeamKit

💠 Osint tools and courses:

⭕️ @OsintGit

💠 Cyber ​​Security Courses and Resources & Learn Bug bounty:

⭕ @BackupLso


💠 All Red Team resources are here!

⭕ @RedTeamVillageRtv

💠 To add to the message list:
🤖 @LibrarySecOfficialBot

⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️

🔖 Cybersecurity AI (CAI) is a lightweight, open-source platform that allows security professionals to build and implement automated artificial intelligence systems for defense and offense.
Whether you are a security researcher, an ethical hacker, an IT professional, or an organization looking to strengthen its security, CAI provides components for building specialized AI agents that can help with mitigation, vulnerability detection, exploitation, and security assessment.

https://github.com/aliasrobotics/cai

❤ Share & Support & Reaction Us
🧩 #AI
📰 @BackupLSO
📚 @LibrarySecOfficial

List of the most secure privacy email providers.

Most of these companies will not co-operate with Law Enforcement and the content is encrypted.

Www.cock.li

Www.secmail.pro

Www.mailfence.com

Www.riseup.net

Www.protonmail.com

www.startmail.com

Www.posteo.de

Www.countermail.com

Www.hushmail.com

https://mailbox.org/en/

https://librem.one

❤ Share & Support & Reaction Us
🧩 #mail #privacy
📰 @BackupLSO
📚 @LibrarySecOfficial

We’re starting an international cybersecurity company and looking for talented people who can create videos and collaborate with us on YouTube. 
If you’re able to produce videos and interested in becoming a partner and future shareholder in this project, please reach out to us! 
This is a great opportunity to build a strong brand together and grow alongside the company. 

We’re waiting for you :

@LibrarySecOfficialBot

⚙️ Complete Bug Bounty tool List ⚙️

Enjoy :)

dnscan https://github.com/rbsec/dnscan

Knockpy https://github.com/guelfoweb/knock

Sublist3r https://github.com/aboul3la/Sublist3r

massdns https://github.com/blechschmidt/massdns

Nmap https://nmap.org

Masscan https://github.com/robertdavidgraham/masscan

EyeWitness https://github.com/ChrisTruncer/EyeWitness

DirBuster https://sourceforge.net/projects/dirbuster/

dirsearch https://github.com/maurosoria/dirsearch

Gitrob https://github.com/michenriksen/gitrob

git-secrets https://github.com/awslabs/git-secrets

sandcastle https://github.com/yasinS/sandcastle

bucket_finder https://digi.ninja/projects/bucket_finder.php

GoogD0rker https://github.com/ZephrFish/GoogD0rker/

Wayback Machine https://web.archive.org

waybackurls https://gist.github.com/mhmdiaa/adf6bff70142e5091792841d4b372050

Sn1per https://github.com/1N3/Sn1per/

XRay https://github.com/evilsocket/xray

wfuzz https://github.com/xmendez/wfuzz/

patator https://github.com/lanjelot/patator

datasploit https://github.com/DataSploit/datasploit

hydra https://github.com/vanhauser-thc/thc-hydra

changeme https://github.com/ztgrace/changeme

MobSF https://github.com/MobSF/Mobile-Security-Framework-MobSF/

Apktool https://github.com/iBotPeaches/Apktool

dex2jar https://sourceforge.net/projects/dex2jar/

sqlmap http://sqlmap.org/

oxml_xxe https://github.com/BuffaloWill/oxml_xxe/

XXE Injector https://github.com/enjoiz/XXEinjector

The JSON Web Token Toolkit https://github.com/ticarpi/jwt_tool

ground-control https://github.com/jobertabma/ground-control

ssrfDetector https://github.com/JacobReynolds/ssrfDetector

LFISuit https://github.com/D35m0nd142/LFISuite

GitTools https://github.com/internetwache/GitTools

dvcs-ripper https://github.com/kost/dvcs-ripper

tko-subs https://github.com/anshumanbh/tko-subs

HostileSubBruteforcer https://github.com/nahamsec/HostileSubBruteforcer

Race the Web https://github.com/insp3ctre/race-the-web

ysoserial https://github.com/GoSecure/ysoserial

PHPGGC https://github.com/ambionics/phpggc

CORStest https://github.com/RUB-NDS/CORStest

Retire-js https://github.com/RetireJS/retire.js

getsploit https://github.com/vulnersCom/getsploit

Findsploit https://github.com/1N3/Findsploit

bfac https://github.com/mazen160/bfac

WPScan https://wpscan.org/

CMSMap https://github.com/Dionach/CMSmap

Amass https://github.com/OWASP/Amass

Extra Tools
http://projectdiscovery.io

❤ Share & Support & Reaction Us
🧩 #tools #BugBounty
📰 @BackupLSO
📚 @LibrarySecOfficial

SQLi -- Learn SQL All in One Method - Best SQL Injection Methods

❤ Share & Support & Reaction Us
🧩 #Sqli #injection
📰 @BackupLSO
📚 @LibrarySecOfficial

Golden checklist for every beginner out there 👇 by Godfather Orwa

1 spend 1-2 hours understanding burp & burp extensions

2 spend 1-2 day understanding subdomain enumeration with more than 1 tool

3 don’t forget scanning port all the time
4 use waymore tool to extract endpoint from lot of resources

5 keep ai chat is opening and ask anything anytime

6 autorized & JS miner is so important extensions read about it and use it


❤ Share & Support & Reaction Us

📰 @BackupLSO
📚 @LibrarySecOfficial

🔖 An easy way to read bug bounty witeups

If you are tired of googling for #BugBounty writeups, You can use this tool which lets you search writeups easily. You can also pull the search data in JSON format if you need it.

Just like a Google query you can append the search term to the 'q' parameter to search for writeups matching that keyword. And I don't save your searches, everything happens on the frontend.

🔴Example: bugbountyhunting.com/?q=csrf (for example, to search for CSRF writeups)

🖥 Tool: 🔗 Link

❤ Share & Support & Reaction Us
🧩 #bugbounty
📰 @BackupLSO
📚 @LibrarySecOfficial

Bug Bounty Guide

Bug Bounty is based on finding vulnerabilities in certain software.‍To claim the bounty, bugs must be original and previously unreported

Bug Bounty Platforms

💠 HackerOne
https://www.hackerone.com
💠 Bugcrowd
https://www.bugcrowd.com
💠 Synack
https://www.synack.com
💠 Detectify
https://cs.detectify.com
💠 Cobalt
https://cobalt.io
💠 Open Bug Bounty
https://www.openbugbounty.org
💠 Zero Copter
https://www.zerocopter.com
💠 Yes We Hack
https://www.yeswehack.com
💠 Hacken Proof
https://hackenproof.com
💠 Vulnerability Lab
https://www.vulnerability-lab.com
💠 Fire Bounty
https://firebounty.com
💠 Bug Bounty
https://bugbounty.jp/
💠 Anti Hack
https://antihack.me
💠 Intigrity
https://intigrity.com/
💠 Safe Hats
https://safehats.com
💠 Red Storm
https://www.redstorm.io/
💠 Cyber Army
https://www.cyberarmy.id
💠 Yogosha
https://yogosha.com

❤ Share & Support & Reaction Us
🧩 #bugbounty
📰 @BackupLSO
📚 @LibrarySecOfficial

🔖 A TO Z ABOUT XSS

Overview:-
Cross-Site Scripting (XSS) attack are a type of injection,in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses input from a user within the output it generates without validating or encoding it.
An attacker can use XSS to send a malicious script to an unsuspecting user. The end user’s browser has no way to know that the script should not be trusted, and will execute the script. Because it thinks the script came from a trusted source, the malicious script can access any cookies, session tokens, or other sensitive information retained by the browser and used with that site. These scripts can even rewrite the content of the HTML page.

🧩 #XSS
📰 @BackupLSO
📚 @LibrarySecOfficial

Websites pentesting With Burpsuite

❤ Share & Support & Reaction Us
🧩 #Burpsuite
📰 @BackupLSO
📚 @LibrarySecOfficial

how to setup Mobile app Traffic proxy with Burp Suite

❤ Share & Support & Reaction Us
🧩 #Burpsuite
📰 @BackupLSO
📚 @LibrarySecOfficial

Scan for Vulnerabilities on Any Website Using Nikto

❤ Share & Support & Reaction Us

📰 @BackupLSO
📚 @LibrarySecOfficial

How Pentester Scan vulnerability of Any Website

❤ Share & Support & Reaction Us

📰 @BackupLSO
📚 @LibrarySecOfficial

APIs Fuzzing for Bug Bounty


❤ Share & Support & Reaction Us

📰 @BackupLSO
📚 @LibrarySecOfficial