diff --git a/README.md b/README.md index 66d6f0f..d9e4be8 100644 --- a/README.md +++ b/README.md @@ -2,15 +2,14 @@ Navi-compatible cheatsheets for security, privacy, and digital sovereignty. +49 cheatsheets spanning offensive security, DFIR, privacy, encryption, system hardening, and cryptocurrency. + ## Installation ```bash # Install navi cargo install navi - -# Or via package manager -sudo apt install navi # Debian/Ubuntu -brew install navi # macOS +# or: sudo apt install navi (Debian/Ubuntu) | brew install navi (macOS) # Add this repo to navi (choose one) navi repo add https://github.com/rpriven/cypherpunk-cheats # GitHub @@ -19,7 +18,7 @@ navi repo add https://git.djeditech.com/djedi/cypherpunk-cheats # Mirror ## Manual Setup -Add to your navi config (`~/.config/navi/config.yaml`): +Point navi at a local clone (best for editing/dogfooding) — `~/.config/navi/config.yaml`: ```yaml cheats: @@ -30,75 +29,102 @@ cheats: ## Usage ```bash -# Launch navi -navi - -# Query specific topic -navi --query "nmap" -navi --query "monero" -navi --query "luks" - -# Preview mode -navi --preview - -# Use with custom path -navi --path /path/to/cypherpunk-cheats +navi # interactive launcher +navi --query "ufw" # jump to a topic +navi --best-match --query "ssh hardening" --print # print top match, no TUI ``` ## Categories -### Offensive Security +### Offensive Security & Recon | File | Description | |------|-------------| | `nmap.cheat` | Port scanning and service enumeration | -| `web.cheat` | Web application testing (ffuf, sqlmap, nikto) | +| `recon-advanced.cheat` | Advanced recon / OSINT enumeration | +| `web.cheat` | Web app testing (Burp, ffuf, fuzzing) | +| `api-testing.cheat` | REST/GraphQL API testing | +| `vuln-scanning.cheat` | Vulnerability scanning | | `hashcat.cheat` | Password cracking with Hashcat | | `john.cheat` | John the Ripper password cracking | | `privesc-linux.cheat` | Linux privilege escalation | | `privesc-windows.cheat` | Windows privilege escalation | -| `active-directory.cheat` | AD attacks (NetExec, Kerberoasting) | -| `containers.cheat` | Docker/Kubernetes security | -| `wireless.cheat` | WiFi attacks (aircrack-ng, WPA cracking) | -| `tunnels.cheat` | SSH tunnels, chisel, pivoting | +| `active-directory.cheat` | AD attacks (Kerberos, NetExec) | +| `ad-post-exploit.cheat` | AD post-exploitation / lateral movement | +| `smb-shares.cheat` | SMB shares & lateral movement | +| `c2-frameworks.cheat` | Command-and-control frameworks | +| `wireless.cheat` | WiFi attacks (aircrack-ng, WPA) | +| `tunnels.cheat` | SSH tunnels, pivoting, port-forward, WireGuard | +| `containers.cheat` | Docker/Kubernetes security & escapes | +| `reversing.cheat` | Ghidra, radare2, GDB, binary analysis | ### DFIR & Analysis | File | Description | |------|-------------| -| `forensics.cheat` | Volatility, disk imaging, evidence collection | -| `osint.cheat` | Sherlock, theHarvester, recon-ng | +| `forensics.cheat` | Volatility, memory, incident response | | `wireshark.cheat` | Packet analysis (tshark, tcpdump) | -| `reversing.cheat` | Ghidra, radare2, GDB, binary analysis | -| `steganography.cheat` | Hidden data extraction (steghide, binwalk) | +| `osint.cheat` | Sherlock, theHarvester, recon-ng | +| `steganography.cheat` | Hidden data (steghide, binwalk) | -### Privacy & Encryption +### Privacy & Anonymity | File | Description | |------|-------------| -| `privacy.cheat` | Tor, GPG, age encryption, metadata removal | -| `luks.cheat` | Full disk encryption (LUKS, dm-crypt) | +| `privacy.cheat` | Privacy toolkit overview (Tor, GPG, PETs) | +| `tor.cheat` | Tor, onion services, darknet | +| `anti-surveillance.cheat` | Counter-surveillance & tracking defense | +| `browser-hardening.cheat` | Firefox/Chrome hardening, anti-fingerprinting | +| `phone-privacy.cheat` | Mobile privacy (GrapheneOS, Android, iOS) | +| `metadata-removal.cheat` | EXIF / metadata sanitization | +| `opsec.cheat` | Operational security & threat modeling | +| `secure-comms.cheat` | Signal, Matrix, SimpleX, encrypted messaging | +| `email-privacy.cheat` | ProtonMail/Tutanota, PGP email | + +### Encryption & Secrets +| File | Description | +|------|-------------| +| `gpg.cheat` | GPG/PGP encryption & signing | +| `age.cheat` | Modern file encryption (age) | +| `luks.cheat` | Full-disk encryption (LUKS, dm-crypt) | +| `veracrypt.cheat` | VeraCrypt containers & hidden volumes | | `pass.cheat` | Password managers (pass, KeePassXC) | -| `secure-comms.cheat` | Signal CLI, Matrix, encrypted messaging | +| `2fa-security.cheat` | TOTP, FIDO2, YubiKey, MFA | +| `secure-file-sharing.cheat` | OnionShare, magic-wormhole | +| `secure-deletion.cheat` | Secure wipe (shred, data destruction) | +| `anti-forensics.cheat` | Counter-forensics / evidence elimination | + +### System Hardening +| File | Description | +|------|-------------| +| `secure-os.cheat` | Tails, Whonix, Qubes, hardened Linux | +| `sandboxing.cheat` | firejail, bubblewrap, Flatpak/Flatseal, distrobox | +| `firewall.cheat` | ufw, nftables, iptables (Tailscale-safe) | +| `ssh-hardening.cheat` | sshd hardening, keys-only, modern crypto | +| `dns-privacy.cheat` | DoH/DoT, dnscrypt, unbound, Pi-hole | ### Cryptocurrency & Web3 | File | Description | |------|-------------| | `monero.cheat` | Monero CLI wallet operations | | `bitcoin.cheat` | Bitcoin Core CLI operations | -| `solidity.cheat` | Smart contract auditing (Slither, Foundry) | +| `anonymous-payments.cheat` | Private payments (Monero, Lightning, cash) | +| `solidity.cheat` | Smart-contract auditing (Slither, Foundry) | +| `nak.cheat` | Nostr army knife (fiatjaf's `nak`) | ## Philosophy Built for cypherpunks who value: -- **Privacy** - Default to encrypted, anonymous, and sovereign -- **Security** - Offensive knowledge for defensive thinking -- **Freedom** - Tools for digital self-determination +- **Privacy** — default to encrypted, anonymous, and sovereign +- **Security** — offensive knowledge for defensive thinking +- **Freedom** — tools for digital self-determination ## Contributing -PRs welcome! Follow the navi `.cheat` format: +PRs welcome. Follow the navi `.cheat` format: - `%` tags for categories - `#` comments for descriptions - `$` for argument completion +Use placeholders (``), never real keys, IPs, or addresses. + ## License MIT diff --git a/dns-privacy.cheat b/dns-privacy.cheat new file mode 100644 index 0000000..3e3e8fa --- /dev/null +++ b/dns-privacy.cheat @@ -0,0 +1,51 @@ +% dns, privacy, dnscrypt, unbound, doh, dot, pihole + +# DNS queries reveal every domain you visit. Encrypt them (DoH/DoT) and/or self-host +# a resolver (unbound / Pi-hole) so no third party logs your lookups. + +# --- INSPECT current DNS --- + +# Which resolver am I actually using? +resolvectl status +cat /etc/resolv.conf + +# Leak test (your egress IP + a who-am-I lookup) +curl -s https://1.1.1.1/cdn-cgi/trace | grep -E '^ip|^loc' +dig +short whoami.akamai.net + +# Query a specific resolver directly +dig @ + +$ resolver: echo -e "1.1.1.1\n9.9.9.9\n127.0.0.1" + +# --- DoT via systemd-resolved (simplest encrypted DNS) --- + +# Edit /etc/systemd/resolved.conf: +# DNS=9.9.9.9#dns.quad9.net +# DNSOverTLS=yes +sudo systemctl restart systemd-resolved +resolvectl query example.com + +# --- dnscrypt-proxy (DoH / DNSCrypt + anonymized relays) --- + +sudo systemctl restart dnscrypt-proxy +sudo systemctl status dnscrypt-proxy +# config: /etc/dnscrypt-proxy/dnscrypt-proxy.toml (set require_dnssec, anonymized_dns) + +# --- unbound (your own recursive, DNSSEC-validating resolver — no upstream logging) --- + +sudo unbound-checkconf +sudo systemctl restart unbound +# then point resolv.conf / resolved at 127.0.0.1 + +# --- Pi-hole (network-wide ad/tracker blocking + your own resolver) --- + +# Run via Docker (or install from the StartOS marketplace) +docker run -d --name pihole -e TZ=Etc/UTC \ + -p 53:53/tcp -p 53:53/udp -p 80:80 -v pihole_etc:/etc/pihole pihole/pihole + +# Update blocklists (gravity) / tail the live query log +docker exec pihole pihole -g +docker exec pihole pihole -t + +# Point your router's (or clients') DNS at the Pi-hole's IP to cover the whole LAN diff --git a/firewall.cheat b/firewall.cheat new file mode 100644 index 0000000..7043929 --- /dev/null +++ b/firewall.cheat @@ -0,0 +1,63 @@ +% firewall, ufw, nftables, iptables, network-security + +# ⚠️ CRITICAL: never blindly flush rules on a box running Tailscale / VPN / Docker. +# `iptables -F`, `iptables -X`, `ip route flush` destroy custom chains (ts-input, +# ts-forward, DOCKER) and can sever your remote access. Inspect first; flush never casually. + +# --- UFW (simple front-end; start here) --- + +# Status, numbered (so you can delete by number) +sudo ufw status numbered + +# Sane defaults: deny in, allow out +sudo ufw default deny incoming +sudo ufw default allow outgoing + +# Allow a port or named service +sudo ufw allow /tcp +sudo ufw allow OpenSSH + +# Allow from one source only +sudo ufw allow from to any port + +# Rate-limit a port (brute-force mitigation, e.g. SSH) +sudo ufw limit OpenSSH + +# Delete a rule by number / enable / reload +sudo ufw delete +sudo ufw enable +sudo ufw reload +sudo ufw logging on + +$ port: echo -e "22\n80\n443\n51820" + +# --- NFTABLES (modern native backend) --- + +# Show the full ruleset / one table +sudo nft list ruleset +sudo nft list table inet filter + +# Add a rule (example: allow tcp 443) +sudo nft add rule inet filter input tcp dport 443 accept + +# Persist / restore +sudo nft list ruleset | sudo tee /etc/nftables.conf +sudo nft -f /etc/nftables.conf + +# --- IPTABLES (legacy; inspect carefully) --- + +# READ the rules before changing anything +sudo iptables -L -n -v --line-numbers +sudo iptables -t nat -L -n -v + +# Back up / restore so a mistake is reversible +sudo iptables-save > ~/iptables.backup +sudo iptables-restore < ~/iptables.backup + +# Confirm Tailscale's chains are intact (before AND after any change) +sudo iptables -L -n | grep -E 'ts-input|ts-forward' + +# --- DIAGNOSTICS --- + +# What's actually listening? +sudo ss -tulpn diff --git a/sandboxing.cheat b/sandboxing.cheat new file mode 100644 index 0000000..c655cf7 --- /dev/null +++ b/sandboxing.cheat @@ -0,0 +1,59 @@ +% sandboxing, isolation, firejail, bubblewrap, flatpak, distrobox, security + +# Sandboxing isolates untrusted apps/code from your home dir, keys, and network. +# Layered: Flatpak+Flatseal (GUI apps) | firejail/bwrap (any binary) | distrobox/podman (untrusted code) + +# --- FIREJAIL (wrap a sandbox around any binary) --- + +# Run an app inside firejail (uses its default profile if one exists) +firejail + +# Run with a private throwaway home — the app sees none of your real files +firejail --private + +# Run with NO network access +firejail --net=none + +# Private home + private tmp +firejail --private --private-tmp + +# List available profiles / running sandboxes +ls /etc/firejail/*.profile +firejail --list + +$ app: ls /usr/bin --- --column 1 + +# --- BUBBLEWRAP (low-level unprivileged sandbox; what Flatpak uses underneath) --- + +# Throwaway home, no network, dies with parent +bwrap --ro-bind /usr /usr --symlink usr/bin /bin --symlink usr/lib /lib \ + --tmpfs /home --tmpfs /tmp --unshare-all --die-with-parent + +# --- FLATPAK + FLATSEAL (GUI app permissions) --- + +# Install an app as a (sandboxed) flatpak +flatpak install flathub + +# Inspect an app's granted permissions +flatpak info --show-permissions + +# Revoke home-folder access / cut off the network (CLI equivalent of Flatseal) +flatpak override --user --nofilesystem=home +flatpak override --user --unshare=network + +# Reset an app's overrides +flatpak override --user --reset + +# Install Flatseal (GUI permission manager) +flatpak install flathub com.github.tchx84.Flatseal + +# --- DISTROBOX / PODMAN (isolate untrusted code & AI-generated builds) --- + +# Throwaway dev container, kept off your home + keys +distrobox create --name sandbox --image debian:stable && distrobox enter sandbox + +# One-off rootless container, auto-removed, only the current dir mounted +podman run --rm -it --userns=keep-id -v "$PWD":/work:Z -w /work debian:stable bash + +# NOTE: distro choice is orthogonal to isolation. Compartmentalize on a normal distro +# (Flatpak+Flatseal + firejail/bwrap + podman/distrobox) = ~70% of Qubes benefit, ~10% of the friction. diff --git a/ssh-hardening.cheat b/ssh-hardening.cheat new file mode 100644 index 0000000..52c8c28 --- /dev/null +++ b/ssh-hardening.cheat @@ -0,0 +1,61 @@ +% ssh, hardening, sshd, openssh, security + +# Harden SSH: keys-only, no root, modern crypto, rate-limited. +# ALWAYS keep a second session open while editing sshd_config so a typo can't lock you out. + +# --- KEYS --- + +# Generate a modern key (ed25519) +ssh-keygen -t ed25519 -C "" + +# Hardware-backed key (FIDO2 / YubiKey — requires a touch to use) +ssh-keygen -t ed25519-sk -C "" + +# Copy your public key to a server +ssh-copy-id @ + +# Add a key with confirm-on-use (agent prompts before every use) +ssh-add -c ~/.ssh/id_ed25519 + +$ host: grep -hoP '^Host \K[^*]+' ~/.ssh/config 2>/dev/null + +# --- sshd_config HARDENING (/etc/ssh/sshd_config) --- + +# Keys only, no root, no passwords: +# PermitRootLogin no +# PasswordAuthentication no +# KbdInteractiveAuthentication no +# PubkeyAuthentication yes +# Limit who can log in: +# AllowUsers +# Shrink brute-force surface: +# MaxAuthTries 3 +# LoginGraceTime 20 +# Modern crypto only: +# KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org +# Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com +# MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com + +# TEST the config BEFORE restarting (catches typos that would lock you out) +sudo sshd -t + +# Restart (keep your other session open!) +sudo systemctl restart ssh + +# --- fail2ban (ban brute-forcers) --- + +sudo fail2ban-client -t +sudo fail2ban-client status sshd +sudo fail2ban-client set sshd unbanip + +# --- CLIENT: ~/.ssh/config aliases (stop typing IPs) --- + +# Host myserver +# HostName +# User +# Port +# IdentityFile ~/.ssh/id_ed25519 +# IdentitiesOnly yes + +# Audit the crypto a server actually offers +ssh -vv 2>&1 | grep -iE 'cipher|kex|mac'