djedi/cypherpunk-cheats
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Complete README index (49 files) + add sandboxing/firewall/dns-privacy/ssh-hardening cheats

Browse source 
- README: full category index (was missing ~23 files incl. the richest privacy sheets)
- sandboxing.cheat: firejail, bubblewrap, Flatpak/Flatseal, distrobox/podman
- firewall.cheat: ufw, nftables, iptables (with the Tailscale-flush warning)
- dns-privacy.cheat: DoH/DoT, dnscrypt, unbound, Pi-hole
- ssh-hardening.cheat: keys-only, modern crypto, fail2ban, FIDO2
- Red-teamed clean (no real PII/secrets)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
rpriven 2026-06-28 14:02:09 -06:00
parent 93ed13d6ee
commit 31ee08b0a0
Signed by: djedi
GPG key ID: D04DED574622EF45
5 changed files with 297 additions and 37 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

100
README.md
View file

@ -2,15 +2,14 @@
Navi-compatible cheatsheets for security, privacy, and digital sovereignty. Navi-compatible cheatsheets for security, privacy, and digital sovereignty.
49 cheatsheets spanning offensive security, DFIR, privacy, encryption, system hardening, and cryptocurrency.
## Installation ## Installation
```bash ```bash
# Install navi # Install navi
cargo install navi cargo install navi
# or: sudo apt install navi (Debian/Ubuntu) | brew install navi (macOS)
# Or via package manager
sudo apt install navi # Debian/Ubuntu
brew install navi # macOS
# Add this repo to navi (choose one) # Add this repo to navi (choose one)
navi repo add https://github.com/rpriven/cypherpunk-cheats # GitHub navi repo add https://github.com/rpriven/cypherpunk-cheats # GitHub
@ -19,7 +18,7 @@ navi repo add https://git.djeditech.com/djedi/cypherpunk-cheats # Mirror
## Manual Setup ## Manual Setup
Add to your navi config (`~/.config/navi/config.yaml`): Point navi at a local clone (best for editing/dogfooding) — `~/.config/navi/config.yaml`:
```yaml ```yaml
cheats: cheats:
@ -30,75 +29,102 @@ cheats:
## Usage ## Usage
```bash ```bash
# Launch navi navi # interactive launcher
navi navi --query "ufw" # jump to a topic
navi --best-match --query "ssh hardening" --print # print top match, no TUI
# Query specific topic
navi --query "nmap"
navi --query "monero"
navi --query "luks"
# Preview mode
navi --preview
# Use with custom path
navi --path /path/to/cypherpunk-cheats
``` ```
## Categories ## Categories
### Offensive Security ### Offensive Security & Recon
| File | Description | | File | Description |
|------|-------------| |------|-------------|
| `nmap.cheat` | Port scanning and service enumeration | | `nmap.cheat` | Port scanning and service enumeration |
| `web.cheat` | Web application testing (ffuf, sqlmap, nikto) | | `recon-advanced.cheat` | Advanced recon / OSINT enumeration |
| `web.cheat` | Web app testing (Burp, ffuf, fuzzing) |
| `api-testing.cheat` | REST/GraphQL API testing |
| `vuln-scanning.cheat` | Vulnerability scanning |
| `hashcat.cheat` | Password cracking with Hashcat | | `hashcat.cheat` | Password cracking with Hashcat |
| `john.cheat` | John the Ripper password cracking | | `john.cheat` | John the Ripper password cracking |
| `privesc-linux.cheat` | Linux privilege escalation | | `privesc-linux.cheat` | Linux privilege escalation |
| `privesc-windows.cheat` | Windows privilege escalation | | `privesc-windows.cheat` | Windows privilege escalation |
| `active-directory.cheat` | AD attacks (NetExec, Kerberoasting) | | `active-directory.cheat` | AD attacks (Kerberos, NetExec) |
| `containers.cheat` | Docker/Kubernetes security | | `ad-post-exploit.cheat` | AD post-exploitation / lateral movement |
| `wireless.cheat` | WiFi attacks (aircrack-ng, WPA cracking) | | `smb-shares.cheat` | SMB shares & lateral movement |
| `tunnels.cheat` | SSH tunnels, chisel, pivoting | | `c2-frameworks.cheat` | Command-and-control frameworks |
| `wireless.cheat` | WiFi attacks (aircrack-ng, WPA) |
| `tunnels.cheat` | SSH tunnels, pivoting, port-forward, WireGuard |
| `containers.cheat` | Docker/Kubernetes security & escapes |
| `reversing.cheat` | Ghidra, radare2, GDB, binary analysis |
### DFIR & Analysis ### DFIR & Analysis
| File | Description | | File | Description |
|------|-------------| |------|-------------|
| `forensics.cheat` | Volatility, disk imaging, evidence collection | | `forensics.cheat` | Volatility, memory, incident response |
| `osint.cheat` | Sherlock, theHarvester, recon-ng |
| `wireshark.cheat` | Packet analysis (tshark, tcpdump) | | `wireshark.cheat` | Packet analysis (tshark, tcpdump) |
| `reversing.cheat` | Ghidra, radare2, GDB, binary analysis | | `osint.cheat` | Sherlock, theHarvester, recon-ng |
| `steganography.cheat` | Hidden data extraction (steghide, binwalk) | | `steganography.cheat` | Hidden data (steghide, binwalk) |
### Privacy & Encryption ### Privacy & Anonymity
| File | Description | | File | Description |
|------|-------------| |------|-------------|
| `privacy.cheat` | Tor, GPG, age encryption, metadata removal | | `privacy.cheat` | Privacy toolkit overview (Tor, GPG, PETs) |
| `luks.cheat` | Full disk encryption (LUKS, dm-crypt) | | `tor.cheat` | Tor, onion services, darknet |
| `anti-surveillance.cheat` | Counter-surveillance & tracking defense |
| `browser-hardening.cheat` | Firefox/Chrome hardening, anti-fingerprinting |
| `phone-privacy.cheat` | Mobile privacy (GrapheneOS, Android, iOS) |
| `metadata-removal.cheat` | EXIF / metadata sanitization |
| `opsec.cheat` | Operational security & threat modeling |
| `secure-comms.cheat` | Signal, Matrix, SimpleX, encrypted messaging |
| `email-privacy.cheat` | ProtonMail/Tutanota, PGP email |
### Encryption & Secrets
| File | Description |
|------|-------------|
| `gpg.cheat` | GPG/PGP encryption & signing |
| `age.cheat` | Modern file encryption (age) |
| `luks.cheat` | Full-disk encryption (LUKS, dm-crypt) |
| `veracrypt.cheat` | VeraCrypt containers & hidden volumes |
| `pass.cheat` | Password managers (pass, KeePassXC) | | `pass.cheat` | Password managers (pass, KeePassXC) |
| `secure-comms.cheat` | Signal CLI, Matrix, encrypted messaging | | `2fa-security.cheat` | TOTP, FIDO2, YubiKey, MFA |
| `secure-file-sharing.cheat` | OnionShare, magic-wormhole |
| `secure-deletion.cheat` | Secure wipe (shred, data destruction) |
| `anti-forensics.cheat` | Counter-forensics / evidence elimination |
### System Hardening
| File | Description |
|------|-------------|
| `secure-os.cheat` | Tails, Whonix, Qubes, hardened Linux |
| `sandboxing.cheat` | firejail, bubblewrap, Flatpak/Flatseal, distrobox |
| `firewall.cheat` | ufw, nftables, iptables (Tailscale-safe) |
| `ssh-hardening.cheat` | sshd hardening, keys-only, modern crypto |
| `dns-privacy.cheat` | DoH/DoT, dnscrypt, unbound, Pi-hole |
### Cryptocurrency & Web3 ### Cryptocurrency & Web3
| File | Description | | File | Description |
|------|-------------| |------|-------------|
| `monero.cheat` | Monero CLI wallet operations | | `monero.cheat` | Monero CLI wallet operations |
| `bitcoin.cheat` | Bitcoin Core CLI operations | | `bitcoin.cheat` | Bitcoin Core CLI operations |
| `solidity.cheat` | Smart contract auditing (Slither, Foundry) | | `anonymous-payments.cheat` | Private payments (Monero, Lightning, cash) |
| `solidity.cheat` | Smart-contract auditing (Slither, Foundry) |
| `nak.cheat` | Nostr army knife (fiatjaf's `nak`) |
## Philosophy ## Philosophy
Built for cypherpunks who value: Built for cypherpunks who value:
- **Privacy** - Default to encrypted, anonymous, and sovereign - **Privacy** — default to encrypted, anonymous, and sovereign
- **Security** - Offensive knowledge for defensive thinking - **Security** — offensive knowledge for defensive thinking
- **Freedom** - Tools for digital self-determination - **Freedom** — tools for digital self-determination
## Contributing ## Contributing
PRs welcome! Follow the navi `.cheat` format: PRs welcome. Follow the navi `.cheat` format:
- `%` tags for categories - `%` tags for categories
- `#` comments for descriptions - `#` comments for descriptions
- `$` for argument completion - `$` for argument completion
Use placeholders (`<var>`), never real keys, IPs, or addresses.
## License ## License
MIT MIT

51
dns-privacy.cheat Normal file
View file

@ -0,0 +1,51 @@
% dns, privacy, dnscrypt, unbound, doh, dot, pihole
# DNS queries reveal every domain you visit. Encrypt them (DoH/DoT) and/or self-host
# a resolver (unbound / Pi-hole) so no third party logs your lookups.
# --- INSPECT current DNS ---
# Which resolver am I actually using?
resolvectl status
cat /etc/resolv.conf
# Leak test (your egress IP + a who-am-I lookup)
curl -s https://1.1.1.1/cdn-cgi/trace | grep -E '^ip|^loc'
dig +short whoami.akamai.net
# Query a specific resolver directly
dig @<resolver> <domain>
$ resolver: echo -e "1.1.1.1\n9.9.9.9\n127.0.0.1"
# --- DoT via systemd-resolved (simplest encrypted DNS) ---
# Edit /etc/systemd/resolved.conf:
# DNS=9.9.9.9#dns.quad9.net
# DNSOverTLS=yes
sudo systemctl restart systemd-resolved
resolvectl query example.com
# --- dnscrypt-proxy (DoH / DNSCrypt + anonymized relays) ---
sudo systemctl restart dnscrypt-proxy
sudo systemctl status dnscrypt-proxy
# config: /etc/dnscrypt-proxy/dnscrypt-proxy.toml (set require_dnssec, anonymized_dns)
# --- unbound (your own recursive, DNSSEC-validating resolver — no upstream logging) ---
sudo unbound-checkconf
sudo systemctl restart unbound
# then point resolv.conf / resolved at 127.0.0.1
# --- Pi-hole (network-wide ad/tracker blocking + your own resolver) ---
# Run via Docker (or install from the StartOS marketplace)
docker run -d --name pihole -e TZ=Etc/UTC \
-p 53:53/tcp -p 53:53/udp -p 80:80 -v pihole_etc:/etc/pihole pihole/pihole
# Update blocklists (gravity) / tail the live query log
docker exec pihole pihole -g
docker exec pihole pihole -t
# Point your router's (or clients') DNS at the Pi-hole's IP to cover the whole LAN

63
firewall.cheat Normal file
View file

@ -0,0 +1,63 @@
% firewall, ufw, nftables, iptables, network-security
# ⚠️ CRITICAL: never blindly flush rules on a box running Tailscale / VPN / Docker.
# `iptables -F`, `iptables -X`, `ip route flush` destroy custom chains (ts-input,
# ts-forward, DOCKER) and can sever your remote access. Inspect first; flush never casually.
# --- UFW (simple front-end; start here) ---
# Status, numbered (so you can delete by number)
sudo ufw status numbered
# Sane defaults: deny in, allow out
sudo ufw default deny incoming
sudo ufw default allow outgoing
# Allow a port or named service
sudo ufw allow <port>/tcp
sudo ufw allow OpenSSH
# Allow from one source only
sudo ufw allow from <ip> to any port <port>
# Rate-limit a port (brute-force mitigation, e.g. SSH)
sudo ufw limit OpenSSH
# Delete a rule by number / enable / reload
sudo ufw delete <num>
sudo ufw enable
sudo ufw reload
sudo ufw logging on
$ port: echo -e "22\n80\n443\n51820"
# --- NFTABLES (modern native backend) ---
# Show the full ruleset / one table
sudo nft list ruleset
sudo nft list table inet filter
# Add a rule (example: allow tcp 443)
sudo nft add rule inet filter input tcp dport 443 accept
# Persist / restore
sudo nft list ruleset | sudo tee /etc/nftables.conf
sudo nft -f /etc/nftables.conf
# --- IPTABLES (legacy; inspect carefully) ---
# READ the rules before changing anything
sudo iptables -L -n -v --line-numbers
sudo iptables -t nat -L -n -v
# Back up / restore so a mistake is reversible
sudo iptables-save > ~/iptables.backup
sudo iptables-restore < ~/iptables.backup
# Confirm Tailscale's chains are intact (before AND after any change)
sudo iptables -L -n | grep -E 'ts-input|ts-forward'
# --- DIAGNOSTICS ---
# What's actually listening?
sudo ss -tulpn

59
sandboxing.cheat Normal file
View file

@ -0,0 +1,59 @@
% sandboxing, isolation, firejail, bubblewrap, flatpak, distrobox, security
# Sandboxing isolates untrusted apps/code from your home dir, keys, and network.
# Layered: Flatpak+Flatseal (GUI apps) | firejail/bwrap (any binary) | distrobox/podman (untrusted code)
# --- FIREJAIL (wrap a sandbox around any binary) ---
# Run an app inside firejail (uses its default profile if one exists)
firejail <app>
# Run with a private throwaway home — the app sees none of your real files
firejail --private <app>
# Run with NO network access
firejail --net=none <app>
# Private home + private tmp
firejail --private --private-tmp <app>
# List available profiles / running sandboxes
ls /etc/firejail/*.profile
firejail --list
$ app: ls /usr/bin --- --column 1
# --- BUBBLEWRAP (low-level unprivileged sandbox; what Flatpak uses underneath) ---
# Throwaway home, no network, dies with parent
bwrap --ro-bind /usr /usr --symlink usr/bin /bin --symlink usr/lib /lib \
--tmpfs /home --tmpfs /tmp --unshare-all --die-with-parent <cmd>
# --- FLATPAK + FLATSEAL (GUI app permissions) ---
# Install an app as a (sandboxed) flatpak
flatpak install flathub <app_id>
# Inspect an app's granted permissions
flatpak info --show-permissions <app_id>
# Revoke home-folder access / cut off the network (CLI equivalent of Flatseal)
flatpak override --user --nofilesystem=home <app_id>
flatpak override --user --unshare=network <app_id>
# Reset an app's overrides
flatpak override --user --reset <app_id>
# Install Flatseal (GUI permission manager)
flatpak install flathub com.github.tchx84.Flatseal
# --- DISTROBOX / PODMAN (isolate untrusted code & AI-generated builds) ---
# Throwaway dev container, kept off your home + keys
distrobox create --name sandbox --image debian:stable && distrobox enter sandbox
# One-off rootless container, auto-removed, only the current dir mounted
podman run --rm -it --userns=keep-id -v "$PWD":/work:Z -w /work debian:stable bash
# NOTE: distro choice is orthogonal to isolation. Compartmentalize on a normal distro
# (Flatpak+Flatseal + firejail/bwrap + podman/distrobox) = ~70% of Qubes benefit, ~10% of the friction.

61
ssh-hardening.cheat Normal file
View file

@ -0,0 +1,61 @@
% ssh, hardening, sshd, openssh, security
# Harden SSH: keys-only, no root, modern crypto, rate-limited.
# ALWAYS keep a second session open while editing sshd_config so a typo can't lock you out.
# --- KEYS ---
# Generate a modern key (ed25519)
ssh-keygen -t ed25519 -C "<comment>"
# Hardware-backed key (FIDO2 / YubiKey — requires a touch to use)
ssh-keygen -t ed25519-sk -C "<comment>"
# Copy your public key to a server
ssh-copy-id <user>@<host>
# Add a key with confirm-on-use (agent prompts before every use)
ssh-add -c ~/.ssh/id_ed25519
$ host: grep -hoP '^Host \K[^*]+' ~/.ssh/config 2>/dev/null
# --- sshd_config HARDENING (/etc/ssh/sshd_config) ---
# Keys only, no root, no passwords:
# PermitRootLogin no
# PasswordAuthentication no
# KbdInteractiveAuthentication no
# PubkeyAuthentication yes
# Limit who can log in:
# AllowUsers <user>
# Shrink brute-force surface:
# MaxAuthTries 3
# LoginGraceTime 20
# Modern crypto only:
# KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org
# Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com
# MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
# TEST the config BEFORE restarting (catches typos that would lock you out)
sudo sshd -t
# Restart (keep your other session open!)
sudo systemctl restart ssh
# --- fail2ban (ban brute-forcers) ---
sudo fail2ban-client -t
sudo fail2ban-client status sshd
sudo fail2ban-client set sshd unbanip <ip>
# --- CLIENT: ~/.ssh/config aliases (stop typing IPs) ---
# Host myserver
# HostName <ip-or-domain>
# User <user>
# Port <port>
# IdentityFile ~/.ssh/id_ed25519
# IdentitiesOnly yes
# Audit the crypto a server actually offers
ssh -vv <host> 2>&1 | grep -iE 'cipher|kex|mac'