Complete README index (49 files) + add sandboxing/firewall/dns-privacy/ssh-hardening cheats

- README: full category index (was missing ~23 files incl. the richest privacy sheets) - sandboxing.cheat: firejail, bubblewrap, Flatpak/Flatseal, distrobox/podman - firewall.cheat: ufw, nftables, iptables (with the Tailscale-flush warning) - dns-privacy.cheat: DoH/DoT, dnscrypt, unbound, Pi-hole - ssh-hardening.cheat: keys-only, modern crypto, fail2ban, FIDO2 - Red-teamed clean (no real PII/secrets) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-28 14:02:09 -06:00 · 2026-06-28 14:02:09 -06:00 · 31ee08b0a0
commit 31ee08b0a0
parent 93ed13d6ee
5 changed files with 297 additions and 37 deletions
--- a/README.md
+++ b/README.md
@ -2,15 +2,14 @@

 Navi-compatible cheatsheets for security, privacy, and digital sovereignty.

+49 cheatsheets spanning offensive security, DFIR, privacy, encryption, system hardening, and cryptocurrency.
+
 ## Installation

 ```bash
 # Install navi
 cargo install navi
-
-# Or via package manager
-sudo apt install navi  # Debian/Ubuntu
-brew install navi      # macOS
+# or: sudo apt install navi   (Debian/Ubuntu)   |   brew install navi   (macOS)

 # Add this repo to navi (choose one)
 navi repo add https://github.com/rpriven/cypherpunk-cheats        # GitHub
@ -19,7 +18,7 @@ navi repo add https://git.djeditech.com/djedi/cypherpunk-cheats   # Mirror

 ## Manual Setup

-Add to your navi config (`~/.config/navi/config.yaml`):
+Point navi at a local clone (best for editing/dogfooding) — `~/.config/navi/config.yaml`:

 ```yaml
 cheats:
@ -30,75 +29,102 @@ cheats:
 ## Usage

 ```bash
-# Launch navi
-navi
-
-# Query specific topic
-navi --query "nmap"
-navi --query "monero"
-navi --query "luks"
-
-# Preview mode
-navi --preview
-
-# Use with custom path
-navi --path /path/to/cypherpunk-cheats
+navi                          # interactive launcher
+navi --query "ufw"            # jump to a topic
+navi --best-match --query "ssh hardening" --print   # print top match, no TUI
 ```

 ## Categories

-### Offensive Security
+### Offensive Security & Recon
 | File | Description |
 |------|-------------|
 | `nmap.cheat` | Port scanning and service enumeration |
-| `web.cheat` | Web application testing (ffuf, sqlmap, nikto) |
+| `recon-advanced.cheat` | Advanced recon / OSINT enumeration |
+| `web.cheat` | Web app testing (Burp, ffuf, fuzzing) |
+| `api-testing.cheat` | REST/GraphQL API testing |
+| `vuln-scanning.cheat` | Vulnerability scanning |
 | `hashcat.cheat` | Password cracking with Hashcat |
 | `john.cheat` | John the Ripper password cracking |
 | `privesc-linux.cheat` | Linux privilege escalation |
 | `privesc-windows.cheat` | Windows privilege escalation |
-| `active-directory.cheat` | AD attacks (NetExec, Kerberoasting) |
-| `containers.cheat` | Docker/Kubernetes security |
-| `wireless.cheat` | WiFi attacks (aircrack-ng, WPA cracking) |
-| `tunnels.cheat` | SSH tunnels, chisel, pivoting |
+| `active-directory.cheat` | AD attacks (Kerberos, NetExec) |
+| `ad-post-exploit.cheat` | AD post-exploitation / lateral movement |
+| `smb-shares.cheat` | SMB shares & lateral movement |
+| `c2-frameworks.cheat` | Command-and-control frameworks |
+| `wireless.cheat` | WiFi attacks (aircrack-ng, WPA) |
+| `tunnels.cheat` | SSH tunnels, pivoting, port-forward, WireGuard |
+| `containers.cheat` | Docker/Kubernetes security & escapes |
+| `reversing.cheat` | Ghidra, radare2, GDB, binary analysis |

 ### DFIR & Analysis
 | File | Description |
 |------|-------------|
-| `forensics.cheat` | Volatility, disk imaging, evidence collection |
-| `osint.cheat` | Sherlock, theHarvester, recon-ng |
+| `forensics.cheat` | Volatility, memory, incident response |
 | `wireshark.cheat` | Packet analysis (tshark, tcpdump) |
-| `reversing.cheat` | Ghidra, radare2, GDB, binary analysis |
-| `steganography.cheat` | Hidden data extraction (steghide, binwalk) |
+| `osint.cheat` | Sherlock, theHarvester, recon-ng |
+| `steganography.cheat` | Hidden data (steghide, binwalk) |

-### Privacy & Encryption
+### Privacy & Anonymity
 | File | Description |
 |------|-------------|
-| `privacy.cheat` | Tor, GPG, age encryption, metadata removal |
-| `luks.cheat` | Full disk encryption (LUKS, dm-crypt) |
+| `privacy.cheat` | Privacy toolkit overview (Tor, GPG, PETs) |
+| `tor.cheat` | Tor, onion services, darknet |
+| `anti-surveillance.cheat` | Counter-surveillance & tracking defense |
+| `browser-hardening.cheat` | Firefox/Chrome hardening, anti-fingerprinting |
+| `phone-privacy.cheat` | Mobile privacy (GrapheneOS, Android, iOS) |
+| `metadata-removal.cheat` | EXIF / metadata sanitization |
+| `opsec.cheat` | Operational security & threat modeling |
+| `secure-comms.cheat` | Signal, Matrix, SimpleX, encrypted messaging |
+| `email-privacy.cheat` | ProtonMail/Tutanota, PGP email |
+
+### Encryption & Secrets
+| File | Description |
+|------|-------------|
+| `gpg.cheat` | GPG/PGP encryption & signing |
+| `age.cheat` | Modern file encryption (age) |
+| `luks.cheat` | Full-disk encryption (LUKS, dm-crypt) |
+| `veracrypt.cheat` | VeraCrypt containers & hidden volumes |
 | `pass.cheat` | Password managers (pass, KeePassXC) |
-| `secure-comms.cheat` | Signal CLI, Matrix, encrypted messaging |
+| `2fa-security.cheat` | TOTP, FIDO2, YubiKey, MFA |
+| `secure-file-sharing.cheat` | OnionShare, magic-wormhole |
+| `secure-deletion.cheat` | Secure wipe (shred, data destruction) |
+| `anti-forensics.cheat` | Counter-forensics / evidence elimination |
+
+### System Hardening
+| File | Description |
+|------|-------------|
+| `secure-os.cheat` | Tails, Whonix, Qubes, hardened Linux |
+| `sandboxing.cheat` | firejail, bubblewrap, Flatpak/Flatseal, distrobox |
+| `firewall.cheat` | ufw, nftables, iptables (Tailscale-safe) |
+| `ssh-hardening.cheat` | sshd hardening, keys-only, modern crypto |
+| `dns-privacy.cheat` | DoH/DoT, dnscrypt, unbound, Pi-hole |

 ### Cryptocurrency & Web3
 | File | Description |
 |------|-------------|
 | `monero.cheat` | Monero CLI wallet operations |
 | `bitcoin.cheat` | Bitcoin Core CLI operations |
-| `solidity.cheat` | Smart contract auditing (Slither, Foundry) |
+| `anonymous-payments.cheat` | Private payments (Monero, Lightning, cash) |
+| `solidity.cheat` | Smart-contract auditing (Slither, Foundry) |
+| `nak.cheat` | Nostr army knife (fiatjaf's `nak`) |

 ## Philosophy

 Built for cypherpunks who value:
- **Privacy** - Default to encrypted, anonymous, and sovereign
- **Security** - Offensive knowledge for defensive thinking
- **Freedom** - Tools for digital self-determination
+- **Privacy** — default to encrypted, anonymous, and sovereign
+- **Security** — offensive knowledge for defensive thinking
+- **Freedom** — tools for digital self-determination

 ## Contributing

-PRs welcome! Follow the navi `.cheat` format:
+PRs welcome. Follow the navi `.cheat` format:
 - `%` tags for categories
 - `#` comments for descriptions
 - `$` for argument completion

+Use placeholders (`<var>`), never real keys, IPs, or addresses.
+
 ## License

 MIT
--- a/dns-privacy.cheat
+++ b/dns-privacy.cheat
@ -0,0 +1,51 @@
+% dns, privacy, dnscrypt, unbound, doh, dot, pihole
+
+# DNS queries reveal every domain you visit. Encrypt them (DoH/DoT) and/or self-host
+# a resolver (unbound / Pi-hole) so no third party logs your lookups.
+
+# --- INSPECT current DNS ---
+
+# Which resolver am I actually using?
+resolvectl status
+cat /etc/resolv.conf
+
+# Leak test (your egress IP + a who-am-I lookup)
+curl -s https://1.1.1.1/cdn-cgi/trace | grep -E '^ip|^loc'
+dig +short whoami.akamai.net
+
+# Query a specific resolver directly
+dig @<resolver> <domain>
+
+$ resolver: echo -e "1.1.1.1\n9.9.9.9\n127.0.0.1"
+
+# --- DoT via systemd-resolved (simplest encrypted DNS) ---
+
+# Edit /etc/systemd/resolved.conf:
+#   DNS=9.9.9.9#dns.quad9.net
+#   DNSOverTLS=yes
+sudo systemctl restart systemd-resolved
+resolvectl query example.com
+
+# --- dnscrypt-proxy (DoH / DNSCrypt + anonymized relays) ---
+
+sudo systemctl restart dnscrypt-proxy
+sudo systemctl status dnscrypt-proxy
+# config: /etc/dnscrypt-proxy/dnscrypt-proxy.toml  (set require_dnssec, anonymized_dns)
+
+# --- unbound (your own recursive, DNSSEC-validating resolver — no upstream logging) ---
+
+sudo unbound-checkconf
+sudo systemctl restart unbound
+# then point resolv.conf / resolved at 127.0.0.1
+
+# --- Pi-hole (network-wide ad/tracker blocking + your own resolver) ---
+
+# Run via Docker (or install from the StartOS marketplace)
+docker run -d --name pihole -e TZ=Etc/UTC \
+  -p 53:53/tcp -p 53:53/udp -p 80:80 -v pihole_etc:/etc/pihole pihole/pihole
+
+# Update blocklists (gravity) / tail the live query log
+docker exec pihole pihole -g
+docker exec pihole pihole -t
+
+# Point your router's (or clients') DNS at the Pi-hole's IP to cover the whole LAN
--- a/firewall.cheat
+++ b/firewall.cheat
@ -0,0 +1,63 @@
+% firewall, ufw, nftables, iptables, network-security
+
+# ⚠️  CRITICAL: never blindly flush rules on a box running Tailscale / VPN / Docker.
+#    `iptables -F`, `iptables -X`, `ip route flush` destroy custom chains (ts-input,
+#    ts-forward, DOCKER) and can sever your remote access. Inspect first; flush never casually.
+
+# --- UFW (simple front-end; start here) ---
+
+# Status, numbered (so you can delete by number)
+sudo ufw status numbered
+
+# Sane defaults: deny in, allow out
+sudo ufw default deny incoming
+sudo ufw default allow outgoing
+
+# Allow a port or named service
+sudo ufw allow <port>/tcp
+sudo ufw allow OpenSSH
+
+# Allow from one source only
+sudo ufw allow from <ip> to any port <port>
+
+# Rate-limit a port (brute-force mitigation, e.g. SSH)
+sudo ufw limit OpenSSH
+
+# Delete a rule by number / enable / reload
+sudo ufw delete <num>
+sudo ufw enable
+sudo ufw reload
+sudo ufw logging on
+
+$ port: echo -e "22\n80\n443\n51820"
+
+# --- NFTABLES (modern native backend) ---
+
+# Show the full ruleset / one table
+sudo nft list ruleset
+sudo nft list table inet filter
+
+# Add a rule (example: allow tcp 443)
+sudo nft add rule inet filter input tcp dport 443 accept
+
+# Persist / restore
+sudo nft list ruleset | sudo tee /etc/nftables.conf
+sudo nft -f /etc/nftables.conf
+
+# --- IPTABLES (legacy; inspect carefully) ---
+
+# READ the rules before changing anything
+sudo iptables -L -n -v --line-numbers
+sudo iptables -t nat -L -n -v
+
+# Back up / restore so a mistake is reversible
+sudo iptables-save > ~/iptables.backup
+sudo iptables-restore < ~/iptables.backup
+
+# Confirm Tailscale's chains are intact (before AND after any change)
+sudo iptables -L -n | grep -E 'ts-input|ts-forward'
+
+# --- DIAGNOSTICS ---
+
+# What's actually listening?
+sudo ss -tulpn
--- a/sandboxing.cheat
+++ b/sandboxing.cheat
@ -0,0 +1,59 @@
+% sandboxing, isolation, firejail, bubblewrap, flatpak, distrobox, security
+
+# Sandboxing isolates untrusted apps/code from your home dir, keys, and network.
+# Layered: Flatpak+Flatseal (GUI apps) | firejail/bwrap (any binary) | distrobox/podman (untrusted code)
+
+# --- FIREJAIL (wrap a sandbox around any binary) ---
+
+# Run an app inside firejail (uses its default profile if one exists)
+firejail <app>
+
+# Run with a private throwaway home — the app sees none of your real files
+firejail --private <app>
+
+# Run with NO network access
+firejail --net=none <app>
+
+# Private home + private tmp
+firejail --private --private-tmp <app>
+
+# List available profiles / running sandboxes
+ls /etc/firejail/*.profile
+firejail --list
+
+$ app: ls /usr/bin --- --column 1
+
+# --- BUBBLEWRAP (low-level unprivileged sandbox; what Flatpak uses underneath) ---
+
+# Throwaway home, no network, dies with parent
+bwrap --ro-bind /usr /usr --symlink usr/bin /bin --symlink usr/lib /lib \
+  --tmpfs /home --tmpfs /tmp --unshare-all --die-with-parent <cmd>
+
+# --- FLATPAK + FLATSEAL (GUI app permissions) ---
+
+# Install an app as a (sandboxed) flatpak
+flatpak install flathub <app_id>
+
+# Inspect an app's granted permissions
+flatpak info --show-permissions <app_id>
+
+# Revoke home-folder access / cut off the network (CLI equivalent of Flatseal)
+flatpak override --user --nofilesystem=home <app_id>
+flatpak override --user --unshare=network <app_id>
+
+# Reset an app's overrides
+flatpak override --user --reset <app_id>
+
+# Install Flatseal (GUI permission manager)
+flatpak install flathub com.github.tchx84.Flatseal
+
+# --- DISTROBOX / PODMAN (isolate untrusted code & AI-generated builds) ---
+
+# Throwaway dev container, kept off your home + keys
+distrobox create --name sandbox --image debian:stable && distrobox enter sandbox
+
+# One-off rootless container, auto-removed, only the current dir mounted
+podman run --rm -it --userns=keep-id -v "$PWD":/work:Z -w /work debian:stable bash
+
+# NOTE: distro choice is orthogonal to isolation. Compartmentalize on a normal distro
+# (Flatpak+Flatseal + firejail/bwrap + podman/distrobox) = ~70% of Qubes benefit, ~10% of the friction.
--- a/ssh-hardening.cheat
+++ b/ssh-hardening.cheat
@ -0,0 +1,61 @@
+% ssh, hardening, sshd, openssh, security
+
+# Harden SSH: keys-only, no root, modern crypto, rate-limited.
+# ALWAYS keep a second session open while editing sshd_config so a typo can't lock you out.
+
+# --- KEYS ---
+
+# Generate a modern key (ed25519)
+ssh-keygen -t ed25519 -C "<comment>"
+
+# Hardware-backed key (FIDO2 / YubiKey — requires a touch to use)
+ssh-keygen -t ed25519-sk -C "<comment>"
+
+# Copy your public key to a server
+ssh-copy-id <user>@<host>
+
+# Add a key with confirm-on-use (agent prompts before every use)
+ssh-add -c ~/.ssh/id_ed25519
+
+$ host: grep -hoP '^Host \K[^*]+' ~/.ssh/config 2>/dev/null
+
+# --- sshd_config HARDENING (/etc/ssh/sshd_config) ---
+
+# Keys only, no root, no passwords:
+#   PermitRootLogin no
+#   PasswordAuthentication no
+#   KbdInteractiveAuthentication no
+#   PubkeyAuthentication yes
+# Limit who can log in:
+#   AllowUsers <user>
+# Shrink brute-force surface:
+#   MaxAuthTries 3
+#   LoginGraceTime 20
+# Modern crypto only:
+#   KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org
+#   Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com
+#   MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
+
+# TEST the config BEFORE restarting (catches typos that would lock you out)
+sudo sshd -t
+
+# Restart (keep your other session open!)
+sudo systemctl restart ssh
+
+# --- fail2ban (ban brute-forcers) ---
+
+sudo fail2ban-client -t
+sudo fail2ban-client status sshd
+sudo fail2ban-client set sshd unbanip <ip>
+
+# --- CLIENT: ~/.ssh/config aliases (stop typing IPs) ---
+
+# Host myserver
+#   HostName <ip-or-domain>
+#   User <user>
+#   Port <port>
+#   IdentityFile ~/.ssh/id_ed25519
+#   IdentitiesOnly yes
+
+# Audit the crypto a server actually offers
+ssh -vv <host> 2>&1 | grep -iE 'cipher|kex|mac'