• API
• Django
• HTTP Smuggling
• JSP
• Node.js
• Ruby
• SSRF
• SSO
• Web Cache Poisoning

• I don't like link shorteners, but we all know where he works so... Plus he was nice to me one time. So that clearly establishes him as being legit.

• DigiDucky - How to setup a Digispark like a rubber ducky
• How to Build Your Own Penetration Testing Drop Box - BHIS

• ubuntu.autossh
  • Autossh reverse tunnel to central server.
• P4wnP1
  • P4wnP1 is a highly customizable USB attack platform, based on a low cost Raspberry Pi Zero or Raspberry Pi Zero W.

• Deployment
  • This document describes how to do a full deployment of Firefox Send on your own Linux server.
• ffsend
  • Easily and securely share files from the command line. A fully featured Firefox Send client.

• Oracle VirtualBox - free
• VMware Workstation - paid

• Proxmox - free
• VMware vSphere - free
• Xen - free

• Understanding VM snapshots in ESXi (1015180) - vmware.com
• How to Manage VMware Snapshots - Vladan Seget
• Deep Dive – The Ultimate Guide to Master VMware Snapshot - Mohammed Rafic

• Vulnhub is a website dedicated to cataloging various vulnerable VMs from across the web. It also has a healthy community that creates and submits new VMs on a regular basis. As I write this now, I believe there is around 100 or so different VMs on Vulnhub, so you have a bit of variation.

• Documentation to set up a simple macOS VM in QEMU, accelerated by KVM.

• VMware Workstation macOS

• macos-guest-virtualbox.sh is a Bash script that creates a macOS virtual machine guest on VirtualBox with unmodified macOS installation files downloaded directly from Apple servers. Tested on Cygwin. Works on macOS, Windows Subsystem for Linux, and centOS 7. Should work on most modern Linux distros.

• Windows Server 2016 AutoLab Setup - Jason Helmick(2016)
  • Join Pluralsight author Jason Helmick as he walks through his automated lab setup for use in our Windows Server 2016 content. Check out how to build your lab environment so you can follow along with our authors as you learn the ins and outs of Windows Server 2016.

• Security Scenario Generator (SecGen)](https://github.com/cliffe/SecGen)
  • SecGen creates vulnerable virtual machines so students can learn security penetration testing techniques. Boxes like Metasploitable2 are always the same, this project uses Vagrant, Puppet, and Ruby to create randomly vulnerable virtual machines that can be used for learning or for hosting CTF events.

• Set up your own malware analysis lab with VirtualBox, INetSim and Burp - Christophe Tafani-Dereeper
• CyRIS: Cyber Range Instantiation System
  • CyRIS is a tool for facilitating cybersecurity training by automating the creation and management of the corresponding training environments (a.k.a, cyber ranges) based on a description in YAML format. CyRIS is being developed by the Cyber Range Organization and Design (CROND) NEC-endowed chair at the Japan Advanced Institute of Science and Technology (JAIST).
• DockerSecurityPlayground
  • A Microservices-based framework for the study of Network Security and Penetration Test techniques

• PSAutoLab
  • This project serves as a set of "wrapper" commands that utilize the Lability module which is a terrific tool for creating a lab environment of Windows based systems. The downside is that it is a difficult module for less experienced PowerShell users. The configurations and control commands for the Hyper-V virtual machines are written in PowerShell using Desired State Configuration (DSC) and deployed via Lability.
• Lability
  • The Lability module enables simple provisioning of Windows Hyper-V development and testing environments. It uses a declarative document for machine configuration. However, rather than defining configurations in an external custom domain-specific language (DSL) document, Lability extends existing PowerShell Desired State Configuration (DSC) configuration (.psd1) documents with metadata that can be interpreted by the module. By using this approach, it allows the use of a single configuration document to describe all properties for provisioning Windows-centric development and/or test environments.
• Detection Lab
  • Vagrant & Packer scripts to build a lab environment complete with security tooling and logging best practices. This lab has been designed with defenders in mind. Its primary purpose is to allow the user to quickly build a Windows domain that comes pre-loaded with security tooling and some best practices when it comes to system logging configurations. It can easily be modified to fit most needs or expanded to include additional hosts.
• DetectionLabELK
  • DetectionLabELK is a fork from DetectionLab with ELK stack instead of Splunk.

List of VMs that are preconfigured virtual machines

The Hacker Games - Hack the VM before it hacks you

• I have talked about counterattacks here before, and this system has implemented a number of aggressive anti-hacker measures. In fact, this VM is downright evil. I am probably legally obligated to tell you that it will try to hack you. So if a calculator or message declaring your pwnedness pops up or shows up on your desktop, you asked for it. But don’t worry, it won’t steal your docs or rm you, it will just demonstrate compromise for the game. To save precious bandwidth, this has been implemented in a minimal tinycore-based VM, and will require VirtualBox to run.

Android

• EVABS (Extremely Vulnerable Android Labs)
  • An open source Android application that is intentionally vulnerable so as to act as a learning platform for Android application security beginners. The effort is to introduce beginners with very limited or zero knowledge to some of the major and commonly found real-world based Android application vulnerabilities in a story-based, interactive model. EVABS follows a level-wise difficulty approach and in each level, the player learns a new concept. This project is still under progress and aims at incorporating as many levels as possible.

AWS

• AWS Well-Architected Security Labs - Amazon(Official)
  • This repository contains documentation and code in the format of hands-on labs to help you learn, measure, and build using architectural best practices. The labs are categorized into levels, where 100 is introductory, 200/300 is intermediate and 400 is advanced.
• CloudGoat
  • CloudGoat is Rhino Security Labs' "Vulnerable by Design" AWS deployment tool. It allows you to hone your cloud cybersecurity skills by creating and completing several "capture-the-flag" style scenarios. Each scenario is composed of AWS resources arranged together to create a structured learning experience. Some scenarios are easy, some are hard, and many offer multiple paths to victory. As the attacker, it is your mission to explore the environment, identify vulnerabilities, and exploit your way to the scenario's goal(s).
• CloudGoat 2: The New & Improved “Vulnerable by Design” AWS Deployment Tool - Jeffrey Anderson
• CloudGoat 2 Walkthrough - Part One - thetestlabs.io
• Damn Vulnerable Cloud Application
  • This is a demonstration project to show how to do privilege escalation on AWS. DO NOT deploy this on an AWS account unless you know very well what you are doing!
• Lambda
  • lambhack
    • A vulnerable serverless lambda application. This is certainly a bad idea to base any coding patterns of what you see here. lambhack allows you to take advantage of our tried and true application security problems, namely arbitrary code execution, XSS, injection attacks aand more. This first release only contains arbitrary code execution through the query string. Please feel free to contribute new vulnerabilities.

Docker

• Vulnerable Docker VM - notsosecure
  • Ever fantasized about playing with docker misconfigurations, privilege escalation, etc. within a container? Download this VM, pull out your pentest hats and get started
• Vulhub - Some Docker-Compose files for vulnerabilities environment

Exploit Development

• exploit_me
  • Very vulnerable ARM application (CTF style exploitation tutorial for ARM, but portable to other platforms)

Git Repo

• Leaky Repo

Router

• iv-wrt
  • An Intentionally Vulnerable Router Firmware Distribution

Serverless

• ServerlessGoat
  • This serverless application demonstrates common serverless security flaws as described in the Serverless Security Top 10 Weaknesses guide https://github.com/puresec/sas-top-10.

Terraform

• TerraGoat
  • TerraGoat is Bridgecrew's "Vulnerable by Design" Terraform repository. TerraGoat is a learning and training project that demonstrates how common configuration errors can find their way into production cloud environments.

Thick Client

• Damn Vulnerable Thick Client Application - Part 1 - Setup - Parsia's Den

• OWASP Broken Web Applications Project is a collection of vulnerable web applications that is distributed on a Virtual Machine.

• OWASP Juice Shop(Github)
• OWASP Juice Shop is an intentionally insecure web application written entirely in Javascript which encompasses the entire range of OWASP Top Ten and other severe security flaws.
• OWASP JuiceShop Gitbook walkthrough
• Video Walk through by Sunny Wear
• Pwning OWASP Juice Shop

• OWASP Damn Vulnerable Web Sockets (DVWS) is a vulnerable web application which works on web sockets for client-server communication. The flow of the application is similar to DVWA. You will find more vulnerabilities than the ones listed in the application.

• Being lightweight, fast, and scalable, Node.js is becoming a widely adopted platform for developing web applications. This project provides an environment to learn how OWASP Top 10 security risks apply to web applications developed using Node.js and how to effectively address them.

• collection of DevOps-driven applications, specifically designed to showcase security catastrophes and vulnerabilities for use in security testing, software testing, learning and teaching for both developers and security professionals.

• OWASP Mutillidae II is a free, open source, deliberately vulnerable web-application providing a target for web-security enthusiast. Mutillidae can be installed on Linux and Windows using LAMP, WAMP, and XAMMP. It is pre-installed on SamuraiWTF and OWASP BWA. The existing version can be updated on these platforms. With dozens of vulnerabilities and hints to help the user; this is an easy-to-use web hacking environment designed for labs, security enthusiast, classrooms, CTF, and vulnerability assessment tool targets. Mutillidae has been used in graduate security courses, corporate web sec training courses, and as an "assess the assessor" target for vulnerability assessment software.

• Damn Vulnerable Web Application (DVWA) is a PHP/MySQL web application that is damn vulnerable. Its main goal is to be an aid for security professionals to test their skills and tools in a legal environment, help web developers better understand the processes of securing web applications and to aid both students & teachers to learn about web application security in a controlled class room environment.

• Damn Small Vulnerable Web (DSVW) is a deliberately vulnerable web application written in under 100 lines of code, created for educational purposes. It supports majority of (most popular) web application vulnerabilities together with appropriate attacks.

• XVWA is a badly coded web application written in PHP/MySQL that helps security enthusiasts to learn application security. It’s not advisable to host this application online as it is designed to be “Xtremely Vulnerable”. We recommend hosting this application in local/controlled environment and sharpening your application security ninja skills with any tools of your own choice.

• Hackazon is a free, vulnerable test site that is an online storefront built with the same technologies used in today’s rich client and mobile applications. Hackazon has an AJAX interface, strict workflows and RESTful API’s used by a companion mobile app providing uniquely-effective training and testing ground for IT security professionals. And, it’s full of your favorite vulnerabilities like SQL Injection, cross-site scripting and so on.

• This is the Git repo of the VWGen, which stands for Vulnerable Web applications Generator.

• By provisioning local environments via docker-compose, you will learn how the most critical web application security risks are exploited and how these vulnerable codes can be fixed to mitigate them. woman_technologist

• Lesser Known Web Attack Lab is for intermediate pentester that can test and practice lesser known web attacks such as Object Injection, XSSI, PHAR Deserialization, variables variable ..etc.

• You may need an insecure web application as part of yearly developer compliance training. You may need an insecure web application for a companywide contest for cyber security awareness month. Perhaps you just like playing with insecure web applications on the weekend. There are a variety of insecure web applications out there. If you have specific needs -- maybe XSS in VBScript as opposed to JavaScript --, or regular use-case where you want something similar to showcase the OWASP top 10 yet different topics and look every time. Then what is out there may not work for you. This talk introduces a new tool -- ORIWAP (One Random Insecure Web Application Please), which can randomly generate an insecure web application (the security features, visual style, and data -- users, passwords, forum postings, about page). If you don't like randomness you can specify some or all of the settings and an application will be generated. The talk will demo creating several new applications, and show the variety of options for creating the perfect insecure web application for you. This talk will also discuss how the code works for each area: security features, visual style, and data.

• vulnerable-api
• How to configure Json.NET to create a vulnerable web API

• django.nV
  • django.nV is a purposefully vulnerable Django application provided by nVisium.

• HTTP-Smuggling-Lab
  • Use HTTP Smuggling Lab to learn HTTP Smuggling.

• MoneyX
  • MoneyX is an intentionally vulnerable JSP application used for training developers in application security concepts.

• node.nV
  • Intentionally Vulnerable node.js application
• goat.js
  • Tutorial for Node.js security
• Damn Vulnerable NodeJS Application(DVNA)
  • Damn Vulnerable NodeJS Application (DVNA) is a simple NodeJS application to demonstrate OWASP Top 10 Vulnerabilities and guide on fixing and avoiding these vulnerabilities. The fixes branch will contain fixes for the vulnerabilities. Fixes for vunerabilities OWASP Top 10 2017 vulnerabilities at fixes-2017 branch.

• grails_nV
  • grails_nV is a vulnerable jobs listing website.
• RailsGoat
  • RailsGoat is a vulnerable version of the Ruby on Rails Framework from versions 3 to 5. It includes vulnerabilities from the OWASP Top 10, as well as some "extras" that the initial project contributors felt worthwhile to share. This project is designed to educate both developers, as well as security professionals.

• SSRF Vulnerable Lab
  • This repository contain PHP codes which are vulnerable to Server-Side Request Forgery (SSRF) attack.

• Vulnerable SSO
  • Vulnerable SSo is focused on single sign on related vulnerabilities. If you want to learn, you should check this and contribute this project. VulnSSO tool is focused on sso attacks. Nowadays most of the company uses their own implementation for sso solutions. Some of the bug hunters found really good vulnerability on the big company. There are some tools(dvwa and others .. ) that contains vulnerability. They don't have any support for sso vulnerability. Our focus is only sso related bugs. VulnSSO is training tool.It will contain redirect uri vulnerability , XXE on saml request and many others.

• Web Cache Poisoning Lab
  • Welcome to the Cache Poisoning Lab. In this lab you will have the opportunity to experiment with some of the vulnerabilities presented in the brilliant paper Practical Web Cache Poisoning by James Kettle.

• Docker container that intakes post with the following form data and then "clicks" the link. Intentionally vulnerable. To be used with vulnerable by design web apps to realistically simulate XSS and XSRF (CSRF). Service runs flask to receive the post requests, and runs on the default port of 5000.

• Building an Effective Active Directory Lab Environment for Testing - adsecurity.org
• Step-By-Step: Setting up Active Directory in Windows Server 2016 - blogs.technet
• Pentest Home Lab - 0x2 - Building Your AD Lab on Premises-SethSec
• Building and Attacking an Active Directory lab with PowerShell - 1337red
• DarthSidious
  • Building an Active Directory domain and hacking it
• Creating a SCCM Lab: Part 1 - Setting up AD
• Build a new Windows Domain with a (semi) easy button - Craig Bowser
• Introducing the Active Directory Learning Lab - @jckhmr_t
  • I'm a big fan of automation with tools such as Ansible, Vagrant and Terrorm now being put to regular use by me. Also, as a Red Team Operator I spend a lot of time modelling attacks up, trying new ideas out and generally keeping myself 'sharp'. I wanted to create something that help me to scratch all of these itches. The research and development culminated in my BSides Belfast 2019 presentation: Offensive Ansible for Red Teams (Attack, Build, Learn).
• How to Build an Active Directory Hacking Lab - TheCyberMentor
• PAW deployment guide - Jian Yan(2018)
• This blogpost only focusses on one aspect, which is the PAW deployment, including the backend servers.
• Step-by-Step Guide to install Active Directory in Windows Server 2019 (PowerShell Guide) - Disham M. Francis(2018)
• Lab Building Guide: Virtual Active Directory - Vartai Security(2020)
• Building a lab with Server 2019 Server Core and PowerShell …then attacking it! - Neil Lines(2020)

• Active Directory Domain Services on the AWS Cloud: Quick Start Reference Deployment - docs.aws
• Active Directory Domain Services on AWS
  • This Quick Start deploys Microsoft Active Directory Domain Services (AD DS) on the AWS Cloud. AD DS and Domain Name Server (DNS) are core Windows services that provide the foundation for many Microsoft-based solutions for the enterprise, including Microsoft SharePoint, Microsoft Exchange, and .NET Framework applications.

• Articles/Blogposts/Writeups
  • Automating the provisioning of Active Directory labs in Azure - Christophe Tafani-Dereeper
• Tools
  • Disruption
    • Disruption is a code for Terraform to deploy a small AD domain-based environment in Azure. The environment contains two domain controllers (Windows Server 2012), Fileserver + Web server (Windows Server 2019), Windows 7 client, Windows 10 client, and kali Linux machine. They are connected to the same subnet. Each windows machine has some packages being installing during deployment (the list can be viewed and modified here: chocolist). All the needed configurations (Domain creation, DC promotion, joining the machines to the domain and more are automated and part of the deployment. However, there are more improvments to be added (creating OUs, Users, and stuff like that. I'll might get to it in the future, or, you will submit a pull request :))

• My Guide to Building your own AD Lab with 0 effort.
  1. Use an automated lab creation solution/script.
  2. Populate it using BadBlood
  3. Add misconfigurations to it: https://medium.com/@vartaisecurity/lab-building-guide-virtual-active-directory-5f0d0c8eb907

• Manage Active Directory Objects with the New Windows AD Provider for HashiCorp Terraform(2020)
• Windows Server Administration for Beginners - IT & Software(Youtube)

• Active Directory Auto Deployment of Tiers in any environment - David Rowe
  • "This code is written in PowerShell and requires the AD commandlets to run. The current scripts in the repo: create a tiered structured in an active directory environment, create tiered groups with very granular permissions on the domain and create ACL permissions on the OUs based on the name of the group."
• WSLab - Official Microsoft Stuff
  • Windows Server rapid lab deployment scripts
• AutomatedLab
  • AutomatedLab is a provisioning solution and framework that lets you deploy complex labs on HyperV and Azure with simple PowerShell scripts. It supports all Windows operating systems from 2008 R2 to 2016 including Nano Server and various products like AD, Exchange, PKI, IIS, etc.
• Automated-AD-Setup
  • A PowerShell script that aims to have a fully configured domain built in under 10 minutes, but also apply security configuration and hardening.
• Invoke-ADLabDeployer
  • Automated deployment of Windows and Active Directory test lab networks. Useful for red and blue teams.
  • Blogpost)
• ADLab
  • PS Script for creating an AD lab quickly
  • Blogpost
• Purple Cloud
  • An Infrastructure as Code (IaC) deployment of a small Active Directory pentest lab in the cloud. The deployment simulates a semi-realistic corporate enterprise Active Directory with a DC and endpoints. Purple team goals include blue team detection capabilities and R&D for detection engineering new approaches.

• BadBlood
  • BadBlood by Secframe fills a Microsoft Active Directory Domain with a structure and thousands of objects. The output of the tool is a domain similar to a domain in the real world. After BadBlood is ran on a domain, security analysts and engineers can practice using tools to gain an understanding and prescribe to securing Active Directory. Each time this tool runs, it produces different results. The domain, users, groups, computers and permissions are different. Every. Single. Time.

• Faker is a Python package that generates fake data for you. Whether you need to bootstrap your database, create good-looking XML documents, fill-in your persistence to stress test it, or anonymize data taken from a production service, Faker is for you.

• How To Create An Active Directory Forest With PowerShell - Adam Bertram(2018)
  • In this video, Adam will cover how the various parameters that are required to run the Install-ADDSForest command and will go over some gotchas that you should know about when building a new forest. Prerequisites include: (2) Windows Server 2016 VMs on the same network (soon-to-be domain controllers)

• Use PowerShell to Create a New Active Directory Forest on Windows 2019 Server Core Installation (no-GUI) - Mike F Robbins

• Create Bulk Users in Active Directory (Step-By-Step Guide) - Robert Allen(2018)
• New-ADUser: Creating Active Directory Users with PowerShell - Kevin Sapp(2019)

• ADImporter
  • When you need to simulate a real Active Directory with thousands of users you quickly find that creating realistic test accounts is not trivial. Sure enough, you can whip up a quick PowerShell one-liner that creates any number of accounts, but what if you need real first and last names? Real (existing) addresses? Postal codes matching phone area codes? I could go on. The point is that you need two things: input files with names, addresses etc. And script logic that creates user accounts from that data. This blog post provides both.
• youzer
  • Fake User Generator for Active Directory Environments
• AzDummy
  • A Python Typer-based CLI tool to generate fake data for Azure AD.

• sheepl
  • sheepl is a tool that aims to bridge the gap by emulating the behaviour that people normally undertake within a network environment. Using Python3 and AutoIT3 the output can be compiled into a standalone executable without any other dependancies that when executed on an Windows endpoint, executes a set of tasks randomly over a chosen time frame.

• DarthSidious
  • To share my modest knowledge about hacking Windows systems. This is commonly refered to as red team exercises. This book however, is also very concerned with the blue team; the defenders. That is, helping those who are working as defenders, analysts and security experts to build secure Active Directory environments and monitor them for malicious activity.
• Home Lab with pfSense & VMware Workstation - sysadmin perspective
  • I wanted to build a virtual lab environment at home that would emulate an office environment. My requirements were to have separate network segments for Clients & Servers, and two DMZ networks. I also wanted my home network, which is external to the virtual lab environment, to emulate the Internet, even though it really isn’t. The following is how I created multiple “named” LAN segments within VMware Workstation, and routed between them using a VM running pfSense, which is an open source firewall.
• Setting Up a Pentest/Hacking Lab with Hyper-V
• Setting up a Windows Lab Environment
• Setting Up A Penetration Testing Lab - Rapid7
• Building a Pentest Lab - stan.gr
• Privilege-Escalation
  • Collection of VMs aimed at teaching different privilege escalation techniques with Vulnhub machines used for examples.
• Emulating ARM Router Firmware - Azeria

• Automating a RedELK Deployment Using Ansible - Jason Lang(2020)

• Slides
• The DumpsterFire Toolset is a modular, menu-driven, cross-platform tool for building repeatable, time-delayed, distributed security events. Easily create custom event chains for Blue Team drills and sensor / alert mapping. Red Teams can create decoy incidents, distractions, and lures to support and scale their operations. Turn paper tabletop exercises into controlled "live fire" range events. Build event sequences ("narratives") to simulate realistic scenarios and generate corresponding network and filesystem artifacts.

• This repo provides an easy way to deploy a clean and customized pentesting environment with Kali linux using vagrant and virtualbox.

• "The Capsulecorp Pentest is a small virtual network managed by vagrant and ansible. It contains five virtual machines, including one Linux attacking system running xubuntu and 4 Windows 2019 servers configured with various vulnerable services. This project can be used to learn network penetration testing as a stand-alone environment but is ultimatly designed to compliment my book The Art of Network Penetration Testing"

• sadcloud is a tool for spinning up insecure AWS infrastructure with Terraform. It supports approx. 84 misconfigurations across 22 AWS Services. The inital set of misconfigurations were drawn from ScoutSuite, NCCGroup's Multi-cloud auditing tool. sadcloud was created to easily allow security researchers to misconfigure AWS for training purposes, or to use to asses AWS security tools - including built-ins and third-party.

• Offensive ELK is a custom Elasticsearch setup, aiming to show how traditional “defensive” tools can be effectively used for offensive security data analysis, helping your team collaborate and triage scan results. In particular, Elasticsearch offers the chance to aggregate a multitude of disparate data sources, query them with a unified interface, with the aim of extracting actionable knowledge from a huge amount of unclassified data.
• Blogpost

• Red Team's SIEM - tool for Red Teams used for tracking and alarming about Blue Team activities as well as better usability for the Red Team in long term operations.

• Official Documentation
  • Getting Started with AWS Managed Microsoft AD - docs.aws
  • Active Directory Domain Services on the AWS Cloud: Quick Start Reference Deployment
• Un-Official
  • Building A Lab on AWS - 0x1 SethSec
  • Pentesting In The Cloud - primalsecurity
  • Designing The Adversary Simulation Lab - Adam Chester(2020)

• Building a security lab in Azure - blogs.technet

• DIY Single Sign-On for SSH - Carl Tashian(2020)
  • TL;DR In this post we're going to set up Google single sign-on for SSH. Behind the scenes, we'll use OpenID Connect (OIDC), short-lived SSH certificates, a couple of clever SSH configuration tweaks, and Smallstep's open-source step-ca and step packages. We will set up an SSH Certificate Authority, and use it to bootstrap a new host and a new user in our system. While this approach requires more up-front work than a typical SSH public/private key setup, it comes with a lot of benefits beyond single sign-on. It eliminates the need for gathering and shipping and managing authorized_keys files.

• This webcast is going to demonstrate an integration between our ongoing Windows baseline best practices configuration and improving your endpoint optics. But first, we’re going to summarize some previous webcasts, their content, and the order in which they should be reviewed to tie all of these things together. Then, with all the baseline content and configuration options summarized, we are going to help you put a bow on all that, just in time for the Holidays.

• Have you ever wanted to learn what a virtual smart card is? How to set them up? Are you running gear in your lab with no TPM security chips? This is something unique that I do for my lab environments with Hyper-V. It's very real world as there are high security organizations out there that do use smart cards.This talk will dive into what is minimally involved to set this environment up so you can run your labs in a password less way.

• Building a Windows Defender Application Control Lab - FortyNorthSecurity(2018)

• Installing ELK 7 (Elasticsearch, Logstash and Kibana) – Windows Server 2016 (Part I) - Rob Willis(2019)
• Using the ELK Stack and Python in Penetration Testing Workflow - Adam Vanderbush
• The Complete Guide to the ELK Stack - Daniel Berman(2019)

• Elastic stack (ELK) on Docker
  • Run the latest version of the Elastic stack with Docker and Docker Compose.

• pfELK was created in 2016 after spending hours researching firewall visualization. After stumbling across Elasticstack (formerly known as ELK stack) with weeks of troubleshooting and research. The process was refined and shared to aid others in leveraging the awesome power of Elasticsearch through the visualization of firewall events. pfELK is comprised of Java, Elasticstack, and a number of dependencies. Your firewall logs are parsed through various patterns simplifying firewall log analysis. Currently, pfSense and OPNsense are supported with extensive testing.

• PacketFence is a fully supported, trusted, Free and Open Source network access control (NAC) solution. Boasting an impressive feature set including a captive-portal for registration and remediation, centralized wired, wireless and VPN management, industry-leading BYOD capabilities, 802.1X and RBAC support, integrated network anomaly detection with layer-2 isolation of problematic devices; PacketFence can be used to effectively secure small to very large heterogeneous networks.

• Articles/Blogposts/Writeups
• Talks/Presentations/Videos

• Articles/Blogposts/Writeups
  • Windows 10 is ‘mine’…, Part 1 - Hexacorn
    • Hexacorn walking through setting up a Win10 VM to his standards.
• Talks/Presentations/Videos

• How To Do Endpoint Monitoring on a Shoestring Budget – Webcast Write-Up - Joff Thyer, Derek Banks
• Azure Sentinel To-Go: Sentinel Lab w/ Prerecorded Data 😈 & a Custom Logs Pipe via ARM Templates 🚀 - Cyb3rWard0g
• Building a SIEM: centralized logging of all Linux commands with ELK + auditd - Security Shenanigans(2020)
• How To Deploy Windows Optics: Commands, Downloads, Instructions, and Screenshots - Jordan Drysdale & Kent Ickler(2020)
• How To: Applied Purple Teaming Lab Build on Azure with Terraform (Windows DC, Member, and HELK!) - Jordan Drysdale & Kent Ickler(2020)

• Build your own threat hunting based on open-source tools - Teymur Kheirkhabarov(PHDays2018)
• Building a Home Network Configured to Collect Artifacts for Supporting Network Forensic Incident Response

• Lab-Creation/Generation
  • DetectionLab
    • [...]to allow the user to quickly build a Windows domain that comes pre-loaded with security tooling and some best practices when it comes to system logging configurations. It can easily be modified to fit most needs or expanded to include additional hosts.
  • ELK Detection Lab
    • An ELK environment loaded with the following datasets: Mordor from Roberto Rodriguez @Cyb3rWard0g and Jose Luis Rodriguez @Cyb3rPandaH; EVTX-ATTACK-SAMPLES from Samir Bousseaden SBousseaden; malware-traffic-analysis.net PCAPs from @malware_traffic processed with Suricata.
  • HELK
    • The Hunting ELK or simply the HELK is one of the first open source hunt platforms with advanced analytics capabilities such as SQL declarative language, graphing, structured streaming, and even machine learning via Jupyter notebooks and Apache Spark over an ELK stack. This project was developed primarily for research, but due to its flexible design and core components, it can be deployed in larger environments with the right configurations and scalable infrastructure.
  • SweetSecurity
    • Scripts to setup and install Bro IDS, Elastic Search, Logstash, Kibana, and Critical Stack on a Raspberry Pi 3 device
  • Response Operation Collections Kit Reference Build
  • RedELK
    • Red Team's SIEM - tool for Red Teams used for tracking and alarming about Blue Team activities as well as better usability for the Red Team in long term operations.
  • Defensive Origins - Lab Build Scripts
    • This repo contains build scripts for Defensive Origin's various lab environments.
• Datasets/Generation
  • Mordor
    • The Mordor project provides pre-recorded security events generated by simulated adversarial techniques in the form of JavaScript Object Notation (JSON) files for easy consumption. The pre-recorded data is categorized by platforms, adversary groups, tactics and techniques defined by the Mitre ATT&CK Framework. The pre-recorded data represents not only specific known malicious events but additional context/events that occur around it. This is done on purpose so that you can test creative correlations across diverse data sources, enhancing your detection strategy and potentially reducing the number of false positives in your own environment.
• Linux
  • auditd - Neo23x0
    • Best Practice Auditd Configuration

• Microsoft-Blue-Forest
  • A Blue Forest is centered around Blue Team operational security in domain networks. This repository serves as a living documentation on securing Windows domain networks running modern Microsoft operating systems.

• Gathering Windows, PowerShell and Sysmon Events with Winlogbeat – ELK 7 – Windows Server 2016 (Part II)
• [PowerShell Script To Reset The KrbTgt Account Password/Keys For Both RWDCs And RODCs - Jorge]https://jorgequestforknowledge.wordpress.com/2020/04/06/powershell-script-to-reset-the-krbtgt-account-password-keys-for-both-rwdcs-and-rodcs-update-5/)

• This project allows you to easily spin up Active Directory labs in Azure with domain-joined workstations, Windows Event Forwarding, Kibana, and Sysmon using Terraform/Ansible.

• Cloud Templates and scripts to deploy mordor environments. An initiative from the Open Threat Research (OTR) community to share cloud templates and scripts to deploy network environments to simulate adversaries, generate/collect data and learn more about adversary tradecraft from a defensive perspective. The difference with other environments is that we do not have one scenario to cover all use-cases, but multiple modular environments that adapt to specific topics of research.

• Powershell - web traffic whitenoise generator

• Pi-hole data visualization using Elasticsearch, Logstash and Kibana. elk-hole provides the relevant files and configuration to easily visualize pi-holes/dnsmasq statistics via the popular elasticstack.

• Apache Guacomole
  • Apache Guacamole is a clientless remote desktop gateway. It supports standard protocols like VNC, RDP, and SSH. We call it clientless because no plugins or client software are required. Thanks to HTML5, once Guacamole is installed on a server, all you need to access your desktops is a web browser.
  • Apache Guacamole: How To Install and Configure - FortyNorth Security
• xrdp
  • xrdp provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp accepts connections from a variety of RDP clients: FreeRDP, rdesktop, NeutrinoRDP and Microsoft Remote Desktop Client (for Windows, Mac OS, iOS and Android).

• ubuntu.autossh
  • Autossh reverse tunnel to central server.

• Wireguard
  • Wireguard - Wikipedia
    • WireGuard is a free and open-source software application and communication protocol that implements virtual private network (VPN) techniques to create secure point-to-point connections in routed or bridged configurations. It is run as a module inside the Linux kernel, and aims for better performance and more power saving than the IPsec and OpenVPN tunneling protocols. It was written by Jason A. Donenfeld and is published under the GNU General Public License (GPL) version 2.
  • wg-access-server
    • wg-access-server is a single binary that provides a WireGuard VPN server and device management web ui. We support user authentication, 1 click device registration that works with Mac, Linux, Windows, Ios and Android including QR codes. You can configure different network isolation modes for better control and more. This project aims to deliver a simple VPN solution for developers, homelab enthusiasts and anyone else feeling adventurous.

• Articles/Blogposts/Writeups
  • Docker Your Command & Control (C2) - obscuritylabs
  • Create a Reusable Burner OS with Docker, Part 1: Making an Ubuntu Hacking Container - EvilToddler
    • Part 2
• Tools
  • linuxkit
    • A toolkit for building secure, portable and lean operating systems for containers
  • Bad Dockerfile
    • A Dockerfile that creates an image with known vulnerabilities.
    • Blogpost

• Instances
  • Simulator
    • A distributed systems and infrastructure simulator for attacking and debugging Kubernetes: simulator creates a kuberntes cluster for you in your AWS account; runs scenarios which misconfigure it and/or leave it vulnerable to compromise and trains you in mitigating against these vulnerabilities.
  • k3s
    • Lightweight Kubernetes. Easy to install, half the memory, all in a binary less than 40mb.
  • k3d
    • Little helper to run Rancher Lab's k3s in Docker
  • kube_security_lab
    • The goal of this project is to make use of Docker and specifically kind to create a lab environment for testing Kubernetes exploits and security tools entirely locally on a single machine without any requirement for remote resources or Virtual Machines being spun up.
  • kind
    • kind is a tool for running local Kubernetes clusters using Docker container “nodes”. kind was primarily designed for testing Kubernetes itself, but may be used for local development or CI.
• Vulnerable
  • Bust-a-Kube
  • Kubernetes Goat
    • The Kubernetes Goat designed to be intentionally vulnerable cluster environment to learn and practice Kubernetes security.

• Callback Catcher is a multi-socket control tool designed to aid in pentest activities. It has a simple web application with an backend API that allows the user control what TCP and UDP sockets should be opened on the server. It records any and all data send to the exposed sockets and logs it to a database which can be easily accessed via it's backend API. Itís kind of intended to be like the love child of Burp Collaborator and Responder. Alternatively think of it like a low/medium interactive honeypot. Its been coded on top of the Django REST framework, which offers a number of benefits , primarily being able to create your own client scripts and tools and quickly searching and filtering of data. Opening of sockets is built on top of Python's ServerSocket library. Upon spinning up a socket a user is given the option to assign a handler to the socket, which is affectively user defined code that overwrites the handler function within the SocketServer.TCPServer and SocketServer.UDPServer classes. This code tells the socket how to handle the incoming data and what to respond with. Each connection to the socket is recorded to a database.

• Papercut
  • Simple Desktop SMTP Server

• MicroMDM
  • MicroMDM is a project which provides an open source Mobile Device Management server for Apple devices. Our goal is to create a performant and extensible device management solution for enterprise and education.

• See AppSec/Programming Stuff

• Offensive Development: How To DevOps Your Red Team - Dominic Chell(BSidesMCR2019)
• OffSecOps – Will Schroeder (SO-CON 2020)
  • As the offensive industry continues to mature in reaction to the progression of its defensive counterpart, offensive teams have increasingly integrated DevOps practices to mature their operations. In this talk, we'll describe our approach to building an offensive continuous integration (CI) pipeline, including our architecture and lessons learned. We'll show how tracking of (unique) artifacts per engagement, proactive scanning for artifacts submitted by defenders to cloud analysis platforms, integrated obfuscation, OPSEC scanning of artifacts, and seamless integration of the build process into existing C2 frameworks (like Cobalt Strike) can all be accomplished with free installations of Jenkins and Artifactory on your own (non-cloud) hardware. Come learn how to up your artifact game!
• Offensive Development: Post Exploitation Tradecraft in an EDR World - Dominic Chell(x33fCon2020)
  • You spend days or even weeks perfecting the perfect phish; your campaign has a targeted pre-text, a slick initial access payload and it slips through perimeter defences right in to your target's inbox. Moments later, your C2 pings and your beacon is awake - you're in, it's time to explore! You start by probing the endpoint, checking your privileges and getting your bearings in the network. Suddenly, silence... your beacon has stopped responding, your infrastructure is burned and you have to start over. Command line logging, PowerShell logging, sysmon, EDR, EDP, app whitelisting, AMSI, the blue team has it all and you're playing on their turf. Unless your post-exploitation game is at it's peak, you shall not pass. During this talk we will explore post-exploitation tradecraft, reviewing the opsec pitfalls that commonly lead to detection in mature environments as well as how to significantly reduce the indicators of compromise. It will demonstrate how DevOps principles can be applied to red teaming, focusing on the implementation of a custom CI/CD pipeline to automatically consume, build and deploy existing and custom tooling to an environment in a manner agnostic to any command and control framework. This approach also provides the operator with the capability to programmatically and automatically protect their tools from DFIR, safeguarding intellectual property and operational infrastructure when an artifact is dropped to disk. The future of red teaming is offensive development.

• Aritcles/Blogposts/Writeups
  • AMSI as a Service — Automating AV Evasion - James
• Tools
  • AMSI_Handler
    • Automate AV evasion by calling AMSI

• 101
  • Azure Pipelines
  • What is Azure Pipelines? - docs.ms
  • Azure Pipelines documentation - docs.ms
• Aritcles/Blogposts/Writeups
  • Using Azure Pipelines to validate my Sysmon configuration - Olaf Harton(2020)
  • Testing your RedTeam Infrastructure - Adam Chester(2020)
    • In this post I'm going to start with a quick review of how RedTeam infrastructure is defined in code which would typically live in a Git repo somewhere. More importantly however, we will continue this by looking at ways in which our environments can be tested as they evolve and increase in complexity, finishing with a walkthrough of how we can introduce a CI pipeline into the mix to help automate this testing.

• 101
  • Github Actions Documentation
• Aritcles/Blogposts/Writeups
  • An Introduction to Github Actions - Gabriel Tanner(2019)
  • Building Tooling With GitHub Actions - James(2019)
  • Offensive Development with GitHub Actions - James Williams(2020)

• 101
  • Jenkins
    • open source automation server
  • Getting started with the Guided Tour - jenkins.io
  • What Is Jenkins? How & Why To Use It? - Himanshu Sheth(2020)
• Aritcles/Blogposts/Writeups
  • Learn How to Set Up a CI/CD Pipeline From Scratch - Samarpit Tuli(2018)
  • CI/CD Pipeline using Jenkins and Gogs - Vishnu(2020)
  • Jenkins - More than Just Target Practice - FortyNorth Security
  • Jenkins Multibranch Pipeline Tutorial For Beginners - Bibin Wilson(2020)
  • Jenkins Automated Build Trigger On Github Pull Request - devopscube(2020)
• Talks/Presentations/Videos
  • OffSecOps – Will Schroeder (SO-CON 2020)
    • As the offensive industry continues to mature in reaction to the progression of its defensive counterpart, offensive teams have increasingly integrated DevOps practices to mature their operations. In this talk, we'll describe our approach to building an offensive continuous integration (CI) pipeline, including our architecture and lessons learned. We'll show how tracking of (unique) artifacts per engagement, proactive scanning for artifacts submitted by defenders to cloud analysis platforms, integrated obfuscation, OPSEC scanning of artifacts, and seamless integration of the build process into existing C2 frameworks (like Cobalt Strike) can all be accomplished with free installations of Jenkins and Artifactory on your own (non-cloud) hardware. Come learn how to up your artifact game!

• Leveraging DevSecOps Practices to Secure Red Team Infrastructure - Jesse Somerville(2020)

• "Why you should stop managing infrastructure and start really programming it."

• The following article highlights both high and mid level concepts toward creating a simple release pipeline for PowerShell modules. The major focus will cover file structure, test practices, task runners, and portability between CI/CD systems. Additional topics include generated reports, design patterns for code consistency, and a Jenkins CI implementation. The supplementary project: Xainey/PSHitchhiker is available on Github to analyze alongside the project.

• Articles/Blogposts
  • AWX
    • AWX provides a web-based user interface, REST API, and task engine built on top of Ansible. It is the upstream project for Tower, a commercial derivative of AWX.

• An Intro to Terraform with Azure, PFSense, and Windows 10 - FortyNorth Security
• Modern C2 Infrastructure with Terraform, DigitalOcean, Covenant and Cloudflare - Riccardo
• Infrastructure as Code: Setting up a web application penetration testing laboratory - avasdream
• Automating Red Team Infrastructure with Terraform - @spottheplanet
• Infrastructure as Code: Setting up a web application penetration testing laboratory - avasdream(2020)

• 101
  • Vagrant Documentation - vagrantup.com
• Articles/Blogposts
  • Automating Red Team Homelabs: Part 1 – Kali Automation - Alex Rodriguez
  • Automating Red Team Homelabs: Part 2 – Build, Pentest, Destroy, and Repeat - Alex Rodriguez

• Modern Windows Attacks and Defense Lab
  • This is the lab configuration for the Modern Windows Attacks and Defense class that Sean Metcalf (@pyrotek3) and I(Jared Haight) teach.
• Self-Installing Windows OVA
  • This is an Virtual Machine in OVA format that will install Windows ontop of itself. I wrote this as an alternative to packer. This OVA basically downloads the evaluation version of the Windows version you select to one drive as installation media and then installs onto the primary drive. After this is done, the smaller secondary drive can be discarded to save disk space.

• axiom
  • Project Axiom is a set of utilities for managing a small dynamic infrastructure setup for bug bounty and pentesting.

• fpm
  • Effing package management! Build packages for multiple platforms (deb, rpm, etc) with great ease and sanity.

• A python tool which aims to help in the behavioral (network) analysis of malware. Imaginary C2 hosts a HTTP server which captures HTTP requests towards selectively chosen domains/IPs. Additionally, the tool aims to make it easy to replay captured Command-and-Control responses/served payloads.

• An open source Android application that is intentionally vulnerable so as to act as a learning platform for Android application security beginners. The effort is to introduce beginners with very limited or zero knowledge to some of the major and commonly found real-world based Android application vulnerabilities in a story-based, interactive model. EVABS follows a level-wise difficulty approach and in each level, the player learns a new concept. This project is still under progress and aims at incorporating as many levels as possible.