Cybersecurity Cheatsheets

• CTFs & Vulnerable Targets: Curated catalog of free + freemium platforms and downloadable targets.
• Certification Roadmap: Practical guide to certifications mapped to AYSEC tracks (2026).
• SQL Injection: Detection + exploitation payloads for MySQL, PostgreSQL, MSSQL, Oracle & SQLite
• Free Platforms Mapping: The 100% free / meaningful-free-tier platforms AYSEC recommends.
• Glossary: Quick definitions for terms used across the AYSEC tracks.
• Nmap: Host discovery, port scanning, service detection, NSE scripts & firewall evasion
• HackTheBox → AYSEC Mapping: HTB Academy modules + retired machines mapped to AYSEC tracks.
• Lab Setup Guide: A single comprehensive lab build supporting every AYSEC track.
• Reverse Shell: One-liners for bash, python, nc, php, PowerShell & msfvenom + TTY upgrade
• Per-Module Lab Manual: Reusable lab manual template + 8 worked examples.
• Tools Reference: Categorized list of every tool used in AYSEC, with module references.
• XSS (Cross-Site Scripting): Payloads, context breakouts, DOM sinks & WAF/filter bypass
• 50 Original Hands-On Labs: Original AYSEC-house-style labs you can host locally.
• Linux Privilege Escalation: SUID, sudo, cron, capabilities, PATH & kernel, the full root checklist
• PortSwigger → AYSEC Mapping: The free PortSwigger Web Security Academy mapped to AppSec modules.
• Windows Privilege Escalation: Token abuse, service misconfigs, AlwaysInstallElevated & credential hunting
• Command Injection: Separators, blind/out-of-band techniques & filter bypass
• TryHackMe → AYSEC Mapping: Complete free + paid TryHackMe rooms and paths mapped to AYSEC.
• Password Cracking: Hashcat & John modes, hash identification, rules, masks & *2john tools
• Udemy & Paid Courses: Recommended paid courses by topic.
• Burp Suite: Proxy, Repeater, Intruder, Decoder & shortcuts for web app testing
• sqlmap: Automated SQL injection detection + exploitation flags and examples
• ffuf: Fast web fuzzing — directories, parameters, vhosts & response filters
• Gobuster: Directory, DNS subdomain & vhost brute-forcing
• WPScan: WordPress enumeration — users, plugins, themes & known vulns
• Nikto: Web server vulnerability & misconfiguration scanner
• Metasploit Framework: msfconsole workflow — search, use, set, exploit, sessions & meterpreter
• msfvenom: Generate reverse shells & payloads for every platform and format
• Hydra: Online password brute-forcing for SSH, FTP, HTTP, RDP & more
• Netcat: The TCP/IP swiss-army knife — listeners, shells, transfers & scans
• searchsploit: Search & use Exploit-DB offline from the terminal
• Impacket: AD attack scripts — secretsdump, psexec, GetUserSPNs, ntlmrelayx
• NetExec / CrackMapExec: Sweep SMB/WinRM/LDAP/MSSQL — creds, shares, dumps & modules
• BloodHound: Map Active Directory attack paths — SharpHound collection & Cypher
• Mimikatz: Dump credentials, pass-the-hash, golden tickets & DCSync
• Evil-WinRM: WinRM shell — login by password/hash, upload, download & load tools
• enum4linux & smbclient: SMB/Samba enumeration — shares, users, groups & null sessions
• Wireshark Display Filters: The display filters you actually use — ip, tcp, http, dns, tls & follow stream
• tcpdump: Capture & filter packets from the CLI — hosts, ports, flags & pcaps
• Volatility: Memory forensics — process, network, injection & credential plugins
• GDB + pwndbg: Debug & exploit binaries — breakpoints, memory exam, checksec & cyclic
• Ghidra: Reverse engineering — decompiler, XREFs, shortcuts & headless analysis
• Aircrack-ng: Wi-Fi auditing — monitor mode, handshake capture & WPA cracking