Skip to content

Ravi Sir's Cyber Security Cards

337 revision cards, 33 comparison cards and 168 interview cards for the Cyber Security course. Download or share any card.

Jump to: Revision cards · Comparison cards · Interview cards · Also see the Cyber Security Interview Cards.

Revision cards (337)

What Is an IP Address? An IP address (Internet Protocol address) is a number that identifies a device on a network. It works like a home address for computers. IPv4 : 32 bits, like 192.168.1.10 . Still the most common. IPv6 : 128 bits, like 2001:db8::10 . Much bigger address space. Every data packet — What Is an IP Address? · Download PNG · Open card page

IPv4 Structure: Bits, Octets and the Subnet Mask An IPv4 address has 32 bits , written as 4 numbers called octets . Each octet is 8 bits, from 0 to 255 . Example: 192.168.1.10. 32 bits give about 4.3 billion addresses. That is too few today. This is why we use NAT, private IPs and IPv6. A subnet mas — IPv4 Structure: Bits, Octets and the Subnet Mask · Download PNG · Open card page

IPv4 Classes (A to E) and Loopback Old IPv4 addresses were split into classes A to E by the first number. Classes are history now, but you still see the ranges. 127.0.0.1 is loopback : a computer talking to itself. A service on 127.0.0.1 cannot be reached from outside. 127.0.0.1 in a web log can mea — IPv4 Classes (A to E) and Loopback · Download PNG · Open card page

CIDR notation: what /24 means An IP address has 32 bits. In 10.0.1.0/24 , the /24 says the first 24 bits are the network part. The rest are for hosts (devices). AWS keeps 5 IPs in every subnet: the first 4 and the last one. So a /24 subnet: 256 − 5 = 251 usable IPs /32 = only one IP, like 198.51.100 — CIDR notation: what /24 means · Download PNG · Open card page

Subnetting Basics (Worked Example) Subnetting means splitting one network into smaller networks (subnets). Network: 192.168.10.0/24 . Need 4 equal subnets for 4 labs. 4 subnets need 2 more bits (2² = 4). New size: /24 + 2 = /26 . Each /26 has 64 addresses: .0, .64, .128, .192. Put web servers in a p — Subnetting Basics (Worked Example) · Download PNG · Open card page

NAT (Network Address Translation) Private IPs (like 192.168.x.x) cannot go on the internet. NAT lets many devices share one public IP . The router changes the sender address from private to public. The router keeps a NAT table . It remembers which inside device asked. Reply to 198.51.100.7:61001 → g — NAT (Network Address Translation) · Download PNG · Open card page

SSH (Secure Shell) – Port 22 SSH (Secure Shell) lets you log in to a server and type commands over an encrypted connection. It uses port 22 . SSH on the internet gets password-guessing attacks ( brute force ) all day. A leaked SSH private key is as bad as a leaked password. You see “REMOTE HOST IDEN — SSH (Secure Shell) – Port 22 · Download PNG · Open card page

HTTP – Port 80 HTTP is how a browser asks a web server for a page. The browser sends a request ; the server sends a response . It uses port 80 . Plain HTTP is not encrypted . Anyone on the same Wi-Fi can read passwords and cookies. If a session cookie is stolen, the attacker is logged in as you. 401 — HTTP – Port 80 · Download PNG · Open card page

HTTPS and TLS Basics – Port 443 HTTPS is HTTP with TLS encryption. It uses port 443 . TLS (Transport Layer Security) scrambles data so others on the network cannot read it. HTTPS protects data while it travels . It does not fix bugs in the website. A site with a padlock can still have SQL injection. — HTTPS and TLS Basics – Port 443 · Download PNG · Open card page

FTP and SFTP FTP (File Transfer Protocol) moves files, port 21. It is not encrypted . SFTP moves files over SSH (port 22). It is encrypted. In a packet capture tool like Wireshark , you can see an FTP password in plain text. Use SFTP or SCP instead of FTP on real systems. Installing an FTP server ju — FTP and SFTP · Download PNG · Open card page

The Seven OSI Layers The OSI model splits network communication into 7 layers . Memory trick (7 → 1): All People Seem To Need Data Processing . 7 Application, 6 Presentation, 5 Session, 4 Transport, 3 Network, 2 Data Link, 1 Physical. Layer 7: HTTP that the browser speaks. Layer 6: encoding and encr — The Seven OSI Layers · Download PNG · Open card page

Encapsulation and Decapsulation Encapsulation : each layer adds its own header as data goes down to the wire, like putting a letter in envelopes. Decapsulation : the receiver removes the headers one by one. Layer 4 = segment (TCP) or datagram (UDP). Layer 3 = packet . Layer 2 = frame . Attackers can — Encapsulation and Decapsulation · Download PNG · Open card page

The TCP/IP Model and OSI Comparison The TCP/IP model is the real internet model, with 4 layers. The OSI model has 7 layers and is mostly for teaching. Application = OSI 5–7. Transport = 4. Internet = 3. Network Access = 1–2. AWS security groups filter IP and port (layers 3–4). They cannot see SQL in — The TCP/IP Model and OSI Comparison · Download PNG · Open card page

What Is EC2? Key Concepts EC2 (Elastic Compute Cloud) gives you virtual servers on AWS. Each server is an instance . AMI : the starting image (operating system). Key pair : the SSH key to log in. Security group : the firewall for the instance. Most EC2 breaches are on the customer side: an open port — What Is EC2? Key Concepts · Download PNG · Open card page

Choosing an Instance Type An instance type decides how much CPU and memory an EC2 server gets. Example: t3.micro = family t (general, burstable), generation 3, size micro. t4g.small : the “g” means Graviton (ARM chip). c7i = compute-heavy. r7i = memory-heavy. Choosing a Graviton type (t4g) with an x — Choosing an Instance Type · Download PNG · Open card page

Launching an Instance Step by Step Launching an instance means creating a new EC2 server from the AWS console. Open EC2 → Launch instance . Give it a name (example: web-server-1), pick an AMI and type, a key pair and a security group. The security group is your first firewall. Allow SSH only from My — Launching an Instance Step by Step · Download PNG · Open card page

SSH from Windows: PowerShell, PuTTY and MobaXterm From Windows, you can SSH to a server with PowerShell , PuTTY or MobaXterm . PuTTY needs a .ppk key. Open PuTTYgen → Load your .pem → Save private key as .ppk. In PuTTY, set Host Name (ec2-user@IP), port 22, and pick the .ppk under SSH → Auth. AWS Se — SSH from Windows: PowerShell, PuTTY and MobaXterm · Download PNG · Open card page

First Commands After Login and Instance Metadata After logging in, check who and where you are: whoami , hostname , uptime . Instance metadata is info AWS gives the server at 169.254.169.254 . Metadata can give out temporary IAM role keys . In an SSRF attack, a buggy web app is tricked into fetching — First Commands After Login and Instance Metadata · Download PNG · Open card page

Instance Lifecycle: Stop, Reboot, Terminate An EC2 server can be stopped (paused), rebooted (restarted) or terminated (deleted for good). After a stop and start, the normal public IP changes . For a fixed IP, use an Elastic IP . Forgotten servers cost money and are not updated or watched. Easy targe — Instance Lifecycle: Stop, Reboot, Terminate · Download PNG · Open card page

The Linux File-System Hierarchy Linux keeps all files in one tree that starts at / (the root folder). /etc : settings files. /var/log : logs. /home : user folders. /root : the root user’s home folder. In an incident, defenders check the same folders for evidence. Knowing the map is half the job. Mix — The Linux File-System Hierarchy · Download PNG · Open card page

Navigation Navigation means moving around folders in the Linux terminal. pwd : show where you are. ls : list files. cd /var/log : go to a folder. cd - : go back. cd : go home. Typing every name in full and making typos (“No such file or directory”). Press Tab . It completes the name. If it doesn’t, — Navigation · Download PNG · Open card page

Working with Files and Directories Basic commands to create, copy, move and delete files and folders in Linux. mkdir : make a folder. cp : copy. mv : move or rename. rm : delete. Running rm -rf without checking the path. A server has no Recycle Bin . Run ls on the same path first. mkdir -p ~/labs/si — Working with Files and Directories · Download PNG · Open card page

Viewing Files and Following Logs Commands to read files: cat (whole file), less (page by page), tail (last lines). tail -f shows new log lines live as they arrive. sudo tail -f /var/log/auth.log (Ubuntu) shows login attacks live, just as a SOC analyst sees them. On Amazon Linux 2023: sudo journalctl — Viewing Files and Following Logs · Download PNG · Open card page

Permissions: r, w, x, chmod and chown Each file has an owner (u), a group (g) and others (o). Each can have read (r) , write (w) and execute (x) permission. chmod changes permissions. chown changes the owner. Example: chmod 640 file = owner read/write, group read, others nothing. A SUID-root program — Permissions: r, w, x, chmod and chown · Download PNG · Open card page

Users, Groups and sudo Linux stores accounts in /etc/passwd , hashed passwords in /etc/shadow and groups in /etc/group . sudo lets a user run a command as root. sudo -l is one of the first commands an attacker runs. A rule like “NOPASSWD: /usr/bin/vim” gives root in seconds. Check sudo rules often. — Users, Groups and sudo · Download PNG · Open card page

Package Management: yum and apt A package manager installs and updates software. apt on Ubuntu/Debian. yum (or dnf) on Amazon Linux. Ubuntu: sudo apt install git . Amazon Linux: sudo yum install git . Install only from official repositories . Random .deb/.rpm files or “curl | bash” scripts can carry — Package Management: yum and apt · Download PNG · Open card page

Processes A process is a running program. Each has a PID (process ID number). ps -ef : list processes. top : live view. kill PID : stop one. Crypto-miners and reverse shells show up as strange processes: high CPU, odd names, running from /tmp . ps -ef --forest and lsof -i help find them. Using kill — Processes · Download PNG · Open card page

Getting Help and Editing Files (nano, vim) nano and vim are text editors in the terminal. man shows help for a command. Ctrl+O then Enter = save. Ctrl+X = exit. Ctrl+W = search. vim has modes. Press i to type. Press Esc to stop typing. :wq = save and quit. :q! = quit without saving. Closing the term — Getting Help and Editing Files (nano, vim) · Download PNG · Open card page

Searching Text: grep grep finds lines that contain some text in a file. -i : ignore upper/lower case. -r : search inside folders. -n : show line numbers. -v : show lines that do NOT match. grep "Failed password" on the auth log shows SSH brute force. Searching web logs for “union|select|<script” fin — Searching Text: grep · Download PNG · Open card page

Remote Access: ssh, scp, rsync and Environment Variables ssh : log in to a server. scp : copy a file to or from it. rsync : copy only the changes. Environment variables are named settings a program can read. .env files often hold database passwords and API keys. If the web server shows .env, or it i — Remote Access: ssh, scp, rsync and Environment Variables · Download PNG · Open card page

Basic Shell Scripting A shell script is a text file of Linux commands that run one after another. Write NAME="Raja" with no spaces around =. Use it as "$NAME" , inside double quotes. A script that counts today’s failed SSH logins and shows the top 3 attacker IPs, using grep, awk, sort and uniq -c. N — Basic Shell Scripting · Download PNG · Open card page

Finding Files: find find searches for files by name, size, owner or time changed. find /etc -name "*.conf" -mtime -7 = .conf files changed in the last 7 days. Attackers use find to look for SUID files and keys. Defenders use -mmin / -mtime to find web shells changed around the attack time. Running f — Finding Files: find · Download PNG · Open card page

Text Processing: awk and sed awk splits each line into columns: $1, $2 and so on. sed finds and replaces text. Both are Linux text tools. awk '{print $1}' access.log | sort | uniq -c | sort -nr | head This lists the IPs that sent the most requests to a web server. In a brute-force or scan, the attac — Text Processing: awk and sed · Download PNG · Open card page

Pipes, Redirection and Here-Documents A pipe ( | ) sends one command’s output into the next command. Redirection sends output into a file. > = write to a file and overwrite it. >> = add to the end of a file. | = pass output on, e.g. ps -ef | grep nginx . Using > instead of >> empties an important fi — Pipes, Redirection and Here-Documents · Download PNG · Open card page

Archives and Compression: tar, gzip, zip tar packs many files into one archive. gzip and zip make files smaller. Pack: tar czf site.tar.gz /var/www/html Unpack: tar xzf site.tar.gz Never leave backups like site.tar.gz or backup.zip inside the web folder. Folder-guessing tools like Gobuster look for — Archives and Compression: tar, gzip, zip · Download PNG · Open card page

Services and Logs: service, systemctl enable, journalctl A service is a program that runs in the background, like nginx or sshd. systemctl enable makes it start at boot. journalctl shows its logs. sudo systemctl status nginx → is it running? sudo journalctl -u nginx -n 50 → last 50 log lines. Logs a — Services and Logs: service, systemctl enable, journalctl · Download PNG · Open card page

Networking Commands Commands to check a server’s network: ip a (addresses), ss -tulnp (listening ports), ping , curl , nc . ss -tulnp is like a scan from the inside. Every listening port is a possible way in. A service on 0.0.0.0 is open to all. On 127.0.0.1 it is local only. “Ping fails, so the ser — Networking Commands · Download PNG · Open card page

Disk and Storage Commands df -h shows free disk space. du -h shows how big folders are. Find big folders: du -h --max-depth=1 | sort -h When the disk is 100% full , MySQL and Nginx give strange errors. People search their code for hours. Always check df -h first. A full disk can stop logs from being — Disk and Storage Commands · Download PNG · Open card page

Scheduling Tasks: cron cron runs commands on a schedule. You set jobs with crontab -e . 30 1 * * * /home/ec2-user/backup.sh = run the backup every night at 1:30 AM . Order: minute, hour, day, month, weekday. In an investigation, check crontab -l for each user, /etc/crontab and /etc/cron.d/ . Attacke — Scheduling Tasks: cron · Download PNG · Open card page

Quick Reference: Packages, Services and Paths A cheat sheet of names and paths that differ between Amazon Linux and Ubuntu. Amazon Linux / CentOS: httpd . Ubuntu: apache2 . Amazon Linux: /usr/share/nginx/html . Ubuntu: /var/www/html . Looking for apache2 on Amazon Linux. Check the OS first, then use — Quick Reference: Packages, Services and Paths · Download PNG · Open card page

Installing Nginx and Apache on Amazon Linux 2023 Installing a web server on Amazon Linux 2023. Nginx: sudo yum install -y nginx . Apache: sudo yum install -y httpd . sudo systemctl enable --now nginx starts it now and at every boot. A new install shows a default test page and the version number. Att — Installing Nginx and Apache on Amazon Linux 2023 · Download PNG · Open card page

Installing Nginx and Apache on Ubuntu Installing a web server on Ubuntu. sudo apt install -y nginx or sudo apt install -y apache2 . Ubuntu has ufw , a simple firewall. Running ufw enable before allowing SSH locks you out of the server. Right order: sudo ufw allow OpenSSH → allow web → sudo ufw enabl — Installing Nginx and Apache on Ubuntu · Download PNG · Open card page

Reading an Nginx Server Block A server block is the Nginx settings for one website. listen 80; = port. server_name = the domain. root = folder of web files. index = first file to show. Forgetting a semicolon (;) at the end of a line. sudo nginx -t shows the line number. The mistake is often on the l — Reading an Nginx Server Block · Download PNG · Open card page

Reading an Apache Virtual Host A virtual host is the Apache settings for one website. Key lines: ServerName , DocumentRoot (the web folder). Options -Indexes stops Apache from listing a folder’s files. Without it, backups and configs can be seen. AllowOverride All lets .htaccess files change securit — Reading an Apache Virtual Host · Download PNG · Open card page

Everyday Management Commands and SELinux Basics Daily commands to test, reload and restart a web server. SELinux is a Linux security layer that limits what each program can touch. reload re-reads the config without dropping visitors. restart stops and starts. Safe habit: sudo nginx -t && sudo system — Everyday Management Commands and SELinux Basics · Download PNG · Open card page

Create the Sample Website and Upload Files Putting your website files on the server. Ways: scp from your laptop, git clone on the server, or SFTP apps like WinSCP and FileZilla (port 22, your key). Folders 755 , files 644 . The web server can read them but not change them. If the web server could wr — Create the Sample Website and Upload Files · Download PNG · Open card page

Amazon Linux 2023 + Nginx Hosting a website with Nginx on Amazon Linux 2023. Put files in a folder, add a server block in /etc/nginx/conf.d/mysite.conf , test and reload. Open http://your-public-IP in the browser. The Nginx welcome page still shows. Another server block won. Check server_name (your — Amazon Linux 2023 + Nginx · Download PNG · Open card page

Amazon Linux 2023 + Apache Hosting a website with Apache (httpd) on Amazon Linux 2023. Apache won’t start because Nginx is already on port 80. Only one program can use a port. Check with sudo ss -tlnp | grep :80 . Make an empty folder and open it in the browser. With Options -Indexes , you should ge — Amazon Linux 2023 + Apache · Download PNG · Open card page

Ubuntu + Nginx Hosting a website with Nginx on Ubuntu. Config goes in /etc/nginx/sites-available/ . Turn the site on with a symlink (shortcut) in /etc/nginx/sites-enabled/ . Forgetting the symlink, so the site doesn’t work. Check with ls -l /etc/nginx/sites-enabled/ . — Ubuntu + Nginx · Download PNG · Open card page

Ubuntu + Apache Hosting a website with Apache on Ubuntu. Turn a site on with a2ensite , off with a2dissite . The Ubuntu default page keeps showing. Run sudo a2dissite 000-default.conf , then config test and reload. List enabled sites: ls /etc/apache2/sites-enabled . — Ubuntu + Apache · Download PNG · Open card page

Changing the Document Root The document root is the folder where the web server finds your website files. Example: move it from /var/www/html to /var/www/portfolio . Change root (Nginx) or DocumentRoot (Apache), test the config, reload. Ask 3 questions: 1. Is every folder on the path 755 and the fil — Changing the Document Root · Download PNG · Open card page

Changing the Port Making the website listen on another port, like 8081 , instead of 80. Change listen in the config, test and reload. Check: sudo ss -tlnp | grep 8081 . Add a security group rule for 8081, from My IP for admin pages. On Amazon Linux, SELinux blocks new ports. You see “Permission deni — Changing the Port · Download PNG · Open card page

Changing the Index Page The index page is the first file shown when someone opens a folder, like index.html. The server uses the first file it finds from the list. If no index file exists and listing is ON, the server shows every file in the folder. Keep autoindex off (Nginx) and Options -Indexes (A — Changing the Index Page · Download PNG · Open card page

Basic Hardening of a Static Web Server Hardening means small changes that make a server harder to attack. Hide the version: server_tokens off; (Nginx). Turn off folder listing. Add security headers, like X-Frame-Options . Scanners like Nikto spot these weak points at once. On Ubuntu Apache, turn on — Basic Hardening of a Static Web Server · Download PNG · Open card page

Installing PHP on Amazon Linux 2023 and Ubuntu PHP runs code on the server to build pages. PHP-FPM is the PHP service that the web server hands work to. Amazon Linux: sudo yum install -y php php-fpm . Ubuntu: sudo apt install -y php-fpm . Installing PHP but not starting php-fpm. Nginx shows 502 Bad — Installing PHP on Amazon Linux 2023 and Ubuntu · Download PNG · Open card page

LAMP on Amazon Linux 2023 LAMP = Linux + Apache + MySQL/MariaDB + PHP. It is a common way to run dynamic websites. Run mysql_secure_installation once. Answer Y to: remove anonymous users, block remote root login, remove the test database, reload privileges. Skipping that step. Anonymous users and th — LAMP on Amazon Linux 2023 · Download PNG · Open card page

LAMP on Ubuntu LAMP on Ubuntu = Linux + Apache + MySQL + PHP. Install with apt : apache2, mysql-server, php, libapache2-mod-php. On Ubuntu, MySQL root logs in with sudo mysql , not a password. Running random internet commands to set a root password. Not needed. Use sudo mysql, then make a separate u — LAMP on Ubuntu · Download PNG · Open card page

LEMP on Amazon Linux 2023 LEMP = Linux + Nginx (“Engine-X”) + MySQL/MariaDB + PHP. Nginx sends PHP work to PHP-FPM . Add try_files $uri =404; in the PHP block. An old mistake let attackers run an uploaded image as PHP, like /uploads/cat.jpg/x.php . This line stops it. Leaving info.php (phpinfo) on t — LEMP on Amazon Linux 2023 · Download PNG · Open card page

LEMP on Ubuntu LEMP on Ubuntu = Linux + Nginx + MySQL + PHP-FPM. Nginx talks to PHP through a socket file in /run/php/. The socket name has the PHP version, like php8.3-fpm.sock . An old name copied from the internet gives 502 Bad Gateway . Check the real name with ls /run/php/ and put that exact na — LEMP on Ubuntu · Download PNG · Open card page

A PHP + MySQL Application with Prepared Statements A small PHP app that saves and shows data from MySQL, written safely. $pdo->prepare("... VALUES (?, ?)") keeps user input apart from the SQL. This stops SQL injection (attackers sneaking database commands into a form). htmlspecialchars() makes user — A PHP + MySQL Application with Prepared Statements · Download PNG · Open card page

Secure PHP Settings php.ini is PHP’s settings file. A few settings make a big safety difference. display_errors = Off : errors are not shown to visitors. expose_php = Off : hides the PHP version. log_errors = On : errors go to the log. One SQL error on screen can show table names and the query. That — Secure PHP Settings · Download PNG · Open card page

Installing MySQL or MariaDB MySQL and MariaDB are databases that store website data. Amazon Linux 2023 uses MariaDB. Ubuntu uses MySQL 8. The database should listen only on 127.0.0.1 (local only). Port 3306 must never be open to the internet. Scanners find open databases and steal or ransom the data — Installing MySQL or MariaDB · Download PNG · Open card page

Subqueries A subquery is a query inside another query, in brackets. Example: WHERE fees > (SELECT AVG(fees) FROM students) . Blind SQL injection uses subqueries to ask yes/no questions, one letter at a time. Tools like sqlmap send thousands of these. The real fix is prepared statements . Using = whe — Subqueries · Download PNG · Open card page

Working with Databases Basic commands to manage databases: CREATE DATABASE , SHOW DATABASES , USE dbname . In SQL injection, attackers list databases from information_schema . With least privilege, the web app user sees only its own database. Even a successful attack cannot list the others. Forgetti — Working with Databases · Download PNG · Open card page

Creating Tables and Choosing Data Types CREATE TABLE makes a table. Each column gets a data type : INT (whole numbers), VARCHAR (text), DATE, DECIMAL (money). CREATE TABLE students (id INT PRIMARY KEY, name VARCHAR(100), fees DECIMAL(10,2)); A VARCHAR(20) password column means you plan to store plai — Creating Tables and Choosing Data Types · Download PNG · Open card page

Inserting Data INSERT adds new rows to a table. Example: INSERT INTO students (name, city) VALUES ('Raja', 'Pune'); Every INSERT that uses user input must use prepared statements . A value like '), ('hacker','x in a joined-string INSERT can add extra rows. That is SQL injection. NULL means “unknown” — Inserting Data · Download PNG · Open card page

SELECT Basics and WHERE SELECT reads data. WHERE picks only matching rows. Example: SELECT name FROM students WHERE city = 'Pune'; The classic attack ' OR '1'='1 makes WHERE always true. In a login query, that can mean “logged in without a password”. Mixing AND and OR without brackets gives wrong ro — SELECT Basics and WHERE · Download PNG · Open card page

ORDER BY, LIMIT, DISTINCT and Aliases ORDER BY sorts rows. LIMIT returns only a few rows. DISTINCT removes repeats. AS gives a column a new name. Attackers try ORDER BY 1, 2, 3… until the query breaks. That tells them how many columns it has. This is the first step of a UNION SQL injection. SELECT * — ORDER BY, LIMIT, DISTINCT and Aliases · Download PNG · Open card page

LIKE, IN, BETWEEN and NULL LIKE matches patterns (% = any text, _ = one letter). IN matches a list. BETWEEN matches a range. WHERE name LIKE '_a%' = names with “a” as the second letter. WHERE email = NULL returns nothing. NULL means “unknown” and can’t be compared with =. Use IS NULL or IS NOT NULL — LIKE, IN, BETWEEN and NULL · Download PNG · Open card page

Aggregate Functions, GROUP BY and HAVING Aggregate functions sum up many rows: COUNT, SUM, AVG, MIN, MAX. GROUP BY makes groups. HAVING filters groups. FROM → WHERE → GROUP BY → HAVING → SELECT → ORDER BY → LIMIT. WHERE COUNT(*) > 1 gives an error. WHERE runs before grouping. Use HAVING COUNT(*) > 1 — Aggregate Functions, GROUP BY and HAVING · Download PNG · Open card page

JOINs A JOIN combines rows from two tables using a shared column, like student_id. INNER JOIN : only matching rows. LEFT JOIN : all rows from the left table, even with no match. UNION adds one query’s results to another. Attackers use UNION SELECT username, password FROM users to pull data from anot — JOINs · Download PNG · Open card page

UPDATE · Download PNG · Open card page

Safe Update Mode, Error 1175 and Transactions Safe update mode blocks UPDATE or DELETE without a key in WHERE. It shows Error 1175 . A transaction lets you undo changes with ROLLBACK before COMMIT . Many real data-loss cases are one unchecked UPDATE or DELETE. Safe mode, transactions and backups pro — Safe Update Mode, Error 1175 and Transactions · Download PNG · Open card page

ALTER TABLE: Add, Modify, Rename and Drop Columns ALTER TABLE changes a table after it is made: add, change, rename or remove columns. ALTER TABLE students ADD phone VARCHAR(15); Shrinking a column (VARCHAR(100) → VARCHAR(10)) cuts long data. Check first: SELECT MAX(LENGTH(name)) FROM students; — ALTER TABLE: Add, Modify, Rename and Drop Columns · Download PNG · Open card page

Constraints: NOT NULL, DEFAULT, CHECK, AUTO_INCREMENT Constraints are rules the database enforces. NOT NULL : must have a value. DEFAULT : value if none given. CHECK : value must pass a test. AUTO_INCREMENT : number goes up by 1 each row. Even if app checks fail, CHECK (amount > 0) stops negative pa — Constraints: NOT NULL, DEFAULT, CHECK, AUTO_INCREMENT · Download PNG · Open card page

Users, GRANT, REVOKE and Least Privilege GRANT gives a database user permissions. REVOKE takes them away. Least privilege = give only what is needed. If the web app uses root , one SQL injection controls the whole database. With a limited user, the attacker cannot drop databases or write files. GRAN — Users, GRANT, REVOKE and Least Privilege · Download PNG · Open card page

Preparing the Server: Elastic IP and Security Group Before adding a domain, give the server a fixed address and a safe firewall. An Elastic IP is a public IP that never changes after stop/start. EC2 → Elastic IPs → Allocate → Actions → Associate with your instance. Allow 80 and 443 from anywhere. Al — Preparing the Server: Elastic IP and Security Group · Download PNG · Open card page

Buying a Domain on GoDaddy and Pointing It to EC2 A domain is a website name, like yourdomain.com. You buy it from a registrar such as GoDaddy. In GoDaddy DNS, add an A record : Name @ , Value = your Elastic IP . Add a CNAME : Name www , Value @ . The new A record often works in minutes. Check with — Buying a Domain on GoDaddy and Pointing It to EC2 · Download PNG · Open card page

Optional: Keeping DNS in Route 53 You can buy a domain at GoDaddy but run its DNS in Route 53 (Amazon’s DNS service). Route 53 → Create hosted zone for your domain. It gives you 4 name servers . In GoDaddy, replace the name servers with those 4. Create an A record in Route 53 pointing to your Elasti — Optional: Keeping DNS in Route 53 · Download PNG · Open card page

Configuring the Web Server for the Domain After DNS works, tell the web server your domain name. Nginx: server_name . Apache: ServerName and ServerAlias . server_name yourdomain.com www.yourdomain.com; Writing only example.com and forgetting www . Then www shows the default welcome page. Write both — Configuring the Web Server for the Domain · Download PNG · Open card page

Verifying DNS with dig, nslookup and curl dig and nslookup ask DNS what IP a name points to. curl checks the web server answers. dig yourdomain.com +short → should print your Elastic IP. curl -I http://yourdomain.com → should show 200 OK . The same commands are used for reconnaissance (info gatherin — Verifying DNS with dig, nslookup and curl · Download PNG · Open card page

Subdomains A subdomain is a name under your domain, like blog.example.com . Add a DNS record with Name blog only, not blog.example.com. Then add a server block for it, test and reload. Forgotten subdomains (dev., test., old.) often run old software with no one watching. If a subdomain points (CNAME) — Subdomains · Download PNG · Open card page

How Name-Based Virtual Hosting Works Name-based virtual hosting = many websites on one server and one IP. The browser sends a Host header with the name. The server picks the matching site. Bots and scanners usually connect by IP, not by name. If the default site is your real app, every scanner sees — How Name-Based Virtual Hosting Works · Download PNG · Open card page

Multiple Sites with Nginx (Amazon Linux 2023 and Ubuntu) Hosting several websites on one Nginx server. Each site gets its own server block , folder and server_name . Make a folder per site → add a server block per site → sudo nginx -t → reload. When writing configs with a script, Nginx variables lik — Multiple Sites with Nginx (Amazon Linux 2023 and Ubuntu) · Download PNG · Open card page

Multiple Sites with Apache (Amazon Linux 2023 and Ubuntu) Hosting several websites on one Apache server. Each site gets its own virtual host file. Amazon Linux: /etc/httpd/conf.d/site1.conf (on automatically). Ubuntu: /etc/apache2/sites-available/site1.conf , then sudo a2ensite site1 . Add both name — Multiple Sites with Apache (Amazon Linux 2023 and Ubuntu) · Download PNG · Open card page

HTTPS with Certbot (Let's Encrypt) Certbot gets free HTTPS certificates from Let’s Encrypt and sets them up for you. Without HTTPS, anyone on the same Wi-Fi can read logins and steal cookies. Also redirect all HTTP to HTTPS, and set cookies with the Secure flag. “Timeout during connect” → running Ce — HTTPS with Certbot (Let's Encrypt) · Download PNG · Open card page

Checking and Hardening Your TLS Setup Checking that your HTTPS setup uses only strong, modern settings. Old protocols ( SSLv3, TLS 1.0, TLS 1.1 ) have known weaknesses. Every scanner flags them. Allow only TLS 1.2 and 1.3. Use SSL Labs (ssllabs.com/ssltest), only on your own domain. Turning on HSTS — Checking and Hardening Your TLS Setup · Download PNG · Open card page

What S3 Is: Buckets, Objects and Keys Amazon S3 stores files in the cloud. A bucket is a container. Each file is an object . Its name/path is the key , like photos/a1.jpg . Every object has a URL. One wrong permission makes files downloadable by anyone . Many real data leaks were just S3 buckets lef — What S3 Is: Buckets, Objects and Keys · Download PNG · Open card page

Creating a Bucket and Uploading Objects Making an S3 bucket and putting files in it. S3 → Create bucket . Name: lowercase, numbers and hyphens, 3–63 characters. Region: ap-south-1 (Mumbai). Keep ACLs disabled , so only policies control access. aws s3 cp file.txt s3://my-bucket/ uploads one file. aws — Creating a Bucket and Uploading Objects · Download PNG · Open card page

Hosting a Static Website on S3 S3 can serve a simple website (HTML, CSS, images) with no server. The S3 website address is HTTP only . For HTTPS and your own domain, put CloudFront in front, with Origin Access Control, so the bucket can stay private. Syncing secret files like .env or .git into a pub — Hosting a Static Website on S3 · Download PNG · Open card page

Versioning and Lifecycle Rules Versioning keeps old copies of a file when it is changed or deleted. A lifecycle rule moves or deletes old files automatically. Move logs/ to cheaper storage after 30 days. Delete old versions after 60 days. With versioning, a file deleted by mistake or encrypted by ra — Versioning and Lifecycle Rules · Download PNG · Open card page

S3 presigned URL: a private file, shared for a short time S3 is Amazon’s file storage. A bucket is a folder there. A presigned URL is a link with a time limit and a signature, so one person can open one private file . The bucket stays 100% private . Logged-in users still get their files. It works fo — S3 presigned URL: a private file, shared for a short time · Download PNG · Open card page

Encryption, Logging, IAM Roles and the S3 Security Checklist The main S3 safety settings in one place. At rest: SSE-S3 (default) or SSE-KMS (every key use is logged). In transit: always HTTPS. Use an IAM role attached to the server. Never put access keys on the server. Block Public Access ON. Versio — Encryption, Logging, IAM Roles and the S3 Security Checklist · Download PNG · Open card page

What RDS Is and Why Companies Use It RDS (Relational Database Service) is a database that AWS runs for you: MySQL, PostgreSQL and more. You still use normal SQL. AWS handles the server, patches and automatic backups. “Managed” does not mean your data is safe by default. AWS secures the platform. You — What RDS Is and Why Companies Use It · Download PNG · Open card page

Planning the Network: Subnet Group and Security Groups Before making an RDS database, plan where it lives and who can reach it. Put the database in private subnets . Its security group allows port 3306 only from the web server’s security group ( web-sg ). Port 3306 open to 0.0.0.0/0 is one of the fi — Planning the Network: Subnet Group and Security Groups · Download PNG · Open card page

Creating an RDS MySQL Instance Step by Step Creating a MySQL database in RDS from the console. RDS → Create database → MySQL 8.x → Free tier. Name: reels-db. Store the password in AWS Secrets Manager . Public access: No . Security group: db-sg. Encryption: ON. Backups: ON. — Creating an RDS MySQL Instance Step by Step · Download PNG · Open card page

Connecting from EC2 and Creating the Application User Connecting to RDS from your EC2 server, then making a separate database user for the app. mysql -h your-db-endpoint -u admin -p Then: CREATE USER 'app' … and GRANT only what the app needs. A connection that hangs means the network is blocking it. — Connecting from EC2 and Creating the Application User · Download PNG · Open card page

Automated Backups, Snapshots and Restore Automated backups : RDS saves your database every day. A snapshot : a backup you take by hand. It stays until you delete it. A restore makes a new database with a new address. It never overwrites the old one. Test it, then point the app to it. Backups are you — Automated Backups, Snapshots and Restore · Download PNG · Open card page

Project Overview and Architecture The plan for a “reels” video app: users upload videos, others watch them. Browser → EC2 (Nginx + PHP) → videos in S3 , data in RDS MySQL. The browser is never trusted. Only EC2 may write to S3 and talk to RDS. S3 and RDS are never public. Writing code first. Draw th — Project Overview and Architecture · Download PNG · Open card page

Deployment: Nginx, PHP Settings and Going Live Putting the app live with Nginx and PHP, with safe settings. Point the web root to public/ only. Then config.php, vendor/ and schema.sql can’t be reached. server_tokens off and expose_php = Off hide version numbers. Block hidden files: location ~ /\. { — Deployment: Nginx, PHP Settings and Going Live · Download PNG · Open card page

Domain and HTTPS Giving the reels app its own name and HTTPS. Add an A record : Name reels → your Elastic IP. Check with dig . Run Certbot to get a certificate and redirect HTTP to HTTPS. Add HSTS in the HTTPS server block. After HTTPS, login seems broken: the page just reloads. Set 'cookie_secure' — Domain and HTTPS · Download PNG · Open card page

Testing and Troubleshooting Finding why the app is broken, step by step. 502 : php-fpm not running. 403 : wrong file permissions. Access Denied from S3: wrong IAM role or old link. Changing code as soon as an error appears. Read the log first. The answer is usually in error.log . — Testing and Troubleshooting · Download PNG · Open card page

Security Checklist: The Target You Will Secure A list of the safety controls already in the reels app, before you start testing it. HTTPS, prepared statements, hashed passwords, CSRF tokens, private S3 and RDS, IAM role, IMDSv2. Rate limiting on login (Nginx limit_req or fail2ban), ownership checks — Security Checklist: The Target You Will Secure · Download PNG · Open card page

AWS Setup: S3 Bucket, IAM Role and RDS The AWS parts the reels app needs: an S3 bucket, an IAM role and an RDS database. Security group web-sg : 22 from your IP, 80 and 443 from anywhere. IAM role reels-ec2-role attached. Metadata: V2 only . Elastic IP attached. The IAM role gives the server short-l — AWS Setup: S3 Bucket, IAM Role and RDS · Download PNG · Open card page

Server Setup: LEMP, Composer and the AWS SDK for PHP Setting up the server: LEMP (Linux, Nginx, MySQL client, PHP) plus Composer , the PHP package manager, and the AWS SDK for PHP . Libraries are part of your attack surface. composer.lock pins exact versions. composer audit checks them for known sec — Server Setup: LEMP, Composer and the AWS SDK for PHP · Download PNG · Open card page

Database Schema The tables for the reels app: users, posts and likes. Store only the S3 key , like videos/2026/09/abc.mp4 , in the database. Make a fresh presigned link each time a page loads. Saving the full presigned URL in the database. After about 20 minutes every video says Access Denied . — Database Schema · Download PNG · Open card page

Configuration and Shared Code bootstrap.php is code that every page loads first. Starts a safe session. Opens the database with prepared statements and TLS. Creates the S3 client using the IAM role. Helpers: e() for safe HTML output, CSRF tokens, require_login() . The S3 client has no keys in code . — Configuration and Shared Code · Download PNG · Open card page

Accounts: Register, Login and Logout Pages to sign up, log in and log out. password_hash() uses a slow, salted method. A stolen users table is hard to crack. A new session ID at login stops session fixation . Logout is POST-only with a CSRF token. Showing “User not found” vs “Wrong password”. That t — Accounts: Register, Login and Logout · Download PNG · Open card page

Uploading Videos and Text Posts The upload page that saves videos to S3 and text posts to the database. Logged in? CSRF token right? Size under 50 MB? Real file type is MP4? Then save it to S3 with a new random name. Files never touch the web folder. They go to S3, and S3 never runs code. Checking o — Uploading Videos and Text Posts · Download PNG · Open card page

The Feed API and Likes feed.php returns the list of posts as JSON. like.php adds or removes a like. The feed returns only what the page needs. Never password hashes or private S3 keys. Not logged in? It returns 401 , not data. like.php accepts only POST with a CSRF token. A two-column primary key (u — The Feed API and Likes · Download PNG · Open card page

The Reel UI: HTML, CSS and JavaScript The front page of the reels app: HTML, CSS and JavaScript that scroll through videos. Captions are added with textContent , so any HTML or script shows as plain text. A Content-Security-Policy header is a second layer: inline scripts won’t run. Autoplay doesn’t — The Reel UI: HTML, CSS and JavaScript · Download PNG · Open card page

You Can't Hack or Secure What You Don't Understand You must understand how a system works before you can attack or defend it. SOC analysts, testers and cloud security engineers are all expected to know networking, Linux, web and databases first. Only then can you judge real risk. Watching “hacking i — You Can't Hack or Secure What You Don't Understand · Download PNG · Open card page

From Networking to Nmap and Wireshark Networking basics become security skills. Nmap finds open ports. Wireshark shows network packets. Nmap shows 22/tcp open ssh . You already know it: port 22, TCP, the SSH service. Close every port you don’t need. Allow management ports (22, 3306) only from specif — From Networking to Nmap and Wireshark · Download PNG · Open card page

From Linux and SSH to Brute Force, Privilege Escalation and Hardening Linux skills turn into attack and defence skills: brute force (password guessing), privilege escalation (normal user → root) and hardening . Tools like linPEAS only list possible weaknesses. You need to understand Linux permission — From Linux and SSH to Brute Force, Privilege Escalation and Hardening · Download PNG · Open card page

From HTTP and Web Servers to Burp Suite, Nikto and Misconfigurations Web server skills turn into web testing skills. Burp Suite catches web requests. Nikto scans for weak settings. curl -I https://yoursite already shows if versions leak and if security headers exist. No special tool needed. You set — From HTTP and Web Servers to Burp Suite, Nikto and Misconfigurations · Download PNG · Open card page

From MySQL to SQL Injection SQL skills help you understand SQL injection : attackers sneaking database commands into input boxes. sqlmap automates attacks but can’t explain the bug. You can read the bad line, prove it in DVWA (your own lab), and write the fix. Use prepared statements . Least privile — From MySQL to SQL Injection · Download PNG · Open card page

From S3, RDS and IAM to Cloud Misconfigurations AWS skills help you spot cloud misconfigurations : settings left unsafe by mistake. A public S3 bucket. An RDS database open to the internet. Access keys in code instead of an IAM role. IAM Access Analyzer , AWS Config , GuardDuty , CloudTrail . Their — From S3, RDS and IAM to Cloud Misconfigurations · Download PNG · Open card page

Your Project as the Target: Roadmap for the Next Parts Your own reels app and lab are the only targets you will practise on. Scan it, test the web app, try password attacks, then fix each finding. Running tools against friends’ or company websites “just to look”. That is a crime and can end your car — Your Project as the Target: Roadmap for the Next Parts · Download PNG · Open card page

The One Rule: Permission and Scope The one rule of ethical hacking: test only with written permission , and only inside the scope (the agreed list of targets). Same tools. The difference is permission, scope and an honest report. Scope is 10.20.30.0/24. An open database on 10.20.30.50 : you may test — The One Rule: Permission and Scope · Download PNG · Open card page

Indian Cyber Law: The IT Act, 2000 (Verify Every Number) The IT Act, 2000 is India’s main cyber law. Section 43 : unauthorised access or damage → you pay for the damage (civil). Section 66 : the same act done dishonestly or fraudulently → a crime. “I was only testing” is not a defence without writte — Indian Cyber Law: The IT Act, 2000 (Verify Every Number) · Download PNG · Open card page

Reporting Cyber Crime in India Where to report cyber crime in India. Online fraud: cybercrime.gov.in or helpline 1930 . Security holes: CERT-In . Example: a public S3 bucket. Do not download the data. Note the minimum evidence, stop, and report to the owner or CERT-In. Going further can turn you fro — Reporting Cyber Crime in India · Download PNG · Open card page

Building a Safe, Isolated Lab A lab is a set of practice computers on your laptop, cut off from real networks. Use VirtualBox (free) or VMware. Kali Linux (attacker), Metasploitable 2, DVWA, Juice Shop (targets). Put every machine on a host-only adapter . They can talk to each other, but not to the — Building a Safe, Isolated Lab · Download PNG · Open card page

Kali Linux Basics Kali Linux is a Linux system with security testing tools already installed. Kali is just Linux, so harden it too: change the default password, keep it updated, keep it on the lab network. Make a folder per target and save every command and its output. This is how a real test report — Kali Linux Basics · Download PNG · Open card page

The Pre-Engagement Checklist A checklist you run before any test, so you never hack the wrong target. Written permission? Scope (allowed targets) clear? Dates and times agreed? Contact person known? Backups of the target done? Testing from your own machine? In a job, “my own VM” becomes “the signed — The Pre-Engagement Checklist · Download PNG · Open card page

How Defenders Detect Scanning How a defender notices someone scanning their network for open ports. Many connection attempts to different ports from one IP. A flood of SYN packets. Lots of “connection refused” in the logs. An IDS like Snort or Suricata. Firewall logs. Netflow. Open only the ports yo — How Defenders Detect Scanning · Download PNG · Open card page

whois and dig whois shows who owns a domain or IP: registrar, dates, name servers. dig asks DNS for a name’s records. whois example.com → registrar and expiry. dig example.com MX → mail servers. These are passive recon tools: info gathering without touching the target’s own servers. Attackers use th — whois and dig · Download PNG · Open card page

theHarvester and Recon-ng (Overview) theHarvester and Recon-ng collect public info about a target: emails, names, subdomains and IPs. They pull from search engines, certificate logs and DNS. Most of this is passive recon (public sources). theHarvester’s DNS brute-force option is active : it sends qu — theHarvester and Recon-ng (Overview) · Download PNG · Open card page

Maltego Introduction Maltego is a tool that draws a picture of how things connect: a domain → its DNS names → IPs → the organisation. You drop an entity (domain, email, IP) on a graph and run transforms (small lookups) that add related entities. It makes links easy to see. Threat intelligence teams — Maltego Introduction · Download PNG · Open card page

Netdiscover: Finding Lab Hosts Netdiscover finds which computers are alive on your local network. It uses ARP (maps IP to MAC address). ARP is layer 2. Even hosts that block ping must answer ARP. So it is very reliable on a LAN. Use it only on your own lab network. This is active recon , so it needs — Netdiscover: Finding Lab Hosts · Download PNG · Open card page

Service Versions, OS Detection and NSE Scripts Nmap can find the version of each service and guess the operating system. NSE = the Nmap Scripting Engine, extra scripts for deeper checks. nmap -sV target shows: 21/tcp open ftp vsftpd 2.3.4 . That gives port, service and exact version to look up. The — Service Versions, OS Detection and NSE Scripts · Download PNG · Open card page

Timing, Output Formats and Scan Hygiene Timing controls scan speed (-T0 slow to -T5 fast). Output formats save results to files. nmap -oA target-name ... saves in all formats at once. Keep a separate folder per target. Scanning, reading the screen, then closing the terminal. Two days later, nothing — Timing, Output Formats and Scan Hygiene · Download PNG · Open card page

Masscan: Very Fast Port Scanning Masscan scans huge IP ranges very fast. It only finds open ports , nothing more. Masscan first to find open ports quickly, then Nmap for details on just those ports. Raising --rate too high drops packets, so it misses open ports. Keep the rate sensible. — Masscan: Very Fast Port Scanning · Download PNG · Open card page

Manual Lookup: searchsploit and Exploit-DB searchsploit searches a local copy of Exploit-DB , a public list of known exploits. From an Nmap version like vsftpd 2.3.4, run searchsploit vsftpd 2.3.4 to see known issues. Reading about a bug on your own lab is learning. Downloading an exploit and runnin — Manual Lookup: searchsploit and Exploit-DB · Download PNG · Open card page

Nmap Vulnerability Scripts Nmap’s vuln scripts check a target for known weaknesses. nmap --script vuln target . On Metasploitable 2 (your lab), it may report a known vsftpd backdoor, with a CVE number. On your own server, each “VULNERABLE” line is a fix to do. Run these scripts only on systems you o — Nmap Vulnerability Scripts · Download PNG · Open card page

OpenVAS / Greenbone: Full Vulnerability Scanning OpenVAS (now Greenbone) is a free, full vulnerability scanner. It runs tens of thousands of tests and gives a report with CVSS scores and fixes. Open the web console, add your lab target, run a scan, read the report. Paid tools like Nessus and Qualys — OpenVAS / Greenbone: Full Vulnerability Scanning · Download PNG · Open card page

Nikto: Web Server Scanning Nikto scans a web server for dangerous files, old software, default pages and missing security headers. It is noisy (easy to detect) but fast. Good for a first look at your own Apache or Nginx. Each finding is a homework item for the web server you built. Fix default pages — Nikto: Web Server Scanning · Download PNG · Open card page

Reading Results: False Positives and Prioritising How to read a scanner report and decide what to fix first. False positive : the tool flagged it, but it is not real. Severity : how bad it is, often from the CVSS score. Check the real installed version ( rpm -q or dpkg -l ), read the vendor advisory — Reading Results: False Positives and Prioritising · Download PNG · Open card page

Writing a Vulnerability Report A clear write-up of each security problem you found. What is wrong? Where? How do you know (evidence)? How to fix it? Keep before/after scan snippets as proof. Vague reports get rejected by companies and bug-bounty platforms. Clear steps get fixes done. — Writing a Vulnerability Report · Download PNG · Open card page

How Web Testing Works: The Intercepting Proxy An intercepting proxy (like Burp) sits between your browser and the website. You can see and change each request. A site may hide a button or check a price in JavaScript , but real security must be on the server . With a proxy you send a request the brow — How Web Testing Works: The Intercepting Proxy · Download PNG · Open card page

Burp Intruder: Automating Requests Burp Intruder repeats a request while changing one marked value. Change an ID from 1 to 50 to test for IDOR (seeing other users’ data). The free version is slower, which is fine for a lab. Rate limiting, account lockouts, and IDs that cannot be guessed, plus owners — Burp Intruder: Automating Requests · Download PNG · Open card page

OWASP ZAP: A Free Full Scanner OWASP ZAP (Zed Attack Proxy) is a free tool like Burp, with a built-in automatic scanner. Good for a quick first pass on your own staging app after each change. Teams can run ZAP automatically and fail the build on new High alerts, just like a failed test. — OWASP ZAP: A Free Full Scanner · Download PNG · Open card page

Gobuster and Dirb: Finding Hidden Content Gobuster and Dirb guess hidden pages and files on a web server, like /admin or /backup.zip . They try names from a wordlist. Flags: -x php,txt,bak adds file endings, -t 50 sets speed. If Gobuster finds /backup.zip or /.env on your server, attackers will too. — Gobuster and Dirb: Finding Hidden Content · Download PNG · Open card page

sqlmap: Testing for SQL Injection sqlmap automatically finds and exploits SQL injection (CWE-89), one of the most dangerous web bugs. You give it a request. It tests each input. If one is injectable, it can list databases, tables and rows. Use it only on your own lab, like DVWA. It shows how serious — sqlmap: Testing for SQL Injection · Download PNG · Open card page

WPScan: Scanning WordPress WPScan is a scanner just for WordPress sites. It checks the version, themes, plugins and users for known bugs. It uses a vulnerability database. A free API token raises the daily limit. Most WordPress breaches come from outdated plugins , not the core. Keep plugins updated — WPScan: Scanning WordPress · Download PNG · Open card page

How Passwords Are Stored How systems should store passwords safely: not as plain text, but as a hash (a one-way fingerprint). A salt is a random value added to each password before hashing, so two equal passwords get different hashes. A slow hash (bcrypt) is slow on purpose, so guessing is hard. On — How Passwords Are Stored · Download PNG · Open card page

John the Ripper: Cracking Hashes John the Ripper cracks password hashes offline, by guessing. It auto-detects many hash types. Helpers like zip2john and ssh2john turn protected files and keys into hashes John can try. Lab only. Cracking your own lab password dump shows which users chose weak passwor — John the Ripper: Cracking Hashes · Download PNG · Open card page

Hashcat: Fast GPU Cracking Hashcat is the fastest cracker. It uses the GPU , so it tries far more guesses per second than John. Tell it the hash type with -m and the attack mode with -a . Example types: 0 = MD5, 100 = SHA1, 3200 = bcrypt. MD5 is cracked fast. bcrypt (slow by design) is so slow that — Hashcat: Fast GPU Cracking · Download PNG · Open card page

Hydra: Online Login Testing Hydra tries many username/password pairs against a live service: SSH, FTP, web forms. This is an online attack , so it is slow and noisy. -l one user, -L a list. -p one password, -P a list. Online guessing is easy to detect and block. Defence: lockouts, rate limits, MFA, — Hydra: Online Login Testing · Download PNG · Open card page

Defending Against Password Attacks Simple controls that stop almost all password attacks. Strong, unique passwords. Slow hashing with salt. MFA (a second factor). Account lockout after failed tries. Most real breaches use a weak, reused or leaked password, not a clever exploit. These controls stop t — Defending Against Password Attacks · Download PNG · Open card page

What Metasploit Is Metasploit is a free toolkit of ready-made exploits, payloads and tools. You pick a tested module , set a few options, and run it. A bind payload opens a port on the target. A reverse payload makes the target connect back to you. Reverse is better, because firewalls usually block — What Metasploit Is · Download PNG · Open card page

Starting msfconsole msfconsole is the main Metasploit command line. db_nmap runs Nmap and saves the results, so modules can use them. search finds a module, use selects it. Metasploit shows how known bugs are abused. Use it only on Metasploitable-class VMs on a host-only network, then apply the patc — Starting msfconsole · Download PNG · Open card page

Search, Select and Configure a Module Choosing a Metasploit module and setting its options. set RHOSTS (target), set RPORT (port), set LHOST (your Kali IP for reverse payloads), set PAYLOAD . Run info on a module and read the references : CVE, advisory, affected versions. That is your patch list for — Search, Select and Configure a Module · Download PNG · Open card page

Running an Exploit and Getting a Session Running the module to get a session (a shell) on the lab target. Type exploit . If it works, you get a shell. Example lab modules: Samba usermap_script, UnrealIRCd backdoor. Getting a shell is not the goal. The goal is to learn the weakness and write the fix — Running an Exploit and Getting a Session · Download PNG · Open card page

Meterpreter and Post-Exploitation Meterpreter is a powerful Metasploit shell that runs in memory and gives friendly commands. Post-exploitation is what an attacker does after getting in. Gather info, dump password hashes, look for other machines to reach (lateral movement). Knowing these steps helps — Meterpreter and Post-Exploitation · Download PNG · Open card page

msfvenom: Generating Payloads (Concept) msfvenom builds a standalone payload file (like an .exe) that connects back to your Metasploit listener when run. You study it to recognise and block such files, not to attack people. EDR and email filters look for exactly these. Sending an msfvenom file to ou — msfvenom: Generating Payloads (Concept) · Download PNG · Open card page

What Sniffing Is Sniffing means capturing the packets travelling on a network to read them. Promiscuous mode tells a network card to capture everything it sees. On old hubs , every packet reached every machine. Modern switches send traffic only to the right port, so sniffing needs tricks like ARP sp — What Sniffing Is · Download PNG · Open card page

tcpdump: Command-Line Capture tcpdump captures packets from the terminal. Great on a server with no screen, like EC2. Filters: host , port , src , dst . -w file.pcap saves packets to open later in Wireshark. Without -n , tcpdump looks up a name for every IP, which is slow. Always use -n . — tcpdump: Command-Line Capture · Download PNG · Open card page

Wireshark: Reading Traffic in a GUI Wireshark is the standard tool to read network packets with a screen (GUI). Capture live, or open a .pcap from tcpdump. The packet list (one row per packet), the details (layers you can open: IP, TCP, HTTP), and the raw bytes . It shows exactly what travelled on t — Wireshark: Reading Traffic in a GUI · Download PNG · Open card page

Display Filters and Following a Stream A display filter shows only the packets you want, like http or ip.addr==192.168.56.20 . Right-click → Follow → TCP Stream. Wireshark rebuilds the whole conversation into readable text. Mixing up filters. A capture filter (like port 80 ) runs before capturing. A — Display Filters and Following a Stream · Download PNG · Open card page

Why HTTP Leaks and HTTPS Protects; ARP Spoofing HTTP is plain text; anyone sniffing can read it. HTTPS encrypts it. ARP spoofing is a man-in-the-middle trick on a LAN. The attacker sends fake ARP replies so your traffic passes through their machine first. Study it in the lab, only to understand the — Why HTTP Leaks and HTTPS Protects; ARP Spoofing · Download PNG · Open card page

Wi-Fi Security Standards Wi-Fi security standards, from weak to strong: WEP (broken), WPA , WPA2 , WPA3 . Home Wi-Fi uses one shared passphrase ( PSK ). Companies use WPA2/WPA3-Enterprise , where each user logs in through a RADIUS server, with no shared password. Older standards were broken, so newe — Wi-Fi Security Standards · Download PNG · Open card page

Monitor Mode and the Aircrack-ng Suite The Aircrack-ng suite tests Wi-Fi security. airmon-ng (monitor mode), airodump-ng (capture), aireplay-ng (deauth), aircrack-ng (crack). Monitor mode lets a card capture all nearby Wi-Fi frames. It fails on a laptop’s built-in card or a VM adapter. You need an e — Monitor Mode and the Aircrack-ng Suite · Download PNG · Open card page

WPA2 Handshake Capture and Offline Cracking An attacker captures the WPA2 handshake (the join step) and then tries to crack the passphrase offline. A long, random passphrase that is in no wordlist makes this attack fail . A short or common one (12345678, password) is cracked fast. WPA2 itself is not — WPA2 Handshake Capture and Offline Cracking · Download PNG · Open card page

Evil Twin and Deauth Attacks (Concept) An evil twin is a fake Wi-Fi access point with a trusted name. A deauth attack kicks you off real Wi-Fi so you join the fake one. On the fake network, the attacker can watch your traffic. Connect only to known networks. Distrust open Wi-Fi. Use a VPN and check — Evil Twin and Deauth Attacks (Concept) · Download PNG · Open card page

Securing Your Own Wi-Fi Simple steps to lock down your home or shop Wi-Fi. Use WPA3 (or WPA2) with a long passphrase. Change the router admin password. Keep firmware updated. Turn WPS off. Wi-Fi is the front door to every device you own. WPS ’s 8-digit PIN can be brute-forced, so turn it off. — Securing Your Own Wi-Fi · Download PNG · Open card page

What Privilege Escalation Is Privilege escalation means getting more rights than you were given, usually normal user → root (full control). Get in as a limited user (web shell or cracked login), then escalate to root. Root can read every file, install anything and hide tracks. With least privilege , — What Privilege Escalation Is · Download PNG · Open card page

Manual Linux Enumeration After getting a shell, checking a Linux box by hand for ways to become root. sudo -l (commands you can run as root). SUID programs. Root cron jobs that run editable scripts. World-writable files. sudo -l is often the direct answer. Defenders check the same things and remove — Manual Linux Enumeration · Download PNG · Open card page

Common Escalation Paths The usual ways a normal user becomes root on Linux. A sudo rule that lets you run an editor or shell as root. A misused SUID program (runs as its owner, often root). A writable script in a root cron job. The site GTFOBins lists how each program can be misused. Defenders remov — Common Escalation Paths · Download PNG · Open card page

Automated Enumeration: linPEAS and LinEnum linPEAS and LinEnum are scripts that search a Linux box for ways to become root, in seconds. linPEAS marks the best findings in colour. Red/yellow = likely escalation path. It checks sudo rights, SUID, cron, writable files and more. On a lab VM, read the re — Automated Enumeration: linPEAS and LinEnum · Download PNG · Open card page

A Note on Windows Escalation How becoming admin works on Windows (for interviews). The goal is the same as on Linux: become Administrator/SYSTEM . Token abuse, weak service settings, unquoted service paths , old vulnerable drivers. Microsoft publishes hardening baselines . Defence: keep patches curr — A Note on Windows Escalation · Download PNG · Open card page

Defending Against Privilege Escalation How to stop a normal user from becoming root. Run the web server and PHP as a low-privilege user . Keep the OS updated. Remove needless sudo rules and SUID bits. Never store passwords or keys in world-readable files. One small foothold is limited. Privilege esc — Defending Against Privilege Escalation · Download PNG · Open card page

What Social Engineering Is and Why It Works Social engineering is tricking people into giving information or access. No exploit needed, just human nature. People want to be helpful, especially under pressure or when someone sounds like authority. A caller pretends to be “IT support” and asks for you — What Social Engineering Is and Why It Works · Download PNG · Open card page

Types of Social Engineering The common forms of social engineering. Phishing (email), vishing (phone call), smishing (SMS), baiting (a dropped USB), tailgating (walking in behind staff). Most real attacks start with one of these, then use technical tools. The human is the entry point. Give staff a c — Types of Social Engineering · Download PNG · Open card page

How to Spot a Phishing Message Phishing is a fake message that tries to steal your password or money. Here is how to spot one. A wrong sender address (sbi-alerts@secure-sbi-verify.xyz is not SBI). Urgency: “act now or lose access”. Links that don’t match the text. Unexpected attachments. Hover over — How to Spot a Phishing Message · Download PNG · Open card page

The SET Toolkit (Awareness Only) SET (Social-Engineer Toolkit) can clone a real login page and build phishing emails. Authorised companies use it with written permission for staff awareness tests, then train whoever clicks. A fake login page can look identical to the real one. So never log in from a — The SET Toolkit (Awareness Only) · Download PNG · Open card page

Building Awareness and Responding Simple habits that stop social engineering and online fraud. Never share OTP, password, PIN or card details. Don’t log in from links; open the official app yourself. Verify odd requests by calling an official number. Awareness is cheap and stops most attacks. The at — Building Awareness and Responding · Download PNG · Open card page

What Digital Forensics Is Digital forensics is the careful process of finding, preserving and analysing digital evidence so it holds up in court. The opposite of an attacker: slow, careful and fully documented. Another examiner following your steps must get the same result. After an incident, good f — What Digital Forensics Is · Download PNG · Open card page

Core Principles The core rules of handling digital evidence. Never work on the original device. Make a copy (image) first. Prove the copy is unchanged with a hash (a fingerprint). Keep a chain of custody (who held the evidence, when). Working directly on the live disk. That changes the evidence, and — Core Principles · Download PNG · Open card page

Types of Forensics The main areas of digital forensics: disk , memory , network and mobile . Deleted files are often recoverable. Deleting usually removes only the pointer, not the data, until it is overwritten. Memory forensics (tools like Volatility) can find things that never touch the disk. In-m — Types of Forensics · Download PNG · Open card page

Making and Verifying a Disk Image A disk image is a bit-for-bit copy of a drive, used so you never touch the original. In real work, connect the evidence disk through a write blocker so imaging can’t change it. For practice, image your own spare USB stick. Always compute a hash before and after, and — Making and Verifying a Disk Image · Download PNG · Open card page

Autopsy and The Sleuth Kit The Sleuth Kit is a set of forensic command-line tools. Autopsy is its graphical front-end. Both come with Kali. Create a case, add the disk image, and Autopsy lists files and deleted files, and extracts pictures, web history and documents. It lets an investigator browse e — Autopsy and The Sleuth Kit · Download PNG · Open card page

Forensics, Incident Response and the Law How forensics connects to incident response and Indian law. Digital evidence is admissible under the Indian Evidence Act with a proper Section 65B certificate (check current rules). CERT-In requires some incidents to be reported. Without chain of custody and — Forensics, Incident Response and the Law · Download PNG · Open card page

What OWASP and the Top 10 Are OWASP (Open Worldwide Application Security Project) is a non-profit that publishes free security guidance. The OWASP Top 10 is the list of the ten most critical web app risks, updated every few years (current list: 2021). It is not for memorising word-for-word. Use it a — What OWASP and the Top 10 Are · Download PNG · Open card page

A03 Injection: SQL Injection SQL injection : an attacker puts database commands into an input box. Input 1' OR '1'='1 makes the query always true and returns every row. Worse: 1'; DROP TABLE users;-- can delete a table. The fix is prepared statements , so input is always treated as data, never as SQ — A03 Injection: SQL Injection · Download PNG · Open card page

A03 Injection: Cross-Site Scripting (XSS) XSS (Cross-Site Scripting): an attacker gets their script to run in another user’s browser on your site. A comment box saves a script that sends each viewer’s session cookie to the attacker. Then the attacker can log in as them. Encode output so text shows a — A03 Injection: Cross-Site Scripting (XSS) · Download PNG · Open card page

A03 Injection: Command Injection Command injection : user input reaches a system shell and runs as a command. A “ping” box gets 8.8.8.8; cat /etc/passwd , so the server runs both commands. Don’t send user input through a shell. Use safe APIs with an argument list and a strict allow-list (like escape — A03 Injection: Command Injection · Download PNG · Open card page

A01 Broken Access Control and IDOR Broken access control is the #1 web risk: a user does or sees things they should not. IDOR is the classic case: changing an ID in a URL to read someone else’s data. /invoice?id=1001 → change to 1002 → you see another user’s invoice, because the server did not check — A01 Broken Access Control and IDOR · Download PNG · Open card page

A07 Authentication and A02 Cryptographic Failures A07 : login weaknesses. A02 : weak or missing encryption. Strong passphrases, lockout and MFA . Change the session ID at login, expire sessions, and don’t reveal whether a username exists. Use HTTPS (TLS 1.2+). Hash passwords with a slow, salted algo — A07 Authentication and A02 Cryptographic Failures · Download PNG · Open card page

The Rest: Design, Components, Integrity, Logging, SSRF The remaining OWASP Top 10 risks: insecure design, old components, data integrity, poor logging and SSRF . SSRF (Server-Side Request Forgery): a server is tricked into fetching a URL. Fetching http://169.254.169.254/ (AWS metadata) can leak cred — The Rest: Design, Components, Integrity, Logging, SSRF · Download PNG · Open card page

IAM Done Right IAM (Identity and Access Management) controls who can do what in AWS. It is the front door of your account. The root user (your sign-up email) can do everything, even close the account. Use it rarely. Put MFA on it. MFA for every human means a stolen password alone is not enough. Give — IAM Done Right · Download PNG · Open card page

Network Security in AWS The two AWS network firewalls. Security groups : stateful, on each instance. NACLs : stateless, on each subnet (a second layer). Never allow 0.0.0.0/0 on 22 (SSH), 3389 (RDP), 3306 (MySQL) or 5432 (PostgreSQL). Scanners find open ports in minutes. Put databases in private sub — Network Security in AWS · Download PNG · Open card page

Protecting Data: S3, Encryption and Secrets Keeping stored data safe in AWS: S3, encryption and secrets. S3 encrypts new objects by default (SSE-S3). SSE-KMS gives more control: you choose who may use the key, and every use is logged. Tick Encryption when creating RDS and EBS. An open S3 bucket is t — Protecting Data: S3, Encryption and Secrets · Download PNG · Open card page

Detection: CloudTrail, GuardDuty, Config and Security Hub AWS tools that let you see what is happening. CloudTrail : who did what. GuardDuty : finds threats. Config : tracks settings. Security Hub : brings it together. Make a multi-region CloudTrail trail into a locked S3 bucket (Block Public Access — Detection: CloudTrail, GuardDuty, Config and Security Hub · Download PNG · Open card page

EC2 Metadata, SSRF and a Leaked-Key Incident Checklist The EC2 metadata service at 169.254.169.254 gives an instance its role’s temporary keys. SSRF can abuse it. A buggy app is tricked into fetching the metadata URL, so the attacker gets the role’s keys. Set IMDSv2 required on every instance. If ke — EC2 Metadata, SSRF and a Leaked-Key Incident Checklist · Download PNG · Open card page

What a SOC Is A SOC (Security Operations Centre) is the team that watches an organisation’s systems day and night, finds attacks and responds. MSSP : a company that runs a SOC for many clients. Playbook : steps for one type of alert. Ticket : a tracked alert or incident. Tools find things; the SOC d — What a SOC Is · Download PNG · Open card page

Where Logs Live Where to find the main logs on a server. Logins: /var/log/auth.log (Ubuntu) or journalctl (Amazon Linux). Web: access and error logs. Panicking at “Failed password”. Every internet server gets thousands daily. The real worry is an “Accepted” from the same IP after many “Failed”: the — Where Logs Live · Download PNG · Open card page

What a SIEM Does A SIEM collects logs from many systems into one place, so you can search and alert across all of them. EDR (watches processes on each machine). SOAR (automates response steps). IDS/IPS (watch network traffic). Reading logs server by server does not scale. A SIEM links events togethe — What a SIEM Does · Download PNG · Open card page

Wazuh Lab: See Your Own Attacks Wazuh is a free SIEM/EDR. A central server collects data from small agents on each machine. A separate VM (4 GB+ RAM) on the host-only network as the Wazuh server. Agents on your target machines. You attack a lab machine and watch your own attack appear as alerts. Thi — Wazuh Lab: See Your Own Attacks · Download PNG · Open card page

Alert Triage Triage means quickly deciding what each alert is and what to do next. Severity = impact (production, customer data) + confidence. Low: a failed scan on a patched server. Critical: an admin login from a new country, then a new user created. Read the alert: which rule, which host, which u — Alert Triage · Download PNG · Open card page

MITRE ATT&CK MITRE ATT&CK is a free catalogue of attacker tactics (goals) and techniques (how), each with a code. WannaCry (2017) spread with an SMB bug: T1210 (Exploitation of Remote Services). It locked files: T1486 (Data Encrypted for Impact). It gives everyone the same words for attacks. For eac — MITRE ATT&CK · Download PNG · Open card page

Hardening Principles Hardening means removing needless risk: fewer packages, fewer open ports, fewer privileges. CIS Benchmarks list hundreds of settings per OS. Lynis checks a server against them and gives a score. Hardening once and forgetting. A new package, user or port needs another check. Run — Hardening Principles · Download PNG · Open card page

SSH Hardening and fail2ban Making SSH, the main way into a Linux server, much harder to attack. fail2ban blocks IPs after repeated failed logins. Use keys, not passwords (PasswordAuthentication no). Disable root login. Best on AWS: keep port 22 closed and use Session Manager . Setting PasswordAuthen — SSH Hardening and fail2ban · Download PNG · Open card page

Host Firewall: firewalld and ufw A host firewall runs inside the OS: firewalld (RHEL/Amazon Linux) or ufw (Ubuntu). It is a second layer after the security group. Allow only the ports you need. Example (ufw): sudo ufw allow 443 . With firewalld, adding --permanent but forgetting --reload , so the ru — Host Firewall: firewalld and ufw · Download PNG · Open card page

Patching, Users, Permissions and Services Four everyday hardening jobs: patch software, review users, fix permissions, turn off unneeded services. sudo yum update / apt upgrade fixes known bugs. Stop and disable services you don’t need. Keep SELinux in enforcing mode. Turning SELinux off to “fix” a — Patching, Users, Permissions and Services · Download PNG · Open card page

Web Server Hardening Safe settings for a public web server. PHP: expose_php = Off , display_errors = Off , allow_url_include = Off . Always HTTPS with a valid certificate, and redirect HTTP to HTTPS. A WAF (web application firewall) like ModSecurity or AWS WAF adds a layer against SQLi and XSS. But — Web Server Hardening · Download PNG · Open card page

Network Hardening: Segmentation, VPN and IDS/IPS Making the network itself safer: segmentation (separate networks), VPN and IDS/IPS . Keep web, app, database and admin on separate networks (public and private subnets in AWS). Keep guest Wi-Fi away from the office network. If the web server is hacked — Network Hardening: Segmentation, VPN and IDS/IPS · Download PNG · Open card page

Symmetric Encryption Symmetric encryption uses one shared key to lock (encrypt) and unlock (decrypt). Example: AES . It is fast, so it protects large data. The problem is key exchange : how do two strangers share the key safely? Asymmetric crypto solves that. Keeping the key next to the encrypted fi — Symmetric Encryption · Download PNG · Open card page

Asymmetric Encryption Asymmetric encryption uses a pair of keys : a public key and a private key. What one locks, only the other opens. RSA (2048-bit or more), ECC (ECDSA, Ed25519: smaller keys, same strength), and Diffie-Hellman for agreeing a shared key. It solves key exchange. It is slow, so real — Asymmetric Encryption · Download PNG · Open card page

Digital Signatures, Certificates, PKI and TLS A digital signature proves who sent a message and that it was not changed. Certificates and PKI prove a public key really belongs to someone. Hash the message, then encrypt the hash with your private key. Anyone checks it with your public key. If the mes — Digital Signatures, Certificates, PKI and TLS · Download PNG · Open card page

Common Crypto Mistakes and Attacks The usual crypto mistakes and attack names. Inventing your own crypto. Using old algorithms (MD5, DES). Hard-coding keys. Reusing a nonce. Brute force (try every key), rainbow table (pre-computed hashes), man-in-the-middle , downgrade (force a weaker protocol), and — Common Crypto Mistakes and Attacks · Download PNG · Open card page

More IT Act Sections You Should Know More parts of India’s IT Act beyond sections 43 and 66. Section 67 : publishing obscene material online. The IT Rules, 2021 tell platforms how fast to remove unlawful content and to appoint grievance officers. Quoting section numbers from memory. Always verify th — More IT Act Sections You Should Know · Download PNG · Open card page

New Criminal Laws and Electronic Evidence India’s new criminal laws (BNS) and how electronic evidence is handled. Cyber fraud is often charged under the IT Act plus BNS sections for cheating and forgery. Cases before 1 July 2024 continue under the old laws. Emails, logs and chats can be evidence, bu — New Criminal Laws and Electronic Evidence · Download PNG · Open card page

CERT-In Directions for Organisations CERT-In (India’s national cyber emergency team) issued directions dated 28 April 2022 for organisations. Report certain incidents within 6 hours of noticing them. Keep system logs for 180 days . Sync clocks to NTP. 6 hours is very little time. You need a ready in — CERT-In Directions for Organisations · Download PNG · Open card page

Common Cyber Frauds in India and How to Spot Them The common online frauds in India and how to recognise them. Fake “KYC update” links. “Your parcel is stuck” SMS. Job and loan scams. Fake customer-care numbers. UPI “request money” tricks. Fear or greed + urgency + a link or a call asking for OTP or — Common Cyber Frauds in India and How to Spot Them · Download PNG · Open card page

What to Do If You Are a Victim The steps to take right away if you are hit by online fraud. Call 1930 (national cyber crime helpline) at once, and call your bank to block the card/account/UPI. Save evidence: screenshots, transaction IDs (UTR), phone numbers. File a report at cybercrime.gov.in . Spee — What to Do If You Are a Victim · Download PNG · Open card page

Cyber Security Job Roles The main entry roles in cyber security. SOC Analyst L1 (watch alerts), VAPT trainee (testing), IT/cloud support with security duties. Many people move in from system admin, networking or development. Your Linux and AWS skills from this course are a real advantage. — Cyber Security Job Roles · Download PNG · Open card page

Certifications Roadmap A sensible order of certifications for a beginner. First build networking and Linux skills. Then Security+ (a foundation). Then eJPT or CEH , with lots of hands-on practice. Certificates help pass HR filters, but only when backed by real skill. Prices change, so check each bod — Certifications Roadmap · Download PNG · Open card page

Practice Platforms Websites where you practise safely and legally: TryHackMe , Hack The Box , PortSwigger Web Security Academy . 3 practice sessions, 1 write-up of what you solved, 1 revision of a weak area. Finishing a room by following a walkthrough. That is not learning. Try on your own for 30–45 — Practice Platforms · Download PNG · Open card page

Portfolio, Resume and LinkedIn How to show your skills to employers. A GitHub with your lab notes, scripts and hardening checklists. Write-ups of labs you solved. A home-lab diagram. Never upload real client data, keys or passwords. Clear write-ups that show the fix for each bug impress interviewers — Portfolio, Resume and LinkedIn · Download PNG · Open card page

Bug Bounty Bug bounty programs let companies invite outside researchers to find bugs, and reward valid reports. Read the program policy fully. Test only assets in scope , only with allowed methods. Out-of-scope testing is unauthorised access (a crime under the IT Act). Start small, write clear repor — Bug Bounty · Download PNG · Open card page

Responsible Disclosure and Staying Legal What to do when you notice a security problem on a site that has no bug bounty program. Stop at the first sign. Don’t dig further or download data. Find the right contact, often at /.well-known/security.txt or CERT-In. Report privately. Going further, even to — Responsible Disclosure and Staying Legal · Download PNG · Open card page

FFUF: Fast Web Fuzzing FFUF is a fast web fuzzer : it tries many words in a URL to find hidden pages, files or parameters. It sends many requests from a wordlist and shows the responses. Flags: -mc 200,301,403 (match these codes), -fs (hide a default page size). Using -mc all and drowning in noise. — FFUF: Fast Web Fuzzing · Download PNG · Open card page

Amass: Subdomain Discovery Amass finds a domain’s subdomains (like dev.example.com), using public sources and, optionally, active guessing. Passive uses public data and is safe. Active brute force sends queries to the target, so it needs permission. Running active brute force on a public domain “for — Amass: Subdomain Discovery · Download PNG · Open card page

WhatWeb and Wappalyzer: Technology Fingerprinting WhatWeb and Wappalyzer tell you what a website is built with: server, CMS, frameworks and versions. Version numbers on public pages help attackers pick an exploit. Hide versions on your own site. Seeing “PHP 5.x” and jumping straight to an exploit. A — WhatWeb and Wappalyzer: Technology Fingerprinting · Download PNG · Open card page

Bettercap: Network Recon and MITM (Lab) Bettercap is a tool for network recon and man-in-the-middle (MITM) tests, like ARP spoofing. Lab only. It sends fake “I am the gateway” messages, so the victim’s traffic passes through the attacker. HTTPS everywhere + HSTS (never ignore certificate warnings). — Bettercap: Network Recon and MITM (Lab) · Download PNG · Open card page

Defence Checklist for These Tools A short list matching each recon/attack tool in this part to its defence. Fuzzing (FFUF): clean deployments, no hidden backups; rate limit and alert. ARP spoofing: HTTPS + HSTS, segmentation. Subdomain discovery: remove old subdomains. Interviewers ask “How would yo — Defence Checklist for These Tools · Download PNG · Open card page

NetBIOS and SMB Enumeration SMB is Windows file sharing (ports 445/139). Enumeration means listing its shares, users and settings. enum4linux , smbclient -L , CrackMapExec/NetExec . They list shares and check if signing is on. “smbclient -L failed, the tool is broken.” A failure is often good : gues — NetBIOS and SMB Enumeration · Download PNG · Open card page

SNMP Enumeration SNMP (port 161) manages network devices. Enumeration reads their info using a community string (a shared password). Default community strings like public can leak device details, interfaces and even configs. Trying the “public” string on a real router “just to see”. That is unauthor — SNMP Enumeration · Download PNG · Open card page

LDAP Enumeration LDAP (Lightweight Directory Access Protocol, ports 389/636) is a directory of users, groups and computers. Active Directory runs on it. An anonymous bind lets anyone read the directory with no login: usernames, emails and group membership. That list is perfect for phishing and passw — LDAP Enumeration · Download PNG · Open card page

SMTP Enumeration SMTP (port 25) is the email-sending protocol. Enumeration uses commands like VRFY to check which usernames exist. A list of valid users is gold for phishing and password attacks. Seeing VRFY succeed and thinking “hacked”. It only confirms a username; it gives no access. Fix: disable — SMTP Enumeration · Download PNG · Open card page

NFS Enumeration NFS (Network File System, ports 111/2049) shares Linux folders over the network. Enumeration lists the shared folders (exports). A world-readable export, or no_root_squash (remote root = local root), is very dangerous. Mounting a no_root_squash share from a real server “to test”. Fix — NFS Enumeration · Download PNG · Open card page

DNS Enumeration DNS enumeration gathers a domain’s records and tries a zone transfer (AXFR), which would dump every hostname. If AXFR is allowed, one command leaks the whole internal map. Fix: allow AXFR only to secondary DNS servers (with TSIG), and use split DNS. Getting upset when AXFR fails . A — DNS Enumeration · Download PNG · Open card page

Putting It Together + Defence Checklist A summary table of each enumeration protocol, its risk, and the defence. SMB null session → disable guest/null, require signing. SNMP public → change community strings, use SNMPv3. DNS AXFR → restrict zone transfers. Interviewers ask “You found an SMB null ses — Putting It Together + Defence Checklist · Download PNG · Open card page

AD Basics for Defenders Active Directory (AD) is the Windows system that stores all users, groups and computers in a company. A Domain Controller (DC) is the server that runs it. Domain : one management area (example: sahyadri.lab). Kerberos : the login system that uses tickets, so you prove your pa — AD Basics for Defenders · Download PNG · Open card page

Safe AD Lab Setup Building a practice Active Directory on your own isolated lab, never on a real company. Install the AD DS role, create a domain, add a few test users and groups. Take a snapshot before you weaken anything. Testing on real AD is a crime . Keep the lab DC on a host-only network, neve — Safe AD Lab Setup · Download PNG · Open card page

Enumeration of AD AD enumeration means mapping the directory: who can admin what, and who is logged in where. BloodHound with its collectors ( SharpHound or bloodhound-python ) gathers the relationships into a graph. Lab creds only. Attackers use it to find the shortest path to Domain Admin. Defende — Enumeration of AD · Download PNG · Open card page

NTLM Relay and Pass-the-Hash Concepts (Lab Only) Two Windows attacks (concepts, lab only). Pass-the-Hash : reuse a stolen password hash to log in, without knowing the password. NTLM relay : capture a login and forward it to another service. Old NTLM authentication can be reused or relayed when signi — NTLM Relay and Pass-the-Hash Concepts (Lab Only) · Download PNG · Open card page

BloodHound Attack-Path Analysis BloodHound draws a graph of AD rights, showing the path from a normal user to Domain Admin. It uses edges (rights), like “member of” or “can reset password”. Red asks “shortest path to Domain Admin”. Blue removes edges until the path is gone. Seeing a red path and del — BloodHound Attack-Path Analysis · Download PNG · Open card page

Privilege Escalation Paths and Domain Admin Risks The common ways an attacker climbs from a normal AD user to Domain Admin . Backup Operators, Account Operators, DNS Admins and replication rights ( DCSync ). Treat them as almost as powerful as Domain Admin. Clean up nested groups. Use just-in-time a — Privilege Escalation Paths and Domain Admin Risks · Download PNG · Open card page

Defence Checklist – Raja-Rani Traders Style AD A hardening checklist for a small-company Active Directory. Example: 1 DC, 2 file servers, 25 PCs. Strong, unique admin passwords and LAPS . SMB signing on. Patch the DC. Few Domain Admins. Watch for Kerberoasting and odd logins. An attacker who gets on — Defence Checklist – Raja-Rani Traders Style AD · Download PNG · Open card page

Putting It Together – Purple Team Mindset The purple team mindset for Active Directory: attack like Red, then fix like Blue. Enumerate like an attacker → fix the weakness like a defender → enumerate again until the attack fails. Say it clearly in interviews: “I test AD only in my own isolated lab. F — Putting It Together – Purple Team Mindset · Download PNG · Open card page

What Is Malware – Types for Defenders Malware is software made to harm, spy on, encrypt or control systems. Types: virus, worm, trojan, ransomware, spyware, rootkit. Virus needs a host file. Worm spreads by itself. Trojan hides in a useful-looking file. Ransomware encrypts your files for money. Wann — What Is Malware – Types for Defenders · Download PNG · Open card page

How Malware Spreads The common ways malware gets onto a computer. Phishing links and attachments. Drive-by downloads from shady websites. USB sticks with a disguised file. Supply-chain (a trusted update is poisoned). Defence: email filtering, blocking macros, EDR on each machine, and user awareness. — How Malware Spreads · Download PNG · Open card page

Ransomware Deep Dive – Raja-Rani Traders Ransomware encrypts your files and demands payment to unlock them. Encryptor : scrambles files. Locker : locks the screen. Double extortion : steal the data first, then encrypt, and threaten to leak it. The best defence is offline, tested backups , so you can — Ransomware Deep Dive – Raja-Rani Traders · Download PNG · Open card page

Defence Stack – Practical Controls The layers that stop malware, from the email gateway to the endpoint. Email filtering and macro blocking. EDR /antivirus on each machine. Least privilege. Patching. Offline, tested backups as the last resort. In October 2026, Osaka Metropolitan University had a lar — Defence Stack – Practical Controls · Download PNG · Open card page

Safe Malware Lab Setup A safe setup to study malware without risk to real systems. A dedicated detonation VM on a host-only network, with a separate IP, so you don’t harm your other lab machines. Take a snapshot to revert after each test. Never run unknown malware on your own laptop or office machin — Safe Malware Lab Setup · Download PNG · Open card page

Incident Response for Malware + CERT-In Awareness The steps to handle a malware incident. IR lifecycle : Prepare → Detect → Contain → Eradicate → Recover → Lessons. Isolate the infected machine from the network. Preserve evidence (disk/memory image) if needed before you rebuild. In India, CERT-In re — Incident Response for Malware + CERT-In Awareness · Download PNG · Open card page

Putting It Together – Purple Team Mindset The purple team mindset for malware: understand how it works, then defend against it. Snapshot before testing. Least privilege. Offline, tested backups. These don’t change even as tools do. Say it clearly in interviews: “I never run unknown files on my works — Putting It Together – Purple Team Mindset · Download PNG · Open card page

Putting It Together – Purple Team Mindset The purple team mindset for denial-of-service (DoS): test your own systems, then harden them. Only ever load-test systems you own. Hide the origin server. Add rate limits and timeouts. Say it clearly in interviews: “I never flood systems I don’t own. In the — Putting It Together – Purple Team Mindset · Download PNG · Open card page

Volumetric and Flood Concepts – Defender View A volumetric attack floods a target with so much traffic that the network pipe fills up. You don’t need the perfect flood to defend. You need traffic baselines , alerts on sudden spikes, and a way to ask your ISP or cloud to scrub traffic. Design the ori — Volumetric and Flood Concepts – Defender View · Download PNG · Open card page

Protocol Attacks – SYN Flood and Handshake Abuse A SYN flood sends many connection starts ( SYN ) but never finishes them. The server’s half-open connection table fills up, so real users can’t connect. The TCP handshake is SYN → SYN-ACK → ACK . The attacker sends the first step only. SYN cookies let — Protocol Attacks – SYN Flood and Handshake Abuse · Download PNG · Open card page

Amplification and Reflection – Closed Lab Only In a reflection attack, the attacker spoofs the victim’s IP, so public servers send their replies to the victim. Amplification : a small request causes a big reply. In 2018, misused public Memcached servers created enormous reflected floods. Never scan — Amplification and Reflection – Closed Lab Only · Download PNG · Open card page

Application-Layer DoS – Slow and Heavy Requests An application-layer DoS overwhelms the app itself, not the network. It needs far less traffic. Many requests to expensive pages (search, report export). Slowloris : hold many connections open very slowly, so all worker slots are used up. Rate limits, — Application-Layer DoS – Slow and Heavy Requests · Download PNG · Open card page

Detection and Defence Stack The layers that detect and absorb a DDoS attack: CDN, scrubbing, rate limits and good monitoring. A CDN (like Cloudflare) sits in front and filters traffic. Alerts on sudden traffic spikes let you act fast. “We use a CDN, so we’re 100% safe.” If your origin IP leaks , the — Detection and Defence Stack · Download PNG · Open card page

Lab-Safe Simulation – Ethics First How to practise DoS safely: only against a weak server you built, on a host-only network. Build a weak origin you own. From Kali, send controlled load to that IP only. Measure, then add rate limits. Banned: public IPs, attacks on open resolvers, booter/stresser ser — Lab-Safe Simulation – Ethics First · Download PNG · Open card page

Incident Response for Availability Attacks + CERT-In Awareness The steps to handle a DDoS. IR : Prepare → Detect → Mitigate → Communicate → Recover → Lessons. Confirm it is an attack, not a traffic spike or a broken deploy. Turn on scrubbing or CDN protection. Keep users informed. In India, CERT-In — Incident Response for Availability Attacks + CERT-In Awareness · Download PNG · Open card page

What Is a Session – Why Hijacking Matters After you log in, the server makes a session and gives your browser a session ID (often in a cookie like PHPSESSID). Every next request carries that ID. The session ID is like a ticket. If someone steals it ( session hijacking ), they are logged in as you, w — What Is a Session – Why Hijacking Matters · Download PNG · Open card page

Putting It Together – Purple Team Mindset The purple team mindset for sessions: understand hijacking, then stop it. Treat session IDs as bearer credentials (whoever holds one is “in”). Always HTTPS, HttpOnly and SameSite, and a new ID at login. Say it clearly in interviews: “I replay my own app’s co — Putting It Together – Purple Team Mindset · Download PNG · Open card page

Cookie Theft and Insecure Transit Session cookies carry your login. If they travel without encryption, someone sniffing can copy them. You log in over HTTPS, then open an HTTP page on the same site. The cookie rides in clear text , so a sniffer copies it and logs in as you. In 2010, the Firesheep br — Cookie Theft and Insecure Transit · Download PNG · Open card page

Session Fixation and Predictable IDs Two session attacks. Session fixation : the attacker sets a session ID before you log in, then reuses it. Predictable IDs : IDs that can be guessed. The app accepts an attacker-supplied session ID and never makes a new one after login. Or IDs are simple numbers. — Session Fixation and Predictable IDs · Download PNG · Open card page

XSS Path to Session Cookies – Defence First XSS (Cross-Site Scripting) runs an attacker’s script in your browser on a trusted site. One use is stealing the session cookie. If the cookie is not HttpOnly , the script can read it and send it out. Even with HttpOnly, the script can still act as you on t — XSS Path to Session Cookies – Defence First · Download PNG · Open card page

Network Sniffing of Sessions – Host-Only Concepts Capturing network traffic to grab session cookies. On your lab’s host-only network only. Modern switches send traffic only to the right port, so casual sniffing is hard. But open Wi-Fi, mirror ports and MITM still expose clear-text cookies. This is w — Network Sniffing of Sessions – Host-Only Concepts · Download PNG · Open card page

Application-Level Hijack – URL Tokens, CSRF, JWT Concepts Session problems at the app level: IDs in the URL, CSRF and JWT mistakes. A session ID in the URL ( ?PHPSESSID=… ) leaks through logs, screenshots and the Referer header. CSRF : the browser already has your cookie, and the attacker tricks it — Application-Level Hijack – URL Tokens, CSRF, JWT Concepts · Download PNG · Open card page

Detection – Logs, Concurrent Sessions, SIEM Signals How defenders spot a hijacked session in the logs. Session create, regenerate and destroy. Login and MFA result, IP and device. Feed these into a SIEM. The same session ID from two far-apart IPs at once. A sudden change of device or country mid-ses — Detection – Logs, Concurrent Sessions, SIEM Signals · Download PNG · Open card page

Defence Hardening Checklist A checklist to keep sessions safe. HTTPS everywhere + HSTS. Cookies: Secure , HttpOnly , SameSite . Regenerate the session ID at login. Short idle timeout. Each item blocks one attack: sniffing, theft by script, CSRF and fixation. “Remember me” should be a separate, caref — Defence Hardening Checklist · Download PNG · Open card page

Lab-Safe PHP Cookie Demo + Ethics / IT Act A safe way to study session cookies: a small PHP demo in your own lab. Log in to your own app, view your own cookie, then turn on Secure, HttpOnly and SameSite and see the difference. Banned: Firesheep-style attacks on strangers’ Wi-Fi, phishing coworkers f — Lab-Safe PHP Cookie Demo + Ethics / IT Act · Download PNG · Open card page

Putting It Together – Purple Team Mindset The purple team mindset for IDS and firewall evasion: study it as a defender. Test only your own lab. Tune, don’t mute noisy alerts. Always have authorisation. Say it clearly in interviews: “In the lab I run ordinary Nmap against my own target and Suricata/f — Putting It Together – Purple Team Mindset · Download PNG · Open card page

Fragmentation, Encoding, Obfuscation – Concepts, Then Reassembly Old tricks to slip past a simple IDS: split the attack across packets ( fragmentation ) or disguise it ( encoding ). A naive sensor that reads one packet at a time never sees the full attack pattern. URL encoding hides keywords from we — Fragmentation, Encoding, Obfuscation – Concepts, Then Reassembly · Download PNG · Open card page

Firewall Types – What "Evasion" Means to Blue The main firewall types: packet filter, stateful, and application/next-gen (NGFW). Not a magic packet. Usually a policy hole : an open outbound rule, or an allowed app being abused. Review allow-lists. Log denied traffic. Default-deny inbound, and also t — Firewall Types – What "Evasion" Means to Blue · Download PNG · Open card page

Honeypots and Honeynets – Deception, Ethics, Alerts A honeypot is a fake system whose only purpose is to be touched by an intruder. A honeynet is a small fake network. Low-interaction (like Cowrie: a fake SSH shell that logs tried passwords). High-interaction (a real system, watched closely). Any to — Honeypots and Honeynets – Deception, Ethics, Alerts · Download PNG · Open card page

Lab – Suricata or firewalld Logging on OWN VM A lab to see detection work: run Suricata (an IDS) or firewalld logging on your own VM, then scan it. After a scan, you should see an alert or a “denied” log line. Zero alerts usually means the wrong network card, a wrong HOME_NET , or promiscuous mode o — Lab – Suricata or firewalld Logging on OWN VM · Download PNG · Open card page

Project, Ethics and IT Act The ethics and law for IDS/firewall testing. Scanning the institute Wi-Fi “for practice”, silencing a client’s IPS, selling “IDS bypass” guides, using a honeypot to attack back. Rule: written permission + your own lab. Know IT Act sections 43 and 66 (verify the current wor — Project, Ethics and IT Act · Download PNG · Open card page

Project, Ethics, IT Act and Purple Interview Lines Ethics, law and interview lines for IoT/OT security. Scanning society cameras, writing to a live factory PLC, Mirai builders, “testing” a shop DVR without written permission. Rule: written permission + your own lab. Interview line: “I only test devi — Project, Ethics, IT Act and Purple Interview Lines · Download PNG · Open card page

Attack Surface – Defaults, Telnet, HTTP, UPnP, Dashboards The weak points of IoT devices like cameras and smart plugs. Factory admin/admin passwords still set. Telnet or plain HTTP management. UPnP opening ports without you knowing. Change default passwords. Turn off Telnet and UPnP. Keep devices on — Attack Surface – Defaults, Telnet, HTTP, UPnP, Dashboards · Download PNG · Open card page

Protocol Awareness – MQTT, CoAP, Modbus, DNP3 IoT and OT protocols. MQTT and CoAP for smart devices. Modbus and DNP3 for factory equipment. Open, anonymous MQTT lets anyone publish fake readings. Modbus often has no authentication inside the plant network. These protocols trust whoever can reach the — Protocol Awareness – MQTT, CoAP, Modbus, DNP3 · Download PNG · Open card page

Network Segregation – IT / OT Zones, Jump Hosts, firewalld Keeping office IT and factory/IoT (OT) on separate network zones , connected only through a controlled jump host . A flat network means a hacked camera can reach the billing database. Segregation stops that jump. Use firewalls (firewalld or — Network Segregation – IT / OT Zones, Jump Hosts, firewalld · Download PNG · Open card page

Internet Exposure Awareness – Your Lab Only Checking whether your own devices are accidentally visible on the public internet. Scanners like Shodan map exposed services. Check only your own company or lab IP: is a camera or MQTT broker exposed by mistake? Banned: mass-scanning strangers or building — Internet Exposure Awareness – Your Lab Only · Download PNG · Open card page

Firmware, Updates and Supply-Chain Hygiene Keeping IoT/OT device firmware updated, and trusting only genuine updates (supply-chain hygiene). Stuxnet (2010) was malware that damaged industrial centrifuges in Iran. It proved software can cause physical harm. Old firmware has known bugs. Update from th — Firmware, Updates and Supply-Chain Hygiene · Download PNG · Open card page

Detection – Outbound IoT, Failed Logins, Protocol Oddities How a defender spots a hacked IoT device from its network behaviour. A camera or sensor suddenly talks to random internet IPs (a sign of command-and-control ). MQTT message storms. A burst of failed logins on a camera. IoT devices have a fix — Detection – Outbound IoT, Failed Logins, Protocol Oddities · Download PNG · Open card page

Lab – Mosquitto MQTT or Fake Camera UI on OWN VM A safe IoT lab on your own VM: an MQTT broker (Mosquitto) or a tiny fake “camera” web page. Start it with no password (lab), see the risk, then add a real password check and watch it block access. It shows why default-open devices are dangerous. Keep — Lab – Mosquitto MQTT or Fake Camera UI on OWN VM · Download PNG · Open card page

Mobile Threat Model – What Can Go Wrong A phone is a small computer with your SIM, mic, camera and bank apps. The main risks for most people. A lost phone with a weak lock. Sideloaded junk apps. Bad public Wi-Fi . Rarely, targeted spyware. In May 2019, WhatsApp reported a spyware issue where a craft — Mobile Threat Model – What Can Go Wrong · Download PNG · Open card page

Project, Ethics, IT Act and Purple Interview Lines Ethics, law and interview lines for mobile security. Stalkerware, OTP theft, scanning other people’s phones, evil-twin Wi-Fi in public, “find my partner” spyware. Rule: written permission + your own device. Know IT Act sections 43 and 66. Interview — Project, Ethics, IT Act and Purple Interview Lines · Download PNG · Open card page

iPhone / iOS Security Model – App Store, Sandbox, Lockdown Mode How iPhone keeps apps safe: the App Store check, the app sandbox , and hardware encryption when a passcode is set. Lockdown Mode is a strong setting for people at high risk of targeted spyware. “Safer by default” is not “unhackable”. Ev — iPhone / iOS Security Model – App Store, Sandbox, Lockdown Mode · Download PNG · Open card page

Signs a Phone May Be Compromised – Practical Checklist Signs that a phone might be hacked. None of these alone proves it. Fast battery drain, a hot phone when idle, strange pop-ups, unknown apps, big data use. These can also be a bad battery or a chatty app. Don’t panic-format. Note the time, take s — Signs a Phone May Be Compromised – Practical Checklist · Download PNG · Open card page

Cleanup and Response – If You Believe the Phone Is Compromised What to do if you think your phone is hacked. From a different, clean device : change your Google/Apple and bank passwords, turn on MFA, and sign out of all sessions. Then remove unknown apps or do a clean reset. Installing a random “cle — Cleanup and Response – If You Believe the Phone Is Compromised · Download PNG · Open card page

MDM and BYOD – SME Concepts for Sahyadri Traders MDM (Mobile Device Management) lets a company set rules on phones: passcode, remote wipe, app allow-list. BYOD is staff using their own phones for work. Company data on a phone that IT does not control. MDM lets you wipe a lost phone and enforce a loc — MDM and BYOD – SME Concepts for Sahyadri Traders · Download PNG · Open card page

Bluetooth Risks – Pairing Hygiene and BlueBorne Awareness Bluetooth is short-range radio. The risks come from careless pairing and leaving it open. Pairing to the wrong device in a café. A phone left discoverable forever. Accepting file or contact prompts blindly. Turn Bluetooth off when not in use. — Bluetooth Risks – Pairing Hygiene and BlueBorne Awareness · Download PNG · Open card page

Wi-Fi on Phones – Evil Twin and Captive Portal Awareness Two Wi-Fi tricks aimed at phones. Evil twin : a fake access point with a familiar name. Captive portal : the “click Accept” page, sometimes fake. The fake name (like “Sahyadri-Guest”) lures your phone. The fake portal asks for a Google or Micr — Wi-Fi on Phones – Evil Twin and Captive Portal Awareness · Download PNG · Open card page

Hardening Checklist and Permission-Hygiene Lab A checklist to lock down a phone, plus a quick app-permission cleanup. Strong lock (PIN/passphrase + biometrics), short auto-lock. Encryption on (default with a lock). Weekly OS and app updates. Revoke permissions apps don’t need, like a torch app askin — Hardening Checklist and Permission-Hygiene Lab · Download PNG · Open card page

How to Use These Exercises – Ethics First How to use the practice exercises safely. Read the question → try for 5 minutes → then read the Hint → then do the Lab. Don’t jump to the Hint first. Offensive tools (nmap, sqlmap, hydra) go against your own IP list only . Before each session, confirm ip a s — How to Use These Exercises – Ethics First · Download PNG · Open card page

Capstone – Project Build-Hack-Fix (Sahyadri or Raja-Rani) The final project: build a small company setup, hack it in your lab, then fix every finding. Pick one fictional company. Scope = your own host-only lab (and optional AWS Free Tier). Do the full loop: build, test, fix, re-test. This is exactly — Capstone – Project Build-Hack-Fix (Sahyadri or Raja-Rani) · Download PNG · Open card page

Networking Foundations – Quick Fire A fast revision of Part 1: private vs public IP, CIDR, well-known ports, the TCP 3-way handshake, OSI vs TCP/IP. Firewalls, IDS rules and logs all use these basics. You cannot read an alert without them. Practise explaining each in one or two plain sentences, as y — Networking Foundations – Quick Fire · Download PNG · Open card page

Linux on EC2 – Commands You Must Type Blind The Linux commands a defender uses every day on an EC2 server. sudo yum install on Amazon Linux. sudo service name start|stop|status . Check permissions, users, logs and processes. Mixing up systemctl and service . In this course, use sudo service on Amazo — Linux on EC2 – Commands You Must Type Blind · Download PNG · Open card page

Web Servers and MySQL – Build and Protect Revision of building and protecting Apache/Nginx and MySQL. Always test before reload: nginx -t or apachectl configtest . MySQL: use keys, keep SQL_SAFE_UPDATES on, never expose port 3306. Connecting the app to MySQL as root . Use a least-privilege app user. — Web Servers and MySQL – Build and Protect · Download PNG · Open card page

Domains, S3, RDS and Project Checklist Revision of Parts 6–8: domains, HTTPS, S3, RDS and IAM. DNS A/CNAME set. HTTPS with Certbot. S3 Block Public Access on. RDS not public . Use an IAM role, not long-lived keys. Most cloud leaks are a public bucket, an open database or leaked keys. This checklist — Domains, S3, RDS and Project Checklist · Download PNG · Open card page

Kali Recon, Scan and Enum – Host-Only Only Revision of recon with Kali: whois/dig, Nmap timing, and service enumeration. Host-only targets only. Use slow timing ( -T2 ) in shared labs. Save output with -oA . Never DoS a target. Recon is the first step both for attackers and defenders. Do it only on — Kali Recon, Scan and Enum – Host-Only Only · Download PNG · Open card page

OWASP Top 10 – Fix What You Break (DVWA / Juice) Revision of web attacks on your own DVWA / Juice Shop : SQLi, XSS, IDOR, command injection, SSRF. Break it in your lab → Fix the code → Re-verify the fix works. Taking a screenshot of alert(1) and stopping. The interview wants the fix , not just proof — OWASP Top 10 – Fix What You Break (DVWA / Juice) · Download PNG · Open card page

Cloud, SOC, Hardening and Crypto – Mixed Drill A mixed revision: IAM least privilege, CloudTrail/GuardDuty, fail2ban, firewalld, SSH keys, hashing vs encryption, TLS. Hashing is one-way (for checking). Encryption is two-way (to protect secrets). They are not the same. These are the everyday defensiv — Cloud, SOC, Hardening and Crypto – Mixed Drill · Download PNG · Open card page

Advanced Defensive Drills – AD to Mobile Revision of the advanced chapters: Active Directory, malware handling, DoS, sessions, evasion, IoT and mobile. Least privilege + patch + segment + monitor covers most of it. The advanced topics look scary, but the defences are the same few ideas. Practise onl — Advanced Defensive Drills – AD to Mobile · Download PNG · Open card page

Source Appendix (URLs actually read) A list of the public sources used in the interview chapters, for transparency. Links can move, so verify them. Understand the concepts, not the exact URLs. Don’t recite URLs. Say: “These are public, candidate-reported themes; I prepare principles, not exact sourc — Source Appendix (URLs actually read) · Download PNG · Open card page

How to Use This Map – Ethics and Exam Mindset How to use the CEH exam-module map in this book. Each module is a topic basket, not a list of tools to run on live networks. Authorisation first : every scenario starts with “Do I own this, or have written permission?” Phase order matters: recon before a — How to Use This Map – Ethics and Exam Mindset · Download PNG · Open card page

Modules 01–05 Map (Intro through Vulnerability Analysis) CEH modules 1–5: the foundation. Ethics, footprinting, scanning, enumeration and vulnerability analysis. How attackers gather info and find weaknesses, and how defenders reduce what is exposed. These map to earlier chapters on ethics, recon an — Modules 01–05 Map (Intro through Vulnerability Analysis) · Download PNG · Open card page

Modules 06–10 Map (System Hacking through DoS) CEH modules 6–10: system hacking, malware awareness, sniffing, social engineering and DoS. Gaining and keeping access, how malware works, capturing traffic, tricking people, and availability attacks. Each is framed for defence: detect, contain and harde — Modules 06–10 Map (System Hacking through DoS) · Download PNG · Open card page

Modules 11–15 Map (Session Hijacking through SQL Injection) CEH modules 11–15: the web-heavy cluster. Session hijacking, web server and app attacks, and SQL injection. Stealing session cookies/tokens, attacking web servers and apps, and database injection. These map to earlier chapters on sessions, — Modules 11–15 Map (Session Hijacking through SQL Injection) · Download PNG · Open card page

Modules 16–20 Map (Wireless through Cryptography) CEH modules 16–20: wireless, mobile, IoT/OT, cloud and cryptography. Weak Wi-Fi, phone risks, insecure devices, cloud misconfigurations and crypto basics. Defence: WPA3, phone hardening, device segmentation, S3/IAM hygiene, TLS 1.2+. Never attack net — Modules 16–20 Map (Wireless through Cryptography) · Download PNG · Open card page

Quick Revision Table – Module → Book Chapter → Blue Control A one-page table linking each CEH module to its book chapter and its main Blue (defence) control. Read it the night before an exam or interview. Fill in the “practised in my own lab?” column yourself. A blank means a weak spot. Don’t just l — Quick Revision Table – Module → Book Chapter → Blue Control · Download PNG · Open card page

How to Use These Cheat Sheets The cheat sheets are a pocket map of what you already practised in earlier chapters. Read the Blue (defender) note for every command. Rewrite example IPs to your own lab IPs before running anything. In interviews, lead with the control, not the tool. A command is only u — How to Use These Cheat Sheets · Download PNG · Open card page

Linux Cheat Sheet A quick revision of the key Linux commands for defenders. Packages and services ( yum / apt , service ). Logs, search ( grep ), permissions, processes, SSH and SCP. These are a defender’s daily tools: read logs, check users, fix permissions. Amazon Linux: sudo yum + sudo service . — Linux Cheat Sheet · Download PNG · Open card page

MySQL Cheat Sheet A quick revision of MySQL: connect, schema, SELECT, writes, keys, safe updates, GRANT and backups. Use a least-privilege app user. Keep SQL_SAFE_UPDATES on. Use prepared statements for all user input. Never expose MySQL or RDS to the public internet. These habits stop most database — MySQL Cheat Sheet · Download PNG · Open card page

Nmap Cheat Sheet A quick revision of Nmap: host discovery, core scans and common ports. 22 SSH, 80 HTTP, 443 HTTPS, 3306 MySQL, 3389 RDP, 53 DNS. Scan only your own ranges. Mass scanning strangers is illegal and noisy. Use gentle timing ( -T2 ) in shared labs, and know how a scan looks in logs. — Nmap Cheat Sheet · Download PNG · Open card page

Metasploit Cheat Sheet (OWN lab only) A quick revision of Metasploit, for defence awareness, used on your own lab only. Search a module, set RHOSTS , run it against Metasploitable 192.168.56.20 , then apply the patch that would have blocked it. Knowing how exploits work helps you detect, patch and a — Metasploit Cheat Sheet (OWN lab only) · Download PNG · Open card page

Quick Combined Revision Card A single combined card: common attack ideas next to their defences. Read the defence column first. In exams and interviews, answer “situation → control”, not a list of tools. A blank defence column means an incomplete answer. Pair every attack idea with how you would sto — Quick Combined Revision Card · Download PNG · Open card page

How to use this glossary A pocket dictionary of the exact terms used in this course. For each term, learn the precise English word (for tickets and interviews) and one short meaning. Clear words matter in a SOC ticket and in an interview. Use the exact term, not a vague one. — How to use this glossary · Download PNG · Open card page

Core security terms The foundation security words: CIA triad, threat, vulnerability, risk, malware, MFA. CIA : Confidentiality, Integrity, Availability. Threat : who might attack. Vulnerability : a weakness. Risk : likelihood × impact. These words appear in every report and interview. Use each one p — Core security terms · Download PNG · Open card page

Networking, Linux and AWS terms Key terms from networking, Linux and AWS: CIDR, SSH, security group, IAM, sudo. CIDR : the /24 network notation. SSH : secure remote login. Security group : an AWS instance firewall. IAM : who can do what in AWS. These are the building blocks of cloud security work. K — Networking, Linux and AWS terms · Download PNG · Open card page

Web, MySQL, OWASP and Kali terms Key web and lab terms: SQL injection, prepared statements, Burp, Nmap, Metasploitable. SQL injection : commands sneaked into input. Prepared statements : the fix. Burp : an intercepting proxy. Metasploitable : a practice target VM. Knowing terms is not enough. Before — Web, MySQL, OWASP and Kali terms · Download PNG · Open card page

SOC, law, AD, malware, mobile/IoT terms Key terms for SOC, law, Active Directory, malware, mobile and IoT: BloodHound, CERT-In, DPDP, Android hygiene. BloodHound : maps AD attack paths. CERT-In : India’s cyber emergency team. DPDP : India’s data protection law. These words carry the India context an — SOC, law, AD, malware, mobile/IoT terms · Download PNG · Open card page

Revision card: Persistence: the attacker's hidden way back. Easy English, with a real example. Scan the QR for the full lesson. — Persistence: the attacker's hidden way back · Download PNG · Open card page

Revision card: Threat hunting: look before the alert. Easy English, with a real example. Scan the QR for the full lesson. — Threat hunting: look before the alert · Download PNG · Open card page

Revision card: SOAR: automate the boring steps. Easy English, with a real example. Scan the QR for the full lesson. — SOAR: automate the boring steps · Download PNG · Open card page

Revision card: Spotting data leaving the building. Easy English, with a real example. Scan the QR for the full lesson. — Spotting data leaving the building · Download PNG · Open card page

Revision card: STRIDE: six questions for any design. Easy English, with a real example. Scan the QR for the full lesson. — STRIDE: six questions for any design · Download PNG · Open card page

Revision card: Ports you must remember. Easy English, with a real example. Scan the QR for the full lesson. — Ports you must remember · Download PNG · Open card page

Revision card: The TCP 3-way handshake. Easy English, with a real example. Scan the QR for the full lesson. — The TCP 3-way handshake · Download PNG · Open card page

Revision card: EC2 SSH key and chmod 400. Easy English, with a real example. Scan the QR for the full lesson. — EC2 SSH key and chmod 400 · Download PNG · Open card page

Revision card: DNS records you must know. Easy English, with a real example. Scan the QR for the full lesson. — DNS records you must know · Download PNG · Open card page

Revision card: S3 Block Public Access. Easy English, with a real example. Scan the QR for the full lesson. — S3 Block Public Access · Download PNG · Open card page

Revision card: Keep your RDS database private. Easy English, with a real example. Scan the QR for the full lesson. — Keep your RDS database private · Download PNG · Open card page

Revision card: Nmap scan and port states. Easy English, with a real example. Scan the QR for the full lesson. — Nmap scan and port states · Download PNG · Open card page

Revision card: CVE, CWE and CVSS. Easy English, with a real example. Scan the QR for the full lesson. — CVE, CWE and CVSS · Download PNG · Open card page

Revision card: Burp Suite intercepting proxy. Easy English, with a real example. Scan the QR for the full lesson. — Burp Suite intercepting proxy · Download PNG · Open card page

Revision card: The incident response lifecycle. Easy English, with a real example. Scan the QR for the full lesson. — The incident response lifecycle · Download PNG · Open card page

Revision card: Hashing, salts and passwords. Easy English, with a real example. Scan the QR for the full lesson. — Hashing, salts and passwords · Download PNG · Open card page

Revision card: India's DPDP Act 2023. Easy English, with a real example. Scan the QR for the full lesson. — India's DPDP Act 2023 · Download PNG · Open card page

Revision card: netcat: the network tool. Easy English, with a real example. Scan the QR for the full lesson. — netcat: the network tool · Download PNG · Open card page

Revision card: What enumeration is. Easy English, with a real example. Scan the QR for the full lesson. — What enumeration is · Download PNG · Open card page

Revision card: Android permissions and safety. Easy English, with a real example. Scan the QR for the full lesson. — Android permissions and safety · Download PNG · Open card page

Comparison cards (33)

Static vs Dynamic IP and DHCP A static IP never changes. An admin sets it by hand. A dynamic IP is given out automatically by a DHCP server (Dynamic Host Configuration Protocol). It can change. DHCP works in 4 steps: Discover → Offer → Request → Acknowledge (DORA). The laptop gets an IP, subnet mask — Static vs Dynamic IP and DHCP · Download PNG · Open card page

Static vs Dynamic Analysis Mindset Malware is harmful software. Static analysis : you study the file without running it (its hash, text strings, file type). Dynamic analysis : you run it in a safe, isolated lab computer and watch what it does. Never run unknown malware on your own laptop or an offic — Static vs Dynamic Analysis Mindset · Download PNG · Open card page

What Is DoS vs DDoS – Availability First DoS (Denial of Service): one source floods a website so real users cannot use it. DDoS (Distributed DoS): many computers attack together. They are often a botnet (hacked devices controlled by one attacker). Both attack availability : the site must be up for r — What Is DoS vs DDoS – Availability First · Download PNG · Open card page

IDS vs IPS vs Firewall vs Honeypot – Why Each Exists Firewall : a gate. It allows or blocks traffic by rules. IDS (Intrusion Detection System): a CCTV camera. It alerts on attacks. IPS (Intrusion Prevention System): a gate that blocks attacks it sees. Honeypot : a fake system that only attackers wou — IDS vs IPS vs Firewall vs Honeypot – Why Each Exists · Download PNG · Open card page

Signature vs Anomaly IDS – False Positives and False Negatives An IDS watches network traffic for attacks. Signature-based : it matches known attack patterns , like a list of known thieves’ faces. Anomaly-based : it learns what is normal and alerts on anything unusual. Signature: fast and clear, but — Signature vs Anomaly IDS – False Positives and False Negatives · Download PNG · Open card page

Slow Scans, Timing, Port Knocking – Nmap vs Blue Rate Alerts A slow scan : the attacker checks ports very slowly, hoping to stay under alert limits. Port knocking : a port stays closed until someone hits a secret order of other ports first. Red team (attacker) hopes slow means unseen. Blue team (def — Slow Scans, Timing, Port Knocking – Nmap vs Blue Rate Alerts · Download PNG · Open card page

Covering Tracks vs Log Integrity – Blue Wins Covering tracks : an attacker deletes logs or changes times to hide. Log integrity : the defender keeps logs safe so they cannot be changed. Send a copy of every log to a separate server, like a SIEM (central log system), right away. The attacker can wipe — Covering Tracks vs Log Integrity – Blue Wins · Download PNG · Open card page

IoT vs OT / ICS / SCADA – CIA Plus Safety IoT : smart everyday devices, like cameras and smart plugs. OT (Operational Technology): computers that run machines in factories and power plants. ICS = industrial control systems; SCADA watches many sites; a PLC is a small computer next to a motor. In OT, — IoT vs OT / ICS / SCADA – CIA Plus Safety · Download PNG · Open card page

OSI model versus TCP/IP – what do interviewers want? The OSI model splits networking into 7 layers . The TCP/IP model is the real-world version, with 4 layers . They want you to map things to layers, not argue about layer counts. IP is the network layer. TLS protects data above the transport layer. — OSI model versus TCP/IP – what do interviewers want? · Download PNG · Open card page

What is a well-known port versus an ephemeral port? A port is a numbered door on a computer for one service. Well-known ports (0–1023) : fixed doors for common services, like 22 for SSH and 443 for HTTPS. Ephemeral ports : short-lived ports your computer picks for its own outgoing connections. The s — What is a well-known port versus an ephemeral port? · Download PNG · Open card page

Prepared statements versus escaping – which do you prefer? Both try to stop SQL injection (an attacker sneaking database commands into a form). Escaping : adding special marks to dangerous characters in user input. Prepared statements : the query and the user data are sent separately . Prepared stat — Prepared statements versus escaping – which do you prefer? · Download PNG · Open card page

Security Group vs Network ACL (AWS) Security group : a firewall on one server’s network card. It has allow rules only . Network ACL (NACL) : a firewall on a whole subnet (a group of servers). It can allow and deny. Security group = stateful . If a request is allowed in, the reply goes out by itself. — Security Group vs Network ACL (AWS) · Download PNG · Open card page

What is phishing awareness versus running SET on strangers? Phishing : fake emails or messages that trick people into giving passwords. Phishing awareness : training staff to spot and report it. SET (Social-Engineer Toolkit): a tool that can build fake login pages. Awareness training is defence (Blu — What is phishing awareness versus running SET on strangers? · Download PNG · Open card page

Threat vs Vulnerability vs Risk Vulnerability : a weakness. Example: software that is not updated. Threat : a person or event that may use that weakness. Example: an attacker. Risk : how likely it is × how much damage it can do. Vulnerability: a broken door lock . Threat: a thief in the area. Risk: — Threat vs Vulnerability vs Risk · Download PNG · Open card page

Golden Ticket versus Silver Ticket – what do you say safely? Kerberos is the login system in Windows Active Directory. It uses “tickets”. Golden Ticket : a forged master ticket. It needs the KRBTGT key (the domain’s master key). Silver Ticket : a forged ticket for one service only. Golden Ticket = a — Golden Ticket versus Silver Ticket – what do you say safely? · Download PNG · Open card page

Security group versus NACLs – interview short form? Both are AWS firewalls. Security group : on one server’s network card. Allow rules only. NACL (Network ACL): on a whole subnet . Allow and deny rules. Security group is stateful : replies are allowed back automatically. NACL is stateless : you must — Security group versus NACLs – interview short form? · Download PNG · Open card page

S3 public website versus accidental public bucket? S3 is Amazon’s file storage. A bucket is a folder there. Public website : you choose to make a bucket public, on purpose, to host a website. Accidental public bucket : private files become public by mistake. A public website is a reviewed design cho — S3 public website versus accidental public bucket? · Download PNG · Open card page

Authentication vs Authorisation Authentication : proving who you are . Example: password, OTP, fingerprint. Authorisation : deciding what you may do after login. Example: see only your own orders. Authentication comes first . Authorisation comes next , on every request. Easy memory: AuthN = who , Au — Authentication vs Authorisation · Download PNG · Open card page

Comparison card: Public vs Private IP. Easy English, with a real example. Scan the QR for the full lesson. — Public vs Private IP · Download PNG · Open card page

Comparison card: TCP vs UDP. Easy English, with a real example. Scan the QR for the full lesson. — TCP vs UDP · Download PNG · Open card page

Comparison card: Nginx vs Apache. Easy English, with a real example. Scan the QR for the full lesson. — Nginx vs Apache · Download PNG · Open card page

Comparison card: Passive vs Active Recon. Easy English, with a real example. Scan the QR for the full lesson. — Passive vs Active Recon · Download PNG · Open card page

Comparison card: Online vs Offline Password Attacks. Easy English, with a real example. Scan the QR for the full lesson. — Online vs Offline Password Attacks · Download PNG · Open card page

Comparison card: Symmetric vs Asymmetric Encryption. Easy English, with a real example. Scan the QR for the full lesson. — Symmetric vs Asymmetric Encryption · Download PNG · Open card page

Comparison card: Hashing vs Encryption. Easy English, with a real example. Scan the QR for the full lesson. — Hashing vs Encryption · Download PNG · Open card page

Comparison card: Brute Force vs Password Spray. Easy English, with a real example. Scan the QR for the full lesson. — Brute Force vs Password Spray · Download PNG · Open card page

Comparison card: True Positive vs False Positive. Easy English, with a real example. Scan the QR for the full lesson. — True Positive vs False Positive · Download PNG · Open card page

Comparison card: HTTP vs HTTPS. Easy English, with a real example. Scan the QR for the full lesson. — HTTP vs HTTPS · Download PNG · Open card page

Comparison card: Alerting vs Threat Hunting. Easy English, with a real example. Scan the QR for the full lesson. — Alerting vs Threat Hunting · Download PNG · Open card page

Comparison card: SIEM vs SOAR. Easy English, with a real example. Scan the QR for the full lesson. — SIEM vs SOAR · Download PNG · Open card page

Comparison card: Data Theft vs Data Lock (Exfiltration vs Ransomware). Easy English, with a real example. Scan the QR for the full lesson. — Data Theft vs Data Lock (Exfiltration vs Ransomware) · Download PNG · Open card page

Comparison card: STRIDE vs OWASP Top 10. Easy English, with a real example. Scan the QR for the full lesson. — STRIDE vs OWASP Top 10 · Download PNG · Open card page

Comparison card: Persistence vs Privilege Escalation. Easy English, with a real example. Scan the QR for the full lesson. — Persistence vs Privilege Escalation · Download PNG · Open card page

Interview cards (168)

How should you start any answer that mentions hacking or scanning tools? Start with ethics . Say you use offensive tools only on systems you own or have written permission to test. “In training I use a host-only VirtualBox lab and my own AWS Free Tier account. I never scan a client or café Wi-Fi.” “ — How should you start any answer that mentions hacking or scanning tools? · Download PNG · Open card page

What is the STAR method in a security interview? STAR = Situation, Task, Action, Result. It is a simple way to tell a story clearly. Situation: my lab site accepted unsafe SQL. Task: prove and fix it. Action: reproduce it, then use prepared statements. Result: the attack no longer works. “I answer w — What is the STAR method in a security interview? · Download PNG · Open card page

Should you memorise tool flags for interviews? No. Learn a tool’s purpose and when to use it, not fifty flags. Know why you would run an Nmap scan on your lab IP, what you look for, and the defence you would suggest. “I focus on the goal, the safe scope, the expected finding and the fix, not on memo — Should you memorise tool flags for interviews? · Download PNG · Open card page

How do you talk about a lab project without inventing work experience? Be clear it was your own lab , not a real client job. Then describe build, proof, fix and re-test. “On my own lab for a fictional company, I found and fixed SQL injection, then checked the fix worked.” “This was my own lab, not p — How do you talk about a lab project without inventing work experience? · Download PNG · Open card page

What if you do not know an answer? Say you have not used it yet, then connect it to something you do know. “I have not run OpenVAS in a real SOC, but I understand authenticated vs unauthenticated scanning and how to patch by CVE priority.” “I haven’t used that in production, but here is the related — What if you do not know an answer? · Download PNG · Open card page

How do you show Blue-team thinking when the question sounds Red? Answer the attack idea briefly, then spend more time on defence : logs, least privilege, patching, segmentation, MFA. For “how would you brute-force SSH?”, explain it in one line, then talk about fail2ban, key-only login and alerting. — How do you show Blue-team thinking when the question sounds Red? · Download PNG · Open card page

Which certifications should you name carefully? Name only certificates you hold or are actively studying for. “For CEH I talk about the exam modules and ethics, never about attacking without permission.” “I only list certifications I hold or am preparing for, and I can back each one with skill.” Put — Which certifications should you name carefully? · Download PNG · Open card page

How do you use fictional Maharashtra labs in answers? Use fictional company names as labels for your own lab VMs . Never present them as a real employer’s breach. “‘Sahyadri Traders’ is just a name for my own practice VMs. I built and tested it myself.” “These are story labels for my own lab, with c — How do you use fictional Maharashtra labs in answers? · Download PNG · Open card page

Scenario: Sahyadri Traders Pune EC2 shows thousands of failed SSH attempts. What do you do? Treat it as an active brute-force attack on SSH. Check if any login succeeded in /var/log/secure. Restrict the security group to known IPs. Confirm password login is off (key-only). Add fail2ban. “First I che — Scenario: Sahyadri Traders Pune EC2 shows thousands of failed SSH attempts. What do you do? · Download PNG · Open card page

Scenario: Raja-Rani’s developer committed AWS keys to a public repo. Your steps? Turn off the keys first, then clean up and move to roles. Deactivate the keys. Rotate related secrets. Check CloudTrail for misuse. Remove them from git history. Switch the app to an IAM role . Add secret scanning. “I k — Scenario: Raja-Rani’s developer committed AWS keys to a public repo. Your steps? · Download PNG · Open card page

Scenario: A Juice Shop-style order page on your lab shows IDOR. How do you answer? It is IDOR : changing an order ID showed another user’s order, because the server did not check ownership. “On my own lab app, I changed order_id in the URL and saw someone else’s order.” “The fix is a server-side che — Scenario: A Juice Shop-style order page on your lab shows IDOR. How do you answer? · Download PNG · Open card page

Scenario: S3 bucket listing is public for "temporary marketing images". Response? Turn on Block Public Access , remove public ACLs and policies, and stop serving files from an open bucket. Serve public images through CloudFront or a reviewed static-hosting setup, not a wide-open bucket. “‘Temporary — Scenario: S3 bucket listing is public for "temporary marketing images". Response? · Download PNG · Open card page

Scenario: Interviewer asks you to scan their production during the interview Wi-Fi. Answer? Refuse politely. You scan only with written permission , and interview Wi-Fi production is out of scope. Talk through your method, or show scan output from your own lab. “I’d love to, but I only scan with wri — Scenario: Interviewer asks you to scan their production during the interview Wi-Fi. Answer? · Download PNG · Open card page

Scenario: Ransomware popup on a warehouse PC at Solapur fiction site. First moves? Isolate the PC from the network first, then preserve evidence and escalate. Keep logs and traffic if you can. Find the account used. Check that backups are offline and intact. “First I isolate the machine, then preser — Scenario: Ransomware popup on a warehouse PC at Solapur fiction site. First moves? · Download PNG · Open card page

Scenario: MySQL on EC2 is bound to 0.0.0.0 and SG open. How do you harden? Stop MySQL listening to the world and close port 3306 from the internet. Bind MySQL to localhost or the private IP. Allow only the app’s security group. Use least-privilege DB users. Check backups. Consider private RDS. “I bi — Scenario: MySQL on EC2 is bound to 0.0.0.0 and SG open. How do you harden? · Download PNG · Open card page

Scenario: Explain a Build-Hack-Fix you did for Sahyadri in under two minutes. Tell the full loop in one minute: build a weak app, hack it in your lab, fix it, then re-test. “I built a weak PHP login on my host-only VM, proved SQL injection from Kali, then fixed it with prepared statements and HTTPS — Scenario: Explain a Build-Hack-Fix you did for Sahyadri in under two minutes. · Download PNG · Open card page

How do you cite a real breach in an interview without inventing facts? Name the incident, roughly when it happened, the weakness, and the lesson. Do not invent numbers. “As publicly reported, Equifax (2017) was linked to an unpatched web component. Lesson: patch internet-facing apps fast.” “I say ‘a — How do you cite a real breach in an interview without inventing facts? · Download PNG · Open card page

What is your closing line if asked "Are you a hacker?" Say you are a security learner who practises attacks only in your own labs, so you can defend better. “My goal is to help an employer protect customers with least privilege, patching, monitoring and honest reporting.” “I practise offence only in — What is your closing line if asked "Are you a hacker?" · Download PNG · Open card page

What is NAT and why does it matter for security? NAT (Network Address Translation) lets many private devices share one public IP address. All the phones in a home use one public IP on the internet because the router does NAT. “NAT hides the internal layout from casual view, but it is not a firewall. — What is NAT and why does it matter for security? · Download PNG · Open card page

Explain CIDR in simple terms. CIDR writes an IP plus a prefix length, like 10.0.0.0/24, meaning the first 24 bits are the network part. A /24 holds about 254 usable hosts. A bigger prefix number means a smaller network. “I use CIDR to size subnets and to write tight security-group rules, so I don’t — Explain CIDR in simple terms. · Download PNG · Open card page

What is a security group rule you would never leave open on a public Elastic IP for Sahyadri Traders? Never leave MySQL (3306), RDP (3389) or admin panels open to 0.0.0.0/0 (the whole internet). Allow 443 from the internet if the site must be public. Allow SSH (22) only from your home or office IP. — What is a security group rule you would never leave open on a public Elastic IP for Sahyadri Traders? · Download PNG · Open card page

How do you install and start Nginx on Amazon Linux in this course style? On Amazon Linux: sudo yum install nginx -y , then sudo service nginx start , then check with status . Use sudo systemctl enable nginx so it starts again after a reboot. “yum to install, service to start, status to check, and en — How do you install and start Nginx on Amazon Linux in this course style? · Download PNG · Open card page

What is wrong with chmod 777 /var/www/html? 777 makes the web root writable by everyone, so any local user (or a web foothold) can change your site files. Use correct ownership and 755 for folders, 644 for files. The web user should not write, except to jailed upload folders. “777 on the web root in — What is wrong with chmod 777 /var/www/html? · Download PNG · Open card page

How do you list listening ports on Linux? Use ss -tulnp (or netstat) and compare what you see to a known baseline. On a lab web server you expect sshd and the web service, not a strange high port (a possible reverse shell). “I list listeners with ss -tulnp and flag anything that isn’t on my baseline — How do you list listening ports on Linux? · Download PNG · Open card page

Explain users, groups, and sudo at interview level. Give each person a named account . Groups bundle privileges. sudo grants limited admin for specific commands. For a developer, grant only the commands they need, not full NOPASSWD ALL . “Named accounts, groups for privileges, and scoped sudo. I avo — Explain users, groups, and sudo at interview level. · Download PNG · Open card page

How do you check a service and restart it safely? Check status, test the config , then reload or restart. sudo nginx -t (or apachectl configtest ) first, then sudo service nginx reload . “I always config-test before reload. A blind restart with a broken config takes the site down.” A reload with a b — How do you check a service and restart it safely? · Download PNG · Open card page

What Linux process commands do you use daily? ps aux , top or htop to see processes, and logs via journalctl or log files. Use kill only when you understand the process. In an incident, preserve evidence before killing if policy says so. “ps aux and top to look, logs to understand, and I kill only w — What Linux process commands do you use daily? · Download PNG · Open card page

How do you secure SSH on a public EC2 instance? Use key-based login, turn off password login, turn off root login, and allow port 22 only from your IP. Keep packages updated with sudo yum update and add fail2ban . A non-default port is extra depth, not a secret. “Keys only, no password, no root, por — How do you secure SSH on a public EC2 instance? · Download PNG · Open card page

What is the difference between updating packages and patching a web app? sudo yum update patches the OS packages. Your app code, plugins and custom PHP need their own update path. Equifax (2017) was linked to an unpatched app component, not the OS. Internet-facing app parts need patching too. “OS pa — What is the difference between updating packages and patching a web app? · Download PNG · Open card page

How do you change the Nginx document root safely? Edit the root in the server block, run sudo nginx -t , then sudo service nginx reload . If the test fails, fix the config first; do not reload. On enforcing SELinux, the new folder may need the right context. “Change the root, config-test, then reloa — How do you change the Nginx document root safely? · Download PNG · Open card page

What is a virtual host or server block? A virtual host (server block) maps a hostname or port to a site folder, so one machine can host several sites. On one server: shop.example.com and warehouse.example.com, each with its own root folder and log files. “A server block maps a hostname to a site roo — What is a virtual host or server block? · Download PNG · Open card page

What is SQL_SAFE_UPDATES and why does MySQL error 1175 appear? SQL_SAFE_UPDATES blocks an UPDATE or DELETE that has no key-based WHERE. Error 1175 is that block. It stops a beginner from running DELETE FROM orders with no WHERE and wiping the whole table. “I fix the query with a proper key-based WHE — What is SQL_SAFE_UPDATES and why does MySQL error 1175 appear? · Download PNG · Open card page

Should RDS or MySQL listen on the public internet? No. Keep the database private and allow port 3306 only from the app’s security group. Put RDS in a private subnet. The app connects over the internal network, not the public internet. “Public MySQL is a classic small-shop breach. I bind it private a — Should RDS or MySQL listen on the public internet? · Download PNG · Open card page

How do you test PHP syntax before deploy? Run php -l file.php on the server or in CI to catch syntax errors before going live. A missing semicolon can take the whole page down. php -l finds it first. “I run php -l, then re-test the login and order pages on the lab URL.” Syntax-OK is not the same as — How do you test PHP syntax before deploy? · Download PNG · Open card page

What headers or cookie flags do you mention for session security? HttpOnly and Secure on session cookies, SameSite where it fits, and HTTPS everywhere. HttpOnly means JavaScript can’t read the cookie, so an XSS bug can’t steal the session. “HttpOnly, Secure, SameSite and HTTPS together cut session t — What headers or cookie flags do you mention for session security? · Download PNG · Open card page

How do you harden a default web server install? Remove default pages, hide the version, turn off directory listing, run as non-root, patch, and add TLS. A default install often shows a test page and the exact server version, which helps attackers. “I strip defaults, run as a non-root user, add HTTPS — How do you harden a default web server install? · Download PNG · Open card page

How do you enable HTTPS with Certbot in a lab story? On a machine you control with a real domain pointing to it, use Certbot to get a certificate, then reload the web server. Certbot fetches a free Let’s Encrypt certificate and sets up auto-renew so it never expires by surprise. “Certbot for the cer — How do you enable HTTPS with Certbot in a lab story? · Download PNG · Open card page

When would you use a presigned URL? When a file should stay private but a browser needs short-term access, like playing one video. S3 makes a link that works for, say, 15 minutes (Example data), then expires on its own. “Presigned URLs give short, private access. I never put long-lived keys in a mob — When would you use a presigned URL? · Download PNG · Open card page

How should EC2 reach S3 and RDS without access keys in code? Attach an IAM role to the EC2 instance with least-privilege access to the exact bucket and actions. The role lets the app read one S3 bucket. No access keys sit in the code. “I use an instance role, not keys in code, and keep RDS private w — How should EC2 reach S3 and RDS without access keys in code? · Download PNG · Open card page

What belongs on a live-project security checklist? HTTPS on, tight security groups, RDS private, S3 Block Public Access on, IAM role (not root keys), prepared statements, cookie flags, patches, tested backups, CloudTrail on, no secrets in git. Walk down the list before launch and tick each item on y — What belongs on a live-project security checklist? · Download PNG · Open card page

What is the risk of a public RDS snapshot or open 3306? A public snapshot or open port 3306 can expose customer tables to theft or ransomware. Someone copies your snapshot to their account and reads every row. “Private subnet, SG from the app only, encryption at rest, least-privilege users, and no p — What is the risk of a public RDS snapshot or open 3306? · Download PNG · Open card page

How do you explain subdomain takeover at a conceptual level? If a DNS record points to a cloud resource you deleted, someone else can claim it and host content on your hostname. A CNAME points to an old cloud app you removed; an attacker recreates that app and now controls the subdomain. “I inventor — How do you explain subdomain takeover at a conceptual level? · Download PNG · Open card page

What is IMDSv2 and why prefer it? IMDSv2 is the safer version of the EC2 metadata service. It needs a session token, which makes credential theft harder. With old IMDSv1, an SSRF bug could grab the instance’s role credentials in one request. IMDSv2 blocks that easy grab. “I require IMDSv2 and set a — What is IMDSv2 and why prefer it? · Download PNG · Open card page

What does CloudTrail give you? CloudTrail is an API audit log: who called which AWS API, and when. After an incident, CloudTrail shows the leaked key made 100 calls from a strange country (Example data). “Without CloudTrail, AWS incident response is blind. I keep it on and the logs locked.” It is yo — What does CloudTrail give you? · Download PNG · Open card page

What is GuardDuty in one sentence? GuardDuty is a managed AWS service that watches logs and threat intel for suspicious activity. It might flag your instance talking to a known bad IP, or a key used from an odd location. “I treat a GuardDuty alert as a starting point to investigate, not as automatic — What is GuardDuty in one sentence? · Download PNG · Open card page

What do you do if AWS access keys leak on GitHub? Access keys are a username + password for programs to use AWS. If they leak, anyone can use your AWS account. Act fast: turn off the keys first . 1. Deactivate or delete the keys. 2. Change (rotate) other secrets. 3. Check CloudTrail (AWS activity lo — What do you do if AWS access keys leak on GitHub? · Download PNG · Open card page

What is wrong with 0.0.0.0/0 on SSH in a security group? 0.0.0.0/0 means every IP on the internet. SSH (port 22) is used to log in to a server. A security group is the AWS firewall. So this rule lets anyone in the world try to log in. A new EC2 server (a cloud computer on AWS) with SSH open to 0.0.0 — What is wrong with 0.0.0.0/0 on SSH in a security group? · Download PNG · Open card page

How do you design a simple three-tier VPC story? Public subnet for the load balancer/bastion, private subnets for app and database, NAT for outbound patching. The warehouse database sits in a private subnet with no public IP, reachable only from the app tier. “Three tiers, security groups between th — How do you design a simple three-tier VPC story? · Download PNG · Open card page

Name the high-level ethical hacking phases defensively. Recon, scanning, gaining access, maintaining access, covering tracks. They are taught so defenders know where to put controls. At “recon” you reduce public info; at “covering tracks” you keep immutable logs. “I learn the attacker phases to plac — Name the high-level ethical hacking phases defensively. · Download PNG · Open card page

What is the OWASP Top 10 used for? The OWASP Top 10 is a well-known list of common web app risks, like injection and broken access control. Use it to prioritise fixes on your own DVWA/Juice Shop lab. “I use the OWASP Top 10 to prioritise fixes, not as a legal attack guide.” It helps you fix the risk — What is the OWASP Top 10 used for? · Download PNG · Open card page

What is IDOR? IDOR = Insecure Direct Object Reference. A user changes an ID number in a link and sees another user’s data , because the server does not check who owns it. Ravi opens shop.example/order?id= 1001 (his order). He changes it to id= 1002 and sees Priya’s name and address. That is IDOR. “T — What is IDOR? · Download PNG · Open card page

When do you mention Nmap in an interview? Say you use Nmap to list ports and services on hosts you own, with gentle timing and clear scope. Use -T2 timing in a shared lab so you don’t flood it. “I scan hosts I own, and Blue uses the same info to know what should be listening.” Framing it with scope — When do you mention Nmap in an interview? · Download PNG · Open card page

How do you talk about sqlmap without sounding reckless? Say you ran sqlmap only on your own DVWA/Juice lab to understand the noise, then focused on the fix. After testing, you add prepared statements so sqlmap-style attacks fail. “I ran it on my own lab to learn detection, then I fixed the code so i — How do you talk about sqlmap without sounding reckless? · Download PNG · Open card page

How do you describe a good vulnerability report? Title, severity, the affected asset, steps to reproduce, impact, and a clear fix. “SQL injection on /order?id=, high severity, steps 1–3, impact: read all orders, fix: prepared statements.” “A good report lets someone reproduce and fix it without aski — How do you describe a good vulnerability report? · Download PNG · Open card page

How do you triage a brute-force SSH alert? Check the source IP and volume, confirm if any login succeeded , block or rate-limit, and verify key-only login. Thousands of failures then one success means the account may be compromised, so escalate. “The key question is: did any attempt succeed? If yes, — How do you triage a brute-force SSH alert? · Download PNG · Open card page

Why are immutable logs important? Attackers delete local logs to hide. Immutable (write-once) logs keep the evidence safe. Shipping logs to a locked SIEM or a locked S3 bucket means the attacker can’t erase them. “CloudTrail to a locked bucket is the AWS version of keeping evidence safe.” If logs ca — Why are immutable logs important? · Download PNG · Open card page

What is AES-GCM associated with? AES-GCM is modern authenticated encryption: it gives both secrecy and integrity. It protects data and also detects if someone tampered with it. “I talk algorithms at concept level but stress key management: KMS, rotation, access control.” Strong encryption is useless — What is AES-GCM associated with? · Download PNG · Open card page

Why disable old TLS versions? Old TLS and SSL versions have known weaknesses, so you turn them off and use TLS 1.2/1.3 . Configure strong ciphers and test the result with a lab scanner. “I allow only TLS 1.2 and 1.3 with strong ciphers, then verify with a tool.” An old protocol can let an attacker d — Why disable old TLS versions? · Download PNG · Open card page

How do you explain fail2ban quickly? fail2ban watches logs for repeated failures and temporarily bans those IPs with firewall rules. After 5 failed SSH logins (Example data), the IP is blocked for a while. “fail2ban cuts brute-force noise, but it’s not a replacement for key-only login and SG allow-l — How do you explain fail2ban quickly? · Download PNG · Open card page

What is Kerberoasting at a conceptual defensive level? Kerberoasting : an attacker requests service tickets for accounts with SPNs, then cracks weak service passwords offline. A service account with a short password gets cracked away from the network. “Defence: gMSA or long random passwords, AES Ker — What is Kerberoasting at a conceptual defensive level? · Download PNG · Open card page

Pass-the-Hash – what do defenders do? Pass-the-Hash reuses an NTLM password hash to log in without knowing the plain password. An attacker who grabs a hash on one PC uses it to authenticate elsewhere. “Defence: LAPS, Credential Guard, fewer local admins, prefer Kerberos, and tiered admin.” It lets a — Pass-the-Hash – what do defenders do? · Download PNG · Open card page

How do you talk about malware types without fear-mongering? Group malware by behaviour: trojan, ransomware, worm, spyware, wiper . Then focus on prevent, detect, respond. Ransomware encrypts files for money; the defence is tested offline backups. “I classify by behaviour, then stress least privilege — How do you talk about malware types without fear-mongering? · Download PNG · Open card page

What session attacks should a web defender know? Session hijacking (via XSS or sniffing HTTP), fixation , and weak logout. On plain HTTP, an attacker on the same Wi-Fi can read the session cookie. “Fixes: HTTPS, cookie flags, regenerate the session id on login, short timeouts, server-side logout.” A — What session attacks should a web defender know? · Download PNG · Open card page

IoT camera in a shop – defensive talking points? Change default passwords, put IoT on its own network, keep firmware updated, and never expose admin panels to the internet. Shop cameras sit on a guest/IoT network, away from the point-of-sale and office systems. “Default-password change, network isol — IoT camera in a shop – defensive talking points? · Download PNG · Open card page

Mobile app security basics for interviews? HTTPS only, no secrets in the app file, certificate pinning where it fits, safe storage, fewer permissions, and updates. Never hardcode an API key in the APK; attackers can unpack and read it. “HTTPS, no secrets in the APK, least permissions, and I test on — Mobile app security basics for interviews? · Download PNG · Open card page

How do you explain lateral movement simply? After one foothold, attackers jump to other machines using stolen credentials or trust links. An attacker on a reception PC uses a reused admin password to reach the server. “Segmentation, LAPS, tiering, and alerts on unusual logins stop the jump.” Stoppin — How do you explain lateral movement simply? · Download PNG · Open card page

What is defence-in-depth? Defence-in-depth means many layers, so one failure doesn’t end the story. Perimeter, identity, patching, secure code, logging and backups all back each other up. “I prefer several boring layers over one magic box.” Any single control can fail. Layers mean an attacker must b — What is defence-in-depth? · Download PNG · Open card page

How is this MNC chapter different from the general interview chapter? The general chapter teaches fundamentals. This one maps themes that candidates reported from public MNC interviews. A theme tied to a company comes from a public candidate post, not a secret question bank. “I prepared the concepts — How is this MNC chapter different from the general interview chapter? · Download PNG · Open card page

When may you name a company in an answer? Only when a public page actually reported that theme for that company. A TechGig article on a company’s security questions, or a GeeksforGeeks experience post. “I name a company only if a public source backs the theme, and I say which kind of source.” Claimi — When may you name a company in an answer? · Download PNG · Open card page

What does "candidate-reported" mean in your mouth? It means a candidate or career site published that a theme came up. It is not an official question bank. “A candidate wrote online that this topic was asked” is different from “the company gave me this list.” “I prepare the concept, not a memorised — What does "candidate-reported" mean in your mouth? · Download PNG · Open card page

How do you open any answer that sounds offensive? Start with ethics : offensive tools only on systems you own or have written permission to test. “In training I use host-only VirtualBox and my own AWS Free Tier.” “Ethics first, then I explain the technical idea and the defence.” Leading with scope s — How do you open any answer that sounds offensive? · Download PNG · Open card page

How do you use STAR with MNC SOC questions? Use STAR : Situation, Task, Action, Result, built on your own lab scenarios. Situation: a lab alert. Task: triage. Action: read logs, contain, fix. Result: re-verify and document. “I frame SOC answers as STAR, and I never present a lab story as a real brea — How do you use STAR with MNC SOC questions? · Download PNG · Open card page

What if the interviewer asks which MNC asked which exact question? Say you prepare from public candidate reports and concept mastery, not leaked private question banks. “I can discuss this theme confidently, but I won’t claim a secret company list.” “I prepare from public reports and strong concepts — What if the interviewer asks which MNC asked which exact question? · Download PNG · Open card page

How do you cite an MNC-related theme without inventing facts? Name the theme, say it is candidate-reported , and if a public source backs a company, name the source type. “This is a candidate-reported theme; a TechGig article mentions it for that company.” “Theme first, candidate-reported label, and — How do you cite an MNC-related theme without inventing facts? · Download PNG · Open card page

How do you cite a real breach without inventing numbers? Name the incident, the well-known timeframe, the weakness, and the lesson. Say “as reported” for scale. “As reported, Capital One (2019) involved a cloud misconfiguration. Lesson: tighten IAM and metadata access.” “I give the theme and the con — How do you cite a real breach without inventing numbers? · Download PNG · Open card page

What NIST CSF functions should you remember for Wipro-style rounds? Identify, Protect, Detect, Respond, Recover — the five NIST CSF functions. A SOC day maps to them: asset inventory (Identify), hardening (Protect), SIEM (Detect), playbooks (Respond), backups (Recover). “I map my work to the five fu — What NIST CSF functions should you remember for Wipro-style rounds? · Download PNG · Open card page

Closing line if asked "Will you hack our client in week one?" Say you follow written scope, the law, and employer process, and you practise offence only in your own labs. “I’d help defend the client with least privilege, patching, monitoring and honest escalation.” “I act only within written scope, — Closing line if asked "Will you hack our client in week one?" · Download PNG · Open card page

What is the Cyber Kill Chain at interview level? The Cyber Kill Chain is an attacker-path model: recon, weaponise, deliver, exploit, install, command-and-control, actions on objectives. Use it to ask where you’d detect phishing delivery vs command-and-control traffic. “I use the kill chain to struct — What is the Cyber Kill Chain at interview level? · Download PNG · Open card page

OSI model – where does FTP fit, and what do interviewers want? FTP is an application-layer protocol for file transfer, and it rides on TCP. Plain FTP sends the password in cleartext; SFTP or FTPS are the safe choices. “They want placement sense. I put FTP at the application layer and map controls to — OSI model – where does FTP fit, and what do interviewers want? · Download PNG · Open card page

What is traceroute used for? Traceroute shows the list of hops (routers) that your packets pass through to reach a destination. In troubleshooting, it shows where traffic stops, so you know which hop has the problem. “I use traceroute to find where traffic breaks, and I remember path info can leak n — What is traceroute used for? · Download PNG · Open card page

How do you install and check a web service on Amazon Linux in this course style? On Amazon Linux: sudo yum install httpd -y (or nginx), then sudo service httpd start , then check with status . sudo service httpd status confirms it’s running before you test the site in a browser. “yum to install, ser — How do you install and check a web service on Amazon Linux in this course style? · Download PNG · Open card page

What Windows Event ID indicates a successful logon? Event ID 4624 is a successful Windows logon. For each 4624 you still check the logon type, account, source IP, time, and if it fits the user’s normal pattern. “4624 is a successful logon, but success isn’t automatically safe. I check the context.” — What Windows Event ID indicates a successful logon? · Download PNG · Open card page

What does Event ID 4625 tell you? Event ID 4625 is a failed Windows logon. Many 4625s then a 4624 from the same IP can mean a brute-force that finally worked. “I correlate failed logons with any later success from the same source and odd hours.” It’s the pattern, not a single 4625, that signals an a — What does Event ID 4625 tell you? · Download PNG · Open card page

How do you list listening ports on Linux in an interview? Use ss -tulnp and compare the result to a known baseline. On a lab web server you expect sshd and the web service, not a strange high port. “I list listeners with ss -tulnp and flag anything that isn’t on my baseline.” An unexpected listening — How do you list listening ports on Linux in an interview? · Download PNG · Open card page

Why is chmod 777 on a web root a bad answer to "make it work"? 777 makes the web root writable by everyone, which invites defacement and webshells after a foothold. Use 755 for folders and 644 for files, with correct ownership instead. “777 is a least-privilege failure. I use 755/644 and tight owner — Why is chmod 777 on a web root a bad answer to "make it work"? · Download PNG · Open card page

How do you restart a service safely after a config change? Config-test first , then reload or restart. sudo nginx -t (or apachectl configtest ), then sudo service nginx reload . “I always test the config before reload, so a typo doesn’t take the site down.” A blind restart with a broken config crash — How do you restart a service safely after a config change? · Download PNG · Open card page

Observed ping.exe on a Windows host – how do you investigate at L1 level? Treat ping.exe as a signal, not a verdict. It can be normal troubleshooting or recon. Check the parent process, the user, the destination IPs, and whether it fits that user’s normal behaviour. “I don’t panic on ping. I check p — Observed ping.exe on a Windows host – how do you investigate at L1 level? · Download PNG · Open card page

Walk through how you triage a phishing alert. Check the email headers and SPF/DKIM/DMARC , the URL/attachment reputation, and whether the user clicked. If they clicked, check proxy/DNS/EDR for what happened next, and isolate only if evidence supports it. “Headers and auth first, then click evidence, — Walk through how you triage a phishing alert. · Download PNG · Open card page

Explain one true-positive scenario you can defend in interview. Give a real-feeling example: many 4625 failures on a service account from an odd IP, then a 4624 , plus a rare process tree. That combination means the attacker likely got in, so you escalate and reset the account. “My true positive was — Explain one true-positive scenario you can defend in interview. · Download PNG · Open card page

Explain persistence in MITRE terms. Persistence is how an attacker survives a reboot or re-login: scheduled tasks, services, startup items, new accounts. A new auto-start service that launches their tool every boot is persistence. “Blue looks for new autostart entries, odd services, and new accounts — Explain persistence in MITRE terms. · Download PNG · Open card page

Explain lateral movement as a defender. Lateral movement is jumping from one machine to others using stolen credentials or remote admin tools. Signs: unusual SMB/RDP/WinRM logins between workstations, or sudden admin use on many hosts. “I watch for workstation-to-workstation admin logins and odd ser — Explain lateral movement as a defender. · Download PNG · Open card page

Connection established from an external IP – investigate and mitigate? Identify the process, user, destination, port, volume , and whether data left. If a strange process is sending large data to an unknown IP, isolate the host or block it at the firewall. “I find the process behind the connection, — Connection established from an external IP – investigate and mitigate? · Download PNG · Open card page

How do you handle three critical alerts at once? Do a fast impact skim: crown-jewel or domain-controller assets first, active spreading next, then document. A domain controller alert beats a single test-PC alert, so you take it first. “I prioritise by asset value and active spread, and I document as — How do you handle three critical alerts at once? · Download PNG · Open card page

What logs matter most in a typical incident? Firewall, EDR/endpoint, authentication (AD/VPN), DNS, email gateway, web proxy, and critical server logs. In cloud, add CloudTrail and control-plane logs. “I name the big log sources and say cloud adds CloudTrail.” Knowing where to look first saves precio — What logs matter most in a typical incident? · Download PNG · Open card page

What is alert fatigue and what do you do about it? Alert fatigue is when too many low-value alerts train analysts to click “Close” without thinking. A noisy rule that fires 500 times a day (Example data) gets ignored, so a real one is missed. “I tune or add exceptions to noisy rules, and I document — What is alert fatigue and what do you do about it? · Download PNG · Open card page

What is Kerberos in one defensive sentence? Kerberos is a ticket-based login system common in Active Directory. Instead of sending the password each time, it hands out time-limited tickets. “Defenders care because ticket abuse and weak accounts open privilege paths.” Understanding tickets helps you — What is Kerberos in one defensive sentence? · Download PNG · Open card page

What is NTLM and why do defenders still care? NTLM is an older Windows login method still used in some compatibility paths. It has known relay and hash-theft problems in attacker playbooks. “I reduce NTLM where I can and monitor where it’s still used.” Old NTLM paths are a quiet way for attackers to — What is NTLM and why do defenders still care? · Download PNG · Open card page

What is Pass-the-Hash at awareness level? Pass-the-Hash is reusing a stolen password hash to log in without the plain password. An attacker grabs a hash on one PC and authenticates to another with it. “Defence: limit lateral admin, Credential Guard/LAPS, and tiered administration.” It lets attackers — What is Pass-the-Hash at awareness level? · Download PNG · Open card page

What Kerberos-related Event ID themes should a SOC analyst know? Watch Event ID 4769 (service ticket requests) for anomalies: odd SPNs, bursts, or unusual hours. A sudden burst of 4769 for many service accounts can mean Kerberoasting. “4769 anomalies are a common SOC talking point for AD attacks.” T — What Kerberos-related Event ID themes should a SOC analyst know? · Download PNG · Open card page

How would you talk about Kerberoasting without teaching the attack? Explain the idea: weak passwords on service accounts with SPNs are easy targets. Then pivot to defence. Defence: long random service-account passwords or gMSA, and monitoring odd ticket requests. “I explain the risk and the fix, not — How would you talk about Kerberoasting without teaching the attack? · Download PNG · Open card page

Why must identity answers stay ethics-first in MNC interviews? Because sounding like a ready-to-run AD attacker can fail a background or ethics check. Show you understand attacker goals so you can detect them, not perform them. “I frame identity attacks as things I detect and prevent.” Ethics-first — Why must identity answers stay ethics-first in MNC interviews? · Download PNG · Open card page

What AWS mistakes do interviewers expect you to catch? Public S3 without Block Public Access, IAM users with unused keys, and security groups open to 0.0.0.0/0. An old access key no one uses is a leak waiting to happen; remove it. “I look for public buckets, stale keys, and wide-open SGs.” These thr — What AWS mistakes do interviewers expect you to catch? · Download PNG · Open card page

Explain least privilege for IAM. Grant only the actions and resources a task needs, and prefer roles over embedded keys. A developer gets access to one bucket, not AdministratorAccess “for speed”. “Least privilege plus roles on EC2, and I review unused permissions.” Over-broad access means one leake — Explain least privilege for IAM. · Download PNG · Open card page

How do you respond if AWS keys were committed to a public repo? Deactivate the keys immediately, rotate secrets, check CloudTrail, scrub git history, move to roles. Deleting the file is not enough; the key stays in git history. “Kill the keys first, check CloudTrail for abuse, then move the app to a — How do you respond if AWS keys were committed to a public repo? · Download PNG · Open card page

Why enable CloudTrail and GuardDuty in a talking-point answer? CloudTrail records who called which AWS API; GuardDuty adds managed threat detection. CloudTrail shows the leaked key’s calls; GuardDuty flags the odd location. “CloudTrail for the audit trail, GuardDuty for the alerts, both on by defaul — Why enable CloudTrail and GuardDuty in a talking-point answer? · Download PNG · Open card page

How does encryption protect data at rest? Encryption at rest turns stored data into unreadable ciphertext without the key. If someone steals a disk or snapshot, they can’t easily read the data. “I encrypt at rest and manage keys carefully with KMS, because the key is the weak point.” Encryption only — How does encryption protect data at rest? · Download PNG · Open card page

Zero-day – what do you say in an MNC round? A zero-day is a vulnerability with no public patch at the time it’s found or exploited. You can’t patch it yet, so you lean on layers: least privilege, EDR behaviour detection, segmentation. “Defence-in-depth buys time until the vendor fix lands, then I pa — Zero-day – what do you say in an MNC round? · Download PNG · Open card page

What OWASP Top 10 themes should you be ready for? Be ready to explain injection, broken access control/IDOR, XSS, misconfiguration, and SSRF, with fixes. Fixes: prepared statements, server-side authorisation checks, output encoding + CSP. “For each risk I give the defender view and the concrete fix. — What OWASP Top 10 themes should you be ready for? · Download PNG · Open card page

Why mention Wireshark? Wireshark captures and analyses network packets. In a lab you can see the difference between cleartext HTTP and encrypted TLS. “I use Wireshark in labs to understand protocols, and I review PCAP only within authorised scope.” Capturing traffic you’re not authorised to see is i — Why mention Wireshark? · Download PNG · Open card page

Explain SPF, DKIM, and DMARC. SPF lists allowed sending servers; DKIM signs the message; DMARC says what to do when checks fail. DMARC can tell receivers to quarantine or reject spoofed mail and send you reports. “Together they stop most email spoofing of a domain.” Without them, anyone can forge em — Explain SPF, DKIM, and DMARC. · Download PNG · Open card page

User clicked a phishing URL – where do you look? Look at the email headers, URL-rewrite logs, proxy/DNS for the destination, and EDR for the process tree. Also check identity logs for MFA fatigue or new sessions, and mailbox rules for persistence. “Mail, proxy/DNS, EDR, identity, and mailbox rules, — User clicked a phishing URL – where do you look? · Download PNG · Open card page

Social engineering – definition for MNC rounds? Social engineering is tricking people into revealing secrets or doing unsafe actions. A fake “boss” email asking to change bank details for a payment. “Defence: awareness, authorised phishing tests, out-of-band verification, and email controls.” People — Social engineering – definition for MNC rounds? · Download PNG · Open card page

Phases of a penetration test – how do you answer ethically? Scoping/rules of engagement, recon, scanning, exploitation (in scope only), post-exploitation awareness, reporting, remediation. It starts with written permission and ends with helping fix what you found. “I stress written scope at the star — Phases of a penetration test – how do you answer ethically? · Download PNG · Open card page

Scenario: Sahyadri Pune EC2 shows thousands of failed SSH attempts. Steps? Check if any login succeeded , tighten the security group to known IPs, and confirm key-only SSH. Add fail2ban and review GuardDuty/CloudTrail if they are on. “The key question is whether any attempt succeeded, then I lock do — Scenario: Sahyadri Pune EC2 shows thousands of failed SSH attempts. Steps? · Download PNG · Open card page

Scenario: Incomplete alert data is escalated to you – what do you do? Work with what you have, list the missing fields, pull related logs yourself, and set a time box. If crown-jewel assets may be involved, escalate upward rather than wait. “I don’t freeze on missing data. I gather more, time-box it — Scenario: Incomplete alert data is escalated to you – what do you do? · Download PNG · Open card page

Scenario: Privileged account shows unusual activity. Investigation outline? Verify with the human owner out-of-band , check MFA status, and review recent actions. Call or message the owner directly to confirm it was really them, not just trust the chat. “Out-of-band check with the owner, MFA review, — Scenario: Privileged account shows unusual activity. Investigation outline? · Download PNG · Open card page

HR: Why should we hire you for a cyber/SOC role? Ethics-first habits, solid networking and Linux basics, own-lab Build-Hack-Fix evidence, and clear communication. “I can hand over a shift clearly and I learn tools fast because I understand the fundamentals.” “I bring ethics, fundamentals, real lab p — HR: Why should we hire you for a cyber/SOC role? · Download PNG · Open card page

HR: What if we assign you a role other than cybersecurity? Stay professional: add value in adjacent IT while you keep building security skills. Ask how the role connects to security later, instead of threatening to leave. “I’d contribute where needed and keep growing toward security.” A mature answe — HR: What if we assign you a role other than cybersecurity? · Download PNG · Open card page

HR + tech: Are you comfortable with shifts / any location? Be honest about your constraints, show you understand SOCs need coverage, and ask about shift patterns. Ask about handover quality and rotation instead of promising “anywhere forever”. “I’m honest about constraints and I understand coverage — HR + tech: Are you comfortable with shifts / any location? · Download PNG · Open card page

Scenario: Interviewer asks you to scan their production Wi-Fi during the interview. Refuse politely. You only scan with written authorisation . Offer to discuss your method or show screenshots from your host-only lab instead. “I’d love to help, but I only scan with written permission.” Agreeing to a — Scenario: Interviewer asks you to scan their production Wi-Fi during the interview. · Download PNG · Open card page

Explain a two-minute Build-Hack-Fix story for MNC interviews. Tell it in one minute: build a weak app, hack it in your lab, fix it, then re-test. “I built a weak PHP order lookup on a host-only VM, proved SQL injection from Kali, then fixed it with prepared statements.” “Build, hack, fix, re-verify, — Explain a two-minute Build-Hack-Fix story for MNC interviews. · Download PNG · Open card page

Before any Nmap scan in a professional engagement, what must exist first? A. A Metasploit workspace B. Written authorisation and agreed scope C. A public CVE blog post D. A honeypot on the target LAN B. Written authorisation and agreed scope Scanning a network without permission is illegal, so writt — Before any Nmap scan in a professional engagement, what must exist first? · Download PNG · Open card page

Passive footprinting mainly uses: A. Exploit kits against the mail server B. Public sources without directly touching the target much C. SQL injection on the login form D. ARP spoofing on the OT VLAN B. Public sources without directly touching the target much Passive footprinting gathers information — Passive footprinting mainly uses: · Download PNG · Open card page

Amass in passive mode is best described as: A. A ransomware encryptor B. A subdomain discovery approach using public/DNS intelligence sources C. A wireless cracker D. A session-cookie editor B. A subdomain discovery approach using public/DNS intelligence sources Amass in passive mode finds subdomain — Amass in passive mode is best described as: · Download PNG · Open card page

Which Nmap-style activity belongs only on OWN or authorised ranges? A. Updating Kali B. Host/port discovery scans C. Reading a public CVE page D. Enabling MFA on your Gmail B. Host/port discovery scans Host and port discovery scans actively contact the target, which is illegal without permission, so — Which Nmap-style activity belongs only on OWN or authorised ranges? · Download PNG · Open card page

A Blue team sees a sudden burst of SYN packets to many ports on one EIP. Likely interpretation? A. Normal DNS recursion B. Possible port scan / recon noise C. Successful TLS handshake only D. SPF pass for email B. Possible port scan / recon noise A sudden burst of SYN packets to many ports on one ad — A Blue team sees a sudden burst of SYN packets to many ports on one EIP. Likely interpretation? · Download PNG · Open card page

Enumeration differs from basic port scanning because it: A. Always encrypts disks B. Pulls extra details from open services (users, shares, banners) after ports are known C. Replaces the need for patching D. Is legal on any cafe Wi-Fi B. Pulls extra details from open services (users, shares, banners — Enumeration differs from basic port scanning because it: · Download PNG · Open card page

Closing null-session style SMB risks and logging LDAP binds primarily helps against: A. DNSSEC misconfig only B. Over-friendly enumeration of directory/share data C. AES-GCM D. Certbot renewals B. Over-friendly enumeration of directory/share data Null-session SMB and open LDAP let an attacker read d — Closing null-session style SMB risks and logging LDAP binds primarily helps against: · Download PNG · Open card page

Best first use of a vulnerability scanner report? A. Blindly launch every exploit B. Prioritise by exposure and severity, then patch / mitigate C. Publish the full report on Twitter D. Disable all logging B. Prioritise by exposure and severity, then patch / mitigate A scanner report is just a list, — Best first use of a vulnerability scanner report? · Download PNG · Open card page

For Sahyadri’s public web VM, which finding usually jumps the queue? A. Info-level missing HTTP header on an internal printer B. Critical CVE on the internet-facing web framework C. Lab-only outdated package on host-only .20 with no route out D. A typo in a comment B. Critical CVE on the internet-fa — For Sahyadri’s public web VM, which finding usually jumps the queue? · Download PNG · Open card page

Least privilege mainly means: A. Everyone is Administrator for convenience B. Accounts get only the access needed for their role C. Disabling TLS D. Sharing one root password on WhatsApp B. Accounts get only the access needed for their role Least privilege means each account gets only the access its — Least privilege mainly means: · Download PNG · Open card page

After a weak password is guessed on an OWN lab SSH, Blue’s durable fixes include: A. Posting the password in a gist B. Key-based auth, fail2ban-style controls, MFA where possible, monitoring failed logins C. Opening port 22 to 0.0.0.0/0 forever D. Turning off all logs B. Key-based auth, fail2ban-sty — After a weak password is guessed on an OWN lab SSH, Blue’s durable fixes include: · Download PNG · Open card page

Which statement is safest training practice for malware? A. Email mystery samples to friends B. Study concepts and use isolated lab samples under guidance – never detonate on production C. Disable AV globally at the shop D. Pay every ransom immediately without IR advice B. Study concepts and use iso — Which statement is safest training practice for malware? · Download PNG · Open card page

Offline / tested backups most directly support recovery from: A. SPF alignment only B. Ransomware / destructive malware availability loss C. CSS styling bugs D. Certificate Transparency logs B. Ransomware / destructive malware availability loss Ransomware encrypts or destroys live data, so an offlin — Offline / tested backups most directly support recovery from: · Download PNG · Open card page

Cleartext FTP on a shared segment is risky mainly because: A. FTP cannot transfer files B. Credentials and data may be sniffed by others on the path C. FTP forces Argon2 D. FTP disables ARP B. Credentials and data may be sniffed by others on the path Plain FTP sends the password and data unencrypted — Cleartext FTP on a shared segment is risky mainly because: · Download PNG · Open card page

Wireshark in a SOC-oriented story is primarily a tool to: A. Encrypt S3 buckets B. Inspect packets for troubleshooting and detection learning C. Replace IAM D. Mine Bitcoin on EC2 B. Inspect packets for troubleshooting and detection learning Wireshark captures and reads packets, so in a SOC it is ma — Wireshark in a SOC-oriented story is primarily a tool to: · Download PNG · Open card page

Best single control that stops many credential-phishing successes: A. Longer company motto B. MFA plus user reporting culture C. Disabling HTTPS D. Public RDP with blank password B. MFA plus user reporting culture Even if a password is phished, MFA blocks the login without the second factor, so MFA — Best single control that stops many credential-phishing successes: · Download PNG · Open card page

A consented phishing simulation at Raja-Rani Traders requires: A. No management awareness B. Clear authorisation, education goal, and no real harm to customers C. Targeting a rival shop’s CEO D. Publishing clicked passwords online B. Clear authorisation, education goal, and no real harm to customers — A consented phishing simulation at Raja-Rani Traders requires: · Download PNG · Open card page

DoS/DDoS primarily targets which CIA pillar? A. Confidentiality of one password file only B. Integrity of a single JPG C. Availability for legitimate users D. Non-repudiation certificates only C. Availability for legitimate users A denial-of-service flood tries to make a service unreachable, so it a — DoS/DDoS primarily targets which CIA pillar? · Download PNG · Open card page

Which is an acceptable Blue response pattern to volumetric floods? A. Launch your own flood at the suspected source from home broadband B. Rate limits, filtering, capacity/DDoS protection services, and an IR playbook C. Disable all monitoring to save CPU D. Open every port so traffic "spreads out" B — Which is an acceptable Blue response pattern to volumetric floods? · Download PNG · Open card page

Name the five high-level ethical hacking phases in order (awareness level). Reconnaissance, scanning, gaining access, maintaining access, covering tracks – taught as a model; real work also emphasises reporting and remediation. Always authorised. “Reconnaissance, scanning, gaining access, maintainin — Name the five high-level ethical hacking phases in order (awareness level). · Download PNG · Open card page

Why is host-only 192.168.56.0/24 used in this book’s Kali labs? To keep offensive traffic inside a private lab network you control, reducing accidental scans of production or neighbour networks. “To keep offensive traffic inside a private lab network you control, reducing accidental scans of product — Why is host-only 192.168.56.0/24 used in this book’s Kali labs? · Download PNG · Open card page

Module 04: give one Blue control for DNS enumeration risk. Restrict zone transfers (AXFR) to authorised secondaries; monitor; consider split DNS. “Restrict zone transfers (AXFR) to authorised secondaries; monitor; consider split DNS.” Answer only for your own lab or with written permission. Unauthor — Module 04: give one Blue control for DNS enumeration risk. · Download PNG · Open card page

Module 06: why are password dumps in exam answers a bad habit? Real dumps and crack recipes can be abused; discuss controls (MFA, hashing, rate limits) and OWN-lab practice only. “Real dumps and crack recipes can be abused; discuss controls (MFA, hashing, rate limits) and OWN-lab practice only.” Ans — Module 06: why are password dumps in exam answers a bad habit? · Download PNG · Open card page

Module 09: name three email authentication building blocks defenders cite. SPF, DKIM, and DMARC. “SPF, DKIM, and DMARC.” Answer only for your own lab or with written permission. Unauthorised access is a crime. — Module 09: name three email authentication building blocks defenders cite. · Download PNG · Open card page

Which cookie flag helps stop JavaScript on the page from reading the session cookie? A. Secure only B. HttpOnly C. Max-Age=31536000 always D. Path=/ B. HttpOnly The HttpOnly flag tells the browser not to let JavaScript read the cookie, so an XSS bug on the page cannot steal the session cookie. — Which cookie flag helps stop JavaScript on the page from reading the session cookie? · Download PNG · Open card page

Session cookies on plain HTTP are dangerous because: A. HTTP is faster forever B. On-path observers may steal cookies (lab sniff demos) C. Cookies cannot exist on HTTP D. TLS forbids cookies B. On-path observers may steal cookies (lab sniff demos) On plain HTTP the cookie travels unencrypted, so any — Session cookies on plain HTTP are dangerous because: · Download PNG · Open card page

A honeypot should be: A. Bridged straight into production AD with Domain Admin B. Isolated so compromise cannot pivot into real Sahyadri systems C. The only firewall rule D. Disabled logging B. Isolated so compromise cannot pivot into real Sahyadri systems A honeypot is meant to be attacked, so it m — A honeypot should be: · Download PNG · Open card page

Slow / fragmented scan ideas exist in attacker literature mainly to: A. Improve video codecs B. Attempt to reduce noisy detection – defenders still use layered controls and tuning C. Replace patching D. Mint TLS certificates B. Attempt to reduce noisy detection – defenders still use layered controls — Slow / fragmented scan ideas exist in attacker literature mainly to: · Download PNG · Open card page

Outdated Apache/Nginx on a public EIP most clearly maps to: A. Perfect security B. Patch / harden web server module risks C. DNS only D. Bluetooth pairing B. Patch / harden web server module risks An outdated public web server has known, published vulnerabilities, so the clear risk is an unpatched w — Outdated Apache/Nginx on a public EIP most clearly maps to: · Download PNG · Open card page

After changing Nginx config on Amazon Linux lab, a safe habit is: A. Reboot the hypervisor twice B. Test config (nginx -t) then sudo service nginx reload or restart as appropriate C. chmod 777 the entire /etc D. Disable the access log forever B. Test config (nginx -t) then sudo service nginx reload — After changing Nginx config on Amazon Linux lab, a safe habit is: · Download PNG · Open card page

Broken access control / IDOR mainly means: A. CSS colour wrong B. Users can reach other users’ objects by changing an identifier without authZ checks C. Disk full D. NTP drift B. Users can reach other users’ objects by changing an identifier without authZ checks IDOR means the server does not check — Broken access control / IDOR mainly means: · Download PNG · Open card page

A solid XSS defence direction is: A. Disable all HTTPS B. Context-appropriate output encoding plus CSP mindset C. Store passwords in MD5 D. Open Redis to the world B. Context-appropriate output encoding plus CSP mindset XSS happens when user input is rendered as script, so the fix is context-appropr — A solid XSS defence direction is: · Download PNG · Open card page

The durable fix for classic string-concat SQL injection is: A. More CSS B. Prepared statements / parameterised queries C. Turning off the database D. Using FTP for queries B. Prepared statements / parameterised queries String-concat SQL mixes data with the query, so the durable fix is prepared state — The durable fix for classic string-concat SQL injection is: · Download PNG · Open card page

In exam/interview English, describe SQLi risk without a working payload string: A. Paste a full real-world exploit chain B. Say a crafted input can change the WHERE clause logic when concatenated into SQL C. Refuse to discuss SQLi at all D. Claim SQLi is fixed by emoji B. Say a crafted input can cha — In exam/interview English, describe SQLi risk without a working payload string: · Download PNG · Open card page

Acceptable wireless practice target for students in this book: A. Airport free Wi-Fi clients B. An access point / lab router you own or have written permission to test C. Neighbour’s home SSID D. Random WPS PINs on the street B. An access point / lab router you own or have written permission to test — Acceptable wireless practice target for students in this book: · Download PNG · Open card page

Guest Wi-Fi isolation helps mainly by: A. Speeding Netflix on OT PLCs B. Keeping guest devices from freely reaching internal Raja-Rani POS/LAN segments C. Disabling WPA3 D. Removing all passwords B. Keeping guest devices from freely reaching internal Raja-Rani POS/LAN segments Guest Wi-Fi isolation — Guest Wi-Fi isolation helps mainly by: · Download PNG · Open card page

Sideloading unknown APKs mainly increases risk of: A. Better battery myths only B. Malicious apps bypassing store review controls C. Stronger TLS D. Automatic Argon2 B. Malicious apps bypassing store review controls Sideloaded apps skip the store's safety checks, so the main risk is installing malic — Sideloading unknown APKs mainly increases risk of: · Download PNG · Open card page

A Blue mobile hygiene list for staff phones should include: A. No screen lock ever B. OS/app updates, screen lock, careful permissions, official stores / MDM where used C. Jailbreak required for email D. Same root password as the EC2 box B. OS/app updates, screen lock, careful permissions, official — A Blue mobile hygiene list for staff phones should include: · Download PNG · Open card page

Default passwords on internet-facing IP cameras are dangerous because: A. Cameras cannot stream B. Attackers worldwide try well-known defaults C. Defaults enable DMARC D. Defaults force WPA3 B. Attackers worldwide try well-known defaults Default passwords are public knowledge, so attackers worldwide — Default passwords on internet-facing IP cameras are dangerous because: · Download PNG · Open card page

Flat IT + OT network without segmentation mainly risks: A. Faster printing only B. Office malware/pathways reaching sensitive plant/IoT segments C. Better bcrypt D. Automatic cloud backups B. Office malware/pathways reaching sensitive plant/IoT segments With no segmentation, office malware can trave — Flat IT + OT network without segmentation mainly risks: · Download PNG · Open card page

Long-lived IAM access keys committed to GitHub are risky because: A. GitHub blocks all git push B. Stolen keys can call AWS APIs as that principal until rotated/disabled C. Keys improve Argon2 D. Keys replace Security Groups B. Stolen keys can call AWS APIs as that principal until rotated/disabled O — Long-lived IAM access keys committed to GitHub are risky because: · Download PNG · Open card page

Hashing passwords with MD5 is discouraged because: A. MD5 is too slow for users B. MD5 is fast and unsuitable as a modern password-storage scheme; prefer bcrypt/Argon2 C. MD5 forces MFA D. MD5 is required by TLS 1.3 B. MD5 is fast and unsuitable as a modern password-storage scheme; prefer bcrypt/Arg — Hashing passwords with MD5 is discouraged because: · Download PNG · Open card page

TLS primarily protects data: A. Only at rest inside MySQL tables always B. In transit between client and server (confidentiality + integrity of the channel) C. From bad CSS D. From disk failure B. In transit between client and server (confidentiality + integrity of the channel) TLS encrypts the conn — TLS primarily protects data: · Download PNG · Open card page

Module 11: name three cookie-related Blue controls. HTTPS, HttpOnly, Secure (and preferably SameSite + short idle timeout + regenerate on login). “HTTPS, HttpOnly, Secure (and preferably SameSite + short idle timeout + regenerate on login).” Answer only for your own lab or with written permission. U — Module 11: name three cookie-related Blue controls. · Download PNG · Open card page

Module 14: what does CSP help with at a high level? Content Security Policy reduces impact of some XSS classes by controlling where scripts/resources may load from (defence-in-depth with encoding). “Content Security Policy reduces impact of some XSS classes by controlling where scripts/resources may — Module 14: what does CSP help with at a high level? · Download PNG · Open card page

Module 18: one sentence OT safety note for exams. OT changes can affect physical processes – prefer segmentation, vendor-approved maintenance windows, and never "test exploits" on live plant gear. “OT changes can affect physical processes – prefer segmentation, vendor-approved maintenance windows, a — Module 18: one sentence OT safety note for exams. · Download PNG · Open card page

Closing ethics line if a question asks you to demonstrate evasion on a client VPN without paper. Refuse. Offer OWN-lab methodology discussion or wait for written authorisation and change control. “Refuse. Offer OWN-lab methodology discussion or wait for written authorisation and change control.” Ans — Closing ethics line if a question asks you to demonstrate evasion on a client VPN without paper. · Download PNG · Open card page