compilations on Stephen Swanson

Getting Started In Security

stephen@stephenswanson.xyz (Stephen Swanson) — Wed, 23 Mar 2022 12:00:30 -0700

This page represents a list of almost every resource that I’ve found useful on my journey to doing cybersecurity. If you’re brand new and interested in learning, or if you’re an old-timer exploring someone else’s viewpoint, I hope you find something interesting here.

Wargames

Tryhackme: One of the best places for a complete novice to start. After learning the ropes using TryHackMe, move on to HackTheBox.
HackTheBox: Super great place for playing boot2root machines. A variety of difficulties. I’d say that easy to medium HackTheBoxMachines are roughly equivalent to OSCP level machines.
HackThisSite: An older wargame which mainly focuses on exploitation of older web applications, but still super fun.
OverTheWire A classic wargame that starts with the fundamentals of Linux, and takes you up to complicated exploitation exercises. This is my favorite place to recommend to beginners.
PicoCTF: I haven’t used this one too much, but for learning the basics of Jeopardy-style CTFs, this is a great start.
VulnHub: Place to find vulnerable virtual machines to put in your lab and attack.
Exploit Education: A collection of challenges to teach binary exploitation.

Training

PortSwigger Web Security Academy: Incredible free resource that covers almost everything you need to know about web application hacking. It’s the replacement for the Web Application Hacker’s Handbook.

Youtube Channels

LiveOverflow: Great security creator. Goes above and beyond to explain the “why” of all his exploits. My favorite series from him are the Pwnie Island Series, and the Binary Exploitation Playlist.
Rana Khalil: Amazing videos walking through the entire PortSwigger Web Academy.
S1REN from OffensiveSecurity: Offensive Security posts walkthroughs of Offensive Security Proving Grounds boxes by S1REN. Although she mainly sticks to OSCP-level boxes, I really appreciate how she demonstrates proper note taking, and I’ve taken many tips from her style.
IppSec: A classic cybersecurity youtuber that posts video walkthroughs of every HackTheBox machine.

My Favorite Resources

stephen@stephenswanson.xyz (Stephen Swanson) — Wed, 23 Mar 2022 12:00:30 -0700

On this page is a list of resources that I’ve stumbled upon that have been helpful for my workflow. I’m not going to list super common tools like Nmap or Metasploit, just the ones that were unknown to me and really useful.

Reference

Ippsec.Rocks: A website that allows you to search through IppSec videos for techniques and tools.
Hacktricks: A huge compilation of techniques for exploitation and privilege escalation.
pentestmonkey’s Reverse Shell Cheatsheet: A place to copy-paste reverse shells.

Tools

Cyberchef: The best tool for dealing with formatting and encoding.
UpDog: A great tool for exfiltration from a compromised machine.
Joplin: The note taking app that works for me. It’s similar to Evernote and Cherrytree, but FOSS. Uses markdown formatting, so it’s really convenient for copy-pasting into Hugo or a Pandoc converter.
Flameshot: One of the best Linux screenshot utilities. I used this app to take and annotate the screenshots for my OSCP.

News

The Daily Swig: Security focused news from PortSwigger
Schneier on Security: Great place for security news and opinion

My Recommended Reading and Watching

stephen@stephenswanson.xyz (Stephen Swanson) — Wed, 23 Mar 2022 12:00:30 -0700

On this page is a list of things that I’ve read or watched that were either interesting or inspiring.

Essays

How To Become A Hacker - Eric Steven Raymond: An interesting piece of writing that has informed my ideology, although I don’t agree with some of it. Also, the original author would completely disagree with my usage of it, given that most of what I do is more inline with his definition of “cracker” rather than “hacker.”
The Word “Hacker” - Paul Graham: An interesting musing on the spirit found in a hacker, and how it relates to the larger society.
Undergraduation - Paul Graham: A how-to guide about becoming a hacker while in college.

Fiction Books

The Hobbit and The Lord of the Rings - J.R.R Tolkien: Classics that I grew up reading and keep coming back to again and again.
Dune - Frank Herbert: Just a masterpiece that was a big part of my childhood.

Non-Fiction Books

Permanent Record - Edward Snowden: This book was a really interesting insight into the motivations and ideals of a person that I’ve admired for a long time (to completely destroy my chances of working at the CIA or NSA now). It was an interesting look into how patriotism and idealism can be found in a hacker.
Ghost In The Wires - Kevin Mitnick: Not a super applicable or relevant book to security today, but it’s a fun read.
Social Engineering: The Art of Human Hacking: Just an interesting and practical book about what makes humanity tick.
Creating True Peace - Thich Nhat Hanh: Although I don’t 100% agree with the philosophy posited by Thich Nhat Hanh, I found this book both insightful and inspiring, and it definitely gave me a great appreciation for the work of the monk.

Non-Technical Talks

Bruce Schneier - Information Security in the Public Interest - DEF CON 27 Conference: A great talk that redefined my goals as a computer scientist.
The Search for the Perfect Door - Deviant Ollam: Deviant Ollam is a master of public speaking and entertaining stories, while also demonstrating the real security problems in the physical world.
Katie Knowles, How to (Holiday) Hack It: Tips for Crushing CTFs & Pwning Pentests | KringleCon 2019: A video I rewatch every time I’m stuck on something. It goes through a really helpful and inspiring problem-solving methodology.
John Hammond, 5 Steps to Build and Lead a Team of Holly Jolly Hackers | KringleCon 2019: Just a good video about bringing people into the community as a leader of an organization.

Technical Talks

Ron Bowes, Reversing Crypto the Easy Way | KringleCon 2019: One of the best and most interesting introductions to reverse engineering crypto. It’s helped me understand that the weakest link in a crypto program often isn’t the crypto itself, but the implementation around it, and I’ve used that to great effect in several challenges.
Tom Liston, RFC-3514 Compliant Pentesting: Being Good While You’re Being Bad | KringleCon 2021: Really funny video that also teaches you how to use python to automatically alter outgoing packets on the fly.
Nancy Gariché, Disclosing Security Vulnerabilities to OS Projects.. Like a Boss! KringleCon 2021: Super useful video that outlines good practices for disclosing vulnerabilities in OS projects.

Youtube Videos

Should We Abolish Copyright? - Tom Nicholas: An interesting discussion about the merits of copyright in the internet age.
A Meat Eater’s Case For Veganism - CosmicSkeptic: Although I found this video after I went vegan, it’s still the best summary of the arguments that had been simmering in my head for years that eventually convinced me.

compilations on Stephen Swanson

Getting Started In Security

Wargames

Training

Youtube Channels

My Favorite Resources

Reference

Tools

News

My Recommended Reading and Watching

Essays

Fiction Books

Non-Fiction Books

Non-Technical Talks

Technical Talks

Youtube Videos

Poetry