Practical Pentest Resources

Collection of practical resources and references (e.g. payloads, wikis, etc.) for daily pentesting

Wordlists and Palyoads	Knowledge	Tools
Discovery	General	Cheat Sheets
SecLists/Discovery	bitvijays	cheat.sh
FuzzDB/Discovery	HackTricks	tldr-pages/tldr
Network	IppSec	Operating Systems
List of TCP and UDP Ports	Pentest Book	Kali Linux
Nmap Services	Red Teaming Experiments	ArchStrike
Speedguide	Privilege Escalation - Linux	Shells
Payloads	Basic Linux Privilege Escalation	Fish Shell
bl4de/dictionaries	GTFOBins	Nushell
Bug Bounty Cheat Sheet	Privilege Escalation - Windows	Information Gathering
FuzzDB	Basic Windows Privilige Escalation	Shodan
PayloadsAllTheThings	LOLBAS	Encoding/Decoding
pentestmonkey	Static Application Secure Testing	CyberChef
SecLists	OWASP Code Review Guide	Privilege Escalation
Wfuzz Wordlists	SEI CERT Coding Standards	PEASS - Privilege Escalation Awesome Scripts SUITE
Credentials	Web Pentesting	For Linux
CIRT Default Passwords	OWASP Attacks	LinEnum
Default Credentials Cheat Sheet	OWASP Vulnerabilities	linuxprivchecker
Cross-Site Scripting (XSS)	OWASP Cheat Sheets
Cross-site Scripting Payloads Cheat Sheet by LinuxSec Exploit	OWASP Web Security Testing Guide (WSTG)
Cross-site scripting (XSS) cheat sheet by Portswigger	Portswigger WebSecurity Academy
SQL Injection
SQL injection cheat sheet

See Also

• Awesome Hacking
• Awesome Pentest Cheat Sheets

Blog/News

• FuzzySecurity 2.0
• Portswigger Blog
• Reddit/netsec

Youtube Channels

• GynvaelEN
• IppSec

Further Search Strategies

# Sample 1 - Simple search about concrete technology
azure penetest

# Sample 2 - Search tools and (awesome) projects on github.com 
site:github.com awesome pentest

# Sample 3 - Search blog posts on reddit.com
site:reddit.com kubernetes pentest

# Sample 4 - Search public available notes about security courses, e.g OSCP
oscp notes

License

CC BY-SA 4.0