https://DevOpsCloud.io -- Cloud Monk Losang Jinpa, Ph.D., MCSE/MCT, GitOps DevOps Engineer

Penetration Testing Tools for macOS and Linux

Updated: 09/23 – I needed Metasploit Framework for an msfvenom payload and I was using Kali Linux as a Virtual Machine, mainly because all the tools are pre-installed there. Running a Virtual Machine is not as easy as running the tools in a host Operating System. The available RAM of course is much less than the actual host and some times configuring things can be complicated.

Nmap (Free) Nmap is the best port scanning tool you can use and also open source. Used widely, mainly because of the incredible power and flexibility it offers. On Mac OS Nmap comes with ZenMap, in the installation pack. For those who don’t like the terminal Zenmap is the perfect tool. I prefer using Nmap but in some cases, like for example when you have multiple hosts to scan, Zenmap makes reading them much easier.

Installation of Nmap is really simple and it does not require any typing at all. You can just download a .dmg file from the official website and do a normal installation like in every other application.

Links: Nmap – Github

Nikto (Free) Nikto comes pre-installed on Kali Linux and some times it can help you find some hidden Gems on the web server you are testing. Nikto is a Web Server scanner that will inform you in case there is an outdated software version, if it finds some insecure or default files / directories and about some possible server misconfigurations.

In order to install Nikto you need to install Homebrew. To install Homebrew you need to type a single command on your terminal.

ruby -e “$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)” After installation if you didn’t agree with the Terms of Service of X-Code you will probably need to follow the instuctions. The instructions are pretty clear and simple to follow. Next you have to install Nikto. Go back to your terminal and type the following.

brew install nikto After finishing the installation you will be able to scan every web server using the command nikto -h {URL}.

Links: Homebrew – Github – Nikto

Wireshark (Free) The Wireshark is the most known Network Traffic Sniffer, that is open-source like all the tools so far. The Wireshark distribution also comes with TShark, which is aline-oriented sniffer (similar to Sun’s snoop, or tcpdump) that uses thesame dissection, capture-file reading and writing, and packet filteringcode as Wireshark, and with editcap, which is a program to read capturefiles and write the packets from that capture file, possibly in adifferent capture file format, and with some packets possibly removed from the capture.

Installation is pretty simple, since it come as a .dmg file and the installation is like on every other application on Mac OS. After installation a new icon will appear on the launchpad’s application list. From there just by clicking it you can start sniffing the network traffic, after specifying the interface you would like to intercept.

Links: Wireshark – Github

Sqlmap (Free) The Sqlmap is a powerful tool for finding SQL injections. It is completely automated and just by specifying a parameter the tool will try to exploit the injectable parameter sometimes even without you having to specify the type of database. It supports multi databases including SQL and non-SQL databases. Installation is pretty simple by using brew.

brew install sqlmap When the installation is complete you can just type sqlmap on terminal to launch the tool.

Links: sqlmap – Github

Zed Attack Proxy (Free) The OWASP Zed Attack Proxy (ZAP) is one of the world’s most popular free security tools and is actively maintained by hundreds of international volunteers*. It can help you automatically find security vulnerabilities in your web applications while you are developing and testing your applications. Its also a great tool for experienced pentesters to use for manual security testing.

The easiest way to install ZAP is by using brew. Start by installing caskroom.

brew install caskroom/cask/brew-cask After the installation is complete the system is ready to install ZAP.

brew cask install owasp-zap After the installation is complete a new ZAP icon will appear on the launchpad.

Links: OWASP ZAP – Github

Burp Suite (Free / Paid) My personally favourite proxy tool is Burp Suite. It offers pretty much the same options as ZAP, with better and much easier to use design. This is only for the Community version. The paid version offers automated fuzzing, with good results, it offers Intruder, a function to repeat requests for fuzzing, with custom wordlist, support for regular expressions and much more. Intruder is also available for the Community version, but it has a throttling that can be a bit slow. Installing Burp is really easy, you just need to visit their website and they offer an option for Mac OS, and you just download an install the .dmg file.

Links: Burp Suite

Aircrack-ng (Free) Unluckily the tool for every Wi-Fi pentration testing is partially available on OS X. You can do a really simple installation of the Aircrack-ng with macports, but Airodump-ng and Aireplay-ng are linux only and will not work under OS X native, so for reinjecting and sniffing you will have to use other means.

sudo port install aircrack-ng After finishing the installation you can use it by typing aircrack-ng and the options you prefer.

Links: Aircrack-ng – Github

TestSSL (Free) TestSSL is the best tool to test the SSL configuration of the server you are testing. What I like the most about TestSSL is the clean UI it offers and the simplicity in use. You get different results depending on the device you want to have as a reference and writes in really clean form the possible vulnerabilities of the current configuration.

To install TestSLL you firstly have to download the git repository from Github. Current stable version is 2.8.

git clone https://github.com/drwetter/testssl.sh.git Then go to the folder of TestSSL.

cd testssl.sh/ If you want to run TestSSL on a server you can just execute the .sh file followed by the URL of the website.

./testssl.sh google.com Links: TestSSL – Github

Wappalyzer (Free) This browser extension is available for both Firefox and Chrome, giving users the ability to really easily identify technologies used on a Web Application. This simple plugin displays versions of web server servers, libraries, programming languages and more. What makes this plugin so helpful is it’s accuracy, how easy is it to use and of course it is open source. I find out about this plugin a few months back and I am using it extensively, so it is worth a shot.

Links: Firefox – Chrome – Github

Gobuster (Free) Great tool for enumerating directories, files and DNS subdomains. What I like about Gobuster is the flexibility if offers with extensions, authentication and mainly support for multithreading. I was mainly using dirb for enumerating files and directories, but what was the biggest concern for me was the fact that dirb does not support multiple threads, and this makes the process really slower. Using brew is it easy to install Gobuster.

brew install gobuster Links: Github

Ffuf (Free) Another tool written an Go, with excellent performance and numerous of customisations. Ffuf offers option for directory, DNS and vhost brute-forcing. Ffuf can also be installed using brew, which makes it really convenient.

brew install fuff Links: Github

Hashcat (Free) Great tool for password recovery. Supports almost every known hashing algorithm and masking for password guessing. It can fully utilize your Mac’s performance while it offers great support for GPUs.

brew install hashcat Links: Hashcat – Github

Impacket (Free) Impacket is an excellent collection of tools for pentest, mainly oriented around Windows assessments. Impacket offers numerous classes to interact with multiple protocols. Impacket is Python based and the installation happens by cloning the repository and installing its dependancies.

git clone https://github.com/SecureAuthCorp/impacket cd impacket python3 -m pip install . Links: SecureAuth – Github

Responder (Free) Another Python based application required for every Windows assessment. The perfect tool for rogue type attacks inside the domain. Just clone the repository, navigate to the project, and run the responder.py script.

git clone https://github.com/lgandx/Responder cd Responder ./Responder.py [options] Links: Github

CrackMapExec (Free) A post exploitation tool, used in Active Directory assessments, which helps with lateral movement inside the domain. The tools is also python-based and using Impacket for multiple of its functions. CrackMapExec can be installed by using downloading the corresponding binary from their release page.

Links: Releases – Github

ADB (Free) ADB (Android Debug Bridge) is a command-line tool that enables communication between a computer and an Android device. It provides a bridge for developers to execute commands, install and debug applications, and access various device functionalities directly from a computer. Essential for any mobile pentest. The files can be downloaded directly from the Google repo. To install it, just extract the content form the zip and add the directory to your path.

Links: Google Repo

Frida (Free) Frida is a dynamic instrumentation toolkit used for injecting JavaScript or native code into running processes on multiple platforms. It enables them to monitor and modify application behavior in real-time, perform runtime analysis, and conduct reverse engineering tasks. Frida can be easily installed using pip. By default pip is installed as pip3 on Mac OS.

pip install frida-tools

Links: Frida – Github

jdax (Free)

JADX is an open-source tool used for decompiling Android applications, perfect for converting DEX (Dalvik Executable) and APK (Android Package) files back into readable Java source code. jadx can be easily installed using brew. After installing it, in order to run it either run jadx-gui on your terminal or run jadx filename to run is inside your console.

brew install jadx

Links: Github: https://github.com/AzureCloudMonk/jadx-Dex-to-Java-decompiler

https://marduc812.com/2017/05/28/penetration-testing-tools-for-mac-os/

Homebrew: How to install exploit tools on macOS Published January 7, 2021 Image of Jesus Vigo Written By Jesus Vigo Table of Contents We'll guide you through the process of using Homebrew package manager to install security tools on macOS to exploit vulnerabilities found in your Apple equipment.

Image: Homebrew Must-read Apple coverage Apple iOS 18 Cheat Sheet macOS 15 Sequoia Cheat Sheet 20 Mac Terminal Commands Every User Should Know Hiring Kit: iOS Developer In this follow-up to the installing security tools on macOS via Homebrew series, we’ll be looking at various applications that can be used to exploit any vulnerabilities that have been found after performing an assessment using scanning tools to determine what—if any—issues exist.

While some pentesters find this to be the fun part of the project, exploiting the vulnerabilities found to see how the devices respond and react to attacks, it’s important to not let the fun factor associated with this part of the campaign to overtake the true purpose of this phase: To verify the information retrieved during the assessment phase is accurate.

SEE: Cybersecurity: Let’s get tactical (free PDF) (TechRepublic)

This is another step along the path to completing a successful penetration testing engagement. Otherwise, it will be incorrect, and likely your supervisors and clients will be none too happy with you for providing misinformation; and potentially making their IT department go on a wild goose chase to correct issues that were never there to begin with.

Taking the identified vulnerabilities and attempting to exploit them will quantify your findings and provide conclusive evidence that the line-item is not merely a false positive, but a true positive, and one of the items that will be presented in your final report to stakeholders for remediation. The tools identified below will allow pentesters to do just that by being able to leverage potential exploits against the vulnerabilities assessed.

Armitage According to the Armitage website, it is “a scriptable red team collaboration tool for Metasploit.” It works by essentially providing a common workspace to assess viable targets by recommending possible exploits and providing access to post-exploitation features. It also provides the ability for teams to share information within the workspace.

brew install armitage

Bettercap v2 Not to be confused with the legacy and no longer supported v1, Bettercap v2 is an extensible framework used to target wired and wireless networks of all types: Ethernet, Wi-Fi, Bluetooth, and wireless devices, such as keyboard and mice, with a number of built-in tools that probe, monitor, capture, and manipulate traffic.

brew install bettercap

SEE: Homebrew: How to install reconnaissance tools on macOS (TecheRepublic)

ClusterD This open-source toolkit focuses exclusively on attacking application servers by automating the reconnaissance and exploitation phases on six different application server platforms. With additional support always being added, ClusterD can also leverage API for adding new platforms and exploits to the program.

brew install clusterd

Commix Short for command injection exploiter, this automated tool is used to test web-based applications to both find and exploit vulnerabilities. Based on Python, the program supports cross-platform use and is available as a package in other standalone security toolkits or as a module in testing frameworks.

brew install commix

Frogger2 This is a script that enumerates and automates hopping VLANs by sniffing network traffic and extracting the tags to identify VLAN IDs to exploit VLAN-hopping vulnerabilities within network equipment.

brew install frogger

Inception This tool is used to manipulate physical memory by exploiting PCI-based DMA and can attack over hardware interfaces such as FireWire and Thunderbolt, for example. It works by performing both intrusive and non-intrusive attacks via DMA on computers that are live.

brew install inception

SEE: How to install common security tools via Homebrew on a Mac (TechRepublic)

Metaploit Framework (MSF) This is one of the most popular exploitation tools in a pentester’s arsenal. Metasploit is actually a framework that allows users to link to a database of known exploits to automate the the exploitation process against vulnerable clients. But MSF is much more than that: It also offers information-gathering tools and vulnerability plugins, as well as a development environment that allows for the creation of modules that encompass writing one’s own exploits.

brew install metasploit

Oracle Database Attacking Tool (ODAT) Another open-source tool, this one is used to remotely test the security of databases running on the Oracle platform. It can be used to find SIDs and credentials, escalate privileges, or execute commands against the system.

brew install odat

Panoptic This is a Python script that uses the path traversal vulnerability to automate the process of locating and retrieving log and configuration files on target devices.

brew install panoptic

Responder The application has many built-in authentication servers to test and exploit a number of Windows-based services. Some of the common services are SMB, MSSQL, and DNS, combined with poisoning capabilities, among many other tools to setup man-in-the-middle (MITM) and spoofing attacks.

brew install responder

SQLMap This open-source testing tool automates the process of owning database servers based on Structured Query Language (SQL). It detects and exploits injection vulnerabilities in addition to fully supporting a large host of database server types via fingerprinting, data fetching, accessing host file systems, and performing out-of-band connections.

brew install sqlmap

Wifite2 This is the second version of the Python-based script for auditing wireless networks. Wifite2 sets itself apart from other, more robust wireless tools by fully automating the process, using all known methods for obtaining hashes from access points, and cracking the passphrase associated with encrypted wireless networks.

brew install wifite

Yersinia Another tool that is regularly included in other security-focused toolkits, this one is designed to take advantage of known weaknesses in different network protocols to scrutinize the security of a network and exploit any issues found, using such common protocols as Spanning Tree Protocol (STP), Cisco Discovery Protocol (CDP), and VLAN Trunking Protocol (VTP) just to name a few.

brew install yersinia

https://www.techrepublic.com/article/homebrew-how-to-install-exploit-tools-on-macos/

Mitre Framework, Common Vulnerabilities and Exposures (CVE), Pentesting by Programming Language (Angular Pentesting, Bash Pentesting, C Pentesting, C Plus Plus Pentesting | C++ Pentesting, C Sharp Pentesting | Pentesting, Clojure Pentesting, COBOL Pentesting, Dart Pentesting, Fortran Pentesting, Golang Pentesting, Java Pentesting, JavaScript Pentesting, Kotlin Pentesting, Python Pentesting, PowerShell Pentesting, React Pentesting, Ruby Pentesting, Rust Pentesting, Scala Pentesting, Spring Pentesting, Swift Pentesting - iOS Pentesting - macOS Pentesting, TypeScript Pentesting),

Pentesting by Cloud Provider, Pentesting GitHub - Pentesting GitHub Repositories, Pentesting by OS, Pentesting by Company, Awesome Pentesting, Pentesting Bibliography, Pentesting GitHub, Pentesting topics, Cybersecurity topics, Dictionary attack, Passwords, Hacking (Ethical hacking, White hat, Black hat, Grey hat), Pentesting, Rainbow table, Cybersecurity certifications (CEH), Awesome pentesting. (navbar_pentesting. See also navbar_passwords, navbar_passkeys, navbar_mfa, navbar_security, navbar_encryption, navbar_iam, navbar_devsecops)

Access Control, Access Control List, Access Management, Account Lockout, Account Takeover, Active Defense, Active Directory Security, Active Scanning, Advanced Encryption Standard, Advanced Persistent Threat, Adversarial Machine Learning, Adware, Air Gap, Algorithmic Security, Anomaly Detection, Anti-Malware, Antivirus Software, Anti-Spyware, Application Blacklisting, Application Layer Security, Application Security, Application Whitelisting, Arbitrary Code Execution, Artificial Intelligence Security, Asset Discovery, Asset Management, Asymmetric Encryption, Asymmetric Key Cryptography, Attack Chain, Attack Simulation, Attack Surface, Attack Vector, Attribute-Based Access Control, Audit Logging, Audit Trail, Authentication, Authentication Protocol, Authentication Token, Authorization, Automated Threat Detection, AutoRun Malware, Backdoor, Backup and Recovery, Baseline Configuration, Behavioral Analysis, Behavioral Biometrics, Behavioral Monitoring, Biometric Authentication, Black Hat Hacker, Black Hat Hacking, Blacklisting, Blockchain Security, Blue Team, Boot Sector Virus, Botnet, Botnet Detection, Boundary Protection, Brute Force Attack, Brute Force Protection, Buffer Overflow, Buffer Overflow Attack, Bug Bounty Program, Business Continuity Plan, Business Email Compromise, BYOD Security, Cache Poisoning, CAPTCHA Security, Certificate Authority, Certificate Pinning, Chain of Custody, Challenge-Response Authentication, Challenge-Handshake Authentication Protocol, Chief Information Security Officer, Cipher Block Chaining, Cipher Suite, Ciphertext, Circuit-Level Gateway, Clickjacking, Cloud Access Security Broker, Cloud Encryption, Cloud Security, Cloud Security Alliance, Cloud Security Posture Management, Code Injection, Code Review, Code Signing, Cold Boot Attack, Command Injection, Common Vulnerabilities and Exposures, Common Vulnerability Scoring System, Compromised Account, Computer Emergency Response Team, Computer Forensics, Computer Security Incident Response Team, Confidentiality, Confidentiality Agreement, Configuration Baseline, Configuration Management, Content Filtering, Continuous Monitoring, Cross-Site Request Forgery, Cross-Site Request Forgery Protection, Cross-Site Scripting, Cross-Site Scripting Protection, Cross-Platform Malware, Cryptanalysis, Cryptanalysis Attack, Cryptographic Algorithm, Cryptographic Hash Function, Cryptographic Key, Cryptography, Cryptojacking, Cyber Attack, Cyber Deception, Cyber Defense, Cyber Espionage, Cyber Hygiene, Cyber Insurance, Cyber Kill Chain, Cyber Resilience, Cyber Terrorism, Cyber Threat, Cyber Threat Intelligence, Cyber Threat Intelligence Sharing, Cyber Warfare, Cybersecurity, Cybersecurity Awareness, Cybersecurity Awareness Training, Cybersecurity Compliance, Cybersecurity Framework, Cybersecurity Incident, Cybersecurity Incident Response, Cybersecurity Insurance, Cybersecurity Maturity Model, Cybersecurity Policy, Cybersecurity Risk, Cybersecurity Risk Assessment, Cybersecurity Strategy, Dark Web Monitoring, Data at Rest Encryption, Data Breach, Data Breach Notification, Data Classification, Data Encryption, Data Encryption Standard, Data Exfiltration, Data Governance, Data Integrity, Data Leakage Prevention, Data Loss Prevention, Data Masking, Data Mining Attacks, Data Privacy, Data Protection, Data Retention Policy, Data Sanitization, Data Security, Data Wiping, Deauthentication Attack, Decryption, Decryption Key, Deep Packet Inspection, Defense in Depth, Defense-in-Depth Strategy, Deidentification, Demilitarized Zone, Denial of Service Attack, Denial-of-Service Attack, Device Fingerprinting, Dictionary Attack, Digital Certificate, Digital Certificate Management, Digital Forensics, Digital Forensics and Incident Response, Digital Rights Management, Digital Signature, Disaster Recovery, Disaster Recovery Plan, Distributed Denial of Service Attack, Distributed Denial-of-Service Attack, Distributed Denial-of-Service Mitigation, DNS Amplification Attack, DNS Poisoning, DNS Security Extensions, DNS Spoofing, Domain Hijacking, Domain Name System Security, Drive Encryption, Drive-by Download, Dumpster Diving, Dynamic Analysis, Dynamic Code Analysis, Dynamic Data Exchange Exploits, Eavesdropping, Eavesdropping Attack, Edge Security, Email Encryption, Email Security, Email Spoofing, Embedded Systems Security, Employee Awareness Training, Encapsulation Security Payload, Encryption, Encryption Algorithm, Encryption Key, Endpoint Detection and Response, Endpoint Protection Platform, Endpoint Security, Enterprise Mobility Management, Ethical Hacking, Ethical Hacking Techniques, Event Correlation, Event Logging, Exploit, Exploit Development, Exploit Framework, Exploit Kit, Exploit Prevention, Exposure, Extended Detection and Response, Extended Validation Certificate, External Threats, False Negative, False Positive, File Integrity Monitoring, File Transfer Protocol Security, Fileless Malware, Firmware Analysis, Firmware Security, Firewall, Firewall Rules, Forensic Analysis, Forensic Investigation, Formal Methods in Security, Formal Verification, Fraud Detection, Full Disk Encryption, Fuzz Testing, Fuzz Testing Techniques, Gateway Security, General Data Protection Regulation, General Data Protection Regulation Compliance, Governance Risk Compliance, Governance, Risk, and Compliance, Gray Hat Hacker, Gray Hat Hacking, Group Policy, Group Policy Management, Hacker, Hacking, Hardware Security Module, Hash Collision Attack, Hash Function, Hashing, Health Insurance Portability and Accountability Act, Health Insurance Portability and Accountability Act Compliance, Heartbleed Vulnerability, Heuristic Analysis, Heuristic Detection, High-Availability Clustering, Honeynet, Honeypot, Honeypot Detection, Host-Based Intrusion Detection System, Host Intrusion Prevention System, Host-Based Intrusion Prevention System, Hypervisor Security, Identity and Access Management, Identity Theft, Incident Handling, Incident Response, Incident Response Plan, Incident Response Team, Industrial Control Systems Security, Information Assurance, Information Security, Information Security Management System, Information Security Policy, Information Systems Security Engineering, Insider Threat, Integrity, Intellectual Property Theft, Interactive Application Security Testing, Internet of Things Security, Intrusion Detection System, Intrusion Prevention System, IP Spoofing, ISO 27001, IT Security Governance, Jailbreaking, JavaScript Injection, Juice Jacking, Key Escrow, Key Exchange, Key Management, Keylogger, Kill Chain, Knowledge-Based Authentication, Lateral Movement, Layered Security, Least Privilege, Lightweight Directory Access Protocol, Log Analysis, Log Management, Logic Bomb, Macro Virus, Malicious Code, Malicious Insider, Malicious Software, Malvertising, Malware, Malware Analysis, Man-in-the-Middle Attack, Mandatory Access Control, Mandatory Vacation Policy, Mass Assignment Vulnerability, Media Access Control Filtering, Message Authentication Code, Mobile Device Management, Multi-Factor Authentication, Multifunction Device Security, National Institute of Standards and Technology, Network Access Control, Network Security, Network Security Monitoring, Network Segmentation, Network Tap, Non-Repudiation, Obfuscation Techniques, Offensive Security, Open Authorization, Open Web Application Security Project, Operating System Hardening, Operational Technology Security, Packet Filtering, Packet Sniffing, Pass the Hash Attack, Password Cracking, Password Policy, Patch Management, Penetration Testing, Penetration Testing Execution Standard, Perfect Forward Secrecy, Peripheral Device Security, Pharming, Phishing, Physical Security, Piggybacking, Plaintext, Point-to-Point Encryption, Policy Enforcement, Polymorphic Malware, Port Knocking, Port Scanning, Post-Exploitation, Pretexting, Preventive Controls, Privacy Impact Assessment, Privacy Policy, Privilege Escalation, Privilege Management, Privileged Access Management, Procedure Masking, Proactive Threat Hunting, Protected Health Information, Protected Information, Protection Profile, Proxy Server, Public Key Cryptography, Public Key Infrastructure, Purple Teaming, Quantum Cryptography, Quantum Key Distribution, Ransomware, Ransomware Attack, Red Teaming, Redundant Array of Independent Disks, Remote Access, Remote Access Trojan, Remote Code Execution, Replay Attack, Reverse Engineering, Risk Analysis, Risk Assessment, Risk Management, Risk Mitigation, Role-Based Access Control, Root of Trust, Rootkit, Salami Attack, Sandbox, Sandboxing, Secure Coding, Secure File Transfer Protocol, Secure Hash Algorithm, Secure Multipurpose Internet Mail Extensions, Secure Shell Protocol, Secure Socket Layer, Secure Sockets Layer, Secure Software Development Life Cycle, Security Assertion Markup Language, Security Audit, Security Awareness Training, Security Breach, Security Controls, Security Event Management, Security Governance, Security Incident, Security Incident Response, Security Information and Event Management, Security Monitoring, Security Operations Center, Security Orchestration, Security Policy, Security Posture, Security Token, Security Vulnerability, Segmentation, Session Fixation, Session Hijacking, Shoulder Surfing, Signature-Based Detection, Single Sign-On, Skimming, Smishing, Sniffing, Social Engineering, Social Engineering Attack, Software Bill of Materials, Software Composition Analysis, Software Exploit, Software Security, Spear Phishing, Spoofing, Spyware, SQL Injection, Steganography, Supply Chain Attack, Supply Chain Security, Symmetric Encryption, Symmetric Key Cryptography, System Hardening, System Integrity, Tabletop Exercise, Tailgating, Threat Actor, Threat Assessment, Threat Hunting, Threat Intelligence, Threat Modeling, Ticket Granting Ticket, Time-Based One-Time Password, Tokenization, Traffic Analysis, Transport Layer Security, Transport Security Layer, Trapdoor, Trojan Horse, Two-Factor Authentication, Two-Person Control, Typosquatting, Unauthorized Access, Unified Threat Management, User Behavior Analytics, User Rights Management, Virtual Private Network, Virus, Vishing, Vulnerability, Vulnerability Assessment, Vulnerability Disclosure, Vulnerability Management, Vulnerability Scanning, Watering Hole Attack, Whaling, White Hat Hacker, White Hat Hacking, Whitelisting, Wi-Fi Protected Access, Wi-Fi Security, Wi-Fi Protected Setup, Worm, Zero-Day Exploit, Zero Trust Security, Zombie Computer

Cybersecurity: DevSecOps - Security Automation, Cloud Security - Cloud Native Security (AWS Security - Azure Security - GCP Security - IBM Cloud Security - Oracle Cloud Security, Container Security, Docker Security, Podman Security, Kubernetes Security, Google Anthos Security, Red Hat OpenShift Security); CIA Triad (Confidentiality - Integrity - Availability, Authorization - OAuth, Identity and Access Management (IAM), JVM Security (Java Security, Spring Security, Micronaut Security, Quarkus Security, Helidon Security, MicroProfile Security, Dropwizard Security, Vert.x Security, Play Framework Security, Akka Security, Ratpack Security, Netty Security, Spark Framework Security, Kotlin Security - Ktor Security, Scala Security, Clojure Security, Groovy Security;

, JavaScript Security, HTML Security, HTTP Security - HTTPS Security - SSL Security - TLS Security, CSS Security - Bootstrap Security - Tailwind Security, Web Storage API Security (localStorage Security, sessionStorage Security), Cookie Security, IndexedDB Security, TypeScript Security, Node.js Security, NPM Security, Deno Security, Express.js Security, React Security, Angular Security, Vue.js Security, Next.js Security, Remix.js Security, PWA Security, SPA Security, Svelts.js Security, Ionic Security, Web Components Security, Nuxt.js Security, Z Security, htmx Security

Python Security - Django Security - Flask Security - Pandas Security,

Programming Language Security ((1. Python Security, 2. JavaScript Security, 3. Java Security, 4. C Sharp Security | Security, 5. CPP Security | C++ Security, 6. PHP Security, 7. TypeScript Security, 8. Ruby Security, 9. C Security, 10. Swift Security, 11. R Security, 12. Objective-C Security, 13. Scala Security, 14. Golang Security, 15. Kotlin Security, 16. Rust Security, 17. Dart Security, 18. Lua Security, 19. Perl Security, 20. Haskell Security, 21. Julia Security, 22. Clojure Security, 23. Elixir Security, 24. F Sharp Security | Security, 25. Assembly Language Security, 26. Shell Script Security / bash Security, 27. SQL Security, 28. Groovy Security, 29. PowerShell Security, 30. MATLAB Security, 31. VBA Security, 32. Racket Security, 33. Scheme Security, 34. Prolog Security, 35. Erlang Security, 36. Ada Security, 37. Fortran Security, 38. COBOL Security, 39. Lua Security, 40. VB.NET Security, 41. Lisp Security, 42. SAS Security, 43. D Security, 44. LabVIEW Security, 45. PL/SQL Security, 46. Delphi/Object Pascal Security, 47. ColdFusion Security, 49. CLIST Security, 50. REXX);

OS Security, Mobile Security: Android Security - Kotlin Security - Java Security, iOS Security - Swift Security; Windows Security - Windows Server Security, Linux Security (Ubuntu Security, Debian Security, RHEL Security, Fedora Security), UNIX Security (FreeBSD Security), IBM z Mainframe Security (RACF Security), Passwords (Windows Passwords, Linux Passwords, FreeBSD Passwords, Android Passwords, iOS Passwords, macOS Passwords, IBM z/OS Passwords), Password alternatives (Passwordless, Personal Access Token (PAT), GitHub Personal Access Token (PAT), Passkeys), Hacking (Ethical Hacking, White Hat, Black Hat, Grey Hat), Pentesting (Red Team - Blue Team - Purple Team), Cybersecurity Certifications (CEH, GIAC, CISM, CompTIA Security Plus, CISSP), Mitre Framework, Common Vulnerabilities and Exposures (CVE), Cybersecurity Bibliography, Cybersecurity Courses, Firewalls, CI/CD Security (GitHub Actions Security, Azure DevOps Security, Jenkins Security, Circle CI Security), Functional Programming and Cybersecurity, Cybersecurity and Concurrency, Cybersecurity and Data Science - Cybersecurity and Databases, Cybersecurity and Machine Learning, Cybersecurity Glossary (RFC 4949 Internet Security Glossary), Awesome Cybersecurity, Cybersecurity GitHub, Cybersecurity Topics (navbar_security - see also navbar_aws_security, navbar_azure_security, navbar_gcp_security, navbar_k8s_security, navbar_docker_security, navbar_podman_security, navbar_mainframe_security, navbar_ibm_cloud_security, navbar_oracle_cloud_security, navbar_database_security, navbar_windows_security, navbar_linux_security, navbar_macos_security, navbar_android_security, navbar_ios_security, navbar_os_security, navbar_firewalls, navbar_encryption, navbar_passwords, navbar_iam, navbar_pentesting, navbar_privacy, navbar_rfc)

SYI LU SENG E MU CHYWE YE. NAN. WEI LA YE. WEI LA YE. SA WA HE.