↓ Skip to main content
u-random
u-random

Concetti

Appunti teorici, architetture, protocolli e meccanismi di difesa in ambito Cybersecurity.

▶ 📁 OS & Linux Internals (46)
├─ alternative a man (cheatsheet) [system]
├─ architettura di wazuh siem/xdr [observability], [system]
├─ bash reverse shell - anatomia del comando [dfir], [system]
├─ bash startup files - file di avvio [system]
├─ blockchain - ledger immutabile e applicazioni security [system], [network-defense]
├─ certificate formats - pem, der, pfx/p12, cer, crt, key [system], [network-defense]
├─ change management - cab, formal approval [system]
├─ command chaining e grouping [system]
├─ compliance frameworks - gdpr, hipaa, pci dss, sox [system]
├─ compressione nidificata (nested compression) [system]
├─ compressione vs archiviazione [system]
├─ data classification e ciclo di vita del dato [system]
├─ etc directory purpose [system], [iam]
├─ faq - diagnostica di rete e servizi [network-defense], [system]
├─ file-descriptor [system]
├─ filesystem architecture inodes [system]
├─ hypervisor - type 1 vs type 2, vm escape e container [system], [cloud-security]
├─ i confini della visibilità: pubblico vs privato [system], [cloud-security]
├─ inode anatomy [system]
├─ iptables - netfilter firewall linux [network-defense], [system]
├─ journald - systemd-journald [system], [observability]
├─ kernel e syscall - user space vs kernel space [system]
├─ link hard vs symbolic [system]
├─ link orfani (broken links) [system], [persistence]
├─ linux filesystem hierarchy [system]
├─ linux processes - processi [system]
├─ network configuration linux [network-defense], [system]
├─ network interfaces (interfacce di rete) [network-defense], [system]
├─ operational plans - drp, irp, bcp, change management [dfir], [system]
├─ pam - pluggable authentication modules [iam], [system]
├─ persistenza degli alias [system]
├─ posix - portable operating system interface [system]
├─ race condition e toctou - vulnerabilita' di timing e atomicita' [system]
├─ risk management - termini chiave [system]
├─ rm mechanism [system]
├─ rootkit - il malware invisibile [system]
├─ s/mime - email signing e encryption [network-defense], [system]
├─ servizi linux (daemon) [system], [persistence]
├─ shebang - #! [system]
├─ shell - confronto e differenze [system]
├─ shell environment - ambiente shell [system]
├─ socket (endpoint di comunicazione) [system]
├─ standard streams [system]
├─ steganography vs tokenization vs data masking [network-defense], [system]
├─ tcp vs udp - protocolli di trasporto [system]
└─ worker pool — come i daemon gestiscono richieste in parallelo [system], [network-defense]
▶ 📁 Network Defense (91)
├─ aaa - authentication authorization accounting - radius e tacacs+ [iam], [network-defense]
├─ anycast - resilienza architetturale e anti-ddos [network-defense], [cloud-security]
├─ arp - address resolution protocol [network-defense]
├─ bgp e autonomous systems (as) - il gps di internet [network-defense]
├─ blockchain - ledger immutabile e applicazioni security [system], [network-defense]
├─ bluetooth attacks - bluejacking, bluesnarfing, bluebugging, bluesmack [network-defense], [threat-intel]
├─ botnet e c2 - master-slave vs p2p, domain flux [malware-analysis], [network-defense]
├─ casb - cloud access security broker [cloud-security], [network-defense]
├─ certificate formats - pem, der, pfx/p12, cer, crt, key [system], [network-defense]
├─ cloud shared responsibility model: iaas, paas, saas [cloud-security], [network-defense]
├─ command injection [network-defense]
├─ crittografia asimmetrica - rsa, ecc, firma digitale e code signing [network-defense], [cloud-security]
├─ cryptography [network-defense]
├─ csrf - cross-site request forgery e samesite cookies [network-defense], [cloud-security]
├─ cvss - common vulnerability scoring system [threat-intel], [network-defense]
├─ ddos reflected e amplification attack [network-defense], [threat-intel]
├─ dhcp - dynamic host configuration protocol [network-defense]
├─ dmz e screened subnet: dual-firewall, bastion host, jump server [network-defense], [cloud-security]
├─ dns e http in una lan con switch [network-defense], [dfir]
├─ dns poisoning, pharming e dns sinkhole [network-defense], [threat-intel]
├─ dns records [network-defense]
├─ dns resolution flow [network-defense], [threat-intel]
├─ dns tunneling [network-defense], [dfir], [threat-intel]
├─ dns zone transfer attack (axfr) - ricognizione dns [network-defense]
├─ dnssec — domain name system security extensions [network-defense]
├─ faq - diagnostica di rete e servizi [network-defense], [system]
├─ fim - file integrity monitoring [network-defense]
├─ firewall types: packet filtering, stateful, ngfw, waf, proxy [network-defense], [cloud-security]
├─ frame, pacchetto, segmento - osi e stream [network-defense], [dfir]
├─ fuzzing - coverage-guided, mutation-based [network-defense]
├─ hashing, hmac e password storage - integrita' e autenticazione [network-defense], [cloud-security]
├─ honeypot, honeynet, honeyfile, honeytoken - deception technologies [network-defense], [threat-hunting]
├─ how web works [network-defense]
├─ http in detail [network-defense]
├─ http in wireshark - tcp segmentation e packet analysis [network-defense], [dfir]
├─ icmp, mac e ip - identità e diagnostica di rete [network-defense]
├─ ids e ips - detection e prevention, host e rete [network-defense], [observability]
├─ ip addressing & subnetting [network-defense]
├─ ip header e ipv4 [network-defense]
├─ ip subnetting - matematica e routing [network-defense]
├─ iptables - netfilter firewall linux [network-defense], [system]
├─ ipv6 - internet protocol version 6 [network-defense]
├─ kms - key management system e key rotation [cloud-security], [network-defense]
├─ lan topologies - topologie di rete [network-defense]
├─ load balancer - active-active, active-passive e session affinity [network-defense], [cloud-security]
├─ mdm - mobile device management e byod [cloud-security], [network-defense]
├─ mtu - maximum transmission unit [network-defense]
├─ nac - network access control e posture assessment [network-defense], [cloud-security]
├─ nat concept [network-defense]
├─ ndp - neighbor discovery protocol [network-defense]
├─ network configuration linux [network-defense], [system]
├─ network interfaces (interfacce di rete) [network-defense], [system]
├─ ntp security - network time protocol e sicurezza temporale [network-defense]
├─ osi model - il modello a layer [network-defense]
├─ osint tools - shodan, censys, virustotal, hibp, exploit-db, cyberchef, navigator, dett&ct [threat-intel], [network-defense], [observability]
├─ owasp top 10 [network-defense], [threat-intel]
├─ passive reconnaissance - ricognizione passiva [network-defense], [threat-intel]
├─ pki - public key infrastructure e chain of trust [network-defense], [cloud-security]
├─ proxy [network-defense]
├─ replay attack - timestamp, nonce e kerberos [network-defense], [cloud-security]
├─ reverse shell [network-defense], [persistence]
├─ rj-45 e cavi ethernet - pinout, dritti e incrociati [network-defense]
├─ routing statico e topologia lan-internet [network-defense]
├─ routing, hop e ttl [network-defense]
├─ s/mime - email signing e encryption [network-defense], [system]
├─ sast vs dast vs iast vs sca - application security testing [network-defense], [automation]
├─ scada e ics - ot security e purdue model [network-defense], [threat-intel]
├─ session hijacking - cookie theft, httponly e token regeneration [network-defense], [cloud-security]
├─ smtp - simple mail transfer protocol [network-defense]
├─ sql injection (sqli) [network-defense]
├─ ssh key authentication [network-defense], [iam]
├─ ssl stripping, hsts e cryptographic downgrade attacks [network-defense], [cloud-security]
├─ steganography vs tokenization vs data masking [network-defense], [system]
├─ stride threat model - framework microsoft per la sicurezza by design [network-defense]
├─ symmetric encryption [network-defense]
├─ syn flood e syn cookies - connection table exhaustion [network-defense], [threat-intel]
├─ tcp handshake [network-defense]
├─ tcp reliability e modello osi - la guida semplificata [network-defense]
├─ tls - transport layer security - handshake e crittografia ibrida [network-defense], [cloud-security]
├─ tpm e hsm - hardware security module e trusted platform module [network-defense], [cloud-security]
├─ unicast, broadcast, multicast [network-defense]
├─ vlan - segmentazione logica e vlan hopping [network-defense], [cloud-security]
├─ vpn e ipsec - ike, esp, ah, tunnel e split tunnel [network-defense], [cloud-security]
├─ vulnerability assessment - credentialed vs non-credentialed [network-defense], [threat-intel]
├─ well-known ports - security+ [network-defense]
├─ wireless security - wpa2, wpa3, rogue ap, evil twin [network-defense]
├─ wireshark [network-defense], [dfir]
├─ worker pool — come i daemon gestiscono richieste in parallelo [system], [network-defense]
├─ xss - cross-site scripting reflected, stored, dom e csp [network-defense], [cloud-security]
├─ xxe - xml external entity injection [network-defense]
└─ zero trust architecture - never trust always verify [network-defense], [cloud-security]
▶ 📁 Cloud & Container (38)
├─ /var/run/docker.sock - il socket di docker [cloud-security], [iam]
├─ anycast - resilienza architetturale e anti-ddos [network-defense], [cloud-security]
├─ casb - cloud access security broker [cloud-security], [network-defense]
├─ cloud shared responsibility model: iaas, paas, saas [cloud-security], [network-defense]
├─ crittografia asimmetrica - rsa, ecc, firma digitale e code signing [network-defense], [cloud-security]
├─ csrf - cross-site request forgery e samesite cookies [network-defense], [cloud-security]
├─ dlp - data loss prevention [cloud-security], [dfir]
├─ dmz e screened subnet: dual-firewall, bastion host, jump server [network-defense], [cloud-security]
├─ docker - modello mentale [cloud-security]
├─ docker - uid, permessi e volumi bind mount [cloud-security], [iam]
├─ docker compose [cloud-security]
├─ docker image [cloud-security]
├─ docker network [cloud-security]
├─ docker security [cloud-security], [iam], [persistence]
├─ docker volumes [cloud-security]
├─ dockerfile [cloud-security]
├─ edr vs antivirus - behavioral analysis e response [threat-hunting], [cloud-security]
├─ firewall types: packet filtering, stateful, ngfw, waf, proxy [network-defense], [cloud-security]
├─ hashing, hmac e password storage - integrita' e autenticazione [network-defense], [cloud-security]
├─ hypervisor - type 1 vs type 2, vm escape e container [system], [cloud-security]
├─ i confini della visibilità: pubblico vs privato [system], [cloud-security]
├─ kms - key management system e key rotation [cloud-security], [network-defense]
├─ load balancer - active-active, active-passive e session affinity [network-defense], [cloud-security]
├─ mdm - mobile device management e byod [cloud-security], [network-defense]
├─ nac - network access control e posture assessment [network-defense], [cloud-security]
├─ oauth 2.0 e oidc - autorizzazione e autenticazione federata [iam], [cloud-security]
├─ pki - public key infrastructure e chain of trust [network-defense], [cloud-security]
├─ privileged access management - jit access e password vault enterprise [iam], [cloud-security]
├─ replay attack - timestamp, nonce e kerberos [network-defense], [cloud-security]
├─ session hijacking - cookie theft, httponly e token regeneration [network-defense], [cloud-security]
├─ ssl stripping, hsts e cryptographic downgrade attacks [network-defense], [cloud-security]
├─ sso, kerberos e saml - enterprise identity federation [iam], [cloud-security]
├─ tls - transport layer security - handshake e crittografia ibrida [network-defense], [cloud-security]
├─ tpm e hsm - hardware security module e trusted platform module [network-defense], [cloud-security]
├─ vlan - segmentazione logica e vlan hopping [network-defense], [cloud-security]
├─ vpn e ipsec - ike, esp, ah, tunnel e split tunnel [network-defense], [cloud-security]
├─ xss - cross-site scripting reflected, stored, dom e csp [network-defense], [cloud-security]
└─ zero trust architecture - never trust always verify [network-defense], [cloud-security]
▶ 📁 Observability (19)
├─ architettura di wazuh siem/xdr [observability], [system]
├─ auth.log - log di autenticazione [iam], [observability]
├─ eicar test file - lo standard per il test malware [observability]
├─ ids e ips - detection e prevention, host e rete [network-defense], [observability]
├─ incident response - framework e lifecycle [observability], [dfir]
├─ incident response - modiga cap 9 - analisi e risposta agli incidenti [dfir], [observability]
├─ indirizzi ip e listening ports - guida soc [observability]
├─ journalctl vs var log [observability]
├─ journald - systemd-journald [system], [observability]
├─ logging e log aggregation - syslog, windows event e siem [observability], [dfir]
├─ mitre att&ck framework [observability]
├─ osint tools - shodan, censys, virustotal, hibp, exploit-db, cyberchef, navigator, dett&ct [threat-intel], [network-defense], [observability]
├─ reverse proxy [observability]
├─ ruoli aziendali - c-suite e figure security [dfir], [observability]
├─ security controls - tipi e funzioni [dfir], [observability]
├─ siem e soar - detection, correlazione e response automatizzata [observability], [dfir]
├─ soc - struttura e organizzazione [dfir], [observability], [threat-intel]
├─ soc tiers - ruoli e responsabilità [observability]
└─ wazuh + auditd: rilevare una reverse shell con regola custom [observability], [dfir]
▶ 📁 DFIR (25)
├─ bash reverse shell - anatomia del comando [dfir], [system]
├─ chain of custody e digital forensics [dfir]
├─ cia triad [dfir], [threat-intel]
├─ dlp - data loss prevention [cloud-security], [dfir]
├─ dns e http in una lan con switch [network-defense], [dfir]
├─ dns tunneling [network-defense], [dfir], [threat-intel]
├─ frame, pacchetto, segmento - osi e stream [network-defense], [dfir]
├─ git objects - struttura interna di git [dfir], [automation]
├─ http in wireshark - tcp segmentation e packet analysis [network-defense], [dfir]
├─ incident response - framework e lifecycle [observability], [dfir]
├─ incident response - modiga cap 9 - analisi e risposta agli incidenti [dfir], [observability]
├─ kill chain - le 7 fasi di un attacco e punto di intervento [threat-intel], [dfir]
├─ lateral movement - pass-the-hash, mimikatz e credential dumping [threat-hunting], [dfir]
├─ logging e log aggregation - syslog, windows event e siem [observability], [dfir]
├─ operational plans - drp, irp, bcp, change management [dfir], [system]
├─ path traversal, lfi e rfi [dfir]
├─ pentest phases - planning, recon, exploitation, reporting [threat-intel], [dfir]
├─ red team, blue team, purple team - ruoli e dinamiche [dfir], [threat-intel]
├─ ruoli aziendali - c-suite e figure security [dfir], [observability]
├─ secret scanning - trovare segreti esposti [dfir], [threat-intel]
├─ security controls - tipi e funzioni [dfir], [observability]
├─ siem e soar - detection, correlazione e response automatizzata [observability], [dfir]
├─ soc - struttura e organizzazione [dfir], [observability], [threat-intel]
├─ wazuh + auditd: rilevare una reverse shell con regola custom [observability], [dfir]
└─ wireshark [network-defense], [dfir]
▶ 📁 Threat Intel (27)
├─ attacker-in-the-browser - form grabbing e zeus case study [malware-analysis], [threat-intel]
├─ bluetooth attacks - bluejacking, bluesnarfing, bluebugging, bluesmack [network-defense], [threat-intel]
├─ cia triad [dfir], [threat-intel]
├─ cve e nvd - database vulnerabilità [threat-intel]
├─ cvss - common vulnerability scoring system [threat-intel], [network-defense]
├─ ddos reflected e amplification attack [network-defense], [threat-intel]
├─ dns poisoning, pharming e dns sinkhole [network-defense], [threat-intel]
├─ dns resolution flow [network-defense], [threat-intel]
├─ dns tunneling [network-defense], [dfir], [threat-intel]
├─ gap analysis - stato attuale vs stato desiderato [threat-intel]
├─ google operators - operatori di ricerca avanzata [threat-intel]
├─ kill chain - le 7 fasi di un attacco e punto di intervento [threat-intel], [dfir]
├─ malware classification - virus, worm, trojan, rat, rootkit [malware-analysis], [threat-intel]
├─ osint tools - shodan, censys, virustotal, hibp, exploit-db, cyberchef, navigator, dett&ct [threat-intel], [network-defense], [observability]
├─ owasp top 10 [network-defense], [threat-intel]
├─ passive reconnaissance - ricognizione passiva [network-defense], [threat-intel]
├─ pentest phases - planning, recon, exploitation, reporting [threat-intel], [dfir]
├─ ransomware - crypto vs locker, wannacry, notpetya [malware-analysis], [threat-intel]
├─ red team, blue team, purple team - ruoli e dinamiche [dfir], [threat-intel]
├─ scada e ics - ot security e purdue model [network-defense], [threat-intel]
├─ secret scanning - trovare segreti esposti [dfir], [threat-intel]
├─ soc - struttura e organizzazione [dfir], [observability], [threat-intel]
├─ social engineering - phishing, bec e principi di cialdini [threat-intel]
├─ supply chain attack - hardware e software [threat-intel]
├─ syn flood e syn cookies - connection table exhaustion [network-defense], [threat-intel]
├─ threat actors - nation-state, insider, hacktivist e altri [threat-intel]
└─ vulnerability assessment - credentialed vs non-credentialed [network-defense], [threat-intel]
▶ 📁 Malware Analysis (7)
├─ attacker-in-the-browser - form grabbing e zeus case study [malware-analysis], [threat-intel]
├─ botnet e c2 - master-slave vs p2p, domain flux [malware-analysis], [network-defense]
├─ fileless malware - living off the land, powershell [malware-analysis], [threat-hunting]
├─ logic bomb e easter egg [malware-analysis], [persistence]
├─ magic bytes [malware-analysis]
├─ malware classification - virus, worm, trojan, rat, rootkit [malware-analysis], [threat-intel]
└─ ransomware - crypto vs locker, wannacry, notpetya [malware-analysis], [threat-intel]
▶ 📁 Threat Hunting (4)
├─ edr vs antivirus - behavioral analysis e response [threat-hunting], [cloud-security]
├─ fileless malware - living off the land, powershell [malware-analysis], [threat-hunting]
├─ honeypot, honeynet, honeyfile, honeytoken - deception technologies [network-defense], [threat-hunting]
└─ lateral movement - pass-the-hash, mimikatz e credential dumping [threat-hunting], [dfir]
▶ 📁 Persistence (8)
├─ docker security [cloud-security], [iam], [persistence]
├─ link orfani (broken links) [system], [persistence]
├─ logic bomb e easter egg [malware-analysis], [persistence]
├─ reverse shell [network-defense], [persistence]
├─ servizi linux (daemon) [system], [persistence]
├─ shell interattiva vs non interattiva [persistence]
├─ suid, sgid e sticky bit [iam], [persistence]
└─ systemd [persistence]
▶ 📁 IAM (22)
├─ /var/run/docker.sock - il socket di docker [cloud-security], [iam]
├─ aaa - authentication authorization accounting - radius e tacacs+ [iam], [network-defense]
├─ account lifecycle - provisioning, modification, deprovisioning [iam]
├─ auth.log - log di autenticazione [iam], [observability]
├─ docker - uid, permessi e volumi bind mount [cloud-security], [iam]
├─ docker security [cloud-security], [iam], [persistence]
├─ etc directory purpose [system], [iam]
├─ etc passwd anatomy [iam]
├─ identity proofing - resolution, validation, attestation [iam]
├─ linux groups [iam]
├─ linux permissions ugo [iam]
├─ mfa e authentication factors [iam]
├─ oauth 2.0 e oidc - autorizzazione e autenticazione federata [iam], [cloud-security]
├─ orphaned files security [iam]
├─ pam - pluggable authentication modules [iam], [system]
├─ privileged access management - jit access e password vault enterprise [iam], [cloud-security]
├─ ssh key authentication [network-defense], [iam]
├─ ssh protocol - secure shell [iam]
├─ sso, kerberos e saml - enterprise identity federation [iam], [cloud-security]
├─ sudoers and privileges [iam]
├─ suid, sgid e sticky bit [iam], [persistence]
└─ uid gid identifiers [iam]
▶ 📁 Automation (4)
├─ command grouping - {} [automation]
├─ git objects - struttura interna di git [dfir], [automation]
├─ heredoc - blocco di testo come stdin [automation]
└─ sast vs dast vs iast vs sca - application security testing [network-defense], [automation]