CalcBase64 Encode / Decode
Encode/decode Base64 — common in phishing macro payloads, PowerShell -enc commands, and URL parameter obfuscation.
CalcURL / IOC Defang & Refang
Convert a live URL/IP/email into a safe, non-clickable defanged form for a report — or reverse it to test the real link.
CalcHash Identifier
Guess a hash's type from its length/prefix so you pick the right hashcat -m or john --format before burning cracking time on the wrong mode.
CalcHashcat / John Mode Lookup
Search by hash type to get the matching hashcat -m number and John format name side by side — full detail in hashcat-cheatsheet-professional.md / john-the-ripper-cheatsheet-professional.md.
| Hash Type | Hashcat -m | John --format |
|---|
CalcTimestamp Converter
Convert between Unix epoch, human-readable UTC, and Windows FILETIME (used in Volatility/Autopsy/registry timestamps) — DFIR needs all three constantly.
CalcSubnet / CIDR Calculator
Given an IP and prefix length, get the network/broadcast address, usable host range, and total host count — for scoping a range before an nmap sweep.
CalcCommon Port Lookup
Quick lookup for what's normally running on a given port — the first question after an nmap scan comes back.
| Port | Protocol | Service |
|---|
CalcHTTP Status Code Reference
Quick lookup while reading Burp/gobuster/dirb output.
| Code | Meaning | Note |
|---|
CalcNumber Base / ASCII Converter
Convert a value between hex, decimal, octal, binary, and its ASCII character — for reading raw bytes, shellcode, or offsets.
CalcROT13 / ROT47
Simple substitution cipher, self-reversing — apply the same function again to undo it.
CalcWindows Event ID Lookup
Search the Event ID reference table live — full detail (attack→Event ID mapping, Sysmon IDs, logon types) in windows-event-id-reference-cheatsheet-professional.md.
| Event ID | Meaning |
|---|
CalcCron Expression Parser
Break down a 5-field cron expression field by field — useful when a Linux privesc check surfaces a suspicious cron job.
RedHost & Networking AuditingNmap — Scan Types & Timing
The scan-type and timing flags reached for on nearly every engagement, from the first host-discovery sweep through service/OS fingerprinting.
-sS | TCP SYN (half-open) — default as root, fast, less logged |
-sT | TCP Connect — non-root fallback |
-sU | UDP scan — slow, relies on ICMP unreachable |
-sV / -O | Service version / OS fingerprint |
-A | Aggressive: -sV -O -sC --traceroute |
-T0…-T5 | Paranoid → Insane timing (T4 common for labs) |
--script vuln | NSE vulnerability-category sweep |
Full reference: nmap-cheatsheet-professional.md
RedHost & Network Penetration TestingAD Attack Quick Map
The five Active Directory attack paths that come up most in engagements and eJPT labs, each with the exact tool chain that takes it from enumeration to cracked credential.
| Kerberoasting | GetUserSPNs.py → hashcat -m 13100 |
| AS-REP Roasting | GetNPUsers.py → hashcat -m 18200 |
| Pass-the-Hash | crackmapexec smb target -u user -H ntlmhash |
| DCSync | secretsdump.py with Replication rights |
| Password Spraying | Check lockout policy first — crackmapexec --pass-pol |
Full reference: active-directory-enumeration-cheatsheet-professional.md
RedAssessment MethodologiesAssessment Types & Box Models
What kind of engagement this actually is and how much starting information the tester has — the two things that should be settled before any tool gets opened.
| Vulnerability Assessment | Identify only, no exploitation |
| Penetration Test | Prove exploitability + impact (eJPT maps here) |
| Red Team | Test detection/response, active evasion |
| Black / Grey / White Box | None / partial / full starting info (eJPT labs ≈ grey box) |
Full reference: penetration-testing-methodology-cheatsheet-professional.md
RedHost & Network Penetration TestingPrivesc Checklist
The first commands to run on any freshly-landed shell to find a path from low-privilege user to root/SYSTEM.
| Linux | sudo -l, SUID (find / -perm -4000), cron jobs, getcap -r / |
| Windows | whoami /priv, unquoted service paths, AlwaysInstallElevated, weak service perms |
| Automated | linpeas.sh / winPEAS.exe as the first pass, verify manually |
Full reference: linux-windows-pentest-cheatsheet-professional.md
RedWeb Application Penetration TestingWeb Vuln Quick Triggers
The minimal payload or command that confirms each common web vulnerability class is actually exploitable, before investing time in a full exploit chain.
| LFI | ?page=../../../../etc/passwd |
| Command Injection | ; whoami / && whoami / `whoami` |
| Blind injection test | ; sleep 5 — time-based confirmation |
| SQLi automation | sqlmap -u URL --batch --dbs |
Full reference: web-enumeration-common-vulns-cheatsheet-professional.md, sqlmap-cheatsheet-professional.md
RedHost & Network Penetration TestingMetasploit — Quick Start
The core msfconsole workflow — find a module, set options, catch a Meterpreter shell — condensed to the commands used in almost every exploitation phase.
search type:exploit platform:windows smb | Find a module by platform/service |
use exploit/... | Load the module |
show options / set RHOSTS ... | Review and set required options |
set PAYLOAD windows/meterpreter/reverse_tcp | Pick a payload matching the target |
run / exploit | Launch it |
msfvenom -p ... -f exe -o shell.exe | Generate a standalone payload outside msfconsole |
Full reference: metasploit-cheatsheet-professional.md
RedAI Enhanced PentestingAI-Assisted Pentesting — Practical Use
Where generative AI tools genuinely save time in an engagement versus where they introduce risk — treat AI output as a draft that still needs verification, not a source of truth.
| Recon triage | Summarizing large nmap/enum output to spot what's worth investigating first |
| Script/payload review | Explaining an unfamiliar exploit script before running it against a live target |
| Report writing | Drafting finding descriptions/remediation text from your own raw notes — always fact-check against evidence |
| ⚠️ Risk | Never paste client-confidential scope, credentials, or live target data into a public/hosted AI tool |
General guidance, not tied to a specific exam objective — treat as a productivity habit layered on top of the core methodology in penetration-testing-methodology-cheatsheet-professional.md.
BlueIncident ResponsePICERL — Incident Response Phases
The six-phase NIST SP 800-61 lifecycle that structures every incident from first alert to the post-mortem that feeds back into next time's Preparation.
| Preparation | Playbooks, log coverage, forensic toolkit readiness |
| Identification | Is it actually an incident? Scope + severity |
| Containment | Stop the spread — isolate, don't destroy evidence |
| Eradication | Remove the root cause, not just the symptom |
| Recovery | Return to normal, monitor for reinfection |
| Lessons Learned | Post-Incident Review, feed back into Preparation |
Full reference: incident-response-lifecycle-cheatsheet-professional.md
BlueThreat IntelligenceMITRE ATT&CK — 12 Tactics
The 12 tactic categories of the ATT&CK Enterprise matrix, in rough attack-chain order, for mapping a detection or finding back to adversary intent.
| Reconnaissance | Initial Access |
| Execution | Persistence |
| Privilege Escalation | Defense Evasion |
| Credential Access | Discovery |
| Lateral Movement | Collection |
| Command and Control | Exfiltration / Impact |
Full reference: threat-intelligence-mitre-attack-cheatsheet-professional.md
BlueThreat IntelligencePyramid of Pain
David Bianco's model for ranking IOC types by how much it actually costs an attacker when that indicator gets blocked — the case for detecting TTPs over hashes.
| Hash Values | Trivial for attacker to change |
| IP Addresses | Easy — spin up a new VPS |
| Domain Names | Moderate — register a new one |
| Network/Host Artifacts | Hard — reconfigure the malware |
| Tools | Very hard — develop/acquire a new one |
| TTPs | Hardest — rethink the whole operation |
Full reference: threat-intelligence-mitre-attack-cheatsheet-professional.md
BluePhishing AnalysisSPF / DKIM / DMARC Quick Read
What each email authentication mechanism actually verifies, and the trap where all three passing still doesn't rule out phishing.
| SPF | Which IPs/servers may send for this domain |
| DKIM | Digital signature proving the message wasn't altered |
| DMARC | What to do on failure: none / quarantine / reject |
| ⚠️ Trap | All three can PASS and the email can still be phishing (attacker's own legitimately-authenticated domain) |
Full reference: phishing-cheatsheet.md
BlueDigital ForensicsVolatility3 Quick Commands
The Volatility3 plugins that cover the first pass of any memory image — running processes, network activity, and injected code.
| Process list / hidden scan | windows.pslist / windows.psscan |
| Process tree | windows.pstree |
| Network connections | windows.netscan |
| Injection detection | windows.malfind |
| Hash dump | windows.hashdump |
Full reference: volatility-autopsy-forensics-cheatsheet-professional.md
BlueDigital ForensicsFast Triage Tools
The fastest tools for a first-pass triage of Windows Event Logs and packet captures, before reaching for a deeper forensic workflow.
| DeepBlueCLI | .\DeepBlue.ps1 file.evtx — automated Event Log hunting |
| Wireshark C2 tell | Regular time intervals to the same external host = beaconing |
| tshark | tshark -r file.pcap -Y "filter" — CLI Wireshark for large captures |
Full reference: deepblue-cli-cheatsheet-professional.md, wireshark-advanced-cheatsheet.md
BlueSecurity FundamentalsCIA Triad & Defense in Depth
The foundational model behind every security decision downstream — what you're protecting (CIA) and why no single control is ever trusted alone (defense in depth).
| Confidentiality | Only authorized parties can read the data — broken by data leaks/breaches |
| Integrity | Data hasn't been altered without authorization — broken by tampering |
| Availability | Authorized parties can access data/systems when needed — broken by DoS/ransomware |
| Defense in Depth | Layer preventive, detective, and corrective controls so one failure isn't total compromise |
| Control types | Preventive (block it) → Detective (notice it) → Corrective (recover from it) |
Baseline vocabulary underpinning the rest of the BTL1-oriented cards in this tab.
BlueSIEMSIEM Quick Query Reference
The handful of Splunk SPL / ELK query patterns used constantly when pivoting from an alert to the raw events behind it.
| Splunk — basic search | index=main sourcetype=winlog EventCode=4625 |
| Splunk — count by field | ... | stats count by src_ip |
| Splunk — time window | earliest=-24h latest=now |
| ELK/KQL — basic search | event.code:4625 and source.ip:* |
| ELK — field exists | _exists_:user.name |
Full reference: siem-splunk-elk-cheatsheet-professional.md