Cybersecurity
網路安全
- OpenVAS
- Nessus
- Learning
- Security Websites
- Cyber Attacks
- Suricata
- Snort
- VirusTotal
- Cheat Sheets
- Pentest 滲透測試
- Cybersecurity Certificate
- Cybersecurity Tools
- Honey Pot 蜜罐陷阱
OpenVAS
Installation
Docker
- Docker Hub: https://hub.docker.com/repository/docker/immauss/openvas
- https://immauss.github.io/openvas/
mkdir openvas-data
docker run -d -p 9392:9392 -e PASSWORD="Your admin password here" -v $(pwd)/openvas-data:/data --name openvas immauss/openvas
Kali Linux
HowTo
更新 Feed
- https://community.greenbone.net/t/how-to-update-keep-the-feed-up-to-date/1431
- https://kenwu0310.wordpress.com/2019/09/17/openvas-%E6%87%89%E7%94%A8-%E6%9B%B4%E6%96%B0%E6%BC%8F%E6%B4%9E%E5%AE%9A%E7%BE%A9/
Nessus
Tutorials
- How to Install and Configure Nessus Vulnerability Scanner on Kali Linux
- How to install, configure and use Nessus Vulnerability Scanner on CentOS 8
- Plugin 最新資訊查詢
免費授權版
- 第一次安裝會有 90 天無限制的試用。
- 超過 90 天後的試用,會變成免費授權版。這個有五年的使用期限,而且限定 16 個掃描 IP 的總數量。
- 免費版計算掃描 IP 數量的原則是,只有掃瞄結果有 High(含) 等級以上弱點,這個 IP 才會被計數。
Installation
Install on RedHat 8
- 前往官網申請 Nessus Essentials 的免費啟動碼。
- 從官網下載 Nessus 安裝檔
Nessus-10.1.2-es8.x86_64.rpm
。 - 先更新作業系統
dnf update
。 - 安裝 RPM 檔
rpm -ivh Nessus-10.1.2-es8.x86_64.rpm
。 - 登入網頁
https://server.ip:8834
。 - 輸入啟動碼與建立登入的帳號密碼。
- 完成。
Install with the docker
DockerHub: https://hub.docker.com/r/tenableofficial/nessus
docker pull tenableofficial/nessus:<version>
docker run --name "nessus-pro" -d -p 8834:8834 -e ACTIVATION_CODE=<activation code> \
-e USERNAME=admin -e PASSWORD=admin tenableofficial/nessus:<version>
Update the Nessus 主程式
Offline
- 下載最新版 Nessus : Download Nessus | Tenable®
NOTE: 如果舊版的是用 RPM 安裝,升級時也必須用 RPM 升級。 - 將更新檔上傳至 Nessus 主機,並進行更新作業。
以 RPM 方式更新
rpm -Uvh Nessus-10.4.1-es8.x86_64.rpm
systemctl stop nessusd
systemctl start nessusd
Online
/opt/nessus/sbin/nessuscli update
檢查目前版號
Nessus Admin > Settings > About
Update the plugins
Online
/opt/nessus/sbin/nessuscli update --plugins-only
Offline
- Install Nessus and Plugins Offline (with pictures) - InfosecMatter
- Offline Update Page Details (Nessus) (tenable.com)
- Install Plugins Manually (Nessus) (tenable.com)
For 免費版授權
NOTE: 原有的 activation code 已經註冊過,就不能重複取得 plugin 的下載連結。必須重新申請一組新的 activation code,再依據下方程序取得最新 plugin 下載連結。
- 申請一組新的 Activation Code (NOTE: 只有使用這個連結,才可以立即收到郵件通知)
- 從現有 Nessus 主機取得 Challenge Code
- 用上述的資料透過下述的連結,可以下載最新的 plugin 更新檔,前往: https://plugins.nessus.org/v2/offline.php (TIP: 網頁除了提供 plugin 更新檔
all-2.0.tar.gz
以外,還有授權檔的資訊,不過在這個案例用不上)
取得 Challenge Code (NOTE: 每次重啟系統,Challenge Code 會被重置)
/opt/nessus/sbin/nessuscli fetch --challenge
將 plugin 更新檔上傳至主機並套用
/opt/nessus/sbin/nessuscli update all-2.0.tar.gz
確認 plugin 已更新
Nessus Admin > Settings > About
- Last Updated: 更新的時間
- Plugin Set: 更新後的版本
- Policy Template version: 更新後的版本
注意事項:
- 套用更新檔指令完成後,系統還需要數分鐘時間進行背景更新作業,可以觀察 CPU 的負載程度來確認是否已完成。
- 舊的 scan 不會套用新的 plugin,必須先移除再重新建立才會套用。
重新註冊授權
用新的授權檔重新註冊
- Generating the Custom URL for downloading plugins for an Offline Nessus Installation (tenable.com)
- Manage Nessus Offline (Nessus) (tenable.com)
FAQ
更新 plugin 出現錯誤
Error: failed to write decompressed tar archive * Failed to update from all-2.0.new.tar.gz. Invalid manifest.
解決方案:檢查目錄 /opt/nessus
是否有足夠可用空間。
修正 plugin #51192(SSL Certificate Cannot Be Trusted)
對於使用自我簽署憑證的網站或服務,可以使用 custom_CA 功能,將自訂的根憑證,輸入至 Nessus 系統。
TIP: 根憑證必須是 PEM 格式 BAS64 編碼,內容包含開頭文字
-----BEGIN CERTIFICATE-----
,與結尾文字-----END CERTIFICATE-----
的密文內容。
Nessus Web > Settings > Custom CA
-----BEGIN CERTIFICATE-----
...
...
...
-----END CERTIFICATE-----
Learning
Threat Intelligence
Detection & Analysis Tools
- VirusTotal is a service that allows anyone to analyze suspicious files, domains, URLs, and IP addresses for malicious content. VirusTotal also offers additional services and tools for enterprise use.
- Jotti's malware scan is a free service that lets you scan suspicious files with several antivirus programs. There are some limitations to the number of files that you can submit.
- Urlscan.io is a free service that scans and analyzes URLs and provides a detailed report summarizing the URL information.
- MalwareBazaar is a free repository for malware samples. Malware samples are a great source of threat intelligence that can be used for research purposes.
- OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence knowledge and observables.
AI Cybersecurity
Security Jobs
Interview
- This blog offers lots of helpful tips, information, and practice scenarios on preparing for technical interviews in the cybersecurity field.
Glossary
Security Websites
CVE Database
- https://www.cve.org/ (Formerly: https://cve.mitre.org)
- https://nvd.nist.gov/ (美國漏洞資料庫)
- https://euvd.enisa.europa.eu/ (歐盟漏洞資料庫)
- https://www.twcert.org.tw/tw/lp-132-1.html (台灣漏洞揭露平台)
- https://www.cvedetails.com/
- https://www.kb.cert.org/vuls/ (CERT/CC Vulnerability Notes Database)
Vendor
- RedHat: https://access.redhat.com/security
- iThome: https://www.ithome.com.tw/security
- HPE: https://support.hpe.com/hpesc/public/docDisplay?docId=sd00001284en_us
- IBM: https://www.ibm.com/trust/security-psirt
- VMware: https://www.broadcom.com/support/vmware-security-advisories
- Cisco: https://sec.cloudapps.cisco.com/security/center/publicationListing.x
- HCL Notes: https://support.hcltechsw.com/csm?id=community_topic&sys_id=d1514ac91be8cc5c83cb86e9cd4bcba8
- Ubuntu: https://ubuntu.com/security/cves
- Debian: https://security-tracker.debian.org/tracker/
- Microsoft: https://msrc.microsoft.com/update-guide/vulnerability
- Apple: https://support.apple.com/en-us/HT201222
- Google Cloud: https://cloud.google.com/support/bulletins
Government
- 台灣電腦網路危機處理暨協調中心 TWCERT/CC
- 台灣漏洞揭露平台 (TVN)
- 惡意檔案檢測服務 Virus Check
- 國家資通安全通報應變網站
- 台灣證交所公開資訊觀測站(一)
- 台灣證交所公開資訊觀測站(二)
- 資通安全署 Administration for Cyber Security, moda
- 國家資通安全研究院
- US. CISA
- US. NIST National Vulnerability Database
Security Organization
- BleepingComputer
- No More Ransom
- Cyberattacks & Data Breaches recent news | Dark Reading
- CSO Online
- Krebs on Security
Security Online Tools
- URL and website scanner - urlscan.io
- VirusTotal - Home
- AbuseIPDB - IP address abuse reports - Making the Internet safer, one IP at a time
- Cisco Talos Intelligence Group - Comprehensive Threat Intelligence
- IBM X-Force Exchange
- Palo Alto Networks URL filtering - Test A Site
- Symantec Sitereview
- IP Address Tools, Network Tools, DNS Tools | IPVoid
- Check if a Website is Malicious/Scam or Safe/Legit | URLVoid
- Web Check
NCHC 國網中心
Cyber Attacks
Suricata
Introduction
Suricata is a high performance, open source network analysis and threat detection software used by most private and public organizations, and embedded by major vendors to protect their assets.
Suricata is far more than an IDS/IPS.
Suricata features
There are three main ways Suricata can be used:
-
Intrusion detection system (IDS): As a network-based IDS, Suricata can monitor network traffic and alert on suspicious activities and intrusions. Suricata can also be set up as a host-based IDS to monitor the system and network activities of a single host like a computer.
-
Intrusion prevention system (IPS): Suricata can also function as an intrusion prevention system (IPS) to detect and block malicious activity and traffic. Running Suricata in IPS mode requires additional configuration such as enabling IPS mode.
-
Network security monitoring (NSM): In this mode, Suricata helps keep networks safe by producing and saving relevant network logs. Suricata can analyze live network traffic, existing packet capture files, and create and save full or conditional packet captures. This can be useful for forensics, incident response, and for testing signatures. For example, you can trigger an alert and capture the live network traffic to generate traffic logs, which you can then analyze to refine detection signatures.
Signatures (Rules)
Suricata uses signatures analysis, which is a detection method used to find events of interest. Signatures consist of three components:
-
Action: The first component of a signature. It describes the action to take if network or system activity matches the signature. Examples include: alert, pass, drop, or reject.
-
Header: The header includes network traffic information like source and destination IP addresses, source and destination ports, protocol, and traffic direction.
-
Rule options: The rule options provide you with different options to customize signatures.
Here's an example of a Suricata signature:
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"GET on wire"; flow:established,to_server; content:"GET"; http_method; sid:12345; rev:3;)
Action
Note that the drop
action also generates an alert, but it drops the traffic. A drop
action only occurs when Suricata runs in IPS mode.
The pass
action allows the traffic to pass through the network interface. The pass rule can be used to override other rules. An exception to a drop rule can be made with a pass rule. For example, the following rule has an identical signature to the previous example, except that it singles out a specific IP address to allow only traffic from that address to pass:
pass http 172.17.0.77 any -> $EXTERNAL_NET any (msg:"BAD USER-AGENT";flow:established,to_server;content:!”Mozilla/5.0”; http_user_agent; sid: 12365; rev:1;)
The reject
action does not allow the traffic to pass. Instead, a TCP reset packet will be sent, and Suricata will drop the matching packet. A TCP reset packet tells computers to stop sending messages to each other.
Note: Rule order refers to the order in which rules are evaluated by Suricata. Rules are loaded in the order in which they are defined in the configuration file. However, Suricata processes rules in a different default order: pass, drop, reject, and alert. Rule order affects the final verdict of a packet.
Header
$HOME_NET
is a Suricata variable defined in /etc/suricata/suricata.yaml
that you can use in your rule definitions as a placeholder for your local or home network to identify traffic that connects to or from systems within your organization.
Rule options
- The
msg:
option provides the alert text. In this case, the alert will print out the text“GET on wire”
, which specifies why the alert was triggered. - The
flow:established,to_server
option determines that packets from the client to the server should be matched. (In this instance, a server is defined as the device responding to the initial SYN packet with a SYN-ACK packet.) - The
content:"GET"
option tells Suricata to look for the wordGET
in the content of thehttp.method
portion of the packet. - The
sid:12345
(signature ID) option is a unique numerical value that identifies the rule. - The
rev:3
option indicates the signature's revision which is used to identify the signature's version. Here, the revision version is 3.
Confiuration file
Configuration files let you customize exactly how you want your IDS to interact with the rest of your environment.
Suricata's configuration file is suricata.yaml
, which uses the YAML file format for syntax and structure.
Log files
There are two log files that Suricata generates when alerts are triggered:
-
eve.json: The eve.json file is the standard Suricata log file. This file contains detailed information and metadata about the events and alerts generated by Suricata stored in JSON format. For example, events in this file contain a unique identifier called flow_id which is used to correlate related logs or alerts to a single network flow, making it easier to analyze network traffic. The eve.json file is used for more detailed analysis and is considered to be a better file format for log parsing and SIEM log ingestion.
-
fast.log: The fast.log file is used to record minimal alert information including basic IP address and port details about the network traffic. The fast.log file is used for basic logging and alerting and is considered a legacy file format and is not suitable for incident response or threat hunting tasks.
The main difference between the eve.json file and the fast.log file is the level of detail that is recorded in each. The fast.log file records basic information, whereas the eve.json file contains additional verbose information.
Trigger a custom rule
With a packet capture file
- The
-r sample.pcap
option specifies an input file to mimic network traffic. In this case, thesample.pcap
file. - The
-S custom.rules
option instructs Suricata to use the rules defined in thecustom.rules
file. - The
-k none
option instructs Suricata to disable all checksum checks.
sudo suricata -r sample.pcap -S custom.rules -k none
Check the logs
# For fast.log
cat /var/log/suricata/fast.log
# For eve.log, using jq command to display the JSON format
jq . /var/log/suricata/eve.json | less
jq -c "[.timestamp,.flow_id,.alert.signature,.proto,.dest_ip]" /var/log/suricata/eve.json
jq "select(.flow_id==1200997752018164)" /var/log/suricata/eve.json
Resources
Snort
Introduction
Snort is the foremost Open Source Intrusion Prevention System (IPS) in the world. Snort IPS uses a series of rules that help define malicious network activity and uses those rules to find packets that match against them and generates alerts for users.
- Snort - Network Intrusion Detection & Prevention System
- [Day18] 動手架設入侵偵測系統吧~Snort 介紹、安裝教學 - iT 邦幫忙::一起幫忙解決難題,拯救 IT 人的一天 (ithome.com.tw)
VirusTotal
Analyse suspicious files, domains, IPs and URLs to detect malware and other breaches, automatically share them with the security community.
URL: https://www.virustotal.com/
Analyze the report
-
Detection: This tab provides a list of third-party security vendors and their detection verdicts on an artifact. Detection verdicts include: malicious, suspicious, unsafe, and others. Notice how many security vendors have reported this hash as malicious and how many have not.
-
Details: This tab provides additional information extracted from a static analysis of the IoC. Notice the additional hashes associated with this malware like MD5, SHA-1, and more.
-
Relations: This tab contains information about the network connections this malware has made with URLs, domain names, and IP addresses. The Detections column indicates how many vendors have flagged the URL or IP address as malicious.
-
Behavior: This tab contains information related to the observed activity and behaviors of an artifact after executing it in a controlled environment, such as a sandboxed environment. A sandboxed environment is an isolated environment that allows a file to be executed and observed by analysts and researchers. Information about the malware's behavioral patterns is provided through sandbox reports. Sandbox reports include information about the specific actions the file takes when it's executed in a sandboxed environment, such as registry and file system actions, processes, and more. Notice the different types of tactics and techniques used by this malware and the files it created.
Pro tip: Sandbox reports are useful in understanding the behavior of a file, but they might contain information that is not relevant to the analysis of the file. By default, VirusTotal shows all sandbox reports in the Behavior tab. You can select individual sandbox reports to view. This is helpful because you can view the similarities and differences between reports so that it's easier to identify which behaviors are likely to be associated with the file.
Determine whether the file is malicious
-
The Vendors' ratio is the metric widget displayed at the top of the report. This number represents how many security vendors have flagged the file as malicious over all. A file with a high number of vendor flags is more likely to be malicious.
-
The Community Score is based on the collective inputs of the VirusTotal community. The community score is located below the vendor's ratio and can be displayed by hovering your cursor over the red X. A file with a negative community score is more likely to be malicious.
-
Under the Detection tab, the Security vendors' analysis section provides a list of detections for this file made by security vendors, like antivirus tools. Vendors who have not identified the file as malicious are marked with a checkmark. Vendors who have flagged the file as malicious are marked with an exclamation mark. Files that are flagged as malicious might also include the name of the malware that was detected and other additional details about the file. This section provides insights into a file's potential maliciousness.
Review these three sections to determine if there is a consistent assessment of the file's potential maliciousness such as: a high vendors' ratio, a negative community score, and malware detections in the security vendors' analysis section.
Screenshots
Cheat Sheets
Cybersecurity Acronyms
Common types of password attacks
Designing Secure Systems
Risk Management Framework
Pentest 滲透測試
滲透測試(Penetration Test,簡寫可以稱 Pen Test),是一種用來檢驗網路防禦是否按照預期計畫正常運行的機制。這個測試會模擬駭客和惡意使用者的行為,試圖入侵企業網站、資訊系統或設備,並分析目標的風險層級,評估安全性是否需要加強。最終目的在於,能在真實攻擊發生前,及早發現安全漏洞並加以修正。
Search Engines
Cybersecurity Certificate
Google Cybersecurity Certificates (GCC)
Google 資安證書
Qualify for the following jobs:
- Cybersecurity analyst
- Information security analyst
- Security analyst
- IT security analyst
- SOC analyst
- Cyber defense analyst
You'll learn about:
- Programming for cybersecurity tasks
- Frameworks and controls that inform security operations
- Using security information and event management (SIEM) tools for cybersecurity
- Detecting and responding to incidents using an intrusion detection system
- Performing packet capture and analysis
- Using AI to boost productivity
Cybersecurity Tools
Seach More
- 10 Top Open Source Penetration Testing Tools
- OSV-Scanner
- 5 Tools to Scan a Linux Server for Malware and Rootkits (tecmint.com)
- Hottest cybersecurity open-source tools of the month: May 2025 - Help Net Security
Online Tools
功能描述 | |
---|---|
shodan.io | 搜索互聯網連接設備的搜索引擎。 |
censys.io | 提供互聯網設備和網絡資產信息的搜索平台。 |
hunter.io | 查找與特定域名相關的電子郵件地址的工具。 |
fullhunt.io | 自動化攻擊面管理和漏洞發現平台。 |
onyphe.io | 網絡資產搜索和網絡安全信息收集引擎。 |
socradar.io | 提供實時網絡威脅情報和數字風險保護服務。 |
binaryedge.io | 互聯網範圍掃描和網絡風險評估平台。 |
ivre.rocks | 開源網絡偵察框架。 |
crt.sh | 搜索和查詢SSL/TLS證書的數據庫。 |
vulners.com | 綜合性漏洞數據庫和安全內容存儲庫。 |
publicwww.com | 源代碼搜索引擎,用於在網頁源碼中查找特定代碼片段。 |
pulsedive.com | 威脅情報和網絡安全數據聚合平台。 |
intelx.io | 多源開放源情報(OSINT)搜索和分析工具。 |
wigle.net | 無線網絡數據庫和地圖服務。 |
viz.greynoise.io |
Vulnerability Scanner
- OpenVAS
- Nessus
- RustScan : The Modern Port Scanner
- Vuls : Agentless Vulnerability Scanner for Linux/FreeBSD
Tools
-Wazuh
The Open Source Security Platform
- https://wazuh.com/
- YT: this Cybersecurity Platform is FREE
- YT: you need this FREE CyberSecurity tool
- YT: Wazuh Open Source SIEM Tutorial - YouTube
- YT: Wazuh! Powerful, Open Source Endpoint Security Monitoring!
-Web Check
All-in-one OSINT tool for analysing any website
-OWASP: Nettacker
Automated Penetration Testing Framework (自動滲透測試框架)
-WAF: Web Application Firewall
- GoTestWAF
- Test and evaluate your WAF before hackers
- SafeLine - A self-hosted WAF(Web Application Firewall)
-Pi-Alert: WiFi/LAN 連網裝置偵測
- Pi.Alert
- [Video] Pi Alert - Open Source, Self Hosted, Network Device Change Notification and Intrusion Detection
-WatchYourLAN
-ntopng
Network traffic monitor
- ntopng – ntop
- YT: NTopNG - A Free, Open Source, Self Hosted, Network Monitoring and Analysis Tool. - YouTube
-ImHex: Hex Editor
A Hex Editor for Reverse Engineers, Programmers and people who value their retinas when working at 3 AM
-OSSIEM
Open Source SIEM Stack, Wazuh + Graylog + Velociraptor + Copilot
-Fishing Test
- pfish - 轻量级的无害化钓鱼
-CISO Assistant
CISO Assistant is a one-stop-shop for GRC, covering Risk, AppSec and Audit Management
-Cybersecurity OS platforms
- TOP VIRTUAL MACHINES FOR CYBERSECURITY PROFESSIONALS | by Flavio Queiroz | CTI Flash Insights | Medium
- Kali Linux
- ParrotOS
-MISP
MISP (Malware Information Sharing Platform)
Honey Pot 蜜罐陷阱
Introduction
Self-hosted Services
- Awesome-Honeypot - Cowrie Honeypot with Elasticsearch