Cybersecurity 網路安全 OpenVAS Installation Docker Docker Hub: https://hub.docker.com/repository/docker/immauss/openvas   https://immauss.github.io/openvas/   mkdir openvas-data docker run -d -p 9392:9392 -e PASSWORD="Your admin password here" -v $(pwd)/openvas-data:/data --name openvas immauss/openvas Kali Linux Install OpenVAS on Kali Linux HowTo 更新 Feed https://community.greenbone.net/t/how-to-update-keep-the-feed-up-to-date/1431 https://kenwu0310.wordpress.com/2019/09/17/openvas-%E6%87%89%E7%94%A8-%E6%9B%B4%E6%96%B0%E6%BC%8F%E6%B4%9E%E5%AE%9A%E7%BE%A9/ Nessus Tutorials How to Install and Configure Nessus Vulnerability Scanner on Kali Linux How to install, configure and use Nessus Vulnerability Scanner on CentOS 8 Plugin 最新資訊查詢 免費授權版 第一次安裝會有 90 天無限制的試用。 超過 90 天後的試用，會變成免費授權版。這個有五年的使用期限，而且限定 16 個掃描 IP 的總數量。 免費版計算掃描 IP 數量的原則是，只有掃瞄結果有 High(含) 等級以上弱點，這個 IP 才會被計數。 Installation Install on RedHat 8 前往官網申請 Nessus Essentials 的免費啟動碼。 從官網下載 Nessus 安裝檔 Nessus-10.1.2-es8.x86_64.rpm 。 先更新作業系統 dnf update 。 安裝 RPM 檔 rpm -ivh Nessus-10.1.2-es8.x86_64.rpm 。 登入網頁 https://server.ip:8834 。 輸入啟動碼與建立登入的帳號密碼。 完成。 Install with the docker DockerHub: https://hub.docker.com/r/tenableofficial/nessus  docker pull tenableofficial/nessus: docker run --name "nessus-pro" -d -p 8834:8834 -e ACTIVATION_CODE= \ -e USERNAME=admin -e PASSWORD=admin tenableofficial/nessus: Update the Nessus 主程式 Offline 下載最新版 Nessus : Download Nessus | Tenable® NOTE: 如果舊版的是用 RPM 安裝，升級時也必須用 RPM 升級。  將更新檔上傳至 Nessus 主機，並進行更新作業。 以 RPM 方式更新 rpm -Uvh Nessus-10.4.1-es8.x86_64.rpm systemctl stop nessusd systemctl start nessusd Online /opt/nessus/sbin/nessuscli update 檢查目前版號 Nessus Admin > Settings > About Update the plugins Online /opt/nessus/sbin/nessuscli update --plugins-only Offline Install Nessus and Plugins Offline (with pictures) - InfosecMatter Offline Update Page Details (Nessus) (tenable.com) Install Plugins Manually (Nessus) (tenable.com) For 免費版授權 NOTE: 原有的 activation code 已經註冊過，就不能重複取得 plugin 的下載連結。必須重新申請一組新的 activation code，再依據下方程序取得最新 plugin 下載連結。 申請一組新的 Activation Code (NOTE: 只有使用這個連結，才可以立即收到郵件通知) 從現有 Nessus 主機取得 Challenge Code 用上述的資料透過下述的連結，可以下載最新的 plugin 更新檔，前往:  https://plugins.nessus.org/v2/offline.php   (TIP: 網頁除了提供 plugin 更新檔 all-2.0.tar.gz 以外，還有授權檔的資訊，不過在這個案例用不上) 取得 Challenge Code (NOTE: 每次重啟系統，Challenge Code 會被重置) /opt/nessus/sbin/nessuscli fetch --challenge 將 plugin 更新檔上傳至主機並套用 /opt/nessus/sbin/nessuscli update all-2.0.tar.gz 確認 plugin 已更新 Nessus Admin > Settings > About  Last Updated: 更新的時間 Plugin Set: 更新後的版本 Policy Template version: 更新後的版本 注意事項： 套用更新檔指令完成後，系統還需要數分鐘時間進行背景更新作業，可以觀察 CPU 的負載程度來確認是否已完成。 舊的 scan 不會套用新的 plugin，必須先移除再重新建立才會套用。 重新註冊授權 用新的授權檔重新註冊 Generating the Custom URL for downloading plugins for an Offline Nessus Installation (tenable.com) Manage Nessus Offline (Nessus) (tenable.com) FAQ 更新 plugin 出現錯誤 Error: failed to write decompressed tar archive * Failed to update from all-2.0.new.tar.gz.  Invalid manifest. 解決方案：檢查目錄 /opt/nessus 是否有足夠可用空間。 修正 plugin #51192(SSL Certificate Cannot Be Trusted) 對於使用自我簽署憑證的網站或服務，可以使用 custom_CA 功能，將自訂的根憑證，輸入至 Nessus 系統。 TIP: 根憑證必須是 PEM 格式 BAS64 編碼，內容包含開頭文字 -----BEGIN CERTIFICATE----- ，與結尾文字 -----END CERTIFICATE----- 的密文內容。 Nessus Web > Settings > Custom CA -----BEGIN CERTIFICATE----- ... ... ... -----END CERTIFICATE----- Log4Shell 誤警報事件  Nessus 的檢測報告裡，許多各式主機或連網裝置，只要有開啟 HTTP 或 HTTPS 網頁介面，都會出現 Plugin  156014 與 156016 的 Log4Shell 漏洞資訊。 這兩個 Plugin 使用了回測 (Callback)的偵測技術，所以 Scanner (Nessus server) 與 Target (Being scanned hosts) 都需要能連外網的 Tenable Controlled Server。 一般企業裡的網路是限制外網存取的，所以會造成系統誤判的情況。 官方文件指引： Overview of Callbacks in Log4j Remote Detection Plugins The... | Tenable Connect Nessus 有兩種不同版本，雲端版 ( Tenable.io )與自行託管的地端版。Log4Shell 有兩個無需認證的檢測 Plugin。 Plugin 156014 : 地端主機與被掃描主機需要外網存取，僅適用雲端版 Plugin 155998 : 雲端主機需要可以存取內部被掃描的主機，僅適用地端版 不適用的 Plugin 可以從管理介面將它排除。 Learning Threat Intelligence Detection & Analysis Tools VirusTotal is a service that allows anyone to analyze suspicious files, domains, URLs, and IP addresses for malicious content. VirusTotal also offers additional services and tools for enterprise use. Jotti's malware scan is a free service that lets you scan suspicious files with several antivirus programs. There are some limitations to the number of files that you can submit. Urlscan.io is a free service that scans and analyzes URLs and provides a detailed report summarizing the URL information. MalwareBazaar is a free repository for malware samples. Malware samples are a great source of threat intelligence that can be used for research purposes. OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence knowledge and observables. Resources Awesome Cybersecurity Handbooks Security Jobs Interview This blog offers lots of helpful tips, information, and practice scenarios on preparing for technical interviews in the cybersecurity field. Glossary Google-Cybersecurity-Certificate-glossary.docx Security Websites CVE Database https://www.cve.org/ (Formerly: https://cve.mitre.org) https://nvd.nist.gov/ (美國漏洞資料庫) https://euvd.enisa.europa.eu/ (歐盟漏洞資料庫) https://www.twcert.org.tw/tw/lp-132-1.html (台灣漏洞揭露平台) https://www.cvedetails.com/ https://www.kb.cert.org/vuls/ (CERT/CC Vulnerability Notes Database) Vendor RedHat: https://access.redhat.com/security iThome: https://www.ithome.com.tw/security HPE: https://support.hpe.com/hpesc/public/docDisplay?docId=sd00001284en_us IBM: https://www.ibm.com/trust/security-psirt VMware: https://www.broadcom.com/support/vmware-security-advisories   Cisco: https://sec.cloudapps.cisco.com/security/center/publicationListing.x   HCL Notes: https://support.hcltechsw.com/csm?id=community_topic&sys_id=d1514ac91be8cc5c83cb86e9cd4bcba8 Ubuntu: https://ubuntu.com/security/cves   Debian: https://security-tracker.debian.org/tracker/   Microsoft: https://msrc.microsoft.com/update-guide/vulnerability   Apple: https://support.apple.com/en-us/HT201222   Google Cloud: https://cloud.google.com/support/bulletins   Government 台灣電腦網路危機處理暨協調中心 TWCERT/CC 台灣漏洞揭露平台 (TVN) 惡意檔案檢測服務 Virus Check 國家資通安全通報應變網站 台灣證交所公開資訊觀測站(一) 台灣證交所公開資訊觀測站(二) 資通安全署 Administration for Cyber Security, moda 國家資通安全研究院 US. CISA US. NIST National Vulnerability Database CERT-EU Security Organization HelpNetSecurity BleepingComputer No More Ransom Cyberattacks & Data Breaches recent news | Dark Reading CSO Online Krebs on Security Security Online Tools URL and website scanner - urlscan.io VirusTotal - Home AbuseIPDB - IP address abuse reports - Making the Internet safer, one IP at a time Cisco Talos Intelligence Group - Comprehensive Threat Intelligence IBM X-Force Exchange Palo Alto Networks URL filtering - Test A Site Symantec Sitereview IP Address Tools, Network Tools, DNS Tools | IPVoid Check if a Website is Malicious/Scam or Safe/Legit | URLVoid Web Check NCHC 國網中心 Malware Knowledge Base (nchc.org.tw) 雲端資安攻防平臺 Cyber Attacks Suricata Introduction Suricata is a high performance, open source network analysis and threat detection software used by most private and public organizations, and embedded by major vendors to protect their assets. Suricata is far more than an IDS/IPS. Home - Suricata 開源Suricata入侵偵測　揪出網路攻擊與異常行為 | 網管人 (netadmin.com.tw) Suricata features There are three main ways Suricata can be used: Intrusion detection system ( IDS ): As a network-based IDS, Suricata can monitor network traffic and alert on suspicious activities and intrusions. Suricata can also be set up as a host-based IDS to monitor the system and network activities of a single host like a computer. Intrusion prevention system ( IPS ): Suricata can also function as an intrusion prevention system (IPS) to detect and block malicious activity and traffic. Running Suricata in IPS mode requires additional configuration such as enabling IPS mode. Network security monitoring ( NSM ): In this mode, Suricata helps keep networks safe by producing and saving relevant network logs. Suricata can analyze live network traffic, existing packet capture files, and create and save full or conditional packet captures. This can be useful for forensics, incident response, and for testing signatures. For example, you can trigger an alert and capture the live network traffic to generate traffic logs, which you can then analyze to refine detection signatures. Signatures (Rules) Suricata uses signatures analysis , which is a detection method used to find events of interest. Signatures consist of three components: Action : The first component of a signature. It describes the action to take if network or system activity matches the signature. Examples include: alert, pass, drop, or reject. Header : The header includes network traffic information like source and destination IP addresses, source and destination ports, protocol, and traffic direction. Rule options: The rule options provide you with different options to customize signatures. Here's an example of a Suricata signature: alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"GET on wire"; flow:established,to_server; content:"GET"; http_method; sid:12345; rev:3;) Action Note that the drop action also generates an alert, but it drops the traffic. A drop action only occurs when Suricata runs in IPS mode. The pass action allows the traffic to pass through the network interface. The pass rule can be used to override other rules. An exception to a drop rule can be made with a pass rule. For example, the following rule has an identical signature to the previous example, except that it singles out a specific IP address to allow only traffic from that address to pass: pass http 172.17.0.77 any -> $EXTERNAL_NET any (msg:"BAD USER-AGENT";flow:established,to_server;content:!”Mozilla/5.0”; http_user_agent; sid: 12365; rev:1;) The  reject action does not allow the traffic to pass. Instead, a TCP reset packet will be sent, and Suricata will drop the matching packet. A TCP reset packet tells computers to stop sending messages to each other. Note: Rule order refers to the order in which rules are evaluated by Suricata. Rules are loaded in the order in which they are defined in the configuration file. However, Suricata processes rules in a different default order: pass, drop, reject, and alert. Rule order affects the final verdict of a packet. Header $HOME_NET  is a Suricata variable defined in  /etc/suricata/suricata.yaml that you can use in your rule definitions as a placeholder for your local or home network to identify traffic that connects to or from systems within your organization. Rule options The  msg:  option provides the alert text. In this case, the alert will print out the text  “GET on wire” , which specifies why the alert was triggered. The  flow:established,to_server  option determines that packets from the client to the server should be matched. (In this instance, a server is defined as the device responding to the initial SYN packet with a SYN-ACK packet.) The  content:"GET"  option tells Suricata to look for the word  GET  in the content of the  http.method  portion of the packet. The  sid:12345  (signature ID) option is a unique numerical value that identifies the rule. The  rev:3 option indicates the signature's revision which is used to identify the signature's version. Here, the revision version is 3. Confiuration file Configuration files let you customize exactly how you want your IDS to interact with the rest of your environment.  Suricata's configuration file is suricata.yaml , which uses the YAML file format for syntax and structure. Log files There are two log files that Suricata generates when alerts are triggered: eve.json : The eve.json file is the standard Suricata log file. This file contains detailed information and metadata about the events and alerts generated by Suricata stored in JSON format. For example, events in this file contain a unique identifier called flow_id  which is used to correlate related logs or alerts to a single network flow, making it easier to analyze network traffic. The eve.json file is used for more detailed analysis and is considered to be a better file format for log parsing and SIEM log ingestion. fast.log : The fast.log file is used to record minimal alert information including basic IP address and port details about the network traffic. The fast.log file is used for basic logging and alerting and is considered a legacy file format and is not suitable for incident response or threat hunting tasks. The main difference between the eve.json file and the fast.log file is the level of detail that is recorded in each. The fast.log file records basic information, whereas the eve.json file contains additional verbose information. Trigger a custom rule With a packet capture file The  -r sample.pcap  option specifies an input file to mimic network traffic. In this case, the  sample.pcap  file. The  -S custom.rules  option instructs Suricata to use the rules defined in the  custom.rules  file. The  -k none option instructs Suricata to disable all checksum checks. sudo suricata -r sample.pcap -S custom.rules -k none Check the logs # For fast.log cat /var/log/suricata/fast.log # For eve.log, using jq command to display the JSON format jq . /var/log/suricata/eve.json | less jq -c "[.timestamp,.flow_id,.alert.signature,.proto,.dest_ip]" /var/log/suricata/eve.json jq "select(.flow_id==1200997752018164)" /var/log/suricata/eve.json Resources Suricata user guide   Suricata features   Rule management Rule performance analysis Suricata threat hunting webinar Introduction to writing Suricata rules Eve.json jq examples Snort Introduction Snort is the foremost Open Source Intrusion Prevention System (IPS) in the world. Snort IPS uses a series of rules that help define malicious network activity and uses those rules to find packets that match against them and generates alerts for users. Snort - Network Intrusion Detection & Prevention System [Day18] 動手架設入侵偵測系統吧～Snort 介紹、安裝教學 - iT 邦幫忙::一起幫忙解決難題，拯救 IT 人的一天 (ithome.com.tw) VirusTotal Analyse suspicious files, domains, IPs and URLs to detect malware and other breaches, automatically share them with the security community. URL: https://www.virustotal.com/   Analyze the report Detection: This tab provides a list of third-party security vendors and their detection verdicts on an artifact. Detection verdicts include: malicious, suspicious, unsafe, and others. Notice how many security vendors have reported this hash as malicious and how many have not. Details : This tab provides additional information extracted from a static analysis of the IoC. Notice the additional hashes associated with this malware like MD5, SHA-1, and more.  Relations : This tab contains information about the network connections this malware has made with URLs, domain names, and IP addresses. The Detections column indicates how many vendors have flagged the URL or IP address as malicious. Behavior : This tab contains information related to the observed activity and behaviors of an artifact after executing it in a controlled environment, such as a sandboxed environment. A sandboxed environment is an isolated environment that allows a file to be executed and observed by analysts and researchers. Information about the malware's behavioral patterns is provided through sandbox reports. Sandbox reports include information about the specific actions the file takes when it's executed in a sandboxed environment, such as registry and file system actions, processes, and more. Notice the different types of tactics and techniques used by this malware and the files it created. Pro tip : Sandbox reports are useful in understanding the behavior of a file, but they might contain information that is not relevant to the analysis of the file. By default, VirusTotal shows all sandbox reports in the Behavior tab. You can select individual sandbox reports to view. This is helpful because you can view the similarities and differences between reports so that it's easier to identify which behaviors are likely to be associated with the file. Determine whether the file is malicious The Vendors' ratio is the metric widget displayed at the top of the report. This number represents how many security vendors have flagged the file as malicious over all. A file with a high number of vendor flags is more likely to be malicious. The Community Score is based on the collective inputs of the VirusTotal community. The community score is located below the vendor's ratio and can be displayed by hovering your cursor over the red X . A file with a negative community score is more likely to be malicious. Under the Detection tab, the Security vendors' analysis section provides a list of detections for this file made by security vendors, like antivirus tools. Vendors who have not identified the file as malicious are marked with a checkmark. Vendors who have flagged the file as malicious are marked with an exclamation mark. Files that are flagged as malicious might also include the name of the malware that was detected and other additional details about the file. This section provides insights into a file's potential maliciousness. Review these three sections to determine if there is a consistent assessment of the file's potential maliciousness such as: a high vendors' ratio, a negative community score, and malware detections in the security vendors' analysis section. Screenshots Cheat Sheets Cybersecurity Acronyms Common types of password attacks Designing Secure Systems Risk Management Framework Malware Types Pentest 滲透測試 滲透測試（Penetration Test，簡寫可以稱 Pen Test），是一種用來檢驗網路防禦是否按照預期計畫正常運行的機制。這個測試會模擬駭客和惡意使用者的行為，試圖入侵企業網站、資訊系統或設備，並分析目標的風險層級，評估安全性是否需要加強。最終目的在於，能在真實攻擊發生前，及早發現安全漏洞並加以修正。 PentAGI Advanced AI-Powered Penetration Testing PentAGI - Advanced AI-Powered Penetration Testing GitHub: https://github.com/vxcontrol/pentagi   arsenal-ng 滲透工具指令查詢器 https://github.com/halilkirazkaya/arsenal-ng   Search Engines Cybersecurity Certificate Google Cybersecurity Certificates (GCC) Google 資安證書 啟動台灣資安人才培育計畫 資訊安全人才教育 - Google 安全中心 Google Cybersecurity Certificate - Grow with Google Qualify for the following jobs: Cybersecurity analyst Information security analyst Security analyst IT security analyst SOC analyst Cyber defense analyst You'll learn about: Programming for cybersecurity tasks Frameworks and controls that inform security operations Using security information and event management (SIEM) tools for cybersecurity Detecting and responding to incidents using an intrusion detection system Performing packet capture and analysis Using AI to boost productivity Cybersecurity Tools Seach More 10 Top Open Source Penetration Testing Tools OSV-Scanner 5 Tools to Scan a Linux Server for Malware and Rootkits (tecmint.com) Hottest cybersecurity open-source tools of the month: May 2025 - Help Net Security Online Tools 網站 功能描述 shodan.io 搜索互聯網連接設備的搜索引擎。 censys.io 提供互聯網設備和網絡資產信息的搜索平台。 hunter.io 查找與特定域名相關的電子郵件地址的工具。 fullhunt.io 自動化攻擊面管理和漏洞發現平台。 onyphe.io 網絡資產搜索和網絡安全信息收集引擎。 socradar.io 提供實時網絡威脅情報和數字風險保護服務。 binaryedge.io 互聯網範圍掃描和網絡風險評估平台。 ivre.rocks 開源網絡偵察框架。 crt.sh 搜索和查詢SSL/TLS證書的數據庫。 vulners.com 綜合性漏洞數據庫和安全內容存儲庫。 publicwww.com 源代碼搜索引擎,用於在網頁源碼中查找特定代碼片段。 pulsedive.com 威脅情報和網絡安全數據聚合平台。 intelx.io 多源開放源情報(OSINT)搜索和分析工具。 wigle.net 無線網絡數據庫和地圖服務。 viz.greynoise.io 分析和可視化互聯網噪聲和惡意活動的平台。 Vulnerability Scanner OpenVAS Nessus RustScan : The Modern Port Scanner Vuls : Agentless Vulnerability Scanner for Linux/FreeBSD GitHub: https://github.com/future-architect/vuls Vuls: A Free, Open Source Vulnerability Scanner for Linux - The New Stack Vuls: Open-source agentless vulnerability scanner - Help Net Security Tools -Wazuh The Open Source Security Platform https://wazuh.com/ YT: this Cybersecurity Platform is FREE YT: you need this FREE CyberSecurity tool YT: Wazuh Open Source SIEM Tutorial - YouTube YT: Wazuh! Powerful, Open Source Endpoint Security Monitoring! -Web Check All-in-one OSINT tool for analysing any website Web Check (web-check.xyz) GitHub: https://github.com/Lissy93/web-check   -OWASP: Nettacker Automated Penetration Testing Framework (自動滲透測試框架) OWASP/Nettacker: Automated Penetration Testing Framework -WAF: Web Application Firewall GoTestWAF Test and evaluate your WAF before hackers SafeLine - A self-hosted WAF(Web Application Firewall) YT: SafeLine: A Feature-Rich WAF with a Catch (or Two) waf-checker   -Pi-Alert: WiFi/LAN 連網裝置偵測 Pi.Alert [Video]  Pi Alert - Open Source, Self Hosted, Network Device Change Notification and Intrusion Detection -WatchYourLAN GitHub: https://github.com/aceberg/WatchYourLAN   -ntopng Network traffic monitor ntopng – ntop YT: NTopNG - A Free, Open Source, Self Hosted, Network Monitoring and Analysis Tool. - YouTube -ImHex: Hex Editor A Hex Editor for Reverse Engineers, Programmers and people who value their retinas when working at 3 AM GitHub: https://github.com/WerWolv/ImHex/   -OSSIEM Open Source SIEM Stack, Wazuh + Graylog + Velociraptor + Copilot GitHub: https://github.com/socfortress/OSSIEM   -Fishing Test pfish - 轻量级的无害化钓鱼 -CISO Assistant CISO Assistant is a one-stop-shop for GRC, covering Risk, AppSec and Audit Management GitHub: https://github.com/intuitem/ciso-assistant-community   -MISP MISP (Malware Information Sharing Platform) https://www.misp-project.org/   -exploitarium 大量真實世界 PoC、CVE 與漏洞研究的龐大收藏 https://github.com/bikini/exploitarium   Cybersecurity Linux Distro. TOP VIRTUAL MACHINES FOR CYBERSECURITY PROFESSIONALS | by Flavio Queiroz | CTI Flash Insights | Medium Kali Linux ParrotOS BlackArch Linux 是一款基於 Arch Linux 的滲透測試發行版，專為滲透測試人員與資安研究人員設計。其軟體庫內含 2866 種工具。您可以單獨安裝工具，或以群組形式進行安裝。BlackArch Linux 與現有的 Arch 系統相容。 AI Tools [pyimagesearch] Build a Network Intrusion Detection System with Variational Autoencoders reverse-skills - 逆向工程與網路安全分析技能 Flounder - 基於 AI Agent 的全自動漏洞挖掘工作流 Anthropic Cybersecurity Skills - The largest open-source cybersecurity skills library for AI agents AI Models DeepHat - 訓練以專業水準處理進攻與防禦網路安全。漏洞利用製作、漏洞分析、修復，應有盡有。長上下文處理，適合挖掘海量日誌。且小巧到能在消費級硬體上運行。 Honey Pot 蜜罐陷阱 Introduction 什麼是誘捕系統（Honey Pot）？ | iThome 防止伺服器變殭屍電腦有新招 趨勢用HoneyPot陷阱誘捕Bot病毒 | iThome Self-hosted Services Awesome-Honeypot - Cowrie Honeypot with Elasticsearch