# 130n@calvinlai.com ## 130n@calvinlai.com - [About Calvin Lai (fkclai)](https://calvin-lai.gitbook.io/calvin-lai-security/master.md): I am working in the IT industry for over 25 years. For the first 15-years worked on web applications and middle-tier development, in recent years, I focus on application security and management work. - [My Work](https://calvin-lai.gitbook.io/calvin-lai-security/my-work.md): 130n@calvinlai.com - [Cyber Security Centre (CSC)](https://calvin-lai.gitbook.io/calvin-lai-security/cyber-security/cyber-security-centre-csc.md) - [Why we need a CSC](https://calvin-lai.gitbook.io/calvin-lai-security/cyber-security/cyber-security-centre-csc/why-we-need-a-csc.md) - [CSC Team Structure: Roles, Functions, and Tools](https://calvin-lai.gitbook.io/calvin-lai-security/cyber-security/cyber-security-centre-csc/csc-team-structure-roles-functions-and-tools.md) - [Key Function & Role](https://calvin-lai.gitbook.io/calvin-lai-security/cyber-security/cyber-security-centre-csc/csc-team-structure-roles-functions-and-tools/key-function-and-role.md) - [Tools & Platforms](https://calvin-lai.gitbook.io/calvin-lai-security/cyber-security/cyber-security-centre-csc/csc-team-structure-roles-functions-and-tools/tools-and-platforms.md) - [People](https://calvin-lai.gitbook.io/calvin-lai-security/cyber-security/cyber-security-centre-csc/csc-team-structure-roles-functions-and-tools/people.md) - [Outsource Strategy](https://calvin-lai.gitbook.io/calvin-lai-security/cyber-security/cyber-security-centre-csc/csc-team-structure-roles-functions-and-tools/outsource-strategy.md) - [HRMC Executive Paper](https://calvin-lai.gitbook.io/calvin-lai-security/cyber-security/cyber-security-centre-csc/hrmc-executive-paper.md) - [Detection and Response](https://calvin-lai.gitbook.io/calvin-lai-security/detection-and-response.md): April 2025 - [Playbook: Threat Prioritization & Automated Response Strategies](https://calvin-lai.gitbook.io/calvin-lai-security/detection-and-response/playbook-threat-prioritization-and-automated-response-strategies.md) - [Scenario: Detecting and Mitigating a Ransomware Attack](https://calvin-lai.gitbook.io/calvin-lai-security/detection-and-response/playbook-threat-prioritization-and-automated-response-strategies/scenario-detecting-and-mitigating-a-ransomware-attack.md): April 2025 - [Scenario: DC Sync Attack Detected and Mitigated](https://calvin-lai.gitbook.io/calvin-lai-security/detection-and-response/playbook-threat-prioritization-and-automated-response-strategies/scenario-dc-sync-attack-detected-and-mitigated.md): April 2025 - [Scenario: Pass-the-Hash (PtH) Attack Detected and Contained](https://calvin-lai.gitbook.io/calvin-lai-security/detection-and-response/playbook-threat-prioritization-and-automated-response-strategies/scenario-pass-the-hash-pth-attack-detected-and-contained.md): April 2025 - [Scenario: Phishing Campaign with Malware / Credential Theft Detected and Mitigated](https://calvin-lai.gitbook.io/calvin-lai-security/detection-and-response/playbook-threat-prioritization-and-automated-response-strategies/scenario-phishing-campaign-with-malware-credential-theft-detected-and-mitigated.md): 📅 Date: May 2025 - [Cyber Security Incident Response Drill Plan](https://calvin-lai.gitbook.io/calvin-lai-security/detection-and-response/cyber-security-incident-response-drill-plan.md) - [Student Module Registration Flow Series using Microservices & Event-Driven Architecture](https://calvin-lai.gitbook.io/calvin-lai-security/application-architecture/student-module-registration-flow-series-using-microservices-and-event-driven-architecture.md): Last updated: 10:47 PM HKT, Tuesday, September 23, 2025. - [Student Module Registration Flow in Microservices & Event-Driven Architecture](https://calvin-lai.gitbook.io/calvin-lai-security/application-architecture/student-module-registration-flow-series-using-microservices-and-event-driven-architecture/student-module-registration-flow-in-microservices-and-event-driven-architecture.md): A Scalable, Resilient Workflow for Academic System - [Optimizing Event-Driven Workflows in Microservices: Patterns for Scalability and Resilience](https://calvin-lai.gitbook.io/calvin-lai-security/application-architecture/student-module-registration-flow-series-using-microservices-and-event-driven-architecture/student-module-registration-flow-in-microservices-and-event-driven-architecture/optimizing-event-driven-workflows-in-microservices-patterns-for-scalability-and-resilience.md) - [Enhancing Security in a Microservices-Based Student Module Registration System](https://calvin-lai.gitbook.io/calvin-lai-security/application-architecture/student-module-registration-flow-series-using-microservices-and-event-driven-architecture/student-module-registration-flow-in-microservices-and-event-driven-architecture/enhancing-security-in-a-microservices-based-student-module-registration-system.md) - [Comparison of MVC , N-tier and Microservice Architecture](https://calvin-lai.gitbook.io/calvin-lai-security/application-architecture/comparison-of-mvc-n-tier-and-microservice-architecture.md) - [AI: Using RAG-Based Enquiry Assistant using Vector Database](https://calvin-lai.gitbook.io/calvin-lai-security/ai-using-rag-based-enquiry-assistant-using-vector-database.md): Developing a RAG-Based Enquiry Assistant with Amazon Bedrock, Vector Databases, and Full-Stack Integration - [RAG Architecture Deep Dive](https://calvin-lai.gitbook.io/calvin-lai-security/ai-using-rag-based-enquiry-assistant-using-vector-database/rag-architecture-deep-dive.md): Working in Progress - [Embedding and Vector Store Integration](https://calvin-lai.gitbook.io/calvin-lai-security/ai-using-rag-based-enquiry-assistant-using-vector-database/embedding-and-vector-store-integration.md): Working in Progress - [Backend API with AWS Lambda](https://calvin-lai.gitbook.io/calvin-lai-security/ai-using-rag-based-enquiry-assistant-using-vector-database/backend-api-with-aws-lambda.md): Working in Progress - [Frontend Chatbot with React](https://calvin-lai.gitbook.io/calvin-lai-security/ai-using-rag-based-enquiry-assistant-using-vector-database/frontend-chatbot-with-react.md): Working in Progress - [Others integration](https://calvin-lai.gitbook.io/calvin-lai-security/ai-using-rag-based-enquiry-assistant-using-vector-database/others-integration.md): Working in Progress - [LLM Model Section Criteria](https://calvin-lai.gitbook.io/calvin-lai-security/application-security/llm-model-section-criteria.md): Section Criteria Guideline for AI Development - [Securing React Native Applications with Java Microservices](https://calvin-lai.gitbook.io/calvin-lai-security/application-security/securing-react-native-applications-with-java-microservices.md): Working in Progress - [Securing WebView-Based Mobile Applications with Java Microservices](https://calvin-lai.gitbook.io/calvin-lai-security/application-security/securing-webview-based-mobile-applications-with-java-microservices.md) - [OAuth, SAML, and OpenID Connect: Key Differences and Use Cases](https://calvin-lai.gitbook.io/calvin-lai-security/application-security/oauth-saml-and-openid-connect-key-differences-and-use-cases.md): April 2025 - [Secure Coding Principles](https://calvin-lai.gitbook.io/calvin-lai-security/application-security/secure-coding-principles.md): August 2022 - [HTTP Header Security Principles](https://calvin-lai.gitbook.io/calvin-lai-security/application-security/http-header-security-principles.md) - [Mitigating Broken Object Level Authorization (BOLA)](https://calvin-lai.gitbook.io/calvin-lai-security/application-security/mitigating-broken-object-level-authorization-bola.md): 10 November 2024 - [Spring Boot Validation](https://calvin-lai.gitbook.io/calvin-lai-security/application-security/spring-boot-validation.md): Spring Boot Validation to Address Lack of Input Validation - [Output Encoding in JavaServer Faces (JSF)](https://calvin-lai.gitbook.io/calvin-lai-security/application-security/output-encoding-in-javaserver-faces-jsf.md) - [Session Management Security Issues](https://calvin-lai.gitbook.io/calvin-lai-security/application-security/session-management-security-issues.md) - [Common API Security Problems](https://calvin-lai.gitbook.io/calvin-lai-security/application-security/common-api-security-problems.md): Understanding and Mitigating Common API Security Problems - [Broken Authentication](https://calvin-lai.gitbook.io/calvin-lai-security/application-security/common-api-security-problems/broken-authentication.md) - [Excessive Data Exposure](https://calvin-lai.gitbook.io/calvin-lai-security/application-security/common-api-security-problems/excessive-data-exposure.md) - [Lack of Resources & Rate Limiting](https://calvin-lai.gitbook.io/calvin-lai-security/application-security/common-api-security-problems/lack-of-resources-and-rate-limiting.md) - [Broken Function Level Authorization](https://calvin-lai.gitbook.io/calvin-lai-security/application-security/common-api-security-problems/broken-function-level-authorization.md) - [Unsafe Consumption of APIs](https://calvin-lai.gitbook.io/calvin-lai-security/application-security/common-api-security-problems/unsafe-consumption-of-apis.md) - [JAVA Exception Handling](https://calvin-lai.gitbook.io/calvin-lai-security/application-security/java-exception-handling.md) - [File Upload Validation](https://calvin-lai.gitbook.io/calvin-lai-security/application-security/file-upload-validation.md) - [OAuth 2.0 Security](https://calvin-lai.gitbook.io/calvin-lai-security/application-security/oauth-2.0-security.md) - [Insecure Storage of Access Tokens](https://calvin-lai.gitbook.io/calvin-lai-security/application-security/oauth-2.0-security/insecure-storage-of-access-tokens.md) - [Microservice Security](https://calvin-lai.gitbook.io/calvin-lai-security/application-security/microservice-security.md): Application Security Issues in microservice at Multi-Service Provider Environments - [Sample Coding Demo](https://calvin-lai.gitbook.io/calvin-lai-security/application-security/microservice-security/sample-coding-demo.md): A sample code implementation illustrating how Spring Security can help address these challenges - [Service Implementation](https://calvin-lai.gitbook.io/calvin-lai-security/application-security/microservice-security/sample-coding-demo/service-implementation.md) - [Client Interaction](https://calvin-lai.gitbook.io/calvin-lai-security/application-security/microservice-security/sample-coding-demo/client-interaction.md) - [Security Solution for Microservices Architecture](https://calvin-lai.gitbook.io/calvin-lai-security/application-security/microservice-security/security-solution-for-microservices-architecture.md): Enterprise Security and Integration Solutions for Microservices Gateways solution - [Modifying and Protecting Java Class Files](https://calvin-lai.gitbook.io/calvin-lai-security/application-security/modifying-and-protecting-java-class-files.md) - [Modify a Class File Inside a WAR File](https://calvin-lai.gitbook.io/calvin-lai-security/application-security/modifying-and-protecting-java-class-files/modify-a-class-file-inside-a-war-file.md) - [Demo: 1. Create Java Web Application](https://calvin-lai.gitbook.io/calvin-lai-security/application-security/modifying-and-protecting-java-class-files/modify-a-class-file-inside-a-war-file/demo-1.-create-java-web-application.md): July 2025 - [Demo: 2. Modify the Class file](https://calvin-lai.gitbook.io/calvin-lai-security/application-security/modifying-and-protecting-java-class-files/modify-a-class-file-inside-a-war-file/demo-2.-modify-the-class-file.md): July 2025 - [Direct Bytecode Editing](https://calvin-lai.gitbook.io/calvin-lai-security/application-security/modifying-and-protecting-java-class-files/direct-bytecode-editing.md) - [Steps to Directly Edit a Java Class File](https://calvin-lai.gitbook.io/calvin-lai-security/application-security/modifying-and-protecting-java-class-files/direct-bytecode-editing/steps-to-directly-edit-a-java-class-file.md) - [Update: Java Bytecode Editing Tools](https://calvin-lai.gitbook.io/calvin-lai-security/application-security/modifying-and-protecting-java-class-files/direct-bytecode-editing/steps-to-directly-edit-a-java-class-file/update-java-bytecode-editing-tools.md): April 2025 - [Techniques to Protect Java Class Files](https://calvin-lai.gitbook.io/calvin-lai-security/application-security/modifying-and-protecting-java-class-files/techniques-to-protect-java-class-files.md) - [Runtime Decryption in WebLogic](https://calvin-lai.gitbook.io/calvin-lai-security/application-security/modifying-and-protecting-java-class-files/techniques-to-protect-java-class-files/runtime-decryption-in-weblogic.md) - [JAVA Program](https://calvin-lai.gitbook.io/calvin-lai-security/application-security/java-program.md) - [Secure, Concurrent Web Access Using Java and Tor](https://calvin-lai.gitbook.io/calvin-lai-security/application-security/java-program/secure-concurrent-web-access-using-java-and-tor.md): A Comprehensive Guide for developing a Secure, Concurrent Web Access Using Java and Tor: - [Creating a Maven Java project in Visual Studio Code](https://calvin-lai.gitbook.io/calvin-lai-security/application-security/java-program/creating-a-maven-java-project-in-visual-studio-code.md) - [Exploiting Missing Authentication in Palo Alto Networks Expedition](https://calvin-lai.gitbook.io/calvin-lai-security/exploit-cve-poc/exploiting-missing-authentication-in-palo-alto-networks-expedition.md): CVE-2024-5910, 10 Nov 2024 - [ZeroLogon Exploit](https://calvin-lai.gitbook.io/calvin-lai-security/exploit-cve-poc/zerologon-exploit.md): CVE-2020-1472, 6 Oct 2020 - [Remote Retrieved Chrome saved Encrypted Password](https://calvin-lai.gitbook.io/calvin-lai-security/exploit-cve-poc/remote-getting-chrome-saved-encrypted-password.md): 21 May 2018 - [Twitter Control an RCE attack](https://calvin-lai.gitbook.io/calvin-lai-security/exploit-cve-poc/twitter-control-an-rce-attack.md): 18 May 2018 - [Hits & Summary](https://calvin-lai.gitbook.io/calvin-lai-security/hack-the-box-writeup/htb-hits-and-summary.md): Hack the Box, try harder and harder - [Tools & Cheat Sheet](https://calvin-lai.gitbook.io/calvin-lai-security/hack-the-box-writeup/htb-hits-and-summary/tools-and-cheat-sheet.md) - [Windows Machine](https://calvin-lai.gitbook.io/calvin-lai-security/hack-the-box-writeup/windows-machine.md) - [Love 10.10.10.239](https://calvin-lai.gitbook.io/calvin-lai-security/hack-the-box-writeup/windows-machine/love-10.10.10.239.md): You could claim that anything's real if the only basis for believing in it is that nobody's proved it doesn't exist! \ - [Blackfield 10.10.10.192](https://calvin-lai.gitbook.io/calvin-lai-security/hack-the-box-writeup/windows-machine/blackfield.md): I know the sky is not the limit because there are footprints on the Moon — and I made some of them! #Buzz Aldrin - [Remote 10.10.10.180](https://calvin-lai.gitbook.io/calvin-lai-security/hack-the-box-writeup/windows-machine/remote.md): It doesn’t matter how many times you get knocked down. All that matters is you get up one more time than you were knocked down. \ - [Sauna 10.10.10.175](https://calvin-lai.gitbook.io/calvin-lai-security/hack-the-box-writeup/windows-machine/sauna.md): Technology is just a tool. In terms of getting the kids working together and motivating them, the teacher is the most important. \ - [Forest 10.10.10.161](https://calvin-lai.gitbook.io/calvin-lai-security/hack-the-box-writeup/windows-machine/forest.md): Defenders think in lists. Attackers think in graphs. As long as this is true, attackers win. \ - [Sniper](https://calvin-lai.gitbook.io/calvin-lai-security/hack-the-box-writeup/windows-machine/sniper.md): 09 Feb 2020 - [Json](https://calvin-lai.gitbook.io/calvin-lai-security/hack-the-box-writeup/windows-machine/json.md): 19 Sep 2019 - [Heist](https://calvin-lai.gitbook.io/calvin-lai-security/hack-the-box-writeup/windows-machine/heist.md): 26.10.2019 - [Blue](https://calvin-lai.gitbook.io/calvin-lai-security/hack-the-box-writeup/windows-machine/blue.md): 18 Sep 2019 - [Legacy](https://calvin-lai.gitbook.io/calvin-lai-security/hack-the-box-writeup/windows-machine/legacy.md): 17 Sep 2019 - [Resolute](https://calvin-lai.gitbook.io/calvin-lai-security/hack-the-box-writeup/windows-machine/resolute.md): 10.10.10.169, windows machine. - [Cascade](https://calvin-lai.gitbook.io/calvin-lai-security/hack-the-box-writeup/windows-machine/cascade.md): 20 July 2020 - [Linux Machine](https://calvin-lai.gitbook.io/calvin-lai-security/hack-the-box-writeup/linux-machine.md) - [Photobomb 10.10.11.182](https://calvin-lai.gitbook.io/calvin-lai-security/hack-the-box-writeup/linux-machine/photobomb-10.10.11.182.md) - [Pandora 10.10.11.136](https://calvin-lai.gitbook.io/calvin-lai-security/hack-the-box-writeup/linux-machine/pandora-10.10.11.136.md) - [BountyHunter 10.10.11.100](https://calvin-lai.gitbook.io/calvin-lai-security/hack-the-box-writeup/linux-machine/bountyhunter-10.10.11.100.md): by 130n@calvinlai.com, 11 Sep 2021 - [CAP 10.10.10.245](https://calvin-lai.gitbook.io/calvin-lai-security/hack-the-box-writeup/linux-machine/cap-10.10.10.245.md) - [Spectra 10.10.10.229](https://calvin-lai.gitbook.io/calvin-lai-security/hack-the-box-writeup/linux-machine/spectra-10.10.10.229.md) - [Ready 10.10.10.220](https://calvin-lai.gitbook.io/calvin-lai-security/hack-the-box-writeup/linux-machine/ready-10.10.10.220.md): The good thing about science is that it's true whether or not you believe in it. \ - [Doctor 10.10.10.209](https://calvin-lai.gitbook.io/calvin-lai-security/hack-the-box-writeup/linux-machine/doctor-10.10.10.209.md) - [Bucket 10.10.10.212](https://calvin-lai.gitbook.io/calvin-lai-security/hack-the-box-writeup/linux-machine/bucket-10.10.10.212.md): No technology that's connected to the internet is unhackable. \ - [Blunder 10.10.10.191](https://calvin-lai.gitbook.io/calvin-lai-security/hack-the-box-writeup/linux-machine/blunder-10.10.10.191.md): Persistence is very important. You should not give up unless you are forced to give up (Elon Musk) - [Registry 10.10.10.159](https://calvin-lai.gitbook.io/calvin-lai-security/hack-the-box-writeup/linux-machine/registry-10.10.10.178.md): Look up at the stars and not down at your feet \ - [Magic](https://calvin-lai.gitbook.io/calvin-lai-security/hack-the-box-writeup/linux-machine/magic.md): 04 July 2020 - [Tabby](https://calvin-lai.gitbook.io/calvin-lai-security/hack-the-box-writeup/linux-machine/tabby.md): 28 Jun 2020 - [Web Application PenTest](https://calvin-lai.gitbook.io/calvin-lai-security/penetration-testing/web-application-pentest.md) - [Network/System PenTest](https://calvin-lai.gitbook.io/calvin-lai-security/penetration-testing/network-system-pentest.md) - [Mobile Penetration Test](https://calvin-lai.gitbook.io/calvin-lai-security/penetration-testing/mobile-penetration-test.md) - [Certificate Pinning](https://calvin-lai.gitbook.io/calvin-lai-security/penetration-testing/mobile-penetration-test/certificate-pinning.md): A security technique used in mobile app to ensure that the app communicates only with a specific server by validating the server's certificate against a known, hardcoded certificate or public key. - [Certificate Pinning Bypass (Android)](https://calvin-lai.gitbook.io/calvin-lai-security/penetration-testing/mobile-penetration-test/certificate-pinning/certificate-pinning-bypass-android.md): Bypassing certificate pinning using three different methods: Frida, Xposed Framework with JustTrustMe, and Modifying APK. - [Root a Android Device](https://calvin-lai.gitbook.io/calvin-lai-security/penetration-testing/mobile-penetration-test/certificate-pinning/certificate-pinning-bypass-android/root-a-android-device.md) - [Setup Proxy Tool - Burp Suite](https://calvin-lai.gitbook.io/calvin-lai-security/penetration-testing/mobile-penetration-test/certificate-pinning/certificate-pinning-bypass-android/setup-proxy-tool-burp-suite.md) - [Checklist](https://calvin-lai.gitbook.io/calvin-lai-security/penetration-testing/mobile-penetration-test/checklist.md) - [Advanced Persistent Threat (APT) groups](https://calvin-lai.gitbook.io/calvin-lai-security/threat-intelligence/advanced-persistent-threat-apt-groups.md) - [North Korean APT Groups](https://calvin-lai.gitbook.io/calvin-lai-security/threat-intelligence/advanced-persistent-threat-apt-groups/north-korean-apt-groups.md) - [Chinese APT Groups](https://calvin-lai.gitbook.io/calvin-lai-security/threat-intelligence/advanced-persistent-threat-apt-groups/chinese-apt-groups.md) - [Russian APT Groups](https://calvin-lai.gitbook.io/calvin-lai-security/threat-intelligence/advanced-persistent-threat-apt-groups/russian-apt-groups.md) - [Other APT](https://calvin-lai.gitbook.io/calvin-lai-security/threat-intelligence/advanced-persistent-threat-apt-groups/other-apt.md) - [01 Reconnaissance](https://calvin-lai.gitbook.io/calvin-lai-security/red-team-windows/01-reconnaissance.md): January 2022 - [02 Privileges Escalation](https://calvin-lai.gitbook.io/calvin-lai-security/red-team-windows/02-privileges-escalation.md) - [03 Lateral Movement](https://calvin-lai.gitbook.io/calvin-lai-security/red-team-windows/03-lateral-movement.md) - [04 AD Attacks](https://calvin-lai.gitbook.io/calvin-lai-security/red-team-windows/04-ad-attacks.md) - [DCSync](https://calvin-lai.gitbook.io/calvin-lai-security/red-team-windows/04-ad-attacks/dcsync.md): MITRE ATT\&CK T1003.006 - [05 Bypass-Evasion](https://calvin-lai.gitbook.io/calvin-lai-security/red-team-windows/05-bypass-evasion.md) - [06 Kerberos Attack](https://calvin-lai.gitbook.io/calvin-lai-security/red-team-windows/06-kerberos-attack.md) - [99 Basic Command](https://calvin-lai.gitbook.io/calvin-lai-security/red-team-windows/99-basic-command.md) - [01 Reconnaissance](https://calvin-lai.gitbook.io/calvin-lai-security/tools/01-reconnaissance.md) - [02 Port Enumeration](https://calvin-lai.gitbook.io/calvin-lai-security/tools/02-eumernation.md) - [03 Web Enumeration](https://calvin-lai.gitbook.io/calvin-lai-security/tools/03-web-enum-and-exploit.md) - [04 Windows Enum & Exploit](https://calvin-lai.gitbook.io/calvin-lai-security/tools/04-windows-enum-and-exploit.md) - [Windows Credential Dumping](https://calvin-lai.gitbook.io/calvin-lai-security/tools/04-windows-enum-and-exploit/windows-credential-dumping.md) - [Credential Dumping: SAM](https://calvin-lai.gitbook.io/calvin-lai-security/tools/04-windows-enum-and-exploit/windows-credential-dumping/dumping-windows-credentials.md): Dumping the NTL Hash - [Credential Dumping: DCSync](https://calvin-lai.gitbook.io/calvin-lai-security/tools/04-windows-enum-and-exploit/windows-credential-dumping/credential-dumping-dcsync.md): May 2022 - [Kerberos Attack](https://calvin-lai.gitbook.io/calvin-lai-security/tools/04-windows-enum-and-exploit/09-kerberos-attack.md): January 2020 - [RDP](https://calvin-lai.gitbook.io/calvin-lai-security/tools/04-windows-enum-and-exploit/rdp.md) - [05 File Enumeration](https://calvin-lai.gitbook.io/calvin-lai-security/tools/05-file-enumeration.md) - [06 Reverse Shell Cheat Sheet](https://calvin-lai.gitbook.io/calvin-lai-security/tools/exploitation-command.md): The syntax of generating reverse TCP shell payload - [Windows Reverse Shell](https://calvin-lai.gitbook.io/calvin-lai-security/tools/exploitation-command/windows-reverse-shell.md): This page is going to show the generation of reverse shell payload for Windows environment. - [Linux Reverse Shell](https://calvin-lai.gitbook.io/calvin-lai-security/tools/exploitation-command/linux-reverse-shell.md): This page is going to show the generation of reverse shell payload for Linux environment. - [07 SQL Injection](https://calvin-lai.gitbook.io/calvin-lai-security/tools/06-sql-injection.md) - [08 BruteForce](https://calvin-lai.gitbook.io/calvin-lai-security/tools/08-bruteforce.md) - [09 XSS Bypass Checklist](https://calvin-lai.gitbook.io/calvin-lai-security/tools/09-xss.md): XSS ByPass, CTF - [10 Spring Boot](https://calvin-lai.gitbook.io/calvin-lai-security/tools/10-spring-boot.md) - [11 WPA](https://calvin-lai.gitbook.io/calvin-lai-security/tools/11-wpa.md): aircrack-ng - [12 Payload list](https://calvin-lai.gitbook.io/calvin-lai-security/tools/12-payload-list.md): XXS, injection, open-redirect, XXE, rfi & lfi - [MrRobot](https://calvin-lai.gitbook.io/calvin-lai-security/vuln-hub-writeup/mrrobot.md) - [CYBERRY](https://calvin-lai.gitbook.io/calvin-lai-security/vuln-hub-writeup/cyberry.md) - [MATRIX 1](https://calvin-lai.gitbook.io/calvin-lai-security/vuln-hub-writeup/matrix-1.md) - [Node-1](https://calvin-lai.gitbook.io/calvin-lai-security/vuln-hub-writeup/node-1-without-msf.md) - [DPwwn-1](https://calvin-lai.gitbook.io/calvin-lai-security/vuln-hub-writeup/dpwwn-1.md) - [DC7](https://calvin-lai.gitbook.io/calvin-lai-security/vuln-hub-writeup/dc7.md) - [AiWeb-2](https://calvin-lai.gitbook.io/calvin-lai-security/vuln-hub-writeup/aiweb-2.md) - [AiWeb-1](https://calvin-lai.gitbook.io/calvin-lai-security/vuln-hub-writeup/aiweb-1.md): 29 AUGUST 2019 - [BrainPan](https://calvin-lai.gitbook.io/calvin-lai-security/vuln-hub-writeup/brainpan.md): 22 MAY 2019 - [CTF Tools & Tips](https://calvin-lai.gitbook.io/calvin-lai-security/ctf-writeup/ctf-tools-and-tips.md) - [Hacker One](https://calvin-lai.gitbook.io/calvin-lai-security/ctf-writeup/hacker-one.md) - [CTF Learn](https://calvin-lai.gitbook.io/calvin-lai-security/ctf-writeup/ctf-learn.md): https://ctflearn.com/ - [P.W.N. University - CTF 2018](https://calvin-lai.gitbook.io/calvin-lai-security/ctf-writeup/p.w.n.-university-ctf-2018.md): https://uni.hctf.fun/ - [HITCON](https://calvin-lai.gitbook.io/calvin-lai-security/ctf-writeup/hitcon.md) - [Pwnable](https://calvin-lai.gitbook.io/calvin-lai-security/ctf-writeup/pwnable.md) - [01 Start](https://calvin-lai.gitbook.io/calvin-lai-security/ctf-writeup/pwnable/01-start.md) - [Kali](https://calvin-lai.gitbook.io/calvin-lai-security/useful-command/kali.md) - [Windows](https://calvin-lai.gitbook.io/calvin-lai-security/useful-command/windows.md) - [Linux](https://calvin-lai.gitbook.io/calvin-lai-security/useful-command/linux.md) - [Lab](https://calvin-lai.gitbook.io/calvin-lai-security/oscp-lab-and-exam/lab.md) - [Tools for an Offensive Certification](https://calvin-lai.gitbook.io/calvin-lai-security/oscp-lab-and-exam/tools-for-an-offensive-certification.md): Commands, Payloads and Resources for an Offensive Certification. - [Strategy for an Offensive Exam Certification](https://calvin-lai.gitbook.io/calvin-lai-security/oscp-lab-and-exam/tools-for-an-offensive-certification/strategy-for-an-offensive-exam-certification.md) - [CVEs](https://calvin-lai.gitbook.io/calvin-lai-security/oscp-lab-and-exam/tools-for-an-offensive-certification/strategy-for-an-offensive-exam-certification/cves.md): Some common CVEs "May" be useful in the exam - [Privilege Escalation](https://calvin-lai.gitbook.io/calvin-lai-security/oscp-lab-and-exam/tools-for-an-offensive-certification/strategy-for-an-offensive-exam-certification/privilege-escalation.md) - [Commands](https://calvin-lai.gitbook.io/calvin-lai-security/oscp-lab-and-exam/tools-for-an-offensive-certification/strategy-for-an-offensive-exam-certification/commands.md) - [Impacket](https://calvin-lai.gitbook.io/calvin-lai-security/oscp-lab-and-exam/tools-for-an-offensive-certification/strategy-for-an-offensive-exam-certification/impacket.md): https://github.com/SecureAuthCorp/impacket - [Disclaimer](https://calvin-lai.gitbook.io/calvin-lai-security/iso-27001/disclaimer.md) - [What is ISO 27001](https://calvin-lai.gitbook.io/calvin-lai-security/iso-27001/what-is-iso-27001.md) - [Implementation](https://calvin-lai.gitbook.io/calvin-lai-security/iso-27001/what-is-iso-27001/implementation.md) - [Documentation](https://calvin-lai.gitbook.io/calvin-lai-security/iso-27001/documentation.md) - [Common Mistake](https://calvin-lai.gitbook.io/calvin-lai-security/iso-27001/common-mistake.md) - [Q\&A](https://calvin-lai.gitbook.io/calvin-lai-security/iso-27001/q-and-a.md) - [Can internal audit to replace the risk assessment](https://calvin-lai.gitbook.io/calvin-lai-security/iso-27001/q-and-a/can-internal-audit-to-replace-the-risk-assessment.md) - [Is it sufficient for only the IT department head to support the ISO 27001 program](https://calvin-lai.gitbook.io/calvin-lai-security/iso-27001/q-and-a/is-it-sufficient-for-only-the-it-department-head-to-support-the-iso-27001-program.md) - [Does the Business Continuity Plan (BCP) and a Disaster Recovery Plan (DRP) are the same?](https://calvin-lai.gitbook.io/calvin-lai-security/iso-27001/q-and-a/does-the-business-continuity-plan-bcp-and-a-disaster-recovery-plan-drp-are-the-same.md) - [ISO 27001 Controls and Domains](https://calvin-lai.gitbook.io/calvin-lai-security/iso-27001/iso-27001-controls-and-domains.md) - [1. Information Security Policies](https://calvin-lai.gitbook.io/calvin-lai-security/iso-27001/iso-27001-controls-and-domains/1.-information-security-policies.md) - [2. Organization of Information Security](https://calvin-lai.gitbook.io/calvin-lai-security/iso-27001/iso-27001-controls-and-domains/2.-organization-of-information-security.md) - [3. Human Resource Security](https://calvin-lai.gitbook.io/calvin-lai-security/iso-27001/iso-27001-controls-and-domains/3.-human-resource-security.md) - [4. Asset Management](https://calvin-lai.gitbook.io/calvin-lai-security/iso-27001/iso-27001-controls-and-domains/4.-asset-management.md) - [5. Access Control](https://calvin-lai.gitbook.io/calvin-lai-security/iso-27001/iso-27001-controls-and-domains/5.-access-control.md) - [6. Cryptographic Controls](https://calvin-lai.gitbook.io/calvin-lai-security/iso-27001/iso-27001-controls-and-domains/6.-cryptographic-controls.md) - [7. Physical and Environmental Security](https://calvin-lai.gitbook.io/calvin-lai-security/iso-27001/iso-27001-controls-and-domains/7.-physical-and-environmental-security.md) - [8: Operational Security](https://calvin-lai.gitbook.io/calvin-lai-security/iso-27001/iso-27001-controls-and-domains/8-operational-security.md) - [9. Communications Security](https://calvin-lai.gitbook.io/calvin-lai-security/iso-27001/iso-27001-controls-and-domains/9.-communications-security.md) - [10. System Acquisition, Development, and Maintenance](https://calvin-lai.gitbook.io/calvin-lai-security/iso-27001/iso-27001-controls-and-domains/10.-system-acquisition-development-and-maintenance.md) - [11. Supplier Relationships](https://calvin-lai.gitbook.io/calvin-lai-security/iso-27001/iso-27001-controls-and-domains/11.-supplier-relationships.md) - [12: Information Security Incident Management](https://calvin-lai.gitbook.io/calvin-lai-security/iso-27001/iso-27001-controls-and-domains/12-information-security-incident-management.md) - [13. Information Security Aspects of Business Continuity Management](https://calvin-lai.gitbook.io/calvin-lai-security/iso-27001/iso-27001-controls-and-domains/13.-information-security-aspects-of-business-continuity-management.md) - [14. Compliance](https://calvin-lai.gitbook.io/calvin-lai-security/iso-27001/iso-27001-controls-and-domains/14.-compliance.md) - [IT Risk and Control Library Policy and Procedure](https://calvin-lai.gitbook.io/calvin-lai-security/risk-management/it-risk-and-control-library-policy-and-procedure.md) - [Risk Library](https://calvin-lai.gitbook.io/calvin-lai-security/risk-management/it-risk-and-control-library-policy-and-procedure/risk-library.md) - [Control Library](https://calvin-lai.gitbook.io/calvin-lai-security/risk-management/it-risk-and-control-library-policy-and-procedure/control-library.md) - [Assessment Level](https://calvin-lai.gitbook.io/calvin-lai-security/risk-management/it-risk-and-control-library-policy-and-procedure/assessment-level.md): Three level details of the risk assessment - [Control Implementation](https://calvin-lai.gitbook.io/calvin-lai-security/risk-management/it-risk-and-control-library-policy-and-procedure/control-implementation.md) - [ISRA Project Change Scope Definition](https://calvin-lai.gitbook.io/calvin-lai-security/risk-management/it-risk-and-control-library-policy-and-procedure/isra-project-change-scope-definition.md) - [ISRA Questionnaire](https://calvin-lai.gitbook.io/calvin-lai-security/risk-management/it-risk-and-control-library-policy-and-procedure/isra-questionnaire.md) - [Risk Acceptance and Risk Register Policy and Procedure](https://calvin-lai.gitbook.io/calvin-lai-security/risk-management/it-risk-and-control-library-policy-and-procedure/risk-acceptance-and-risk-register-policy-and-procedure.md) - [Penetration Testing](https://calvin-lai.gitbook.io/calvin-lai-security/risk-management/it-risk-and-control-library-policy-and-procedure/penetration-testing.md)