THE FIELD, CONNECTED

Knowledge graph

Start with a question. Follow an idea. See the bigger picture.

500 notes to explore

Knowledge, connected.One concept per note. Follow the links.

Drag to pan · Pinch or use +/− to zoom · Click to preview · Double-click to read

Browse notes as a list (500)

Abuse Elevation Control Mechanism Acceptance criteria Network access-control lists Access control Access Token Manipulation Account Access Removal Account Discovery Account Manipulation Secure account recovery Acquire Infrastructure Active Scanning Evasion and evidence of activity AES Agile delivery AI agent security Alert triage API security testing REST API security Application Layer Protocol Application security logging Application Window Discovery Archive Collected Data ARP and local address resolution Asset inventories Asymmetric cryptography Attack surface Audio Capture Authentication Authorization Automated Collection Automated Exfiltration Availability Backups and restore testing Bell–LaPadula model Biba integrity model BITS Jobs Boot or Logon Autostart Execution Boot or Logon Initialization Scripts Bot management and anti-automation Botnets Broken access control Browser artifacts Browser Information Discovery Browser Session Hijacking Brute-force attacks Build Image on Host Business continuity Business impact analysis Business logic vulnerabilities Caesar ciphers Certificate transparency Chain of custody Change control Chinese Wall model CI/CD pipeline security The CIA triad Clark–Wilson model Clickjacking and framing controls Clipboard Data Cloud audit logs Cloud computing Public, private, and hybrid cloud Cloud identity and permissions Cloud incident response Cloud Infrastructure Discovery Cloud security architecture Cloud Service Dashboard Cloud Service Discovery IaaS, PaaS, and SaaS Cloud shared responsibility Cloud storage security Command and Scripting Interpreter OS command injection Communication Through Removable Media Compliance evidence Compliance and assurance Compromise Accounts Compromise Host Software Binary Compromise Infrastructure Computer forensics Confidentiality Container Administration Command Container and Resource Discovery Container security Incident containment Content Security Policy (CSP)Control mapping and gap analysis Secure cookie attributes Cross-Origin Resource Sharing (CORS)Create Account Create or Modify System Process Credential stuffing Credentials from Password Stores Critical path Cryptanalysis Cryptography CrypTool Cross-site request forgery CyberChef What is cybersecurity?Data classification Data Destruction Data Encoding Data Encrypted for Impact Data from Cloud Storage Data from Configuration Repository Data from Information Repositories Data from Local System Data from Network Shared Drive Data from Removable Media Data Manipulation Data minimization and retention Data Obfuscation Data Staged Data Transfer Size Limits Database hardening Decision logs Defacement Defense in depth Definition of Done Denial of service Deobfuscate/Decode Files or Information Vulnerable dependency remediation Deploy Container Detection engineering Develop Capabilities DHCP Digital certificates and PKI Digital forensics Digital signatures Direct Volume Access Disaster recovery Disk imaging Disk Wipe Domain Name System DOM-based cross-site scripting DOM clobbering Domain or Tenant Policy Modification Domain Trust Discovery Drive-by downloads DVWA Dynamic Resolution ECB and block-cipher modes Elliptic-curve cryptography Email Collection Email protocols and authentication Email validation and verification Encrypted Channel End-to-end encryption Endpoint detection and response Eradication and recovery Escape to Host Establish Accounts Ethical hacking Event Triggered Execution Evidence acquisition Execution Guardrails Exfiltration Over Alternative Protocol Exfiltration Over C2 Channel Exfiltration Over Other Network Medium Exfiltration Over Physical Medium Exfiltration Over Web Service Data exfiltration Exploit Public-Facing Application Exploitation for Client Execution Exploitation for Credential Access Exploitation for Privilege Escalation Exploitation for Stealth Exploitation of Remote Services Exploits, payloads, and shells External Remote Services Fallback Channels File and Directory Discovery File and Directory Permissions Modification File carving File metadata and timestamps Deleted files and recovery File upload security Firewalls Firmware Corruption Forced Authentication Forensic reporting Forge Web Credentials Frequency analysis FTP, FTPS, and SFTP Gather Victim Host Information Gather Victim Identity Information Gather Victim Network Information Gather Victim Org Information GDPR concepts GitHub Actions security GraphQL security The phases of a security assessment Hardware Additions Cryptographic hashing Hexadecimal analysis Hide Artifacts Hijack Execution Flow Message authentication codes and HMAC HTTP Strict Transport Security (HSTS)HTML sanitization HTTP security headers HTTP status codes HTTP and HTTPS ICMP, ping, and traceroute Identity and access management Identity federation and SSO Insecure direct object references (IDOR)IDS and IPS Implant Internal Image Incident playbooks Incident reporting and handover Incident response Incident timelines Indicator Removal Indicators of compromise Indirect Command Execution Infrastructure as code security Ingress Tool Transfer Inhibit System Recovery Injection Input Capture Input validation Insider threats Integrity The intelligence cycle Inter-Process Communication Internal Spearphishing IP addresses IPsec IPv4 IPv6 JWT expiration and revocation JSON Web Token (JWT) security Kali Linux Kanban Kerberos Key agreement Key management Kubernetes security Lateral movement Lateral Tool Transfer LDAP injection LDAP and directory services Least privilege Legacy cryptography Lessons learned Linux filesystem and paths Linux fundamentals Linux file permissions Linux processes and services Shells, pipes, and text tools Log correlation Logs and telemetry MAC addresses Malware Adversary in the middle Masquerading Mass assignment vulnerabilities Model Context Protocol (MCP) security Memory forensics Metasploit Microservices security MITRE ATT&CK Modify Authentication Process Modify Cloud Compute Infrastructure Modify Registry Modify System Image Multi-Factor Authentication Interception Multi-Stage Channels Multi-tenant application isolation Multifactor authentication Mutual TLS (mTLS)Network address translation Native API Network Boundary Bridging Network devices Network forensics SNMP and network management Network segmentation Network Service Discovery Network Share Discovery Network Sniffing Time synchronization Network topologies LANs, WANs, and other network scopes Computer networking NIST Cybersecurity Framework Nmap Non-Application Layer Protocol Non-Standard Port NoSQL injection OAuth scopes and delegated permissions OAuth 2.0 security Obfuscated Files or Information Obtain Capabilities Office Application Startup Open redirects OpenSSL Order of volatility OS Credential Dumping OSI and TCP/IP models Open-source intelligence Context-aware output encoding OWASP Top 10 Packet analysis Parameterized queries and prepared statements Passkeys and WebAuthn Password Policy Discovery Password storage Path traversal PCI DSS concepts Reporting security assessments Penetration testing Peripheral Device Discovery Permission Groups Discovery Persistence PGP and GnuPG Phishing for Information Phishing Proof Key for Code Exchange (PKCE)Port scanning Port states Ports and services Secure cross-window messaging Pre-OS Boot PRINCE2 concepts Privileged access Process Discovery Process Injection Processes in memory Backlogs and prioritization Budgeting and resources Project charters Project closure and handover Project dependencies Project documentation Project governance Project lifecycles Monitoring delivery and outcomes Project planning Project risk management Scheduling and milestones LLM prompt injection Protocol Tunneling JavaScript prototype pollution Proxy Query Registry Retrieval-augmented generation (RAG) security RAID logs Cryptographic randomness Ransomware Rate limiting and abuse controls RBAC and ABAC Reconnaissance RTO and RPO Red teaming Remote Access Tools Remote Service Session Hijacking Remote Services Remote System Discovery Replay attacks Replication Through Removable Media Resource Hijacking Responsible disclosure Risk appetite and tolerance Risk assessment Risk registers Risk treatment Rogue Domain Controller Rootkit Routing and switching Routing protocols RSA Rules of engagement SAML assertion security SASE and security service edge Software bills of materials (SBOMs)Scheduled Task/Job Scheduled tasks and startup artifacts Scheduled Transfer Screen Capture Scrum Software-defined WAN Search Closed Sources Search Open Technical Databases Search Open Websites/Domains Search Victim-Owned Websites Secrets management Secure code review Security awareness Careers in cybersecurity Security controls Security domains Secure error handling Security governance Security misconfiguration Security operations centers Policies, standards, and procedures Separation of duties Server Software Component Serverless function security Service enumeration and fingerprinting Service Stop Session fixation Session hijacking and cookie theft Sessions and cookies Shared Modules Side-channel attacks Security information and event management S/MIME Security orchestration and automation Security operations metrics SOC roles and escalation Social engineering Software Deployment Tools Software Discovery Software Extensions Software supply chain security Evaluating information sources Scrum events SQL injection SSH Server-side request forgery (SSRF)Stage Capabilities Stakeholders and communication Steal Application Access Token Steal or Forge Kerberos Tickets Subnetting and CIDR Subvert Trust Controls Supply Chain Compromise Symmetric encryption System Binary Proxy Execution System Information Discovery System Location Discovery System Network Configuration Discovery System Network Connections Discovery System Owner/User Discovery System Script Proxy Execution System Service Discovery System Services System Shutdown/Reboot System Time Discovery Tabletop exercises Taint Shared Content TCP and UDP Transmission Control Protocol tcpdump Template Injection Third-party JavaScript security Third-party risk Threat hunting Threat intelligence Threat modeling Threat, vulnerability, and risk TLS and secure transport Traffic Signaling Transaction authorization Transfer Data to Cloud Account Trust boundaries Trusted Developer Utilities Proxy Execution Trusted Relationship User Datagram Protocol Unsafe deserialization Unsecured Credentials Unused/Unsupported Cloud Regions Use Alternate Authentication Material User Execution Valid Accounts Video Capture Virtual security labs Virtualization/Sandbox Evasion VLANs Variable-length subnet masks Virtual-machine network modes Virtual-machine snapshots Volatility Virtual private networks Vulnerability management Vulnerability scanning Waterfall delivery Weaken Encryption Web application architecture Web cache security Web Service Webhook security WebSocket security Windows Management Instrumentation Windows Registry artifacts Wireless security Wireshark Work breakdown structures Write blockers XML processing security XPath injection XSL Script Processing Cross-site scripting XML external entity (XXE) injection Zero-day vulnerabilities Zero trust