Open cardosec
182 cards · 10 domains
Every card in the deck
Each card is a security topic to explain out loud: a concept, a live incident, a deep dive or an interview question. Open one to practise it, or let cardosec draw for you.
Web AppSec
- SQL InjectionL1 Foundations
- Cross-Site Scripting (XSS)L2 Practitioner
- Cross-Site Request ForgeryL2 Practitioner
- IDOR and Broken Access ControlL1 Foundations
- Server-Side Request ForgeryL3 Applied
- CORS MisconfigurationL3 Applied
- JWT PitfallsL3 Applied
- Insecure DeserializationL3 Applied
- Server-Side Template InjectionL4 Advanced
- Prioritising the OWASP Top 10L2 Practitioner
- HTTP Request SmugglingL5 Expert
- Metadata Hits from the PDF ServiceL3 Applied
- Web Shell in Uploads FolderL3 Applied
- Login Spike from 4,000 IPsL2 Practitioner
- Support Ticket Steals Admin SessionL3 Applied
- CDN Serves Attacker JavaScriptL5 Expert
- OAuth 2.0 Flow AttacksL4 Advanced
- Third-Party JavaScript RiskL4 Advanced
Network
- ARP SpoofingL2 Practitioner
- Firewall vs IDS vs IPSL1 Foundations
- Port Scanning TechniquesL2 Practitioner
- Network SegmentationL1 Foundations
- DNS TunnelingL3 Applied
- VLAN HoppingL3 Applied
- TLS Inspection Trade-offsL3 Applied
- Lateral Movement over SMB/RDPL3 Applied
- LLMNR and NBT-NS PoisoningL3 Applied
- Zero Trust NetworkingL2 Practitioner
- BGP Hijacking and RPKIL5 Expert
- Long TXT Queries from FinanceL3 Applied
- Printer Scans the SubnetL2 Practitioner
- RDP Hops at 2amL4 Advanced
- Two MACs Claim the GatewayL2 Practitioner
- VPN Appliance Phones HomeL5 Expert
- Hunting with Flow DataL3 Applied
- Securing OT NetworksL4 Advanced
Identity & AD
- How Kerberos Authentication WorksL2 Practitioner
- KerberoastingL3 Applied
- AS-REP RoastingL2 Practitioner
- Pass-the-HashL2 Practitioner
- Golden vs Silver TicketsL4 Advanced
- DCSyncL3 Applied
- NTLM RelayL4 Advanced
- OAuth 2.0 Authorization Code + PKCEL2 Practitioner
- SAML vs OIDCL1 Foundations
- MFA FatigueL1 Foundations
- AD Tiering ModelL4 Advanced
- AD Certificate Services RiskL4 Advanced
- RBCD Attack ChainL5 Expert
- Impossible Travel Sign-InL3 Applied
- New Domain Admin at 2amL3 Applied
- Malicious OAuth App ConsentL3 Applied
- Password Spray in ProgressL2 Practitioner
- Entra Connect Server CompromisedL5 Expert
- Just-in-Time AccessL1 Foundations
- Passkeys and FIDO2L2 Practitioner
Cloud
- Shared Responsibility ModelL1 Foundations
- Least-Privilege IAML3 Applied
- Instance Metadata and IMDSv2L3 Applied
- Public Storage BucketsL1 Foundations
- Envelope Encryption with KMSL2 Practitioner
- Secrets in CI/CDL3 Applied
- Kubernetes RBACL4 Advanced
- Container EscapeL4 Advanced
- AWS IAM Privilege Escalation PathsL5 Expert
- Cloud Audit LoggingL2 Practitioner
- CSPM vs CWPP vs CNAPPL1 Foundations
- AWS Keys Pushed to GitHubL2 Practitioner
- Database Snapshot Made PublicL3 Applied
- Crypto-Miner in the ClusterL3 Applied
- Root Account LoginL2 Practitioner
- Attacker Persisting in AWSL5 Expert
- Capital One 2019 BreachL3 Applied
- Multi-Account Landing ZoneL4 Advanced
Cryptography
- Hashing vs Encryption vs EncodingL1 Foundations
- Symmetric vs Asymmetric CryptoL1 Foundations
- Salting, bcrypt and Argon2L2 Practitioner
- Digital Signatures and MACsL2 Practitioner
- PKI and Certificate ChainsL3 Applied
- The TLS 1.3 HandshakeL3 Applied
- Forward SecrecyL2 Practitioner
- Block Cipher ModesL2 Practitioner
- Padding Oracle AttacksL4 Advanced
- Post-Quantum CryptographyL3 Applied
- ECDSA Nonce Bias Key RecoveryL5 Expert
- TLS Private Key on GitHubL3 Applied
- Password Dump Hits PastebinL2 Practitioner
- Cert Chain Breaks at MidnightL3 Applied
- Repeated Nonces in ProdL4 Advanced
- Key Management with KMS and HSMsL3 Applied
- Why Crypto Implementations FailL3 Applied
- Group E2EE with MLSL5 Expert
Blue team / DFIR
- The Incident Response LifecycleL1 Foundations
- Alert TriageL2 Practitioner
- Essential Log SourcesL1 Foundations
- Key Windows Event IDsL2 Practitioner
- Memory ForensicsL3 Applied
- Evidence and Chain of CustodyL2 Practitioner
- Writing SIEM DetectionsL3 Applied
- How EDR WorksL3 Applied
- Building a Forensic TimelineL4 Advanced
- Containment vs EradicationL3 Applied
- Encoded PowerShell at 2amL2 Practitioner
- Someone Touched LSASSL3 Applied
- Security Log Wiped on a DCL3 Applied
- Shadow Copies VanishingL4 Advanced
- Hypervisors Encrypted, EDR SilentL5 Expert
- Hypothesis-Driven Threat HuntingL3 Applied
- Incident Response in the CloudL3 Applied
- Proving What Was ExfiltratedL5 Expert
Malware & intel
- Ransomware attack lifecycleL2 Practitioner
- MITRE ATT&CK tacticsL1 Foundations
- C2 beaconingL3 Applied
- Living off the land (LOLBins)L3 Applied
- Windows persistence mechanismsL2 Practitioner
- IOCs vs TTPsL1 Foundations
- Pyramid of PainL1 Foundations
- Phishing kits and AiTML3 Applied
- InfostealersL3 Applied
- Process injectionL4 Advanced
- Sandbox and anti-analysis evasionL4 Advanced
- Unpacking the Office stagerL3 Applied
- How the locker kills recoveryL4 Advanced
- The 60-second heartbeatL2 Practitioner
- Fingerprinting the LSASS dumperL4 Advanced
- The RaaS economyL3 Applied
- How malware evades EDRL5 Expert
- UEFI bootkits and BlackLotusL5 Expert
Famous breaches
- Equifax 2017L2 Practitioner
- WannaCryL1 Foundations
- NotPetyaL2 Practitioner
- SolarWinds SUNBURSTL4 Advanced
- Colonial PipelineL1 Foundations
- Log4ShellL2 Practitioner
- Target 2013L1 Foundations
- StuxnetL3 Applied
- HeartbleedL2 Practitioner
- xz-utils backdoorL4 Advanced
- MOVEit on your perimeterL3 Applied
- JNDI strings in the logsL3 Applied
- Screenshots from your support vendorL3 Applied
- Ransom note in billingL4 Advanced
- Your signed softphone is beaconingL5 Expert
- Supply-chain attacks comparedL4 Advanced
- Lapsus$ and identity attacksL3 Applied
- Storm-0558 forged token attackL5 Expert
GRC
- Risk vs Threat vs VulnerabilityL1 Foundations
- Zero Trust ArchitectureL3 Applied
- Least PrivilegeL1 Foundations
- SOC 2 Type I vs Type IIL2 Practitioner
- ISO 27001 ISMSL2 Practitioner
- NIST Cybersecurity Framework 2.0L1 Foundations
- Risk Appetite and ToleranceL3 Applied
- BCP vs DR: RTO and RPOL1 Foundations
- Third-Party Vendor RiskL3 Applied
- Security Awareness MetricsL3 Applied
- Auditor Finds Orphaned AdminsL3 Applied
- Payroll Vendor Breach NoticeL3 Applied
- Ransomware Hits the Backup ServerL4 Advanced
- The Exception Nobody RenewedL2 Practitioner
- Cyber Risk Quantification with FAIRL4 Advanced
- SEC Cyber Disclosure RulesL4 Advanced
- Four Regulators, Four ClocksL5 Expert
- Cyber Due Diligence in M&AL5 Expert
AI security
- Direct Prompt InjectionL1 Foundations
- Indirect Prompt InjectionL3 Applied
- Data and Model PoisoningL3 Applied
- Model Extraction AttacksL3 Applied
- JailbreaksL2 Practitioner
- Excessive AgencyL2 Practitioner
- Training Data LeakageL3 Applied
- OWASP LLM Top 10 Threat ModelingL3 Applied
- AI Supply Chain RiskL3 Applied
- Improper Output HandlingL2 Practitioner
- Copilot Forwards the InboxL3 Applied
- Model Load Spawns a ShellL4 Advanced
- API Bill Spikes 40x OvernightL3 Applied
- Chatbot Promises a Refund PolicyL2 Practitioner
- Securing a RAG PipelineL4 Advanced
- Threat Modeling AI AgentsL4 Advanced
- MCP Server Rewrites Its ToolsL5 Expert
- Injection-Resistant Agent ArchitecturesL5 Expert