CyberShield

  Introduction After learning the basics of network scanning, the next step is mastering advanced techniques. Nmap is not just a simple scanner—it is a powerful tool capable of deep network analysis and vulnerability detection. This Nmap Advanced Guide 2026 covers practical commands used in real-world penetration testing and cybersecurity assessments. Why Advanced Nmap Matters Detect hidden services Bypass basic firewall rules Perform stealth scanning Identify vulnerabilities Prerequisites Before continuing, you should understand: Basic Nmap commands Ports and protocols Network fundamentals Advanced Nmap Commands 1. Stealth Scan (SYN Scan) nmap -sS example.com This scan is faster and less detectable than full connection scans. 2. UDP Scan nmap -sU example.com Used to detect UDP services like DNS and SNMP. 3. OS Detection nmap -O example.com Identifies the operating system of the target. 4. Aggressive Scan nmap -A example.com Combines OS detection, version detection, script scannin...

  Introduction Reconnaissance is the foundation of every successful penetration test. Before exploiting any system, security professionals must understand the target’s structure, assets, and attack surface. This Reconnaissance Workflow 2026 provides a complete step-by-step approach, combining multiple tools and techniques used in real-world cybersecurity. What is Reconnaissance Reconnaissance (Recon) is the process of gathering information about a target system before launching an attack or security assessment. It is divided into two types: Passive Recon (no direct interaction) Active Recon (direct interaction with target) Why Recon is Important Identifies attack surface Reduces guesswork Improves success rate Helps find hidden assets Complete Recon Workflow Step 1: Domain Information Gathering whois example.com Step 2: DNS Enumeration nslookup example.com dig example.com Step 3: Subdomain Discovery subfinder -d example.com Step 4: Live Host Detection nmap -sn example.com Step 5: ...

Introduction Password security remains one of the weakest points in modern systems. Even today, many breaches happen because of weak or reused passwords. Security professionals use tools like John the Ripper to test password strength and identify vulnerabilities before attackers can exploit them. What is John the Ripper John the Ripper is a popular open-source password auditing and recovery tool. It works by taking hashed passwords and attempting to recover the original plaintext passwords using different attack methods. It supports multiple platforms including Linux, Windows, and macOS, and is widely used in penetration testing and security assessments. Why John the Ripper is Important Helps identify weak passwords Supports many hash types such as MD5, SHA, and NTLM Useful for penetration testing and security audits Improves overall authentication security How John the Ripper Works John the Ripper follows a simple process. It takes password hashes as input, generates possible password...

  Welcome to another segment of our Information Gathering series! In our previous post, we explored WhatWeb to identify a website's internal technology stack. However, to understand who is behind a website, when it was registered, or which company manages its infrastructure, we need a technique called WHOIS Lookup . WHOIS is a fundamental footprinting method used by penetration testers to gather domain-level intelligence. What is WHOIS? WHOIS (pronounced as the phrase "who is") is a query and response protocol used for querying databases that store the registered users or assignees of an Internet resource, such as a domain name or an IP address block. Essentially, it acts as a public directory providing details about domain ownership, registration dates, expiry dates, and authoritative name servers. Why is it Important for Ethical Hackers? For a security researcher, a WHOIS lookup is vital for several reasons: Ownership Identity: Identifies the person or organization ...

  Welcome back to CyberShield! Amra ager post-e Nmap diye network scanning shikhechi. Kintu jokhon apnar target ekti website hoy, tokhon shudhu port scan korle hoy na; apnake jante hoy shei site-ti kon technology diye toiri. Ajke amra ekti powerful reconnaissance tool niye alochona korbo, jar nam holo WhatWeb . WhatWeb Ki? WhatWeb holo ekti open-source "Next-generation web scanner." Eti ekti website-er technology stack identify korte babohar kora hoy. Mane, ekti site kon CMS (Content Management System), kon web server, kon programming language, ebong kon kon plugin babohar korche, ta WhatWeb ekti command-er maddhome bole dite pare. WhatWeb Keno Babohar Korben? Passive Reconnaissance-er khetre WhatWeb khub-i guruttopurno. Eti diye niche-r jinish gulo khuje paoa jay: CMS Discovery: Site-ti ki WordPress, Joomla, naki Drupal? Web Server Information: Server-ti ki Apache, Nginx, naki Microsoft-IIS? Frameworks: Site-ti ki React, Vue.js, naki Laravel babohar korche? Plugins ...

  Welcome back to CyberShield! We have spent a lot of time discussing technical vulnerabilities like SQL Injection and Directory Traversal. However, today we are going to talk about a method that doesn't target software—it targets the Human Mind . Welcome to the world of Social Engineering . What is Social Engineering? Social Engineering is the psychological manipulation of people into performing actions or divulging confidential information. In the world of cybersecurity, it is often called "Human Hacking." No matter how strong your firewall is, if an employee gives away their password to a stranger, the system is compromised. Why Social Engineering is Dangerous Hard to Patch: You can patch software, but you cannot "patch" human emotions like curiosity, fear, or trust. Low Technical Requirement: An attacker doesn't need to be a master coder to trick someone over the phone. The Weakest Link: Humans are often considered the weakest link in any security ch...

Welcome back to CyberShield! Search engines are more powerful than most people realize. Beyond regular queries, they can reveal deeply indexed content that is not easily visible through normal browsing. In cybersecurity, this technique is known as Google Dorking . It allows researchers to uncover publicly exposed data using advanced search queries without ever directly interacting with the target's server. What is Google Dorking? Google Dorking refers to the use of advanced search operators to locate specific types of information within search engine indexes. Instead of performing simple keyword searches, users apply structured queries to filter results and uncover hidden or sensitive data that was never meant to be public. Why It Matters in Security Testing For penetration testers and bug bounty hunters, this technique is a vital part of passive reconnaissance . It helps to: Identify exposed files and directories: Finding folders that should be private. Discover forgotten or unl...

  Welcome back to CyberShield! We have explored web vulnerabilities and reconnaissance. Now, it's time to go deeper into the network layer. If you want to see exactly what is traveling through your Wi-Fi or Ethernet cables, you need to master Wireshark . What is Wireshark? Wireshark is the world’s most popular network protocol analyzer. It allows you to capture and interactively browse the traffic running on a computer network. Think of it as a "microscope" for your network—it lets you see every single packet that is sent or received. Why Do Pentesters Use Wireshark? For a Cybersecurity professional, Wireshark is essential for: Analyzing Protocols: Understanding how HTTP, DNS, TCP, and TLS work. Finding Vulnerabilities: Spotting unencrypted sensitive data (like passwords) sent over plain HTTP or FTP. Incident Response: Investigating how a malware or virus is communicating with its Command and Control (C2) server. Network Troubleshooting: Fixing latency or connection ...

Introduction Subdomain enumeration is a crucial step in reconnaissance for penetration testing and bug bounty hunting. Finding hidden subdomains can reveal additional attack surfaces. One of the most efficient tools for this task is Subfinder. What is Subfinder? Subfinder is a fast and powerful subdomain discovery tool designed to find valid subdomains using passive sources. It is widely used by security researchers for reconnaissance. Key Features Passive subdomain enumeration Fast and lightweight Uses multiple data sources Easy to use Suitable for bug bounty workflows Why Subdomain Enumeration Matters Subdomains often expose: Admin panels APIs Development environments Misconfigured services These can lead to vulnerabilities. Installation Install Subfinder using Go: go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest Make sure your PATH is configured correctly. Basic Usage subfinder -d example.com This command finds subdomains of the target domain. Save Output ...

  Introduction In penetration testing and ethical hacking, information gathering (enumeration) is a critical phase. One of the most powerful tools for enumerating Windows and Samba systems is Enum4linux. This guide will help you understand how Enum4linux works, what information it can extract, and how to use it effectively in a lab environment. What is Enum4linux? Enum4linux is a Linux-based tool used to enumerate information from Windows and Samba systems. It is commonly used in penetration testing to extract: Usernames Groups Shares Password policies System information Enum4linux works by leveraging SMB (Server Message Block) protocol. What is SMB? SMB (Server Message Block) is a network protocol used for sharing files, printers, and other resources between systems. It typically runs on: Port 139 Port 445 Why Enum4linux is Important Enum4linux helps identify: Misconfigured SMB services Anonymous login access User account information Network shares This information is often used f...

Introduction In this part of the cybersecurity series, we explore one of the most critical web vulnerabilities: Server-Side Request Forgery (SSRF). With the rise of cloud platforms such as AWS, Azure, and Google Cloud, SSRF has become a high-impact vulnerability frequently targeted in bug bounty programs. What is SSRF? Server-Side Request Forgery (SSRF) is a vulnerability that allows an attacker to force a server to make requests to unintended locations. In simple terms, the attacker uses the server as a proxy to access internal or restricted resources. How SSRF Works Many applications fetch data from external URLs. For example: fetch("https://trusted-site.com/data.json") If user input is not properly validated, an attacker can modify the request: fetch("http://127.0.0.1/admin") or: fetch("http://192.168.1.1/config") Because the request originates from the server, internal systems may trust it and return sensitive data. Types of SSRF Basic (In-band) SSRF T...

🔐 Introduction After learning common web vulnerabilities like XSS and CSRF , it is important to understand more critical attacks such as Command Injection (OS Command Injection) . This vulnerability allows an attacker to execute operating system commands directly on the server , which can lead to full system compromise. 💡 What is Command Injection? Command Injection occurs when a web application takes unsafe user input and passes it directly to a system shell or OS command execution function. 👉 If input is not properly validated, attackers can inject malicious system commands. 🧠 How Command Injection Works Imagine a website has a “ping test” feature to check server connectivity. Backend logic example: system("ping -c 4 " + user_input); Normal Input: 8.8.8.8 Result: ping -c 4 8.8.8.8 Malicious Input: 8.8.8.8; whoami Result: ping -c 4 8.8.8.8; whoami 👉 The server executes both commands, exposing system-level information. ⚠️ Common Command Injection Operators Attackers use...

A Complete Beginner-to-Professional Guide Why Learn Ethical Hacking? In today’s digital environment, organizations constantly face cyber threats. Ethical hackers play a key role in identifying vulnerabilities before attackers can exploit them. This field offers: High demand career opportunities Continuous learning Multiple income streams (job, bug bounty, freelancing) Quick Overview of the Roadmap This roadmap is divided into 7 practical stages: Fundamentals Web Security Hands-on Practice Tools Mastery Real-World Testing Reporting Skills Specialization Stage 1: Fundamentals (Build Your Base) Before touching any hacking tools, you must understand the basics. Networking IP Addressing TCP/UDP DNS & HTTP/HTTPS Operating Systems Linux (essential) Windows basics Programming Python (automation) JavaScript (web understanding) Stage 2: Web Security (Core Skills) Focus on the most common vulnerabilities: SQL Injection Cross-Site Scripting (XSS) Broken Access Control (IDOR) File Inclusion SSR...