Camp Field Guide

Account Security

• Weak passwords are common, short, reused, or easy to guess, such as password123.
• Multi-factor authentication (MFA) asks for a second proof after a password.
• Use unique passwords for different sites and store them in a password manager.
• Recovery codes, reset links, private keys, and passwords should stay secret.
• Phishing tricks people into giving up credentials or visiting fake login pages.
• Least privilege means giving users only the access they need.
• On shared computers, always log out.

Web Basics

• HTTPS is the encrypted web URL scheme. Plain HTTP is not encrypted.
• HTTP commonly uses port 80; HTTPS commonly uses port 443.
• Cookies are small browser-stored values often used for login sessions.
• Hidden form fields are visible in browser tools and are not safe places for secrets.
• SQL injection can happen when raw user input is placed directly into database queries.
• XSS, or cross-site scripting, runs unwanted JavaScript in someone else's browser.
• CSRF tricks a logged-in browser into sending an unwanted request. Anti-CSRF tokens help stop it.
• Input validation checks and rejects unexpected input before using it.
• Status code 404 usually means a page was not found.
• Hiding a URL is security through obscurity, not strong protection.
• Production sites should not show public debug errors because they can leak internals.

Networking

• DNS translates domain names into IP addresses.
• 192.168.x.x addresses are usually private network addresses.
• A router forwards traffic between networks.
• Network services listen on numbered ports.
• TCP and UDP are transport-layer protocols.
• ping checks whether a host responds.
• nslookup queries DNS records.
• Wireshark captures and inspects packets.

Encoding, Crypto, and Password Cracking

• Base64 is an encoding. It often ends with = padding. It is not encryption.
• Encryption hides data; decryption reveals it.
• Plaintext is readable text before encryption. Ciphertext is encrypted text.
• A hash is a one-way fingerprint of data. Hashes help verify file integrity.
• The avalanche effect means a tiny input change makes a very different hash.
• In public-key crypto, the public key can be shared; the private key stays secret.
• A Caesar cipher shifts letters. ROT13 is Caesar shift 13.
• 5f4dcc3b5aa765d61d8327deb882cf99 is a famous MD5 hash of password.
• A salt is random data added before hashing to make identical passwords hash differently.
• A rainbow table is a precomputed table for reversing common unsalted hashes.
• A dictionary attack tries likely passwords from a wordlist.
• A cracking mask reduces the search space when you know a password pattern.
• Rate limiting slows repeated guesses. Account lockout disables login after too many failures.
• Credential stuffing tries leaked username/password pairs on other services.
• Strong passwords rely on length and randomness.

OSINT and Forensics

• OSINT is open-source intelligence: using public information as evidence.
• UTC means Coordinated Universal Time.
• A timeline arranges events in time order.
• Username reuse links accounts that share the same handle.
• Reverse image search searches with an image to find copies or matches.
• A cache is a stored copy used for faster access or later viewing.
• In a URL, the part after ? is the query string.
• A repeated phrase can link accounts or writing styles.
• Saving pages and screenshots is evidence preservation.
• Social graphs contain accounts and their connections.
• Good reports include sources, timestamps, and evidence, not guesses.
• Metadata is data about data. EXIF is image metadata and may include GPS.
• Deleted files may be recoverable until the disk space is overwritten.
• Magic bytes are the first bytes of a file that can identify its real type.
• File extensions alone do not prove a file's real type.
• Steganography hides data inside another file, such as an image.
• A ZIP archive can bundle files and may be password protected.
• The strings command extracts readable text from binary files.
• Chain of custody documents who handled evidence.

Decoding Quick Reference

• V29ybGQgUmVzZXQ= Base64-decodes to World Reset.
• erfcnja ROT13-decodes to respawn.
• 666c6167 hex-decodes to flag.
• 01001000 01001001 binary ASCII-decodes to HI.
• ... --- ... in Morse code is SOS.
• khoor shifted back by Caesar 3 becomes hello.
• PNG files commonly start with magic bytes 89 50 4E 47.
• In X/Y/Z coordinates, if X and Z are shown, the missing axis is Y.
• Documenting steps lets another analyst reproduce your work.

Bash Command Patterns

• pwd prints the current directory. ls lists files. ls -la shows hidden files and permissions.
• cd folder changes directory. cat file prints a file.
• wc -l file counts lines. head -n 1 file prints the first line. tail -n 1 file prints the last line.
• grep word file searches one file. grep -R word folder searches recursively.
• find folder -name filename finds a file by name.
• sort file sorts lines. uniq -c counts repeated sorted lines.
• cut -d: -f4 extracts the fourth colon-separated field.
• awk -F, '$1=="Name"{s+=$3} END{print s}' file.csv can sum CSV values.
• comm -12 <(sort a.txt) <(sort b.txt) finds lines common to two files.
• find folder -type f -perm -111 finds executable files.
• base64 -d < encoded.txt > decoded.txt decodes Base64 into a file.
• sha256sum file hashes a file. sha256sum -c expected.sha256 verifies a checksum file.
• tar -tzf archive.tar.gz lists an archive. tar -xzf archive.tar.gz extracts it.
• diff -u clean.conf changed.conf shows line-by-line differences.