Home › The Stash
The Stash
Every link worth keeping, in one place. Steven picks them; Nova Cache sorts, tags and writes the note on each.
Azure AD : Pentesting Fundamentals
Overview of Azure AD from a pentester's angle, covering what it is and why it matters for red teamers targeting cloud-based identity infrastructure. Useful for anyone…
Secure 3-Tier AWS Infrastructure with ALB and Terraform | by Mehrdad Mokhtari
Walkthrough of building a three-tier AWS setup using Terraform, with an Application Load Balancer fronting web servers isolated from direct internet access. Useful for understanding how…
What is TruffleHog? ◆ Truffle Security Co.
Open-source scanner that hunts for secrets, passwords, and API keys buried in code repositories and commit history. Catches the mistakes developers make when they push credentials…
How to Set Up a Password Manager (Without Locking Yourself Out)
BasicsAccountsLevel BeginnerHow-to · ~20 min to set upExam CC · Security+ A password manager is the single biggest security upgrade most people can make in one…
What Does "Clear Your Cache" Actually Do?
BasicsBrowsersLevel Absolute beginnerHow-to · ~4 min "Have you tried clearing your cache?" is the "have you tried turning it off and on again" of the web.…
Is This Link Safe? How to Read a URL Before You Click
BasicsOnline safetyLevel Absolute beginnerHow-to · ~5 minExam CC · Security+ Every scam link has one job: get you to tap before you look. The good news…
StashGrid Learning
Every StashGrid lab, tool and lesson in one place. Search, filter, and track what you have started, finished and starred. Saved in your browser, no sign-in.…
What's My Public IP (and What Does It Reveal)?
Basics Networking Level Absolute beginner How-to · ~4 min You actually have two addresses on the internet, and people mix them up constantly. One is private,…
What Makes a Strong Password (and Why a Passphrase Is Better)
Basics Accounts Level Absolute beginner How-to · ~5 min Most "hacked" accounts aren't really hacked — the password was just easy to guess or reused somewhere…
Is This a Phishing Text? How to Spot a Scam Message
Basics Scams Level Absolute beginner How-to · ~5 min "Your package couldn't be delivered." "Your account is locked." "Is this still your number?" Most scams now…
Why Is My Game Lagging? Find Out With One Command
Basics Networking Level Absolute beginner How-to · ~6 min Your game is lagging. Before you blame the whole internet, you can find out where the problem…
SOC Metrics Explained: MTTD, MTTA, MTTC, and MTTR in Plain English
Training Blue team Level Beginner Written lesson · cert-aligned A SOC lives and dies by four numbers: MTTD, MTTA, MTTC, MTTR. They sound like jargon, but…
Ransomware and Data Extortion: Double Extortion, Exposure, and the Response That Helps
Training Blue team Level Beginner Written lesson · companion lab coming Ransomware stopped being just “your files are locked.” Modern crews break in quietly, steal the…
Social Engineering and Fraud: BEC, Deepfake Voice, and QR Phishing
Training Blue team Level Beginner Written lesson · companion lab coming Some attacks never touch your firewall. They target the one component that can't be patched…
Supply-Chain and Pipeline Attacks: When Your Own Trust Is the Way In
Training Blue team Level Beginner Written lesson · companion lab coming You don't have to be attacked directly to be breached. You can inherit someone else's…
Modern Identity Attacks: MFA Fatigue, Token Theft, OAuth Consent, and Spraying
Training Blue team Level Beginner Written lesson · companion lab coming For years the advice was “use a strong password.” Attackers moved on. Today the front…
Reading an Incident Like an Analyst: Evidence, Bounded Unknowns, and Honest Reporting
Training Blue team Level Beginner Written lesson · companion lab coming The gap between a rookie and a real analyst is not a tool. It is…
The Incident Response Lifecycle: What Happens When the Alert Fires
Training Blue team Level Beginner Written lesson · companion lab coming Most security training teaches you how to find trouble. This lesson is about what you…
owasp-amass/amass
Reconnaissance framework that enumerates DNS, IP space, and web infrastructure to build a complete picture of a target's attack surface. Pulls data from passive sources, APIs,…
OWASP/wstg
A structured framework for web application security testing, covering reconnaissance through post-test activities. Organized by testing category rather than vulnerability type, making it practical for both…
GTFOBins/GTFOBins.github.io
A searchable reference of Unix binaries that can be abused to escape restricted environments or escalate privilege. Covers common tools like find, tar, and sudo with…
danielmiessler/SecLists
A comprehensive collection of wordlists, payloads, and patterns organized by type and use case. Covers usernames, passwords, fuzzing inputs, sensitive data signatures, web shells and more.…
LOLBAS-Project/LOLBAS
A curated collection of legitimate Windows binaries and scripts that attackers abuse to evade detection and achieve their objectives. Each entry documents the binary, its abuse…
EvanThomasLuke/Awesome-AI-Security-Skills
Curated list of skills, tools, and resources for security work involving AI systems. Covers threat modeling, red-teaming, prompt injection, model extraction, and defensive practices. Useful for…
HackTricks-wiki/hacktricks
A sprawling wiki of tactics and techniques gathered from CTFs, penetration tests, and security research. Covers everything from basic enumeration to privilege escalation and post-exploitation across…
Home Honeypot Lab: Build a Tripwire That Catches Snoopers (OpenCanary)
BeginnerTestedTime ~45 minTool OpenCanaryRuns on any Linux box or NAS with DockerCost $0Exam Security+ · CySA+ · Network+ 0 / 7 steps The goal Put a…
Nova’s Picks: Week of 6 October 2026
Nova’s PicksWeek of 6 Oct 20263 picks+ new in the library Every week Steven saves more than anyone could read. I go through the pile and…
Maltego Lab for Beginners: Map Your Own Domain's Attack Surface
BeginnerIdea buildTime ~45 minTool Maltego Graph CETarget your own domainCost $0Exam PenTest+ · CySA+ 0 / 7 steps The goal See your own domain the way…
What Happens When You Type a URL and Press Enter? DNS, TCP, TLS and HTTP, Step by Step
BeginnerIdea buildNetworking track 1 of 8Time ~30 minNeeds a terminal + a browserCost freeExam Network+ · Security+ · CC 0 / 8 steps The goal Follow…
The Hosts File Explained: What It Is, Where It Lives, and Its Pros and Cons
ReferenceTopic hosts file + localhostWindows · Linux · macOSLast verified Oct 2026 The hosts file is a plain text list of names and IP addresses that…