Documentation and cheat sheets

Quick references to keep open while you work. Search across every sheet at once.

Cybersecurity

OWASP Top 10 (2021)

The ten most critical web application security risks, and what each one means.

Risk	What it means
A01	Broken access control: users reach data or actions that are not theirs.
A02	Cryptographic failures: sensitive data sent or stored without strong encryption.
A03	Injection: input runs as SQL, shell or other code. Includes cross-site scripting.
A04	Insecure design: security was not planned in from the start.
A05	Security misconfiguration: default passwords, open storage, verbose errors.
A06	Vulnerable and outdated components: old libraries with known holes.
A07	Identification and authentication failures: weak logins, no MFA, bad sessions.
A08	Software and data integrity failures: unverified updates and pipelines.
A09	Security logging and monitoring failures: attacks go unnoticed.
A10	Server-side request forgery: the server is tricked into calling internal addresses.

Cybersecurity

Incident response steps

The NIST incident response life cycle, in the order you work through it.

Step	What you do
Preparation	Have plans, contacts, tools and backups ready before anything happens.
Detection & analysis	Spot the incident, confirm it and judge how serious it is.
Containment	Stop the spread: isolate machines, block accounts or addresses.
Eradication	Remove the cause: malware, backdoors and compromised accounts.
Recovery	Restore systems from clean backups and watch them closely.
Lessons learned	Write down what happened and fix the gaps so it does not repeat.

Networking

Common ports

Ports you will meet on servers, scans and firewall rules.

Port	Service
20/tcp · FTP data	File transfer data channel. Unencrypted: prefer SFTP.
21/tcp · FTP	File transfer control. Sends passwords in clear text.
22/tcp · SSH	Secure remote login and file copy (SFTP, SCP).
23/tcp · Telnet	Old remote login without encryption. Disable it and use SSH.
25/tcp · SMTP	Email delivery between mail servers.
53/tcp/udp · DNS	Domain name lookups.
67/udp · DHCP	Hands out IP addresses on a local network.
80/tcp · HTTP	Unencrypted web traffic. Redirect it to HTTPS.
110/tcp · POP3	Downloading email (old, unencrypted).
123/udp · NTP	Time synchronization.
143/tcp · IMAP	Reading email on the server (unencrypted).
161/udp · SNMP	Network device monitoring. Change default community strings.
389/tcp · LDAP	Directory services such as Active Directory.
443/tcp · HTTPS	Encrypted web traffic (HTTP over TLS).
445/tcp · SMB	Windows file sharing. Never expose it to the internet.
587/tcp · SMTP submission	Sending email from an app or mail client, with TLS.
993/tcp · IMAPS	Reading email over TLS.
1433/tcp · MS SQL	Microsoft SQL Server database.
3306/tcp · MySQL	MySQL and MariaDB databases. Keep it private.
3389/tcp · RDP	Windows Remote Desktop. A favorite target: put it behind a VPN.
5432/tcp · PostgreSQL	PostgreSQL database. Keep it private.
6379/tcp · Redis	Redis cache. Often left open without a password.
8080/tcp · HTTP alt	Common port for development servers and proxies.
27017/tcp · MongoDB	MongoDB database. Keep it private.

Software development

HTTP status codes

What the numbers in API responses and browser errors mean.

Code	Meaning
200 OK	The request worked.
201 Created	A new resource was created.
204 No Content	It worked and there is nothing to send back.
301 Moved Permanently	The address changed for good; follow the new one.
304 Not Modified	Your cached copy is still current.
400 Bad Request	The request is malformed or invalid.
401 Unauthorized	Not signed in, or the token is missing or expired.
403 Forbidden	Signed in but not allowed to do this.
404 Not Found	Nothing exists at this address.
409 Conflict	The request clashes with the current state, such as a duplicate.
429 Too Many Requests	A rate limit was reached; wait and retry.
500 Internal Server Error	Something broke on the server.
502 Bad Gateway	A server in the middle got a bad answer from the next one.
503 Service Unavailable	The server is overloaded or down for maintenance.

Software development

Git command cheat sheet

The Git commands that cover almost every working day.

Command	What it does
git clone <url>	Copy a repository to your computer.
git status	See what changed and what is staged.
git add -p	Stage changes piece by piece after reviewing them.
git commit -m "message"	Save a snapshot with a message.
git switch -c feature	Create a branch and move to it.
git pull --rebase	Get the latest changes and replay yours on top.
git push -u origin feature	Upload your branch and track it.
git log --oneline --graph	Show a compact history with branches.
git diff	Show changes that are not staged yet.
git stash	Put unfinished changes aside for later.
git revert <commit>	Undo a commit with a new commit, keeping history.

Cloud & Linux

Linux command cheat sheet

The commands you will use every day on a Linux server.

Command	What it does
pwd	Show the folder you are in.
ls -la	List all files with details, including hidden ones.
cd /var/log	Move to another folder.
cat file.txt	Print a file.
less file.txt	Read a long file page by page.
grep -i error app.log	Find lines containing a word, ignoring case.
chmod 755 script.sh	Change file permissions.
chown user:group file	Change the owner of a file.
ps aux	List running processes.
top	Watch CPU and memory use live.
df -h	Show free disk space.
sudo apt update && sudo apt upgrade	Install updates on Debian or Ubuntu.
ssh user@host	Connect to a remote server.
tail -f /var/log/syslog	Follow a log file as it grows.

Cloud & Linux

Docker and Kubernetes commands

Build, run and debug containers, then manage them on a cluster.

Command	What it does
docker build -t app .	Build an image from the Dockerfile in this folder.
docker run -p 8080:80 app	Run the image and expose port 80 as 8080.
docker ps	List running containers.
docker logs -f <id>	Follow a container's output.
docker exec -it <id> sh	Open a shell inside a running container.
kubectl get pods	List pods in the current namespace.
kubectl describe pod <name>	Show details and recent events for a pod.
kubectl logs <pod>	Print a pod's logs.
kubectl apply -f deploy.yaml	Create or update resources from a file.
kubectl rollout undo deployment/app	Roll back to the previous version.

Networking

DNS record types

The records you will see in a DNS zone and what each one does.

Record	Purpose
A	Maps a name to an IPv4 address.
AAAA	Maps a name to an IPv6 address.
CNAME	Makes one name an alias of another name.
MX	Says which mail servers receive email for the domain.
TXT	Free text, used for SPF, DKIM and domain ownership checks.
NS	Lists the name servers that are in charge of the domain.
SOA	Start of authority: the zone's main settings and serial number.
PTR	Reverse lookup: maps an IP address back to a name.
SRV	Points to the host and port of a specific service.
CAA	Limits which certificate authorities may issue certificates.

Networking

CIDR and subnet mask table

Prefix length, subnet mask, total addresses and usable hosts.

Prefix	Mask · total · usable
/8	255.0.0.0 · 16,777,216 · 16,777,214
/16	255.255.0.0 · 65,536 · 65,534
/20	255.255.240.0 · 4,096 · 4,094
/22	255.255.252.0 · 1,024 · 1,022
/24	255.255.255.0 · 256 · 254
/25	255.255.255.128 · 128 · 126
/26	255.255.255.192 · 64 · 62
/27	255.255.255.224 · 32 · 30
/28	255.255.255.240 · 16 · 14
/29	255.255.255.248 · 8 · 6
/30	255.255.255.252 · 4 · 2
/32	255.255.255.255 · 1 · 1

Networking

Network troubleshooting commands

Commands to find out where a connection breaks. Only test systems you own or have permission to test.

Command	What it does
ping -c 4 example.com	Check that a host answers, and how long it takes.
traceroute example.com	Show every router a packet passes on its way.
dig example.com A	Look up DNS records for a name.
nslookup example.com	A simpler DNS lookup that works on most systems.
curl -I https://example.com	Fetch only the response headers of a web page.
ip addr	Show your network interfaces and IP addresses.
ip route	Show where traffic is sent, including the default gateway.
ss -tulpn	List listening ports and the programs that opened them.
nmap -sV 192.168.1.10	Scan a host you own to see open ports and service versions.
tcpdump -i eth0 port 53	Capture DNS packets on an interface.

Software development

SQL cheat sheet

The statements behind most database work. Always pass user input as parameters, never by joining strings.

Statement	What it does
SELECT name, email FROM users;	Read columns from a table.
SELECT * FROM orders WHERE total > 100;	Filter rows with a condition.
ORDER BY created_at DESC LIMIT 10	Sort the result and keep only the first rows.
INSERT INTO users (name) VALUES ($1);	Add a row. $1 is a parameter filled in safely.
UPDATE users SET name = $1 WHERE id = $2;	Change existing rows. Never forget the WHERE.
DELETE FROM sessions WHERE expires_at < now();	Remove rows that match.
JOIN orders ON orders.user_id = users.id	Combine rows from two tables that share a value.
SELECT status, count(*) FROM orders GROUP BY status;	Group rows and count or sum them.
CREATE INDEX ON users (email);	Speed up searches on a column.
BEGIN; ... COMMIT;	Run several statements as one all-or-nothing transaction.

Software development

Regular expression cheat sheet

Patterns for searching and validating text. Try them in the Regex tester tool.

Pattern	Matches
.	Any single character except a new line.
\d \w \s	A digit, a word character, a whitespace character.
^ $	The start and the end of the text.
\b	A word boundary.
* + ?	Zero or more, one or more, zero or one of the previous item.
{2,4}	Between 2 and 4 of the previous item.
[abc] [^abc]	One of the listed characters, or any character not listed.
(cat\|dog)	A group that matches cat or dog and remembers it.
(?:cat\|dog)	The same group without remembering it.
(?=x)	A lookahead: only if x follows, without using it up.

Cloud & Linux

Bash scripting basics

The building blocks of shell scripts for automation.

Syntax	Meaning
#!/usr/bin/env bash	First line: which program runs the script.
set -euo pipefail	Stop on errors, unset variables and failed pipes. A safer default.
name="web01"; echo "$name"	Set and use a variable. Quote it to keep spaces safe.
if [ -f "$file" ]; then ... fi	Run commands only if a condition is true, here if a file exists.
for f in *.log; do ... done	Repeat commands for every item in a list.
cmd1 \| cmd2	Send the output of one command into another.
cmd > out.txt cmd >> out.txt	Write output to a file, replacing it or appending to it.
$?	The exit code of the last command. 0 means success.
cmd1 && cmd2 cmd1 \|\| cmd2	Run the second only if the first succeeds, or only if it fails.
chmod +x script.sh && ./script.sh	Make a script executable and run it.

Cloud & Linux

Cron schedule syntax

Five fields: minute, hour, day of month, month and day of week. Try them in the Cron explainer.

Expression	Runs
* * * * *	Every minute.
/15 * * *	Every 15 minutes.
0 * * * *	At the start of every hour.
0 2 * * *	Every day at 02:00.
30 9 * * 1-5	At 09:30 on weekdays, Monday to Friday.
0 0 1 * *	At midnight on the first day of every month.
0 0 * * 0	At midnight every Sunday.
0 8,20 * * *	Twice a day, at 08:00 and 20:00.

Cloud & Linux

Linux permission modes

Common chmod values and when to use them. Read is 4, write is 2, execute is 1.

Mode	Meaning
777 rwxrwxrwx	Everyone can do everything. Almost never correct.
755 rwxr-xr-x	Owner full access, others read and run. Typical for programs and folders.
750 rwxr-x---	Owner full access, group read and run, others nothing.
700 rwx------	Only the owner has any access. Good for private folders.
664 rw-rw-r--	Owner and group can edit, others can read.
644 rw-r--r--	Owner can edit, everyone can read. Typical for web files.
640 rw-r-----	Owner edits, group reads. Good for config files with passwords.
600 rw-------	Only the owner can read and write. Required for SSH private keys.
400 r--------	Read-only for the owner. Good for keys that never change.

Cybersecurity

Web security headers and cookie flags

Response headers that make browsers enforce safer behavior.

Header or flag	What it protects
Content-Security-Policy	Limits where scripts, images and frames may load from. Strong protection against XSS.
Strict-Transport-Security	Tells browsers to always use HTTPS for this site.
X-Content-Type-Options: nosniff	Stops browsers from guessing file types and running disguised scripts.
X-Frame-Options: DENY	Prevents other sites from showing yours in a frame (clickjacking).
Referrer-Policy	Controls how much of your address is sent to other sites.
Permissions-Policy	Turns off browser features such as camera or location for the page.
Set-Cookie: HttpOnly	Hides the cookie from JavaScript, so XSS cannot steal it.
Set-Cookie: Secure	Sends the cookie only over HTTPS.
Set-Cookie: SameSite=Lax	Limits cookies on cross-site requests, reducing CSRF.
Access-Control-Allow-Origin	CORS: which other websites may read responses from your API.

Cybersecurity

Cryptography at a glance

Which algorithm to use for which job, and which ones to avoid.

Algorithm	What it is and when to use it
AES-256-GCM	Fast symmetric encryption for data at rest and in transit. Same key encrypts and decrypts.
ChaCha20-Poly1305	A modern symmetric cipher, great on phones without hardware AES.
RSA 2048+	Public-key encryption and signatures. Slower, mostly used to exchange keys.
ECDSA / Ed25519	Compact public-key signatures with smaller keys than RSA.
Diffie-Hellman	Lets two parties agree on a shared secret over an open channel.
SHA-256	A cryptographic hash for fingerprints and integrity checks. Not for passwords.
HMAC	A hash mixed with a secret key to prove a message was not changed.
bcrypt / Argon2	Slow, salted hashes made for storing passwords.
TLS 1.3	The protocol behind HTTPS. Use it and disable old versions.
MD5 / SHA-1	Broken for security use. Never use them for signatures or passwords.

Cybersecurity

Common attacks glossary

Plain-language definitions of the attacks you will hear about most.

Attack	What it is
Phishing	Fake messages that trick people into giving up passwords or clicking harmful links.
Ransomware	Malware that locks files and demands payment to unlock them.
DDoS	Flooding a service with traffic from many machines so real users cannot get in.
Man-in-the-middle	Secretly sitting between two parties to read or change their messages.
Brute force	Trying many passwords until one works.
Credential stuffing	Trying leaked username and password pairs on other sites.
Zero-day	An attack on a flaw the vendor does not know about yet, so no patch exists.
Supply chain attack	Compromising a supplier or software package to reach its customers.
Privilege escalation	Turning limited access into administrator access.
Social engineering	Manipulating people rather than computers to get access.
Insider threat	Harm caused by someone with legitimate access, on purpose or by accident.

Cybersecurity

MITRE ATT&CK tactics

The 14 stages attackers move through, a shared language for defenders.

Tactic	The attacker's goal
Reconnaissance	Gather information about the target.
Resource development	Set up infrastructure, accounts and tools for the attack.
Initial access	Get a first foothold, for example through phishing.
Execution	Run malicious code on the system.
Persistence	Keep access after restarts and password changes.
Privilege escalation	Gain higher permissions.
Defense evasion	Avoid being detected or blocked.
Credential access	Steal account names and passwords.
Discovery	Learn about the environment and what is in it.
Lateral movement	Move from one system to others on the network.
Collection	Gather the data of interest.
Command and control	Communicate with compromised systems to direct them.
Exfiltration	Steal the data out of the network.
Impact	Disrupt, destroy or lock systems and data.