🌶 Changelog

• 2026-10-22 IMPROVE Clearer page titles and descriptions on every cheat sheet. Each of the 272 cheat sheet pages now has a readable browser and search-result title (for example Nmap cheat sheet · commands & reference) and a written description of what the sheet covers, instead of an auto-truncated fragment. This helps the pages be found and understood in search results. No page content or URLs changed.
• 2026-10-11 FIX More tool input fixes. In the Encoder / Decoder, the Reverse operation now reverses by character, so emoji and other multi-byte characters are no longer split apart and corrupted. The Reverse Shell Generator substitutes the host and port literally, so a $ in a value can never be read as a replacement pattern, and its copy buttons now report copy failed instead of silently claiming success when the browser blocks clipboard access. The CVSS Calculator no longer breaks when a vector carries a metric key named like a built-in object property (for example constructor); such keys are treated as unknown.
• 2026-10-11 SITE Build-source data directories blocked over HTTP. The raw dataset directories the cheat sheets and walkthroughs are generated from (/cheatsheets/data/ and /walkthroughs/data/) now return 403. Their contents were only duplicates of the published pages, so this is tidiness rather than a leak fix; the generated pages and the runtime data the tools actually fetch are unaffected.
• 2026-10-11 FIX Input handling in three tools. The CVSS Calculator now rejects vectors with an unknown metric value or a repeated metric instead of showing NaN; the JWT Decoder no longer stops working when a header or payload is JSON null or an array, and no longer labels a claim named constructor; the Hash Identifier only suggests Cisco type 7 for its real shape (offset 00–15 followed by hex pairs).
• 2026-10-04 NEW LLM Red-Team Checklist. A client-side coverage checklist for authorized LLM/GenAI red teaming, organised by the OWASP Top 10 for LLM Applications (2025) and cross-referenced to MITRE ATLAS, with status tracking and Markdown/JSON export. Nothing is uploaded.
• 2026-10-03 CONTENT Pentest-methodology quiz expanded to 305 questions. The Pentest methodology bank grew from 247 to 305 questions. Every new item is transcribed from NIST SP 800-115 — the four-phase methodology, the categories of vulnerabilities exploited during an attack, information gathering, data handling (collection, storage, transmission and SP 800-88 sanitization) and post-testing activities (mitigation, reporting, remediation) — each answer cited to its section. Nothing is invented; you still choose how many questions to draw and each attempt is random.
• 2026-10-03 CONTENT Two more attack-path walkthroughs — seventeen now. DCSync to domain dominance (replication rights let an attacker pull every account hash — including krbtgt — straight from a domain controller, enabling golden-ticket forgery) and JWT algorithm confusion to account takeover (an API that trusts the token header's algorithm lets the RSA public key be reused as an HMAC secret to forge admin tokens) join the walkthroughs, each mapped to MITRE ATT&CK with detection and mitigation at every stage.
• 2026-10-03 CONTENT Two more attack-path walkthroughs — fifteen now. Two canonical paths join the walkthroughs: Kerberoasting to a privileged service account (request SPN service tickets as any domain user, crack them offline, and abuse an over-privileged service account), and insecure deserialization to remote code execution (an untrusted serialized blob reaching a deserializer, driven through a library gadget chain to a shell). Each step maps to MITRE ATT&CK and links the cheat sheets, tools and quizzes that cover the detail.
• 2026-10-03 CONTENT Two more attack-path walkthroughs — thirteen now. Two classic internal paths join the walkthroughs: LLMNR/NBT-NS poisoning to an SMB relay foothold (capture Windows authentication from broadcast name resolution and relay it to a host without SMB signing — no password cracked) and container escape to the host (how a mounted Docker socket, privileged mode or a dangerous capability lets a workload break out onto the node). Both map every stage to MITRE ATT&CK (v19.2) with the detection it raises and the control that stops it.
• 2026-10-03 NEW New tool — username / email permutator. The Username / Email Permutator turns a list of full names into the username and email formats organisations commonly use — first.last, flast, f.last, firstl, first_last and more, with middle-initial variants. Add one or more domains to produce email addresses, choose which formats to include, and copy or download the de-duplicated list. Diacritics are folded to ASCII (José → jose). It is for authorized recon and password-spray scoping only — it generates candidates, it does not confirm accounts, and everything runs in your browser.
• 2026-10-03 CONTENT Three more attack-path walkthroughs. The walkthroughs library grows to eleven with Wi-Fi (WPA2) to the internal network (capture and crack a handshake, then join the network), SQL injection to remote code execution (from data disclosure to a shell via the database's own features) and OAuth consent phishing to a cloud mailbox (an illicit token grant that sidesteps the password and MFA). Each stage is mapped to its MITRE ATT&CK technique (v19.2) and paired with the detection it raises and the control that stops it.
• 2026-10-03 NEW New tool — payload encoder / decoder. The Payload Encoder / Decoder chains reversible text transforms into a recipe — Base64 and URL-safe Base64, URL and full per-byte percent-encoding, hex, HTML entities (including all-numeric for XSS), Unicode \uXXXX escapes, decimal and binary char codes, plus ROT13 and reverse. Each step runs on the output of the one before it, so you can build chains like Base64 → URL-encode or double URL-encode for WAF-bypass research, reorder or remove steps, and decode captured data. UTF-8 safe, with one-click presets. Everything runs in your browser — nothing is uploaded.
• 2026-10-03 NEW New tool — CVSS calculator (v4.0 & v3.1). The CVSS Calculator scores a vulnerability with the official CVSS v4.0 and v3.1 metrics, updating the score, qualitative severity and vector string as you choose. The v4.0 engine uses FIRST's own MacroVector lookup tables and interpolation algorithm (verified identical to the reference calculator across 20,000 vectors); v3.1 implements the specified base-score equations and Roundup. Base, Threat and Environmental metrics are all supported, and you can paste a CVSS:4.0/… or CVSS:3.1/… string to load it. Everything runs in your browser — nothing is uploaded.
• 2026-10-03 NEW New section — attack-path walkthroughs. Walkthroughs is a new section of end-to-end red-team engagement paths, one stage at a time — eight to start: external web app to an internal foothold, phishing to Domain Admin, AD CS (ESC1) to Domain Admin, Linux shell to root, SSRF to cloud account takeover, a leaked cloud key to account takeover, password spraying to a cloud mailbox and Kubernetes workload to cluster-admin. Every stage is mapped to a MITRE ATT&CK technique (v19.2, resolved from the official dataset) and paired with the detection it generates and the control that stops it, with links to the matching cheat sheets, tools and quizzes. Knowledge, not weapons: these are conceptual, defensive-aware paths for authorized testing — not copy-paste playbooks.
• 2026-10-03 NEW Seventh quiz — Linux privilege escalation. Linux privilege escalation covers getting from a shell to root — 404 questions built from GTFOBins (SUID, sudo and Linux-capability abuse of real binaries), the MITRE ATT&CK Linux privilege-escalation techniques (v19.2), and the Linux capabilities(7) manual page. Every answer is cited to its primary source and cross-checked against the source data. Choose how many questions you want; random every attempt.
• 2026-10-03 NEW Sixth quiz — containers & Kubernetes. Containers & Kubernetes covers attacking and hardening container platforms — 301 questions combining the MITRE ATT&CK Containers matrix (technique recognition, tactic mapping, sub-technique parentage and IDs, from the v19.2 dataset) with Kubernetes architecture and RBAC, Pod Security Standards, the OWASP Kubernetes Top Ten, NSA/CISA hardening guidance and container/Docker fundamentals — each answer cited to its primary source (MITRE, kubernetes.io, OWASP, CISA, Docker). Choose how many questions you want; random every attempt.
• 2026-10-03 NEW Fifth quiz — cloud attacks. Cloud attacks covers attacks against cloud platforms — IaaS, SaaS, Identity Provider and Office Suite — across every ATT&CK tactic: 494 questions derived from the official MITRE ATT&CK Enterprise v19.2 cloud matrix and cited to each ATT&CK page (technique recognition, technique→tactic mapping, sub-technique parentage, IDs and platform scope). Choose how many questions you want; random every attempt.
• 2026-10-03 NEW Fourth quiz — pentest methodology — plus a PTES methodology cheat sheet. The quiz section is now complete with Pentest methodology — 247 questions spanning NIST SP 800-115, CVSS v3.1 severity scoring, the PTES phases and technical guidelines, the OWASP Risk Rating Methodology and the Lockheed Martin Cyber Kill Chain, each answer cited to its primary source. A companion PTES methodology cheat sheet maps the seven PTES phases and their activities. As with every quiz you choose the number of questions and each attempt is drawn fresh and in random order.
• 2026-10-03 NEW Two more quizzes (OWASP WSTG, Active Directory) and a green perfect score. The quiz section gains two topics. OWASP Web Security Testing Guide — 337 questions across all 12 WSTG categories and 114 tests (IDs, categories and objectives), from the official WSTG checklist. Active Directory & privilege escalation — 332 questions on the AD attack chain (Kerberos/NTLM abuse, LSASS and DCSync credential theft, Pass-the-Hash/Ticket, privilege escalation), each mapped and cited to a MITRE ATT&CK technique. Both let you choose the question count and are random every attempt. On the results screen a perfect 100% score now shows in green.
• 2026-10-03 NEW New quiz section, starting with MITRE ATT&CK. A practice-quiz section is now live at /quiz/, beginning with MITRE ATT&CK (Enterprise v19.2) — 357 questions across the 15 tactics plus framework fundamentals, every one derived from the official ATT&CK dataset and cited to its ATT&CK page (tactic goals and IDs, technique→tactic mapping, sub-technique parentage, mitigations). You choose how many questions to answer (10, 20, 50, 100 or all) and each attempt is drawn fresh and in random order, with a quiz mode (scored, per-topic breakdown) and a flashcard mode. It runs entirely in your browser. More topics are in preparation.
• 2026-10-02 CONTENT Twelve new cheat sheets. Added references covering web exploitation (SSTI, NoSQL injection, open redirect, host-header injection, file-upload bypass, CORS misconfiguration), Active Directory & post-exploitation (pass-the-hash, golden & silver tickets, shadow credentials, SAML attacks), and operations (pivoting & tunneling, file-transfer techniques). The library is now 271 sheets.
• 2026-09-30 NEW Two reporting tools, plus three more builders. Five client-side tools joined the toolbox: the Pentest Report Builder drafts a full report with a built-in CVSS 3.1 calculator and exports Markdown, HTML or PDF; the Red-Team Comms Builder drafts engagement emails — kickoff, status, and especially incident/mistake, out-of-scope and deconfliction — and exports them as .eml, mailto, .txt or Markdown; and the Nmap Command Builder, JWT Decoder & Analyzer and Hash Identifier round out recon, auth and cracking. Everything runs in your browser — nothing is uploaded or stored.
• 2026-09-30 CONTENT Thirteen new cheat sheets. Added references for Kubernetes and Docker, web exploitation (LFI/RFI, XXE, command injection, insecure deserialization, subdomain takeover), reverse engineering (Frida, Ghidra), LLM / AI red-teaming, password spraying, and engagement paperwork — pentest reporting & templates and red-team comms templates. The library is now 259 sheets.
• 2026-09-30 SITE This changelog. Every notable change to the site now lands here, newest first, with an Atom and JSON feed so you can follow along from a reader — no email, no tracking.
• 2026-09-30 SITE Design aligned with CyberRamen. OffensiveRamen now shares its blue-team sister site's design system, set apart only by a dark-red-on-near-black palette. Same typography, same components, one consistent look across both sites.
• 2026-09-30 NEW Cheat sheets launched. A searchable library of offensive-security command references — recon, exploitation, Active Directory, cloud, web and post-exploitation — each on its own page you can read, search or print. No login, no tracking.
• 2026-09-30 NEW The first interactive tools. The tools hub opened with a Recon / OSINT Helper, Google Dork Builder, LOLBin / GTFOBins Browser, Reverse Shell Generator and a Hashcat / John rule & mask builder — all client-side, organised by the pentest kill chain.
• 2026-09-30 SITE OffensiveRamen is live. A red-team sister site to CyberRamen: offensive-security tools and references for authorized testing only, running entirely in your browser with no accounts and no tracking.

Nothing in this category yet.