A personal, continuously-updated cybersecurity study repo
Offensive-side notes for eJPT and defensive-side notes for BTL1 — cheat sheets, an offline field toolkit, and a study roadmap.

_{Senior SOC Analyst & Facilitator — expanding into offensive security through eJPT & BTL1.}

🧰 Open the Field Toolkit (live) · 📄 Study Roadmap

---

📖 What's in here

This repo collects everything gathered while studying for the eJPT (eLearnSecurity Junior Penetration Tester) and BTL1 (Blue Team Level 1) certifications: practical, command-heavy cheat sheets — not theory dumps — each covering one tool or one concept, cross-referenced against its siblings.

	Folder	Focus
🔴	Red-Team/	Recon, enumeration, exploitation, post-exploitation, reporting — eJPT-aligned
🔵	Blue-Team/	Detection, triage, forensics, incident response — BTL1-aligned
🟣	Purple-Team-Mapping/	Attack ↔ detection cross-reference — ties Red-Team techniques to Blue-Team detections across ten kill-chain stages
🎯	Interview-Prep/	Interview Q&A — fundamentals, red team, blue team, behavioral, junior pentest — in flashcard format, plus an interactive study app
🧰	field-toolkit_2.html	Offline, single-file interactive reference — calculators + quick-lookup cards, no install needed (link opens the live version)
📘	blue-team-study-notes_1.html	Interactive BTL1 study reference — curriculum prioritized by importance, click-to-expand notes with real commands/workflows (Splunk SPL, Wireshark filters, Volatility, DeepBlueCLI, Autopsy, TheHive, report template)
⏱️	btl1-exam-tracker.html	Interactive BTL1 exam companion — 24h timer + pacing, IOC table, timeline, host/network activity map (Wireshark-ready), MITRE ATT&CK checklist, confidence tracking, and auto-generated report draft (link opens the live version)
🗺️	ejpt-roadmap.md	Study roadmap / progress tracker
📕	ejpt-study-notes.html	Interactive eJPT study reference — curriculum mapped to your actual course order (TryHackMe Pre-Security → INE eJPTv2 → Junior Pentester Path → Beginner's/Offensive Pentesting Path), click-to-expand notes with real commands/workflows (enumeration, web app testing, Metasploit, Active Directory, pivoting)
🧭	ejpt-study-reference.html	Interactive eJPT exam companion — 48h timer + pacing, Hosts/Loot/Timeline tracking, coverage bar, confidence tracking, quick-reference cheat sheet (Nmap, enumeration, web app, Metasploit, privesc, pivoting, AD), Toolbox calculators (Epoch, Base64, hash ID, hex/dec + IP/CIDR), auto-generated report draft
📋	playbook-index.md	Quick-access index of every scenario playbook — "which alert just fired, which playbook do I open"
🔍	osint-field-toolkit.html	Interactive OSINT investigation reference — 58 tools across 7 categories (email/domain, IP/infrastructure, URL/file sandboxing, phishing intel, threat & breach intel, social/identity, image/metadata) plus a Frameworks & Methodology category (MITRE ATT&CK, D3FEND, Pyramid of Pain, Diamond Model, Cyber Kill Chain, PICERL, STIX/TAXII, MISP, OpenCTI), each with a click-through panel: usage notes, input → output, and an OPSEC reminder. BTL1 phishing analysis + eJPT recon aligned.
🎣	phishing-analysis-field-guide.html	Interactive phishing analysis methodology reference — header analysis, SPF/DKIM/DMARC, sender & domain red flags, content & social-engineering patterns, attachment & link analysis, and IOC extraction, each with a click-through panel: what to check and why. BTL1-aligned.
📡	splunk-field-guide.html	SPL and Windows Event ID reference for SIEM triage — default fields, search commands, Security & Sysmon Event IDs (including Kerberos, DCSync, scheduled-task and password-reset events), network beaconing detection, and email/endpoint/network/DNS/web/auth/account-management fields, each with a ready SPL query. BTL1-aligned.
🦈	wireshark-field-guide.html	Wireshark field and display-filter reference for packet capture review — TCP flags & Nmap scan signatures, HTTP/DNS/TLS/ARP/DHCP fields, a common-ports quick reference, and credential-exposure indicators. BTL1-aligned.
💻	live-host-triage-field-guide.html	Live Windows host triage reference — CLI/PowerShell commands for network, process & service, account, and persistence checks, run before the system is ever imaged or its memory captured. BTL1-aligned.
💽	autopsy-field-guide.html	Interactive Autopsy disk forensics reference — case/ingest setup, timeline & MACB analysis, deleted files & carving, keyword/hash search, web & OS artifacts, registry/email/EXIF, and tagging/reporting, each with a click-through panel: what to look for and exactly where to find it. BTL1-aligned.
🔷	deepblue-field-guide.html	Interactive DeepBlueCLI reference for Windows Event Log triage — usage & parameters plus detection patterns (brute force, credential dumping, obfuscated PowerShell, persistence, log clearing), each with the exact detection string and Event ID. BTL1-aligned.
🧠	volatility-field-guide.html	Interactive Volatility memory forensics reference — acquisition & setup, process analysis, process internals, injection & hooking, network & registry (including credential extraction), and timeline & file activity, each with the exact plugin command. BTL1-aligned.

Both folders are organized into numbered sub-folders that roughly follow the order you'd actually work through them — recon before exploitation on the Red-Team side, alert-triage before deep forensics on the Blue-Team side. See each folder's own README.md for the full file index.

---

🧰 Try the field toolkit

field-toolkit_2.html is a single, self-contained file — calculators (Base64, hash identifier, subnet/CIDR, Hydra command builder, reverse shell generator, and more) plus quick-reference cards for both red and blue team work, filterable by category. No server, no dependencies, no accounts, works fully offline.

View it live — GitHub Pages is already enabled on this repo's default branch (cybersecurity-learning-hub), so it's reachable right now at:

https://zelihazenginapogeeusa-byte.github.io/zeliha-infosec-journey/field-toolkit_2.html

(optional: rename field-toolkit_2.html to index.html at the repo root if you'd rather the short root URL — .../zeliha-infosec-journey/ — load it directly)

---

🗂️ Repo structure

zeliha-infosec-journey/
├── README.md
├── LICENSE
├── banner.png
├── field-toolkit_2.html
├── toolkit-preview.png
├── ejpt-roadmap.md
├── playbook-index.md
├── Red-Team/
│   ├── README.md
│   ├── 01-Recon-and-OSINT/
│   │   ├── assessment-methodology-report-writing-cheatsheet-professional.md   (shared w/ Blue-Team)
│   │   ├── osint-cheatsheet.md
│   │   ├── ejpt-exam-checklist-and-methodology.md
│   │   └── ... (4 more)
│   ├── 02-Web-and-Network-Pentesting/
│   │   ├── nmap-cheatsheet-professional.md
│   │   ├── gobuster-cheatsheet-professional.md
│   │   └── ... (6 more)
│   └── 03-Exploitation-and-Post-Exploitation/
│       ├── active-directory-enumeration-cheatsheet-professional.md
│       ├── active-directory-attack-chain-playbook.md
│       ├── metasploit-cheatsheet-professional.md
│       └── ... (12 more)
└── Blue-Team/
    ├── README.md
    ├── 01-SOC-and-SIEM-Analysis/
    │   ├── siem-splunk-elk-cheatsheet-professional.md
    │   ├── splunk-siem-investigation-playbook.md
    │   └── ... (5 more)
    └── 02-DFIR-and-Threat-Intelligence/
        ├── volatility-autopsy-forensics-cheatsheet-professional.md
        ├── phishing-cheatsheet.md
        ├── ransomware-incident-response-playbook.md
        └── ... (11 more)

(exact counts drift as new files get added — each folder's own README.md is always the source of truth for what's currently inside it.)

---

⚠️ Scope

All techniques documented here are for use in authorized environments only — personal labs, CTFs, and engagements covered by written authorization (RoE). Nothing in this repo should be used against systems without explicit permission.

---

_{Built while studying — updated as new modules get covered.}