# CanYouPwnMe!

> A Turkish-language cybersecurity education platform covering penetration testing, vulnerability research, CTF writeups, hardening guides, and cheatsheets. Maintained by a community of security researchers.

## About

CanYouPwnMe! (canyoupwn.me, abbreviated "cypm!") is a community-driven cybersecurity blog founded and maintained by Turkish security researchers. The site publishes practical, hands-on content aimed at students, professionals, and enthusiasts learning offensive and defensive security. The full site tagline is "CanYouPwnMe! - For Cyber Security Researchers".

The site is a static archive of 212 blog posts originally published on WordPress (2016–2020). Content is organized into categories and covers a broad spectrum of cybersecurity topics, from beginner Linux basics to advanced binary exploitation, network attacks, and real-world CTF challenge solutions.

Posts are prefixed with a language indicator:
- `TR |` — Turkish-language post (the large majority)
- `EN |` — English-language post (a smaller subset)

## Content Categories

- **bug-bounty** — Real-world bug bounty write-ups and methodology (e.g., Sony subdomain takeover, Yandex bug bounty process, Eksi Sozluk app vulnerability)
- **cheatsheet** — Quick-reference command sheets for common security tools (Nmap, Hydra, Hping, Burp Suite, reverse shell one-liners, x86 assembly, MSFvenom)
- **courses** — In-depth tutorial series and structured learning content (wireless attacks, Metasploit usage, Kali Linux setup, vulnerability exploitation walkthroughs)
- **hardenings** — System hardening guides for Linux and Windows (Apache, SSH, DNS, PHP, iptables, PAM, disk encryption, Windows Firewall, Group Policy, WordPress)
- **howto** — Practical how-to articles for specific tasks (using GPG, setting up Tor, port knocking, proxychains, 2FA for SSH, Scapy scripting)
- **tips** — Short tips and security awareness posts (online compiler risks, password management, physical security, anonymity, Firefox privacy)
- **tutorials** — Step-by-step technical tutorials (network forensics, malware analysis, SCADA security, post-exploitation, pivoting, privilege escalation)
- **walkthrough** — Vulnerable VM and CTF walkthrough write-ups (VulnHub machines, Protostar, HackTheBox, RingZer0, PentesterLab, CTF competitions)

## Popular Topics

### Network Security & Attacks
- ARP poisoning and MITM attacks (using Scapy, MITMf)
- DNS amplification, DNS spoofing, DNS hardening
- SNMP attacks, ICMP redirect attacks, IP fragmentation DoS
- Wi-Fi attacks: WEP/WPA/WPA2 cracking, wireless DoS, hidden SSID discovery
- CAM table overflow / MAC flood attacks
- DDoS protection and stress testing with JMeter
- Network traffic analysis: Tcpdump, Dshell, Wireshark

### Web Application Security
- SQL injection (manual and SQLMap), error-based injection, WAF bypass
- XSS (cross-site scripting), CSRF, SSRF, XXE
- File inclusion (LFI/RFI), URL redirect vulnerabilities
- XPath injection, Server-Side Template Injection (SSTI)
- Cloudflare bypass techniques
- Web application hardening (Apache, PHP, Nginx/Varnish)
- Drupal SQL injection (CVE-2014-3704)

### Exploitation & Post-Exploitation
- Metasploit Framework usage and modules (ms08_067, EternalBlue MS17-010, Shellshock, Heartbleed)
- Meterpreter commands, RDP via Meterpreter, pass-the-hash with PsExec
- Empire framework, Mimikatz, Armitage
- Buffer overflow and stack exploitation (Protostar series)
- ROP chains and code reuse attacks (ret2libc)
- XOR-encoded shellcode, egg hunting technique
- SUID bit abuse, dirty cow (CVE-2016-5195), MS16-032
- Jenkins exploitation, Tomcat exploitation, MSSQL exploitation via Metasploit
- WebDAV exploitation

### Reconnaissance & OSINT
- Nmap scanning and enumeration
- Nikto, Dirbuster, Shodan
- DNS lookup tools, email harvesting
- Open-source intelligence (OSINT) methodology
- Google dorks

### Privilege Escalation & Lateral Movement
- Linux and Windows enumeration techniques
- Pivoting and port forwarding
- Windows user and account management
- Active Directory and domain penetration testing concepts
- Pass-the-hash attacks

### Cryptography & Privacy
- Introduction to cryptography (symmetric, asymmetric)
- Quantum cryptography overview
- GPG usage, TrueCrypt/disk encryption, BitLocker
- Tor network: browsing anonymously, hosting .onion sites, OnionShare, Onion Pi
- Proxychains, WebRTC IP leak prevention
- IDN homograph attacks

### Hardening & Defense
- Linux hardening: user security, disk security, file/directory permissions, root protection, TCP wrappers, PAM, GRUB security, removing unnecessary services
- Linux bash activity logging and history format
- SSH hardening and 2FA
- Apache mod_evasive for DoS/DDoS protection
- Windows hardening: firewall, Group Policy, AppLocker, print services
- WordPress hardening
- Honeypots: setup and usage
- Physical security considerations
- Secure data deletion

### Mobile & Embedded
- Android penetration testing introduction
- Android Stagefright exploit (CVE-2015-1538 etc.)
- Bluetooth Low Energy overview
- SCADA systems security

### CTF & Vulnerable VMs
- Protostar (Stack 0, 1, 2 writeups)
- VulnHub machines: Kevgir, SmashtHeTux, DonkeyDocker, Billu-b0x, Bulldog, HackDayAlbania, Seattle v0.3, Stapler, Proteus, D0Not5top, 6days-lab
- HackTheBox: Nibbles writeup
- RingZer0 writeup
- InfoSecInstitute CTF writeup
- HITB CTF Singapore web challenge writeup
- PentesterLab: Web for Pentester XSS and SQLi series
- SQL-i labs walkthrough series (levels 0–15)
- Web For Pentester 2 SQLi

### Tools & Learning Resources
- Awesome curated lists: Python, Ruby, Assembly, C, Perl, PHP, Node.js, web app sec, network security, Wi-Fi security, pentesting, malware analysis
- Scapy scripting: probe request analysis, SSID collection, pcap parsing, ARP poisoning, wireless DoS
- Python: SimpleHTTPServer/wget tricks, interactive shell via pty module, data hacking
- CTF platform lists

## Content Language

The primary language is **Turkish (tr)**. Approximately 80–85% of posts are written in Turkish, targeting the Turkish-speaking security community. The remaining 15–20% of posts are written in **English (en)** and cover topics such as reverse shell cheat sheets, network security resources, Wi-Fi password cracking, Shellshock exploitation, Nmap cheatsheet, PHP security checklist, HTML5 learning resources, CTF lists, and Sony subdomain takeover.

## Site Structure

The site is a static HTML archive with the following URL layout:

- Posts: `https://canyoupwn.me/posts/{slug}/`
- Categories: `https://canyoupwn.me/categories/{category}/`
- Pages: `https://canyoupwn.me/pages/{page}/`
- Author archives: `https://canyoupwn.me/archive/author/{username}/`

Post slugs use a `tr-` or `en-` prefix to indicate the content language, followed by a descriptive kebab-case title.

## Authors

The site was built by a community of Turkish security researchers and contributors. Notable authors include:

- Mustafa Kaan Demirhan (@mstfknn) — founder, Security Researcher
- Hakkı YÜCE (@h4yuce) — Cyber Security Researcher / Project Director
- Cihan Mehmet Doğan (@cihanmehmets) — contributor
- Cagatay Cali (@cagataycali) — contributor
- Additional community contributors from various Turkish university cybersecurity clubs (cypm-uni teams)

## Links

- Homepage: https://canyoupwn.me/
- Posts: https://canyoupwn.me/posts/
- Categories: https://canyoupwn.me/categories/
- Cheatsheets: https://canyoupwn.me/categories/cheatsheet/
- Hardenings: https://canyoupwn.me/categories/hardenings/
- Walkthroughs: https://canyoupwn.me/categories/walkthrough/
- Tutorials: https://canyoupwn.me/categories/tutorials/
- Bug Bounty: https://canyoupwn.me/categories/bug-bounty/
- Twitter: https://twitter.com/canyoupwnme
- Facebook: https://www.facebook.com/canyoupwnme
- YouTube: https://www.youtube.com/channel/UCkp4BOhjN9iJkDCYMpk1Qkg
- LinkedIn: https://www.linkedin.com/company/10430795