During a security lab, a small gap in recall can interrupt an otherwise useful line of investigation. A command option needs checking, a familiar tool has not been used for months, or notes from a previous exercise are difficult to find. Hacking Cheatsheets organises reference material around those everyday needs, bringing tool guides, testing methodologies and defensive topics into a single GitHub repository.
Disclosure: Hacking Cheatsheets is maintained by Ilias Georgopoulos, editor of DaySec.
At the time of review, the project’s English index linked to 127 guides across 77 topic folders. The collection provides English and eleven additional language editions. Its scope extends from individual tools such as Nmap and Burp Suite to cloud security, incident response and the task of writing an assessment report.
What the collection contains
The repository offers several ways to approach a subject. Tool-specific guides organise installation information, command syntax, examples and reference tables around a particular application. Broader topic guides address areas such as web vulnerabilities, Active Directory, OSINT, network testing, digital forensics and reverse engineering. Separate sections cover CTF exercises, mobile applications, containers and IoT.
The Nmap guide illustrates the tool-focused approach. Its contents separate target selection, host discovery, scanning techniques, service detection, output formats and quick reference material. That structure lets a reader find a particular task without working through the entire document each time. Understanding the task still matters: a reference table can remind you of syntax, while the surrounding explanation helps establish what the command is intended to do.
There is also a substantial defensive side. The Blue Team section includes incident response, log analysis, SIEM detection, threat hunting, hardening, Sigma and YARA material. The reporting section contains templates for penetration tests, bug bounty submissions and executive summaries. Including those areas connects technical investigation with detection, remediation and communication.
Twelve language editions, with English as the reference
The available languages are English, Greek, Turkish, Italian, German, Russian, French, Spanish, Portuguese (Portugal), Arabic, Simplified Chinese and Norwegian Bokmål. Each has a homepage that links into the translated guides. The language navigation is visible at the top of the main README, making it part of the normal route into the collection.
The documented translation policy keeps English as the primary version. Explanatory text is translated, while tool names, command syntax, paths and necessary technical terms retain their original form. This gives readers a way to study an explanation in a familiar language while recognising the commands and terminology they will encounter in documentation or a terminal.
For example, readers can move between the English Nmap guide and its Greek edition. A check of the repository tree found corresponding translation files for all 127 indexed guides in each additional language. File coverage establishes that the editions are present; it does not independently establish the accuracy of every translated explanation or technical example.
The philosophy reflected in the structure
Three priorities stand out in the way the project is organised: reducing the time spent looking for reference material, giving commands explanatory context and making that material accessible across languages. The collection is organised for repeated use: a guide can provide an introduction during one session and a quick reminder during another.
The contribution guidelines ask for an introduction explaining what a tool is and why it is used, basic commands and a quick reference section. They also encourage installation guidance, examples and links to further resources. That combination supports both an initial reading and a later return when only one detail needs checking.
A useful way to approach the collection is to move between the explanation, the example and your own observations. Reading a command gives you a starting point. Applying it in a suitable lab, checking the output and recording why it behaved that way turns the reference into part of a learning process. The repository can support that process alongside official tool documentation and structured practice.
How a learner might use it
Consider a learner working through an authorised web security lab. They could begin with a methodology guide to organise the investigation, consult a relevant tool reference when a syntax question arises, then use a reporting template to structure their findings. A reader approaching the same exercise from a defensive perspective could consult the log analysis or detection material to explore what evidence the activity might leave.
The documents are stored as Markdown. They can be read on GitHub or downloaded as part of a local copy of the repository, then searched in an editor and consulted offline. External documentation links still need a connection. Keeping a local copy up to date matters when tool options, platform behaviour or examples change.
Readers should check prerequisites, supported versions and the target environment before applying an example. A guide’s presence in a large collection is not evidence that every command was tested against the reader’s current setup. Personal lab notes can record those differences without losing the convenience of a shared reference.
Contributions help keep the reference useful
The project includes an MIT licence file and accepts contributions through GitHub. Its guidelines invite new guides, clearer explanations, corrected commands, updated information and translations. They ask contributors to test commands and examples before submitting a pull request, with review by the maintainer forming part of the contribution process.
For someone who finds a problem, a useful issue identifies the affected file and section, describes the environment and explains the observed discrepancy. A focused correction is easier to assess than a general statement that a guide is outdated. Translation reports can similarly point to the English source and the passage that changes its meaning.
The repository homepage is the starting point for browsing the collection and choosing a language. Its intended use is education and authorised security work. For readers building their own reference library, the combination of topic indexes, editable text files and a public correction process provides a practical way to organise material they will need to revisit.
Repository structure and sample documents reviewed on November 5, 2026. Guide and language counts describe the indexed collection at that time. This article is a project overview, not a technical validation of every command or translation.
