WADComs

• ADCSEnumarationActive Directory Certifcate Services or ADCS provide an alternative way to authenticate within a AD enviroment that contains a PKI as well as being configured … WindowsEnumerationShell
• BloodHound.py Remote IngestionBloodHound is a single page Javascript web application, built on top of Linkurious, compiled with Electron, with a Neo4j database fed by a data collector. … LinuxWindowsEnumerationNo_Creds
• BloodHound.py Remote Ingestion CredsBloodHound is a single page Javascript web application, built on top of Linkurious, compiled with Electron, with a Neo4j database fed by a data collector. … LinuxWindowsEnumerationUsernamePassword
• bloodyAD Wite PropertiesBloodyAD can be used to set, write and delete properties of objects in AD. Given a user:pass, you can use bloodyAD to which objects and what properties of those … LinuxEnumerationUsernamePassword
• CredDumpWithoutMimilkatzThe lsass Process while great, is no where neaar the only way to dump credintials from windows. One of which is access the three registry hives: SAM, SYSTEM, … WindowsLinuxShellPrivEscExploitation
• Dementordementor.py interacts with the printer spooler on a host to trigger an authentication from the target IP to an attacker controlled host (usually an SMB or HTTP … LinuxWindowsExploitationPasswordUsername
• Enum4Linux CredsEnum4Linux is a tool for enumerating information from Windows and Samba systems, using a number of different techniques. The following command will attempt to … LinuxEnumerationUsernamePassword
• enum4linux ngenum4linux-ng is a modern reimplementation of enum4linux written in Python3. It is used to enumerate information from Windows and Samba systems, providing … LinuxEnumerationNo_Creds
• Enum4Linux NoCredsEnum4Linux is a tool for enumerating information from Windows and Samba systems, using a number of different techniques. The following command will attempt to … LinuxEnumerationNo_Creds
• Evil WinRMEvil-WinRM uses the Windows Management Instrumentation (WMI) to give you an interactive shell on the Windows host. Command Reference: Target IP: 10.10.10.1 … LinuxWindowsExploitationPasswordUsername
• Evil Winrm PKINITEvil-WinRM uses the Windows Management Instrumentation (WMI) to give you an interactive shell on the Windows host. Winrm Supports PKINIT, meaning if you have a … WindowsExploitationPFX
• Evil WinRM PTHEvil-WinRM uses the Windows Management Instrumentation (WMI) to give you an interactive shell on the Windows host. Evil-WinRM supports passing the victim's NT … LinuxWindowsExploitationUsernameHash
• FindUncommonSharesThe script FindUncommonShares.py is a Python equivalent of PowerView's Invoke-ShareFinder.ps1 allowing to quickly find uncommon shares in vast Windows Domains. … LinuxWindowsEnumerationPasswordUsernameHash
• Impacket addcomputer LDAPSImpacket's addcomputer.py will add a computer account to the domain and set its password. The following command will create a new computer over LDAPS. Plain … LinuxWindowsExploitationPersistenceUsernamePassword
• Impacket addcomputer SMBImpacket's addcomputer.py will add a computer account to the domain and set its password. The following command will create a new computer over the SMB by … LinuxWindowsExploitationPersistenceUsernamePassword
• Impacket atexec CredsImpacket's atexec.py uses the Task Scheduler service on the remote Windows host to execute the given command. It will create a windows task with a random name, … LinuxWindowsExploitationPasswordUsername
• Impacket atexec HashImpacket's atexec.py uses the Task Scheduler service on the remote Windows host to execute the given command. It will create a windows task with a random name, … LinuxWindowsExploitationHashUsername
• Impacket DCOMExecImpacket's dcomexec.py provides an interactive shell on the Windows host similar to wmiexec.py, but using varying DCOM endpoints. Currently supports … LinuxWindowsExploitationPasswordUsername
• Impacket Get GPPPasswordPython script to automatically extract and decrypt Group Policy Preferences (GPP) passwords using streams for carving files instead of mounting shares Command … LinuxWindowsExploitationEnumerationPasswordUsername
• Impacket GetADUsersImpacket's GetADUsers.py will attempt to gather data about the domain's users and their corresponding email addresses. Command Reference: Target IP: … LinuxWindowsEnumerationUsernamePassword
• Impacket GetNPUsersImpacket's GetNPUsers.py will attempt to harvest the non-preauth AS_REP responses for a given list of usernames. These responses will be encrypted with the … LinuxWindowsExploitationUsername
• Impacket getST CredsImpacket's getST.py will request a Service Ticket and save it as ccache. If the account has constrained delegation privileges, you can use the `-impersonate` … LinuxWindowsExploitationPrivEscPersistenceUsername
• Impacket getST HashImpacket's getST.py will request a Service Ticket and save it as ccache. If the account has constrained delegation privileges, you can use the `-impersonate` … LinuxWindowsExploitationPrivEscPersistenceHash
• Impacket getTGTImpacket's getTGT.py uses a valid user's NTLM hash to request Kerberos tickets, in order to access any service or machine where that user has permissions. … LinuxWindowsExploitationHashUsername
• Impacket GetUserSPNsImpacket's GetUserSPNs.py will attempt to fetch Service Principal Names that are associated with normal user accounts. What is returned is a ticket that is … LinuxWindowsExploitationPasswordUsername
• Impacket GoldenTicketImpacket's ticketer.py can perform Golden Ticket attacks, which crafts a valid TGT ticket using a valid user's NTLM hash. It is then possible to access any … LinuxWindowsExploitationPersistenceUsernameHash
• Impacket LookUpSIDImpacket's lookupsid.py performs bruteforcing of Windows SID's to identify users/groups on the remote target. Command Reference: Target IP: 10.10.10.1 … LinuxWindowsEnumerationPasswordUsername
• Impacket NTLMRelayXImpacket's ntlmrelayx.py performs NTLM Relay Attacks, creating an SMB and HTTP server and relaying credentials to various different protocols (SMB, HTTP, LDAP, … LinuxWindowsExploitationNo_Creds
• Impacket NTLMRelayX SocksImpacket's ntlmrelayx.py performs NTLM Relay Attacks, creating an SMB and HTTP server and relaying credentials to various different protocols (SMB, HTTP, LDAP, … LinuxWindowsExploitationNo_Creds
• Impacket NTLMRelayX WPADImpacket's ntlmrelayx.py performs NTLM Relay Attacks, creating an SMB and HTTP server and relaying credentials to various different protocols (SMB, HTTP, LDAP, … LinuxWindowsExploitationNo_Creds
• Impacket PsExecImpacket's psexec.py offers psexec like functionality. This will give you an interactive shell on the Windows host. Command Reference: Target IP: 10.10.10.1 … LinuxWindowsExploitationPasswordUsername
• Impacket PsExec PassTheTicketImpacket's psexec.py offers psexec like functionality. This will give you an interactive shell on the Windows host. psexec.py also allows using Service Tickets, … LinuxWindowsExploitationTGSUsername
• Impacket RBCDImpacket rbcd.py will modify the msDS-AllowedToActOnBehalfOfOtherIdentity property of a target computer with security descriptor of another computer. The … LinuxWindowsExploitationPrivEscPersistenceUsername
• Impacket RegImpacket's reg.py is a remote registry manipulation tool, providing similar functionality to reg.exe in Windows. Command Reference: Target IP: 10.10.10.1 … LinuxWindowsExploitationPersistencePasswordUsername
• Impacket RPCDumpImpacket's rpcdump.py enumerates Remote Procedure Call (RPC) endpoints. Command Reference: Target IP: 10.10.10.1 Domain: test.local Username: john … LinuxWindowsEnumerationPasswordUsername
• Impacket SAMRDumpImpacket's samrdump.py communicates with the Security Account Manager Remote (SAMR) interface to list system user accounts, available resource shares, and other … LinuxWindowsEnumerationPasswordUsername
• Impacket SecretsDumpImpacket's secretsdump.py will perform various techniques to dump secrets from the remote machine without executing any agent. Techniques include reading SAM … LinuxWindowsExploitationPasswordUsername
• Impacket SecretsDump NTDSImpacket's secretsdump.py will perform various techniques to dump secrets from the remote machine without executing any agent. Techniques include reading SAM … LinuxWindowsExploitationPasswordUsername
• Impacket ServicesImpacket's services.py communicates with Windows services using the MSRPC interface. It can perform many different actions on any service. Command Reference: … LinuxWindowsEnumerationPasswordUsername
• Impacket SilverTicketImpacket's ticketer.py can perform Silver Ticket attacks, which crafts a valid TGS ticket for a specific service using a valid user's NTLM hash. It is then … LinuxWindowsExploitationPersistenceUsernameHash
• Impacket SMBClientImpacket's smbclient.py is a generic smbclient, allowing you to list shares and files, rename, upload and download files and create and delete directories. … LinuxWindowsEnumerationPasswordUsername
• Impacket SMBExecImpacket's smbexec.py. This will give you an interactive shell on the Windows host. Command Reference: Target IP: 10.10.10.1 Domain: test.local Username: … LinuxWindowsExploitationPasswordUsername
• Impacket WMIExecImpacket's wmiexec.py uses the Windows Management Instrumentation (WMI) to give you an interactive shell on the Windows host. Command Reference: Target IP: … LinuxWindowsExploitationPasswordUsername
• Kerbrute BruteForceropnop's kerbrute bruteforces and enumerates valid Active Directory accounts through Kerberos Pre-Authentication. The following command will attempt to brute … LinuxEnumerationNo_Creds
• Kerbrute BruteUserropnop's kerbrute bruteforces and enumerates valid Active Directory accounts through Kerberos Pre-Authentication. The following command will bruteforce an … LinuxWindowsEnumerationUsername
• Kerbrute PasswordSprayropnop's kerbrute bruteforces and enumerates valid Active Directory accounts through Kerberos Pre-Authentication. The following command will perform a password … LinuxWindowsEnumerationUsername
• Kerbrute UserEnumropnop's kerbrute bruteforces and enumerates valid Active Directory accounts through Kerberos Pre-Authentication. The following command will attempt to … LinuxWindowsEnumerationNo_Creds
• LDAPSearch Credsldapsearch is a Linux based tool that opens a connection to an LDAP server, binds, and performs a search using specified parameters. The following command will … LinuxEnumerationUsernamePassword
• LDAPSearch NoCredsldapsearch is a Linux based tool that opens a connection to an LDAP server, binds, and performs a search using specified parameters. The following command will … LinuxEnumerationNo_Creds
• lsassy credsdump"lsassy is a tool written in python released in 2021 to provide a varity of methods to dump credintials from a single/multiple remote targets. It uses a varity … LinuxExploitationUsernamePassword
• Mitm6mitm6 is a pentesting tool that exploits the default configuration of Windows to take over the default DNS server. It does this by replying to DHCPv6 messages, … LinuxWindowsExploitationNo_Creds
• NetExec Creds coerce plus"NetExec (a.k.a nxc) is a network pentesting suite that has many modules that can be listed via nxc -L. The coerece_plus module will enumarate a target ip, … LinuxWindowsEnumerationPrivilidge EscalationExploitationLaterl movement
• NetExec Enum LDAP"NetExec (a.k.a nxc) is a network service exploitation tool that helps automate assessing the security of large networks." - https://www.netexec.wiki/. This … LinuxEnumerationUsernamePassword
• NetExec Enum SMB"NetExec (a.k.a nxc) is a network service exploitation tool that helps automate assessing the security of large networks." - https://www.netexec.wiki/. This … LinuxEnumerationUsernamePassword
• NetExec Enum SMB Anonymous"NetExec (a.k.a nxc) is a network service exploitation tool that helps automate assessing the security of large networks." - https://www.netexec.wiki/. This … LinuxEnumerationNo_Creds
• NetExec Enum SMB Null"NetExec (a.k.a nxc) is a network service exploitation tool that helps automate assessing the security of large networks." - https://www.netexec.wiki/. This … LinuxEnumerationNo_Creds
• NetExec Enum SMB Relay List"NetExec (a.k.a nxc) is a network service exploitation tool that helps automate assessing the security of large networks." - https://www.netexec.wiki/. The … LinuxEnumerationNo_Creds
• NetExec Exec SMB"NetExec (a.k.a nxc) is a network service exploitation tool that helps automate assessing the security of large networks." - https://www.netexec.wiki/. This … LinuxExploitationUsernamePassword
• NetExec LDAP ASREPRoastingNetExec (formerly CrackMapExec) performs an AS-REP Roasting attack via the LDAP service. This command attempts to enumerate domain accounts that do not require … LinuxWindowsCredential AccessAS-REP RoastingUsernameHash
• NetExec LDAP KerberoastingNetExec (formerly CrackMapExec) performs a Kerberoasting attack via the LDAP service. This command authenticates with the given domain account, enumerates … LinuxWindowsCredential AccessKerberoastingUsernamePassword
• NetExec SMB Password Spray"NetExec (a.k.a nxc) is a network service exploitation tool that helps automate assessing the security of large networks." - https://www.netexec.wiki/. This … LinuxExploitationUsername
• NetExec SMB TimeroastingNetExec (formerly CrackMapExec) performs a Timeroasting attack via the SMB service. This command targets the remote Windows host and abuses the Kerberos … LinuxWindowsCredential AccessTimeroastingHashUsername
• Nmap Krb5 Enum UsersNmap's `krb5-enum-users` script attempts to bruteforce and enumerate valid Active Directory accounts through Kerberos Pre-Authentication. The following command … LinuxWindowsEnumerationNo_Creds
• PetitPotamPetitPotam leverages the MS-EFSRPC API to connect to a Windows host, hijack the authentication session, and trigger an authentication from the target host to an … LinuxWindowsExploitationPasswordUsername
• PKINIT getnthashPKINIT getnthash.py request a TGS for yourself using Kerberos U2U. This will include with the PAC which in turn contains the NT hash that you can decrypt with … LinuxWindowsExploitationPrivEscTGT
• PKINIT gettgtpkinitPKINIT gettgtpkinit.py request a TGT using a PFX file, either as file or as base64 encoded blob, or PEM files for cert+key. This uses Kerberos PKINIT and will … LinuxWindowsExploitationPrivEscUsernamePassword
• Powershell ADModule enumThe Active Directory Module from powershell can be used to preform most needed enumaration tasks as well as some exploitation tasks revoling around … WindowsDiscoveryCredential Access
• PSADmodule KerbaroastingKerberoasting is the act of requesting service tickes for accounts that have an SPN set, and then attempting to crack those hashes offline. This one liner … WindowsExploitationpowershell
• PwshADmodule DelegationAttack EnumHaving imported the pwsh AD module referenced in the project, we can begin to use it to enumerate for potential points of exploit one of the prime being … WindowsEnumerationPowerShell
• PwshADmodule Initial EnumThese commands provide a quick refernece for using the AD module to get situational awerness of the AD environment. Note that to get more commands that you can … WindowsEnumeration
• PyLDAPmonitorldapmonitor.py allows you to monitor creation, deletion and changes to LDAP objects live during your pentest. Command Reference: Target IP: 10.10.10.1 … LinuxEnumerationPasswordUsernameHash
• PyWhiskerpyWhisker is a tool allowing users to manipulate the msDS-KeyCredentialLink attribute of a target user/computer to obtain full control over that object. It's … LinuxExploitationPasswordUsername
• Regexe PersistenceIt is possible to gain persistence on a windows machine by adding reg keys that will execute an arbitrary payload during logon or startup. Keys added to the … WindowsPersistenceShell
• Responder AnalyzeResponder is an LLMNR, NBT-NS, and MDNS poisoner. It will answer to specific NBT-NS (NetBIOS Name Service) queries based on their name suffix. By default, the … LinuxWindowsExploitationNo_Creds
• RPCClient Anonymousrpcclient is a tool used for executing client side MS-RPC functions to manage Windows NT clients from Unix workstatios. From an offensive security standpoint, … LinuxEnumerationNo_Creds
• Rubeus AskTGTRubeus' `asktgt` module uses a valid user's NTLM hash to request Kerberos tickets, in order to access any service or machine where that user has permissions. … WindowsExploitationHashUsername
• Rubeus ASREPRoastRubeus' `asreproast` module will attempt to harvest the non-preauth AS_REP responses for a given list of usernames. These responses will be encrypted with the … WindowsExploitationPrivEscShell
• Rubeus BruteRubeus' `brute` module bruteforces and enumerates valid Active Directory accounts through Kerberos Pre-Authentication. The following command will attempt to … WindowsEnumerationNo_Creds
• Rubeus KerberoastRubeus' `kerberoast` module will attempt to fetch Service Principal Names that are associated with normal user accounts. What is returned is a ticket that is … WindowsExploitationPrivEscShell
• Rubeus s4uRubeus' `s4u` module performs Kerberos constrained delegation attacks using the S4U2Self and S4U2Proxy. This technique abuses accounts configured with … WindowsExploitationLateral MovementPrivilidge EscalationHashUsername
• SafetyKatzSafetyKatz.exe is part of the GhostPack suite of tools and is a combination of SharpDump and Mimikatz. The following command will dump the LSASS process and run … WindowsPrivEscEnumerationShell
• SeatbeltSeatbelt.exe is part of the GhostPack suite of tools that will perform a lot of "safety checks" on the Windows host and collect system data that could be useful … WindowsPrivEscPersistenceShell
• SharpDumpSharpDump.exe is part of the GhostPack suite of tools and is a C# port of PowerSploit's Out-Minidump.ps1. It can dump the process for LSASS or a specific … WindowsPrivEscEnumerationShell
• SharpHoundSharpHound.exe and SharpHound.ps1 are the official data collector for BloodHound, written in C# or Powershell and uses Windows API functions and LDAP namespace … WindowsPrivEscEnumerationShell
• SharpHound LDAPSharpHound.exe is the official data collector for BloodHound, written in C# and uses Windows API functions and LDAP namespace functions to collect data from … WindowsPrivEscEnumerationShellUsernamePassword
• SharpLDAPmonitorSharpLDAPmonitor.exe allows you to monitor creation, deletion and changes to LDAP objects live during your pentest. Command Reference: Target IP: 10.10.10.1 … WindowsEnumerationPasswordUsername
• SharpUpSharpUp.exe is part of the GhostPack suite of tools and is a C# port of PowerUp that will perform numerous privilege escalation checks. The following command … WindowsPrivEscShell
• SharpWMISharpWMI.exe is part of the GhostPack suite of tools that provides WMI functionality, such as local/remote WMI queries, remote WMI process creation, and remote … WindowsPersistenceShell
• SiftSift finds credentials, secrets and sensitive files on accessible SMB shares. This command discovers domain computers over LDAP and scans their shares using the … WindowsEnumerationUsernamePassword
• Sift LocalSift finds credentials, secrets and sensitive files on local filesystems. This command scans the C: drive and writes the findings to a log. Command Reference: … WindowsEnumerationShell
• Sift Network CredsSift can scan SMB hosts without Active Directory discovery. This command scans a subnet using domain credentials. Command Reference: Target Subnet: … WindowsEnumerationUsernamePassword
• Sift Network PTHSift supports NTLMv2 pass-the-hash for targeted SMB scans. This command scans one Windows host using a username and NT hash. Command Reference: Target IP: … WindowsEnumerationUsernameHash
• SMBClient Enum ShareSmbclient is a tool used to communicate with SMB servers. The following command will connect to an SMB share `C$` using valid credentials. Command Reference: … LinuxEnumerationUsernamePassword
• SMBClient Enum Share AnonymousSmbclient is a tool used to communicate with SMB servers. The following command will connect to an SMB share `public` using anonymous login. Command Reference: … LinuxEnumerationNo_Creds
• SMBClient List Share PTHSmbclient is a tool used to communicate with SMB servers. The following command will list out all available shares on the target ip using user John hash on test … LinuxEnumerationUsernameHash
• SMBClient List SharesSmbclient is a tool used to communicate with SMB servers. The following command will list out all available shares on the target server using valid credentials. … LinuxEnumerationUsernamePassword
• SMBClient List Shares AnonymousSmbclient is a tool used to communicate with SMB servers. The following command will list out all available shares on the target server using anonymous login. … LinuxEnumerationNo_Creds
• SMBMap Enum FileSMBMap is a tool used to enumerate SMB share drives, including listing share drive permissions, share contents, upload/download functionality, file name … LinuxWindowsEnumerationUsernamePassword
• SMBMap Enum ShareSMBMap is a tool used to enumerate SMB share drives, including listing share drive permissions, share contents, upload/download functionality, file name … LinuxWindowsEnumerationUsernamePassword
• SMBMap Enum Share AnonymousSMBMap is a tool used to enumerate SMB share drives, including listing share drive permissions, share contents, upload/download functionality, file name … LinuxWindowsEnumerationNo_Creds
• SnafflerSnaffler is a tool used to enumerate sensitive data (passwords, PII, etc.) from file shares in Active Directory. It searches for interesting files based on file … WindowsEnumerationShell
• targetedKerberoasttargetedKerberoast is a Python script that can, like many others (e.g. GetUserSPNs.py), print "kerberoast" hashes for user accounts that have a SPN set. This … LinuxExploitationPasswordUsername
• Windapsearchwindapsearch enumerates users, groups, and computers from a Windows domain through LDAP queries. The following command enumerates all 3 of the above mentioned … LinuxWindowsEnumerationUsernamePassword
• winPEASwinpeas.exe is a script that will search for all possible paths to escalate privileges on Windows hosts. The below command will run all priv esc checks and … WindowsPrivEscShell

no matches