SUMMARY.md

Table of Contents

⚒️ Pentest

• C2
  • Covenant
  • Empire
  • Havoc
  • Meterpreter
  • PoshC2
  • Sliver
• Infrastructure
  • AD
    • ACL Abuse
    • AD CS Abuse
      • dNSHostName Spoofing (Certifried)
      • ESC1
      • ESC4
      • ESC8
      • ESC15
      • Golden Certificate
    • ADIDNS Abuse
    • Attack Trusts
    • Attack RODCs
    • AV / EDR Evasion
      • .NET Assembly
        • .NET Config Loader
        • .NET Dynamic API Invocation
        • .NET In-Memory Assembly
        • .NET Reflective Assembly
      • AMSI Bypass
      • Application Whitelist Bypass
      • AppLocker Bypass
      • BYOVD
      • CLM Bypass
      • Defender
      • ETW Block
      • Execution Policy Bypass
      • KIS / KES
      • Mimikatz
      • UAC Bypass
    • Authentication Coercion
    • Credentials Harvesting
      • From Memory
        • lsass.exe
        • svchost.exe
      • Credential Phishing
      • DCSync
      • DPAPI
      • KeePass
      • Linux
      • LSA
      • NetSync
      • NPLogonNotify
      • NTDS
      • Password Filter
      • RDP
      • RPC
      • SAM
      • SSH Clients
      • SSPI
    • Discovery
    • DnsAdmins
    • Dominance
    • GPO Abuse
    • Kerberos
      • Delegation Abuse
        • Constrained
        • Resource-based Constrained
        • Unconstrained
      • Kerberos Relay
      • Roasting
    • Key Credentials Abuse
    • LAPS
    • Lateral Movement
      • Overpass-the-Hash
      • Pass-the-Hash
      • Pass-the-Ticket
      • RDP
      • RPC
      • RunAs
      • SMB
      • SPN-jacking
      • WinRM / PSRemoting
      • WMI
    • LDAP
    • NTLM
      • NTLM Relay
      • NTLMv1 Downgrade
    • Password Spraying
    • Post Exploitation
    • Pre-created Computers Abuse
    • PrivExchange
    • Privileges Abuse
      • SeBackupPrivilege & SeRestorePrivilege
      • SeImpersonatePrivilege
        • Potatoes
        • PrintSpoofer
      • SeTrustedCredmanAccess
    • RID Cycling
    • SCCM Abuse
    • SMB
    • RPC
    • Token Manipulation
    • User Hunt
    • WSUS
    • Zerologon
  • Azure AD
    • On-Prem ↔ Cloud
      • Cloud → On-Prem
      • On-Prem → Cloud
    • PRT Abuse
  • DevOps
    • Ansible
    • Artifactory
    • Atlassian
    • Containerization / Orchestration
    • GitLab
    • Jenkins
    • Zabbix
  • DBMS
    • FireBird
    • MS SQL
    • MySQL / MariaDB
    • Oracle
    • Redis
    • SQLite
  • Authentication Brute Force
  • File Transfer
  • IPMI
  • Kiosk Breakout
  • Low-Hanging Fruits
  • LPE
  • Networks
    • L2
      • ARP Spoofing
      • DHCPv6 Spoofing
      • LLMNR / NBNS Poisoning
      • SNACs Abuse
      • VLAN Hopping
    • NAC Bypass
    • Scanning
    • SIP / VoIP
    • Sniff Traffic
  • NFS
  • Persistence
  • Pivoting
  • Post Exploitation
  • SNMP
  • SSH
  • TFTP
  • VNC
• OSINT
  • Shodan
• Password Brute Force
  • Generate Wordlists
• Perimeter
  • 1C
  • ADFS
  • Cisco
  • DNS
  • Exchange
  • Information Gathering
  • IPSec
  • Java RMI
  • Log4j / Log4Shell
  • Lync & Skype for Business
  • NTP
  • Outlook
  • OWA
  • SharePoint
  • SMTP
  • SSH
  • Subdomain Takeover
• Shells
  • Reverse Shells
  • Web Shells
• Web
  • 2FA Bypass
  • LFI / RFI
  • SOP / CORS
  • SQLi
  • WAF
  • WordPress
  • XSS
• Wi-Fi
  • WPA / WPA2
    • Enterprise
    • Personal

⚔️ Red Team

• Basics
• Cobalt Strike
  • UDRL
• Infrastructure
• MalDev
  • API Hashing
  • API Hooking
  • BOF / COFF
  • Code Injection
    • DLL Injectors
    • Process Hollowing
    • Process Injectors
    • Shellcode Runners
  • DLL Hijacking
  • Golang
  • Kernel Mode
  • PIC / Shellcode
  • Nim
  • Sandbox Evasion
  • Syscalls
  • Windows API
• SE
  • Phishing
    • HTML Smuggling
    • MS Office
    • Rogue RDP

🐞 Exploit Dev

• BOF
  • OSCP BOF
  • OSED SEH Overflow
• RE
• WinDbg

⚙️ Admin

• Git
• Linux
  • Kali
• Networking
  • DHCP Server & Linux Hotspot
  • Quick Configurations
  • Routing
  • WireGuard
• Virtualization
  • Docker
  • Hyper-V
  • VirtualBox
  • VMWare
• Windows