Skip to content

Knowledge Base

Battle-tested attack playbooks and methodologies — the offensive techniques that carry an engagement from the first packet to full domain dominance.

Knowledge Base Categories (8 Categories)
01 / RECON

Reconnaissance

Network footprinting, port scanning, OSINT, and web surface enumeration to map the target infrastructure.

23 Topics

Network Footprinting

SMTP IMAP & POP3 SNMP MySQL MSSQL Oracle TNS IPMI DNS NFS SMB FTP

Information Gathering - Web

Web Recon Overview WHOIS Digging DNS Subdomains Zone Transfers Virtual Hosts Fingerprinting Crawling Search Engines Web Archives Automation CT Logs
02 / WEB

Web Attacks

File upload vulnerabilities, injection flaws, and deep dives into web application exploitation techniques.

34 Topics

File Upload Attacks

Overview Fingerprinting Absent Validation Weaponization Client Validation Blacklists Whitelists MIME Filters Limited Uploads Prevention Cheatsheet

SQL Injection

Theory Overview Logic Subversion Discovery In-Band SQLi Blind SQLi Out-of-Band Advanced WAF Bypass Cheatsheet SQLMap Guide

Attacking with Ffuf

Overview Directory Fuzzing Extensions Pages Recursive Subdomains VHosts GET Params POST Params Cheatsheet
03 / APPS

Attacking Common Applications

Targeting enterprise web apps, CMS platforms, WordPress, custom portals, and administrative suites.

2 Topics

Enterprise Applications

App Discovery & Enumeration Attacking WordPress
04 / CREDENTIALS

Credential Attacks

Password cracking, credential hunting, Pass-the-Hash, Pass-the-Ticket, and dumping hashes from SAM/NTDS.

27 Topics

Password Cracking

John the Ripper Hashcat Wordlists & Rules Protected Files Archives

Windows Credential Extraction

Windows Auth SAM & SYSTEM Attacking LSASS Cred Manager NTDS.dit Cred Hunting

Lateral Movement & Relay

Pass the Hash PtT (Windows) PtT (Linux) Pass the Cert NTLM Coercion Hash Theft & Relay
05 / ACTIVE DIRECTORY

Active Directory

The complete AD pentesting playbook: LLMNR poisoning, Kerberoasting, ADCS escalation, and Golden Tickets.

31 Topics

Initial Access & Enumeration

LLMNR Poisoning SMB Relay mitm6 BloodHound ldapdomaindump PingCastle

Domain Exploitation & ADCS

Kerberoasting GPP Attacks Token Impersonation Mimikatz ADCS ESC Overview Golden Certificate Golden Ticket
06 / FRAMEWORKS

Exploitation Frameworks

Mastering Metasploit, managing payloads with MSFVenom, handling sessions, and writing custom modules.

13 Topics

Metasploit Framework

MSFconsole Modules Targets Payloads Encoders Databases Plugins & Mixins Sessions & Jobs Meterpreter Module Writing MSFVenom IDS/Evasion
07 / PIVOTING

Pivoting, Tunneling & Port Forwarding

SSH tunneling, SOCKS proxies, Socat relays, Chisel, DNS/ICMP tunneling, double pivots, and detection evasion.

11 Topics

Core Techniques

SSH & Meterpreter Socat Relays Pivoting Tools Advanced Tunneling Double Pivots Detection Evasion

Tool Deep Dives

Ligolo-ng Proxychains SSH Tunneling sshuttle
08 / WIN PRIVESC

Windows Privilege Escalation & Access Control

Windows access control architecture, tokens, SIDs, integrity levels, privilege mechanics, service hardening, and credential security.

14 Modules

Privileges & Groups

Quick Decision Guide SeImpersonate (Potato Attacks) SeDebug (LSASS Dumping) SeBackup & SeRestore SeTakeOwnership & SeLoadDriver Group Privileges (DnsAdmins, Server Ops)

OS & Services

Quick Decision Guide Unquoted Service Paths Weak Service Permissions DLL Hijacking AlwaysInstallElevated & Tasks UAC Bypass Kernel Exploits

Credentials & Environment

Quick Decision Guide Credential Hunting Environment Breakouts Tools & Enumeration
!!! tip "Methodology Structure" Each playbook follows a consistent workflow: 1. **Reconnaissance** — Port scanning, service and protocol enumeration 2. **Foothold** — Initial access and exploitation 3. **Privilege Escalation** — Escalating toward Domain Admin 4. **Key Takeaways** — Detection, mitigation, and lessons learned